Xin chào, mình là Kris Pham 👋

38 connections hit the honeypot on 2026-10-29, from 29 unique IP(s).

Top source IPs

113.192.12.34 — 2 connections
34.38.81.253 — 2 connections
189.239.26.55 — 2 connections
185.247.137.119 — 2 connections
154.200.239.213 — 2 connections

Commands attempted

/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo
ps | grep '[Mm]iner'
ps -ef | grep '[Mm]iner'
ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
locate D877F783D5D3EF8Cs
echo Hi | cat -n

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

49 connections hit the honeypot on 2026-10-30, from 34 unique IP(s).

Top source IPs

2.57.122.150 — 3 connections
165.154.41.232 — 3 connections
200.104.61.214 — 2 connections
146.190.214.220 — 2 connections
181.78.23.72 — 2 connections

Commands attempted

sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_control'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a'"'"''
printf '\n%s|%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_control' 'check_24d7b16304efe0e2fb097c752c895b5a'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_math'"'"' "$((459*817+23))"'
printf '\n%s|%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_math' "$((459*817+23))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_pid' "$$"
sh -c 'set -- '"'"'check_24d7b16304efe0e2fb097c752c895b5a_arg1'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_positional'"'"' "$#|$1|$2"'
set -- 'check_24d7b16304efe0e2fb097c752c895b5a_arg1' 'check_24d7b16304efe0e2fb097c752c895b5a_arg2'; printf '\n%s|%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_positional' "$#|$1|$2"
sh -c 'f_check_24d7b16304efe0e2fb097c752c895b5a() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_function'"'"' "$1|$#"; }; f_check_24d7b16304efe0e2fb097c752c895b5a '"'"'check_24d7b16304efe0e2fb097c752c895b5a_function_value'"'"''
f_check_24d7b16304efe0e2fb097c752c895b5a() { printf '\n%s|%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_function' "$1|$#"; }; f_check_24d7b16304efe0e2fb097c752c895b5a 'check_24d7b16304efe0e2fb097c752c895b5a_function_value'
sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_24d7b16304efe0e2fb097c752c895b5a_small_done'"'"''
printf '\n%s\n' 'check_24d7b16304efe0e2fb097c752c895b5a_small_done'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_control'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2'"'"''
printf '\n%s|%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_control' 'check_463ea4cbd32b35b8f804909dc90f3cf2'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_math'"'"' "$((37*566+38))"'
printf '\n%s|%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_math' "$((37*566+38))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_pid' "$$"
sh -c 'set -- '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_arg1'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_positional'"'"' "$#|$1|$2"'
set -- 'check_463ea4cbd32b35b8f804909dc90f3cf2_arg1' 'check_463ea4cbd32b35b8f804909dc90f3cf2_arg2'; printf '\n%s|%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_positional' "$#|$1|$2"
sh -c 'f_check_463ea4cbd32b35b8f804909dc90f3cf2() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_function'"'"' "$1|$#"; }; f_check_463ea4cbd32b35b8f804909dc90f3cf2 '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_function_value'"'"''
f_check_463ea4cbd32b35b8f804909dc90f3cf2() { printf '\n%s|%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_function' "$1|$#"; }; f_check_463ea4cbd32b35b8f804909dc90f3cf2 'check_463ea4cbd32b35b8f804909dc90f3cf2_function_value'
sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_463ea4cbd32b35b8f804909dc90f3cf2_small_done'"'"''
printf '\n%s\n' 'check_463ea4cbd32b35b8f804909dc90f3cf2_small_done'
echo; echo 'check_9cbb9064289951ee43c457a159d4f39b_transport_done'
echo 'check_617a86042bf429d565d3de368e3a6272_small_control|check_617a86042bf429d565d3de368e3a6272'
echo 'check_617a86042bf429d565d3de368e3a6272_small_math|'"$((30*615+26))"
echo 'check_617a86042bf429d565d3de368e3a6272_small_pid|'"$$"
set -- 'check_617a86042bf429d565d3de368e3a6272_arg1' 'check_617a86042bf429d565d3de368e3a6272_arg2'; echo 'check_617a86042bf429d565d3de368e3a6272_small_positional|'"$#|$1|$2"
f_check_617a86042bf429d565d3de368e3a6272() { echo 'check_617a86042bf429d565d3de368e3a6272_small_function|'"$1|$#"; }; f_check_617a86042bf429d565d3de368e3a6272 'check_617a86042bf429d565d3de368e3a6272_function_value'
echo 'check_617a86042bf429d565d3de368e3a6272_small_done'
echo 'check_217823ed02631e514057b4d74dd2da03_small_control|check_217823ed02631e514057b4d74dd2da03'
echo 'check_217823ed02631e514057b4d74dd2da03_small_math|'"$((593*279+33))"
echo 'check_217823ed02631e514057b4d74dd2da03_small_pid|'"$$"
set -- 'check_217823ed02631e514057b4d74dd2da03_arg1' 'check_217823ed02631e514057b4d74dd2da03_arg2'; echo 'check_217823ed02631e514057b4d74dd2da03_small_positional|'"$#|$1|$2"
f_check_217823ed02631e514057b4d74dd2da03() { echo 'check_217823ed02631e514057b4d74dd2da03_small_function|'"$1|$#"; }; f_check_217823ed02631e514057b4d74dd2da03 'check_217823ed02631e514057b4d74dd2da03_function_value'
echo 'check_217823ed02631e514057b4d74dd2da03_small_done'
echo; echo 'check_f0e203e1157e5108464200496755cdf9_transport_done'
echo '!root' | sudo -S sh -c 'chmod +x '\''/root/.16'\''' || echo '!root' | sudo -S chmod +x '/root/.16' || sh -c 'chmod +x '\''/root/.16'\''' || chmod +x '/root/.16'
chmod +x '/root/.16'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_small_control'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1'"'"''
printf '\n%s|%s\n' 'check_7e0027b679d9322522d5cfc53c521ee1_small_control' 'check_7e0027b679d9322522d5cfc53c521ee1'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_small_math'"'"' "$((353*257+53))"'
printf '\n%s|%s\n' 'check_7e0027b679d9322522d5cfc53c521ee1_small_math' "$((353*257+53))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_7e0027b679d9322522d5cfc53c521ee1_small_pid' "$$"
sh -c 'set -- '"'"'check_7e0027b679d9322522d5cfc53c521ee1_arg1'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_small_positional'"'"' "$#|$1|$2"'
set -- 'check_7e0027b679d9322522d5cfc53c521ee1_arg1' 'check_7e0027b679d9322522d5cfc53c521ee1_arg2'; printf '\n%s|%s\n' 'check_7e0027b679d9322522d5cfc53c521ee1_small_positional' "$#|$1|$2"
sh -c 'f_check_7e0027b679d9322522d5cfc53c521ee1() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_7e0027b679d9322522d5cfc53c521ee1_small_function'"'"' "$1|$#"; }; f_check_7e0027b679d9322522d5cfc53c521ee1 '"'"'check_7e0027b679d9322522d5cfc53c521ee1_function_value'"'"''
f_check_7e0027b679d9322522d5cfc53c521ee1() { printf '\n%s|%s\n' 'check_7e0027b679d9322522d5cfc53c521ee1_small_function' "$1|$#"; }; f_check_7e0027b679d9322522d5cfc53c521ee1 'check_7e0027b679d9322522d5cfc53c521ee1_function_value'

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

36 connections hit the honeypot on 2026-10-31, from 23 unique IP(s).

Top source IPs

52.53.236.170 — 8 connections
172.235.40.131 — 2 connections
195.211.252.154 — 2 connections
136.51.92.56 — 2 connections
139.19.117.131 — 2 connections

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

47 connections hit the honeypot on 2026-11-01, from 27 unique IP(s).

Top source IPs

139.19.117.131 — 7 connections
45.56.110.197 — 3 connections
185.247.137.34 — 2 connections
179.59.78.248 — 2 connections
98.10.82.140 — 2 connections

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

47 connections hit the honeypot on 2026-11-02, from 25 unique IP(s).

Top source IPs

139.19.117.131 — 7 connections
195.178.110.217 — 7 connections
181.27.89.154 — 2 connections
27.130.141.108 — 2 connections
200.106.187.27 — 2 connections

Commands attempted

sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_control'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a'"'"''
printf '\n%s|%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_control' 'check_3d923aaa3a9226eb64588330853f064a'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_math'"'"' "$((808*154+49))"'
printf '\n%s|%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_math' "$((808*154+49))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_pid' "$$"
sh -c 'set -- '"'"'check_3d923aaa3a9226eb64588330853f064a_arg1'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_positional'"'"' "$#|$1|$2"'
set -- 'check_3d923aaa3a9226eb64588330853f064a_arg1' 'check_3d923aaa3a9226eb64588330853f064a_arg2'; printf '\n%s|%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_positional' "$#|$1|$2"
sh -c 'f_check_3d923aaa3a9226eb64588330853f064a() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_function'"'"' "$1|$#"; }; f_check_3d923aaa3a9226eb64588330853f064a '"'"'check_3d923aaa3a9226eb64588330853f064a_function_value'"'"''
f_check_3d923aaa3a9226eb64588330853f064a() { printf '\n%s|%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_function' "$1|$#"; }; f_check_3d923aaa3a9226eb64588330853f064a 'check_3d923aaa3a9226eb64588330853f064a_function_value'
sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_3d923aaa3a9226eb64588330853f064a_small_done'"'"''
printf '\n%s\n' 'check_3d923aaa3a9226eb64588330853f064a_small_done'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_control'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01'"'"''
printf '\n%s|%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_control' 'check_4b960e6998ade0d8c45eddbb366e9d01'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_math'"'"' "$((408*717+48))"'
printf '\n%s|%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_math' "$((408*717+48))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_pid' "$$"
sh -c 'set -- '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_arg1'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_positional'"'"' "$#|$1|$2"'
set -- 'check_4b960e6998ade0d8c45eddbb366e9d01_arg1' 'check_4b960e6998ade0d8c45eddbb366e9d01_arg2'; printf '\n%s|%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_positional' "$#|$1|$2"
sh -c 'f_check_4b960e6998ade0d8c45eddbb366e9d01() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_function'"'"' "$1|$#"; }; f_check_4b960e6998ade0d8c45eddbb366e9d01 '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_function_value'"'"''
f_check_4b960e6998ade0d8c45eddbb366e9d01() { printf '\n%s|%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_function' "$1|$#"; }; f_check_4b960e6998ade0d8c45eddbb366e9d01 'check_4b960e6998ade0d8c45eddbb366e9d01_function_value'
sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_4b960e6998ade0d8c45eddbb366e9d01_small_done'"'"''
printf '\n%s\n' 'check_4b960e6998ade0d8c45eddbb366e9d01_small_done'
echo; echo 'check_a4fbd6b904757d0281198ada9df4c958_transport_done'
echo 'check_385ab5e87f182b43006507e3a24abb24_small_control|check_385ab5e87f182b43006507e3a24abb24'
echo 'check_385ab5e87f182b43006507e3a24abb24_small_math|'"$((469*983+71))"
echo 'check_385ab5e87f182b43006507e3a24abb24_small_pid|'"$$"
set -- 'check_385ab5e87f182b43006507e3a24abb24_arg1' 'check_385ab5e87f182b43006507e3a24abb24_arg2'; echo 'check_385ab5e87f182b43006507e3a24abb24_small_positional|'"$#|$1|$2"
f_check_385ab5e87f182b43006507e3a24abb24() { echo 'check_385ab5e87f182b43006507e3a24abb24_small_function|'"$1|$#"; }; f_check_385ab5e87f182b43006507e3a24abb24 'check_385ab5e87f182b43006507e3a24abb24_function_value'
echo 'check_385ab5e87f182b43006507e3a24abb24_small_done'
echo 'check_b571e554adf8e77760d3e2a8f190796f_small_control|check_b571e554adf8e77760d3e2a8f190796f'
echo 'check_b571e554adf8e77760d3e2a8f190796f_small_math|'"$((588*240+84))"
echo 'check_b571e554adf8e77760d3e2a8f190796f_small_pid|'"$$"
set -- 'check_b571e554adf8e77760d3e2a8f190796f_arg1' 'check_b571e554adf8e77760d3e2a8f190796f_arg2'; echo 'check_b571e554adf8e77760d3e2a8f190796f_small_positional|'"$#|$1|$2"
f_check_b571e554adf8e77760d3e2a8f190796f() { echo 'check_b571e554adf8e77760d3e2a8f190796f_small_function|'"$1|$#"; }; f_check_b571e554adf8e77760d3e2a8f190796f 'check_b571e554adf8e77760d3e2a8f190796f_function_value'
echo 'check_b571e554adf8e77760d3e2a8f190796f_small_done'
echo; echo 'check_1a18e1f36fc1a88d0e529c833968ade1_transport_done'
echo '!root' | sudo -S sh -c 'chmod +x '\''/root/.16'\''' || echo '!root' | sudo -S chmod +x '/root/.16' || sh -c 'chmod +x '\''/root/.16'\''' || chmod +x '/root/.16'
chmod +x '/root/.16'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_control'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7'"'"''
printf '\n%s|%s\n' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_control' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7'
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_math'"'"' "$((468*973+55))"'
printf '\n%s|%s\n' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_math' "$((468*973+55))"
sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_pid'"'"' "$$"'
printf '\n%s|%s\n' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_pid' "$$"
sh -c 'set -- '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_arg1'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_arg2'"'"'; printf '"'"'\n%s|%s\n'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_positional'"'"' "$#|$1|$2"'
set -- 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_arg1' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_arg2'; printf '\n%s|%s\n' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_positional' "$#|$1|$2"
sh -c 'f_check_8a22876ad7ddf7ebb807f7fcda3be6e7() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_function'"'"' "$1|$#"; }; f_check_8a22876ad7ddf7ebb807f7fcda3be6e7 '"'"'check_8a22876ad7ddf7ebb807f7fcda3be6e7_function_value'"'"''
f_check_8a22876ad7ddf7ebb807f7fcda3be6e7() { printf '\n%s|%s\n' 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_small_function' "$1|$#"; }; f_check_8a22876ad7ddf7ebb807f7fcda3be6e7 'check_8a22876ad7ddf7ebb807f7fcda3be6e7_function_value'

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

60 connections hit the honeypot on 2026-11-03, from 38 unique IP(s).

Top source IPs

139.19.117.131 — 3 connections
2.57.122.76 — 3 connections
180.73.235.41 — 3 connections
41.249.61.153 — 2 connections
190.175.9.82 — 2 connections

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.