ogurexxx@root:~$ tail -f /var/log/honeypot

Honeypot live feed

This server runs a honeypot: it pretends to be a defenceless Linux box and lets almost any password in. Below are real sessions of bots that “hacked” it in the last day, annotated with what each command means in MITRE ATT&CK terms. There is no real system behind it — the bots are talking to a stage set.

bot · SSH-2.0-Go · 2026-10-30 00:32

root@srv-backup01:~# /bin/./uname -s -v -n -r -m

# T1082 · System Information Discovery

session took 0 s

# watch it in your own terminal: asciinema play https://ogurexxx.ru/live/latest.cast

Botnet families

# threat feed: JSON · STIX 2.1 (MISP, OpenCTI) · RSS

Attackers that behave identically — the same chain of commands — are most likely parts of one botnet. Only families seen from at least three different addresses in the last 7 days are shown.

SSH key implant `sshkey-3bfa`

105 addresses · 110 sessions · s 28.10

Adds its own SSH key to come back later without a password.

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~

T1098.004 T1222.002

SSH-2.0-libssh_0.9.6 · SSH-2.0-libssh_0.11.1

▶ sshkey-3bfa.cast

Scout `recon-90e6`

5 addresses · 202 sessions · s 29.10 · active today

Only looks around — what system, how many cores — and leaves.

$ /bin/./uname -s -v -n -r -m

T1082

SSH-2.0-Go

▶ recon-90e6.cast

Scout `recon-5552`

5 addresses · 5907 sessions · s 28.10

Only looks around — what system, how many cores — and leaves.

$ uname -s -v -n -r -m

T1082

SSH-2.0-Go

▶ recon-5552.cast

Loader `loader-e884`

3 addresses · 66 sessions · s 28.10

Downloads and runs a program — usually a botnet client.

$ sh -c <arg>
$ sh -c <arg>
$ sh -c <arg>
$ sh -c <arg>

T1059.004 T1222.002

SSH-2.0-Go

▶ loader-e884.cast

SSH key implant `sshkey-b6c8`

3 addresses · 3 sessions · s 29.10

Adds its own SSH key to come back later without a password.

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~
$ cat /proc/cpuinfo | grep name | wc -l
$ echo <str> | chpasswd | bash
$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.
$ cat /proc/cpuinfo | grep name | head -n 1 | awk <str>
$ free -m | grep <arg> | awk <str>
$ ls -lh <arg> <arg>

T1033 T1053.003 T1057 T1059.004 T1082 T1083 T1098 T1098.004 T1222.002 T1489

SSH-2.0-libssh_0.9.6 · SSH-2.0-libssh_0.11.1

▶ sshkey-b6c8.cast

How it works: commands are sanitized — links, addresses, quoted strings and random file names are replaced with tags like <url> and <file>, unknown programs are hidden. Attacker IP addresses are never published. The summary of all attacks is on Statistics. Test yourself on a real session — Weekly investigation.