HONEYPOT REPORT // SSH + WEB // 2026-04-01 – 2026-04-05

April 2026 — SSH + Web Honeypot Report

Period: 2026-04-01 – 2026-04-05 | Sensor: Cowrie v2.x (SSH + HTTP) | Host: VPS / RackNerd

SSH WEB ALERT REDTAIL

SSH CONNECTIONS

16,491

across 5 days

AUTH ATTEMPTS

12,050

5,213 succeeded

UNIQUE SSH IPs

1,921

top: 45.153.34.120

PAYLOAD DROPS

2,606

5 unique hashes

FILE UPLOADS

100

Redtail multi-arch

WEB REQUESTS

3,869

46 unique IPs

SSH connection volume by day

Apr 1

274

Apr 2

1,612

Apr 3

2,194

Apr 4

4,443

Apr 5

4,077

Apr 6*

3,891

*Apr 6 connections captured in Apr 5 log files (UTC rollover). Volume increased ~16x from Apr 1 to Apr 4 peak.

Executive summary

The five-day observation window from April 1–5 captured a rapidly escalating attack surface across both SSH and web honeypot sensors. SSH connection volume increased approximately 16x between day one and peak activity on April 4, suggesting either active scanning campaigns discovering the endpoint or coordinated botnet tasking. The dominant finding across both sensors is sustained Redtail botnet activity: the libredtail-http user agent was observed in 47 web requests across 14 unique IPs and correlates with SSH sessions from 130.12.180.51 that uploaded multi-architecture Redtail cryptominer binaries directly to the honeypot via SCP.

The most operationally significant SSH campaign involved a credential pair — root:3245gs5662d34 and 345gs5662d34:345gs5662d34 — accounting for over 4,500 login attempts combined, consistent with a credential-stuffing campaign using a known compromised list. Successful logins were followed by a scripted post-exploitation sequence: SSH authorized_keys backdooring with a key attributed to the mdrfckr threat cluster, hardware reconnaissance, and competitor botnet cleanup commands. A secondary actor class used direct TCPIP tunnel requests to probe external IPs including Cloudflare (1.1.1.1) and Yandex infrastructure, suggesting proxy or C2 routing behavior.

On the web side, 172.94.9.253 submitted 458 POST requests to /admin within a 17-second window using 14 rotating user agents against the router-admin.uk virtual host — consistent with automated credential stuffing tooling. Separately, 185.177.72.61 (UA: l9explore/1.2.2) repeatedly probed /admin/.git/config across multiple ports and days, consistent with automated recon for exposed Git repositories.

Cross-sensor finding: libredtail-http appears in both web access logs (47 hits, 14 unique IPs targeting /admin/vendor/phpunit/.../eval-stdin.php) and SSH sessions (130.12.180.51 uploading Redtail binaries). The phpunit eval-stdin.php path is a known Redtail initial access vector — CVE-2017-9841.

Notable sessions — SSH

2026-04-01T23:22:09Z REDTAIL DROP 130.12.180.51

Multi-arch Redtail cryptominer uploaded via SCP — 6 files including clean.sh, setup.sh, and architecture-specific binaries

session: 8a68d1c0 user: root country: US
uploaded: clean.sh, setup.sh, redtail.arm7, redtail.arm8, redtail.i686, redtail.x86_64
cmd: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; ...
note: Same IP returned repeatedly throughout Apr 2 — consistent with persistent C2 operator re-checking deployed nodes

2026-04-02T00:21:48Z SSH BACKDOOR 118.193.33.42

SSH authorized_keys injection — mdrfckr threat cluster key planted to enable persistent access

session: dd6938e14ffe user: root creds: root:3245gs5662d34
cmd: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAAB...mdrfckr" >> .ssh/authorized_keys && chmod -R go= ~/.ssh
note: Same key and pattern replayed across 2,431 sessions — botnet-scale SSH key seeding campaign

2026-04-02T02:31:06Z RECON 14.103.73.80

Post-auth hardware reconnaissance followed by competitor botnet cleanup

session: ad9341608dca creds: root:3245gs5662d34
recon cmds: uname -a, cat /proc/cpuinfo | grep name | wc -l, free -m, df -h, whoami, w, top, lscpu
cleanup: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny
note: Cleanup pattern removes competing bots and clears hosts.deny — consistent with botnet territory claims

2026-04-01–05 (sustained) TUNNEL multiple

353 direct-tcpip tunnel requests — probing external IPs via honeypot as relay

top destinations: 1.1.1.1 (63), 77.88.21.158 (32), 184.24.145.53 (22), 23.197.161.53 (22), 141.101.90.1 (18)
note: Destinations include Cloudflare DNS, Yandex infrastructure, and Akamai CDN ranges — likely connectivity checks or C2 reachability probes

Notable sessions — web

2026-04-02T00:37:56–00:38:13Z BRUTE FORCE 172.94.9.253

458 POST /admin requests in 17 seconds — rotating UA strings, targeting router-admin.uk vhost

target: router-admin.uk / /admin method: POST
ua rotation: 14 distinct user agents — Chrome/Firefox/Safari/Edge across macOS, Windows, Linux
note: UA rotation at this volume with no body content suggests automated credential stuffing tool (e.g., Hydra, custom script) testing admin panel authentication

2026-04-02T06:08–2026-04-06T15:12 (persistent) REDTAIL WEB multiple (14 IPs)

47 GET/POST requests to phpunit eval-stdin.php across multiple paths — CVE-2017-9841 exploitation attempts

ua: libredtail-http paths probed: /admin/vendor/phpunit/..., /vendor/phpunit/..., /laravel/vendor/..., /cms/vendor/..., /api/vendor/... (30+ variants)
top src: 178.156.145.41 (34 hits), then 13 additional IPs (1 each)
note: Path enumeration across framework prefixes is consistent with a scanner module — not manual probing

2026-04-03T04:33–2026-04-05T12:44 (recurring) GIT RECON 185.177.72.61

8 requests to /admin/.git/config — l9explore scanner probing for exposed Git repositories

ua: l9explore/1.2.2 ports targeted: 80, 8080, 443
note: l9explore is a commercial attack surface enumeration tool. Repeated hits across multiple ports and days suggest scheduled scanning, not one-off reconnaissance

2026-04-03T15:56–16:53 SECRETS HARVEST 130.12.180.111 / 192.253.248.169

Credential file enumeration — .env, .aws/credentials, public/.env probed in sequence

paths: /admin/.env, /admin/.aws/credentials, /admin/public/.env
note: 130.12.180.111 also appeared in SSH download events — potential cross-sensor actor overlap

Top attempted SSH credentials

username	password	attempts	notes
root	3245gs5662d34	2,268	Campaign-specific — botnet credential list
345gs5662d34	345gs5662d34	2,264	Same campaign, alternate username format
root	admin	98	Generic default
admin	admin	89	Generic default
root	Aa123123	70	Common weak password
orangepi	orangepi	19	Orange Pi SBC default
AdminGPON	ALC#FGU	17	GPON router default (Mirai variant)
enable	system	14	Cisco IOS default
shell	sh	14	Embedded device probe

The 3245gs5662d34 credential pair dominated auth attempts by a significant margin — over 4,500 attempts combined. This string does not match common default lists, suggesting a campaignspecific credential derived from a prior breach or generated by the threat actor. The near-identical attempt count for both username formats indicates automated tooling cycling through two credential variants in parallel.

Observed payload hashes (ssh downloads)

sha256 (truncated)	count	context
a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2	2,431	Primary payload — dropped across botnet-scale sessions
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b	156	Secondary payload — empty file (null byte), likely a dropper placeholder
8a68d1c08ea31250063f70b1ccb5051db1f7ab6e17d46e9dd3cc292b9849878b	16	Observed alongside Redtail upload session from 130.12.180.51
24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7	1	Isolated drop — unconfirmed family
8ada174e7f0845bee202dbb6613ac07665ae5fe9db08d297e8b8da06d096275d	1	Isolated drop — unconfirmed family

Indicators of compromise

type	value	context
IP	130.12.180.51	Redtail SCP uploader — returned multiple times across Apr 2
IP	172.94.9.253	Web admin brute force — 458 POSTs in 17s, UA rotation
IP	185.177.72.61	l9explore scanner — .git/config recon, multi-port, multi-day
IP	178.156.145.41	libredtail-http — 34 phpunit eval-stdin probes
IP	45.153.34.120	Top SSH source — 2,755 connections
IP	130.12.180.111	.env / .aws/credentials harvesting — possible cross-sensor overlap with 130.12.180.51 (/24)
IP	118.193.33.42	mdrfckr SSH key injection
hash	a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2	Primary dropped binary — 2,431 sessions
hash	3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f	redtail.arm7 — SCP uploaded by 130.12.180.51
UA	libredtail-http	Redtail botnet scanner — cross-sensor SSH + web
UA	l9explore/1.2.2	Attack surface enumeration tool — Git config recon
SSH key	AAAAB3NzaC1yc2EAAAAB...mdrfckr (comment)	mdrfckr backdoor key — seeded across 2,431+ sessions
credential	root:3245gs5662d34	Campaign credential — 2,268 SSH auth attempts
URL	http://5.175.223.249/w.sh	Observed download URL — shell dropper
URL	http://5.175.223.249/data.arm4	Observed download URL — ARM binary

MITRE ATT&CK mapping

technique id	name	observed
T1110.001	Brute Force: Password Guessing	SSH credential stuffing — 12,050 attempts; web admin POST flood
T1098.004	Account Manipulation: SSH Authorized Keys	mdrfckr key injected into ~/.ssh/authorized_keys across 2,431 sessions
T1059.004	Command & Scripting: Unix Shell	clean.sh / setup.sh execution; chmod +x pipe-to-bash patterns
T1105	Ingress Tool Transfer	SCP upload of Redtail multi-arch binaries; wget/curl downloads to /tmp
T1496	Resource Hijacking	Redtail cryptominer deployment — arm7, arm8, i686, x86_64 variants
T1070.003	Indicator Removal: Clear Command History	Competitor cleanup commands clearing /tmp payloads and killing competing processes
T1082	System Information Discovery	uname, cpuinfo, free, df, lscpu, whoami, w — scripted hardware recon
T1572	Protocol Tunneling	353 direct-tcpip requests probing external IPs via honeypot relay
T1190	Exploit Public-Facing Application	CVE-2017-9841 phpunit eval-stdin.php — 47 web hits across 30+ path variants
T1592.002	Gather Victim Host Info: Software	l9explore .git/config probing; .env / .aws/credentials harvesting

Raw log excerpts

Redtail SCP upload session (130.12.180.51):

2026-04-01T23:22:09.217299Z cowrie.session.connect src=130.12.180.51
2026-04-01T23:22:09.586691Z cowrie.login.success user=root
2026-04-01T23:22:29.414014Z cowrie.command.input CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh
2026-04-01T23:22:29.514660Z cowrie.session.file_upload filename=clean.sh sha256=d46555af...
2026-04-01T23:22:29.521719Z cowrie.session.file_upload filename=redtail.arm7 sha256=3625d068...
2026-04-01T23:22:29.533679Z cowrie.session.file_upload filename=redtail.arm8 sha256=dbb7ebb9...
2026-04-01T23:22:29.545830Z cowrie.session.file_upload filename=redtail.i686 sha256=048e374b...
2026-04-01T23:22:29.557894Z cowrie.session.file_upload filename=redtail.x86_64 sha256=59c29436...

mdrfckr SSH key injection (118.193.33.42):

2026-04-02T00:21:48.442170Z cowrie.command.input session=dd6938e14ffe src=118.193.33.42
CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2...
     mdrfckr" >> .ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Web — libredtail phpunit probe (178.156.145.41):

2026-04-03T02:30:46+00:00 178.156.145.41 "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 200 ua="libredtail-http"
2026-04-04T02:16:01+00:00 154.12.90.12   "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 200 ua="libredtail-http"
2026-04-04T03:14:09+00:00 188.132.230.217 "GET /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 200 ua="libredtail-http"

Full session transcripts, raw JSON logs, and captured binaries available on request. Credential strings are presented as-observed — no active systems use these values. SHA256 hashes are undefanged; IP addresses are as logged.

cd ..