HONEYPOT REPORT // SSH + WEB // 2026-04-06 – 2026-04-10

2026-04-06 – 2026-04-10 — SSH + Web Honeypot Report

Period: 2026-04-06 – 2026-04-10 | Sensor: Cowrie v2.x (SSH + HTTP) | Host: VPS / RackNerd

SSH WEB ALERT REDTAIL

SSH CONNECTIONS

23,470

across 5 days

AUTH ATTEMPTS

18,319

10,342 succeeded

UNIQUE SSH IPs

1,427

top: 80.66.66.10

PAYLOAD DROPS

3,316

6 unique hashes

FILE UPLOADS

Redtail — 130.12.180.51

WEB REQUESTS

175

28 unique IPs

SSH connection volume by day

Apr 6

588

Apr 7

5,509

Apr 8

3,620

Apr 9

6,884

Apr 10

3,504

Apr 11*

3,365

*Apr 11 connections captured in Apr 10 log files (UTC rollover). Apr 9 was the peak day at 6,884 connections.

Executive summary

This five-day window continues the trends established in the prior report (Apr 1–5) with several notable developments. The mdrfckr SSH key injection campaign remained the dominant SSH activity, now confirmed across 3,159 sessions — a ~30% increase over the previous period — with 130.12.180.51 returning to upload fresh Redtail multi-architecture binaries on Apr 7, using identical filenames and hashes to the Apr 1 campaign. This persistence across two reporting windows suggests an active, operator-maintained deployment infrastructure rather than a one-time scan.

A new top-volume SSH source emerged: 80.66.66.10 accounted for 20,213 events — nearly 14% of all SSH traffic for the period — making it by far the most active single source observed across either report. A second actor, 103.97.215.11, contributed 8,928 events. Both sources concentrated heavily around the root:admin credential pair (2,918 attempts), a significant shift from the campaign-specific 3245gs5662d34 string that dominated the prior period — suggesting a different, more generic scanning operation running in parallel.

On the web side, 185.194.204.39 emerged as the new dominant source with 46 requests, all carrying the libredtail-http user agent targeting the phpunit eval-stdin.php path — consistent with the Redtail campaign's continued scanning across the sensor. A new actor, 74.207.237.5, performed broad admin panel fingerprinting across 14 file extensions (/admin.php, /admin.asp, /admin.jsp, etc.) and probed for Joomla installs via /administrator/manifests/files/joomla.xml. Additionally, 45.148.10.249 ran a Go-based scanner probing for phpinfo pages and .env files across multiple path variants. The 172.94.9.253 admin brute-force tool reappeared on Apr 8 with another 16-request burst.

Persistence finding: 130.12.180.51 has now uploaded Redtail binaries in both reporting periods (Apr 1 and Apr 7), with identical file hashes across both sessions. The operator is actively re-deploying to newly compromised nodes using the same pre-built binary set.

Notable sessions — SSH

2026-04-07T01:23:45Z (and recurring) REDTAIL DROP 130.12.180.51

Redtail operator returns — SCP upload of same multi-arch binary set as Apr 1, repeated across multiple sessions throughout Apr 7

uploaded: clean.sh, setup.sh, redtail.arm7, redtail.arm8, redtail.i686, redtail.x86_64
hashes: identical to Apr 1 session — operator reusing same build
pattern: Multiple upload sessions throughout the day — consistent with operator actively seeding newly compromised honeypot nodes

2026-04-06–10 (sustained) SSH BACKDOOR multiple

mdrfckr SSH key injection — 3,159 sessions across the period, up from 2,431 in prior window

cmd: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAAB...mdrfckr" >> .ssh/authorized_keys && chmod -R go= ~/.ssh
credential used: root:3245gs5662d34 / 345gs5662d34:345gs5662d34
note: Campaign volume increasing week over week — botnet appears to be growing its node count

2026-04-06–10 (sustained) HIGH VOLUME 80.66.66.10 / 103.97.215.11

Two new dominant SSH sources — 20,213 and 8,928 events respectively, primarily targeting root:admin

top cred: root:admin (2,918 attempts) — distinct from mdrfckr campaign's custom credential
note: Volume and credential choice suggest a separate generic scanning operation, not the same operator as the mdrfckr campaign. Possible Shodan-driven or mass-scanner infrastructure.

2026-04-06–10 (sustained) TUNNEL multiple

3,000 direct-tcpip tunnel requests — significant increase over prior period's 353

note: Nearly 9x increase in tunneling activity vs Apr 1–5. Could reflect growing use of the honeypot as a relay node by actors who successfully authenticated.

2026-04-07 (observed) NEW DROPPER 206.189.93.37

New download URL observed — Hammz.sh shell dropper fetched twice

url: http://206.189.93.37/Hammz.sh
hash: 28c82f066f09fc5dde84e0ac582313994bc9d737483bbeb5c31ecf7a5c99ed82
note: Not previously seen in Apr 1–5 data. New dropper family or second-stage loader — distinct from Redtail and the primary payload hash.

Notable sessions — web

2026-04-06–10 (sustained) REDTAIL WEB 185.194.204.39 + 13 others

58 libredtail-http hits across the period — 185.194.204.39 now the dominant source at 44 requests

path: /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
note: Consistent with CVE-2017-9841 scanning by Redtail infrastructure. 185.194.204.39 replaced 178.156.145.41 (Apr 1–5 top source) as primary scanner — possible IP rotation within the botnet.

2026-04-11T01:50:04–01:50:45Z FINGERPRINTING 74.207.237.5

Broad admin panel and CMS fingerprinting — 14 file extensions enumerated, Joomla version disclosure probed

paths: /admin.php, /admin.asp, /admin.aspx, /admin.jsp, /admin.jhtml, /admin.cgi, /admin.pl, /admin.cfm, /admin.html, /admin.jsa, /admin.shtml ...
joomla probe: /administrator/manifests/files/joomla.xml — multi-port (80, 8080)
note: Systematic extension cycling and Joomla-specific path are consistent with a web vulnerability scanner (e.g. Nuclei template set). Not previously seen in Apr 1–5.

2026-04-08T11:42:44–11:43:30Z ENV HARVEST 45.148.10.249

Go-http-client scanner probing phpinfo and .env across multiple admin path variants

paths: /admin/phpinfo.php, /admin/php-info.php, /admin/php_info.php, /admin/console/.env, /admin/config/.env, /administrator/config/.env, /administrator/.env, /admin/.env
note: Go-http-client UA with rapid sequential probing across path variants — automated scanner, not manual. Likely scanning for misconfigured Laravel/Symfony installations.

2026-04-08T20:01:41Z BRUTE FORCE 172.94.9.253

172.94.9.253 returns — 16 POST /admin requests with UA rotation targeting router-admin.uk

note: Same actor and tool as Apr 2 burst (458 requests). Smaller volume this session — may indicate partial credential list or rate-limited retry.

2026-04-11T22:28:34Z GIT RECON 93.123.109.152

New actor probing .git/config across both /admin and /administrator paths on router-admin.uk vhost

paths: /admin/.git/config, /administrator/.git/config
vhost: router-admin.uk (targeted by hostname, not IP)
note: Distinct from the recurring l9explore/1.2.2 actor (185.177.72.61). This one used a Chrome UA and specifically targeted the virtual hostname — suggests awareness of the vhost.

Top attempted SSH credentials

username	password	attempts	notes
345gs5662d34	345gs5662d34	3,017	mdrfckr campaign — continued from prior period
root	3245gs5662d34	3,012	mdrfckr campaign — continued from prior period
root	admin	2,918	Generic — dominant credential for new high-volume sources
admin	admin	92	Generic default
root	P	28	Single-char probe
orangepi	orangepi	22	Orange Pi SBC default
AdminGPON	ALC#FGU	22	GPON router default — Mirai variant
root	------fuck------	11	Adversarial/taunt string — credential stuffing artifact
support	support	11	Generic device default
root	root12345678	10	Common weak password

Observed payload hashes (ssh downloads)

sha256 (truncated)	count	context
a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2	3,159	Primary payload — same hash as Apr 1–5, mdrfckr campaign
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b	141	Null/placeholder — consistent with prior period
8a68d1c08ea31250063f70b1ccb5051db1f7ab6e17d46e9dd3cc292b9849878b	12	Redtail-linked — observed alongside 130.12.180.51 sessions
28c82f066f09fc5dde84e0ac582313994bc9d737483bbeb5c31ecf7a5c99ed82	2	Hammz.sh dropper — new this period, from 206.189.93.37
24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7	1	Isolated drop — unconfirmed family
8ada174e7f0845bee202dbb6613ac07665ae5fe9db08d297e8b8da06d096275d	1	Isolated drop — unconfirmed family

Indicators of compromise

type	value	context
IP	80.66.66.10	Top SSH source — 20,213 events, root:admin credential
IP	103.97.215.11	Second SSH source — 8,928 events
IP	130.12.180.51	Redtail SCP uploader — returned Apr 7, same binaries as Apr 1
IP	185.194.204.39	libredtail-http — 44 phpunit eval-stdin probes
IP	74.207.237.5	Admin fingerprinting + Joomla probe — 24 requests
IP	45.148.10.249	Go-http-client scanner — phpinfo + .env enumeration
IP	172.94.9.253	Admin brute force — returned Apr 8, UA rotation
IP	185.177.72.61	l9explore/1.2.2 — continued .git/config recon
IP	93.123.109.152	New .git/config actor — targeted router-admin.uk vhost
IP	206.189.93.37	Hammz.sh dropper host — new this period
hash	a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2	Primary mdrfckr payload — persistent across both reporting periods
hash	28c82f066f09fc5dde84e0ac582313994bc9d737483bbeb5c31ecf7a5c99ed82	Hammz.sh — new dropper, 2 observed drops
UA	libredtail-http	Redtail botnet scanner — persistent across both periods
UA	l9explore/1.2.2	Attack surface enumeration — .git/config recon
URL	http://206.189.93.37/Hammz.sh	New dropper URL — first observed Apr 7
URL	http://5.175.223.249/w.sh	Continued from prior period
credential	root:3245gs5662d34	mdrfckr campaign — 3,012 attempts this period

MITRE ATT&CK mapping

technique id	name	observed
T1110.001	Brute Force: Password Guessing	18,319 SSH auth attempts; 172.94.9.253 POST /admin burst
T1098.004	Account Manipulation: SSH Authorized Keys	mdrfckr key injection — 3,159 sessions
T1059.004	Command & Scripting: Unix Shell	clean.sh / setup.sh / Hammz.sh execution
T1105	Ingress Tool Transfer	Redtail SCP upload (130.12.180.51); Hammz.sh wget from 206.189.93.37
T1496	Resource Hijacking	Redtail cryptominer — multi-arch binaries deployed again Apr 7
T1070.003	Indicator Removal: Clear Command History	Competitor cleanup — pkill competing bots, clear /tmp payloads
T1082	System Information Discovery	Scripted hardware recon: uname, cpuinfo, free, df, lscpu, whoami
T1572	Protocol Tunneling	3,000 direct-tcpip requests — 9x increase over prior period
T1190	Exploit Public-Facing Application	CVE-2017-9841 phpunit eval-stdin.php — 58 web hits; Joomla fingerprinting
T1592.002	Gather Victim Host Info: Software	l9explore .git/config; 74.207.237.5 CMS fingerprinting; 45.148.10.249 phpinfo enumeration
T1083	File and Directory Discovery	.env, .aws/credentials, phpinfo.php probing across multiple path variants

Raw log excerpts

Redtail operator return — 130.12.180.51 (Apr 7):

2026-04-07T01:23:45.269666Z cowrie.session.file_upload src=130.12.180.51 filename=clean.sh   sha256=d46555af...
2026-04-07T01:23:45.275827Z cowrie.session.file_upload src=130.12.180.51 filename=redtail.arm7 sha256=3625d068...
2026-04-07T01:23:45.283068Z cowrie.session.file_upload src=130.12.180.51 filename=redtail.arm8 sha256=dbb7ebb9...
2026-04-07T01:23:45.295274Z cowrie.session.file_upload src=130.12.180.51 filename=redtail.i686 sha256=048e374b...
2026-04-07T01:23:45.306060Z cowrie.session.file_upload src=130.12.180.51 filename=redtail.x86_64 sha256=59c29436...
2026-04-07T01:23:45.307060Z cowrie.session.file_upload src=130.12.180.51 filename=setup.sh   sha256=783adb7a...

Hammz.sh dropper download (new this period):

cowrie.session.file_download url=http://206.189.93.37/Hammz.sh
  sha256=28c82f066f09fc5dde84e0ac582313994bc9d737483bbeb5c31ecf7a5c99ed82 (x2)

45.148.10.249 Go scanner — .env and phpinfo enumeration (Apr 8):

2026-04-08T11:42:44+00:00 45.148.10.249 "GET /admin/console/.env HTTP/1.1" 200 ua="Go-http-client/1.1"
2026-04-08T11:42:45+00:00 45.148.10.249 "GET /administrator/phpinfo.php HTTP/1.1" 200
2026-04-08T11:42:45+00:00 45.148.10.249 "GET /admin/phpinfo.php HTTP/1.1" 200
2026-04-08T11:43:29+00:00 45.148.10.249 "GET /administrator/config/.env HTTP/1.1" 200
2026-04-08T11:43:30+00:00 45.148.10.249 "GET /admin/.env HTTP/1.1" 200

74.207.237.5 CMS fingerprinting — Joomla + admin extension sweep (Apr 11):

2026-04-11T01:50:04+00:00 74.207.237.5 "GET /administrator/manifests/files/joomla.xml HTTP/1.1" 200
2026-04-11T01:50:13+00:00 74.207.237.5 "GET /admin.shtml HTTP/1.1" 200
2026-04-11T01:50:19+00:00 74.207.237.5 "GET /admin.php HTTP/1.1" 200
2026-04-11T01:50:33+00:00 74.207.237.5 "GET /admin.aspx HTTP/1.1" 200
2026-04-11T01:50:43+00:00 74.207.237.5 "GET /admin.asp HTTP/1.1" 200
2026-04-11T01:50:45+00:00 74.207.237.5 "GET /admin.jsp HTTP/1.1" 200

Full session transcripts, raw JSON logs, and captured binaries available on request. Credential strings are presented as-observed. SHA256 hashes are undefanged; IP addresses are as logged.

cd ..