HONEYPOT REPORT // SSH + WEB // 2026-04-21 – 2026-04-25
2026-04-21 – 2026-04-25 — SSH + Web Honeypot Report
SSH
WEB
ALERT
CANARY FOLLOW-ON
185.177.72.x CLUSTER
SSH CONNECTIONS
26,726
across 5 days
AUTH ATTEMPTS
22,431
13,493 succeeded
UNIQUE SSH IPs
1,389
top: 113.87.226.234
PAYLOAD DROPS
3,398
9 unique hashes
FILE UPLOADS
126
Redtail — most yet
WEB REQUESTS
119
26 unique IPs
SSH connection volume by day
*Apr 26 captured in Apr 25 log files (UTC rollover). Apr 22 peak driven by canary follow-on actor 113.87.226.234.
Executive summary
The Apr 16–20 period ended with a mass canary scan from 134.122.95.87 probing 31,772 sessions with an execution check. This period confirms the follow-on: 113.87.226.234 ran 5,175 canary sessions on Apr 22 — the same echo -e "\x6F\x6B" pattern — then a distinct actor from the same infrastructure delivered actual payloads via 87.121.79.73, serving an ARM botnet binary set (00okarm5, 00okarm6, 00okarm7, 00okm68k) alongside a dropper script named ok. The naming convention directly mirrors the canary string — this is the same operator completing the two-phase workflow first observed in the prior period: scan with canary, return with payload.
The Redtail operator at 130.12.180.51 completed 126 upload sessions this period — the highest single-period count yet, representing a continued escalation in deployment frequency. The mdrfckr key injection campaign reached 3,252 sessions, remaining broadly consistent with recent periods. Two new credential strings appeared in volume: root:nPSpP4PBW0 (124 attempts) and root:Aa112211. (122 attempts) — neither matches common default lists, suggesting a newly circulated credential from a breach or targeted list not seen in prior periods.
On the web side, the 185.177.72.x subnet consolidated as a persistent threat cluster. Three distinct IPs from this range have now been observed across reporting periods: .61 (l9explore Git recon, all six periods), .11 (curl RCE + DB enum, Apr 11–15), and now .52 and .30 both running the same curl-based RCE and admin enumeration toolkit — with .52 adding URL-encoded dot obfuscation (%2e substitution for .) across 35 of its 39 requests, and probing JavaScript config files (common.js, constants.js, database.js) not seen from any prior actor. .30 ran the identical playbook against the router-admin.uk vhost. This subnet is operating coordinated tooling across multiple IPs against the same sensor.
Two-phase attack confirmed: Apr 16–20 canary scan (134.122.95.87, 31,772 sessions) → Apr 21–25 payload delivery (113.87.226.234 + 87.121.79.73). The
ok dropper and 00okarm* binary names directly reference the canary string, confirming same operator.
185.177.72.x subnet now confirmed as a multi-IP coordinated threat cluster. Four distinct IPs (.11, .30, .52, .61) have targeted this sensor across six reporting periods using curl-based tooling and l9explore — consistent with a shared toolset or organized scanning infrastructure.
Notable sessions — SSH
2026-04-22 (peak day)
CANARY FOLLOW-ON
113.87.226.234 + 87.121.79.73
Two-phase attack completes — canary actor returns, payload C2 delivers ARM botnet binaries
phase 1 (canary): 113.87.226.234 — 5,175 sessions, echo -e "\x6F\x6B" only
phase 2 (payload): 87.121.79.73 — dropper named "ok" + 00okarm5, 00okarm6, 00okarm7, 00okm68k binaries
naming: "ok" prefix mirrors canary string — confirmed same operator completing recon→deploy cycle
also active: 113.87.225.105 — 787 canary sessions, same pattern, likely same infrastructure
note: m68k targeting (Motorola 68000) adds vintage embedded device coverage alongside ARM — targets older SCADA, industrial, and network equipment.
phase 2 (payload): 87.121.79.73 — dropper named "ok" + 00okarm5, 00okarm6, 00okarm7, 00okm68k binaries
naming: "ok" prefix mirrors canary string — confirmed same operator completing recon→deploy cycle
also active: 113.87.225.105 — 787 canary sessions, same pattern, likely same infrastructure
note: m68k targeting (Motorola 68000) adds vintage embedded device coverage alongside ARM — targets older SCADA, industrial, and network equipment.
2026-04-22–25 (sustained)
REDTAIL DROP
130.12.180.51
126 upload sessions — highest single-period count, operator running multiple sessions per day
files: clean.sh (d46555af — original hash), setup.sh, redtail.arm7/arm8/i686/x86_64
upload counts by period: P1: ~100 → P2: 72 → P3: 36 → P4: 84 → P5: 126
note: Increasing upload volume suggests more successful logins being found via the mdrfckr campaign feeding this operator's node list.
upload counts by period: P1: ~100 → P2: 72 → P3: 36 → P4: 84 → P5: 126
note: Increasing upload volume suggests more successful logins being found via the mdrfckr campaign feeding this operator's node list.
2026-04-21–25 (sustained)
SSH BACKDOOR
multiple
mdrfckr key injection — 3,252 sessions, stable after prior period's spike
week-over-week: P1: 2,431 → P2: 3,159 → P3: 3,418 → P4: 3,956 → P5: 3,252 (slight dip)
new credentials in volume: root:nPSpP4PBW0 (124), root:Aa112211. (122) — not seen in prior periods
note: New credential strings suggest a fresh breach list being circulated alongside the existing campaign credential.
new credentials in volume: root:nPSpP4PBW0 (124), root:Aa112211. (122) — not seen in prior periods
note: New credential strings suggest a fresh breach list being circulated alongside the existing campaign credential.
2026-04-21–25
NEW CREDS
multiple
Two new high-volume credential pairs not seen in prior periods — likely from a recently circulated breach list
root:nPSpP4PBW0 → 124 attempts — random-looking string, not a dictionary word or common default
root:Aa112211. → 122 attempts — pattern-based (uppercase + lowercase + digits + dot), credential list artifact
root:MoeClub.org → 27 attempts — domain-based credential, possibly from a specific compromised service
proxyuser:proxyuser → 25 attempts — proxy server default, new target class appearing
root:Aa112211. → 122 attempts — pattern-based (uppercase + lowercase + digits + dot), credential list artifact
root:MoeClub.org → 27 attempts — domain-based credential, possibly from a specific compromised service
proxyuser:proxyuser → 25 attempts — proxy server default, new target class appearing
Notable sessions — web
2026-04-22T12:21:09–12:25:21Z
RCE + OBFUSCATION
185.177.72.52
Curl actor with URL-encoded dot obfuscation — 35 of 39 requests use %2e substitution, adds JavaScript config file probing
obfuscation: %2e substituted for . throughout — /admin/phpinfo%2ephp, /admin/%2eenv, /admin/config%2ephp
rce probes (x2): /admin/config?cmd=cat%20/root/%2eaws/credentials
new — JS config files: /admin/config/common%2ejs, /admin/config/constants%2ejs, /admin/config/database%2ejs, /admin/server%2ejs, /admin/utils%2ejs
also: same DB enum playbook as .11 — sqladmin, phpmyadmin, adminer, db.conf, sql.conf
note: URL-encoded dot technique may be attempting to bypass WAF rules matching literal .env or .php extensions. JS config file targeting is new — hunting for hardcoded credentials in frontend bundles.
rce probes (x2): /admin/config?cmd=cat%20/root/%2eaws/credentials
new — JS config files: /admin/config/common%2ejs, /admin/config/constants%2ejs, /admin/config/database%2ejs, /admin/server%2ejs, /admin/utils%2ejs
also: same DB enum playbook as .11 — sqladmin, phpmyadmin, adminer, db.conf, sql.conf
note: URL-encoded dot technique may be attempting to bypass WAF rules matching literal .env or .php extensions. JS config file targeting is new — hunting for hardcoded credentials in frontend bundles.
2026-04-24T01:46:11–01:50:19Z
RCE REPEAT
185.177.72.30
Third curl actor from 185.177.72.x — identical playbook to .11 (Apr 11–15), targeting router-admin.uk vhost
rce probe: /admin/config?cmd=cat%20/root/.aws/credentials
vhost: router-admin.uk — targeted by hostname, consistent with .11 behavior
playbook: phpinfo → .env → config.php → DB tools → RCE → admin enumeration — same sequence as prior curl actors
185.177.72.x confirmed IPs: .11 (P3), .52 (P5), .30 (P5), .61 (all periods — l9explore)
vhost: router-admin.uk — targeted by hostname, consistent with .11 behavior
playbook: phpinfo → .env → config.php → DB tools → RCE → admin enumeration — same sequence as prior curl actors
185.177.72.x confirmed IPs: .11 (P3), .52 (P5), .30 (P5), .61 (all periods — l9explore)
2026-04-22 (persistent)
BROAD SCAN
213.209.159.175
21 requests across a wide range of paths including aged browser UAs — broad generic scanner
uas: MSIE 7.0, Chrome 2.0, Android 2.3.6, DragonFly Firefox 3.1b2 — deliberately outdated UAs
paths include: /.env, /.env.2, /.env-example, /.env1, /enviroments/.env.production, /aws/.env, /dist/.env, /mailer/.env, /website/.env
note: Novel .env path variants not seen from prior actors — /enviroments/ (typo), /mailer/, /website/ suggest a different template set than 130.12.180.111's recurring sweep.
paths include: /.env, /.env.2, /.env-example, /.env1, /enviroments/.env.production, /aws/.env, /dist/.env, /mailer/.env, /website/.env
note: Novel .env path variants not seen from prior actors — /enviroments/ (typo), /mailer/, /website/ suggest a different template set than 130.12.180.111's recurring sweep.
2026-04-26T21:12:54Z
ENV HARVEST
3.106.139.148
AWS-hosted IP probing /admin/.env, /administrator/.env, and /admin/phpinfo.php
note: AWS ap-southeast-2 region. Short 3-request burst — consistent with an automated scanner running on compromised or rented cloud infrastructure.
Top attempted SSH credentials
| username | password | attempts | notes |
|---|---|---|---|
| root | 3245gs5662d34 | 3,141 | mdrfckr campaign — slight dip from P5 |
| 345gs5662d34 | 345gs5662d34 | 3,138 | mdrfckr campaign — slight dip from P5 |
| root | admin | 529 | Generic — stable |
| root | nPSpP4PBW0 | 124 | New this period — breach list artifact |
| root | Aa112211. | 122 | New this period — pattern-based credential |
| admin1234 | admin1234 | 77 | Continuing from P5 |
| admin | admin | 76 | Generic default |
| root | P | 40 | Single-char probe |
| orangepi | orangepi | 27 | Orange Pi SBC default |
| root | MoeClub.org | 27 | Domain-based credential — new this period |
| proxyuser | proxyuser | 25 | Proxy server default — new target class |
| root | 2glehe5t24th1issZs | 26 | Complex string — breach list artifact |
Observed payload hashes (ssh downloads)
| sha256 (truncated) | count | context |
|---|---|---|
| a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | 3,252 | mdrfckr primary payload — all six periods, unchanged |
| 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b | 102 | Null placeholder — consistent across all periods |
| 8a68d1c08ea31250063f70b1ccb5051db1f7ab6e17d46e9dd3cc292b9849878b | 21 | Redtail-linked — slightly elevated this period |
| 148d31c590732b49fd4632ac63d4c7f0d4e56c8900204968a6adfdac1e7e7c3e | 4 | Canary follow-on payload — 87.121.79.73 |
| d2d3e12f505ffaf10660db9f53830636a926854c8dcadb499d9f6fc19b4b4324 | 4 | Canary follow-on — 00okarm5/arm6 variant |
| 7473ba9d600617052260cefc7a679a131ee6bcfed094e5860156223728b22263 | 4 | Canary follow-on — 00okarm7 variant |
| c632bd71d56213672dbb094962b6072a54e0d8214e8b956352b58e74a16bce95 | 4 | Canary follow-on — 00okm68k (Motorola 68k) |
| 58625ffc34f0bf6d6363d7bdf224f5ff7f50d469ff89121c1f39f2838d5e4d72 | 4 | Canary follow-on — additional variant |
| d37ddf9c7c61bd8db3a01e8675652c6c6a4953d5b4cc81b70add9faa0b148ee2 | 3 | Canary follow-on — additional variant |
Indicators of compromise
| type | value | context |
|---|---|---|
| IP | 113.87.226.234 | Canary follow-on — 5,175 sessions Apr 22, echo-ok pattern |
| IP | 87.121.79.73 | Payload C2 — ok dropper + 00okarm5/6/7 + 00okm68k binaries |
| IP | 113.87.225.105 | Secondary canary actor — 787 sessions, same infrastructure as .226.234 |
| IP | 130.12.180.51 | Redtail SCP uploader — 126 sessions, highest single-period count |
| IP | 185.177.72.52 | curl actor — URL-encoded dot obfuscation, JS config probing, RCE x2 |
| IP | 185.177.72.30 | curl actor — same playbook as .11, targets router-admin.uk vhost |
| IP | 185.177.72.61 | l9explore/1.2.2 — .git/config recon, all six periods (absent this period) |
| IP | 213.209.159.175 | Broad .env scanner — novel path variants, aged browser UAs |
| IP | 3.106.139.148 | AWS-hosted scanner — .env + phpinfo probe |
| hash | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | mdrfckr payload — persistent all six periods |
| hash | c632bd71d56213672dbb094962b6072a54e0d8214e8b956352b58e74a16bce95 | 00okm68k — Motorola 68k binary, canary follow-on |
| URL | http://87.121.79.73/ok | Canary follow-on dropper |
| URL | http://87.121.79.73/00okarm5 | ARM botnet binary |
| URL | http://87.121.79.73/00okm68k | Motorola 68k botnet binary — unusual architecture |
| UA | curl/8.7.1 | 185.177.72.52 + .30 — coordinated admin enumeration |
| UA | libredtail-http | Redtail scanner — all six periods, 17 hits this window |
| credential | root:nPSpP4PBW0 | New breach list credential — 124 attempts, first appearance |
| credential | root:3245gs5662d34 | mdrfckr campaign — 3,141 attempts |
| path | /admin/config/database%2ejs | JS config harvest — new technique, 185.177.72.52 |
Cross-period actor tracking
| actor / indicator | P1 Apr1–5 | P2 Apr6–10 | P3 Apr11–15 | P4 Apr16–20 | P5 Apr21–25 | trend |
|---|---|---|---|---|---|---|
| mdrfckr injections | 2,431 | 3,159 | 3,418 | 3,956 | 3,252 | → plateau |
| 130.12.180.51 uploads | ~100 | 72 | 36 | 84 | 126 ↑ peak | ↑ escalating |
| 130.12.180.111 .env | ✓ | ✓ | ✓ | ✓ HTTPS | — | → absent P5 |
| 185.177.72.61 l9explore | ✓ | ✓ | ✓ | ✓ | — | → absent P5 |
| 185.177.72.x curl RCE | — | — | .11 | — | .52 + .30 | ↑ expanding IPs |
| libredtail-http phpunit | 47 | 58 | 16 | 17 | 17 | → stable |
| Canary scan → payload | — | — | — | scan only | ✓ payload | ↑ completed |
| SSH connections (total) | 16,491 | 23,470 | 20,823 | 59,761 | 26,726 | ↓ post-spike |
| Botnet families (cumulative) | Redtail | Redtail | +Kurayami | +Demon | +Canary C2 | ↑ 4 families |
MITRE ATT&CK mapping
| technique id | name | observed |
|---|---|---|
| T1110.001 | Brute Force: Password Guessing | 22,431 SSH auth attempts; new breach-list credentials root:nPSpP4PBW0, root:Aa112211. |
| T1098.004 | Account Manipulation: SSH Authorized Keys | mdrfckr key injection — 3,252 sessions |
| T1018 | Remote System Discovery | Canary scan — 113.87.226.234 confirming shell execution across 5,175 sessions |
| T1059.004 | Command & Scripting: Unix Shell | ok dropper execution; clean.sh / setup.sh chains |
| T1105 | Ingress Tool Transfer | Redtail SCP (130.12.180.51, 126 sessions); 87.121.79.73 ARM/m68k payload delivery |
| T1496 | Resource Hijacking | Redtail cryptominer — 126 upload sessions, highest period yet |
| T1027.001 | Obfuscated Files: Binary Padding / Encoding | 185.177.72.52 URL-encoded dot (%2e) substitution across 35 requests |
| T1190 | Exploit Public-Facing Application | CVE-2017-9841 phpunit eval-stdin.php (libredtail-http, 17 hits); RCE cmd= probes (185.177.72.52/.30) |
| T1552.001 | Credentials In Files | .env, .aws/credentials, database.js, constants.js, common.js probing |
| T1083 | File and Directory Discovery | Novel .env paths: /enviroments/, /mailer/, /website/, /dist/; JS config bundle harvesting |
| T1572 | Protocol Tunneling | 523 direct-tcpip requests |
Raw log excerpts
Canary follow-on payload delivery — 87.121.79.73:
cowrie.session.file_download url=http://87.121.79.73/ok sha256=148d31c590732b49... (x4) cowrie.session.file_download url=http://87.121.79.73/00okarm5 sha256=d2d3e12f505ffaf1... (x4) cowrie.session.file_download url=http://87.121.79.73/00okarm6 sha256=d2d3e12f505ffaf1... (x4) cowrie.session.file_download url=http://87.121.79.73/00okarm7 sha256=7473ba9d60061705... (x4) cowrie.session.file_download url=http://87.121.79.73/00okm68k sha256=c632bd71d5621367... (x4) # "ok" naming mirrors Apr 21 canary: echo -e "\x6F\x6B" → "ok"
185.177.72.52 — URL-encoded dot obfuscation + JS config harvest (Apr 22):
2026-04-22T12:21:09+00:00 185.177.72.52 "GET /admin/phpinfo%2ephp HTTP/1.1" 8080 2026-04-22T12:21:20+00:00 185.177.72.52 "GET /admin/config?cmd=cat%20/root/%2eaws/credentials" 2026-04-22T12:21:21+00:00 185.177.72.52 "GET /admin/%2eenv HTTP/1.1" 2026-04-22T12:25:20+00:00 185.177.72.52 "GET /admin/config/common%2ejs HTTP/1.1" 2026-04-22T12:25:21+00:00 185.177.72.52 "GET /admin/config/constants%2ejs HTTP/1.1" 2026-04-22T12:25:21+00:00 185.177.72.52 "GET /admin/config/database%2ejs HTTP/1.1"
185.177.72.30 — identical playbook, router-admin.uk vhost (Apr 24):
2026-04-24T01:46:21+00:00 185.177.72.30 "GET /admin/config?cmd=cat%20/root/.aws/credentials" router-admin.uk 2026-04-24T01:46:22+00:00 185.177.72.30 "GET /admin/.env HTTP/1.1" router-admin.uk 2026-04-24T01:49:10+00:00 185.177.72.30 "GET /admin/db.conf HTTP/1.1" router-admin.uk 2026-04-24T01:49:10+00:00 185.177.72.30 "GET /admin/sqladmin.php HTTP/1.1" router-admin.uk
Full session transcripts, raw JSON logs, and captured binaries available on request. Credential strings are presented as-observed. SHA256 hashes are undefanged; IP addresses are as logged.