🍉 watermelon auth

honeypot field report

watermelon auth

who keeps knocking on a door that doesn't open. this is the digest of what has been hitting the honeypot system — decoy services that authenticate anyone, and grant access to no one.

traffic

total external hits since the last log rotation, across all three decoys.

5260
total hits
104
unique source ips
77
http decoy hits
4799
ssh decoy hits
384
ftp decoy hits
80
ips banned on contact

period covered: Sep 7 10:31 UTC → Sep 9 17:13 UTC · generated Sep 9 2026 17:13 UTC by cron

last 14 days

Sep 7126
Sep 8176
Sep 94958

decoy split

http 77ssh 4799ftp 384

top sources

heaviest external ips, with which decoys they touched and a sample of what they tried.

ip / location hits decoys sample
210.86.225.158 Vietnam, Hanoi
1860
ssh
ssh user=root · ssh cmd=echo -e "\x6F\x6B"
210.86.225.156 Vietnam, Hanoi
1620
ssh
ssh user=root · ssh cmd=echo -e "\x6F\x6B"
80.94.92.179 The Netherlands, North Holland
513
ssh
ssh user=root · ssh cmd=export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C uname=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -s -v -n -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; IFS= read -r v < /proc/version && printf '%s\n' "$v") 2>/dev/null arch=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; for c in arch 'busybox arch' 'toybox arch'; do v=$($c 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; printf '%s\n' unknown) uptime=$(IFS= read -r v < /proc/uptime && printf '%s\n' "$v" || cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null || toybox cat /proc/uptime 2>/dev/null) 2>/dev/null cpus=$(unset OMP_NUM_THREADS OMP_THREAD_LIMIT; for c in nproc /usr/bin/nproc 'busybox nproc' 'toybox nproc'; do v=$($c 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ "$v" -gt 0 ] 2>/dev/null && { printf '%s\n' "$v"; exit; }; done; for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; v=$($a 'function count(s, a,b,n,i,t,m) { gsub(/[[:space:]]/,"",s); n=split(s,a,","); for(i=1;i<=n;i++) { if(a[i]!~/^[0-9]+(-[0-9]+)?$/) return 0; m=split(a[i],b,"-"); if(m==2 && b[2]+0<b[1]+0) return 0; t+=(m==2?b[2]-b[1]+1:1) } return t } BEGIN { while((getline s < "/proc/self/status")>0) if(s~/^Cpus_allowed_list:/) { sub(/^[^:]*:/,"",s); n=count(s); if(n>0) { print n; exit } } }' 2>/dev/null); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; for c in getconf 'busybox getconf' 'toybox getconf'; do v=$($c _NPROCESSORS_ONLN 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ "$v" -gt 0 ] 2>/dev/null && { printf '%s\n' "$v"; exit; }; done; v=$($a 'BEGIN { if((getline s < "/sys/devices/system/cpu/online")>0 && s~/^[0-9]+(-[0-9]+)?(,[0-9]+(-[0-9]+)?)*$/) { k=split(s,a,","); for(i=1;i<=k;i++) { m=split(a[i],b,"-"); if(m==2 && b[2]+0<b[1]+0) { n=0; break } n+=(m==2?b[2]-b[1]+1:1) } if(n>0) { print n; exit } } while((getline s < "/proc/cpuinfo")>0) { if(s~/^[[:space:]]*processor[[:space:]]*:[[:space:]]*[0-9]+[[:space:]]*$/ || s~/^[[:space:]]*processor[[:space:]]+[0-9]+:/) n++; if(s~/^[[:space:]]*#[[:space:]]*processors[[:space:]]*:/) { sub(/^[^:]*:/,"",s); p=s+0 } } if(n>0) print n; else if(p>0) print p }' 2>/dev/null); printf '%s\n' "${v:-unknown}") cpu_model=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$({ lscpu 2>/dev/null || busybox lscpu 2>/dev/null || toybox lscpu 2>/dev/null; printf '\n@@CPUINFO@@\n'; r /proc/cpuinfo; printf '\n@@MIDR@@\n'; for f in /sys/devices/system/cpu/cpu[0-9]*/regs/identification/midr_el1; do r "$f"; done; } | $a 'function trim(s) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", s); return s } function useful(s, t) { t=tolower(trim(s)); return t!="" && t!~/^(unknown|undefined|unspecified|not specified|not available|not present|not installed|default string|to be filled by o\.e\.m\.|n\/a|none|null|\(null\)|-|(0x)?[0-9a-f]+)$/ && t!~/^(unknown|unidentified|unrecognized)([[:space:]]|$)/ && t!~/^(armv[0-9]+(-compatible)?|aarch64|arm64|arm)([[:space:]]+processor|[[:space:]]*\(|$)/ && t!~/^(armv[0-9]+|aarch64|arm64|arm|processor|cpu|riscv(32|64)?|risc-v|x86_64|amd64|i[3-6]86|ppc64(le)?|powerpc|loongarch64|s390x)$/; } function number(s, n,i,d) { s=tolower(trim(s)); n=0; if(s~/^0x[0-9a-f]+$/) { for(i=3;i<=length(s);i++) { d=index("0123456789abcdef",substr(s,i,1))-1; n=n*16+d } return n; } return s~/^[0-9]+$/ ? s+0 : -1; } function addname(s) { if(useful(s) && !names[s]++) name[++nn]=s } function arm(impl,part, id,s) { impl=number(impl); part=number(part); if(impl<0 || impl>255 || part<0 || part>4095) return; id=sprintf("%02x:%03x",impl,part); if(ids[id]++) return; s=parts[id]; if(s=="") s="ARM implementer=0x" substr(id,1,2) " part=0x" substr(id,4); core[++nc]=s; } function addraw(s) { if(s!="" && !rawseen[s]++) raw[++nr]=s } function flush() { addname(model); if(implementer!="" && part!="") arm(implementer,part); if(mvendor!="" || march!="" || mimp!="") addraw("RISC-V mvendorid=" mvendor " marchid=" march " mimpid=" mimp); model=implementer=part=""; mvendor=march=mimp=""; } function table(impl,s, a,b,n,i) { n=split(s,a," "); for(i=1;i<=n;i++) { split(a[i],b,"="); parts[impl ":" b[1]]=b[2] } } function output(a,n, i) { for(i=1;i<=n;i++) printf "%s%s",(i>1?" + ":""),a[i] } BEGIN { table("41","b76=ARM1176 c05=Cortex-A5 c07=Cortex-A7 c08=Cortex-A8 c09=Cortex-A9 c0d=Cortex-A17 c0e=Cortex-A17 c0f=Cortex-A15 d01=Cortex-A32 d02=Cortex-A34 d03=Cortex-A53 d04=Cortex-A35 d05=Cortex-A55 d06=Cortex-A65 d07=Cortex-A57 d08=Cortex-A72 d09=Cortex-A73 d0a=Cortex-A75 d0b=Cortex-A76 d0c=Neoverse-N1 d0d=Cortex-A77 d0e=Cortex-A76AE d40=Neoverse-V1 d41=Cortex-A78 d42=Cortex-A78AE d44=Cortex-X1 d46=Cortex-A510 d47=Cortex-A710 d48=Cortex-X2 d49=Neoverse-N2 d4a=Neoverse-E1 d4b=Cortex-A78C d4d=Cortex-A715 d4e=Cortex-X3 d4f=Neoverse-V2 d80=Cortex-A520 d81=Cortex-A720 d82=Cortex-X4 d84=Neoverse-V3 d85=Cortex-X925 d87=Cortex-A725"); table("42","00f=Brahma-B15 100=Brahma-B53 516=ThunderX2"); table("43","0a0=ThunderX 0a1=ThunderX-88XX 0a2=ThunderX-81XX 0a3=ThunderX-83XX 0af=ThunderX2-99xx"); table("46","001=A64FX"); table("4e","000=Denver 003=Denver-2 004=Carmel"); table("50","000=X-Gene"); table("51","001=Oryon 00f=Scorpion 02d=Scorpion 04d=Krait 06f=Krait 201=Kryo 205=Kryo 211=Kryo 800=Falkor-V1/Kryo 801=Kryo-V2 802=Kryo-3XX-Gold 803=Kryo-3XX-Silver 804=Kryo-4XX-Gold 805=Kryo-4XX-Silver c00=Falkor c01=Saphira"); table("c0","ac3=Ampere-1 ac4=Ampere-1a"); } /^@@CPUINFO@@$/ { section=1; next } /^@@MIDR@@$/ { flush(); section=2; next } section==2 { s=tolower(trim($0)); sub(/^0x/,"",s); if(s!~/^[0-9a-f]+$/ || length(s)<8) next; s=substr(s,length(s)-7); arm("0x" substr(s,1,2),"0x" substr(s,5,3)); next; } section==1 && /^[[:space:]]*$/ { flush(); next } { pos=index($0,":"); if(!pos) next; key=tolower(trim(substr($0,1,pos-1))); value=trim(substr($0,pos+1)); if(section==0) { if(key=="model name" && useful(value) && !lsseen[value]++) ls[++nl]=value; if(key=="bios model name" && useful(value) && !biosseen[value]++) bios[++nb]=value; next; } if(key=="processor" && value~/^[0-9]+$/) flush(); if(key=="cpu implementer") implementer=value; if(key=="cpu part") part=value; if(key=="mvendorid") mvendor=value; if(key=="marchid") march=value; if(key=="mimpid") mimp=value; if(key~/^(model name|cpu model|cpu|uarch|cpu type|processor)$/ && useful(value)) { if(model=="" || key=="model name" || key=="uarch") model=value; } if(key~/^processor[[:space:]]+[0-9]+$/ && value~/machine[[:space:]]*=/) { s=value; sub(/^.*machine[[:space:]]*=[[:space:]]*/,"",s); sub(/[,[:space:]].*$/,"",s); if(s!="") addraw("IBM S/390 machine " s); } } END { flush(); if(nn>0) { output(name,nn); if(nc>1) { printf " [cores: "; output(core,nc); printf "]" } } else if(nc>1) { output(core,nc); } else if(nl>0) { output(ls,nl); } else if(nb>0) { output(bios,nb); } else if(nc>0) { output(core,nc); } else if(nr>0) { output(raw,nr); } if(nn+nc+nl+nb+nr>0) print ""; }' 2>/dev/null); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; if ! $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null; then v=$(emit() { [ -n "$1" ] || return; case "$seen" in *"|$1|"*) return ;; esac; printf '%s%s' "$sep" "$1"; sep=' + '; seen="$seen|$1|"; }; rec() { if [ -n "$n" ]; then emit "$n"; elif [ -n "$i" ] && [ -n "$p" ]; then emit "ARM implementer=$i part=$p"; fi; n= i= p=; }; n= i= p= seen= sep=; if [ -r /proc/cpuinfo ]; then while IFS=: read -r k x || [ -n "$k$x" ]; do k=${k#"${k%%[![:space:]]*}"}; k=${k%"${k##*[![:space:]]}"}; x=${x#"${x%%[![:space:]]*}"}; x=${x%"${x##*[![:space:]]}"}; case "$k" in '') rec ;; processor) case "$x" in *[!0-9]*) ;; *) rec ;; esac ;; 'CPU implementer') i=$x ;; 'CPU part') p=$x ;; 'model name'|'Model Name'|'cpu model'|cpu|uarch|'cpu type'|Processor) case "$x" in ''|[Uu][Nn][Kk][Nn][Oo][Ww][Nn]*|[Nn]/[Aa]|[Aa][Rr][Mm]*[Pp]rocessor*|[Aa][Aa][Rr][Cc][Hh]64*) ;; *) case "$x" in *[!0-9]*) n=$x ;; esac ;; esac ;; esac; done < /proc/cpuinfo; rec; fi); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; fi; v=$(for d in /sys/firmware/devicetree/base /proc/device-tree; do [ -d "$d/cpus" ] || continue; for f in "$d"/cpus/*/compatible; do [ -r "$f" ] || continue; tr '\000' '\n' < "$f" 2>/dev/null || busybox tr '\000' '\n' < "$f" 2>/dev/null || toybox tr '\000' '\n' < "$f" 2>/dev/null; done; break; done | $a 'NF && !seen[$0]++ { printf "%s%s",n++?" + ":"CPU compatible: ",$0 } END { if(n) print "" }' 2>/dev/null); printf '%s\n' "${v:-unknown ($arch)}") gpu_info=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$(for c in lspci 'busybox lspci' 'toybox lspci'; do p=$($c -Dnn 2>/dev/null) || p=; [ -n "$p" ] || { p=$($c -nn 2>/dev/null) || p=; }; [ -n "$p" ] || { p=$($c 2>/dev/null) || p=; }; p=$(printf '%s\n' "$p" | $a '{ s=tolower($0) } s~/\[03[0-9a-f][0-9a-f]\]/ || s~/(vga compatible|3d|display) controller/ || s~/(^|[[:space:]])(class[[:space:]]+)?03[0-9a-f][0-9a-f]:[[:space:]]/ { if(!seen[$0]++) print }' 2>/dev/null); [ -n "$p" ] && { printf '%s\n' "$p"; break; }; done); if [ -n "$v" ]; then printf '%s\n' "$v"; else for d in /sys/bus/pci/devices/*; do c=$(r "$d/class"); case $c in 0x03????) x=$(r "$d/vendor"); y=$(r "$d/device"); printf '%s display controller [%s:%s]\n' "${d##*/}" "${x#0x}" "${y#0x}" ;; esac; done; fi; for d in /sys/class/drm/card[0-9]* /sys/class/drm/renderD[0-9]*; do [ -d "$d/device" ] || continue; case ${d##*/} in *-*) continue ;; esac; e=$(r "$d/device/uevent"); case $e in *PCI_SLOT_NAME=*) continue ;; esac; p=$(CDPATH= cd -P "$d/device" 2>/dev/null && pwd -P); [ -n "$p" ] || continue; x=$(printf '%s\n' "$e" | $a '/^DRIVER=/ { sub(/^DRIVER=/,""); print; exit }' 2>/dev/null); printf '%s DRM device: %s\n' "$p" "${x:-unknown}"; done | $a '!seen[$0]++' 2>/dev/null) last_output=$(last 2>/dev/null) filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ) printf 'UNAME:%s\n' "$uname" printf 'ARCH:%s\n' "$arch" printf 'UPTIME:%s\n' "$uptime" printf 'CPUS:%s\n' "$cpus" printf 'CPU_MODEL:%s\n' "$cpu_model" printf 'GPU:%s\n' "$gpu_info" printf 'LAST:%s\n' "$last_output" printf 'FILTER:%s\n' "$filter_output"
2.57.122.238 The Netherlands, North Holland
195
ssh
ssh user=sol · ssh cmd=/bin/./uname -s -v -n -r -m
109.160.32.20 United States, North Carolina
93
ssh
ssh user=sam · ssh cmd=uname -s -v -n -r -m
109.160.32.85 United States, North Carolina
83
ssh
ssh user=root · ssh cmd=uname -s -v -n -r -m
92.118.39.77 United States, Texas
81
ssh
ssh user=root · ssh cmd=export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C uname=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -s -v -n -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; IFS= read -r v < /proc/version && printf '%s\n' "$v") 2>/dev/null arch=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; for c in arch 'busybox arch' 'toybox arch'; do v=$($c 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; printf '%s\n' unknown) uptime=$(IFS= read -r v < /proc/uptime && printf '%s\n' "$v" || cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null || toybox cat /proc/uptime 2>/dev/null) 2>/dev/null cpus=$(unset OMP_NUM_THREADS OMP_THREAD_LIMIT; for c in nproc /usr/bin/nproc 'busybox nproc' 'toybox nproc'; do v=$($c 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ "$v" -gt 0 ] 2>/dev/null && { printf '%s\n' "$v"; exit; }; done; for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; v=$($a 'function count(s, a,b,n,i,t,m) { gsub(/[[:space:]]/,"",s); n=split(s,a,","); for(i=1;i<=n;i++) { if(a[i]!~/^[0-9]+(-[0-9]+)?$/) return 0; m=split(a[i],b,"-"); if(m==2 && b[2]+0<b[1]+0) return 0; t+=(m==2?b[2]-b[1]+1:1) } return t } BEGIN { while((getline s < "/proc/self/status")>0) if(s~/^Cpus_allowed_list:/) { sub(/^[^:]*:/,"",s); n=count(s); if(n>0) { print n; exit } } }' 2>/dev/null); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; for c in getconf 'busybox getconf' 'toybox getconf'; do v=$($c _NPROCESSORS_ONLN 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ "$v" -gt 0 ] 2>/dev/null && { printf '%s\n' "$v"; exit; }; done; v=$($a 'BEGIN { if((getline s < "/sys/devices/system/cpu/online")>0 && s~/^[0-9]+(-[0-9]+)?(,[0-9]+(-[0-9]+)?)*$/) { k=split(s,a,","); for(i=1;i<=k;i++) { m=split(a[i],b,"-"); if(m==2 && b[2]+0<b[1]+0) { n=0; break } n+=(m==2?b[2]-b[1]+1:1) } if(n>0) { print n; exit } } while((getline s < "/proc/cpuinfo")>0) { if(s~/^[[:space:]]*processor[[:space:]]*:[[:space:]]*[0-9]+[[:space:]]*$/ || s~/^[[:space:]]*processor[[:space:]]+[0-9]+:/) n++; if(s~/^[[:space:]]*#[[:space:]]*processors[[:space:]]*:/) { sub(/^[^:]*:/,"",s); p=s+0 } } if(n>0) print n; else if(p>0) print p }' 2>/dev/null); printf '%s\n' "${v:-unknown}") cpu_model=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$({ lscpu 2>/dev/null || busybox lscpu 2>/dev/null || toybox lscpu 2>/dev/null; printf '\n@@CPUINFO@@\n'; r /proc/cpuinfo; printf '\n@@MIDR@@\n'; for f in /sys/devices/system/cpu/cpu[0-9]*/regs/identification/midr_el1; do r "$f"; done; } | $a 'function trim(s) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", s); return s } function useful(s, t) { t=tolower(trim(s)); return t!="" && t!~/^(unknown|undefined|unspecified|not specified|not available|not present|not installed|default string|to be filled by o\.e\.m\.|n\/a|none|null|\(null\)|-|(0x)?[0-9a-f]+)$/ && t!~/^(unknown|unidentified|unrecognized)([[:space:]]|$)/ && t!~/^(armv[0-9]+(-compatible)?|aarch64|arm64|arm)([[:space:]]+processor|[[:space:]]*\(|$)/ && t!~/^(armv[0-9]+|aarch64|arm64|arm|processor|cpu|riscv(32|64)?|risc-v|x86_64|amd64|i[3-6]86|ppc64(le)?|powerpc|loongarch64|s390x)$/; } function number(s, n,i,d) { s=tolower(trim(s)); n=0; if(s~/^0x[0-9a-f]+$/) { for(i=3;i<=length(s);i++) { d=index("0123456789abcdef",substr(s,i,1))-1; n=n*16+d } return n; } return s~/^[0-9]+$/ ? s+0 : -1; } function addname(s) { if(useful(s) && !names[s]++) name[++nn]=s } function arm(impl,part, id,s) { impl=number(impl); part=number(part); if(impl<0 || impl>255 || part<0 || part>4095) return; id=sprintf("%02x:%03x",impl,part); if(ids[id]++) return; s=parts[id]; if(s=="") s="ARM implementer=0x" substr(id,1,2) " part=0x" substr(id,4); core[++nc]=s; } function addraw(s) { if(s!="" && !rawseen[s]++) raw[++nr]=s } function flush() { addname(model); if(implementer!="" && part!="") arm(implementer,part); if(mvendor!="" || march!="" || mimp!="") addraw("RISC-V mvendorid=" mvendor " marchid=" march " mimpid=" mimp); model=implementer=part=""; mvendor=march=mimp=""; } function table(impl,s, a,b,n,i) { n=split(s,a," "); for(i=1;i<=n;i++) { split(a[i],b,"="); parts[impl ":" b[1]]=b[2] } } function output(a,n, i) { for(i=1;i<=n;i++) printf "%s%s",(i>1?" + ":""),a[i] } BEGIN { table("41","b76=ARM1176 c05=Cortex-A5 c07=Cortex-A7 c08=Cortex-A8 c09=Cortex-A9 c0d=Cortex-A17 c0e=Cortex-A17 c0f=Cortex-A15 d01=Cortex-A32 d02=Cortex-A34 d03=Cortex-A53 d04=Cortex-A35 d05=Cortex-A55 d06=Cortex-A65 d07=Cortex-A57 d08=Cortex-A72 d09=Cortex-A73 d0a=Cortex-A75 d0b=Cortex-A76 d0c=Neoverse-N1 d0d=Cortex-A77 d0e=Cortex-A76AE d40=Neoverse-V1 d41=Cortex-A78 d42=Cortex-A78AE d44=Cortex-X1 d46=Cortex-A510 d47=Cortex-A710 d48=Cortex-X2 d49=Neoverse-N2 d4a=Neoverse-E1 d4b=Cortex-A78C d4d=Cortex-A715 d4e=Cortex-X3 d4f=Neoverse-V2 d80=Cortex-A520 d81=Cortex-A720 d82=Cortex-X4 d84=Neoverse-V3 d85=Cortex-X925 d87=Cortex-A725"); table("42","00f=Brahma-B15 100=Brahma-B53 516=ThunderX2"); table("43","0a0=ThunderX 0a1=ThunderX-88XX 0a2=ThunderX-81XX 0a3=ThunderX-83XX 0af=ThunderX2-99xx"); table("46","001=A64FX"); table("4e","000=Denver 003=Denver-2 004=Carmel"); table("50","000=X-Gene"); table("51","001=Oryon 00f=Scorpion 02d=Scorpion 04d=Krait 06f=Krait 201=Kryo 205=Kryo 211=Kryo 800=Falkor-V1/Kryo 801=Kryo-V2 802=Kryo-3XX-Gold 803=Kryo-3XX-Silver 804=Kryo-4XX-Gold 805=Kryo-4XX-Silver c00=Falkor c01=Saphira"); table("c0","ac3=Ampere-1 ac4=Ampere-1a"); } /^@@CPUINFO@@$/ { section=1; next } /^@@MIDR@@$/ { flush(); section=2; next } section==2 { s=tolower(trim($0)); sub(/^0x/,"",s); if(s!~/^[0-9a-f]+$/ || length(s)<8) next; s=substr(s,length(s)-7); arm("0x" substr(s,1,2),"0x" substr(s,5,3)); next; } section==1 && /^[[:space:]]*$/ { flush(); next } { pos=index($0,":"); if(!pos) next; key=tolower(trim(substr($0,1,pos-1))); value=trim(substr($0,pos+1)); if(section==0) { if(key=="model name" && useful(value) && !lsseen[value]++) ls[++nl]=value; if(key=="bios model name" && useful(value) && !biosseen[value]++) bios[++nb]=value; next; } if(key=="processor" && value~/^[0-9]+$/) flush(); if(key=="cpu implementer") implementer=value; if(key=="cpu part") part=value; if(key=="mvendorid") mvendor=value; if(key=="marchid") march=value; if(key=="mimpid") mimp=value; if(key~/^(model name|cpu model|cpu|uarch|cpu type|processor)$/ && useful(value)) { if(model=="" || key=="model name" || key=="uarch") model=value; } if(key~/^processor[[:space:]]+[0-9]+$/ && value~/machine[[:space:]]*=/) { s=value; sub(/^.*machine[[:space:]]*=[[:space:]]*/,"",s); sub(/[,[:space:]].*$/,"",s); if(s!="") addraw("IBM S/390 machine " s); } } END { flush(); if(nn>0) { output(name,nn); if(nc>1) { printf " [cores: "; output(core,nc); printf "]" } } else if(nc>1) { output(core,nc); } else if(nl>0) { output(ls,nl); } else if(nb>0) { output(bios,nb); } else if(nc>0) { output(core,nc); } else if(nr>0) { output(raw,nr); } if(nn+nc+nl+nb+nr>0) print ""; }' 2>/dev/null); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; if ! $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null; then v=$(emit() { [ -n "$1" ] || return; case "$seen" in *"|$1|"*) return ;; esac; printf '%s%s' "$sep" "$1"; sep=' + '; seen="$seen|$1|"; }; rec() { if [ -n "$n" ]; then emit "$n"; elif [ -n "$i" ] && [ -n "$p" ]; then emit "ARM implementer=$i part=$p"; fi; n= i= p=; }; n= i= p= seen= sep=; if [ -r /proc/cpuinfo ]; then while IFS=: read -r k x || [ -n "$k$x" ]; do k=${k#"${k%%[![:space:]]*}"}; k=${k%"${k##*[![:space:]]}"}; x=${x#"${x%%[![:space:]]*}"}; x=${x%"${x##*[![:space:]]}"}; case "$k" in '') rec ;; processor) case "$x" in *[!0-9]*) ;; *) rec ;; esac ;; 'CPU implementer') i=$x ;; 'CPU part') p=$x ;; 'model name'|'Model Name'|'cpu model'|cpu|uarch|'cpu type'|Processor) case "$x" in ''|[Uu][Nn][Kk][Nn][Oo][Ww][Nn]*|[Nn]/[Aa]|[Aa][Rr][Mm]*[Pp]rocessor*|[Aa][Aa][Rr][Cc][Hh]64*) ;; *) case "$x" in *[!0-9]*) n=$x ;; esac ;; esac ;; esac; done < /proc/cpuinfo; rec; fi); [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; fi; v=$(for d in /sys/firmware/devicetree/base /proc/device-tree; do [ -d "$d/cpus" ] || continue; for f in "$d"/cpus/*/compatible; do [ -r "$f" ] || continue; tr '\000' '\n' < "$f" 2>/dev/null || busybox tr '\000' '\n' < "$f" 2>/dev/null || toybox tr '\000' '\n' < "$f" 2>/dev/null; done; break; done | $a 'NF && !seen[$0]++ { printf "%s%s",n++?" + ":"CPU compatible: ",$0 } END { if(n) print "" }' 2>/dev/null); printf '%s\n' "${v:-unknown ($arch)}") gpu_info=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$(for c in lspci 'busybox lspci' 'toybox lspci'; do p=$($c -Dnn 2>/dev/null) || p=; [ -n "$p" ] || { p=$($c -nn 2>/dev/null) || p=; }; [ -n "$p" ] || { p=$($c 2>/dev/null) || p=; }; p=$(printf '%s\n' "$p" | $a '{ s=tolower($0) } s~/\[03[0-9a-f][0-9a-f]\]/ || s~/(vga compatible|3d|display) controller/ || s~/(^|[[:space:]])(class[[:space:]]+)?03[0-9a-f][0-9a-f]:[[:space:]]/ { if(!seen[$0]++) print }' 2>/dev/null); [ -n "$p" ] && { printf '%s\n' "$p"; break; }; done); if [ -n "$v" ]; then printf '%s\n' "$v"; else for d in /sys/bus/pci/devices/*; do c=$(r "$d/class"); case $c in 0x03????) x=$(r "$d/vendor"); y=$(r "$d/device"); printf '%s display controller [%s:%s]\n' "${d##*/}" "${x#0x}" "${y#0x}" ;; esac; done; fi; for d in /sys/class/drm/card[0-9]* /sys/class/drm/renderD[0-9]*; do [ -d "$d/device" ] || continue; case ${d##*/} in *-*) continue ;; esac; e=$(r "$d/device/uevent"); case $e in *PCI_SLOT_NAME=*) continue ;; esac; p=$(CDPATH= cd -P "$d/device" 2>/dev/null && pwd -P); [ -n "$p" ] || continue; x=$(printf '%s\n' "$e" | $a '/^DRIVER=/ { sub(/^DRIVER=/,""); print; exit }' 2>/dev/null); printf '%s DRM device: %s\n' "$p" "${x:-unknown}"; done | $a '!seen[$0]++' 2>/dev/null) last_output=$(last 2>/dev/null) filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ) printf 'UNAME:%s\n' "$uname" printf 'ARCH:%s\n' "$arch" printf 'UPTIME:%s\n' "$uptime" printf 'CPUS:%s\n' "$cpus" printf 'CPU_MODEL:%s\n' "$cpu_model" printf 'GPU:%s\n' "$gpu_info" printf 'LAST:%s\n' "$last_output" printf 'FILTER:%s\n' "$filter_output"
109.160.32.115 United States, North Carolina
51
ssh
ssh user=bjji · ssh cmd=uname -s -v -n -r -m
109.160.32.77 United States, North Carolina
51
ssh
ssh user=ubuntu · ssh cmd=uname -s -v -n -r -m
109.160.32.46 United States, North Carolina
51
ssh
ssh user=eshiyanova · ssh cmd=uname -s -v -n -r -m
47.242.108.72 Hong Kong, Central and Western District
42
ssh
ssh user=root · ssh cmd=uname -a
3.110.49.213 India, Maharashtra
35
http
/.env · /.env.local
152.32.207.21 United States, Virginia
35
ftp
ftp connection · ftp ���Vx�3���D�{�yG�bBf�5t����B dr���Ui�p�I�n�_0o��I����-9vP�4̨̩�/�0�+�,� �̨̪3=�
152.32.150.7 United States, Virginia
34
ftp
ftp connection · ftp ��:a �'%U]�Ъ���sk��Ӟ1��b�� ��E�~/�bFj�$<��`3b���7��m����>4̨̩�/�0�+�,� �̨̪3=�
212.181.252.130 Sweden, Uppsala County
28
ssh
ssh user=ubuntu · ssh cmd=uname -a
130.185.120.96 Turkey, Istanbul
21
ssh
ssh user=root · ssh cmd=uname -a
81.171.72.93 Germany, State of Berlin
20
http
/backup.sql · /config.php
172.236.228.198 United States, California
19
ftp
ftp connection · ftp 
34.79.30.146 Belgium, Brussels Capital
16
ftp
ftp connection · ftp USER anonymous
152.32.148.250 United States, Virginia
16
ftp
ftp connection · ftp session_end

probed paths

what the scanners ask for, verbatim. mostly the usual secret-hunting dictionary.

pathhits
/.git/config
9
/.env
8
/.env.production
3
/.env.local
2
/backup.sql
2
/dump.sql
2
/database.sql
2
/.npmrc
2
/.git/HEAD
2
/.env.prod
1
/.env.dev
1
/.env.bak
1

how to read this: .env and .git/config probes are automated secret-scrapers hitting every vhost on the box. wp-login.php and xmlrpc.php are wordpress credential-stuffing. every one of these paths answers with decoy content and the source ip is banned on first contact.

ssh decoy

usernames tried on the fake ssh shell (port 22 decoy).

root admin 345gs5662d34 administrator bjji ubuntu es backup admin1 git node nico

ftp decoy

commands and usernames on the fake ftp service (port 21 decoy).

connection session_end AUTH TLS auth_attempt USER anonymous AUTH SSL QUIT PASV LIST TYPE A PWD

fail2ban jails

what the ban side is doing — per-jail current and lifetime bans. jails are named, not ported: ports are the boring part.

0
banned right now
0
total bans recorded
80
banned on decoy contact
jail now lifetime state

fail2ban unavailable at generation time.

how to read this: jails with zero lifetime bans are doing nothing because nothing tripped them — that is the good outcome. the decoy-contact bans are the aggressive ones: touch a decoy, get banned.

banned

one-time visitors, auto-banned the moment they touched a decoy.

hedge: this is a sample of what a public ip does to a decoy service. it is background radiation plus targeted secret-scraping. no decoy grants access to anything real.