Kojoney Honeypot Report ----------------------- Date: dom 31 jul 2005 23:48:18 CEST Log lines: 93758 Log size: 6,8M ../old_logs/log_capado.txt Authenticated users. Successfull logons --------------------------------------- 25 admin 19 root 10 test 7 mysql 6 oracle 5 webmaster 5 user 5 guest 5 ftp 4 web 3 webadmin 3 unix 3 linux 2 administrator Total 102 Unauthenticated users. Failed logons ------------------------------------ 4910 root 44 test 35 admin 20 testuser 15 ftpuser 15 alex 14 adam 13 danny 12 paul 12 mike 12 mail 11 guest 10 sales 10 ellen 10 adm 9 user 9 ronald 9 postgres 9 pgsql 9 jack 9 info 9 george 9 francis 9 eric 9 ben 8 webmaster 8 richard 8 michael 8 john 8 apple 8 alin 7 white 7 stephanie 7 russ 7 kayla 7 filip 7 clinton 7 clark 7 cesar 7 carol 7 adrian 6 wwwrun 6 www 6 webster 6 viper 6 username 6 theo 6 student 6 steven 6 stephen 6 shell 6 service 6 postfix 6 philip 6 nobody 6 matt 6 master 6 martin 6 mailtest 6 jerry 6 jeremy 6 james 6 isabelle 6 http 6 hacker 6 hack 6 fred 6 drive 6 dexter 6 cycle 6 cvs 6 brian 6 bob 6 bill 6 backup 6 aron 6 apache 6 angel 5 willie 5 thomas 5 testing 5 sshd 5 paintball1 5 operator 5 nathan 5 diamond 5 david 5 chris 5 amanda 4 xxx 4 walter 4 sybase 4 snoopy 4 simon 4 signalhill 4 seoulselection 4 robert 4 nicole 4 mri 4 kelly 4 karika 4 joshua 4 jking 4 jesus 4 instrume 4 hiperg 4 gary 4 ethereal 4 carshowguide 4 beginner 4 bear 4 ashley 4 andrei 4 alberto 4 albert 4 alan 4 aecpro 4 admins 3 zena 3 yolanda 3 xtra 3 xbox 3 www-data 3 wwwdata 3 win 3 wilma 3 willy 3 willow 3 will 3 weenie 3 webpop 3 wayne 3 waterboy 3 wanker 3 wang 3 virginia 3 viorel 3 vincintz 3 vinci 3 vicky 3 vermont 3 ventas 3 venom 3 vdi 3 vasilios 3 valerie 3 valentin 3 union 3 ultra 3 tweety 3 trash 3 tony 3 tomcat 3 tom 3 tmp 3 tir 3 tip 3 tino 3 timothy 3 tim 3 tigger 3 tiffany 3 theresa 3 thaiset 3 temp 3 technicom 3 tasha 3 tamara 3 tads 3 system 3 sys_admin 3 sync 3 sylvia 3 sya 3 sven 3 suva 3 susan 3 superman 3 sunsun 3 sunny 3 steve 3 spike 3 spider 3 spencer 3 spam 3 sonny 3 smith 3 sme 3 sm 3 sll 3 skkb 3 silver 3 shop 3 shaun 3 sharp 3 sharon 3 sham 3 semenov 3 seba 3 sean 3 scorpion 3 scan 3 save 3 sarah 3 sandra 3 samuel 3 sammy 3 samir 3 samba 3 rrhh 3 rosa 3 rolo 3 roland 3 rock 3 rivlocal 3 rezvie 3 resin 3 recepcion2piso 3 quincy 3 pvm 3 purple 3 prueba 3 princess 3 porno 3 play 3 phil 3 petru 3 pete 3 penelope 3 peewee 3 peaches 3 paulj 3 patrick 3 pascal 3 paintball 3 orange 3 one 3 oficina1piso 3 o2 3 notused 3 norman 3 norm 3 nora 3 nina 3 news 3 netdump 3 netadmin 3 mysql 3 myra 3 mustang 3 mouse 3 mortimer 3 moon 3 monique 3 monica 3 mirc 3 miller 3 mikael 3 mihai 3 mich 3 mia 3 merlin 3 max 3 maverick 3 maurice 3 matthew 3 matilda 3 marvin 3 martinez 3 marleth 3 mark 3 marivic 3 mario 3 maria 3 margaret 3 marcus 3 magic 3 madison 3 lucas 3 lloyd 3 lisa 3 linda 3 library 3 leslie 3 leroy 3 leonard 3 leon 3 lee 3 laurentiu 3 larry 3 kristin 3 kristen 3 kramer 3 kjayroe 3 kinder 3 kim 3 kevin 3 ken 3 keith 3 kay 3 katie 3 kathy 3 kathrine 3 kathleen 3 karl 3 jupiter 3 junior 3 julie 3 jukebox 3 johny 3 joey 3 joerg 3 joeflores 3 joanna 3 jmartin 3 jimmy 3 jim 3 jester 3 jessie 3 jeffrey 3 jeff 3 janice 3 ismail 3 ionut 3 ioana 3 internet 3 ident 3 iceuser 3 httpd 3 honey 3 hessam 3 herbert 3 hera 3 henry 3 hatton 3 harry 3 harrison 3 harris 3 harold 3 harley 3 hammer 3 hamlet 3 hall 3 hal 3 gwen 3 guinness 3 guest2 3 gregory 3 graham 3 grace 3 gordon 3 godzilla 3 girl 3 ginger 3 gerencia 3 gemma 3 games 3 gabi 3 ftphome 3 friends 3 franklin 3 frank 3 francois 3 flower 3 fletcher 3 fernie 3 felix 3 fax 3 fauzi 3 faridah 3 eva 3 eugen 3 erica 3 enzo 3 emmanuel 3 emil 3 elly 3 elizabeth 3 elizabet 3 elena 3 edward 3 edgar 3 eddie 3 ed 3 earl 3 dylan 3 dust 3 duncan 3 dujoey 3 duckie 3 dominic 3 doming 3 doctor 3 dkauffman 3 dev 3 denise 3 deborah 3 debbie 3 deb 3 dboachie 3 db 3 davis 3 dave 3 data 3 daniela 3 daniel 3 dana 3 dan 3 dale 3 cyrus 3 cyp 3 cynthia 3 cristi 3 crichard 3 craig 3 courier 3 corinna 3 control 3 comun 3 collins 3 colleen 3 clock 3 claudia 3 chipmast 3 cheryl 3 charlott 3 center 3 cassie 3 carl 3 capacitacion 3 call3 3 call2 3 call1 3 buster 3 burrelli 3 bunny 3 bull 3 bryan 3 bruce 3 brett 3 bret 3 boss 3 boon 3 bong 3 bonec 3 bogdan 3 bobby 3 black 3 bird 3 bind 3 billy 3 bert 3 bernard 3 beny 3 belea 3 beavis 3 bcampion 3 bayonne 3 bash 3 bart 3 barbara 3 banner 3 bank 3 bandit 3 austin 3 atir 3 arthur 3 arnold 3 aris 3 areyes 3 arbaiah 3 apples 3 anton 3 anthony 3 anonymous 3 anna 3 ann 3 anita 3 angie 3 angela 3 andy 3 andrew 3 andres 3 andreea 3 andi 3 amdsa 3 alvin 3 almacen 3 allan 3 alka 3 alice 3 ali 3 alfred 3 alexie 3 alexandru 3 alexander 3 ahmed 3 administracionventas 3 admin2 3 adine 3 adi 3 abilenki 3 abby 3 aaron 2 web 2 watson 2 vanesa 2 users 2 tara 2 sgi 2 server1 2 search 2 sara 2 rpm 2 Robert 2 postmaster 2 peter 2 party 2 oracle 2 Nicole 2 mickey 2 marlon 2 justin1 2 Justin 2 justin 2 Joshua 2 Jordan 2 Jewel 2 jet 2 iesse 2 ian 2 garv 2 failed 2 dick 2 damian 2 Dakota 2 Chicago 2 Abel 2 Aba 2 Aaron 2 Aaliyah 1 word 1 winner 1 winer 1 wille 1 wallimo_phpbb1 1 vanessa 1 travel_phpb1 1 teen 1 ssh 1 spirit 1 sex 1 sangley_xmb1 1 radu 1 network 1 myrhodesiaiscom 1 music 1 mp3 1 monkey 1 michey 1 michel 1 lynx 1 lpd 1 lpa 1 lolita 1 lion 1 lemancaf_leman 1 jordan 1 Joan 1 jesse 1 jcoret 1 root 1 HSB 1 heart 1 fluffy 1 filippid_admin 1 dakota 1 Christ 1 chicago 1 bebe 1 BACKUP 1 arbgirl_phpbb1 1 apple1 1 alibaba 1 adult 1 Administrator 1 administrator 1 absurdir_deadphp Total 7023 Users successfully authenticateds with publickey ------------------------------------------------ Total 0 Users unsuccessfully authenticateds with publickey -------------------------------------------------- 20 ssh-userauth Total 20 Logons with null passwords -------------------------- 20 admin 5 root 1 user 1 test 1 oracle 1 joxean 1 ftp Total 30 Logons with or without password ------------------------------- 4934 root 98 admin 55 test 20 testuser 16 guest 15 user 15 ftpuser 15 alex 14 adam 13 webmaster 13 danny 12 paul 12 mike 12 mail 10 sales 10 oracle 10 mysql 10 ellen 10 adm 9 ronald 9 postgres 9 pgsql 9 jack 9 info 9 george 9 francis 9 eric 9 ben 8 richard 8 michael 8 john 8 apple 8 alin 7 white 7 stephanie 7 russ 7 kayla 7 filip 7 clinton 7 clark 7 cesar 7 carol 7 adrian 6 wwwrun 6 www 6 webster 6 web 6 viper 6 username 6 theo 6 student 6 steven 6 stephen 6 shell 6 service 6 postfix 6 philip 6 nobody 6 matt 6 master 6 martin 6 mailtest 6 jerry 6 jeremy 6 james 6 isabelle 6 http 6 hacker 6 hack 6 ftp 6 fred 6 drive 6 dexter 6 cycle 6 cvs 6 brian 6 bob 6 bill 6 backup 6 aron 6 apache 6 angel 5 willie 5 thomas 5 testing 5 sshd 5 paintball1 5 operator 5 nathan 5 diamond 5 david 5 chris 5 amanda 4 xxx 4 walter 4 sybase 4 snoopy 4 simon 4 signalhill 4 seoulselection 4 robert 4 nicole 4 mri 4 kelly 4 karika 4 joshua 4 jking 4 jesus 4 instrume 4 hiperg 4 gary 4 ethereal 4 carshowguide 4 beginner 4 bear 4 ashley 4 andrei 4 alberto 4 albert 4 alan 4 aecpro 4 admins 3 zena 3 yolanda 3 xtra 3 xbox 3 www-data 3 wwwdata 3 win 3 wilma 3 willy 3 willow 3 will 3 weenie 3 webpop 3 webadmin 3 wayne 3 waterboy 3 wanker 3 wang 3 virginia 3 viorel 3 vincintz 3 vinci 3 vicky 3 vermont 3 ventas 3 venom 3 vdi 3 vasilios 3 valerie 3 valentin 3 unix 3 union 3 ultra 3 tweety 3 trash 3 tony 3 tomcat 3 tom 3 tmp 3 tir 3 tip 3 tino 3 timothy 3 tim 3 tigger 3 tiffany 3 theresa 3 thaiset 3 temp 3 technicom 3 tasha 3 tamara 3 tads 3 system 3 sys_admin 3 sync 3 sylvia 3 sya 3 sven 3 suva 3 susan 3 superman 3 sunsun 3 sunny 3 steve 3 spike 3 spider 3 spencer 3 spam 3 sonny 3 smith 3 sme 3 sm 3 sll 3 skkb 3 silver 3 shop 3 shaun 3 sharp 3 sharon 3 sham 3 semenov 3 seba 3 sean 3 scorpion 3 scan 3 save 3 sarah 3 sandra 3 samuel 3 sammy 3 samir 3 samba 3 rrhh 3 rosa 3 rolo 3 roland 3 rock 3 rivlocal 3 rezvie 3 resin 3 recepcion2piso 3 quincy 3 pvm 3 purple 3 prueba 3 princess 3 porno 3 play 3 phil 3 petru 3 pete 3 penelope 3 peewee 3 peaches 3 paulj 3 patrick 3 pascal 3 paintball 3 orange 3 one 3 oficina1piso 3 o2 3 notused 3 norman 3 norm 3 nora 3 nina 3 news 3 netdump 3 netadmin 3 myra 3 mustang 3 mouse 3 mortimer 3 moon 3 monique 3 monica 3 mirc 3 miller 3 mikael 3 mihai 3 mich 3 mia 3 merlin 3 max 3 maverick 3 maurice 3 matthew 3 matilda 3 marvin 3 martinez 3 marleth 3 mark 3 marivic 3 mario 3 maria 3 margaret 3 marcus 3 magic 3 madison 3 lucas 3 lloyd 3 lisa 3 linux 3 linda 3 library 3 leslie 3 leroy 3 leonard 3 leon 3 lee 3 laurentiu 3 larry 3 kristin 3 kristen 3 kramer 3 kjayroe 3 kinder 3 kim 3 kevin 3 ken 3 keith 3 kay 3 katie 3 kathy 3 kathrine 3 kathleen 3 karl 3 jupiter 3 junior 3 julie 3 jukebox 3 johny 3 joey 3 joerg 3 joeflores 3 joanna 3 jmartin 3 jimmy 3 jim 3 jester 3 jessie 3 jeffrey 3 jeff 3 janice 3 ismail 3 ionut 3 ioana 3 internet 3 ident 3 iceuser 3 httpd 3 honey 3 hessam 3 herbert 3 hera 3 henry 3 hatton 3 harry 3 harrison 3 harris 3 harold 3 harley 3 hammer 3 hamlet 3 hall 3 hal 3 gwen 3 guinness 3 guest2 3 gregory 3 graham 3 grace 3 gordon 3 godzilla 3 girl 3 ginger 3 gerencia 3 gemma 3 games 3 gabi 3 ftphome 3 friends 3 franklin 3 frank 3 francois 3 flower 3 fletcher 3 fernie 3 felix 3 fax 3 fauzi 3 faridah 3 eva 3 eugen 3 erica 3 enzo 3 emmanuel 3 emil 3 elly 3 elizabeth 3 elizabet 3 elena 3 edward 3 edgar 3 eddie 3 ed 3 earl 3 dylan 3 dust 3 duncan 3 dujoey 3 duckie 3 dominic 3 doming 3 doctor 3 dkauffman 3 dev 3 denise 3 deborah 3 debbie 3 deb 3 dboachie 3 db 3 davis 3 dave 3 data 3 daniela 3 daniel 3 dana 3 dan 3 dale 3 cyrus 3 cyp 3 cynthia 3 cristi 3 crichard 3 craig 3 courier 3 corinna 3 control 3 comun 3 collins 3 colleen 3 clock 3 claudia 3 chipmast 3 cheryl 3 charlott 3 center 3 cassie 3 carl 3 capacitacion 3 call3 3 call2 3 call1 3 buster 3 burrelli 3 bunny 3 bull 3 bryan 3 bruce 3 brett 3 bret 3 boss 3 boon 3 bong 3 bonec 3 bogdan 3 bobby 3 black 3 bird 3 bind 3 billy 3 bert 3 bernard 3 beny 3 belea 3 beavis 3 bcampion 3 bayonne 3 bash 3 bart 3 barbara 3 banner 3 bank 3 bandit 3 austin 3 atir 3 arthur 3 arnold 3 aris 3 areyes 3 arbaiah 3 apples 3 anton 3 anthony 3 anonymous 3 anna 3 ann 3 anita 3 angie 3 angela 3 andy 3 andrew 3 andres 3 andreea 3 andi 3 amdsa 3 alvin 3 almacen 3 allan 3 alka 3 alice 3 ali 3 alfred 3 alexie 3 alexandru 3 alexander 3 ahmed 3 administrator 3 administracionventas 3 admin2 3 adine 3 adi 3 abilenki 3 abby 3 aaron 2 watson 2 vanesa 2 users 2 trying 2 tara 2 sgi 2 server1 2 search 2 sara 2 rpm 2 Robert 2 postmaster 2 peter 2 party 2 Nicole 2 mickey 2 marlon 2 justin1 2 Justin 2 justin 2 joxean 2 Joshua 2 Jordan 2 Jewel 2 jet 2 iesse 2 ian 2 garv 2 dick 2 damian 2 Dakota 2 Chicago 2 Abel 2 Aba 2 Aaron 2 Aaliyah 1 word 1 winner 1 winer 1 wille 1 wallimo_phpbb1 1 vanessa 1 travel_phpb1 1 teen 1 ssh 1 spirit 1 sex 1 sangley_xmb1 1 radu 1 network 1 myrhodesiaiscom 1 music 1 mp3 1 monkey 1 michey 1 michel 1 lynx 1 lpd 1 lpa 1 lolita 1 lion 1 lemancaf_leman 1 jordan 1 Joan 1 jesse 1 root 1 HSB 1 heart 1 fluffy 1 filippid_admin 1 dakota 1 Christ 1 chicago 1 bebe 1 BACKUP 1 arbgirl_phpbb1 1 apple1 1 alibaba 1 adult 1 Administrator 1 absurdir_deadphp Total 7174 Number of times a remote shell was opened ----------------------------------------- Total 100 X11 forward requests -------------------- Total 2 Executed different commands --------------------------- 11 ls -lga 10 w 10 ls 6 who 6 uname 5 id 5 exit 4 pwd 4 clear 3 ps 2 wget .. 2 uptime 2 sudo 2 passwd 2 ls -a 2 logout 2 login 2 ftp .. 2 cd home 2 1 whoami 1 vdir 1 unbam 1 unae 1 This is a fucking honeypot, yeah :) 1 This is a fa 1 su 1 p[ss ax 1 ps ls 1 ps -l 1 php -0v 1 lsa 1 lougout 1 ld 1 l 1 help 1 ext 1 exith 1 exit 1 ewx 1 cwd 1 cd /var/tmp 1 cd non-existent 1 cd etc 1 cd dev 1 cat 1 ç 1 apache 1 a Total 113 Number of times the intruder tries to change the terminal window size --------------------------------------------------------------------- Total 5 IP Addresses ------------ 1 222.66.29.251 - 1 conexion(es) 2 220.132.30.12 - 17 conexion(es) 3 219.166.152.202 - 1 conexion(es) 4 218.75.120.146 - 1 conexion(es) 5 218.69.8.78 - 1 conexion(es) 6 218.6.197.7 - 1 conexion(es) 7 212.103.139.105 - 2 conexion(es) 8 211.40.49.59 - 8 conexion(es) 9 210.178.60.1 - 4 conexion(es) 10 210.0.212.151 - 1 conexion(es) 11 209.50.113.123 - 107 conexion(es) 12 209.152.166.77 - 5093 conexion(es) 13 202.155.224.86 - 62 conexion(es) 14 202.129.54.22 - 79 conexion(es) 15 201.14.228.254 - 4 conexion(es) 16 192.168.1.6 - 9 conexion(es) 17 192.168.1.100 - 2 conexion(es) 18 172.179.184.30 - 1 conexion(es) 19 127.0.0.1 - 21 conexion(es) 20 83.52.20.130 - 2 conexion(es) 21 82.77.71.107 - 2 conexion(es) 22 82.76.27.43 - 2 conexion(es) 23 82.43.139.111 - 1 conexion(es) 24 81.96.76.168 - 7 conexion(es) 25 81.181.97.30 - 1 conexion(es) 26 80.57.116.77 - 1681 conexion(es) 27 62.116.40.103 - 54 conexion(es) 28 61.75.4.142 - 1 conexion(es) 29 61.59.221.179 - 4 conexion(es) 30 61.38.187.68 - 1 conexion(es) 31 59.52.28.132 - 1 conexion(es) Total 31 IP Addresses and Countries -------------------------- 1 222.66.29.251 - CN, China 2 220.132.30.12 - TW, Taiwan Province of China 3 219.166.152.202 - JP, Japan 4 218.75.120.146 - CN, China 5 218.69.8.78 - CN, China 6 218.6.197.7 - CN, China 7 212.103.139.105 - SI, Slovenia 8 211.40.49.59 - KR, Republic of Korea 9 210.178.60.1 - KR, Republic of Korea 10 210.0.212.151 - HK, Hong Kong Special Administrative Region of China 11 209.50.113.123 - US, United States 12 209.152.166.77 - US, United States 13 202.155.224.86 - HK, Hong Kong Special Administrative Region of China 14 202.129.54.22 - TH, Thailand 15 201.14.228.254 - BR, Brazil 16 192.168.1.6 - **, Intranet address 17 192.168.1.100 - **, Intranet address 18 172.179.184.30 - US, United States 19 127.0.0.1 - **, Intranet address 20 83.52.20.130 - ES, Spain 21 82.77.71.107 - RO, Romania 22 82.76.27.43 - RO, Romania 23 82.43.139.111 - GB, United Kingdom 24 81.96.76.168 - GB, United Kingdom 25 81.181.97.30 - RO, Romania 26 80.57.116.77 - NL, Netherlands 27 62.116.40.103 - AT, Austria 28 61.75.4.142 - KR, Republic of Korea 29 61.59.221.179 - TW, Taiwan Province of China 30 61.38.187.68 - KR, Republic of Korea 31 59.52.28.132 - CN, China Total 31 Sessions opened by humans ------------------------- Session with id 0 opened by a human Session with id 5 opened by a human Session with id 0 opened by a human Session with id 1682 opened by a human 4 human session(s) total Humans detecteds by IP ---------------------- Human detected at 127.0.0.1 (**, Intranet address) Human detected at 82.77.71.107 (RO, Romania) 2 human(s) total Internal Honeypot Errors ------------------------ Total 15