xoneypot
selfhost.im · LIVE CAPTURE
Connections
33
7 in last minute
Unique Sources
17
distinct IPs
Ports Hit
4
distinct ports
Bytes Captured
5.5 KB
total raw data
IoT Attacks — telnet credential harvesting + rigged BusyBox
1050 sessions · 682 attempts · 682 accepted · 28359 commands · 4 dropper URLs
16:58:01
185.115.171.183
→
:23
0 attempts
0 commands
read_timeout
16:49:49
82.208.127.212
→
:23
1 attempts
0 commands
shell
eof
root:1234horses
16:48:55
203.218.169.61
→
:2323
1 attempts
119 commands
shell
read_timeout
admin:admin
16:48:53
203.218.169.61
→
:2323
1 attempts
8 commands
shell
eof
admin:admin
16:48:07
211.194.52.6
→
:23
1 attempts
119 commands
shell
read_timeout
admin:admin
16:48:05
211.194.52.6
→
:23
1 attempts
8 commands
shell
eof
admin:admin
16:47:36
222.109.58.57
→
:23
1 attempts
71 commands
shell
eof
admin:admin
16:47:34
222.109.58.57
→
:23
1 attempts
8 commands
shell
eof
admin:admin
16:33:58
203.218.169.61
→
:2323
1 attempts
119 commands
shell
read_timeout
admin:admin
16:33:56
203.218.169.61
→
:2323
1 attempts
8 commands
shell
eof
admin:admin
16:33:06
211.194.52.6
→
:23
1 attempts
119 commands
shell
read_timeout
admin:admin
16:33:04
211.194.52.6
→
:23
1 attempts
8 commands
shell
eof
admin:admin
16:32:40
222.109.58.57
→
:23
1 attempts
53 commands
shell
eof
admin:admin
16:32:37
222.109.58.57
→
:23
1 attempts
8 commands
shell
eof
admin:admin
16:30:43
185.115.171.183
→
:23
0 attempts
0 commands
read_timeout
16:30:42
104.131.11.62
→
:23
0 attempts
0 commands
read_timeout
16:26:06
118.194.228.239
→
:23
0 attempts
0 commands
eof
16:25:48
118.194.228.239
→
:23
0 attempts
0 commands
eof
16:25:29
118.194.228.239
→
:23
0 attempts
0 commands
eof
16:25:29
118.194.228.239
→
:23
1 attempts
0 commands
shell
live
\x16\x03\x01\x00\x01\x00\x00\x03\x03Ӽ`3<&\x01J+F6\T]\x1aa'& re\x09j+ɣ(JMe8_&\x004̨̩/0+,\x09\x00̨̪\x003\x00=\x00\x16:\x009\x13\x00
HTTP Requests — URLs & bodies probed via Caddy
2906 requests · 776 urls · 132 sources · 97 with body
16:59:53
45.79.181.104
→
:8443
GET
/
16:58:27
47.251.116.218
→
:8443
GET
/
16:58:07
47.251.116.218
→
:8443
GET
/
16:54:03
3.129.187.38
→
:9200
GET
/
16:52:55
3.129.187.38
→
:9200
GET
/
16:49:15
123.160.223.75
→
:3000
GET
/favicon.ico
16:49:15
123.160.223.74
→
:3000
GET
/
16:48:59
123.160.223.73
→
:3000
GET
/favicon.ico
16:48:58
123.160.223.74
→
:3000
GET
/
16:48:55
123.160.223.72
→
:3000
GET
/favicon.ico
16:48:55
123.160.223.72
→
:3000
GET
/favicon.ico
16:48:54
123.160.223.73
→
:3000
GET
/favicon.ico
16:48:54
123.160.223.73
→
:3000
GET
/favicon.ico
16:48:54
123.160.223.75
→
:3000
GET
/favicon.ico
16:48:54
123.160.223.72
→
:3000
GET
/
16:48:54
123.160.223.74
→
:3000
GET
/
16:48:54
123.160.223.74
→
:3000
GET
/
16:48:54
123.160.223.73
→
:3000
GET
/
16:48:54
123.160.223.74
→
:3000
GET
/
16:48:53
156.225.1.39
→
:9200
GET
/favicon.ico
Top Ports
:51413
24
:6379
5
:8443
3
:23
1
Top Sources
167.56.189.202
4
125.239.84.82
3
23.234.76.223
3
203.188.168.1
3
172.216.151.235
3
152.203.4.64
3
90.166.18.208
2
73.116.26.227
2
47.251.116.218
2
185.247.137.177
1
87.236.176.160
1
185.115.171.183
1
45.79.181.104
1
185.247.137.167
1
195.96.139.173
1
Protocol Distribution
unknown
26
http
3
dns
2
telnet
1
tls
1
Dropper Scripts — captured from wget/curl/tftp
README.md
(from disk: README.md)
5.3 KB
SHA256: 0ac2dd1324854a29... — click to view full script
Analysis Reports — AI-generated per port
Port :23
unknown
unknown
16:56:21
# Port 23 — telnet **Source**: 222.109.58.57 **Size**: 141 bytes **Captured**: 2026-10-16T16:38:18.815628Z ## Raw Data...