Loading threats
Execution of ls -d /var/artillery /opt/beelzebub /opt/glutton /opt/endlessh 2>/dev/null | wc -l to test for the presence of default Artillery, Beelzebub, Glutton, or Endlessh installation directories and return a numeric count of matches. The use of wc -l suggests the output is being programmatically evaluated, indicating automated honeypot or deception-service detection prior to continued interaction.
This attack primitive is part of the SikkerAPI detection catalog and is actively monitored across our global honeypot network. No IPs in the current retention window have triggered this detection signature.
When an attacker triggers this primitive, matched IPs will appear here with confidence scores, geolocation, and session details. Browse other SSH detections or look up a specific IP to check its threat profile.