flux fleet digest — 2026-09-13 07:37 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
3824 |
57 |
20853 |
266 |
-82% |
| canary-farm-1 |
2712 |
75 |
4791 |
217 |
-43% |
| control-1 |
4254 |
53 |
2820 |
82 |
+51% |
| frantech-ts |
2293 |
1 |
116 |
1 |
+1877% |
| netcup-ts |
1765 |
1 |
53 |
1 |
+3230% |
| ru-edge-1 |
1165 |
1 |
104 |
1 |
+1020% |
| sponge-01-ts |
2204 |
1 |
375 |
1 |
+488% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-xmlrpc-post |
60 |
0.0 |
infx |
| control-1 |
app-config-php-error |
28 |
4.8 |
5.9x |
| control-1 |
app-config-python-error |
30 |
4.3 |
6.9x |
| control-1 |
app-config-yaml-error |
23 |
7.7 |
3.0x |
| control-1 |
aws-credentials-file-error |
38 |
11.3 |
3.4x |
| control-1 |
config-json-error |
20 |
3.8 |
5.2x |
| control-1 |
env-production-error |
487 |
80.2 |
6.1x |
| control-1 |
phpinfo-error |
51 |
8.7 |
5.9x |
| control-1 |
webapp-config-bundle-js-error |
34 |
11.3 |
3.0x |
| control-1 |
webshell-sweep-observed |
33 |
5.1 |
6.4x |
| control-1 |
wp-config-error |
37 |
9.5 |
3.9x |
| frantech-ts |
not-handled |
1325 |
83.0 |
16.0x |
| frantech-ts |
phpunit-eval-stdin |
112 |
0.0 |
infx |
| frantech-ts |
tarpit |
26 |
1.0 |
26.0x |
| frantech-ts |
tarpit-disconnect |
26 |
1.0 |
26.0x |
| frantech-ts |
tarpit-module |
713 |
25.0 |
28.5x |
| frantech-ts |
webshell-sweep-observed |
25 |
0.0 |
infx |
| netcup-ts |
not-handled |
871 |
4.0 |
217.8x |
| netcup-ts |
phpunit-eval-stdin |
39 |
0.0 |
infx |
| netcup-ts |
tarpit |
22 |
4.0 |
5.5x |
| netcup-ts |
tarpit-disconnect |
21 |
4.0 |
5.2x |
| netcup-ts |
tarpit-module |
745 |
32.0 |
23.3x |
| ru-edge-1 |
aws-credentials-file-error |
28 |
0.0 |
infx |
| ru-edge-1 |
env-production |
24 |
0.0 |
infx |
| ru-edge-1 |
env-production-error |
69 |
0.0 |
infx |
| ru-edge-1 |
firebase-json-error |
28 |
0.0 |
infx |
| ru-edge-1 |
not-handled |
202 |
61.0 |
3.3x |
| ru-edge-1 |
phpunit-eval-stdin |
74 |
0.0 |
infx |
| ru-edge-1 |
tarpit-module |
232 |
23.0 |
10.1x |
| sponge-01-ts |
not-handled |
1390 |
40.0 |
34.8x |
| sponge-01-ts |
tarpit |
21 |
4.0 |
5.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| e6e6f15a77e8 ⟳ |
35 |
105 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ |
9 |
63 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
4 |
28 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| d3f27a8fb79f |
2 |
206 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-13 |
/ [tarpit-module] → /.git/config [fake-git-error] → / [tarpit-module] → /.DS_Store [ds-store] → / [tarpit-module] → / [tarpit] → … |
| 76d212a95300 ⟳ |
2 |
78 |
ai-devbox-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| c540fc530a5a ⟳ |
2 |
78 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| fd169a55036f |
1 |
1500 |
ai-devbox-1 |
09-13 |
/composer.lock [not-handled] → /wp-config.php.old [wp-config] → /composer.json [not-handled] → /configuration.php [app-config-php] → /config/settings.py [app-config-python] → /config/database.php [app |
| 303811c5ab0a |
1 |
47 |
canary-farm-1 |
09-13 |
/.git/HEAD [fake-git] → /.git/refs/heads/main [fake-git] → /.git/config [fake-git] → /.git/description [fake-git] → /.git/info/exclude [fake-git] → /.git/info/refs [fake-git] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| control-1 |
/ai/site-profile.json |
2026-09-13 03:31:58.976775-04:00 |
| control-1 |
/api/files |
2026-09-13 03:31:58.976775-04:00 |
| sponge-01-ts |
/aws_leak_probe_7958bac7 |
2026-09-13 03:31:58.976775-04:00 |
| control-1 |
/aws_leak_probe_079084eb |
2026-09-13 03:31:58.976775-04:00 |
| ru-edge-1 |
/boaform/admin/formLogin |
2026-09-13 03:31:58.976775-04:00 |
| ai-devbox-1 |
/v3/.env |
2026-09-13 03:15:36.666970-04:00 |
| ai-devbox-1 |
/bucket-name/config/.env |
2026-09-13 03:15:36.666970-04:00 |
| ai-devbox-1 |
/api/.env/wp-includes/leaf |
2026-09-13 03:15:36.666970-04:00 |
| ai-devbox-1 |
/frontend/sendgrid.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/.aws/credentials |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/.env.php-backup |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/twilio/.local/bin/aws/config/.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/twilio/.conda/bin/aws/config/.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/module/.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/laravel-sites/dev_grupo_total/.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/.env-openid |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/.azure/.env |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/vendor/phpunit/Util/PHP/eval-stdin.php |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/phpunit/phpunit/Util/PHP/eval-stdin.php |
2026-09-13 03:15:36.666970-04:00 |
| frantech-ts |
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
2026-09-13 03:15:36.666970-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Linux; Android 15; SM-G930P; Build/AP4A.190211. |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/6 |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple |
2026-09-13 03:32:00.439721-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537 |
2026-09-13 03:32:00.439721-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| ai-devbox-1 |
94.154.46.246 |
1500 |
93 |
743 |
09-12 04:12 |
09-12 04:13 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
136.70.175.146 |
839 |
138 |
609 |
09-12 06:33 |
09-12 06:34 |
- |
Google LLC |
US |
12 |
| canary-farm-1 |
103.81.230.80 |
104 |
23 |
67 |
09-12 22:05 |
09-12 22:07 |
- |
HostRoyale Technologies Pvt |
US |
7 |
| ai-devbox-1 |
103.81.230.80 |
102 |
23 |
65 |
09-12 20:10 |
09-12 20:14 |
- |
HostRoyale Technologies Pvt |
US |
7 |
| canary-farm-1 |
129.213.151.234 |
47 |
2 |
45 |
09-12 05:02 |
09-12 05:03 |
- |
Oracle Corporation |
US |
0 |
| ai-devbox-1 |
45.156.128.126 |
43 |
5 |
37 |
09-12 07:35 |
09-12 07:35 |
ipsum:2 |
Sistemas Informaticos, S.A. |
PT |
0 |
| canary-farm-1 |
138.68.144.227 |
39 |
25 |
34 |
09-12 20:35 |
09-12 20:36 |
ipsum:1 |
DigitalOcean, LLC |
GB |
3 |
| canary-farm-1 |
157.245.113.227 |
39 |
25 |
34 |
09-12 20:35 |
09-12 20:36 |
ipsum:1 |
DigitalOcean, LLC |
US |
3 |
| ai-devbox-1 |
167.99.181.249 |
39 |
25 |
34 |
09-12 20:30 |
09-12 20:31 |
ipsum:1 |
DigitalOcean, LLC |
CA |
3 |
| ai-devbox-1 |
68.183.9.16 |
39 |
25 |
34 |
09-12 20:30 |
09-12 20:31 |
ipsum:1 |
DigitalOcean, LLC |
NL |
3 |
| ai-devbox-1 |
45.156.128.47 |
26 |
1 |
26 |
09-12 07:35 |
09-12 07:35 |
ipsum:2 |
Sistemas Informaticos, S.A. |
PT |
0 |
| ai-devbox-1 |
104.219.251.64 |
12 |
2 |
1 |
09-12 12:10 |
09-12 23:36 |
- |
Namecheap, Inc. |
US |
4 |
| ai-devbox-1 |
47.254.122.247 |
7 |
3 |
1 |
09-12 07:09 |
09-12 07:09 |
- |
Alibaba (US) Technology Co., |
US |
0 |
| canary-farm-1 |
74.7.230.38 |
7 |
3 |
1 |
09-12 19:00 |
09-12 19:00 |
ipsum:1 |
Microsoft Corporation |
US |
0 |
| ai-devbox-1 |
185.226.197.73 |
7 |
3 |
1 |
09-12 05:13 |
09-12 05:13 |
ipsum:3 |
Zenlayer Inc |
PT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
3 |
1 |
| control-1 |
5 |
1 |
| canary-farm-1 |
13 |
3 |
| ai-devbox-1 |
18 |
5 |
Mint failures (24h): canary-farm-1:400x44; ru-edge-1:400x13; control-1:400x40; ai-devbox-1:400x45
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
13 |
| ru-edge-1 |
["aws"] |
3 |
| control-1 |
["aws"] |
5 |
| ai-devbox-1 |
["aws"] |
18 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 625
- multi-entry XFF (forged chains — no proxy appends on the direct path): 50
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
3545 |
| ai-devbox-1 |
https |
279 |
| canary-farm-1 |
http |
2423 |
| canary-farm-1 |
https |
289 |
| control-1 |
http |
4253 |
| control-1 |
https |
1 |
| frantech-ts |
http |
2293 |
| netcup-ts |
http |
1765 |
| ru-edge-1 |
http |
1165 |
| sponge-01-ts |
http |
2204 |
Top Host headers:
| sensor |
host |
events |
| control-1 |
38.54.2.209 |
4167 |
| ai-devbox-1 |
217.15.163.226 |
3270 |
| sponge-01-ts |
89.167.72.144 |
2188 |
| canary-farm-1 |
109.123.246.142 |
2019 |
| frantech-ts |
209.141.62.110 |
1931 |
| netcup-ts |
159.195.21.150 |
1755 |
| ru-edge-1 |
130.94.89.46 |
1151 |
| canary-farm-1 |
sso.rightabouteverything.show |
631 |
| ai-devbox-1 |
inference.fapthropic.com |
515 |
| frantech-ts |
we-love-the.world |
98 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (0 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
| 2026-09-05 |
3958 |
98 |
| 2026-09-04 |
4632 |
100 |
| 2026-09-03 |
2361 |
105 |
| 2026-09-02 |
4068 |
105 |
| 2026-09-01 |
15373 |
107 |
| 2026-08-31 |
24100 |
88 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
136.70.175.146 |
138 |
/ [tarpit-module] → /aws_leak_probe_edee14a6 [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] → /.env.local [env-production] → /@fs/proc/1/environ [vite-fs-proc-environ] → /aws/credentials [aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] |
Google LLC |
US |
| ai-devbox-1 |
94.154.46.246 |
93 |
/composer.lock [not-handled] → /wp-config.php.old [wp-config] → /composer.json [not-handled] → /configuration.php [app-config-php] → /config/settings.py [app-config-python] → /config/database.php [app-config-php-database] → /wp-config.php [wp-config] → /.aws/config [aws-config-file] → /config.php [app-config-php] → /yarn.lock [yarn-lock-error] → /.git/config [fake-git] → /config/app.php [app-config-php-services] |
Omegatech LTD |
US |
| ai-devbox-1 |
167.99.181.249 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
157.245.113.227 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
68.183.9.16 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
138.68.144.227 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
103.81.230.80 |
23 |
/ [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /index.php [tarpit-module] |
HostRoyale Technologies Pvt |
US |
| canary-farm-1 |
103.81.230.80 |
23 |
/ [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /index.php [tarpit-module] |
HostRoyale Technologies Pvt |
US |
| ai-devbox-1 |
45.156.128.126 |
5 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /wp-json [wp-rest-index] → /wp-content/plugins/wp-central/readme.txt [not-handled] → /wp-content/plugins/wpschoolpress/readme.txt [not-handled] → /wp-content/plugins/wp-video-lightbox/readme.txt [not-handled] → /wp-content/plugins/kingcomposer/readme.txt [not-handled] → /wp-content/plugins/fancy-product-designer/readme.txt [not-handled] → /wp-content/plugins/contact-form-7/readme.txt [not-handled] → /wp-content/plugins/wordpress-seo/readme.txt [not-handled] → /wp-content/plugins/akismet/readme.txt [not-handled] |
Sistemas Informaticos, S.A. |
PT |
| ai-devbox-1 |
109.174.130.45 |
3 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
M247 Europe SRL |
AE |
| ai-devbox-1 |
47.254.122.247 |
3 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
Alibaba (US) Technology Co., |
US |
| canary-farm-1 |
74.7.230.38 |
3 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
Microsoft Corporation |
US |
| ai-devbox-1 |
43.155.162.41 |
3 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
Tencent Building, Kejizhongy |
KR |
| canary-farm-1 |
80.169.110.222 |
3 |
/wp-json/ [wp-rest-index] → / [tarpit-module] → / [tarpit] |
COLT Technology Services Gro |
BE |
| ai-devbox-1 |
34.90.215.190 |
3 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
Google LLC |
NL |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 533 sources sent credentials → 349 got a shell (65%) → 253 ran a command (72% of shell-getters, 47% of sources)
- event level: 38787 credential attempts → 17886 accepted logins → 12281 commands (69% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 538 attempts
New commands this window (0 of 53 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 4570 |
7 |
109.160.32.114 |
"uname -m | awk '{printf $1}'" |
| 4570 |
7 |
109.160.32.114 |
"uname -s -v -n -r -m" |
| 1078 |
103 |
113.88.78.112 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 931 |
94 |
113.88.78.112 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 246 |
6 |
2.57.122.150 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 246 |
6 |
2.57.122.150 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 191 |
122 |
125.20.60.69 |
"uname -a 2>/dev/null" |
| 113 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 17232 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1038 |
345gs5662d34 |
345gs5662d34 |
| 788 |
root |
3245gs5662d34 |
| 119 |
root |
root |
| 65 |
root |
123456 |
| 59 |
admin |
3245gs5662d34 |
| 58 |
pi |
raspberry |
| 54 |
user |
wasd |
| 52 |
support |
support |