flux fleet digest — 2026-09-16 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
5582 |
94 |
2985 |
86 |
+87% |
| canary-farm-1 |
4242 |
119 |
3953 |
126 |
+7% |
| control-1 |
4795 |
62 |
3338 |
43 |
+44% |
| frantech-ts |
3133 |
67 |
1535 |
1 |
+104% |
| netcup-ts |
987 |
86 |
916 |
1 |
+8% |
| ru-edge-1 |
2625 |
84 |
2192 |
1 |
+20% |
| sponge-01-ts |
407 |
74 |
1118 |
1 |
-64% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
webshell-probe |
83 |
14.1 |
5.9x |
| canary-farm-1 |
env-production-error |
400 |
127.6 |
3.1x |
| canary-farm-1 |
fake-git-miss |
26 |
2.7 |
9.8x |
| canary-farm-1 |
vite-fs-aws-credentials-file |
40 |
9.4 |
4.3x |
| canary-farm-1 |
wp-config-error |
32 |
9.0 |
3.6x |
| control-1 |
app-config-python |
20 |
5.2 |
3.9x |
| control-1 |
webshell-probe |
48 |
4.5 |
10.7x |
| frantech-ts |
webshell-probe |
55 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
55 |
385 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
12 |
84 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| b07c7bb207b4 ⟳ |
7 |
328 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 850993125b15 ⟳ |
7 |
287 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ |
6 |
294 |
canary-farm-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 6d284d806b36 |
5 |
41 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
09-16 |
/ [tarpit-module] → /goform/formJsonAjaxReq [soho-router-diag] → / [tarpit-module] |
| fa6433fb567c |
4 |
819 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
09-16 |
/ [tarpit-module] → /.env [tracebit-http-error] → /backend/.env [env-production-error] → /api/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /phpinfo/ [not-handled] → … |
| 4a3bf1265dff |
3 |
105 |
ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE |
09-16 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| control-1 |
/site/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| canary-farm-1 |
/cms/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| control-1 |
/wp/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| ai-devbox-1 |
/cms/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| frantech-ts |
/wp/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| frantech-ts |
/wordpress/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| control-1 |
/ouh4dwot7o |
2026-09-16 03:31:41.816232-04:00 |
| ai-devbox-1 |
/wp-login/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| control-1 |
/cms/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| ai-devbox-1 |
/wordpress/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| sponge-01-ts |
/wp/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| canary-farm-1 |
/site/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| ai-devbox-1 |
/wp/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| frantech-ts |
/wp-login/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| canary-farm-1 |
/admin/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| sponge-01-ts |
/site/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| sponge-01-ts |
/wp-login/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| canary-farm-1 |
/wp/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| canary-farm-1 |
/wp-login/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
| control-1 |
/admin/wp-login.php |
2026-09-16 03:31:41.816232-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| sponge-01-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100 |
2026-09-16 03:31:41.921962-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Android 14; Mobile; rv:128.0) Gecko/128.0 Firef |
2026-09-16 03:31:41.921962-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100 |
2026-09-16 03:31:41.921962-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-16 03:31:41.921962-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20 |
2026-09-16 03:31:41.921962-04:00 |
| control-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) Apple |
2026-09-16 03:31:41.921962-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-09-16 03:31:41.921962-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Android 14; Mobile; rv:128.0) Gecko/128.0 Firef |
2026-09-16 03:31:41.921962-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20 |
2026-09-16 03:31:41.921962-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) Apple |
2026-09-16 03:31:41.921962-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| ai-devbox-1 |
94.154.46.242 |
1500 |
98 |
743 |
09-15 15:58 |
09-15 15:58 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
94.154.46.243 |
1448 |
98 |
743 |
09-15 20:50 |
09-15 20:50 |
- |
Omegatech LTD |
US |
0 |
| ru-edge-1 |
204.76.203.18 |
1292 |
2 |
561 |
09-15 12:08 |
09-16 07:30 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
204.76.203.18 |
1278 |
2 |
558 |
09-15 12:06 |
09-16 07:32 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
8.234.173.27 |
1053 |
165 |
784 |
09-16 00:03 |
09-16 00:03 |
- |
Google LLC |
US |
12 |
| control-1 |
94.154.46.247 |
1050 |
112 |
1042 |
09-16 04:01 |
09-16 04:02 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
69.5.20.14 |
503 |
21 |
401 |
09-15 22:29 |
09-15 22:30 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| control-1 |
69.5.20.14 |
503 |
21 |
401 |
09-16 04:36 |
09-16 04:37 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| frantech-ts |
69.5.20.14 |
470 |
6 |
390 |
09-16 03:48 |
09-16 03:49 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| frantech-ts |
94.154.46.244 |
300 |
4 |
150 |
09-16 07:01 |
09-16 07:01 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
94.154.46.247 |
300 |
36 |
150 |
09-15 12:43 |
09-15 12:43 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
213.209.159.175 |
228 |
16 |
112 |
09-15 15:24 |
09-16 02:34 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
34.17.8.94 |
218 |
14 |
166 |
09-15 22:28 |
09-15 22:31 |
- |
Google LLC |
IT |
4 |
| ai-devbox-1 |
80.94.95.211 |
214 |
16 |
212 |
09-16 00:29 |
09-16 00:30 |
- |
SS-Net |
RO |
0 |
| canary-farm-1 |
172.105.69.26 |
214 |
25 |
170 |
09-15 12:59 |
09-15 12:59 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
DE |
1 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
1 |
1 |
| control-1 |
8 |
3 |
| canary-farm-1 |
23 |
10 |
| ai-devbox-1 |
39 |
14 |
Mint failures (24h): canary-farm-1:400x37; ru-edge-1:400x1; ai-devbox-1:400x17; control-1:400x5
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
23 |
| ru-edge-1 |
["aws"] |
1 |
| control-1 |
["aws"] |
8 |
| ai-devbox-1 |
["aws"] |
39 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 800
- multi-entry XFF (forged chains — no proxy appends on the direct path): 1
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 8
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
5016 |
| ai-devbox-1 |
https |
566 |
| canary-farm-1 |
http |
4018 |
| canary-farm-1 |
https |
224 |
| control-1 |
http |
4795 |
| frantech-ts |
http |
3133 |
| netcup-ts |
http |
987 |
| ru-edge-1 |
http |
2625 |
| sponge-01-ts |
http |
407 |
Top Host headers:
| sensor |
host |
events |
| control-1 |
38.54.2.209 |
4779 |
| ai-devbox-1 |
217.15.163.226 |
4474 |
| canary-farm-1 |
109.123.246.142 |
3562 |
| frantech-ts |
209.141.62.110 |
2766 |
| ru-edge-1 |
130.94.89.46 |
2622 |
| ai-devbox-1 |
inference.fapthropic.com |
1085 |
| netcup-ts |
159.195.21.150 |
977 |
| canary-farm-1 |
sso.rightabouteverything.show |
453 |
| sponge-01-ts |
89.167.72.144 |
397 |
| canary-farm-1 |
vmi3243483.contaboserver.net |
210 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (3 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
| 2026-09-05 |
3958 |
98 |
| 2026-09-04 |
4632 |
100 |
| 2026-09-03 |
2361 |
105 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
8.234.173.27 |
165 |
/ [tarpit-module] → /aws_leak_probe_c14dcbdf [not-handled] → /.env [issued] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /etc/passwd [not-handled] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] → /.aws/credentials [aws-credentials-file] → /.env.local [env-production] |
Google LLC |
US |
| control-1 |
94.154.46.247 |
112 |
/wp-config.old [wp-config] → /wp-config.php.save [wp-config] → /config/database.php [app-config-php-database] → /docker-compose.yaml [docker-compose] → / [tarpit-module] → /wp-config.php.old [wp-config] → /.env.production.local [env-production] → /.env.test [env-production] → /package-lock.json [package-lock-json-error] → /.yarnrc [yarnrc-error] → /.env~ [env-production] → /composer.lock [not-handled] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.243 |
98 |
/wp-config.php [wp-config] → /.env [issued] → /.env.saved [env-production] → /.ssh/id_dsa [ssh-private-key-error] → /.env_backup [env-production] → /wp-config.php.bak [wp-config] → /docker-compose.yaml [docker-compose] → /.aws/credentials [aws-credentials-file] → /.env.production.local [env-production] → /.env_old [env-production] → /.env.development.local [env-production] → /.circleci/config.yml [generic-ci-config] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.242 |
98 |
/.git/HEAD [fake-git] → /.gitlab-ci.yml [gitlab-ci] → /.env.old [env-production] → /app/.env [env-production] → /config.py [app-config-python] → /composer.lock [not-handled] → /.env.2 [tarpit-module] → /config/database.php [app-config-php-database] → /.env.save~ [env-production] → /.ssh/id_dsa [ssh-private-key-error] → /Jenkinsfile [jenkinsfile] → /.circleci/config.yml [generic-ci-config] |
Omegatech LTD |
US |
| ru-edge-1 |
80.94.95.211 |
49 |
/ [tarpit-module] → /.env [tracebit-http-error] → /backend/.env [env-production-error] → /api/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /phpinfo/ [not-handled] → /admin/.env [env-production-error] → /phpinfo.php [phpinfo-error] → /.env.example [env-production-error] → /app/.env [env-production-error] → /app_dev.php/_profiler/open [symfony-parameters-yml-error] → /appsettings.json [appsettings-json-error] |
SS-Net |
RO |
| canary-farm-1 |
94.154.46.247 |
36 |
/wp-config.bak [wp-config-error] → /wp-config.old [wp-config-error] → /config.php [app-config-php-error] → /.env~ [env-production-error] → /.env.production.local [env-production-error] → /.htaccess [not-handled] → /config.py [app-config-python-error] → /Gemfile.lock [not-handled] → /configuration.php [app-config-php-error] → /settings.py [app-config-python-error] → /wp-config.php.save [wp-config-error] → /local_settings.py [app-config-python-error] |
Omegatech LTD |
US |
| ai-devbox-1 |
188.166.99.91 |
30 |
/.env.prod [env-production-error] → /.env.test [env-production-error] → /.env.old [env-production-error] → /.env.local [env-production-error] → /.env.development [env-production-error] → /.env.production [env-production-error] → /.env [tracebit-http-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] → /.env.bak [env-production-error] → /.env.docker [env-production-error] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
68.183.180.73 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
138.197.191.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
64.226.65.160 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
142.93.143.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 482 sources sent credentials → 370 got a shell (77%) → 169 ran a command (46% of shell-getters, 35% of sources)
- event level: 46009 credential attempts → 18930 accepted logins → 12724 commands (67% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 734 attempts
New commands this window (0 of 51 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2809 |
4 |
109.160.32.15 |
"uname -m | awk '{printf $1}'" |
| 2809 |
4 |
109.160.32.15 |
"uname -s -v -n -r -m" |
| 1489 |
19 |
120.48.90.166 |
"uname -a" |
| 1463 |
1 |
46.101.165.211 |
"nproc" |
| 1425 |
128 |
101.47.159.50 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1269 |
114 |
101.47.159.50 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 323 |
6 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 323 |
6 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 28479 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1388 |
345gs5662d34 |
345gs5662d34 |
| 1043 |
root |
3245gs5662d34 |
| 80 |
root |
123456 |
| 72 |
ubuntu |
3245gs5662d34 |
| 67 |
user |
wasd |
| 61 |
admin |
3245gs5662d34 |
| 59 |
pi |
raspberry |
| 42 |
root |
admin |