flux fleet digest — 2026-09-17 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
3102 |
130 |
3528 |
81 |
-12% |
| canary-farm-1 |
2279 |
162 |
4301 |
112 |
-47% |
| control-1 |
5129 |
94 |
3557 |
43 |
+44% |
| frantech-ts |
27839 |
130 |
1855 |
14 |
+1401% |
| netcup-ts |
714 |
76 |
930 |
18 |
-23% |
| ru-edge-1 |
2516 |
95 |
2279 |
18 |
+10% |
| sponge-01-ts |
1227 |
116 |
976 |
16 |
+26% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
fake-git |
293 |
54.0 |
5.4x |
| ai-devbox-1 |
fake-git-miss |
161 |
0.0 |
infx |
| ai-devbox-1 |
phpmyadmin-login |
31 |
7.4 |
4.2x |
| ai-devbox-1 |
webapp-config-bundle-js |
65 |
14.7 |
4.4x |
| ai-devbox-1 |
webshell-probe |
97 |
25.9 |
3.8x |
| canary-farm-1 |
fake-git-miss |
143 |
8.5 |
16.8x |
| canary-farm-1 |
webshell-probe |
68 |
7.0 |
9.7x |
| control-1 |
app-config-php |
33 |
9.6 |
3.4x |
| control-1 |
app-config-python |
40 |
8.3 |
4.8x |
| control-1 |
env-production |
335 |
82.0 |
4.1x |
| control-1 |
rails-database-yml |
22 |
5.8 |
3.8x |
| control-1 |
webshell-probe |
89 |
13.2 |
6.7x |
| control-1 |
wp-config |
39 |
10.8 |
3.6x |
| frantech-ts |
not-handled |
27261 |
1283.2 |
21.2x |
| ru-edge-1 |
fake-git |
165 |
1.0 |
165.0x |
| sponge-01-ts |
tarpit-disconnect |
26 |
8.4 |
3.1x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
81 |
567 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
16 |
113 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
8 |
367 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
7 |
328 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 1cf777711bea ⟳ |
7 |
59 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 721e73e8d123 |
3 |
15 |
canary-farm-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
09-17 |
/ [method-not-allowed] → / [tarpit-module] → / [method-not-allowed] |
| 8c3f2665d0b4 |
3 |
138 |
ai-devbox-1,canary-farm-1,ru-edge-1 ⚠FLEET-WIDE |
09-17 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-st |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| sponge-01-ts |
/config/config.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/PMA/index.php |
2026-09-17 03:32:27.022627-04:00 |
| ai-devbox-1 |
/api/tags |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/admin-app/.env |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/__info.php |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/0.0_phpinfo.php |
2026-09-17 03:32:27.022627-04:00 |
| ai-devbox-1 |
/v1/models |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/private/.env |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/.env.project |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/frontend/web/debug/default/view |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/web/debug/default/view |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/AwsConfig.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/deployment-config.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/credentials/config.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/parameters.yml |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/pma/index.php |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/apps/.env |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/sendgrid.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/ws-config.json |
2026-09-17 03:32:27.022627-04:00 |
| sponge-01-ts |
/php-my-admin/index.php |
2026-09-17 03:32:27.022627-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| sponge-01-ts |
curl/7.29.0 |
2026-09-17 03:35:16.885786-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-17 03:32:28.093398-04:00 |
| netcup-ts |
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; en) Opera |
2026-09-17 03:32:28.093398-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/2010 |
2026-09-17 03:32:28.093398-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-17 03:32:28.093398-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) |
2026-09-17 03:32:28.093398-04:00 |
| netcup-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Apple |
2026-09-17 03:32:28.093398-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-17 03:32:28.093398-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefo |
2026-09-17 03:32:28.093398-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Fir |
2026-09-17 03:32:28.093398-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.119.20 |
12949 |
5 |
12949 |
09-16 09:53 |
09-16 09:54 |
- |
tzulo, inc. |
US |
0 |
| frantech-ts |
138.199.6.195 |
12949 |
5 |
12949 |
09-17 00:34 |
09-17 00:36 |
ipsum:1 |
Datacamp Limited |
CH |
0 |
| ru-edge-1 |
204.76.203.18 |
1885 |
2 |
567 |
09-16 03:34 |
09-17 07:34 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
204.76.203.18 |
1866 |
2 |
569 |
09-16 03:35 |
09-17 07:34 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
94.154.46.247 |
1050 |
112 |
1042 |
09-16 04:01 |
09-16 04:02 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
69.5.20.14 |
940 |
6 |
395 |
09-16 03:48 |
09-16 14:56 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| control-1 |
69.5.20.14 |
903 |
35 |
433 |
09-16 04:36 |
09-16 15:50 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| control-1 |
94.154.46.250 |
750 |
98 |
743 |
09-16 12:34 |
09-16 12:34 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
102.220.161.102 |
514 |
34 |
511 |
09-17 00:11 |
09-17 00:26 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.161.102 |
514 |
34 |
511 |
09-16 23:52 |
09-17 00:05 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
69.5.20.14 |
409 |
20 |
337 |
09-16 09:23 |
09-16 20:20 |
- |
Byteplus Pte. Ltd. |
ID |
0 |
| ai-devbox-1 |
41.249.4.249 |
333 |
21 |
54 |
09-17 03:51 |
09-17 03:57 |
- |
Office National des Postes e |
MA |
29 |
| frantech-ts |
94.154.46.244 |
300 |
4 |
150 |
09-16 07:01 |
09-16 07:01 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
195.178.110.159 |
295 |
9 |
199 |
09-16 21:58 |
09-16 22:00 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| netcup-ts |
185.73.23.162 |
270 |
1 |
1 |
09-16 09:25 |
09-17 06:39 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
4 |
2 |
| ai-devbox-1 |
21 |
15 |
| control-1 |
18 |
5 |
| canary-farm-1 |
15 |
11 |
Mint failures (24h): ai-devbox-1:400x9; control-1:400x2; canary-farm-1:400x6
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
21 |
| control-1 |
["aws"] |
18 |
| canary-farm-1 |
["aws"] |
15 |
| ru-edge-1 |
["aws"] |
4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1282
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 3
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2266 |
| ai-devbox-1 |
https |
836 |
| canary-farm-1 |
http |
1836 |
| canary-farm-1 |
https |
443 |
| control-1 |
http |
5129 |
| frantech-ts |
http |
27839 |
| netcup-ts |
http |
714 |
| ru-edge-1 |
http |
2516 |
| sponge-01-ts |
http |
1227 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
27557 |
| control-1 |
38.54.2.209 |
5118 |
| ru-edge-1 |
130.94.89.46 |
2512 |
| ai-devbox-1 |
217.15.163.226 |
1627 |
| canary-farm-1 |
109.123.246.142 |
1437 |
| ai-devbox-1 |
inference.fapthropic.com |
1391 |
| canary-farm-1 |
sso.rightabouteverything.show |
829 |
| sponge-01-ts |
89.167.72.144 |
805 |
| netcup-ts |
159.195.21.150 |
430 |
| sponge-01-ts |
static.144.72.167.89.clients.your-server.de |
263 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (4 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
| 2026-09-05 |
3958 |
98 |
| 2026-09-04 |
4632 |
100 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
94.154.46.247 |
112 |
/wp-config.old [wp-config] → /wp-config.php.save [wp-config] → /config/database.php [app-config-php-database] → /docker-compose.yaml [docker-compose] → / [tarpit-module] → /wp-config.php.old [wp-config] → /.env.production.local [env-production] → /.env.test [env-production] → /package-lock.json [package-lock-json-error] → /.yarnrc [yarnrc-error] → /.env~ [env-production] → /composer.lock [not-handled] |
Omegatech LTD |
US |
| control-1 |
94.154.46.250 |
98 |
/config/app.php [app-config-php-services] → /wp-config.php.save [wp-config] → /config.php [app-config-php] → /wp-config.php~ [wp-config] → / [tarpit-module] → /.env.production.local [env-production] → /settings.php [app-config-php] → /.env.production [env-production] → /.travis.yml [generic-ci-config] → /.git/config [fake-git] → /package-lock.json [package-lock-json-error] → /wp-config.php.old [wp-config] |
Omegatech LTD |
US |
| canary-farm-1 |
64.23.218.208 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
69.5.20.14 |
35 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.env.local [env-production-error] → /.aliyun/config.json [not-handled] → /config.yml [app-config-yaml-error] → /.env.staging [env-production-error] → /.git/config [fake-git-error] → /aliyun_config.json [not-handled] → /credentials.json [config-json-error] → /oss.json [not-handled] → /alicloud.yml [not-handled] |
Byteplus Pte. Ltd. |
ID |
| canary-farm-1 |
102.220.161.102 |
34 |
/ [tarpit-module] → /pscan-d4517fff-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.102 |
34 |
/ [tarpit-module] → /pscan-21c822fe-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
188.166.99.91 |
30 |
/.env.prod [env-production-error] → /.env.test [env-production-error] → /.env.old [env-production-error] → /.env.local [env-production-error] → /.env.development [env-production-error] → /.env.production [env-production-error] → /.env [tracebit-http-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] → /.env.bak [env-production-error] → /.env.docker [env-production-error] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
164.92.107.174 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
178.128.207.138 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.244.168.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 518 sources sent credentials → 381 got a shell (74%) → 155 ran a command (41% of shell-getters, 30% of sources)
- event level: 26709 credential attempts → 17933 accepted logins → 8951 commands (50% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 399 attempts
New commands this window (0 of 70 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2210 |
4 |
109.160.32.67 |
"uname -s -v -n -r -m" |
| 2210 |
4 |
109.160.32.67 |
"uname -m | awk '{printf $1}'" |
| 1248 |
114 |
103.189.89.196 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1082 |
102 |
103.189.89.196 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 800 |
1 |
185.144.27.63 |
"echo -e "\x6F\x6B"" |
| 256 |
5 |
2.57.122.209 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 256 |
5 |
2.57.122.209 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 119 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 11734 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1187 |
345gs5662d34 |
345gs5662d34 |
| 853 |
root |
3245gs5662d34 |
| 72 |
root |
123456 |
| 58 |
admin |
3245gs5662d34 |
| 57 |
pi |
raspberry |
| 55 |
user |
wasd |
| 51 |
ubuntu |
3245gs5662d34 |
| 36 |
support |
support |