flux fleet digest — 2026-09-19 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
4026 |
121 |
3808 |
81 |
+6% |
| canary-farm-1 |
5230 |
151 |
3504 |
97 |
+49% |
| control-1 |
5283 |
129 |
3943 |
55 |
+34% |
| frantech-ts |
13886 |
98 |
5313 |
34 |
+161% |
| netcup-ts |
523 |
75 |
880 |
40 |
-41% |
| ru-edge-1 |
3772 |
100 |
2325 |
42 |
+62% |
| sponge-01-ts |
1850 |
123 |
1100 |
47 |
+68% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
phpinfo |
59 |
14.5 |
4.1x |
| ai-devbox-1 |
phpmyadmin-login |
81 |
11.6 |
7.0x |
| ai-devbox-1 |
tomcat-path-bypass-env |
45 |
12.5 |
3.6x |
| ai-devbox-1 |
webapp-config-bundle-js |
164 |
32.0 |
5.1x |
| ai-devbox-1 |
yii2-debug-view |
24 |
6.3 |
3.8x |
| canary-farm-1 |
adminer-credential-post |
24 |
0.0 |
infx |
| canary-farm-1 |
adminer-login |
24 |
3.0 |
8.0x |
| canary-farm-1 |
phpmyadmin-login |
92 |
7.8 |
11.8x |
| canary-farm-1 |
tarpit |
185 |
61.4 |
3.0x |
| canary-farm-1 |
tomcat-path-bypass-env |
60 |
15.0 |
4.0x |
| canary-farm-1 |
webapp-config-bundle-js |
165 |
23.0 |
7.2x |
| canary-farm-1 |
webapp-config-bundle-js-error |
84 |
23.7 |
3.5x |
| canary-farm-1 |
wp-batch-rejected |
24 |
4.4 |
5.5x |
| canary-farm-1 |
yii2-debug-view |
24 |
6.0 |
4.0x |
| canary-farm-1 |
yii2-debug-view-error |
35 |
8.8 |
4.0x |
| control-1 |
phpinfo |
58 |
6.5 |
8.9x |
| ru-edge-1 |
phpinfo-error |
26 |
7.2 |
3.6x |
| ru-edge-1 |
phpmyadmin-login |
32 |
4.3 |
7.4x |
| ru-edge-1 |
tarpit-module |
1030 |
316.9 |
3.3x |
| ru-edge-1 |
tracebit-http-error |
31 |
9.2 |
3.4x |
| ru-edge-1 |
webshell-probe |
52 |
3.0 |
17.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
98 |
664 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
13 |
39 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ |
12 |
588 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ |
8 |
56 |
canary-farm-1,control-1,frantech-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7ea1125e0232 ⟳ |
6 |
84 |
ai-devbox-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 8912719db30f |
4 |
12 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts ⚠FLEET-WIDE |
09-19 |
/ [tarpit-module] → /api.php [webshell-sweep-observed] → / [tarpit-module] |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| sponge-01-ts |
/.env.save.1 |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/sandbox/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/home/ec2-user/.config/bin/aws/bin/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/larabus/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/home/ec2-user/.local/bin/aws/tools/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/home/ec2-user/.config/bin/aws/tools/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/aws-ses/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/connect/.env |
2026-09-19 03:16:06.256095-04:00 |
| sponge-01-ts |
/blog/wp-login.php |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/Socketio/.env |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/apis/.env.staging |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/app/.env.staging |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/asset_img/.env |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/basic-network/.env |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/backup/App_Config/ConnectionStrings.config |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/global.asa.bak |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/setup.sql |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/administrator/info.php |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/adminphp.php |
2026-09-19 03:16:06.256095-04:00 |
| ru-edge-1 |
/resources/.git/config |
2026-09-19 03:16:06.256095-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| ru-edge-1 |
Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.7.10) Gecko/200507 |
2026-09-19 03:16:22.413679-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/2010 |
2026-09-19 03:16:22.413679-04:00 |
| sponge-01-ts |
Python/3.12 aiohttp/3.12.15 |
2026-09-19 03:16:22.413679-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/2010 |
2026-09-19 03:16:22.413679-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/201 |
2026-09-19 03:16:22.413679-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-19 03:16:22.413679-04:00 |
| ru-edge-1 |
Python/3.10 aiohttp/3.8.4 |
2026-09-19 03:16:22.413679-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20 |
2026-09-19 03:16:22.413679-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-19 03:16:22.413679-04:00 |
| frantech-ts |
Mozilla/5.0 (version-check) |
2026-09-19 03:16:22.413679-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
155.2.191.165 |
13000 |
5 |
13000 |
09-19 01:07 |
09-19 01:08 |
ipsum:1 |
Host Universal Pty Ltd |
US |
0 |
| control-1 |
204.76.203.18 |
1826 |
2 |
573 |
09-18 03:32 |
09-19 06:11 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
204.76.203.18 |
1812 |
2 |
574 |
09-18 03:32 |
09-19 06:11 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
176.65.144.71 |
1500 |
98 |
743 |
09-18 06:02 |
09-18 06:02 |
- |
Dedik Services Limited |
CH |
0 |
| control-1 |
94.154.46.244 |
1050 |
112 |
1042 |
09-19 03:55 |
09-19 03:56 |
- |
Omegatech LTD |
US |
0 |
| ru-edge-1 |
102.220.161.139 |
893 |
32 |
481 |
09-19 00:46 |
09-19 01:41 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
31.57.219.158 |
611 |
23 |
59 |
09-18 19:12 |
09-18 19:22 |
- |
12651980 CANADA INC. |
FR |
50 |
| canary-farm-1 |
31.57.219.158 |
605 |
23 |
59 |
09-18 19:20 |
09-18 19:40 |
- |
12651980 CANADA INC. |
FR |
50 |
| ai-devbox-1 |
102.220.161.139 |
514 |
34 |
511 |
09-18 23:40 |
09-19 00:37 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
102.220.161.139 |
514 |
35 |
511 |
09-19 00:25 |
09-19 01:18 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
102.220.161.139 |
404 |
27 |
309 |
09-19 00:43 |
09-19 01:41 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
195.178.110.159 |
384 |
2 |
372 |
09-18 05:39 |
09-18 05:39 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| ai-devbox-1 |
101.47.44.7 |
383 |
21 |
291 |
09-18 22:42 |
09-19 01:06 |
- |
Byteplus Pte. Ltd. |
SG |
0 |
| canary-farm-1 |
135.129.124.82 |
350 |
17 |
132 |
09-19 01:52 |
09-19 01:58 |
- |
Space Exploration Technologi |
NG |
8 |
| ai-devbox-1 |
80.94.95.211 |
329 |
45 |
325 |
09-18 22:17 |
09-18 22:19 |
- |
SS-Net |
RO |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
5 |
3 |
| ru-edge-1 |
5 |
3 |
| canary-farm-1 |
38 |
16 |
| ai-devbox-1 |
26 |
14 |
Mint failures (24h): control-1:400x7; ai-devbox-1:400x7; ru-edge-1:400x31; canary-farm-1:400x43
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
26 |
| control-1 |
["aws"] |
5 |
| ru-edge-1 |
["aws"] |
5 |
| canary-farm-1 |
["aws"] |
38 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2392
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2806 |
| ai-devbox-1 |
https |
1220 |
| canary-farm-1 |
http |
4058 |
| canary-farm-1 |
https |
1172 |
| control-1 |
http |
5283 |
| frantech-ts |
http |
13886 |
| netcup-ts |
http |
523 |
| ru-edge-1 |
http |
3772 |
| sponge-01-ts |
http |
1850 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13792 |
| control-1 |
38.54.2.209 |
5263 |
| ru-edge-1 |
130.94.89.46 |
3754 |
| canary-farm-1 |
109.123.246.142 |
3247 |
| ai-devbox-1 |
217.15.163.226 |
2221 |
| sponge-01-ts |
89.167.72.144 |
1826 |
| ai-devbox-1 |
inference.fapthropic.com |
1787 |
| canary-farm-1 |
sso.rightabouteverything.show |
1733 |
| netcup-ts |
159.195.21.150 |
408 |
| canary-farm-1 |
vmi3243483.contaboserver.net |
235 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (6 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
94.154.46.244 |
112 |
/wp-config.php.save [wp-config] → /wp-config.php.bak [wp-config] → /config.js [webapp-config-bundle-js] → /.npmrc [npmrc-error] → /.env.orig [env-production] → /.env.prev [env-production] → /.env.staging.local [env-production] → /.env.copy [env-production] → /wp-config.old [wp-config] → /config.php [app-config-php] → /env [actuator-env] → /docker-compose.yml [docker-compose] |
Omegatech LTD |
US |
| canary-farm-1 |
176.65.144.71 |
98 |
/config.php [app-config-php] → /settings.php [app-config-php] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /wp-config.php.old [wp-config] → /config.json [config-json] → /wp-config.php~ [wp-config] → /configuration.php [app-config-php] → /local_settings.py [app-config-python] → /.ssh/authorized_keys [authorized-keys-error] → /docker-compose.yaml [docker-compose] → /docker-compose.override.yml [docker-compose] |
Dedik Services Limited |
CH |
| ai-devbox-1 |
80.94.95.211 |
45 |
/ [tarpit-module] → /vf3me03jjqx8se [not-handled] → /.env [issued] → /.env [tracebit-http-error] → /rest/workflows [not-handled] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] |
SS-Net |
RO |
| control-1 |
102.220.161.139 |
35 |
/ [tarpit-module] → /pscan-d6fdf207-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.139 |
34 |
/ [tarpit-module] → /pscan-bf4f93a7-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
102.220.161.139 |
32 |
/ [tarpit-module] → /pscan-bde62f91-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
165.227.173.41 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.244.168.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
139.59.136.184 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
102.220.161.139 |
27 |
/ [tarpit-module] → /pscan-b60b4382-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 393 sources sent credentials → 312 got a shell (79%) → 198 ran a command (63% of shell-getters, 50% of sources)
- event level: 18534 credential attempts → 15067 accepted logins → 5975 commands (40% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 318 attempts
New commands this window (0 of 50 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1491 |
2 |
109.160.32.69 |
"uname -m | awk '{printf $1}'" |
| 1491 |
2 |
109.160.32.69 |
"uname -s -v -n -r -m" |
| 1018 |
174 |
175.97.207.27 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 872 |
157 |
175.97.207.27 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 236 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 236 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 88 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 88 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 7298 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 977 |
345gs5662d34 |
345gs5662d34 |
| 734 |
root |
3245gs5662d34 |
| 50 |
pi |
raspberry |
| 48 |
root |
123456 |
| 45 |
admin |
3245gs5662d34 |
| 39 |
user |
wasd |
| 30 |
ubuntu |
3245gs5662d34 |
| 30 |
test |
3245gs5662d34 |