flux fleet digest — 2026-09-20 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
4640 |
221 |
3899 |
83 |
+19% |
| canary-farm-1 |
1924 |
165 |
3645 |
100 |
-47% |
| control-1 |
3856 |
109 |
4439 |
66 |
-13% |
| frantech-ts |
14003 |
130 |
7280 |
48 |
+92% |
| netcup-ts |
681 |
81 |
947 |
50 |
-28% |
| ru-edge-1 |
4469 |
116 |
2849 |
57 |
+57% |
| sponge-01-ts |
2757 |
141 |
1311 |
64 |
+110% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
claude-config |
312 |
0.0 |
infx |
| ai-devbox-1 |
claude-credentials |
52 |
0.0 |
infx |
| ai-devbox-1 |
claude-settings |
52 |
0.0 |
infx |
| ai-devbox-1 |
codex-auth |
1092 |
0.0 |
infx |
| ai-devbox-1 |
codex-config-toml |
52 |
1.0 |
52.0x |
| ai-devbox-1 |
wp-batch-rejected |
257 |
8.5 |
30.2x |
| canary-farm-1 |
codex-auth |
21 |
0.0 |
infx |
| canary-farm-1 |
fake-git-miss |
264 |
44.2 |
6.0x |
| control-1 |
codex-auth |
21 |
0.0 |
infx |
| ru-edge-1 |
app-config-php |
21 |
1.3 |
15.8x |
| ru-edge-1 |
app-config-python |
23 |
3.0 |
7.7x |
| ru-edge-1 |
env-production |
202 |
24.9 |
8.1x |
| ru-edge-1 |
wp-config |
25 |
1.5 |
16.7x |
| sponge-01-ts |
not-handled |
2176 |
530.1 |
4.1x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
83 |
580 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
18 |
54 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ |
12 |
588 |
canary-farm-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ |
10 |
70 |
netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 321f17b2aca0 ⟳ |
6 |
48 |
canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 218630667b2c ⟳ |
5 |
210 |
ai-devbox-1,control-1,frantech-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| bdf9ed3c2302 |
4 |
12 |
ai-devbox-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
09-20 |
/ [tarpit] → / [tarpit-disconnect] → / [tarpit-module] |
| 5e7a5d88d947 |
3 |
9 |
ai-devbox-1,control-1,frantech-ts ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.git/objects/48/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/2d/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/63/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/57/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/be/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/d0/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/8d/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/35/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/3c/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/5d/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/43/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/1b/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/23/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/ff/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/e5/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/d2/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/a6/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/cc/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/f7/ |
2026-09-20 03:31:10.235692-04:00 |
| canary-farm-1 |
/.git/objects/08/ |
2026-09-20 03:31:10.235692-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
curl/7.81.0 |
2026-09-20 03:31:14.227731-04:00 |
| canary-farm-1 |
git/2.34.1 |
2026-09-20 03:31:14.227731-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-09-20 03:15:34.963759-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Buil |
2026-09-20 03:15:34.963759-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTM |
2026-09-20 03:15:34.963759-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-09-20 03:15:34.963759-04:00 |
| netcup-ts |
Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) |
2026-09-20 03:15:34.963759-04:00 |
| canary-farm-1 |
- |
2026-09-20 03:15:34.963759-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-20 03:15:34.963759-04:00 |
| control-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Fir |
2026-09-20 03:15:34.963759-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
169.150.201.29 |
13006 |
5 |
13006 |
09-20 03:14 |
09-20 03:15 |
ipsum:1 |
Datacamp Limited |
DE |
0 |
| ru-edge-1 |
204.76.203.18 |
2019 |
2 |
573 |
09-19 03:33 |
09-20 06:14 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
204.76.203.18 |
2005 |
2 |
574 |
09-19 03:33 |
09-20 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
94.154.46.244 |
1100 |
113 |
1092 |
09-19 08:50 |
09-19 08:51 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
94.154.46.244 |
1050 |
112 |
1042 |
09-19 03:55 |
09-19 03:56 |
- |
Omegatech LTD |
US |
0 |
| ru-edge-1 |
176.65.144.71 |
649 |
95 |
642 |
09-20 00:21 |
09-20 00:21 |
- |
Dedik Services Limited |
CH |
0 |
| ai-devbox-1 |
102.220.161.139 |
594 |
29 |
203 |
09-20 03:44 |
09-20 04:26 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
195.178.110.104 |
434 |
8 |
40 |
09-20 03:28 |
09-20 03:34 |
- |
Techoff Srv Limited |
BG |
300 |
| canary-farm-1 |
195.178.110.159 |
384 |
2 |
372 |
09-20 06:15 |
09-20 06:15 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| control-1 |
213.209.159.175 |
272 |
52 |
227 |
09-19 08:31 |
09-20 00:21 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
193.32.204.199 |
265 |
26 |
88 |
09-19 04:19 |
09-19 04:23 |
- |
Madina IT |
TR |
0 |
| netcup-ts |
185.73.23.162 |
213 |
2 |
4 |
09-19 04:13 |
09-20 04:36 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| frantech-ts |
45.138.12.51 |
176 |
3 |
85 |
09-19 04:32 |
09-19 13:59 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
167.99.79.44 |
160 |
4 |
20 |
09-19 18:01 |
09-19 20:50 |
- |
DigitalOcean, LLC |
SG |
8 |
| ai-devbox-1 |
167.99.79.44 |
160 |
5 |
20 |
09-19 18:01 |
09-19 20:50 |
- |
DigitalOcean, LLC |
SG |
8 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
12 |
5 |
| control-1 |
5 |
3 |
| canary-farm-1 |
19 |
11 |
| ai-devbox-1 |
15 |
12 |
| frantech-ts |
0 |
0 |
Mint failures (24h): control-1:400x9; ai-devbox-1:400x15; ru-edge-1:400x6; canary-farm-1:400x9
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
19 |
| ru-edge-1 |
["aws"] |
12 |
| ai-devbox-1 |
["aws"] |
15 |
| control-1 |
["aws"] |
5 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2159
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 741
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
3871 |
| ai-devbox-1 |
https |
769 |
| canary-farm-1 |
http |
1275 |
| canary-farm-1 |
https |
649 |
| control-1 |
http |
3856 |
| frantech-ts |
http |
14003 |
| netcup-ts |
http |
681 |
| ru-edge-1 |
http |
4469 |
| sponge-01-ts |
http |
2757 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13866 |
| ru-edge-1 |
130.94.89.46 |
4464 |
| control-1 |
38.54.2.209 |
3844 |
| ai-devbox-1 |
vmi3177282.contaboserver.net |
2091 |
| sponge-01-ts |
static.144.72.167.89.clients.your-server.de |
1927 |
| ai-devbox-1 |
inference.fapthropic.com |
1048 |
| canary-farm-1 |
sso.rightabouteverything.show |
957 |
| canary-farm-1 |
109.123.246.142 |
956 |
| ai-devbox-1 |
217.15.163.226 |
810 |
| sponge-01-ts |
89.167.72.144 |
804 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (7 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
94.154.46.244 |
113 |
/.env.test [env-production] → /.git/config [fake-git] → /.env.copy [env-production] → /.env.staging.local [env-production] → /.git/HEAD [fake-git] → /wp-config.bak [wp-config] → /docker-compose.yaml [docker-compose] → /.aws/config [aws-config-file] → /.env.template [env-production] → /.dockerenv [not-handled] → /.env.default [env-production] → /config.js [webapp-config-bundle-js] |
Omegatech LTD |
US |
| control-1 |
94.154.46.244 |
112 |
/wp-config.php.save [wp-config] → /wp-config.php.bak [wp-config] → /config.js [webapp-config-bundle-js] → /.npmrc [npmrc-error] → /.env.orig [env-production] → /.env.prev [env-production] → /.env.staging.local [env-production] → /.env.copy [env-production] → /wp-config.old [wp-config] → /config.php [app-config-php] → /env [actuator-env] → /docker-compose.yml [docker-compose] |
Omegatech LTD |
US |
| ru-edge-1 |
176.65.144.71 |
95 |
/Jenkinsfile [jenkinsfile-error] → /wp-config.old [wp-config-error] → /wp-config.php [wp-config-error] → /.dockerenv [not-handled] → /config/settings.py [app-config-python-error] → /.yarnrc [yarnrc-error] → /.git/HEAD [fake-git-error] → /wp-config.php.bak [wp-config-error] → /wp-config.php.old [wp-config-error] → /.git/index [fake-git-error] → /wp-config.php~ [wp-config-error] → /wp-config.php.save [wp-config-error] |
Dedik Services Limited |
CH |
| control-1 |
213.209.159.175 |
52 |
/ [tarpit-module] → /fwy7lip9s6ktsc [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ru-edge-1 |
102.220.161.102 |
30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.env.local [env-production] → /.env [issued] → /.env.development [env-production] → /.env.prod [env-production] → /.env.test [env-production] → /.env.dev [env-production] → /.env.staging [env-production] → /.env.backup [env-production] → /.env.old [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.139 |
29 |
/.env [issued] → /vendor/.env [env-production] → /storage/.env [env-production] → /public/.env [env-production] → /api/.env [env-production] → /admin/.env [env-production] → /app/.env [env-production] → /backend/.env [env-production] → /frontend/.env [env-production] → /config/.env [env-production] → /core/.env [env-production] → /.env.staging/info [not-handled] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
139.59.136.184 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
167.71.175.236 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
159.65.18.197 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
193.32.204.199 |
26 |
/ [tarpit-module] → /etc/passwd [not-handled] → /api/console/api_server [not-handled] → /laravel-filemanager [not-handled] → /filemanager/dialog.php [not-handled] → /index.php [tarpit-module] → /solr/admin/file [not-handled] → /..;/etc/passwd [not-handled] → /@fs/etc/passwd [vite-fs-etc-passwd] → /definitely-not-a-real-path-9x7q/passwd [not-handled] → /@fs/etc/etc/passwd [vite-fs-miss] → /.aws/credentials [aws-credentials-file-error] |
Madina IT |
TR |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 591 sources sent credentials → 490 got a shell (83%) → 312 ran a command (64% of shell-getters, 53% of sources)
- event level: 24742 credential attempts → 17030 accepted logins → 16019 commands (94% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 657 attempts
New commands this window (0 of 63 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 5375 |
10 |
109.160.32.12 |
"uname -s -v -n -r -m" |
| 5113 |
9 |
109.160.32.12 |
"uname -m | awk '{printf $1}'" |
| 1419 |
281 |
101.96.202.48 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1248 |
259 |
101.96.202.48 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 302 |
2 |
45.148.10.240 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
| 302 |
2 |
45.148.10.240 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 302 |
2 |
45.148.10.240 |
"uptime -p" |
| 302 |
2 |
45.148.10.240 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
Credentials: 6927 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1378 |
345gs5662d34 |
345gs5662d34 |
| 1047 |
root |
3245gs5662d34 |
| 77 |
root |
123456 |
| 60 |
user |
3245gs5662d34 |
| 50 |
admin |
3245gs5662d34 |
| 49 |
pi |
raspberry |
| 49 |
user |
wasd |
| 47 |
ubuntu |
3245gs5662d34 |