flux fleet digest — 2026-09-21 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
3748 |
156 |
4015 |
106 |
-7% |
| canary-farm-1 |
4847 |
196 |
3532 |
113 |
+37% |
| control-1 |
2632 |
89 |
4382 |
74 |
-40% |
| frantech-ts |
13824 |
95 |
8953 |
66 |
+54% |
| netcup-ts |
2777 |
76 |
792 |
62 |
+251% |
| ru-edge-1 |
3105 |
116 |
3321 |
73 |
-7% |
| sponge-01-ts |
1046 |
86 |
1390 |
84 |
-25% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
backup-archive |
90 |
1.0 |
90.0x |
| canary-farm-1 |
composer-auth-json-error |
111 |
2.5 |
44.4x |
| canary-farm-1 |
docker-compose |
35 |
6.7 |
5.2x |
| canary-farm-1 |
github-actions-workflow |
44 |
4.5 |
9.8x |
| canary-farm-1 |
wp-config |
49 |
16.3 |
3.0x |
| netcup-ts |
wp-xmlrpc-post |
1873 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
80 |
566 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
12 |
36 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ |
9 |
441 |
ai-devbox-1,canary-farm-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 5c207ae1f250 |
7 |
28 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-21 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-json/wp/v2/users/me [wp-rest-auth-required] |
| 4b4cc0ece037 ⟳ |
6 |
42 |
control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 321f17b2aca0 ⟳ |
5 |
40 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| ef1ab74f3d57 ⟳ |
4 |
196 |
ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/beta/ |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/examples/11-transactions/.env |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/tests/default_settings/v8.0/.env |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/examples/05-migrations/.env |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/register/.env |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/APP/.env |
2026-09-21 03:16:31.714887-04:00 |
| ru-edge-1 |
/services/simcore/.env |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/settings.php.dist |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/settings.php.save |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/smb.conf |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/storage/oauth-public.key |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/vendor/webmozart/assert/.composer-auth.json |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/wc.db |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/wp-content/plugins/constant-contact-forms/vendor/constantcontact/constantcontact/test/Json/Auth/token_info.json |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/.azure-pipelines.yml |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/.badarg.log |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/.dockerfile |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/.vs/slnx.sqlite |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/SSI/info_configuration.htm |
2026-09-21 03:16:31.714887-04:00 |
| canary-farm-1 |
/authentication/auth.json |
2026-09-21 03:16:31.714887-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20 |
2026-09-21 03:16:31.836762-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/576.48 (KHTML, l |
2026-09-21 03:16:31.836762-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2_1) AppleWebKit/56 |
2026-09-21 03:16:31.836762-04:00 |
| ai-devbox-1 |
FeedFetcher-Google; ( http://www.google.com/feedfetcher.html |
2026-09-21 03:16:31.836762-04:00 |
| control-1 |
Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML |
2026-09-21 03:16:31.836762-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 7_2; Win64; x64) AppleWebKit/569.51 |
2026-09-21 03:16:31.836762-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Geck |
2026-09-21 03:16:31.836762-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/ |
2026-09-21 03:16:31.836762-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) Appl |
2026-09-21 03:16:31.836762-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/600.53 (KHTML, l |
2026-09-21 03:16:31.836762-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.60.29 |
13006 |
5 |
13006 |
09-21 01:08 |
09-21 01:10 |
ipsum:1 |
Datacamp Limited |
SG |
0 |
| canary-farm-1 |
45.138.12.16 |
2647 |
98 |
754 |
09-20 17:01 |
09-21 01:50 |
- |
Tc Datacenter Limited |
LT |
0 |
| ru-edge-1 |
204.76.203.18 |
2060 |
2 |
569 |
09-20 03:33 |
09-21 06:10 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
204.76.203.18 |
2058 |
2 |
566 |
09-20 03:33 |
09-21 06:10 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
119.40.84.186 |
1881 |
6 |
6 |
09-21 06:04 |
09-21 06:11 |
ipsum:3 firehol2 |
BDCOM Online Limited |
BD |
1873 |
| ai-devbox-1 |
94.154.46.245 |
1471 |
98 |
743 |
09-20 17:53 |
09-20 17:53 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
102.220.161.139 |
594 |
29 |
203 |
09-20 03:44 |
09-20 04:26 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
94.154.46.250 |
526 |
95 |
519 |
09-20 21:45 |
09-20 21:45 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
195.178.110.159 |
384 |
2 |
372 |
09-20 06:15 |
09-20 06:15 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| sponge-01-ts |
185.73.23.162 |
343 |
2 |
4 |
09-20 04:05 |
09-21 01:19 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.162 |
333 |
2 |
4 |
09-20 04:35 |
09-21 01:18 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ru-edge-1 |
80.94.95.211 |
330 |
44 |
326 |
09-21 02:12 |
09-21 02:13 |
- |
SS-Net |
RO |
0 |
| frantech-ts |
87.120.104.29 |
300 |
4 |
150 |
09-20 18:47 |
09-20 18:47 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| ai-devbox-1 |
152.233.61.9 |
180 |
11 |
72 |
09-20 15:52 |
09-20 15:52 |
- |
Datacamp Limited |
DE |
0 |
| netcup-ts |
45.138.12.51 |
176 |
3 |
85 |
09-20 20:35 |
09-20 22:41 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
3 |
3 |
| canary-farm-1 |
30 |
17 |
| control-1 |
9 |
4 |
| ai-devbox-1 |
26 |
15 |
Mint failures (24h): control-1:400x1; ru-edge-1:400x3; ai-devbox-1:400x5
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
9 |
| canary-farm-1 |
["aws"] |
30 |
| ru-edge-1 |
["aws"] |
3 |
| ai-devbox-1 |
["aws"] |
26 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 4401
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 712
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
3262 |
| ai-devbox-1 |
https |
486 |
| canary-farm-1 |
https |
3203 |
| canary-farm-1 |
http |
1644 |
| control-1 |
http |
2632 |
| frantech-ts |
http |
13824 |
| netcup-ts |
http |
2777 |
| ru-edge-1 |
http |
3105 |
| sponge-01-ts |
http |
1046 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13692 |
| canary-farm-1 |
sso.rightabouteverything.show |
3362 |
| ru-edge-1 |
130.94.89.46 |
3085 |
| control-1 |
38.54.2.209 |
2613 |
| netcup-ts |
159.195.21.150 |
2442 |
| ai-devbox-1 |
217.15.163.226 |
2258 |
| canary-farm-1 |
109.123.246.142 |
1223 |
| ai-devbox-1 |
inference.fapthropic.com |
801 |
| ai-devbox-1 |
127.0.0.1 |
677 |
| sponge-01-ts |
89.167.72.144 |
674 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (8 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
45.138.12.16 |
98 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.Dockerfile [not-handled] → /.appveyor.yml [not-handled] → /.auth.json [not-handled] → /.authorized_keys [not-handled] → /.aws/config [aws-config-file] → /.aws/credent [not-handled] → /.aws/credentials [aws-credentials-file] → /.aws/credentials.bak [aws-credentials-file] → /.axiom/accounts/do.json [not-handled] |
Tc Datacenter Limited |
LT |
| ai-devbox-1 |
94.154.46.245 |
98 |
/.env.development.local [env-production] → /.travis.yml [generic-ci-config] → /config.json [config-json] → /.env.production [env-production] → /wp-config.php~ [wp-config] → /wp-config.bak [wp-config] → /settings.py [app-config-python] → /.ssh/id_dsa [ssh-private-key-error] → /.npmrc [npmrc-error] → /.yarnrc [yarnrc-error] → /.env.orig [env-production] → /config.py [app-config-python] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.250 |
95 |
/.git/index [fake-git] → /.git/config [fake-git] → /composer.json [not-handled] → /settings.php [app-config-php] → /.env.local [env-production] → /yarn.lock [yarn-lock-error] → /.ssh/id_dsa [ssh-private-key-error] → / [tarpit-module] → /src/.env [env-production] → /config.py [app-config-python] → /.git/HEAD [fake-git] → /wp-config.php.old [wp-config] |
Omegatech LTD |
US |
| ru-edge-1 |
80.94.95.211 |
44 |
/ [tarpit-module] → /tn5rbtb79vek86 [not-handled] → /.env [issued] → /.env [tracebit-http-error] → /rest/workflows [not-handled] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] |
SS-Net |
RO |
| ai-devbox-1 |
93.152.220.22 |
33 |
/.env [tracebit-http-error] → /.azure/credentials [azure-credentials-file-error] → /.circleci/config.yml [generic-ci-config-error] → /.drone.yml [generic-ci-config-error] → /.aws/config [aws-config-file-error] → /.bash_profile [shell-rc-error] → /.aws/credentials [aws-credentials-file-error] → /.github/workflows/ci.yml [github-actions-workflow-error] → /.travis.yml [generic-ci-config-error] → /.github/workflows/deploy.yml [github-actions-workflow-error] → /.kube/config [kubeconfig-error] → /.gitlab-ci.yml [gitlab-ci-error] |
Dedik Services Limited |
NL |
| ai-devbox-1 |
85.11.167.85 |
30 |
/laravel/.env [env-production] → /settings.js [webapp-config-bundle-js] → /pi.php [phpinfo] → /config/services.php [app-config-php-services] → /phpinfo [phpinfo] → /core/.env [env-production] → /runtime-env.js [not-handled] → /.env.swp [env-production] → /config/aws.yml [not-handled] → /js/env.js [not-handled] → /docker/.env [env-production] → /aws.yml [not-handled] |
TechTies Inc. |
NL |
| ai-devbox-1 |
94.26.106.214 |
30 |
/.env [issued] → /.env.test [env-production] → /.env.dev [env-production] → /.env.prod [env-production] → /.env.staging [env-production] → /.env.development [env-production] → /.env.local [env-production] → /.env.old [env-production] → /.env.backup [env-production] → /.env.production [env-production] → /.env.bak [env-production] → /.env.example [env-production] |
TechTies Inc. |
DE |
| ru-edge-1 |
102.220.161.102 |
30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.env.local [env-production] → /.env [issued] → /.env.development [env-production] → /.env.prod [env-production] → /.env.test [env-production] → /.env.dev [env-production] → /.env.staging [env-production] → /.env.backup [env-production] → /.env.old [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.139 |
29 |
/.env [issued] → /vendor/.env [env-production] → /storage/.env [env-production] → /public/.env [env-production] → /api/.env [env-production] → /admin/.env [env-production] → /app/.env [env-production] → /backend/.env [env-production] → /frontend/.env [env-production] → /config/.env [env-production] → /core/.env [env-production] → /.env.staging/info [not-handled] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
142.93.129.190 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.227.32.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
207.154.197.113 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 594 sources sent credentials → 485 got a shell (82%) → 306 ran a command (63% of shell-getters, 52% of sources)
- event level: 21938 credential attempts → 10472 accepted logins → 11510 commands (110% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1053 attempts
New commands this window (0 of 57 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3134 |
5 |
109.160.32.12 |
"uname -s -v -n -r -m" |
| 3134 |
5 |
109.160.32.12 |
"uname -m | awk '{printf $1}'" |
| 1426 |
273 |
106.12.106.232 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1224 |
243 |
106.12.106.232 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 810 |
1 |
161.132.50.183 |
"echo -e "\x6F\x6B"" |
| 296 |
5 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 296 |
5 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 115 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 9796 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1382 |
345gs5662d34 |
345gs5662d34 |
| 1028 |
root |
3245gs5662d34 |
| 71 |
root |
123456 |
| 70 |
ubuntu |
3245gs5662d34 |
| 68 |
admin |
3245gs5662d34 |
| 52 |
user |
wasd |
| 51 |
pi |
raspberry |
| 42 |
support |
support |