flux fleet digest — 2026-09-22 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1220 |
150 |
4165 |
125 |
-71% |
| canary-farm-1 |
6870 |
258 |
3599 |
138 |
+91% |
| control-1 |
5088 |
145 |
4308 |
87 |
+18% |
| frantech-ts |
15747 |
134 |
10776 |
79 |
+46% |
| netcup-ts |
37866 |
91 |
1030 |
72 |
+3577% |
| ru-edge-1 |
3857 |
111 |
3431 |
89 |
+12% |
| sponge-01-ts |
2131 |
105 |
1354 |
96 |
+57% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
app-config-php |
72 |
21.0 |
3.4x |
| canary-farm-1 |
app-config-python |
80 |
22.0 |
3.6x |
| canary-farm-1 |
application-yml |
32 |
9.6 |
3.3x |
| canary-farm-1 |
firebase-json |
28 |
8.8 |
3.2x |
| canary-farm-1 |
k8s-secret-manifest |
44 |
6.0 |
7.3x |
| canary-farm-1 |
kubeconfig |
28 |
9.2 |
3.0x |
| canary-farm-1 |
terraform-tfstate |
36 |
7.0 |
5.1x |
| canary-farm-1 |
wp-config |
77 |
23.7 |
3.3x |
| canary-farm-1 |
wp-login-credentials |
147 |
11.0 |
13.4x |
| control-1 |
phpmyadmin-login |
44 |
5.0 |
8.8x |
| control-1 |
webapp-config-bundle-js |
22 |
4.2 |
5.2x |
| control-1 |
wp-login-credentials |
165 |
0.0 |
infx |
| frantech-ts |
tarpit-module |
1470 |
276.6 |
5.3x |
| netcup-ts |
wp-login-credentials |
18177 |
0.0 |
infx |
| netcup-ts |
wp-xmlrpc-post |
18064 |
1873.0 |
9.6x |
| ru-edge-1 |
fake-git |
163 |
39.2 |
4.2x |
| ru-edge-1 |
wp-login-credentials |
460 |
0.0 |
infx |
| sponge-01-ts |
wp-login-credentials |
149 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
107 |
754 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
13 |
90 |
canary-farm-1,control-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
8 |
392 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
4 |
197 |
ai-devbox-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 321f17b2aca0 ⟳ |
4 |
31 |
ai-devbox-1,control-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| e6e6f15a77e8 ⟳ |
3 |
9 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| eee552d8955a |
3 |
825 |
control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-22 |
/wp-login.php [wp-login-probe] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → / [wp-user-enum-rest-list] → /index.php [wp-user-enum-rest-list] → /feed/ [not-handled] → /wp-sitemap-users-1.xml [wp-u |
| 35a122336c32 |
3 |
43 |
control-1 |
09-22 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /adminer.php [adminer-login] → /adminer.php [adminer-credential-post] → /adminer/adminer.php [adminer-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.git/objects/7d/3bb022787eb977377bc84b17f3d640b697c877 |
2026-09-22 03:30:59.759047-04:00 |
| canary-farm-1 |
/.git/objects/27/9411a35ed2cd6e7bc60b2949527ab2c5321282 |
2026-09-22 03:30:59.759047-04:00 |
| canary-farm-1 |
/actuator/nonexist_1790057890188193129 |
2026-09-22 03:30:59.759047-04:00 |
| canary-farm-1 |
/.git/objects/05/fed78175e952371fa550f38730e456468e4f9c |
2026-09-22 03:30:59.759047-04:00 |
| frantech-ts |
/c/Z8yA65KepqCxZ5gB81k6vYaSk4dYMAecHUt3CRHXVhAOMXAFjUcsMdQdcSJFGxghtaWEznh3svtc348p5PTAUSD1SQmMEWTVw_s |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/c/UJ06noUvwL6PVBR3qs1zucLxVzU3pqOMW9Rx7DtZLwN2_r448EHNgsLuzoTV7W4f7KcfobOrXxLUbx4hZP-721ESPXoXMjVXN_A |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/cgi-bin/luci/ |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/app-ads.txt |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/blogs/.env |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/backend/.env.2 |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/auth/.env.conf |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/api/credentials/.env |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/uis/ |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/news/ |
2026-09-22 03:15:59.956886-04:00 |
| frantech-ts |
/spaces/ |
2026-09-22 03:15:59.956886-04:00 |
| sponge-01-ts |
/wp-json/gravitysmtp/v1/tests/mock-data |
2026-09-22 03:15:59.956886-04:00 |
| sponge-01-ts |
/var/task/next.config.mjs |
2026-09-22 03:15:59.956886-04:00 |
| sponge-01-ts |
/docker/registry/config.yml |
2026-09-22 03:15:59.956886-04:00 |
| sponge-01-ts |
/.docker/secrets.json |
2026-09-22 03:15:59.956886-04:00 |
| sponge-01-ts |
/_vercel/insights |
2026-09-22 03:15:59.956886-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/ |
2026-09-22 03:31:01.161310-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-22 03:31:01.161310-04:00 |
| canary-farm-1 |
Mozila/5.0 |
2026-09-22 03:16:00.181075-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-22 03:16:00.181075-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-22 03:16:00.181075-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/10 |
2026-09-22 03:16:00.181075-04:00 |
| sponge-01-ts |
curl/8.18.0 |
2026-09-22 03:16:00.181075-04:00 |
| canary-farm-1 |
SEC-SGHX820/1.0 NetFront/3.2 Profile/MIDP-2.0 Configuration/ |
2026-09-22 03:16:00.181075-04:00 |
| canary-farm-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) App |
2026-09-22 03:16:00.181075-04:00 |
| control-1 |
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11 |
2026-09-22 03:16:00.181075-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| netcup-ts |
119.40.84.186 |
36134 |
7 |
6 |
09-21 06:04 |
09-21 12:34 |
ipsum:3 firehol2 |
BDCOM Online Limited |
BD |
36126 |
| frantech-ts |
138.199.60.16 |
13057 |
5 |
13008 |
09-22 00:56 |
09-22 00:59 |
ipsum:2 |
Datacamp Limited |
SG |
0 |
| canary-farm-1 |
94.154.46.248 |
2100 |
112 |
1042 |
09-21 11:45 |
09-21 11:45 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
94.154.46.249 |
2100 |
112 |
1042 |
09-21 17:09 |
09-21 17:09 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
204.76.203.18 |
2069 |
1 |
568 |
09-21 03:33 |
09-22 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| frantech-ts |
169.58.252.153 |
1457 |
10 |
786 |
09-21 13:10 |
09-22 04:10 |
- |
Contabo GmbH |
FR |
0 |
| ru-edge-1 |
94.154.46.243 |
1050 |
112 |
1042 |
09-21 16:11 |
09-21 16:11 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
94.154.46.248 |
1050 |
113 |
1042 |
09-22 03:23 |
09-22 03:23 |
- |
Omegatech LTD |
US |
0 |
| ru-edge-1 |
204.76.203.18 |
706 |
2 |
534 |
09-21 03:34 |
09-21 14:00 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.162 |
361 |
2 |
2 |
09-21 07:35 |
09-21 15:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
94.154.46.243 |
300 |
4 |
150 |
09-22 05:13 |
09-22 05:26 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
34.74.108.117 |
275 |
6 |
10 |
09-21 10:15 |
09-21 10:16 |
- |
Google LLC |
US |
1 |
| ru-edge-1 |
64.207.176.102 |
275 |
6 |
10 |
09-21 10:16 |
09-21 10:17 |
- |
GoDaddy.com, LLC |
US |
1 |
| control-1 |
47.82.146.212 |
275 |
6 |
10 |
09-21 10:46 |
09-21 10:47 |
- |
Alibaba (US) Technology Co., |
SG |
1 |
| sponge-01-ts |
51.75.19.210 |
275 |
6 |
10 |
09-21 10:09 |
09-21 10:10 |
- |
OVH SAS |
FR |
1 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
7 |
2 |
| control-1 |
15 |
6 |
| ai-devbox-1 |
9 |
8 |
| canary-farm-1 |
38 |
12 |
Mint failures (24h): canary-farm-1:400x4; control-1:400x1; ai-devbox-1:400x2
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
15 |
| ru-edge-1 |
["aws"] |
7 |
| canary-farm-1 |
["aws"] |
38 |
| ai-devbox-1 |
["aws"] |
9 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 625
- multi-entry XFF (forged chains — no proxy appends on the direct path): 100
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 337
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 100
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1122 |
| ai-devbox-1 |
https |
98 |
| canary-farm-1 |
http |
6780 |
| canary-farm-1 |
https |
90 |
| control-1 |
http |
5088 |
| frantech-ts |
http |
15747 |
| netcup-ts |
http |
37866 |
| ru-edge-1 |
http |
3857 |
| sponge-01-ts |
http |
2131 |
Top Host headers:
| sensor |
host |
events |
| netcup-ts |
159.195.21.150 |
37497 |
| frantech-ts |
209.141.62.110 |
15617 |
| canary-farm-1 |
109.123.246.142 |
6466 |
| control-1 |
38.54.2.209 |
5056 |
| ru-edge-1 |
130.94.89.46 |
3850 |
| sponge-01-ts |
89.167.72.144 |
1919 |
| ai-devbox-1 |
217.15.163.226 |
919 |
| canary-farm-1 |
sso.rightabouteverything.show |
246 |
| ai-devbox-1 |
inference.fapthropic.com |
200 |
| canary-farm-1 |
localhost |
100 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (9 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
94.154.46.248 |
113 |
/wp-config.php~ [wp-config] → /wp-config.old [wp-config] → /.git/config [fake-git] → /.env [issued] → /.env.staging.local [env-production] → /config.php [app-config-php] → /.yarnrc [yarnrc-error] → /.dockerenv [not-handled] → /.env.example [env-production] → /compose/.env [env-production] → /docker/.env [env-production] → /docker-compose.override.yml [docker-compose] |
Omegatech LTD |
US |
| ru-edge-1 |
94.154.46.243 |
112 |
/.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /.env.orig [env-production] → /settings.php [app-config-php] → /yarn.lock [yarn-lock-error] → /docker-compose.yaml [docker-compose] → /composer.lock [not-handled] → /.ssh/authorized_keys [authorized-keys-error] → /wp-config.php.save [wp-config] → /config.py [app-config-python] → /.gitlab-ci.yml [gitlab-ci] → /config/settings.py [app-config-python] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.249 |
112 |
/.git/HEAD [fake-git] → /wp-config.php.bak [wp-config] → /.git/config [fake-git] → /wp-config.php.old [wp-config] → /wp-config.php~ [wp-config] → /wp-config.php.save [wp-config] → /.aws/config [aws-config-file] → /settings.py [app-config-python] → /config/database.php [app-config-php-database] → /.dockerenv [not-handled] → /.env [issued] → /docker-compose.override.yml [docker-compose] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.248 |
112 |
/.git/index [fake-git] → /.aws/config [aws-config-file] → /.travis.yml [generic-ci-config] → /config/settings.py [app-config-python] → /config.py [app-config-python] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /config.json [config-json] → /wp-config.php.old [wp-config] → /.git/config [fake-git] → /.env.staging.local [env-production] → /composer.json [not-handled] |
Omegatech LTD |
US |
| canary-farm-1 |
213.209.159.175 |
52 |
/ [tarpit-module] → /fs3f26bkkhe20y [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
143.244.168.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
165.227.173.41 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.38.248.17 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
138.197.191.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
164.92.107.174 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
105.158.191.248 |
15 |
/ [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] |
Office National des Postes e |
MA |
| control-1 |
213.209.159.154 |
12 |
/ [tarpit-module] → /.env [issued] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] → /phpinfo.php [phpinfo] → /core/.env [env-production] |
Feo Prest SRL |
DE |
| control-1 |
213.209.159.175 |
12 |
/ [tarpit-module] → /g7hk7dnxhle49k [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 669 sources sent credentials → 489 got a shell (73%) → 312 ran a command (64% of shell-getters, 47% of sources)
- event level: 15814 credential attempts → 5963 accepted logins → 5097 commands (85% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 550 attempts
New commands this window (0 of 59 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1223 |
267 |
103.159.199.43 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1026 |
240 |
103.159.199.43 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 628 |
1 |
109.160.32.16 |
"uname -m | awk '{printf $1}'" |
| 628 |
1 |
109.160.32.16 |
"uname -s -v -n -r -m" |
| 232 |
5 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 232 |
5 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 106 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 106 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 9409 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1193 |
345gs5662d34 |
345gs5662d34 |
| 881 |
root |
3245gs5662d34 |
| 61 |
root |
123456 |
| 57 |
ubuntu |
3245gs5662d34 |
| 49 |
pi |
raspberry |
| 47 |
user |
wasd |
| 44 |
admin |
3245gs5662d34 |
| 35 |
support |
support |