flux fleet digest — 2026-09-23 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
9074 |
2817 |
3789 |
145 |
+139% |
| canary-farm-1 |
5150 |
288 |
4404 |
174 |
+17% |
| control-1 |
3598 |
121 |
4266 |
107 |
-16% |
| frantech-ts |
17695 |
1080 |
12644 |
98 |
+40% |
| netcup-ts |
1940 |
106 |
6335 |
85 |
-69% |
| ru-edge-1 |
12154 |
4979 |
3244 |
105 |
+275% |
| sponge-01-ts |
1589 |
92 |
1574 |
111 |
+1% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
app-config-php-error |
34 |
9.5 |
3.6x |
| ai-devbox-1 |
app-config-yaml-error |
26 |
5.8 |
4.5x |
| ai-devbox-1 |
backup-archive-error |
24 |
1.0 |
24.0x |
| ai-devbox-1 |
config-json-error |
42 |
9.0 |
4.7x |
| ai-devbox-1 |
phpinfo-error |
497 |
26.5 |
18.8x |
| ai-devbox-1 |
tarpit |
468 |
85.9 |
5.5x |
| ai-devbox-1 |
tarpit-disconnect |
462 |
83.7 |
5.5x |
| ai-devbox-1 |
tarpit-module |
3253 |
878.1 |
3.7x |
| ai-devbox-1 |
webshell-sweep-observed |
25 |
7.7 |
3.3x |
| ai-devbox-1 |
wp-config-error |
36 |
6.6 |
5.5x |
| canary-farm-1 |
env-production-error |
450 |
134.7 |
3.3x |
| control-1 |
env-production-error |
180 |
46.8 |
3.8x |
| control-1 |
phpinfo |
56 |
14.0 |
4.0x |
| frantech-ts |
tarpit-module |
1561 |
437.3 |
3.6x |
| ru-edge-1 |
app-config-php-error |
63 |
4.5 |
14.0x |
| ru-edge-1 |
app-config-python-error |
24 |
5.2 |
4.6x |
| ru-edge-1 |
app-config-yaml-error |
35 |
3.5 |
10.0x |
| ru-edge-1 |
appsettings-json-error |
29 |
1.0 |
29.0x |
| ru-edge-1 |
backup-archive-error |
31 |
1.0 |
31.0x |
| ru-edge-1 |
config-json-error |
73 |
2.8 |
26.5x |
| ru-edge-1 |
env-production-error |
1008 |
129.2 |
7.8x |
| ru-edge-1 |
fake-git-error |
97 |
7.0 |
13.9x |
| ru-edge-1 |
iis-web-config-error |
24 |
3.7 |
6.5x |
| ru-edge-1 |
php-filter-tracebit-http-error |
33 |
0.0 |
infx |
| ru-edge-1 |
phpinfo |
21 |
3.8 |
5.5x |
| ru-edge-1 |
phpinfo-error |
752 |
11.3 |
66.4x |
| ru-edge-1 |
phpmyadmin-credential-post |
48 |
0.0 |
infx |
| ru-edge-1 |
sftp-config-error |
37 |
4.5 |
8.2x |
| ru-edge-1 |
symfony-profiler-phpinfo-error |
25 |
2.0 |
12.5x |
| ru-edge-1 |
tarpit |
804 |
32.0 |
25.1x |
| ru-edge-1 |
tarpit-disconnect |
788 |
30.9 |
25.5x |
| ru-edge-1 |
tarpit-module |
4852 |
622.0 |
7.8x |
| ru-edge-1 |
tracebit-http-error |
31 |
10.2 |
3.0x |
| ru-edge-1 |
webapp-config-bundle-js-error |
48 |
1.8 |
27.4x |
| ru-edge-1 |
webshell-probe |
113 |
21.2 |
5.3x |
| ru-edge-1 |
webshell-sweep-observed |
158 |
2.6 |
60.8x |
| ru-edge-1 |
wp-config-error |
124 |
7.0 |
17.7x |
| ru-edge-1 |
yii2-debug-view-error |
30 |
3.7 |
8.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
98 |
688 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
12 |
588 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 1a64c5d5efd2 |
9 |
189 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-23 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 9cd5084e9e43 |
7 |
49 |
ai-devbox-1,ru-edge-1 ⚠FLEET-WIDE |
09-23 |
/app_dir/.env [tarpit-module] → /app_dir/.env [tarpit] → /app_dir/.env [tarpit-disconnect] |
| ed66cc967251 |
7 |
29 |
canary-farm-1 |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 9932ef9d714d |
7 |
49 |
ai-devbox-1,ru-edge-1 ⚠FLEET-WIDE |
09-23 |
/redmine/.env [tarpit-module] → /redmine/.env [tarpit] → /redmine/.env [tarpit-disconnect] |
| 2f886a7c88e7 ⟳ |
6 |
173 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-09 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 4b4cc0ece037 ⟳ |
6 |
42 |
netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/cloud/gcp/config.json/v1/settings.ini |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/2024-backup.zip |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/server/php.php |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/model/.env |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/backend/helper/phpinfo.php |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/id_ed25519.pub |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/backend/nestjs/dist/secrets.env |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/ci-cd/github/v1/Dockerfile |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/umbraco.sql |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/config/settings.json/v2/keys.pem |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/admins/help/info.php |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/up/ |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/function/xampp/phpinfo |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/dev/temp.php |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/ml/config.js |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/cloud/azure/secrets.yaml/prod/secrets.json |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/instance/sendgrid_keys.py |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/dynatrace.json |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/service/service/phpinfo.php |
2026-09-23 03:16:24.888762-04:00 |
| ru-edge-1 |
/configure.php.orig |
2026-09-23 03:16:24.888762-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-23 03:16:24.979226-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/ |
2026-09-23 03:16:24.979226-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/ |
2026-09-23 03:16:24.979226-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-23 03:16:24.979226-04:00 |
| ru-edge-1 |
Mozilla/5.0 (compatible; CyberHunter/1.0) |
2026-09-23 03:16:24.979226-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-23 03:16:24.979226-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20 |
2026-09-23 03:16:24.979226-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Fire |
2026-09-23 03:16:24.979226-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 8_2_1; Win64; x64) AppleWebKit/577.4 |
2026-09-23 03:16:24.979226-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/541.52 (KHTML, l |
2026-09-23 03:16:24.979226-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
185.209.196.130 |
13134 |
5 |
13134 |
09-23 01:34 |
09-23 01:36 |
ipsum:2 |
31173 Services AB |
DE |
0 |
| canary-farm-1 |
94.154.46.247 |
2400 |
137 |
1042 |
09-22 12:35 |
09-22 22:53 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
169.58.252.153 |
2176 |
14 |
1412 |
09-22 03:59 |
09-22 12:13 |
- |
Contabo GmbH |
FR |
0 |
| control-1 |
204.76.203.18 |
2086 |
1 |
562 |
09-22 03:33 |
09-23 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
102.220.161.87 |
2003 |
56 |
824 |
09-22 08:27 |
09-22 18:26 |
- |
VPS Dedicated LLC |
SI |
48 |
| ai-devbox-1 |
94.154.46.244 |
1492 |
98 |
743 |
09-22 16:37 |
09-22 16:37 |
- |
Omegatech LTD |
US |
0 |
| netcup-ts |
185.73.23.162 |
864 |
2 |
5 |
09-23 03:46 |
09-23 06:13 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
603 |
2 |
4 |
09-23 03:47 |
09-23 06:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ai-devbox-1 |
102.220.161.87 |
556 |
36 |
511 |
09-22 08:27 |
09-23 01:35 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
102.220.161.87 |
530 |
36 |
511 |
09-22 11:17 |
09-22 21:24 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
102.220.161.87 |
516 |
35 |
511 |
09-22 10:33 |
09-22 12:43 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
151.243.18.111 |
466 |
70 |
466 |
09-22 13:28 |
09-22 13:28 |
- |
Dedik Services Limited |
US |
0 |
| canary-farm-1 |
213.209.159.175 |
460 |
43 |
227 |
09-22 10:25 |
09-22 21:44 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
80.94.95.211 |
330 |
43 |
326 |
09-23 03:08 |
09-23 03:11 |
- |
SS-Net |
RO |
0 |
| control-1 |
213.209.159.175 |
307 |
52 |
228 |
09-22 06:42 |
09-23 04:47 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
10 |
4 |
| ru-edge-1 |
6 |
5 |
| ai-devbox-1 |
17 |
16 |
| canary-farm-1 |
14 |
13 |
| netcup-ts |
0 |
0 |
Mint failures (24h): control-1:400x4; ai-devbox-1:400x21; canary-farm-1:400x26; ru-edge-1:400x31
Mints by type label:
| sensor |
types |
mints |
| ru-edge-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws"] |
14 |
| control-1 |
["aws"] |
10 |
| ai-devbox-1 |
["aws"] |
17 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 16577
- multi-entry XFF (forged chains — no proxy appends on the direct path): 15390
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 909
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 15390
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
8955 |
| ai-devbox-1 |
https |
119 |
| canary-farm-1 |
http |
4991 |
| canary-farm-1 |
https |
159 |
| control-1 |
http |
3598 |
| frantech-ts |
http |
17695 |
| netcup-ts |
http |
1940 |
| ru-edge-1 |
http |
12154 |
| sponge-01-ts |
http |
1589 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
16601 |
| ru-edge-1 |
localhost |
8947 |
| ai-devbox-1 |
localhost |
5385 |
| canary-farm-1 |
109.123.246.142 |
4196 |
| control-1 |
38.54.2.209 |
3574 |
| ai-devbox-1 |
217.15.163.226 |
3465 |
| ru-edge-1 |
130.94.89.46 |
2290 |
| netcup-ts |
159.195.21.150 |
1067 |
| sponge-01-ts |
89.167.72.144 |
978 |
| frantech-ts |
localhost |
968 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (10 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
94.154.46.247 |
137 |
/wp-config.old [wp-config-error] → /.git/config [fake-git-error] → /config.php [app-config-php-error] → /.aws/credentials [aws-credentials-file-error] → /wp-config.bak [wp-config-error] → /config/app.php [app-config-php-services-error] → /settings.php [app-config-php-error] → /.env~ [env-production-error] → /configuration.php [app-config-php-error] → /wp-config.php.save [wp-config-error] → /docker-compose.yaml [docker-compose-error] → /package-lock.json [package-lock-json-error] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.244 |
98 |
/config/app.php [app-config-php-services] → /docker-compose.yml [docker-compose] → /package-lock.json [package-lock-json-error] → /phpinfo.php [phpinfo] → /.ssh/id_dsa [ssh-private-key-error] → /.travis.yml [generic-ci-config] → /html/.env [env-production] → /public/.env [env-production] → /.htpasswd [htpasswd-error] → /.ssh/id_rsa [ssh-private-key-error] → /yarn.lock [yarn-lock-error] → /myapp/settings.py [not-handled] |
Omegatech LTD |
US |
| ai-devbox-1 |
151.243.18.111 |
70 |
/frontend/.env.local [env-production-error] → /web/.env.local [env-production-error] → /.env.yml [env-production-error] → /.env.json [env-production-error] → /api/.env [env-production-error] → /api/.env.local [env-production-error] → /app/.env [env-production-error] → /docker/compose/withPostgres/.env [tarpit-module] → /env.txt [env-production-error] → /docker/.env [env-production-error] → /.env.save~ [env-production-error] → /.env.bak~ [env-production-error] |
Dedik Services Limited |
US |
| ru-edge-1 |
102.220.161.87 |
56 |
/ [tarpit-module] → / [tarpit] → /pscan-a3e87233-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] |
VPS Dedicated LLC |
SI |
| control-1 |
213.209.159.175 |
52 |
/ [tarpit-module] → /s3fr39tyysz37g [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
80.94.95.211 |
43 |
/ [tarpit-module] → /ic5xxxrwg0zqhg [not-handled] → /.env [tracebit-http-error] → /rest/workflows [not-handled] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] → /.env.example [env-production-error] |
SS-Net |
RO |
| canary-farm-1 |
213.209.159.175 |
43 |
/ [tarpit-module] → /0v3tf18p6kve99 [not-handled] → /.env [tracebit-http-error] → /rest/workflows [not-handled] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] → /.env.example [env-production-error] |
Feo Prest SRL |
DE |
| ru-edge-1 |
94.154.46.247 |
36 |
/.gitlab-ci.yml [gitlab-ci-error] → /config/app.php [app-config-php-services-error] → /.git/HEAD [fake-git-error] → /.ssh/authorized_keys [authorized-keys-error] → /wp-config.php~ [wp-config-error] → /.yarnrc [yarnrc-error] → /.env~ [env-production-error] → / [tarpit-module] → /.env.production.local [env-production-error] → /Gemfile.lock [not-handled] → /.git/config [fake-git-error] → /wp-config.php.bak [wp-config-error] |
Omegatech LTD |
US |
| ai-devbox-1 |
102.220.161.87 |
36 |
/ [tarpit-module] → / [tarpit] → /pscan-1903cca3-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
102.220.161.87 |
36 |
/ [tarpit-module] → /pscan-ea109591-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
94.154.46.243 |
36 |
/config/app.php [app-config-php-services-error] → /wp-config.php.save [wp-config-error] → /.env.saved [env-production-error] → /config.php [app-config-php-error] → /wp-config.old [wp-config-error] → /settings.php [app-config-php-error] → /.env.orig [env-production-error] → /config/database.php [app-config-php-database-error] → /Gemfile.lock [not-handled] → /.ssh/id_dsa [ssh-private-key-error] → /config/settings.py [app-config-python-error] → /.env_prod [env-production-error] |
Omegatech LTD |
US |
| control-1 |
102.220.161.87 |
35 |
/ [tarpit-module] → /pscan-df07ff7c-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 586 sources sent credentials → 482 got a shell (82%) → 296 ran a command (61% of shell-getters, 51% of sources)
- event level: 9057 credential attempts → 5714 accepted logins → 4602 commands (81% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 500 attempts
New commands this window (0 of 66 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1138 |
237 |
103.88.76.27 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 972 |
218 |
103.88.76.27 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 573 |
1 |
109.160.32.38 |
"uname -m | awk '{printf $1}'" |
| 573 |
1 |
109.160.32.38 |
"uname -s -v -n -r -m" |
| 166 |
7 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 166 |
7 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 125 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 125 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 3845 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1101 |
345gs5662d34 |
345gs5662d34 |
| 815 |
root |
3245gs5662d34 |
| 67 |
root |
123456 |
| 63 |
user |
wasd |
| 56 |
ubuntu |
3245gs5662d34 |
| 50 |
pi |
raspberry |
| 43 |
admin |
3245gs5662d34 |
| 37 |
support |
support |