flux fleet digest — 2026-09-24 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1470 |
141 |
4288 |
534 |
-66% |
| canary-farm-1 |
1993 |
189 |
4534 |
198 |
-56% |
| control-1 |
4271 |
119 |
4095 |
116 |
+4% |
| frantech-ts |
14031 |
112 |
14724 |
243 |
-5% |
| netcup-ts |
4858 |
93 |
6471 |
88 |
-25% |
| ru-edge-1 |
2486 |
107 |
4605 |
804 |
-46% |
| sponge-01-ts |
4282 |
116 |
1742 |
114 |
+146% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
docker-registry-manifest |
90 |
27.9 |
3.2x |
| ai-devbox-1 |
docker-registry-tags |
90 |
27.9 |
3.2x |
| ai-devbox-1 |
graphql-introspection |
36 |
11.1 |
3.2x |
| canary-farm-1 |
docker-registry-manifest |
90 |
27.9 |
3.2x |
| canary-farm-1 |
docker-registry-tags |
90 |
27.9 |
3.2x |
| canary-farm-1 |
graphql-introspection |
39 |
11.1 |
3.5x |
| control-1 |
fake-git-error |
24 |
4.8 |
5.0x |
| netcup-ts |
tarpit-module |
4511 |
627.9 |
7.2x |
| ru-edge-1 |
phpmyadmin-credential-post |
200 |
48.0 |
4.2x |
| ru-edge-1 |
phpmyadmin-login |
214 |
18.5 |
11.6x |
| sponge-01-ts |
tarpit-module |
3865 |
824.0 |
4.7x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
66 |
462 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
27 |
189 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
10 |
410 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 76d212a95300 ⟳ |
8 |
312 |
ai-devbox-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| ae42a8355f29 |
7 |
112 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-24 |
/ [tarpit-module] → /doc/page/login.asp [not-handled] → / [tarpit-module] |
| b07c7bb207b4 ⟳ |
7 |
410 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| e6e6f15a77e8 ⟳ |
6 |
18 |
canary-farm-1 |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/ss_probe_a01447c1fe32c906ca527c9cf792d4ac |
2026-09-24 03:31:02.661613-04:00 |
| frantech-ts |
/c/J1b-Mo_SAnhdIxzBxUo-Io1yvokUWaTGcqc0v7H6AXaMilB9OAxTrNdH6F37h8GcXBM7Iaain81raZwLX0PAyR6DHLbQ1AhjcPo |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/bPunJg27glzw_svUKIhN3xFLj7O9P71Imzn9OxyKTC4TMpfQ_BttITqpiMC6E650VN1c4426U0bXpJvMHmR6s6y2HDWhDUmXj_w |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/coikadnq4ab5imOpvS0FvFgO4LG-ZiipA0szpjc3lPueaGPG3F90KRFugTQdVj33ARQAoTFxcD0K0wR2wHCon9rWMKKYDRAWzRU |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/1cjzd_h4f3DjqXM910iAtuCgi_CfudubfvfCZE43sojs3WOmALPeh8TfLsMsVnzmFaCLSnakTlsLXZIC3sdxgwncpcL-PVTRbnY |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/K3AkAPg32Bgn6jj4cehg1SG_0UYhkIFQtwiN7H7WG-cEb4ugAPYwi4jqHm85-cn4DSxRWvLx5jId1q3NkImRCSx2cSz3IqZ9Ig0 |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/login.html |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/index.jsp |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/wp-content/plugins/wp-fastest-cache/readme.txt |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/wp-content/plugins/duplicator/readme.txt |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/wp-content/plugins/ewww-image-optimizer/readme.txt |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/wp-content/plugins/wp-time-capsule/readme.txt |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/MPhsemy5QoRS6duX51AJp4zy63X6Bi3DiyahJIBO_Xp78cKkpxqXwlRhNKDh3OYg-UtH7QlafIpsPrJTl8Uc7GMP-EMV3MUNzeo |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/tPcJI-_ZNCNmUU9lq3e4FrVvAYLE_Vv-aeYfICABWsifZuLleFgJa5Q1JroF5aYcxuihDjIB8yACXJT4W8VKsLU7D5HxKPIjdwQ |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/c/pP_iseGCpGxc86SlI-eOhBE0iUR-t24S7PCk989JZb7CHgDT9WhKy0pwilX8HiDBw4VnV25R_9hNtdYCQLxS7H_0AHowq0yKSlI |
2026-09-24 03:15:40.179612-04:00 |
| canary-farm-1 |
/infra/.env |
2026-09-24 03:15:40.179612-04:00 |
| canary-farm-1 |
/icecoder/lib/terminal-xhr.php |
2026-09-24 03:15:40.179612-04:00 |
| ru-edge-1 |
/install.sh |
2026-09-24 03:15:40.179612-04:00 |
| ru-edge-1 |
/.env.release |
2026-09-24 03:15:40.179612-04:00 |
| frantech-ts |
/qzxuuppn.armv6 |
2026-09-24 03:15:40.179612-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/ |
2026-09-24 03:15:40.750912-04:00 |
| control-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Fir |
2026-09-24 03:15:40.750912-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-24 03:15:40.750912-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-24 03:15:40.750912-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/ |
2026-09-24 03:15:40.750912-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G960F Build/PPR1.1 |
2026-09-24 03:15:40.750912-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-24 03:15:40.750912-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ |
2026-09-24 03:15:40.750912-04:00 |
| canary-farm-1 |
Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 SonyEricssonP100 |
2026-09-24 03:15:40.750912-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 6.0.1; SM-J700F Build/MMB29K) Ap |
2026-09-24 03:15:40.750912-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
185.213.155.227 |
13189 |
5 |
13189 |
09-24 01:12 |
09-24 01:14 |
ipsum:1 |
31173 Services AB |
DE |
0 |
| netcup-ts |
185.73.23.162 |
4253 |
2 |
7 |
09-23 03:46 |
09-24 06:12 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
3551 |
2 |
7 |
09-23 03:47 |
09-24 06:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
2160 |
2 |
579 |
09-23 03:34 |
09-24 06:13 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
87.120.104.29 |
1650 |
121 |
1642 |
09-23 18:05 |
09-23 18:05 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| control-1 |
94.154.46.247 |
1050 |
112 |
1042 |
09-24 05:25 |
09-24 05:26 |
- |
Omegatech LTD |
US |
0 |
| ru-edge-1 |
38.76.171.143 |
402 |
2 |
1 |
09-23 16:13 |
09-23 16:20 |
- |
cognetcloud INC |
HK |
200 |
| control-1 |
213.209.159.175 |
330 |
52 |
258 |
09-23 04:47 |
09-24 00:53 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| canary-farm-1 |
136.85.48.119 |
228 |
56 |
153 |
09-23 16:49 |
09-23 16:49 |
- |
Google LLC |
SG |
17 |
| sponge-01-ts |
94.154.46.245 |
150 |
4 |
150 |
09-24 03:26 |
09-24 03:26 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
2a01:4f9:c015:8f93::1 |
144 |
2 |
142 |
09-23 13:45 |
09-23 13:45 |
- |
Hetzner Online GmbH |
FI |
0 |
| frantech-ts |
101.36.106.89 |
133 |
3 |
2 |
09-23 21:54 |
09-23 22:00 |
ipsum:3 |
UCLOUD INFORMATION TECHNOLOG |
HK |
0 |
| canary-farm-1 |
213.209.159.175 |
95 |
12 |
40 |
09-23 08:10 |
09-24 04:17 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| control-1 |
45.138.12.51 |
88 |
20 |
85 |
09-23 23:37 |
09-23 23:38 |
- |
Tc Datacenter Limited |
LT |
0 |
| ai-devbox-1 |
139.59.143.102 |
82 |
29 |
36 |
09-23 21:00 |
09-23 22:11 |
ipsum:2 firehol2 |
DigitalOcean, LLC |
DE |
6 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
6 |
1 |
| ai-devbox-1 |
19 |
14 |
| control-1 |
18 |
6 |
| canary-farm-1 |
26 |
17 |
Mint failures (24h): canary-farm-1:400x9; control-1:400x3; ai-devbox-1:400x11
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
18 |
| canary-farm-1 |
["aws"] |
26 |
| ru-edge-1 |
["aws"] |
6 |
| ai-devbox-1 |
["aws"] |
19 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1198
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 3
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1097 |
| ai-devbox-1 |
https |
373 |
| canary-farm-1 |
http |
1172 |
| canary-farm-1 |
https |
821 |
| control-1 |
http |
4270 |
| control-1 |
https |
1 |
| frantech-ts |
http |
14031 |
| netcup-ts |
http |
4858 |
| ru-edge-1 |
http |
2486 |
| sponge-01-ts |
http |
4282 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13910 |
| control-1 |
38.54.2.209 |
4250 |
| ru-edge-1 |
130.94.89.46 |
2478 |
| canary-farm-1 |
sso.rightabouteverything.show |
1214 |
| canary-farm-1 |
109.123.246.142 |
769 |
| ai-devbox-1 |
inference.fapthropic.com |
765 |
| sponge-01-ts |
89.167.72.144 |
719 |
| ai-devbox-1 |
217.15.163.226 |
692 |
| netcup-ts |
159.195.21.150 |
601 |
| frantech-ts |
we-love-the.world |
34 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (11 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
87.120.104.29 |
121 |
/.env~ [env-production] → /.env [issued] → /wp-config.php~ [wp-config] → /wp-config.php.save [wp-config] → /composer.lock [not-handled] → /.git/config [fake-git] → /.env.yml [env-production] → /settings.py [app-config-python] → /.env.toml [env-production] → /docker-compose/.env [env-production] → /web/.env.local [env-production] → /backend/.env [env-production] |
Sino Worldwide Trading Limit |
NO |
| control-1 |
94.154.46.247 |
112 |
/docker-compose.yml [docker-compose] → /docker-compose.override.yml [docker-compose] → /.htaccess [not-handled] → /wp-config.php [wp-config] → /wp-config.php~ [wp-config] → /wp-config.old [wp-config] → /config/app.php [app-config-php-services] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /.gitlab-ci.yml [gitlab-ci] → /settings.php [app-config-php] → /.ssh/id_dsa [ssh-private-key-error] |
Omegatech LTD |
US |
| canary-farm-1 |
136.85.48.119 |
56 |
/ [tarpit-module] → /o7ybcqzatjb7gh4n6pdl [not-handled] → /ro2nynsvz1jnr18og5ld [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /.bashrc [shell-rc] → /key.pem [ssh-private-key-error] → /wp-config.php.bak [wp-config] → /.zshrc [shell-rc] → /graphql [graphql-introspection] → /wp-config.php.old [wp-config] → /api/graphql [graphql-introspection] → /v1/graphql [graphql-introspection] |
Google LLC |
SG |
| control-1 |
213.209.159.175 |
52 |
/ [tarpit-module] → /6hehtqh1rvntnq [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
103.230.156.211 |
32 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.env [issued] → /.env.local [env-production] → /.env.production [env-production] → /.git/config [fake-git] → /.git/index [fake-git] → /.git/HEAD [fake-git] → /.vscode/sftp.json [sftp-config-error] → /.aws/credentials [aws-credentials-file] → /.ssh/id_rsa [ssh-private-key-error] |
Mammoth Media Pty Ltd |
AU |
| ai-devbox-1 |
139.59.143.102 |
29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
64.225.75.246 |
29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
157.245.113.227 |
28 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
147.182.200.94 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.81.12.187 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
139.59.143.102 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
142.93.129.190 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 543 sources sent credentials → 424 got a shell (78%) → 267 ran a command (63% of shell-getters, 49% of sources)
- event level: 15538 credential attempts → 7954 accepted logins → 10733 commands (135% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 707 attempts
New commands this window (0 of 96 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3710 |
7 |
134.199.148.192 |
"uname -m | awk '{printf $1}'" |
| 3710 |
7 |
134.199.148.192 |
"uname -s -v -n -r -m" |
| 1323 |
245 |
101.47.159.125 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1149 |
221 |
101.47.159.125 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 116 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 116 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 104 |
2 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 104 |
2 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 5859 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1291 |
345gs5662d34 |
345gs5662d34 |
| 970 |
root |
3245gs5662d34 |
| 67 |
support |
support |
| 64 |
root |
123456 |
| 56 |
pi |
raspberry |
| 53 |
user |
wasd |
| 48 |
ubuntu |
3245gs5662d34 |
| 36 |
admin |
3245gs5662d34 |