flux fleet digest — 2026-09-25 07:49 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2569 |
122 |
4055 |
535 |
-37% |
| canary-farm-1 |
6719 |
160 |
4493 |
202 |
+50% |
| control-1 |
6508 |
91 |
3973 |
119 |
+64% |
| frantech-ts |
14326 |
110 |
12752 |
241 |
+12% |
| netcup-ts |
2956 |
90 |
7063 |
90 |
-58% |
| ru-edge-1 |
1192 |
115 |
4601 |
806 |
-74% |
| sponge-01-ts |
3976 |
92 |
2179 |
114 |
+82% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| control-1 |
app-config-php |
54 |
15.0 |
3.6x |
| control-1 |
app-config-python |
60 |
14.0 |
4.3x |
| control-1 |
app-config-yaml |
24 |
8.0 |
3.0x |
| control-1 |
application-yml |
24 |
7.0 |
3.4x |
| control-1 |
backup-archive |
33 |
9.2 |
3.6x |
| control-1 |
docker-compose |
21 |
5.9 |
3.6x |
| control-1 |
env-production |
455 |
127.9 |
3.6x |
| control-1 |
k8s-secret-manifest |
33 |
11.0 |
3.0x |
| control-1 |
kubeconfig |
22 |
7.2 |
3.1x |
| control-1 |
rails-database-yml |
33 |
9.2 |
3.6x |
| control-1 |
ssh-private-key-error |
81 |
26.4 |
3.1x |
| control-1 |
wp-config |
60 |
14.1 |
4.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
83 |
585 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
9 |
441 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| e6e6f15a77e8 ⟳ |
8 |
24 |
canary-farm-1 |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 1cf777711bea ⟳ |
7 |
59 |
ai-devbox-1,canary-farm-1,control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 321f17b2aca0 ⟳ |
5 |
36 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| ed66cc967251 ⟳ |
5 |
20 |
canary-farm-1 |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/8d67badf9e70 |
2026-09-25 03:34:25.142168-04:00 |
| frantech-ts |
/c/tGWxuir0HRXfs9qAOcaI2WObjvjWh3htJDlOs-tLeXHF_ioJuP7aKRquNz5T0LxpLLtAlkFeJkcCR_Wj_ic1l_oBeW2wK93D7zc |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/-KqRbQKNkzi3biTAjTAj36eyhsowt6_B3_pYoqxZ75-m0_c8RNkd9KLf7qb1ZHsRGi5cqPK9G8QT-LivHXTdWxZolCCvJkCRki0 |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/3ILAGUnxoZ5IiBJX1bVWXe_Ehn19RqPcmqrfqa8iiaBorWXOsM8B9CGtO6H4Ez_PI7J5uitT2D2ZyZrtPjNk9LySHap8_U16o-Q |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/TJLiClZ4UuIcLIrXXe4yFl0HSDp_7crz-sDesc-tXcuen-VETiX7kotkfDdE8ZOQYQ_cMdkEuyi3Zsf66isj38OKXxR7y5Lt-k8 |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/hpiKpcLNrLfEs-sWRu3-t9CKwgzN3wSeJQEzH725spwsEH6W_bUPj0zNAOL8glsuas7E9jyk1viAqWC8JP0dAU7uNSEaju6CnvI |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/n0VkSrbiaQM7FnlvaOOf7W80MkMPBFfDAcONqCSTd2eT-FNds2vdEbKMq7T7NMRSUrUbK1Rkd7KpKkD9JGdfEB1cFQqCYHniSBs |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/HlQvf7jH78i5K2Wmj2hjERT23kVBv4oWwntEekZYmiOoWcLTbmflSJzVlTXDuCU979ICsdok-sGnYK0yqhzcA0gfUCGw01q6fWQ |
2026-09-25 03:15:48.571622-04:00 |
| netcup-ts |
/de-de |
2026-09-25 03:15:48.571622-04:00 |
| ai-devbox-1 |
/ss_probe_5c9ee9e689d1e0c5e309f64ca2eca069 |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/l4_k5MkqusmNh5haKeDUC3_i0Y3SgGAGZLWRzk2KXnepCfX9zivpeB2IC4OFEgCttId0F3T-uozGrlX9K4ws5FTkc_5_vNl1Mxs |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/8F3SFm4eJRG7uD6panNVV9awsJZqfuMa3fVR68IsJTkaMY9chEeZbeOayPVpfMfqxeac3rUaelE43lylGwH7uiVYodC6TurJyTg |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/NGRO9w2T0D3sJ-JJOFwfdqJ-SMMdJBVosmtyxwLhtTmuk0ik6rPf8I6iSUss09kkXXrwI--3o-_33I-ZtygSW-O9c7zMEsKESOs |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/qWmLQXdXo4aG7wh5g6xhq60zIJZsi8jXbL69zkGXscaZ9to_isC6SYcAkudsy1jheTy7FBhf7pAfg4XLqPpwhLdFuR2pCGBJdto |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/vmYu89LFJYe9uYhEPUcIUNOs0zaEdCgaI5p15HdO-bG4MiwJot7XGEBpJgrQrOlalfQt3NdDjO-2ZYz_0g7_ln8rYyQeOSwocws |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/qnkBuZXmV6udvJwjzie-Mjd2LJCNdX3AWC-xa-I0iXySGVloe0ptM7hBahpglr8rAabF0aG02WBunzXRL23ffolTMpdzXu_Qf3A |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/ryEeL-Nfwv_QvrB5UO034S410ZCmVRZjEfsIDnQ9sj9rUt2Qy37m-DTV9YmIGvZ-RDcgBZ-g3FJ4k4XU71jwIi7f9dPAMqYarW0 |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/JiPvY2amTtpwO6JItNYksA0ECkg_KTfF7pXEDSt9BVksyJ0tWcZFqZwuIEBFOqldhz-kMXgJcwSFikjM3doen1iCttUVOvazgtg |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/Hk73djS7u-U4ziYSSyZWRTggvykXRgtkjKljOtnXTNFQolGTFM7NiFdehooxLfrouusuRADLbDjPflC25FmJc8-Vrp9OS2xnmNo |
2026-09-25 03:15:48.571622-04:00 |
| frantech-ts |
/c/CFSbIhe9TpmAs-18InGimk7PEE2OF0PPei43ijGOsHK-p5nwXbVu25rUelzB-KsG03RMxf4oaMrEnpZDsc_JciUkjt_K6qZMCfw |
2026-09-25 03:15:48.571622-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Jigsaw/2.2.5 W3C_CSS_Validator_JFouffa/2.0 |
2026-09-25 03:31:19.077862-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-09-25 03:31:19.077862-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-09-25 03:15:49.373370-04:00 |
| control-1 |
Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-R530C Build |
2026-09-25 03:15:49.373370-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/ |
2026-09-25 03:15:49.373370-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.3 |
2026-09-25 03:15:49.373370-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_1) AppleWebKit/555. |
2026-09-25 03:15:49.373370-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML |
2026-09-25 03:15:49.373370-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20 |
2026-09-25 03:15:49.373370-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100 |
2026-09-25 03:15:49.373370-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.60.3 |
13189 |
5 |
13189 |
09-25 00:13 |
09-25 00:15 |
ipsum:1 |
Datacamp Limited |
SG |
0 |
| canary-farm-1 |
94.154.46.249 |
2222 |
115 |
1164 |
09-24 23:37 |
09-24 23:37 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
94.154.46.246 |
2100 |
111 |
1042 |
09-25 05:32 |
09-25 05:33 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
204.76.203.18 |
2098 |
2 |
580 |
09-24 03:49 |
09-25 06:13 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.162 |
2083 |
3 |
9 |
09-24 03:50 |
09-24 13:22 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
1832 |
2 |
8 |
09-24 03:49 |
09-24 13:22 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
94.154.46.247 |
1050 |
112 |
1042 |
09-24 05:25 |
09-24 05:26 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
94.154.46.249 |
1050 |
112 |
1042 |
09-25 00:25 |
09-25 00:25 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
94.154.46.244 |
1050 |
113 |
1042 |
09-24 21:15 |
09-24 21:15 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
213.209.159.175 |
380 |
52 |
325 |
09-24 04:17 |
09-25 01:32 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
41.140.198.124 |
334 |
21 |
54 |
09-25 03:17 |
09-25 03:30 |
- |
Office National des Postes e |
MA |
29 |
| frantech-ts |
87.120.104.29 |
300 |
4 |
150 |
09-25 01:22 |
09-25 01:22 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| netcup-ts |
185.151.196.17 |
280 |
6 |
10 |
09-24 19:40 |
09-24 19:40 |
- |
Partner Communications Ltd. |
IL |
1 |
| canary-farm-1 |
51.75.142.41 |
280 |
6 |
10 |
09-24 20:45 |
09-24 20:48 |
- |
OVH SAS |
FR |
1 |
| ai-devbox-1 |
103.118.17.13 |
280 |
6 |
10 |
09-24 19:41 |
09-24 19:42 |
- |
WHG Hosting Services Ltd |
IN |
1 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
3 |
3 |
| control-1 |
24 |
7 |
| canary-farm-1 |
40 |
15 |
| ai-devbox-1 |
30 |
14 |
Mint failures (24h): control-1:400x3; ai-devbox-1:400x5; canary-farm-1:400x17
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
30 |
| ru-edge-1 |
["aws"] |
3 |
| canary-farm-1 |
["aws"] |
40 |
| control-1 |
["aws"] |
24 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 552
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2266 |
| ai-devbox-1 |
https |
303 |
| canary-farm-1 |
http |
6472 |
| canary-farm-1 |
https |
247 |
| control-1 |
http |
6508 |
| frantech-ts |
http |
14326 |
| netcup-ts |
http |
2956 |
| ru-edge-1 |
http |
1192 |
| sponge-01-ts |
http |
3976 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14116 |
| control-1 |
38.54.2.209 |
6495 |
| canary-farm-1 |
109.123.246.142 |
6304 |
| sponge-01-ts |
89.167.72.144 |
2137 |
| ai-devbox-1 |
217.15.163.226 |
1977 |
| ru-edge-1 |
130.94.89.46 |
1187 |
| netcup-ts |
159.195.21.150 |
865 |
| ai-devbox-1 |
inference.fapthropic.com |
578 |
| canary-farm-1 |
sso.rightabouteverything.show |
404 |
| frantech-ts |
we-love-the.world |
53 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (12 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
94.154.46.249 |
115 |
/wp-config.php.old [wp-config] → /.git/HEAD [fake-git] → /.git/index [fake-git] → /wp-config.php [wp-config] → /config.php [app-config-php] → /docker-compose.yml [docker-compose] → /wp-config.old [wp-config] → /wp-config.bak [wp-config] → /docker-compose.override.yml [docker-compose] → /wp-config.php.save [wp-config] → /wp-config.php.bak [wp-config] → /.aws/config [aws-config-file] |
Omegatech LTD |
US |
| control-1 |
94.154.46.244 |
113 |
/config.php [app-config-php] → /Gemfile.lock [not-handled] → /.env_dev [env-production] → /api/.env [env-production] → /docker/compose/withMySQL/.env [tarpit-module] → /config/database.php [app-config-php-database] → /wp-config.php~ [wp-config] → /Jenkinsfile [jenkinsfile] → /.env.development [env-production] → /configuration.php [app-config-php] → /docker/compose/withRedis/.env [tarpit-module] → /.env.production [env-production] |
Omegatech LTD |
US |
| control-1 |
94.154.46.249 |
112 |
/configuration.php [app-config-php] → /composer.lock [not-handled] → /.env.development.local [env-production] → /.env.staging [env-production] → /.git/index [fake-git] → /config.php [app-config-php] → /.env.staging.local [env-production] → /.dockerenv [not-handled] → /config.js [webapp-config-bundle-js] → /settings.py [app-config-python] → /wp-config.php.old [wp-config] → /.env.tmp [env-production] |
Omegatech LTD |
US |
| control-1 |
94.154.46.247 |
112 |
/docker-compose.yml [docker-compose] → /docker-compose.override.yml [docker-compose] → /.htaccess [not-handled] → /wp-config.php [wp-config] → /wp-config.php~ [wp-config] → /wp-config.old [wp-config] → /config/app.php [app-config-php-services] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /.gitlab-ci.yml [gitlab-ci] → /settings.php [app-config-php] → /.ssh/id_dsa [ssh-private-key-error] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.246 |
111 |
/.git/config [fake-git] → /wp-config.php.bak [wp-config] → /.git/index [fake-git] → /.git/HEAD [fake-git] → /package-lock.json [package-lock-json-error] → /wp-config.php.save [wp-config] → /settings.php [app-config-php] → /configuration.php [app-config-php] → /docker-compose.override.yml [docker-compose] → /.dockerenv [not-handled] → /wp-config.php [wp-config] → /.aws/config [aws-config-file] |
Omegatech LTD |
US |
| canary-farm-1 |
213.209.159.175 |
52 |
/ [tarpit-module] → /t8tiaxmsiktv53 [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /55fw6eif7deewo [not-handled] → /laravel/.env [env-production] → /phpinfo/ [not-handled] |
Feo Prest SRL |
DE |
| canary-farm-1 |
176.65.144.71 |
39 |
/kmonbasezd0b157690 [not-handled] → /.env.production [env-production] → /.env [issued] → /config/.env [env-production] → /.env.save [env-production] → /.env.example [env-production] → /backups/.env [env-production] → /app/.env [env-production] → /public_html/.env [env-production] → /airflow.cfg [not-handled] → /www/.env [env-production] → /Jenkinsfile [jenkinsfile] |
Dedik Services Limited |
CH |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
134.122.28.88 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
206.81.12.187 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 633 sources sent credentials → 480 got a shell (76%) → 281 ran a command (59% of shell-getters, 44% of sources)
- event level: 20737 credential attempts → 5577 accepted logins → 8497 commands (152% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 2120 attempts
New commands this window (0 of 63 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2840 |
5 |
109.160.32.105 |
"uname -m | awk '{printf $1}'" |
| 2840 |
5 |
109.160.32.105 |
"uname -s -v -n -r -m" |
| 1123 |
261 |
13.72.83.77 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 980 |
233 |
13.72.83.77 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 139 |
4 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 139 |
4 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 36 |
24 |
140.246.137.102 |
"cat /proc/cpuinfo | grep name | wc -l" |
| 34 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 11738 distinct pairs offered this window, 6 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
rayhan |
rayhan |
| 1 |
root |
asdfgh |
| 1 |
root |
staff@2026 |
| 1 |
root |
123456ok |
| 1 |
qwe |
root |
| 1 |
dede |
dede123 |