flux fleet digest — 2026-09-27 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1045 |
106 |
3513 |
530 |
-70% |
| canary-farm-1 |
1818 |
119 |
4896 |
199 |
-63% |
| control-1 |
3455 |
105 |
4508 |
113 |
-23% |
| frantech-ts |
27627 |
72 |
12977 |
250 |
+113% |
| lauterbourg-01-ts |
1593 |
153 |
2374 |
121 |
-33% |
| netcup-ts |
991 |
108 |
7452 |
91 |
-87% |
| ru-edge-1 |
435 |
107 |
3975 |
805 |
-89% |
| sponge-01-ts |
658 |
95 |
2416 |
102 |
-73% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| lauterbourg-01-ts |
webshell-probe |
21 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
70 |
490 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
20 |
140 |
ai-devbox-1,canary-farm-1,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
10 |
487 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 5aacd0c8529f |
4 |
16 |
lauterbourg-01-ts |
09-27 |
/ [kiteworks-root-redirect] → /login [kiteworks-shell] → / [kiteworks-root-redirect] → /login [kiteworks-shell] |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5c4b5dc2fb71 ⟳ |
3 |
21 |
canary-farm-1,frantech-ts,sponge-01-ts ⚠FLEET-WIDE |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
| 321f17b2aca0 ⟳ |
3 |
24 |
ai-devbox-1,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| lauterbourg-01-ts |
/.env.txt |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/server/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/core/app/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/drupal/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/bin/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/psnlink/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/newsletter/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/infrastructure/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/travis/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/production/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/debug.php |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/server-status.php |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/cpanel/phpinfo.php |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/staging/phpinfo.php |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/.env.default |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/wp-config.php.old |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/config/database.php |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/images/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/facturacion/.env |
2026-09-27 03:16:16.475387-04:00 |
| lauterbourg-01-ts |
/.env_database |
2026-09-27 03:16:16.475387-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/ |
2026-09-27 03:16:17.939430-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; Android 11; Pixel 5) AppleWebKit/537.36 |
2026-09-27 03:16:17.939430-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-27 03:16:17.939430-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-27 03:16:17.939430-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-27 03:16:17.939430-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Fir |
2026-09-27 03:16:17.939430-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_2) AppleWebKit/55 |
2026-09-27 03:16:17.939430-04:00 |
| netcup-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-27 03:16:17.939430-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-09-27 03:16:17.939430-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Linux; Android 9; SM-N950F) AppleWebKit/537.36 |
2026-09-27 03:16:17.939430-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
193.32.126.191 |
13195 |
5 |
13195 |
09-27 00:44 |
09-27 00:46 |
- |
31173 Services AB |
FR |
0 |
| frantech-ts |
23.234.117.146 |
13195 |
5 |
13195 |
09-26 10:53 |
09-26 10:54 |
- |
tzulo, inc. |
US |
0 |
| control-1 |
204.76.203.18 |
1378 |
2 |
568 |
09-26 03:34 |
09-26 20:53 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
87.120.104.29 |
1239 |
114 |
1231 |
09-26 05:33 |
09-26 05:33 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| canary-farm-1 |
213.209.159.175 |
442 |
62 |
315 |
09-26 05:35 |
09-27 06:09 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| netcup-ts |
45.139.104.35 |
352 |
1 |
1 |
09-26 03:36 |
09-26 22:21 |
- |
49.3 Networking LLC |
BG |
0 |
| canary-farm-1 |
41.140.17.206 |
340 |
21 |
54 |
09-27 01:54 |
09-27 02:08 |
- |
Office National des Postes e |
MA |
30 |
| lauterbourg-01-ts |
34.178.184.243 |
335 |
11 |
260 |
09-26 07:21 |
09-26 07:23 |
- |
Google LLC |
NL |
4 |
| frantech-ts |
94.154.46.247 |
300 |
4 |
150 |
09-26 07:49 |
09-26 07:49 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
213.209.159.154 |
243 |
20 |
240 |
09-26 07:33 |
09-26 07:34 |
- |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
213.209.159.154 |
243 |
8 |
240 |
09-26 13:36 |
09-26 13:36 |
- |
Feo Prest SRL |
DE |
0 |
| frantech-ts |
213.209.159.154 |
243 |
7 |
240 |
09-26 03:41 |
09-26 03:42 |
- |
Feo Prest SRL |
DE |
0 |
| sponge-01-ts |
213.209.159.154 |
243 |
7 |
240 |
09-26 19:53 |
09-26 19:53 |
- |
Feo Prest SRL |
DE |
0 |
| frantech-ts |
94.154.46.243 |
150 |
4 |
150 |
09-26 18:12 |
09-26 18:12 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
45.138.12.15 |
146 |
3 |
143 |
09-27 07:31 |
09-27 07:32 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
20 |
14 |
| ru-edge-1 |
3 |
3 |
| canary-farm-1 |
25 |
10 |
| control-1 |
18 |
5 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ru-edge-1:400x1; canary-farm-1:400x3
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
25 |
| ai-devbox-1 |
["aws"] |
20 |
| ru-edge-1 |
["aws"] |
3 |
| control-1 |
["aws"] |
18 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 797
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 5
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
946 |
| ai-devbox-1 |
https |
99 |
| canary-farm-1 |
http |
1591 |
| canary-farm-1 |
https |
227 |
| control-1 |
http |
3454 |
| control-1 |
https |
1 |
| frantech-ts |
http |
27627 |
| lauterbourg-01-ts |
http |
1128 |
| lauterbourg-01-ts |
https |
465 |
| netcup-ts |
http |
991 |
| ru-edge-1 |
http |
435 |
| sponge-01-ts |
http |
658 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
27490 |
| control-1 |
38.54.2.209 |
3433 |
| canary-farm-1 |
109.123.246.142 |
1380 |
| netcup-ts |
159.195.21.150 |
976 |
| lauterbourg-01-ts |
89.116.25.211 |
952 |
| ai-devbox-1 |
217.15.163.226 |
690 |
| sponge-01-ts |
89.167.72.144 |
652 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
634 |
| canary-farm-1 |
sso.rightabouteverything.show |
422 |
| ru-edge-1 |
130.94.89.46 |
421 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (14 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
87.120.104.29 |
114 |
/wp-config.php.save [wp-config] → /docker-compose.override.yml [docker-compose] → /wp-config.php.bak [wp-config] → /.env.bak [env-production] → /config.js [webapp-config-bundle-js] → /.env.staging [env-production] → /.ssh/authorized_keys [authorized-keys-error] → /.ssh/id_rsa [ssh-private-key-error] → /.env.local [env-production] → /wp-config.php [wp-config] → /composer.lock [not-handled] → /.dockerenv [not-handled] |
Sino Worldwide Trading Limit |
NO |
| canary-farm-1 |
213.209.159.175 |
62 |
/ [tarpit-module] → /0h1w3f6hp6ymlp [not-handled] → /.env [issued] → /.env [tracebit-http-error] → /rest/workflows [not-handled] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
138.68.144.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
164.90.228.79 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
146.190.63.48 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.189.225.181 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
64.227.70.2 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
167.71.175.236 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
41.140.17.206 |
21 |
/ [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] |
Office National des Postes e |
MA |
| control-1 |
213.209.159.154 |
20 |
/ [tarpit-module] → /.env [issued] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] → /laravel/.env [env-production-error] → /phpinfo/ [not-handled] → /.env.example [env-production-error] → /phpinfo.php [phpinfo-error] → /core/.env [env-production-error] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
45.138.12.51 |
20 |
/ [tarpit-module] → /.env.backup [env-production] → /.env.dev.local [tarpit-module] → /.env.prod [env-production] → /prod/.env [env-production] → /.env.uat [env-production] → /data/.git/config [fake-git] → /public/.git/config [fake-git] → /www/.git/config [fake-git] → /.svn/wc.db [fake-svn] → /docker-compose.prod.yml [docker-compose] → /.env [issued] |
Tc Datacenter Limited |
LT |
| ai-devbox-1 |
139.162.33.108 |
18 |
/ [tarpit-module] → /health [observability-health] → /nmaplowercheck1790433822 [not-handled] → /evox/about [not-handled] → /dana-na/nc/nc_gina_ver.txt [ivanti-nc-gina-ver] → /human.aspx [not-handled] → /login.php [webshell-sweep-observed] → /dniapi/userInfos [not-handled] → /user [not-handled] → /webui [not-handled] → /geoserver/ [geoserver-redirect-root] → /Account/Login [webapp-form-login] |
Akamai Connected Cloud |
SG |
| lauterbourg-01-ts |
142.93.0.66 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 609 sources sent credentials → 461 got a shell (76%) → 275 ran a command (60% of shell-getters, 45% of sources)
- event level: 9269 credential attempts → 4720 accepted logins → 7565 commands (160% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 817 attempts
New commands this window (0 of 77 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1457 |
3 |
109.160.32.45 |
"uname -s -v -n -r -m" |
| 1457 |
3 |
109.160.32.45 |
"uname -m | awk '{printf $1}'" |
| 1206 |
232 |
112.123.228.180 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1048 |
217 |
112.123.228.180 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 189 |
4 |
2.57.122.53 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 189 |
4 |
2.57.122.53 |
"lspci | grep VGA -c" |
| 189 |
4 |
2.57.122.53 |
"uptime -p" |
| 189 |
4 |
2.57.122.53 |
"/bin/./uname -s -v -n -r -m" |
Credentials: 3370 distinct pairs offered this window, 7 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
pwn |
pwn |
| 1 |
www |
123qweASD |
| 1 |
root |
sergio |
| 1 |
user3 |
1234567 |
| 1 |
test |
P@ssw0rd1! |
| 1 |
kacper |
kacper |
| 1 |
MikroTik |
12345678 |