flux fleet digest — 2026-09-28 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
748 |
95 |
2999 |
513 |
-75% |
| canary-farm-1 |
3041 |
126 |
4881 |
192 |
-38% |
| control-1 |
2863 |
84 |
4451 |
112 |
-36% |
| frantech-ts |
475 |
63 |
14924 |
242 |
-97% |
| lauterbourg-01-ts |
2282 |
145 |
1984 |
137 |
+15% |
| netcup-ts |
932 |
88 |
7496 |
94 |
-88% |
| ru-edge-1 |
274 |
92 |
3398 |
804 |
-92% |
| sponge-01-ts |
690 |
90 |
2116 |
95 |
-67% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| lauterbourg-01-ts |
wp-xmlrpc-post |
1000 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
81 |
567 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
9 |
441 |
ai-devbox-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 1cf777711bea ⟳ |
4 |
44 |
ai-devbox-1,control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 4cd90f65cba3 |
4 |
224 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-28 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| c38436efbf6b |
4 |
40 |
frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-28 |
/.env [not-handled] → /.env.production [not-handled] → /.env.staging [not-handled] → /.env.development [not-handled] → /.env.local [not-handled] → /.env.backup [not-handled] → … |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 4b4cc0ece037 ⟳ |
3 |
21 |
control-1,frantech-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/c/aXTJFptR8wmPR-PG6oGgipQnMIjg-nCBywVw53Yj6qbr_kjur6TCj-vHMQ24BO7QBBB19PeoK_UnAGY4qBXxNDKMxS_Q2p5YWPE |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/4nEjtMz-7DLhdbElzwdEAAAPGHYD15gY3ICQwx7bh9PtcO87Z49nJjU-mHk1wMZ2nIB8Zbx--fwwPWJF5hYvJy7G9nR705qUVoU |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/4l-bnnHDvU8HeL9KCblUGQKpiPNE9ZCDi-vwU9EaUpLZQuJrWMTRXmw0FoxuP8dLreo575mndU58yUFVpo3ZG71nhizoq8oOo80 |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/lzt2-FdrG_R5y9OiHcku9Raq7jUrJHxpEgX3C00yXV_mbDuGgmTCJbEu2YpNRyoj5Kv6Y-UdJFrnN5k0TL6Ra4WOgcYeeTOi8FQ |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/lcoYgNLC14MkSenOtcUeKEhn_BiAnojSVlA3eVlx25BVhxgajzVfbvlMGDiW_HbYoFzAEFU8OtHIv2vH0bBhg2mzuECr2se7vVw |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/BSERawhPUhm-PJtFJ-8Mw-MC1IKNFUEDlWqgBK0prWfWzA-3FCHU_4GdNXgkC079DwoSyeSRyLKO043T6MwiL9MmbMrbCxsE-lk |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/wA9Moy6Iz8fcNTcttFe5vufORDE1HLtMaM5OSCi8TMY5gjhQ0oLfHdigCmXyChHyn5lkm-we-SGhKxMcMMOXcauzbvJb3cDxMdQ |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/XDqqrtPGqiVZerDrm-UIZJEC-yhhP3ESd5V8MWkBDbFlWbWXjrZNHG7WdiA_qwGU27RsraKrwYoiRX0dRLA-noYhJj4RDZIve4A |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/storage/logs/laravel-2026-09-26.log |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/storage/logs/laravel-2026-09-25.log |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/smpjTZ-Pmum6FmS30fqGl9bl7rWgbQWTLxl3pG_G_MYJwjB24pKMjU8f_prR5kU1zLpTXcBmGXnmRRw3skEFV6fgrXjzoW9chNQ |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/IegBoOixwLsHIy9zrz7iusd2Gv1g8v4HhhygjoCXpXNlETRSbcDR8JgvV3XtR3Z1f7fAepeCQv4jyH-iYUMD-aVOL7Rdz5kAkr4 |
2026-09-28 03:15:37.355238-04:00 |
| frantech-ts |
/c/f4NHdT3yL-Dn3fCIheg6By5dWYK0NfgOdujoi-izt0mWdhKID-XSMagWGdG5XtHhaTvvVfZJ1SWAyCWkMJy2COvw7sgagb9qhXM |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/sitecore/shell/sitecore.version.xml |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/Telerik.Web.UI.WebResource.axd |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/jasperserver/login.html |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/akismet/readme.txt |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/wordfence/readme.txt |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/wp-fastest-cache/readme.txt |
2026-09-28 03:15:37.355238-04:00 |
| lauterbourg-01-ts |
/instance/config.py |
2026-09-28 03:15:37.355238-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/ |
2026-09-28 03:15:37.538399-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-28 03:15:37.538399-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-09-28 03:15:37.538399-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/593.38 (KHTML, l |
2026-09-28 03:15:37.538399-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-28 03:15:37.538399-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit/619 |
2026-09-28 03:15:37.538399-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3. |
2026-09-28 03:15:37.538399-04:00 |
| frantech-ts |
Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTM |
2026-09-28 03:15:37.538399-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/ |
2026-09-28 03:15:37.538399-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-28 03:15:37.538399-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
94.154.46.246 |
2100 |
132 |
1042 |
09-28 05:48 |
09-28 05:49 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
204.76.203.18 |
1310 |
2 |
581 |
09-27 15:15 |
09-28 06:13 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
94.154.46.243 |
1050 |
112 |
1042 |
09-27 10:18 |
09-27 10:19 |
- |
Omegatech LTD |
US |
0 |
| lauterbourg-01-ts |
185.19.40.202 |
1007 |
5 |
5 |
09-28 00:14 |
09-28 00:15 |
- |
1337 Services GmbH |
NL |
1000 |
| lauterbourg-01-ts |
94.154.46.248 |
300 |
6 |
150 |
09-27 21:01 |
09-27 21:01 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
213.209.159.175 |
168 |
12 |
41 |
09-27 06:09 |
09-28 04:26 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| netcup-ts |
94.154.46.246 |
150 |
5 |
150 |
09-27 20:21 |
09-27 20:21 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
45.138.12.15 |
146 |
3 |
143 |
09-27 07:31 |
09-27 07:32 |
- |
Tc Datacenter Limited |
LT |
0 |
| netcup-ts |
118.194.250.22 |
133 |
3 |
2 |
09-27 12:00 |
09-27 12:06 |
ipsum:3 |
UCLOUD INFORMATION TECHNOLOG |
TH |
0 |
| control-1 |
213.209.159.175 |
126 |
12 |
40 |
09-27 11:26 |
09-28 02:02 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
35.205.254.119 |
119 |
6 |
119 |
09-27 05:08 |
09-27 05:09 |
- |
Google LLC |
BE |
0 |
| sponge-01-ts |
123.58.215.102 |
114 |
2 |
2 |
09-28 04:05 |
09-28 04:11 |
ipsum:4 |
UCLOUD INFORMATION TECHNOLOG |
HK |
0 |
| netcup-ts |
45.138.12.51 |
88 |
3 |
85 |
09-28 03:08 |
09-28 03:08 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
45.138.12.51 |
88 |
4 |
85 |
09-27 06:38 |
09-27 06:38 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
144.172.99.12 |
79 |
3 |
79 |
09-27 13:27 |
09-27 13:28 |
- |
RouterHosting LLC |
US |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
23 |
15 |
| control-1 |
17 |
4 |
| canary-farm-1 |
43 |
16 |
| ru-edge-1 |
5 |
3 |
| frantech-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
23 |
| canary-farm-1 |
["aws"] |
43 |
| control-1 |
["aws"] |
17 |
| ru-edge-1 |
["aws"] |
5 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 325
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
659 |
| ai-devbox-1 |
https |
89 |
| canary-farm-1 |
http |
2944 |
| canary-farm-1 |
https |
97 |
| control-1 |
http |
2863 |
| frantech-ts |
http |
475 |
| lauterbourg-01-ts |
http |
2144 |
| lauterbourg-01-ts |
https |
138 |
| netcup-ts |
http |
932 |
| ru-edge-1 |
http |
274 |
| sponge-01-ts |
http |
690 |
Top Host headers:
| sensor |
host |
events |
| control-1 |
38.54.2.209 |
2851 |
| canary-farm-1 |
109.123.246.142 |
2836 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
1288 |
| lauterbourg-01-ts |
89.116.25.211 |
984 |
| netcup-ts |
159.195.21.150 |
913 |
| sponge-01-ts |
89.167.72.144 |
682 |
| ai-devbox-1 |
217.15.163.226 |
560 |
| frantech-ts |
209.141.62.110 |
361 |
| ru-edge-1 |
130.94.89.46 |
269 |
| canary-farm-1 |
sso.rightabouteverything.show |
198 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (15 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
94.154.46.246 |
132 |
/config/database.php [app-config-php-database] → /.aws/credentials [aws-credentials-file] → /Jenkinsfile [jenkinsfile] → /Gemfile.lock [gemfile-lock-error] → /config.js [webapp-config-bundle-js] → /.npmrc [npmrc-error] → /.env.2 [tarpit-module] → /.env.txt [env-production] → /api/.env [env-production] → /.env.bak [env-production] → /settings.php [app-config-php] → /.env.local [env-production] |
Omegatech LTD |
US |
| control-1 |
94.154.46.243 |
112 |
/settings.py [app-config-python] → /.env.test.local [env-production] → /.gitlab-ci.yml [gitlab-ci] → /.env.staging [env-production] → /.env_backup [env-production] → /.ssh/authorized_keys [authorized-keys-error] → /.env.new [env-production] → /.git/HEAD [fake-git] → /docker-compose.yaml [docker-compose] → /.env.prev [env-production] → /wp-config.php [wp-config] → /.env.sample [env-production] |
Omegatech LTD |
US |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
46.101.1.225 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
167.172.158.128 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
167.71.175.236 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| lauterbourg-01-ts |
134.209.25.199 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| lauterbourg-01-ts |
209.38.208.202 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
213.209.159.175 |
12 |
/ [tarpit-module] → /mvpkq47pd6i4wj [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| control-1 |
213.209.159.175 |
12 |
/ [tarpit-module] → /n94nv0zto4qaqn [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
80.94.95.211 |
12 |
/ [tarpit-module] → /3akseuimehr4i6 [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
SS-Net |
RO |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 577 sources sent credentials → 442 got a shell (77%) → 246 ran a command (56% of shell-getters, 43% of sources)
- event level: 12712 credential attempts → 5783 accepted logins → 8585 commands (148% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 2669 attempts
New commands this window (0 of 39 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2908 |
5 |
109.160.32.170 |
"uname -s -v -n -r -m" |
| 2908 |
5 |
109.160.32.170 |
"uname -m | awk '{printf $1}'" |
| 1013 |
214 |
103.38.219.22 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 888 |
190 |
103.38.219.22 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 283 |
22 |
119.1.100.156 |
"uname -a" |
| 162 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 162 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 72 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 3004 distinct pairs offered this window, 15 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
dejanae |
dejanae1 |
| 1 |
ftpuser |
Password01 |
| 1 |
root |
fckgwrhqq2 |
| 1 |
ftpadmin |
1 |
| 1 |
openkm |
password |
| 1 |
root |
helloadmin |
| 1 |
root |
abc.369* |
| 1 |
dejanae |
dejanae123 |