flux fleet digest — 2026-09-29 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
5148 |
122 |
2571 |
504 |
+100% |
| canary-farm-1 |
5804 |
164 |
4623 |
182 |
+26% |
| control-1 |
3336 |
107 |
4484 |
111 |
-26% |
| frantech-ts |
615 |
83 |
13017 |
238 |
-95% |
| lauterbourg-01-ts |
6770 |
126 |
2083 |
140 |
+225% |
| netcup-ts |
613 |
98 |
7233 |
96 |
-92% |
| ru-edge-1 |
448 |
97 |
2994 |
801 |
-85% |
| sponge-01-ts |
2443 |
99 |
2065 |
96 |
+18% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
app-config-php |
92 |
8.0 |
11.5x |
| ai-devbox-1 |
app-config-properties |
30 |
0.0 |
infx |
| ai-devbox-1 |
app-config-python |
94 |
21.5 |
4.4x |
| ai-devbox-1 |
app-config-yaml |
61 |
9.0 |
6.8x |
| ai-devbox-1 |
application-properties |
36 |
4.5 |
8.0x |
| ai-devbox-1 |
application-yml |
32 |
9.0 |
3.6x |
| ai-devbox-1 |
aws-credentials-file |
21 |
2.8 |
7.4x |
| ai-devbox-1 |
cmd-injection-php-cgi-rce |
25 |
8.3 |
3.0x |
| ai-devbox-1 |
config-json |
24 |
8.0 |
3.0x |
| ai-devbox-1 |
docker-compose |
24 |
4.1 |
5.8x |
| ai-devbox-1 |
env-production |
783 |
90.1 |
8.7x |
| ai-devbox-1 |
firebase-json |
21 |
2.5 |
8.4x |
| ai-devbox-1 |
iis-web-config |
23 |
6.0 |
3.8x |
| ai-devbox-1 |
k8s-secret-manifest |
29 |
8.0 |
3.6x |
| ai-devbox-1 |
kubeconfig |
21 |
5.5 |
3.8x |
| ai-devbox-1 |
not-handled |
1186 |
380.0 |
3.1x |
| ai-devbox-1 |
phpinfo |
115 |
13.7 |
8.4x |
| ai-devbox-1 |
rails-database-yml |
44 |
12.5 |
3.5x |
| ai-devbox-1 |
ssh-private-key |
54 |
0.0 |
infx |
| ai-devbox-1 |
terraform-tfstate |
23 |
3.5 |
6.6x |
| ai-devbox-1 |
terraform-tfvars |
20 |
3.5 |
5.7x |
| ai-devbox-1 |
wp-config |
76 |
8.9 |
8.6x |
| canary-farm-1 |
app-config-properties |
32 |
8.0 |
4.0x |
| canary-farm-1 |
app-config-yaml |
88 |
27.3 |
3.2x |
| canary-farm-1 |
application-properties |
40 |
13.3 |
3.0x |
| canary-farm-1 |
phpinfo |
74 |
21.3 |
3.5x |
| control-1 |
phpinfo |
62 |
15.6 |
4.0x |
| lauterbourg-01-ts |
wp-login-credentials |
3049 |
14.0 |
217.8x |
| lauterbourg-01-ts |
wp-xmlrpc-post |
3050 |
1000.0 |
3.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
81 |
567 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
15 |
105 |
ai-devbox-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
14 |
686 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 7ea1125e0232 ⟳ |
5 |
76 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 6f51c096c3a0 |
3 |
9 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-29 |
/.env [issued] → / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] |
| 1473fd7a8615 |
3 |
51 |
ai-devbox-1,canary-farm-1,netcup-ts ⚠FLEET-WIDE |
09-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /admin/ [webapp-form-profile] → / [tarpit-module] → / [tarpit] → … |
| 218630667b2c ⟳ |
3 |
126 |
ai-devbox-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| lauterbourg-01-ts |
/geoserver/ |
2026-09-29 03:15:36.218605-04:00 |
| lauterbourg-01-ts |
/apps/zxtm/login.cgi |
2026-09-29 03:15:36.218605-04:00 |
| lauterbourg-01-ts |
/cslu/v1/core/conf |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/.aws/config.bak |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/group_vars/all.yml |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/.env2 |
2026-09-29 03:15:36.218605-04:00 |
| lauterbourg-01-ts |
/core/misc/drupal.js |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/aws/ec2/.env |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/helmfile.yaml |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/infra/terraform.tfvars.json |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/circle.yml |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/saltstack/.env |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/terraform/terraform.tfvars |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/salt/pillar/secrets.sls |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/ansible/roles/common/vars/main.yml |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/.env.20230101 |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/heroku.env |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/k8s-config.yaml |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/jwt.key |
2026-09-29 03:15:36.218605-04:00 |
| ai-devbox-1 |
/.hg/store/data/.env.i |
2026-09-29 03:15:36.218605-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-29 03:15:36.419575-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:78.0) Gecko |
2026-09-29 03:15:36.419575-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.19) Ge |
2026-09-29 03:15:36.419575-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/ |
2026-09-29 03:15:36.419575-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Fir |
2026-09-29 03:15:36.419575-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) Apple |
2026-09-29 03:15:36.419575-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit/54 |
2026-09-29 03:15:36.419575-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-29 03:15:36.419575-04:00 |
| netcup-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/542.54 (KHTML, l |
2026-09-29 03:15:36.419575-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 7_1; Win64; x64) AppleWebKit/547.55 |
2026-09-29 03:15:36.419575-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| lauterbourg-01-ts |
134.209.110.125 |
6108 |
7 |
6 |
09-28 17:20 |
09-28 19:04 |
- |
DigitalOcean, LLC |
SG |
6099 |
| control-1 |
204.76.203.18 |
2143 |
2 |
580 |
09-28 04:22 |
09-29 05:30 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
94.154.46.245 |
2100 |
132 |
1042 |
09-28 10:16 |
09-28 10:16 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
94.154.46.246 |
2100 |
132 |
1042 |
09-28 05:48 |
09-28 05:49 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
94.154.46.246 |
1668 |
125 |
911 |
09-28 14:47 |
09-28 14:47 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
94.154.46.245 |
1453 |
131 |
1025 |
09-28 19:09 |
09-28 19:09 |
- |
Omegatech LTD |
US |
0 |
| sponge-01-ts |
185.73.23.162 |
1370 |
2 |
8 |
09-28 14:31 |
09-28 21:26 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| canary-farm-1 |
102.220.161.139 |
514 |
34 |
511 |
09-28 16:53 |
09-28 19:44 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
102.220.161.139 |
514 |
34 |
511 |
09-28 16:53 |
09-28 19:35 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.161.139 |
514 |
34 |
511 |
09-28 20:26 |
09-28 20:39 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
35.185.144.245 |
335 |
16 |
259 |
09-28 20:05 |
09-28 20:07 |
- |
Google LLC |
TW |
4 |
| lauterbourg-01-ts |
172.235.181.217 |
202 |
27 |
165 |
09-28 13:14 |
09-28 13:15 |
ipsum:4 firehol2 |
Akamai Connected Cloud |
NL |
1 |
| sponge-01-ts |
172.105.69.26 |
200 |
22 |
160 |
09-28 21:09 |
09-28 21:10 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
DE |
1 |
| control-1 |
213.209.159.175 |
168 |
12 |
41 |
09-28 09:12 |
09-29 04:24 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| sponge-01-ts |
94.154.46.245 |
150 |
5 |
150 |
09-28 20:22 |
09-28 20:22 |
- |
Omegatech LTD |
US |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
15 |
4 |
| ai-devbox-1 |
42 |
16 |
| canary-farm-1 |
45 |
15 |
| ru-edge-1 |
4 |
3 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
36 |
| ai-devbox-1 |
["aws"] |
42 |
| canary-farm-1 |
["aws","ssh"] |
9 |
| control-1 |
["aws"] |
15 |
| ru-edge-1 |
["aws"] |
4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 775
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
4577 |
| ai-devbox-1 |
https |
571 |
| canary-farm-1 |
http |
5665 |
| canary-farm-1 |
https |
139 |
| control-1 |
http |
3336 |
| frantech-ts |
http |
615 |
| lauterbourg-01-ts |
http |
6706 |
| lauterbourg-01-ts |
https |
64 |
| netcup-ts |
http |
613 |
| ru-edge-1 |
http |
448 |
| sponge-01-ts |
http |
2443 |
Top Host headers:
| sensor |
host |
events |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
6214 |
| canary-farm-1 |
109.123.246.142 |
5552 |
| ai-devbox-1 |
217.15.163.226 |
4471 |
| control-1 |
38.54.2.209 |
3319 |
| sponge-01-ts |
89.167.72.144 |
867 |
| ai-devbox-1 |
inference.fapthropic.com |
671 |
| netcup-ts |
159.195.21.150 |
609 |
| frantech-ts |
209.141.62.110 |
492 |
| ru-edge-1 |
130.94.89.46 |
443 |
| lauterbourg-01-ts |
89.116.25.211 |
349 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (16 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
94.154.46.245 |
132 |
/wp-config.php.old [wp-config] → /wp-config.php~ [wp-config] → /.git/config [fake-git] → /wp-config.php [wp-config] → /.git/HEAD [fake-git] → /.git/index [fake-git] → /configuration.php [app-config-php] → /wp-config.php.bak [wp-config] → /.aws/credentials [aws-credentials-file] → /.travis.yml [generic-ci-config] → /wp-config.old [wp-config] → /package-lock.json [package-lock-json-error] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.246 |
132 |
/config/database.php [app-config-php-database] → /.aws/credentials [aws-credentials-file] → /Jenkinsfile [jenkinsfile] → /Gemfile.lock [gemfile-lock-error] → /config.js [webapp-config-bundle-js] → /.npmrc [npmrc-error] → /.env.2 [tarpit-module] → /.env.txt [env-production] → /api/.env [env-production] → /.env.bak [env-production] → /settings.php [app-config-php] → /.env.local [env-production] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.245 |
131 |
/.env.old [env-production] → /.yarnrc [yarnrc-error] → /wp-config.bak [wp-config] → /html/.env [env-production] → /.env.save~ [env-production] → /docker-compose.yml [docker-compose] → /.env_dev [env-production] → /.circleci/config.yml [generic-ci-config] → /.git/config [fake-git] → /client/.env [env-production] → /config/environment.rb [not-handled] → /.env.development [env-production] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.246 |
125 |
/wp-config.php.bak [wp-config] → /.env.swp [env-production] → /wp-config.php [wp-config] → /.git/config [fake-git] → /public/.env [env-production] → /config/app.php [app-config-php-services] → / [tarpit-module] → /.env.sample [env-production] → /.env.save [env-production] → /.env.prev [env-production] → /.env.saved [env-production] → /wp-config.old [wp-config] |
Omegatech LTD |
US |
| canary-farm-1 |
102.220.161.139 |
34 |
/ [tarpit-module] → /pscan-590647e5-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| control-1 |
102.220.161.139 |
34 |
/ [tarpit-module] → /pscan-6f037ff5-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.139 |
34 |
/ [tarpit-module] → /pscan-553949ab-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
94.26.106.73 |
30 |
/.env.prod [env-production] → /api/.env [env-production] → /.env.backup [env-production] → /storage/.env [env-production] → /.env.production [env-production] → /.env.development [env-production] → /wp-config.php [wp-config] → /.git/HEAD [fake-git] → /.env.dev [env-production] → /bootstrap/cache/config.php [app-config-php] → /.env.local [env-production] → /config/mail.php [app-config-php-mail] |
TechTies Inc. |
DE |
| lauterbourg-01-ts |
172.235.181.217 |
27 |
/ [kiteworks-root-redirect] → /health [observability-health] → /nmaplowercheck1790601286 [not-handled] → /rest/applinks/1.0/manifest [not-handled] → /cgi-mod/header_logo.cgi [not-handled] → /sdk [not-handled] → /nmaplowercheck1790601287 [not-handled] → /HNAP1 [hnap1-discovery] → /login [kiteworks-shell] → /confluence/rest/applinks/1.0/manifest [not-handled] → /favicon.ico [tarpit-module] → /evox/about [not-handled] |
Akamai Connected Cloud |
NL |
| canary-farm-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
164.92.107.174 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 609 sources sent credentials → 471 got a shell (77%) → 284 ran a command (60% of shell-getters, 47% of sources)
- event level: 15811 credential attempts → 7390 accepted logins → 14058 commands (190% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 2644 attempts
New commands this window (0 of 49 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 4213 |
7 |
109.160.32.150 |
"uname -s -v -n -r -m" |
| 4212 |
7 |
109.160.32.150 |
"uname -m | awk '{printf $1}'" |
| 994 |
226 |
129.226.202.180 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 836 |
202 |
129.226.202.180 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 408 |
7 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 408 |
7 |
195.178.110.218 |
"uptime -p" |
| 408 |
7 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 407 |
7 |
195.178.110.218 |
"lspci | grep VGA -c" |
Credentials: 3487 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 959 |
345gs5662d34 |
345gs5662d34 |
| 698 |
root |
3245gs5662d34 |
| 62 |
root |
123456 |
| 57 |
ubuntu |
3245gs5662d34 |
| 54 |
admin |
admin |
| 49 |
pi |
raspberry |
| 48 |
user |
wasd |
| 45 |
support |
support |