flux fleet digest — 2026-09-30 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
9093 |
196 |
3132 |
500 |
+190% |
| canary-farm-1 |
1933 |
170 |
4471 |
169 |
-57% |
| control-1 |
16554 |
113 |
4234 |
106 |
+291% |
| frantech-ts |
1380 |
87 |
10855 |
230 |
-87% |
| lauterbourg-01-ts |
1950 |
142 |
3255 |
136 |
-40% |
| netcup-ts |
1161 |
102 |
1911 |
97 |
-39% |
| ru-edge-1 |
15593 |
101 |
2507 |
799 |
+522% |
| sponge-01-ts |
1072 |
114 |
2109 |
95 |
-49% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
actuator-env |
33 |
8.3 |
4.0x |
| ai-devbox-1 |
app-config-php-database |
27 |
6.0 |
4.5x |
| ai-devbox-1 |
aws-credentials-file |
99 |
6.2 |
16.1x |
| ai-devbox-1 |
backup-archive |
460 |
9.0 |
51.1x |
| ai-devbox-1 |
config-json |
190 |
10.4 |
18.2x |
| ai-devbox-1 |
docker-config |
33 |
3.8 |
8.8x |
| ai-devbox-1 |
docker-registry-catalog |
22 |
6.3 |
3.5x |
| ai-devbox-1 |
env-production |
1364 |
199.1 |
6.8x |
| ai-devbox-1 |
fake-git |
592 |
47.9 |
12.4x |
| ai-devbox-1 |
fake-git-miss |
167 |
54.0 |
3.1x |
| ai-devbox-1 |
firebase-json |
69 |
12.5 |
5.5x |
| ai-devbox-1 |
htpasswd-error |
34 |
2.7 |
12.8x |
| ai-devbox-1 |
issued |
94 |
25.4 |
3.7x |
| ai-devbox-1 |
kubeconfig |
66 |
10.7 |
6.2x |
| ai-devbox-1 |
magento-env |
69 |
7.0 |
9.9x |
| ai-devbox-1 |
not-handled |
2244 |
545.3 |
4.1x |
| ai-devbox-1 |
npmrc-error |
21 |
2.2 |
9.3x |
| ai-devbox-1 |
openapi-spec-json-issued |
85 |
4.0 |
21.2x |
| ai-devbox-1 |
phpmyadmin-login |
63 |
17.7 |
3.6x |
| ai-devbox-1 |
pm2-ecosystem-config |
34 |
6.0 |
5.7x |
| ai-devbox-1 |
pprof-dump |
51 |
0.0 |
infx |
| ai-devbox-1 |
sftp-config-error |
104 |
14.1 |
7.4x |
| ai-devbox-1 |
sql-dump |
97 |
7.8 |
12.5x |
| ai-devbox-1 |
ssh-private-key |
162 |
54.0 |
3.0x |
| ai-devbox-1 |
trace-axd |
21 |
4.9 |
4.3x |
| ai-devbox-1 |
webapp-form-profile |
20 |
2.0 |
10.0x |
| ai-devbox-1 |
wp-config |
326 |
19.4 |
16.8x |
| canary-farm-1 |
fake-git |
435 |
115.3 |
3.8x |
| control-1 |
fake-git |
149 |
30.7 |
4.9x |
| control-1 |
not-handled |
15590 |
2475.9 |
6.3x |
| lauterbourg-01-ts |
llm-endpoint-ollama-chat |
20 |
0.0 |
infx |
| ru-edge-1 |
app-config-php |
26 |
7.0 |
3.7x |
| ru-edge-1 |
app-config-yaml |
21 |
5.0 |
4.2x |
| ru-edge-1 |
env-production |
243 |
73.8 |
3.3x |
| ru-edge-1 |
fake-git |
69 |
7.8 |
8.9x |
| ru-edge-1 |
not-handled |
13875 |
427.4 |
32.5x |
| ru-edge-1 |
ssh-private-key |
28 |
0.0 |
infx |
| ru-edge-1 |
wp-config |
28 |
5.8 |
4.9x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
84 |
590 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
9 |
437 |
ai-devbox-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ed66cc967251 ⟳ |
9 |
36 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 4b4cc0ece037 ⟳ |
7 |
49 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 1a64c5d5efd2 ⟳ |
6 |
131 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
09-23 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 321f17b2aca0 ⟳ |
4 |
32 |
ai-devbox-1,canary-farm-1,netcup-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b5dcb9cb5461 |
3 |
82 |
ai-devbox-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
09-30 |
/.env [issued] → /vendor/.env [env-production] → /storage/.env [env-production] → /public/.env [env-production] → /api/.env [env-production] → /admin/.env [env-production] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| control-1 |
/fvbig/sever1078.mips |
2026-09-30 03:16:02.138123-04:00 |
| control-1 |
/giggappck |
2026-09-30 03:16:02.138123-04:00 |
| control-1 |
/hiddenbin/reflect.m68k |
2026-09-30 03:16:02.138123-04:00 |
| control-1 |
/kushnet.sh4 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/tr064 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/tranphuonglinh.sh |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/tvCr |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/tvt/sh4 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/ub8ehJSePAfc9FYqZIT6.arm7 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/update.aarch64 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/update.i486 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/update.m68k |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/update/dlr.arm |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/update/svc.mpsl |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/usa.sh |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/uwu.armv6l |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/uwu.sh4 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/uxaarp/usagi1/main/ethd0 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/uxaarp/usagi1/main/devfreqd0 |
2026-09-30 03:16:02.138123-04:00 |
| ru-edge-1 |
/vc2 |
2026-09-30 03:16:02.138123-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-30 03:30:58.124139-04:00 |
| ru-edge-1 |
RouterOS/7.2.9 (Wavlink; A518-I0) |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
TP-LINK Archer C20 AC750 |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
Roku/DVP-4.1 (04.10E02202A) |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Phicomm K |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
FAST FAC1900R AC1900 |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
OpenWrt 22.03 (Linux) |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
ASUS Router Y989-H8 6.3.1 |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
TP-LINK Archer C50 AC1200 |
2026-09-30 03:16:02.308841-04:00 |
| ru-edge-1 |
Python-requests/2.31.0 |
2026-09-30 03:16:02.308841-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| ru-edge-1 |
98.98.47.133 |
13292 |
5 |
13292 |
09-29 10:02 |
09-29 10:04 |
- |
Zenlayer Inc |
MY |
0 |
| control-1 |
23.234.118.146 |
13292 |
5 |
13292 |
09-29 08:59 |
09-29 09:01 |
ipsum:1 |
tzulo, inc. |
US |
0 |
| ai-devbox-1 |
104.28.222.46 |
2688 |
64 |
254 |
09-29 19:00 |
09-29 20:29 |
- |
Cloudflare, Inc. |
SG |
0 |
| control-1 |
204.76.203.18 |
2185 |
2 |
581 |
09-29 03:32 |
09-30 06:13 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
94.154.46.245 |
1350 |
138 |
1342 |
09-29 15:04 |
09-29 15:04 |
- |
Omegatech LTD |
US |
0 |
| lauterbourg-01-ts |
185.19.40.202 |
1007 |
5 |
5 |
09-29 07:31 |
09-29 07:33 |
- |
1337 Services GmbH |
NL |
1000 |
| ai-devbox-1 |
104.28.254.46 |
992 |
60 |
241 |
09-29 18:24 |
09-29 20:27 |
- |
Cloudflare, Inc. |
SG |
0 |
| ai-devbox-1 |
102.220.161.102 |
846 |
39 |
557 |
09-29 08:21 |
09-29 09:28 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
104.28.254.47 |
835 |
58 |
226 |
09-29 19:00 |
09-29 20:27 |
- |
Cloudflare, Inc. |
SG |
0 |
| frantech-ts |
45.148.10.238 |
640 |
5 |
335 |
09-30 05:04 |
09-30 05:10 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
11 |
| netcup-ts |
185.73.23.162 |
461 |
2 |
2 |
09-29 07:28 |
09-29 09:38 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ai-devbox-1 |
104.28.254.16 |
403 |
21 |
61 |
09-29 22:28 |
09-29 22:30 |
- |
Cloudflare, Inc. |
FI |
0 |
| sponge-01-ts |
185.73.23.162 |
401 |
2 |
2 |
09-29 07:28 |
09-29 09:37 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| canary-farm-1 |
213.209.159.154 |
378 |
8 |
342 |
09-30 00:02 |
09-30 00:02 |
- |
Feo Prest SRL |
DE |
0 |
| control-1 |
102.220.161.102 |
344 |
29 |
333 |
09-29 08:05 |
09-29 22:14 |
- |
VPS Dedicated LLC |
SI |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
9 |
4 |
| canary-farm-1 |
46 |
10 |
| ai-devbox-1 |
94 |
29 |
| control-1 |
20 |
7 |
Mint failures (24h): control-1:400x1; ai-devbox-1:400x7
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
94 |
| canary-farm-1 |
["aws","ssh"] |
46 |
| control-1 |
["aws"] |
20 |
| ru-edge-1 |
["aws"] |
9 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 8059
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
https |
7491 |
| ai-devbox-1 |
http |
1602 |
| canary-farm-1 |
http |
1485 |
| canary-farm-1 |
https |
448 |
| control-1 |
http |
16554 |
| frantech-ts |
http |
1380 |
| lauterbourg-01-ts |
http |
1832 |
| lauterbourg-01-ts |
https |
118 |
| netcup-ts |
http |
1161 |
| ru-edge-1 |
http |
15593 |
| sponge-01-ts |
http |
1072 |
Top Host headers:
| sensor |
host |
events |
| control-1 |
38.54.2.209 |
16536 |
| ru-edge-1 |
130.94.89.46 |
15585 |
| ai-devbox-1 |
inference.fapthropic.com |
7586 |
| ai-devbox-1 |
217.15.163.226 |
1491 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
1246 |
| canary-farm-1 |
109.123.246.142 |
1174 |
| frantech-ts |
209.141.62.110 |
1131 |
| netcup-ts |
159.195.21.150 |
694 |
| sponge-01-ts |
89.167.72.144 |
656 |
| canary-farm-1 |
sso.rightabouteverything.show |
540 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (17 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
94.154.46.245 |
138 |
/yarn.lock [yarn-lock-error] → /wp-config.php [wp-config] → /package-lock.json [package-lock-json-error] → /.env.json [env-production] → /.circleci/config.yml [generic-ci-config] → /.git/index [fake-git] → /.env.staging [env-production] → /.env.bak [env-production] → /wp-config.php.bak [wp-config] → /.htpasswd [htpasswd-error] → /config.py [app-config-python] → /.gitlab-ci.yml [gitlab-ci] |
Omegatech LTD |
US |
| ai-devbox-1 |
104.28.222.46 |
64 |
/aZ9xQ7kL3m [not-handled] → /.env.development [env-production] → /.env.backup [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env [issued] → /.git/config [fake-git] → /wp-config.php.bak [wp-config] → /config.json [config-json] → /.aws/credentials [aws-credentials-file] → /wrangler.toml [not-handled] → /.dev.vars [not-handled] |
Cloudflare, Inc. |
SG |
| ai-devbox-1 |
104.28.254.46 |
60 |
/.git/info/refs [fake-git] → /.git/HEAD [fake-git] → /.git/objects/8d/f5712fe7d24a6ef721c09fbf0e58ba533f462e [fake-git] → /.git/objects/3e/2e9c1964e84abafb52d02b1d60c7f6d0528485 [fake-git] → /.git/objects/95/82b387e4d08b69a6d062bdc7bfa60674d97a21 [fake-git] → /.git/objects/40/d5715058787995c4913bfd54e20c0283d323f4 [fake-git] → /.git/objects/2b/683fb23f868413971ed69220171eedf682ac05 [fake-git] → /.git/objects/be/e64c733b51aa2b5de8d1ed628219df158075f6 [fake-git] → /aZ9xQ7kL3m [not-handled] → /.env.production [env-production] → /.env [issued] → /.git/config [fake-git] |
Cloudflare, Inc. |
SG |
| ai-devbox-1 |
104.28.254.47 |
58 |
/aZ9xQ7kL3m [not-handled] → /.env.staging [env-production] → /.env.old [env-production] → /.env.dev [env-production] → /.env [issued] → /.git/config [fake-git] → /.env.local [env-production] → /wp-config.php.bak [wp-config] → /.docker/config.json [docker-config] → /dump.sql [sql-dump] → /.vscode/sftp.json [sftp-config-error] → /wp-config.php [wp-config] |
Cloudflare, Inc. |
SG |
| ai-devbox-1 |
102.220.161.102 |
39 |
/.git/config [fake-git] → /aura-zvkz7wwiltd6dac5iq2aox7q.txt [not-handled] → /.env [issued] → /.env.sample [env-production] → /.env.live [env-production] → /.env~ [env-production] → /.env.example.local [env-production] → /.env.settings [tarpit-module] → /.env.bkp [tarpit-module] → /.env.tmp [env-production] → /.env.development.local [env-production] → /.env.production.local [env-production] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
102.220.161.102 |
38 |
/.git/config [fake-git] → /aura-thesgqiljsfpsmln51uhdzf2.txt [not-handled] → /sites/all/libraries/mailchimp/.env [tarpit-module] → /en/.env [env-production] → /.github/workflows/deploy.yml [github-actions-workflow] → /cgi-bin/.env [tarpit-module] → /.aws/cli/cache [not-handled] → /.git/logs/HEAD [fake-git] → /wp-config.php.1 [not-handled] → /docker-compose.aws.yml [not-handled] → /.github/workflows/ci.yml [github-actions-workflow] → /wp-content/.env [tarpit-module] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
185.169.252.170 |
34 |
/_rNd9xZ7kL3 [not-handled] → / [tarpit-module] → /robots.txt [robots-crawler] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /sitemap-index.xml [not-handled] → /.git/HEAD [fake-git] → /.aws/credentials [aws-credentials-file] → /secrets.json [config-json] → /wp-config.php [wp-config] → /.env.production [env-production] → /.env [issued] |
Contabo GmbH |
FR |
| control-1 |
102.220.161.102 |
29 |
/.git/config [fake-git] → /aura-531wcby956p7vtmjt7nk2txx.txt [not-handled] → /.env [issued] → /.env.copy [env-production] → /.env.private [env-production] → /.envrc [tarpit-module] → /.env.json [env-production] → /.env.sample [env-production] → /.env.example [env-production] → /.env.production.local [env-production] → /.env.config [tarpit-module] → /.env.live [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
139.59.231.238 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
146.190.103.103 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
64.227.32.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 630 sources sent credentials → 509 got a shell (81%) → 327 ran a command (64% of shell-getters, 52% of sources)
- event level: 12121 credential attempts → 5719 accepted logins → 8591 commands (150% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1957 attempts
New commands this window (0 of 68 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1555 |
3 |
109.160.32.150 |
"uname -s -v -n -r -m" |
| 1555 |
3 |
109.160.32.150 |
"uname -m | awk '{printf $1}'" |
| 1508 |
288 |
101.47.156.170 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1274 |
264 |
101.47.156.170 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 295 |
6 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 295 |
6 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 277 |
36 |
183.36.126.68 |
"uname -a" |
| 179 |
3 |
2.57.122.53 |
"/bin/./uname -s -v -n -r -m" |
Credentials: 3989 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1442 |
345gs5662d34 |
345gs5662d34 |
| 1119 |
root |
3245gs5662d34 |
| 63 |
user |
wasd |
| 60 |
root |
123456 |
| 59 |
pi |
raspberry |
| 53 |
admin |
admin |
| 51 |
admin |
3245gs5662d34 |
| 47 |
ubuntu |
3245gs5662d34 |