flux fleet digest — 2026-10-01 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2012 |
117 |
3135 |
126 |
-36% |
| canary-farm-1 |
4713 |
166 |
4011 |
152 |
+18% |
| control-1 |
3962 |
117 |
6085 |
105 |
-35% |
| frantech-ts |
28448 |
88 |
8524 |
88 |
+234% |
| lauterbourg-01-ts |
1321 |
129 |
2994 |
137 |
-56% |
| netcup-ts |
1300 |
117 |
1800 |
97 |
-28% |
| ru-edge-1 |
1120 |
94 |
2998 |
102 |
-63% |
| sponge-01-ts |
1083 |
108 |
2036 |
98 |
-47% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
graphql-introspection |
36 |
12.0 |
3.0x |
| ai-devbox-1 |
yii2-debug-view |
22 |
6.7 |
3.3x |
| canary-farm-1 |
docker-registry-manifest |
90 |
30.0 |
3.0x |
| canary-farm-1 |
docker-registry-tags |
90 |
30.0 |
3.0x |
| canary-farm-1 |
method-not-allowed |
23 |
7.4 |
3.1x |
| canary-farm-1 |
phpinfo |
74 |
24.6 |
3.0x |
| canary-farm-1 |
ssh-private-key |
56 |
0.0 |
infx |
| canary-farm-1 |
wp-login-credentials |
162 |
13.8 |
11.8x |
| canary-farm-1 |
wp-login-probe |
168 |
21.2 |
7.9x |
| canary-farm-1 |
yii2-debug-view |
21 |
7.0 |
3.0x |
| control-1 |
phpinfo |
80 |
17.0 |
4.7x |
| control-1 |
webshell-probe |
82 |
23.1 |
3.5x |
| frantech-ts |
not-handled |
27630 |
7964.0 |
3.5x |
| frantech-ts |
webshell-probe |
50 |
15.2 |
3.3x |
| lauterbourg-01-ts |
docker-registry-manifest |
50 |
12.0 |
4.2x |
| lauterbourg-01-ts |
docker-registry-tags |
50 |
12.0 |
4.2x |
| lauterbourg-01-ts |
graphql-introspection |
20 |
4.8 |
4.2x |
| lauterbourg-01-ts |
whm-login |
20 |
4.8 |
4.2x |
| netcup-ts |
wp-login-credentials |
139 |
13.3 |
10.4x |
| netcup-ts |
wp-login-probe |
140 |
1.5 |
93.3x |
| ru-edge-1 |
phpinfo |
56 |
4.5 |
12.4x |
| ru-edge-1 |
wp-login-credentials |
109 |
0.0 |
infx |
| ru-edge-1 |
wp-login-probe |
110 |
1.7 |
66.0x |
| sponge-01-ts |
wp-login-credentials |
216 |
20.5 |
10.5x |
| sponge-01-ts |
wp-login-probe |
217 |
3.0 |
72.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
84 |
590 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
25 |
173 |
ai-devbox-1,control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ |
13 |
574 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| ed66cc967251 ⟳ |
11 |
44 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| b07c7bb207b4 ⟳ |
11 |
492 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| df15d0ee3ccf |
10 |
1152 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| abf92a331d66 |
10 |
390 |
lauterbourg-01-ts |
10-01 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ |
8 |
392 |
control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/c/bpQZfan2Q9VlxEAY255KqBCfTllzqZ7yFhCtGrp2K_y9PiVv9DTOZTJ2ZpHZp5biKZYw4qwSYF1_w5l4uJX4OFxkQ4z-IZ3_G_o |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/c/nJ57RY8Yg-9Oq0cjkF-S0jy4HL-VCl09rkuaMmXY8prJuAt1raVdPFl9qbPyoJKrXNi9yXnCrDv0GAisJMvitY6JqVULL4OKgEo |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/c/lp5woxYrubD_1cTvLSWkAcfx466ViXFchA1LLnSpBmqmCub4WwNKdQ08au8sXIK8x3CoRyPZjcShrrlGLLwGKJxm0oibCNf4PCA |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/c/le8fjWiUJTHowtDnoM3ft_Xrtm4zYoe1hftbxBLNJWOcyeE51vZ6Fk_JQ8gTOKvn3c8NaloSi1KY4ssvDklI2hP_7MVeOSfegEw |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/_crm/.env |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/_dashboard/.env |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/config./.env |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/dashboard./.env |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/phpinfo./.env |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/apis/.git/config |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/content/.git/config |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/home/.git/config |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/lms/.git/config |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/node-api/.git/config |
2026-10-01 03:16:16.885007-04:00 |
| netcup-ts |
/cron/.env |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/bins/aurora.mpsl |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/bins/auroraint.m68k |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/bins/auroraint.x86 |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/release/DS.arm7 |
2026-10-01 03:16:16.885007-04:00 |
| frantech-ts |
/release/enc |
2026-10-01 03:16:16.885007-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 26_0_1 like Mac OS X) App |
2026-10-01 03:16:16.946076-04:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/ |
2026-10-01 03:16:16.946076-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Fir |
2026-10-01 03:16:16.946076-04:00 |
| sponge-01-ts |
Mozilla/5.0 (compatible; KGBMasscann/1.0) |
2026-10-01 03:16:16.946076-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 9; POT-LX2J) AppleWebKit/537.36 |
2026-10-01 03:16:16.946076-04:00 |
| control-1 |
Mozilla/5.0 (Linux; U; Android 8.1.0; zh-CN; Mi Note 3 Build |
2026-10-01 03:16:16.946076-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-01 03:16:16.946076-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-10-01 03:16:16.946076-04:00 |
| control-1 |
Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2 |
2026-10-01 03:16:16.946076-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-01 03:16:16.946076-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.118.146 |
13297 |
5 |
13297 |
09-30 18:35 |
09-30 18:36 |
ipsum:1 |
tzulo, inc. |
US |
0 |
| frantech-ts |
193.32.126.131 |
13297 |
5 |
13297 |
10-01 00:56 |
10-01 00:58 |
- |
31173 Services AB |
FR |
0 |
| control-1 |
204.76.203.18 |
2107 |
2 |
574 |
09-30 03:33 |
10-01 06:05 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
94.154.46.249 |
2100 |
132 |
1042 |
10-01 01:07 |
10-01 01:07 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
45.148.10.238 |
640 |
5 |
335 |
09-30 05:04 |
09-30 05:10 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
11 |
| canary-farm-1 |
102.220.161.87 |
515 |
34 |
511 |
09-30 16:51 |
09-30 23:25 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
102.220.161.87 |
514 |
34 |
511 |
09-30 20:25 |
09-30 21:14 |
- |
VPS Dedicated LLC |
SI |
0 |
| ru-edge-1 |
102.220.161.87 |
514 |
34 |
511 |
09-30 16:51 |
09-30 19:54 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.161.87 |
514 |
34 |
511 |
09-30 16:53 |
09-30 20:23 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
45.148.10.238 |
499 |
30 |
299 |
09-30 09:56 |
09-30 10:00 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
1 |
| netcup-ts |
213.209.159.154 |
378 |
4 |
342 |
10-01 00:18 |
10-01 00:18 |
- |
Feo Prest SRL |
DE |
0 |
| frantech-ts |
94.154.46.242 |
300 |
5 |
150 |
09-30 23:07 |
09-30 23:07 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
94.154.46.248 |
300 |
5 |
150 |
10-01 01:35 |
10-01 01:35 |
- |
Omegatech LTD |
US |
0 |
| lauterbourg-01-ts |
94.154.46.248 |
300 |
6 |
150 |
10-01 04:16 |
10-01 04:16 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
185.177.72.49 |
197 |
19 |
77 |
09-30 13:49 |
09-30 13:55 |
ipsum:5 firehol2 |
Bucklog SARL |
FR |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
25 |
22 |
| canary-farm-1 |
36 |
24 |
| ru-edge-1 |
3 |
3 |
| control-1 |
6 |
5 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x5; ru-edge-1:?x1
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
25 |
| canary-farm-1 |
["ssh"] |
5 |
| canary-farm-1 |
["aws"] |
10 |
| control-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws","ssh"] |
21 |
| ru-edge-1 |
["aws"] |
3 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1528
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 198
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1453 |
| ai-devbox-1 |
https |
559 |
| canary-farm-1 |
http |
4149 |
| canary-farm-1 |
https |
564 |
| control-1 |
http |
3962 |
| frantech-ts |
http |
28448 |
| lauterbourg-01-ts |
http |
1114 |
| lauterbourg-01-ts |
https |
207 |
| netcup-ts |
http |
1300 |
| ru-edge-1 |
http |
1120 |
| sponge-01-ts |
http |
1083 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
28240 |
| control-1 |
38.54.2.209 |
3946 |
| canary-farm-1 |
109.123.246.142 |
3765 |
| netcup-ts |
159.195.21.150 |
1288 |
| ru-edge-1 |
130.94.89.46 |
1115 |
| ai-devbox-1 |
217.15.163.226 |
1076 |
| sponge-01-ts |
89.167.72.144 |
1071 |
| canary-farm-1 |
sso.rightabouteverything.show |
935 |
| ai-devbox-1 |
inference.fapthropic.com |
927 |
| lauterbourg-01-ts |
89.116.25.211 |
886 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (18 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
94.154.46.249 |
132 |
/.git/config [fake-git] → /.git/HEAD [fake-git] → /config.php [app-config-php] → /wp-config.php.bak [wp-config] → /config/app.php [app-config-php-services] → /wp-config.old [wp-config] → /config/database.php [app-config-php-database] → /.aws/config [aws-config-file] → /config/settings.py [app-config-python] → /wp-config.php.old [wp-config] → /.yarnrc [yarnrc-error] → /settings.php [app-config-php] |
Omegatech LTD |
US |
| canary-farm-1 |
102.220.161.87 |
34 |
/ [tarpit-module] → /pscan-b8e52cce-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.87 |
34 |
/ [tarpit-module] → /pscan-ee4af8be-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| control-1 |
102.220.161.87 |
34 |
/ [tarpit-module] → /pscan-fdf32cb2-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
102.220.161.87 |
34 |
/ [tarpit-module] → /pscan-1f520f7b-nonexistent.txt [not-handled] → /.env [tracebit-error] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| control-1 |
45.148.10.238 |
30 |
/config/aws.yml [not-handled] → /config/plugins.js [not-handled] → /api1/.env [tarpit-module] → /env [actuator-env] → / [tarpit-module] → /in.php [webshell-sweep-observed] → /configs.json.bak [not-handled] → /inf.php [webshell-sweep-observed] → /config/.env [env-production] → /api/aws/index.js [webapp-config-bundle-js] → /app/config/.env [tarpit-module] → /.gitlab-ci/.env [tarpit-module] |
Techoff Srv Limited |
NL |
| canary-farm-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
139.59.143.102 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.227.32.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
147.182.200.94 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
165.227.173.41 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
159.65.144.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| ai-devbox-1 |
128.199.182.152 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
138.68.82.23 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 622 sources sent credentials → 475 got a shell (76%) → 300 ran a command (63% of shell-getters, 48% of sources)
- event level: 11695 credential attempts → 5020 accepted logins → 6866 commands (137% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 815 attempts
New commands this window (0 of 85 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1332 |
247 |
121.227.152.171 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1315 |
8 |
109.160.32.35 |
"uname -s -v -n -r -m" |
| 1314 |
8 |
109.160.32.35 |
"uname -m | awk '{printf $1}'" |
| 1166 |
229 |
121.227.152.171 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 336 |
7 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 336 |
7 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 259 |
35 |
114.202.2.168 |
"uname -a" |
| 113 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 5544 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1279 |
345gs5662d34 |
345gs5662d34 |
| 961 |
root |
3245gs5662d34 |
| 62 |
root |
123456 |
| 55 |
admin |
admin |
| 54 |
pi |
raspberry |
| 53 |
admin |
3245gs5662d34 |
| 52 |
user |
wasd |
| 47 |
ubuntu |
3245gs5662d34 |