flux fleet digest — 2026-10-02 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1193 |
152 |
3212 |
123 |
-63% |
| canary-farm-1 |
15946 |
148 |
4400 |
149 |
+262% |
| control-1 |
2751 |
115 |
6041 |
104 |
-54% |
| frantech-ts |
2496 |
100 |
10584 |
85 |
-76% |
| lauterbourg-01-ts |
1018 |
138 |
2715 |
136 |
-63% |
| netcup-ts |
741 |
93 |
1291 |
100 |
-43% |
| ru-edge-1 |
2529 |
112 |
2803 |
100 |
-10% |
| sponge-01-ts |
1240 |
116 |
1579 |
97 |
-21% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-login-probe |
30 |
8.8 |
3.4x |
| canary-farm-1 |
fake-git |
2333 |
174.3 |
13.4x |
| canary-farm-1 |
fake-git-miss |
11281 |
3.0 |
3760.3x |
| canary-farm-1 |
fake-git-redirect |
760 |
3.2 |
237.5x |
| control-1 |
fake-git |
138 |
44.1 |
3.1x |
| control-1 |
issued |
74 |
18.3 |
4.0x |
| frantech-ts |
tarpit-module |
1263 |
389.0 |
3.2x |
| ru-edge-1 |
app-config-php |
40 |
11.7 |
3.4x |
| ru-edge-1 |
app-config-python |
52 |
14.0 |
3.7x |
| ru-edge-1 |
app-config-yaml |
30 |
9.3 |
3.2x |
| ru-edge-1 |
application-properties |
20 |
5.5 |
3.6x |
| ru-edge-1 |
rails-database-yml |
22 |
6.0 |
3.7x |
| ru-edge-1 |
wp-config |
42 |
8.8 |
4.8x |
| ru-edge-1 |
wp-login-probe |
118 |
28.8 |
4.1x |
| sponge-01-ts |
phpmyadmin-login |
57 |
1.0 |
57.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
137 |
959 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ed66cc967251 ⟳ |
12 |
48 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| df15d0ee3ccf ⟳ |
7 |
740 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 5c4b5dc2fb71 ⟳ |
7 |
49 |
ai-devbox-1,canary-farm-1,frantech-ts,lauterbourg-01-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
| ef1ab74f3d57 ⟳ |
5 |
245 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 7e61a9500d8b ⟳ |
5 |
245 |
control-1,netcup-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 1cf777711bea ⟳ |
5 |
40 |
control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| a2176d32b35f |
4 |
52 |
ai-devbox-1,canary-farm-1,frantech-ts,sponge-01-ts ⚠FLEET-WIDE |
10-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /auth.html [sonicwall-portal] → /auth1.html [not-handled] → /sslvpnLogin.html [not-handled] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/config/smtp.php |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/REVERT_HEAD |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/info/grafts |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/heads/trunk |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/heads/ci |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/refs/Index |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/HEAD/0000000000000000000000000000000000000000 |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/stash/retry |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/of |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/Index |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/ |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/.git/logs/refs/ |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/app/.git/HEAD |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/info/refs |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/hooks/post-commit |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/hooks/commit-msg |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/objects/pack/ |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/objects/28/ |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/objects/e5/ |
2026-10-02 03:15:43.138557-04:00 |
| canary-farm-1 |
/backend/.git/objects/10/ |
2026-10-02 03:15:43.138557-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-02 03:31:18.595732-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 |
2026-10-02 03:15:45.726933-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/ |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 |
2026-10-02 03:15:45.726933-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3. |
2026-10-02 03:15:45.726933-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
169.40.142.2 |
14787 |
44 |
10150 |
10-01 12:46 |
10-01 12:56 |
- |
Zkillu SAS |
FR |
0 |
| ru-edge-1 |
94.154.46.250 |
1765 |
129 |
1007 |
10-02 02:03 |
10-02 05:48 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
188.166.248.40 |
1710 |
8 |
515 |
10-01 16:02 |
10-01 16:05 |
- |
DigitalOcean, LLC |
SG |
17 |
| control-1 |
204.76.203.18 |
1550 |
2 |
565 |
10-01 04:06 |
10-01 22:25 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
213.209.159.154 |
378 |
8 |
342 |
10-01 06:57 |
10-01 06:58 |
- |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
94.154.46.248 |
300 |
6 |
150 |
10-01 04:16 |
10-01 04:16 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
213.209.159.175 |
242 |
14 |
193 |
10-01 10:00 |
10-01 21:33 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
80.94.95.211 |
200 |
9 |
167 |
10-01 15:23 |
10-01 15:24 |
- |
SS-Net |
RO |
0 |
| canary-farm-1 |
185.177.72.9 |
188 |
19 |
76 |
10-01 18:30 |
10-01 18:35 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| frantech-ts |
185.177.72.29 |
188 |
8 |
76 |
10-01 23:49 |
10-01 23:54 |
- |
Bucklog SARL |
FR |
0 |
| sponge-01-ts |
213.209.159.154 |
170 |
3 |
137 |
10-01 14:00 |
10-01 14:00 |
- |
Feo Prest SRL |
DE |
0 |
| sponge-01-ts |
94.154.46.242 |
150 |
5 |
150 |
10-01 08:20 |
10-01 08:20 |
- |
Omegatech LTD |
US |
0 |
| lauterbourg-01-ts |
94.154.46.250 |
150 |
6 |
150 |
10-01 13:32 |
10-01 13:32 |
- |
Omegatech LTD |
US |
0 |
| canary-farm-1 |
102.220.161.102 |
144 |
2 |
142 |
10-01 18:49 |
10-01 18:49 |
- |
VPS Dedicated LLC |
SI |
0 |
| sponge-01-ts |
47.104.246.244 |
134 |
2 |
1 |
10-01 04:02 |
10-02 06:12 |
- |
Hangzhou Alibaba Advertising |
CN |
67 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
47 |
13 |
| control-1 |
74 |
5 |
| canary-farm-1 |
18 |
13 |
| ru-edge-1 |
14 |
4 |
| frantech-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
2 |
| ai-devbox-1 |
["aws"] |
47 |
| canary-farm-1 |
["aws","ssh"] |
16 |
| control-1 |
["aws"] |
74 |
| ru-edge-1 |
["aws"] |
14 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 15580
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 377
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
887 |
| ai-devbox-1 |
https |
306 |
| canary-farm-1 |
https |
14852 |
| canary-farm-1 |
http |
1094 |
| control-1 |
http |
2751 |
| frantech-ts |
http |
2496 |
| lauterbourg-01-ts |
http |
973 |
| lauterbourg-01-ts |
https |
45 |
| netcup-ts |
http |
741 |
| ru-edge-1 |
http |
2529 |
| sponge-01-ts |
http |
1240 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
sso.rightabouteverything.show |
14991 |
| control-1 |
38.54.2.209 |
2734 |
| ru-edge-1 |
130.94.89.46 |
2522 |
| frantech-ts |
209.141.62.110 |
2280 |
| sponge-01-ts |
89.167.72.144 |
1220 |
| canary-farm-1 |
109.123.246.142 |
943 |
| lauterbourg-01-ts |
89.116.25.211 |
908 |
| ai-devbox-1 |
217.15.163.226 |
729 |
| netcup-ts |
159.195.21.150 |
726 |
| ai-devbox-1 |
inference.fapthropic.com |
349 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (19 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
94.154.46.250 |
129 |
/wp-config.bak [wp-config] → /.git/HEAD [fake-git] → /.aws/credentials [aws-credentials-file] → /yarn.lock [yarn-lock-error] → /docker-compose.yml [docker-compose] → /.circleci/config.yml [generic-ci-config] → /wp-config.php.old [wp-config] → /composer.json [composer-json-error] → /package-lock.json [package-lock-json-error] → /wp-config.old [wp-config] → /.gitlab-ci.yml [gitlab-ci] → /.ssh/id_dsa [ssh-private-key] |
Omegatech LTD |
US |
| canary-farm-1 |
169.40.142.2 |
44 |
/ [tarpit-module] → / [tarpit] → /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → /sitemap.xml [tarpit-module] → /sitemap.xml [tarpit-disconnect] → /sitemap.xml [tarpit] → /config/app.php [app-config-php-services] → /.env.remote [env-production] → /.circleci/config.yml [generic-ci-config] → /html/.env [env-production] |
Zkillu SAS |
FR |
| canary-farm-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
143.110.217.244 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
64.226.65.160 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| ru-edge-1 |
64.52.111.248 |
24 |
/ [tarpit-module] → /openapi.json [openapi-spec-json-issued] → /_api/version [not-handled] → /portal/webclient/index.html [not-handled] → /api/v1/version [not-handled] → /CFIDE/administrator/ [coldfusion-admin-login] → /hub/signup [not-handled] → /php/login.php [not-handled] → /dashboard/ [webapp-form-profile] → /robots.txt [tarpit-module] → /.backstage/health/v1/readiness [not-handled] → /mgmt/tm/sys/version [not-handled] |
Amazon.com, Inc. |
US |
| ai-devbox-1 |
164.92.107.174 |
23 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] → /v2/internal/auth-service/manifests/latest [docker-registry-manifest] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
45.138.12.51 |
20 |
/ [tarpit-module] → /config.json [config-json] → /build/.env [env-production] → /cms/.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.vscode/sftp.json [sftp-config-error] → /.vscode/settings.json [config-json] → /docker-compose.prod.yml [docker-compose] → /.env_sample [tarpit-module] → /.git/config [fake-git] → /config/.git/config [fake-git] → /_profiler/phpinfo [symfony-profiler-phpinfo] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
185.177.72.9 |
19 |
/info.php.bak [phpinfo-source] → /php-info.php [phpinfo] → /newinfo.php [webshell-sweep-observed] → /siteinfo.php [webshell-sweep-observed] → /info.php.1 [not-handled] → /admin/phpinfo.php [phpinfo] → /pageinfo.php [webshell-probe] → /info.php.back [not-handled] → /phpbb/phpinfo.php [phpinfo] → /release_info.php [webshell-probe] → /test/info.php [phpinfo] → /info [docker-daemon-info] |
Bucklog SARL |
FR |
| lauterbourg-01-ts |
206.189.19.19 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| lauterbourg-01-ts |
167.71.175.236 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
213.209.159.175 |
14 |
/ [tarpit-module] → /6lstiygau4aaqd [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 606 sources sent credentials → 461 got a shell (76%) → 299 ran a command (65% of shell-getters, 49% of sources)
- event level: 36872 credential attempts → 5137 accepted logins → 9985 commands (194% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 611 attempts
New commands this window (0 of 66 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1316 |
6 |
109.160.32.104 |
"uname -m | awk '{printf $1}'" |
| 1316 |
6 |
109.160.32.104 |
"uname -s -v -n -r -m" |
| 1162 |
240 |
119.209.12.20 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1005 |
220 |
119.209.12.20 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 523 |
3 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 523 |
3 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 523 |
3 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 523 |
3 |
195.178.110.218 |
"uptime -p" |
Credentials: 27243 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1110 |
345gs5662d34 |
345gs5662d34 |
| 801 |
root |
3245gs5662d34 |
| 79 |
root |
123456 |
| 61 |
admin |
admin |
| 57 |
user |
wasd |
| 55 |
pi |
raspberry |
| 52 |
admin |
3245gs5662d34 |
| 49 |
ubuntu |
3245gs5662d34 |