flux fleet digest — 2026-10-03 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
320 |
12 |
3015 |
127 |
-89% |
| canary-farm-1 |
1746 |
162 |
5718 |
147 |
-69% |
| control-1 |
2899 |
128 |
5504 |
108 |
-47% |
| frantech-ts |
14651 |
92 |
8894 |
84 |
+65% |
| lauterbourg-01-ts |
1262 |
162 |
2473 |
136 |
-49% |
| netcup-ts |
2048 |
107 |
975 |
100 |
+110% |
| ru-edge-1 |
1465 |
123 |
2994 |
99 |
-51% |
| sponge-01-ts |
532 |
103 |
1188 |
100 |
-55% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-login-credentials |
134 |
12.0 |
11.2x |
| lauterbourg-01-ts |
phpunit-eval-stdin |
148 |
30.7 |
4.8x |
| netcup-ts |
wp-user-enum-rest-single |
144 |
0.0 |
infx |
| ru-edge-1 |
wp-user-enum-rest-single |
20 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
107 |
755 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 850993125b15 ⟳ |
13 |
574 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ |
7 |
343 |
canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 8340706ababf ⟳ |
6 |
144 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-24 |
/version [docker-daemon-version] → / [tarpit-module] → /v1 [not-handled] → / [tarpit-module] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit] → … |
| 1cf777711bea ⟳ |
6 |
48 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 5c4b5dc2fb71 ⟳ |
5 |
35 |
canary-farm-1,control-1,lauterbourg-01-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
5 |
35 |
ai-devbox-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| abf92a331d66 ⟳ |
5 |
195 |
lauterbourg-01-ts |
10-01 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| netcup-ts |
/config/database.json |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/cart/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/configuration.php.bak |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/.env.release |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�backup/�.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/pro/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/search/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/_debug/default |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/1.php |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�.env.dev |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/assets/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/netlify.toml |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/tmp/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/videos/.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/php/phpinfo.php |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�content/�.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�functions/�.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�credentials.csv |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�sms/�.env |
2026-10-03 03:15:48.969050-04:00 |
| netcup-ts |
/�app/�config.php |
2026-10-03 03:15:48.969050-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Wget |
2026-10-03 03:31:04.654428-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 9; LEX829) AppleWebKit/537.36 (K |
2026-10-03 03:15:49.308595-04:00 |
| netcup-ts |
CGrab/v8.24.1-dev-throughput |
2026-10-03 03:15:49.308595-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/ |
2026-10-03 03:15:49.308595-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/ |
2026-10-03 03:15:49.308595-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (compatible; nmap-http-info) |
2026-10-03 03:15:49.308595-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/5 |
2026-10-03 03:15:49.308595-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox |
2026-10-03 03:15:49.308595-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605 |
2026-10-03 03:15:49.308595-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0_0) AppleWebKit/6 |
2026-10-03 03:15:49.308595-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
98.98.47.133 |
13327 |
5 |
13324 |
10-03 01:20 |
10-03 01:22 |
- |
Zenlayer Inc |
MY |
0 |
| control-1 |
185.177.72.75 |
1022 |
35 |
410 |
10-03 06:01 |
10-03 06:06 |
- |
Bucklog SARL |
FR |
5 |
| netcup-ts |
185.177.72.75 |
956 |
8 |
407 |
10-02 16:32 |
10-02 16:37 |
- |
Bucklog SARL |
FR |
6 |
| control-1 |
204.76.203.18 |
872 |
2 |
565 |
10-02 20:18 |
10-03 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
94.154.46.250 |
750 |
118 |
743 |
10-02 05:48 |
10-02 05:48 |
- |
Omegatech LTD |
US |
0 |
| netcup-ts |
51.210.247.58 |
547 |
9 |
78 |
10-02 17:50 |
10-02 17:50 |
- |
OVH SAS |
FR |
1 |
| frantech-ts |
94.154.46.248 |
300 |
5 |
150 |
10-02 10:50 |
10-02 10:50 |
- |
Omegatech LTD |
US |
0 |
| frantech-ts |
94.154.46.243 |
300 |
5 |
150 |
10-02 13:17 |
10-02 13:17 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
213.209.159.175 |
241 |
14 |
193 |
10-02 06:51 |
10-02 18:52 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
87.182.231.18 |
160 |
1 |
30 |
10-02 15:42 |
10-02 15:43 |
- |
Deutsche Telekom AG |
DE |
0 |
| lauterbourg-01-ts |
35.220.183.213 |
157 |
3 |
71 |
10-02 23:48 |
10-02 23:48 |
- |
Google LLC |
HK |
0 |
| canary-farm-1 |
104.207.39.149 |
144 |
2 |
142 |
10-03 04:23 |
10-03 04:23 |
- |
3xK Tech GmbH |
US |
0 |
| canary-farm-1 |
65.111.3.141 |
144 |
2 |
142 |
10-03 05:26 |
10-03 05:26 |
- |
3xK Tech GmbH |
US |
0 |
| ru-edge-1 |
217.60.198.3 |
141 |
8 |
39 |
10-03 05:03 |
10-03 05:49 |
- |
12651980 CANADA INC. |
AE |
4 |
| ai-devbox-1 |
39.105.208.239 |
131 |
1 |
1 |
10-03 05:06 |
10-03 05:14 |
- |
Hangzhou Alibaba Advertising |
CN |
131 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
4 |
4 |
| control-1 |
48 |
13 |
| canary-farm-1 |
24 |
19 |
| ru-edge-1 |
9 |
5 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
4 |
| ru-edge-1 |
["aws"] |
9 |
| canary-farm-1 |
["aws"] |
24 |
| control-1 |
["aws"] |
48 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 811
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 7
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
194 |
| ai-devbox-1 |
https |
126 |
| canary-farm-1 |
http |
1247 |
| canary-farm-1 |
https |
499 |
| control-1 |
http |
2899 |
| frantech-ts |
http |
14651 |
| lauterbourg-01-ts |
http |
1083 |
| lauterbourg-01-ts |
https |
179 |
| netcup-ts |
http |
2048 |
| ru-edge-1 |
http |
1465 |
| sponge-01-ts |
http |
532 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14504 |
| control-1 |
38.54.2.209 |
2869 |
| netcup-ts |
159.195.21.150 |
2034 |
| ru-edge-1 |
130.94.89.46 |
1453 |
| canary-farm-1 |
109.123.246.142 |
918 |
| lauterbourg-01-ts |
89.116.25.211 |
879 |
| canary-farm-1 |
sso.rightabouteverything.show |
812 |
| sponge-01-ts |
89.167.72.144 |
514 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
366 |
| ai-devbox-1 |
inference.fapthropic.com |
166 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (20 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
94.154.46.250 |
118 |
/.git/index [fake-git] → /docker-compose.yml [docker-compose] → /.aws/config [aws-config-file] → /docker-compose.yaml [docker-compose] → /.htaccess [not-handled] → /config.py [app-config-python] → /.env [issued] → /yarn.lock [yarn-lock-error] → /local_settings.py [app-config-python] → /Jenkinsfile [jenkinsfile] → /.ssh/id_dsa [ssh-private-key] → /docker-compose.override.yml [docker-compose] |
Omegatech LTD |
US |
| control-1 |
185.177.72.75 |
35 |
/.env.copy [env-production] → /config/database.yml [rails-database-yml] → /.env.1 [tarpit-module] → /billing/.env [tarpit-module] → /components/.env [tarpit-module] → /cpanel/.env [tarpit-module] → /wp-config.php [wp-config] → /bank/.env [tarpit-module] → /client/.env [env-production] → /1board/.env [tarpit-module] → /legacy/.env [tarpit-module] → /orders/.env [tarpit-module] |
Bucklog SARL |
FR |
| canary-farm-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.189.233.36 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
142.93.0.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 564 sources sent credentials → 439 got a shell (78%) → 279 ran a command (64% of shell-getters, 49% of sources)
- event level: 38999 credential attempts → 3657 accepted logins → 5515 commands (151% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 736 attempts
New commands this window (0 of 48 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1140 |
225 |
129.121.78.234 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 976 |
211 |
129.121.78.234 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 370 |
8 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 370 |
8 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 250 |
2 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 250 |
2 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 250 |
2 |
195.178.110.218 |
"uptime -p" |
| 249 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
Credentials: 29925 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1092 |
345gs5662d34 |
345gs5662d34 |
| 828 |
root |
3245gs5662d34 |
| 70 |
root |
123456 |
| 63 |
pi |
raspberry |
| 56 |
admin |
admin |
| 55 |
user |
wasd |
| 46 |
admin |
3245gs5662d34 |
| 45 |
ubuntu |
3245gs5662d34 |