flux fleet digest — 2026-10-04 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1594 |
173 |
2794 |
114 |
-43% |
| canary-farm-1 |
1941 |
179 |
5000 |
151 |
-61% |
| control-1 |
4542 |
157 |
5117 |
110 |
-11% |
| frantech-ts |
14091 |
86 |
10813 |
84 |
+30% |
| lauterbourg-01-ts |
930 |
140 |
2314 |
142 |
-60% |
| netcup-ts |
960 |
92 |
1112 |
102 |
-14% |
| ru-edge-1 |
1386 |
133 |
3123 |
104 |
-56% |
| sponge-01-ts |
1694 |
131 |
1103 |
104 |
+54% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-login-credentials |
178 |
42.5 |
4.2x |
| ai-devbox-1 |
wp-login-probe |
71 |
12.6 |
5.6x |
| ai-devbox-1 |
wp-xmlrpc-post |
25 |
6.2 |
4.0x |
| canary-farm-1 |
wp-user-enum-rest-list |
89 |
8.0 |
11.1x |
| canary-farm-1 |
wp-user-enum-rest-single |
95 |
0.0 |
infx |
| control-1 |
webapp-config-bundle-js |
33 |
6.5 |
5.1x |
| frantech-ts |
wp-batch-multiplex |
26 |
1.0 |
26.0x |
| netcup-ts |
wp-user-enum-rest-list |
59 |
2.7 |
22.1x |
| ru-edge-1 |
wp-user-enum-rest-list |
105 |
2.7 |
39.4x |
| ru-edge-1 |
wp-user-enum-rest-single |
100 |
20.0 |
5.0x |
| sponge-01-ts |
wp-user-enum-rest-list |
110 |
1.0 |
110.0x |
| sponge-01-ts |
wp-user-enum-rest-single |
170 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
99 |
672 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ed66cc967251 ⟳ |
20 |
80 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 7e61a9500d8b ⟳ |
15 |
737 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ |
10 |
64 |
canary-farm-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ |
9 |
369 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| abf92a331d66 ⟳ |
8 |
312 |
lauterbourg-01-ts |
10-01 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5e0185746583 |
6 |
96 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-04 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| b07c7bb207b4 ⟳ |
5 |
246 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| sponge-01-ts |
/wp-json/wp/v2/users/7 |
2026-10-04 03:15:50.829836-04:00 |
| ru-edge-1 |
/.git/appsettings.json |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/pWU2Bg2XJy79s4_WnEtwL2vmIru7SgRkGca1UklNxVeL3CGspmZWYnU4lsYFTyiHOE_71px3rgNOO7ANytnK-vBAp2VgIBa8Q9Y |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/DZnzfUF9NguV627uhXO13qjUW1WwclG1aof_FycFqf86nl-9g1ZvRZ1vvMLiT3YYEeOAsctGGundV2f1SUIGoVO-5aXNwXjDN_A |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/.well-known/pki-validation/update |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/dnjORuaeaC8C1gpAIxlUaiNbpyHwCmidewRONm5acXRbXCpvKSkGXu4BsnwknIBj3KbN491Az5WjPU0zotukdVtXeiDKlP5OAGs |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/nG3mSa_ml7ZYZ0rM2G3mG2phZx7JZ0Gvy4d0-nwbh6xRiMXtvSYe6IwjlgPS6r2UEaVl9UKbp2KinVu70whFoH0QmHFRezr9tsM |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/UDNMOcZ_CfATkVMcr4KJvyAILc-6Lkvb4u9hkZeUlCQTbcn22yUAXO12hCl9wD2Cdc9yZ_iXRpQp4vi_qLegGnRvdkAQ24r1NrA |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/uP87hdknMieRseSUrO4A5voJ2lJCuqeL7ABOYijWijwUW7TPyWxxS8VVXprjwcLHrwrRBTSmK8fqlLTcZa4rHGf-wwDAJufyz5U |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/aVQYBR2gwRp8o9to7ziBaC10iK9h9YKSyjR2g6_D-pnH7g5GEtKJYp_jAWgZFCy69Nhj3CT29V6lEOI6K9lwf-ncbEMLGiVLurU |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/MXjDgBExPx2K25A-tC4OpPNh4NCNp61eEo9NUwgeLLADpx1UDv__yvxpiSsSafNSA4-eQAOKbv8LOXO6fVsr7Ztk8mmFwA27l7o |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/backend/.git/config |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/lib/.git/config |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/_jFkV6pQxXOLBodc_hfX0Nj0CtBmRKEey7buBTF59yyPpk2gSgoLU6AoU3yv1TSe6wiYic-80x9csKMgkRUJtFUpZRGC6RcaqY4 |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/-oecrfqnJLFn7is7R_-iJUjrK9lrBpUWLPZKC6LcodEL337qqCXNMXwfYGAF8EUAzi36p-8hT8pVENuCfU6D72i9UVR6ulqe9vU |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/VIotx2kLpQHpoMxqXF54OSFBoFc7aaXqRMP-ByA2L_0wwTCy6qqVFRqsEw6yubZ9Jdj_WCmMY9YTny8Xak9nG8O-SefG2Ic_r54 |
2026-10-04 03:15:50.829836-04:00 |
| canary-farm-1 |
/wp-json/wp/v2/users/17 |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/b_wt |
2026-10-04 03:15:50.829836-04:00 |
| control-1 |
/nmaplowercheck1791043157 |
2026-10-04 03:15:50.829836-04:00 |
| frantech-ts |
/c/07aiE_thdr7770DtPwTjG540BGTFa8rc1_jlDI92FkheakJmly4E2-kV0uhMpMaZWa2wtU_qGUJfbkXxWjQeFZ9qWVcIMUpW13k |
2026-10-04 03:15:50.829836-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-04 03:33:23.635500-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; CrOS x86_64 12239.67.0) AppleWebKit/537.36 |
2026-10-04 03:33:23.635500-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 9; Pixel 2) AppleWebKit/537.36 ( |
2026-10-04 03:15:50.915189-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20 |
2026-10-04 03:15:50.915189-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/ |
2026-10-04 03:15:50.915189-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-04 03:15:50.915189-04:00 |
| control-1 |
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) Opera 6.01 [ |
2026-10-04 03:15:50.915189-04:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 12; vivo 1907) AppleWebKit/537.3 |
2026-10-04 03:15:50.915189-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-10-04 03:15:50.915189-04:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 7.0; YS900) AppleWebKit/537.36 ( |
2026-10-04 03:15:50.915189-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.6.234 |
13358 |
5 |
13358 |
10-04 00:44 |
10-04 00:46 |
ipsum:1 |
Datacamp Limited |
CH |
0 |
| control-1 |
204.76.203.18 |
2247 |
2 |
578 |
10-03 03:33 |
10-04 07:13 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
185.177.72.75 |
1022 |
35 |
410 |
10-03 06:01 |
10-03 06:06 |
- |
Bucklog SARL |
FR |
5 |
| ru-edge-1 |
217.60.198.3 |
301 |
8 |
39 |
10-03 05:03 |
10-03 16:54 |
- |
12651980 CANADA INC. |
AE |
21 |
| sponge-01-ts |
51.178.48.203 |
293 |
7 |
38 |
10-03 10:45 |
10-03 12:37 |
- |
OVH SAS |
FR |
36 |
| control-1 |
45.79.123.76 |
207 |
25 |
161 |
10-03 15:59 |
10-03 15:59 |
ipsum:1 |
Akamai Connected Cloud |
IN |
1 |
| ru-edge-1 |
51.195.6.20 |
172 |
8 |
40 |
10-03 13:21 |
10-03 13:21 |
- |
OVH SAS |
DE |
37 |
| canary-farm-1 |
185.216.203.177 |
171 |
8 |
40 |
10-03 11:24 |
10-03 11:24 |
- |
Contabo GmbH |
FR |
36 |
| sponge-01-ts |
217.60.198.3 |
162 |
9 |
40 |
10-03 12:38 |
10-03 16:43 |
- |
12651980 CANADA INC. |
AE |
14 |
| ru-edge-1 |
119.198.229.152 |
153 |
8 |
40 |
10-03 12:09 |
10-03 12:10 |
ipsum:2 firehol2 |
Korea Telecom |
KR |
18 |
| netcup-ts |
51.210.150.97 |
145 |
8 |
40 |
10-03 12:45 |
10-03 12:45 |
- |
OVH SAS |
FR |
10 |
| canary-farm-1 |
104.207.39.149 |
144 |
2 |
142 |
10-03 04:23 |
10-03 04:23 |
- |
3xK Tech GmbH |
US |
0 |
| canary-farm-1 |
65.111.3.141 |
144 |
2 |
142 |
10-03 05:26 |
10-03 05:26 |
- |
3xK Tech GmbH |
US |
0 |
| ai-devbox-1 |
39.105.208.239 |
131 |
1 |
1 |
10-03 05:06 |
10-03 05:14 |
- |
Hangzhou Alibaba Advertising |
CN |
131 |
| netcup-ts |
103.154.62.39 |
127 |
6 |
30 |
10-03 10:27 |
10-03 10:28 |
- |
VIETNAM POSTS AND TELECOMMUN |
VN |
13 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
24 |
19 |
| control-1 |
15 |
14 |
| canary-farm-1 |
20 |
16 |
| ru-edge-1 |
6 |
4 |
Mint failures (24h): canary-farm-1:400x4; ai-devbox-1:400x4
Mints by type label:
| sensor |
types |
mints |
| ru-edge-1 |
["aws"] |
6 |
| ai-devbox-1 |
["aws"] |
24 |
| canary-farm-1 |
["aws"] |
20 |
| control-1 |
["aws"] |
15 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1265
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 2
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 5
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1163 |
| ai-devbox-1 |
https |
431 |
| canary-farm-1 |
http |
1499 |
| canary-farm-1 |
https |
442 |
| control-1 |
http |
4541 |
| control-1 |
https |
1 |
| frantech-ts |
http |
14091 |
| lauterbourg-01-ts |
http |
545 |
| lauterbourg-01-ts |
https |
385 |
| netcup-ts |
http |
960 |
| ru-edge-1 |
http |
1386 |
| sponge-01-ts |
http |
1694 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13948 |
| control-1 |
38.54.2.209 |
4519 |
| sponge-01-ts |
89.167.72.144 |
1666 |
| ru-edge-1 |
130.94.89.46 |
1379 |
| canary-farm-1 |
109.123.246.142 |
1176 |
| netcup-ts |
159.195.21.150 |
949 |
| ai-devbox-1 |
217.15.163.226 |
851 |
| canary-farm-1 |
sso.rightabouteverything.show |
752 |
| ai-devbox-1 |
inference.fapthropic.com |
730 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
568 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (21 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
185.177.72.75 |
35 |
/.env.copy [env-production] → /config/database.yml [rails-database-yml] → /.env.1 [tarpit-module] → /billing/.env [tarpit-module] → /components/.env [tarpit-module] → /cpanel/.env [tarpit-module] → /wp-config.php [wp-config] → /bank/.env [tarpit-module] → /client/.env [env-production] → /1board/.env [tarpit-module] → /legacy/.env [tarpit-module] → /orders/.env [tarpit-module] |
Bucklog SARL |
FR |
| ai-devbox-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
128.199.182.152 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
142.93.143.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| ai-devbox-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.226.65.160 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| control-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
159.89.127.165 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
146.190.103.103 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
138.68.86.32 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 610 sources sent credentials → 500 got a shell (82%) → 267 ran a command (53% of shell-getters, 44% of sources)
- event level: 43604 credential attempts → 3314 accepted logins → 3646 commands (110% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 3925 attempts
New commands this window (0 of 46 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1076 |
202 |
101.32.240.31 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 928 |
188 |
101.32.240.31 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 320 |
47 |
120.48.175.69 |
"uname -a" |
| 218 |
6 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 218 |
6 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 121 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 121 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 80 |
6 |
109.160.32.109 |
"uname -s -v -n -r -m" |
Credentials: 31654 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1044 |
345gs5662d34 |
345gs5662d34 |
| 779 |
root |
3245gs5662d34 |
| 70 |
root |
123456 |
| 56 |
pi |
raspberry |
| 56 |
ubuntu |
3245gs5662d34 |
| 47 |
user |
wasd |
| 46 |
admin |
3245gs5662d34 |
| 44 |
admin |
admin |