flux fleet digest — 2026-10-05 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
980 |
122 |
2873 |
124 |
-66% |
| canary-farm-1 |
955 |
134 |
5018 |
159 |
-81% |
| control-1 |
2928 |
133 |
5272 |
117 |
-44% |
| frantech-ts |
14096 |
79 |
8879 |
86 |
+59% |
| lauterbourg-01-ts |
888 |
139 |
2219 |
140 |
-60% |
| netcup-ts |
2480 |
95 |
1108 |
100 |
+124% |
| ru-edge-1 |
471 |
117 |
3259 |
107 |
-86% |
| sponge-01-ts |
1994 |
109 |
1251 |
109 |
+59% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| control-1 |
webapp-config-bundle-js |
46 |
11.3 |
4.1x |
| netcup-ts |
not-handled |
886 |
180.9 |
4.9x |
| netcup-ts |
webshell-probe |
27 |
7.5 |
3.6x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
82 |
575 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ed66cc967251 ⟳ |
21 |
84 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 4b4cc0ece037 ⟳ |
12 |
84 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
8 |
392 |
ai-devbox-1,canary-farm-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| df15d0ee3ccf ⟳ |
6 |
370 |
canary-farm-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 850993125b15 ⟳ |
5 |
205 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 2bdde2df2cf6 |
4 |
32 |
ai-devbox-1 |
10-05 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credent |
| 1cf777711bea ⟳ |
4 |
44 |
control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/webhook/.env |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/v4/.env |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/qsktBHngvvvhrUqljf3pRxKzTM2VVBcnOngkAsYN2u9coOfsT3FSD_vPWWa_RIY68eqjdjpG4eXSmZWV7mBWHr_fZIYggnG53Tk |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/KrOhqZrSqd8JSueSezfw2zoc5o8JNpbr0LO_XylsNogLL1uDSdSTULgjuMzWLGfZVUlotumjo66WARYBSZD9gHKylAmwj8BsrGo |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/wEIPqF62fQPq6JioRBCizW6ZkQKHGENs_Bkbbm-4FfC-O2UE5qYOFijIKoap0EJ9YvTuvEkAlG-wT-4Ooblmz-nQRO-jZtRB6oA |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/08ZBMSxerrmgRg1ttnDbWPtcbu_pYtE-yldm4t4GOPlaDoBSNRWLIfjq35f-KelrH8FyA9E0ZSo_Q1gtL0k_i8ySEBE7Eq63e6E |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/QyDphdyOVKC07mxLpS5E-LXQrfMNbP-1gm1ae8WkiFMLdAPpuN2rAtpu5DHcRXyf_vtkyc9dwtJLda9aZDz47qOpuZ1jYBBV-4Y |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/content/.git/config |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/html/.git/config |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/lms/.git/config |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/usr/.git/config |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/vFj84C622vK8x0pDoqS1m6jxNz_lfu5EHs_HHswLAkmbvaMnRye_2AuU9QySyPY4_4ThybTKYgxGEfVQGzqCyc1YC69qc1zen1w |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/nqH_D7b4c8x-IG0v3YDECtHKozVw7lh8GdDL3HR25w4n0Zi-122KCdYl3l2fcU8UkkHAw8dWN6vq2cEkx7xvWT1T4aZ-R3LwOCA |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/WaCFgjkCCsceI6jGiYJgEF_fCSUAwr3QxLC1Tn0B4R_xqx8hchghV95jVxMBLfgjCL3IJWuHM_L6vdhH5-j02yjDgZcHB4F3CeI |
2026-10-05 03:15:35.256089-04:00 |
| frantech-ts |
/c/zSiiSUXThjuM5O1Xl6MBKcOafDpO3bB-D4ckn6oGML8jCFIOkRTUJjDcFsomCS0939jQ4EjnkUDC2vDxHGXOqe7zCkOlOWEXBds |
2026-10-05 03:15:35.256089-04:00 |
| netcup-ts |
/server |
2026-10-05 03:15:35.256089-04:00 |
| netcup-ts |
/v2/staging/web-app/manifests/latest |
2026-10-05 03:15:35.256089-04:00 |
| netcup-ts |
/�queue/�.env |
2026-10-05 03:15:35.256089-04:00 |
| netcup-ts |
/�tokens/�.env |
2026-10-05 03:15:35.256089-04:00 |
| netcup-ts |
/�mail/�.env |
2026-10-05 03:15:35.256089-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| frantech-ts |
Mozilla/5.0 (iPod; U; CPU iPhone OS 6_1 like Mac OS X; en-HK |
2026-10-05 03:15:35.321878-04:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 7.1.2; Nexus 6P Build/N2G48C) Ap |
2026-10-05 03:15:35.321878-04:00 |
| control-1 |
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Tr |
2026-10-05 03:15:35.321878-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Geck |
2026-10-05 03:15:35.321878-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; d |
2026-10-05 03:15:35.321878-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.36 |
2026-10-05 03:15:35.321878-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-05 03:15:35.321878-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-05 03:15:35.321878-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-05 03:15:35.321878-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/ |
2026-10-05 03:15:35.321878-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
185.213.155.227 |
13398 |
6 |
13398 |
10-04 23:32 |
10-05 00:33 |
ipsum:1 |
31173 Services AB |
DE |
0 |
| control-1 |
204.76.203.18 |
2173 |
2 |
570 |
10-04 03:33 |
10-05 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.162 |
765 |
3 |
13 |
10-04 23:10 |
10-05 05:13 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
704 |
3 |
12 |
10-04 23:11 |
10-05 05:12 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.177.72.75 |
460 |
6 |
247 |
10-05 02:24 |
10-05 02:28 |
- |
Bucklog SARL |
FR |
0 |
| netcup-ts |
79.124.58.82 |
300 |
5 |
150 |
10-04 14:14 |
10-05 05:46 |
- |
Tamatiya EOOD |
BG |
0 |
| netcup-ts |
213.209.159.154 |
296 |
7 |
293 |
10-04 11:09 |
10-04 11:09 |
- |
Feo Prest SRL |
DE |
0 |
| sponge-01-ts |
213.209.159.154 |
296 |
7 |
293 |
10-05 03:04 |
10-05 03:05 |
- |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
45.138.12.51 |
176 |
20 |
85 |
10-04 04:20 |
10-04 06:59 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
34.52.229.253 |
144 |
7 |
144 |
10-04 11:22 |
10-04 11:22 |
- |
Google LLC |
BE |
0 |
| canary-farm-1 |
216.26.239.111 |
144 |
2 |
142 |
10-04 14:48 |
10-04 14:48 |
- |
3xK Tech GmbH |
BR |
0 |
| frantech-ts |
195.178.110.28 |
131 |
2 |
131 |
10-04 08:20 |
10-04 17:57 |
ipsum:2 firehol2 |
Techoff Srv Limited |
BG |
1 |
| lauterbourg-01-ts |
35.205.254.119 |
119 |
6 |
119 |
10-05 04:33 |
10-05 04:34 |
- |
Google LLC |
BE |
0 |
| frantech-ts |
185.177.72.75 |
115 |
3 |
59 |
10-05 00:44 |
10-05 00:49 |
- |
Bucklog SARL |
FR |
0 |
| sponge-01-ts |
45.138.12.51 |
88 |
3 |
85 |
10-04 19:37 |
10-04 19:37 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| canary-farm-1 |
11 |
9 |
| ru-edge-1 |
4 |
4 |
| ai-devbox-1 |
16 |
11 |
| control-1 |
12 |
9 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
16 |
| control-1 |
["aws"] |
12 |
| canary-farm-1 |
["aws"] |
11 |
| ru-edge-1 |
["aws"] |
4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 684
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 7
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
786 |
| ai-devbox-1 |
https |
194 |
| canary-farm-1 |
http |
663 |
| canary-farm-1 |
https |
292 |
| control-1 |
http |
2928 |
| frantech-ts |
http |
14096 |
| lauterbourg-01-ts |
http |
697 |
| lauterbourg-01-ts |
https |
191 |
| netcup-ts |
http |
2480 |
| ru-edge-1 |
http |
471 |
| sponge-01-ts |
http |
1994 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13886 |
| control-1 |
38.54.2.209 |
2916 |
| netcup-ts |
159.195.21.150 |
1705 |
| sponge-01-ts |
89.167.72.144 |
1281 |
| ai-devbox-1 |
217.15.163.226 |
691 |
| lauterbourg-01-ts |
89.116.25.211 |
584 |
| canary-farm-1 |
109.123.246.142 |
567 |
| ru-edge-1 |
130.94.89.46 |
457 |
| canary-farm-1 |
sso.rightabouteverything.show |
378 |
| ai-devbox-1 |
inference.fapthropic.com |
276 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (22 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
165.227.173.41 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
128.199.182.152 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
164.92.244.132 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
138.197.191.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
45.138.12.51 |
20 |
/ [tarpit-module] → /.env.uat [env-production] → /storage/.env [env-production] → /config/aws.json [aws-credentials-json] → /config/aws.yml [not-handled] → /.gitlab-ci.yml [gitlab-ci] → /.env.default [env-production] → /.env.staging.local [env-production] → /wp-config.php.bak [wp-config] → /wp-config.php.old [wp-config] → /.env.live [env-production] → /.env.preprod [env-production] |
Tc Datacenter Limited |
LT |
| lauterbourg-01-ts |
165.227.173.41 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| lauterbourg-01-ts |
206.189.233.36 |
17 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 640 sources sent credentials → 512 got a shell (80%) → 286 ran a command (56% of shell-getters, 45% of sources)
- event level: 44949 credential attempts → 2976 accepted logins → 4119 commands (138% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 4728 attempts
New commands this window (0 of 54 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 936 |
195 |
103.143.11.150 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 813 |
181 |
103.143.11.150 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 221 |
5 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 221 |
5 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 171 |
68 |
117.50.208.11 |
"uname -a" |
| 157 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 157 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
| 157 |
2 |
195.178.110.218 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 32743 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 902 |
345gs5662d34 |
345gs5662d34 |
| 678 |
root |
3245gs5662d34 |
| 60 |
root |
123456 |
| 52 |
admin |
3245gs5662d34 |
| 50 |
pi |
raspberry |
| 48 |
user |
wasd |
| 43 |
ubuntu |
3245gs5662d34 |
| 35 |
support |
support |