flux fleet digest — 2026-10-06 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1110 |
160 |
2906 |
128 |
-62% |
| canary-farm-1 |
1233 |
176 |
4720 |
160 |
-74% |
| control-1 |
3132 |
154 |
5282 |
124 |
-41% |
| frantech-ts |
14032 |
98 |
10825 |
88 |
+30% |
| lauterbourg-01-ts |
1204 |
164 |
2020 |
139 |
-40% |
| netcup-ts |
1573 |
130 |
1329 |
101 |
+18% |
| ru-edge-1 |
675 |
106 |
3287 |
111 |
-79% |
| sponge-01-ts |
1050 |
107 |
1437 |
111 |
-27% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
webapp-config-bundle-js |
60 |
7.0 |
8.6x |
| lauterbourg-01-ts |
llm-endpoint-openai-chat |
33 |
2.0 |
16.5x |
| ru-edge-1 |
webapp-config-bundle-js |
20 |
5.8 |
3.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
62 |
435 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ed66cc967251 ⟳ |
21 |
84 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 4b4cc0ece037 ⟳ |
20 |
141 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
15 |
735 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| d045b89fe96b |
14 |
98 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
10-06 |
/.envrc [tarpit-module] → /.envrc [tarpit] → /.envrc [tarpit-disconnect] |
| e4cbfe2556fa |
7 |
49 |
control-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
10-06 |
/var/.env [tarpit-module] → /var/.env [tarpit] → /var/.env [tarpit-disconnect] |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5c4b5dc2fb71 ⟳ |
5 |
35 |
lauterbourg-01-ts |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| sponge-01-ts |
/server-info.php |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/stream.mjpg |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/image.jpg |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/image.jpeg |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/picture.jpg |
2026-10-06 03:15:35.190502-04:00 |
| ru-edge-1 |
/env.production.js |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/main_host |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/c/wMiTAXn_DA2RfwGiXhUNIHrS0ULvyzeADkbgP84UogtVe4BnIX0MZzBemFrckc8ieBOVVabGJqpNWAkUOvWkm_MJoQxwvGqBsOM |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/c/twPVDEkiAYtEWXLozCv5BJyXe-68vq324cZ7WjNPnLyIm5UJ3ESmTLAPWqgC71KkQiOdobLBleqIpOvmkX7zDQfjF7bBgMLbSwU |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/c/re_NRKIhx2MkCqQ0SICWmYI7nub-0WF3iXJC9pUEw209Fl4-I_vkI7IuWExCYgIQ8rkAILUhQzYkQmDQ13vwaqdbqcTrctFUI7g |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/c/9L-YjYSovvTwYyroWDYTv7EDb6H17CBj5NOmivW7M-qb-V_Qv9UaeGkcqqFtbMtDyuaf_tD1970fyMWIKTce1O8iTKxtI8gyO7E |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/7f13c0a9d8644f3ca0a563b6b56e49d7 |
2026-10-06 03:15:35.190502-04:00 |
| netcup-ts |
/abc6 |
2026-10-06 03:15:35.190502-04:00 |
| netcup-ts |
/.env-ku |
2026-10-06 03:15:35.190502-04:00 |
| netcup-ts |
/frontend_dev.php/$ |
2026-10-06 03:15:35.190502-04:00 |
| frantech-ts |
/login.action |
2026-10-06 03:15:35.190502-04:00 |
| ai-devbox-1 |
/iw0_pbtszk |
2026-10-06 03:15:35.190502-04:00 |
| ai-devbox-1 |
/ss_probe_6044ce427532cb1225692c4f1807383d |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/init.php |
2026-10-06 03:15:35.190502-04:00 |
| sponge-01-ts |
/.env-ku |
2026-10-06 03:15:35.190502-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/ |
2026-10-06 03:31:10.679762-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-06 03:15:35.274282-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-10-06 03:15:35.274282-04:00 |
| control-1 |
Opera/9.25 (Windows NT 6.0; U; en) |
2026-10-06 03:15:35.274282-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefo |
2026-10-06 03:15:35.274282-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/201 |
2026-10-06 03:15:35.274282-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Linux; Android 9; ONEPLUS 6) AppleWebKit/537.36 |
2026-10-06 03:15:35.274282-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-06 03:15:35.274282-04:00 |
| frantech-ts |
ApcosysBot/1.0 |
2026-10-06 03:15:35.274282-04:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 13; 13T Pro; Build/TP1A.230816.2 |
2026-10-06 03:15:35.274282-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
98.98.47.133 |
13414 |
5 |
13414 |
10-06 00:23 |
10-06 00:25 |
- |
Zenlayer Inc |
MY |
0 |
| control-1 |
204.76.203.18 |
2198 |
1 |
571 |
10-05 03:33 |
10-06 06:10 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| sponge-01-ts |
185.73.23.162 |
390 |
2 |
11 |
10-05 03:38 |
10-05 17:17 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.162 |
329 |
3 |
10 |
10-05 03:39 |
10-06 06:10 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
79.124.58.82 |
150 |
5 |
150 |
10-05 05:46 |
10-05 05:46 |
- |
Tamatiya EOOD |
BG |
0 |
| netcup-ts |
87.120.104.29 |
150 |
5 |
150 |
10-05 14:35 |
10-05 14:35 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| ai-devbox-1 |
102.220.161.102 |
145 |
2 |
142 |
10-05 07:59 |
10-05 15:56 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
185.213.193.49 |
141 |
19 |
42 |
10-06 00:20 |
10-06 03:21 |
- |
Zenlayer Inc |
US |
14 |
| lauterbourg-01-ts |
45.138.12.27 |
141 |
7 |
141 |
10-05 09:35 |
10-05 09:35 |
- |
Tc Datacenter Limited |
LT |
0 |
| sponge-01-ts |
87.182.231.18 |
128 |
1 |
30 |
10-06 02:53 |
10-06 02:53 |
- |
Deutsche Telekom AG |
DE |
0 |
| lauterbourg-01-ts |
35.205.254.119 |
119 |
6 |
119 |
10-05 04:33 |
10-05 04:34 |
- |
Google LLC |
BE |
0 |
| lauterbourg-01-ts |
172.105.76.7 |
117 |
19 |
95 |
10-05 17:08 |
10-05 17:14 |
- |
Akamai Connected Cloud |
DE |
4 |
| netcup-ts |
45.138.12.51 |
88 |
3 |
85 |
10-05 16:02 |
10-05 16:03 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
105.159.4.244 |
73 |
15 |
38 |
10-05 11:59 |
10-05 12:01 |
- |
Office National des Postes e |
MA |
9 |
| ai-devbox-1 |
185.213.193.49 |
72 |
19 |
42 |
10-06 01:33 |
10-06 01:35 |
- |
Zenlayer Inc |
US |
7 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
17 |
13 |
| control-1 |
17 |
16 |
| ru-edge-1 |
7 |
7 |
| canary-farm-1 |
20 |
18 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
20 |
| ai-devbox-1 |
["aws"] |
17 |
| control-1 |
["aws"] |
17 |
| ru-edge-1 |
["aws"] |
7 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 829
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 19
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
830 |
| ai-devbox-1 |
https |
280 |
| canary-farm-1 |
http |
1028 |
| canary-farm-1 |
https |
205 |
| control-1 |
http |
3132 |
| frantech-ts |
http |
14032 |
| lauterbourg-01-ts |
http |
880 |
| lauterbourg-01-ts |
https |
324 |
| netcup-ts |
http |
1573 |
| ru-edge-1 |
http |
675 |
| sponge-01-ts |
http |
1050 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
13942 |
| control-1 |
38.54.2.209 |
3120 |
| netcup-ts |
159.195.21.150 |
1233 |
| canary-farm-1 |
109.123.246.142 |
865 |
| lauterbourg-01-ts |
89.116.25.211 |
823 |
| ai-devbox-1 |
217.15.163.226 |
714 |
| ru-edge-1 |
130.94.89.46 |
669 |
| sponge-01-ts |
89.167.72.144 |
638 |
| ai-devbox-1 |
inference.fapthropic.com |
382 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
368 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (23 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
146.190.103.103 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| control-1 |
139.59.143.102 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
146.190.242.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
206.189.225.181 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
139.59.136.184 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
159.89.127.165 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
185.213.193.49 |
19 |
/ [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] |
Zenlayer Inc |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 692 sources sent credentials → 571 got a shell (83%) → 321 ran a command (56% of shell-getters, 46% of sources)
- event level: 26644 credential attempts → 4033 accepted logins → 6612 commands (164% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 708 attempts
New commands this window (0 of 54 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1088 |
236 |
103.143.72.165 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 960 |
212 |
103.143.72.165 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 803 |
8 |
77.239.124.146 |
"uname -s -v -n -r -m" |
| 715 |
7 |
77.239.124.146 |
"uname -m | awk '{printf $1}'" |
| 258 |
2 |
195.178.110.218 |
"uptime -p" |
| 258 |
2 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 258 |
2 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 257 |
2 |
195.178.110.218 |
"lspci | grep VGA -c" |
Credentials: 21058 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1044 |
345gs5662d34 |
345gs5662d34 |
| 772 |
root |
3245gs5662d34 |
| 61 |
ubuntu |
3245gs5662d34 |
| 51 |
user |
wasd |
| 48 |
root |
123456 |
| 43 |
pi |
raspberry |
| 38 |
admin |
3245gs5662d34 |
| 37 |
support |
support |