flux fleet digest — 2026-10-07 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1642 |
105 |
2329 |
133 |
-29% |
| canary-farm-1 |
1462 |
158 |
4067 |
162 |
-64% |
| control-1 |
2313 |
126 |
5253 |
131 |
-56% |
| frantech-ts |
14306 |
88 |
12742 |
90 |
+12% |
| lauterbourg-01-ts |
1631 |
134 |
1225 |
145 |
+33% |
| netcup-ts |
4272 |
113 |
1466 |
105 |
+191% |
| ru-edge-1 |
5153 |
185 |
3320 |
112 |
+55% |
| sponge-01-ts |
2421 |
89 |
1238 |
113 |
+96% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
phpmyadmin-login |
21 |
3.5 |
6.0x |
| lauterbourg-01-ts |
tarpit |
48 |
13.1 |
3.7x |
| lauterbourg-01-ts |
tarpit-disconnect |
48 |
12.6 |
3.8x |
| lauterbourg-01-ts |
tarpit-module |
796 |
122.1 |
6.5x |
| netcup-ts |
not-handled |
1063 |
326.3 |
3.3x |
| netcup-ts |
tarpit-module |
2902 |
788.1 |
3.7x |
| ru-edge-1 |
app-config-php |
48 |
15.7 |
3.1x |
| ru-edge-1 |
config-json |
20 |
5.1 |
3.9x |
| ru-edge-1 |
env-production |
503 |
127.2 |
4.0x |
| ru-edge-1 |
issued |
37 |
7.4 |
5.0x |
| ru-edge-1 |
phpmyadmin-login |
22 |
6.5 |
3.4x |
| ru-edge-1 |
ssh-private-key-error |
30 |
0.0 |
infx |
| ru-edge-1 |
tarpit-module |
2627 |
469.3 |
5.6x |
| sponge-01-ts |
tarpit-module |
2095 |
639.9 |
3.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
85 |
595 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
14 |
98 |
ai-devbox-1,canary-farm-1,control-1,netcup-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| c7411f59a56f |
10 |
70 |
control-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
10-07 |
/var/.env"] [tarpit-module] → /var/.env"] [tarpit] → /var/.env"] [tarpit-disconnect] |
| a157d6c255ee |
9 |
60 |
control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
10-07 |
/.envrc"] [tarpit-module] → /.envrc"] [tarpit] → /.envrc"] [tarpit-disconnect] |
| ed66cc967251 ⟳ |
6 |
24 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| e4cbfe2556fa ⟳ |
6 |
42 |
ru-edge-1 |
10-06 |
/var/.env [tarpit-module] → /var/.env [tarpit] → /var/.env [tarpit-disconnect] |
| d045b89fe96b ⟳ |
6 |
42 |
ru-edge-1 |
10-06 |
/.envrc [tarpit-module] → /.envrc [tarpit] → /.envrc [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/glixnjj4y0 |
2026-10-07 03:31:21.072521-04:00 |
| netcup-ts |
/.hgignore |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/config/database.config.php |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/config/development.config.php |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/application/config/database.php |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/application/config/config.php |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/config/ai.json |
2026-10-07 03:15:49.175218-04:00 |
| netcup-ts |
/.git/objects/info/packs |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/config/smtp.php |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/dataset1/.env |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/deploy/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/deprecated/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/docker/php/.env |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/dotfiles/.env |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/documentation/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/env/template/.env |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/engine/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/examples/07-feature-flags/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/films/.env� |
2026-10-07 03:15:49.175218-04:00 |
| ru-edge-1 |
/FIRST_CONFIG/.env |
2026-10-07 03:15:49.175218-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (compatible; opendir-scanner/1.0) |
2026-10-07 03:31:21.952764-04:00 |
| lauterbourg-01-ts |
curl/8.6.0 |
2026-10-07 03:15:51.034254-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Android 10; Mobile; rv:152.0) Gecko/152.0 Firef |
2026-10-07 03:15:51.034254-04:00 |
| ru-edge-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_1 like Mac OS X) App |
2026-10-07 03:15:51.034254-04:00 |
| ru-edge-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-07 03:15:51.034254-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:59.0) Gecko/20100101 |
2026-10-07 03:15:51.034254-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-07 03:15:51.034254-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 9; POT-LX1) AppleWebKit/537.36 ( |
2026-10-07 03:15:51.034254-04:00 |
| control-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Fir |
2026-10-07 03:15:51.034254-04:00 |
| control-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) Apple |
2026-10-07 03:15:51.034254-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
176.119.150.252 |
13445 |
5 |
13445 |
10-07 01:24 |
10-07 01:25 |
- |
Owl Limited |
DE |
0 |
| ru-edge-1 |
102.220.161.102 |
2797 |
55 |
1503 |
10-06 10:39 |
10-06 11:47 |
- |
VPS Dedicated LLC |
SI |
0 |
| netcup-ts |
185.73.23.162 |
1774 |
3 |
18 |
10-06 04:50 |
10-07 06:05 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ru-edge-1 |
87.120.104.29 |
1650 |
140 |
1642 |
10-06 20:39 |
10-06 20:39 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| control-1 |
204.76.203.18 |
1372 |
2 |
570 |
10-06 03:33 |
10-06 20:51 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.177.72.75 |
1096 |
9 |
485 |
10-06 18:52 |
10-06 18:59 |
- |
Bucklog SARL |
FR |
4 |
| sponge-01-ts |
185.73.23.162 |
1024 |
3 |
11 |
10-06 15:37 |
10-07 06:05 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
787 |
2 |
6 |
10-06 22:49 |
10-07 02:54 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
102.220.161.87 |
722 |
8 |
350 |
10-06 23:02 |
10-06 23:20 |
- |
VPS Dedicated LLC |
SI |
0 |
| lauterbourg-01-ts |
185.196.220.132 |
715 |
9 |
282 |
10-06 20:50 |
10-07 02:48 |
ipsum:1 |
ColocaTel Inc. |
NL |
2 |
| ai-devbox-1 |
102.220.161.87 |
599 |
45 |
564 |
10-06 11:58 |
10-06 12:09 |
- |
VPS Dedicated LLC |
SI |
0 |
| frantech-ts |
185.177.72.9 |
188 |
8 |
76 |
10-06 22:37 |
10-06 22:42 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| canary-farm-1 |
185.177.72.205 |
188 |
19 |
76 |
10-06 20:22 |
10-06 20:26 |
ipsum:2 firehol2 |
Bucklog SARL |
FR |
0 |
| ai-devbox-1 |
185.213.193.49 |
175 |
22 |
55 |
10-06 11:32 |
10-06 13:59 |
- |
Zenlayer Inc |
US |
17 |
| canary-farm-1 |
2a01:4f9:c015:3f79::1 |
144 |
2 |
142 |
10-06 20:26 |
10-06 20:26 |
- |
Hetzner Online GmbH |
FI |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
16 |
9 |
| control-1 |
6 |
6 |
| ru-edge-1 |
37 |
6 |
| canary-farm-1 |
16 |
13 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
16 |
| ai-devbox-1 |
["aws"] |
16 |
| control-1 |
["aws"] |
6 |
| ru-edge-1 |
["aws"] |
37 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 4706
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 3167
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1462 |
| ai-devbox-1 |
https |
180 |
| canary-farm-1 |
http |
1169 |
| canary-farm-1 |
https |
293 |
| control-1 |
http |
2313 |
| frantech-ts |
http |
14306 |
| lauterbourg-01-ts |
https |
1065 |
| lauterbourg-01-ts |
http |
566 |
| netcup-ts |
http |
4272 |
| ru-edge-1 |
http |
5153 |
| sponge-01-ts |
http |
2421 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14296 |
| ru-edge-1 |
127.0.0.1 |
2791 |
| ru-edge-1 |
130.94.89.46 |
2351 |
| control-1 |
38.54.2.209 |
2293 |
| netcup-ts |
159.195.21.150 |
2127 |
| ai-devbox-1 |
217.15.163.226 |
1283 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
1106 |
| canary-farm-1 |
109.123.246.142 |
967 |
| sponge-01-ts |
89.167.72.144 |
590 |
| lauterbourg-01-ts |
89.116.25.211 |
513 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (24 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
87.120.104.29 |
140 |
/wp-config.php~ [wp-config] → /wp-config.php [wp-config] → /wp-config.php.old [wp-config] → /wp-config.php.orig [wp-config] → /wp-config.bak [wp-config] → /.git/HEAD [fake-git] → /laravel/.env.example [env-production] → /.travis.yml [generic-ci-config] → /config.inc.php [webshell-sweep-observed] → /laravel/.env [env-production] → /config/config.php [app-config-php] → /.env.development [env-production] |
Sino Worldwide Trading Limit |
NO |
| ru-edge-1 |
102.220.161.102 |
55 |
/ [tarpit-module] → / [tarpit] → /.env.dist [env-production] → /wp-config.php� [not-handled] → /.git/HEAD [fake-git] → /wp-config.php [wp-config] → /.env.backup [env-production] → /.git/config� [fake-git-miss] → /.git/config [fake-git] → /.git/HEAD� [fake-git-miss] → /.env.test� [tarpit-module] → /.env.test [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.87 |
45 |
/aura-wkyalbom53v9dllms5c4f71p.txt [not-handled] → /.env [issued] → /aura-x55fzohvwviudpoglx7hmhaa.txt [not-handled] → /.env.dist [env-production] → /.env.save [env-production] → /.env.development [env-production] → /portal/.env [env-production] → /.envs [tarpit-module] → /.env.secure [tarpit-module] → /.env.development.sample [tarpit-module] → /.env.example.local [env-production] → /.env.production.local [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
178.128.207.138 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
207.154.212.47 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
128.199.182.152 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
142.93.0.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
64.227.32.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 698 sources sent credentials → 588 got a shell (84%) → 335 ran a command (57% of shell-getters, 48% of sources)
- event level: 42530 credential attempts → 3949 accepted logins → 6343 commands (161% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 841 attempts
New commands this window (0 of 53 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1318 |
253 |
|
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1142 |
231 |
123.122.46.140 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 394 |
2 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 394 |
2 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 394 |
2 |
195.178.110.218 |
"uptime -p" |
| 393 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 393 |
2 |
195.178.110.218 |
"lspci | grep VGA -c" |
| 393 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
Credentials: 35463 distinct pairs offered this window, 6 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
root |
1234@qwe |
| 1 |
shealyn |
shealyn12345 |
| 1 |
shealyn |
shealyn |
| 1 |
shealyn |
shealyn1234 |
| 1 |
shealyn |
shealyn1 |
| 1 |
shealyn |
shealyn123 |