flux fleet digest — 2026-10-08 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1395 |
117 |
1264 |
120 |
+10% |
| canary-farm-1 |
2794 |
149 |
3999 |
160 |
-30% |
| control-1 |
3354 |
146 |
3218 |
133 |
+4% |
| frantech-ts |
14046 |
84 |
14589 |
90 |
-4% |
| lauterbourg-01-ts |
1356 |
145 |
1179 |
144 |
+15% |
| netcup-ts |
1825 |
111 |
1911 |
107 |
-4% |
| ru-edge-1 |
1008 |
137 |
1828 |
124 |
-45% |
| sponge-01-ts |
1661 |
102 |
1431 |
109 |
+16% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
app-config-yaml |
37 |
2.5 |
14.8x |
| ai-devbox-1 |
config-json |
30 |
9.6 |
3.1x |
| canary-farm-1 |
wp-login-credentials |
459 |
56.3 |
8.2x |
| canary-farm-1 |
wp-login-probe |
464 |
64.0 |
7.2x |
| control-1 |
wp-login-credentials |
427 |
0.0 |
infx |
| control-1 |
wp-login-probe |
433 |
4.0 |
108.2x |
| control-1 |
wp-user-enum-rest-single |
20 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
103 |
722 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| df15d0ee3ccf ⟳ |
17 |
790 |
canary-farm-1,control-1 ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 7e61a9500d8b ⟳ |
15 |
733 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 1cf777711bea ⟳ |
9 |
78 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| e4cbfe2556fa ⟳ |
8 |
53 |
ru-edge-1 |
10-06 |
/var/.env [tarpit-module] → /var/.env [tarpit] → /var/.env [tarpit-disconnect] |
| ef1ab74f3d57 ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| a157d6c255ee ⟳ |
7 |
49 |
control-1,ru-edge-1 ⚠FLEET-WIDE |
10-07 |
/.envrc"] [tarpit-module] → /.envrc"] [tarpit] → /.envrc"] [tarpit-disconnect] |
| c7411f59a56f ⟳ |
7 |
49 |
control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
10-07 |
/var/.env"] [tarpit-module] → /var/.env"] [tarpit] → /var/.env"] [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/MedLife/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/acc/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/alfa/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/baza/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/billing/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/corp/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/credit/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/crm/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ai-devbox-1 |
/cpanel.env |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/srv/app/.env |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/www/ |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/assets/images/ |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/files/ |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/wordpress-seo/ |
2026-10-08 03:16:02.810622-04:00 |
| lauterbourg-01-ts |
/js/ |
2026-10-08 03:16:02.810622-04:00 |
| frantech-ts |
/ce.sh |
2026-10-08 03:16:02.810622-04:00 |
| frantech-ts |
/qv3.mips |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/itil/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/metal/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
| ru-edge-1 |
/old/favicon.ico |
2026-10-08 03:16:02.810622-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-08 03:16:05.630249-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/201 |
2026-10-08 03:16:05.630249-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/ |
2026-10-08 03:16:05.630249-04:00 |
| canary-farm-1 |
Mozilla/5.0 (compatible; InternetData.io/1.0; +https://inter |
2026-10-08 03:16:05.630249-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-08 03:16:05.630249-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-10-08 03:16:05.630249-04:00 |
| frantech-ts |
Mozilla/5.0 Mozilla/5.0 (Windows NT 5.0; rv:45.0) Gecko/2016 |
2026-10-08 03:16:05.630249-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-08 03:16:05.630249-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20 |
2026-10-08 03:16:05.630249-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-08 03:16:05.630249-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
178.249.209.163 |
13474 |
5 |
13474 |
10-08 02:09 |
10-08 02:11 |
ipsum:1 |
Datacamp Limited |
CZ |
0 |
| netcup-ts |
185.73.23.162 |
833 |
3 |
11 |
10-07 03:38 |
10-07 09:04 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
804 |
3 |
12 |
10-07 03:40 |
10-07 08:59 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
185.177.72.75 |
564 |
33 |
277 |
10-07 08:41 |
10-07 08:45 |
- |
Bucklog SARL |
FR |
1 |
| ai-devbox-1 |
168.119.64.101 |
428 |
21 |
83 |
10-07 06:18 |
10-07 13:22 |
- |
Hetzner Online GmbH |
DE |
0 |
| canary-farm-1 |
160.251.210.23 |
311 |
7 |
10 |
10-07 09:04 |
10-07 16:05 |
- |
GMO Internet, Inc. |
JP |
19 |
| control-1 |
107.190.185.67 |
311 |
7 |
10 |
10-07 09:20 |
10-07 16:02 |
- |
Silver Star Communications |
US |
19 |
| canary-farm-1 |
51.210.150.97 |
307 |
7 |
10 |
10-07 09:09 |
10-07 16:01 |
- |
OVH SAS |
FR |
17 |
| lauterbourg-01-ts |
79.124.58.82 |
300 |
6 |
150 |
10-07 19:55 |
10-07 19:55 |
- |
Tamatiya EOOD |
BG |
0 |
| control-1 |
51.210.150.97 |
275 |
6 |
10 |
10-07 09:07 |
10-07 09:08 |
- |
OVH SAS |
FR |
1 |
| canary-farm-1 |
107.190.185.67 |
275 |
6 |
10 |
10-07 08:57 |
10-07 08:57 |
- |
Silver Star Communications |
US |
1 |
| control-1 |
160.251.210.23 |
275 |
6 |
10 |
10-07 09:18 |
10-07 09:18 |
- |
GMO Internet, Inc. |
JP |
1 |
| ru-edge-1 |
141.255.162.236 |
260 |
5 |
254 |
10-07 23:02 |
10-07 23:03 |
- |
Private Layer INC |
CH |
0 |
| netcup-ts |
185.177.72.64 |
256 |
6 |
253 |
10-07 17:27 |
10-07 17:29 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| canary-farm-1 |
217.60.198.14 |
170 |
8 |
29 |
10-07 09:20 |
10-07 22:17 |
- |
12651980 CANADA INC. |
AE |
40 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
11 |
8 |
| ai-devbox-1 |
32 |
20 |
| canary-farm-1 |
21 |
13 |
| ru-edge-1 |
5 |
5 |
| frantech-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
32 |
| canary-farm-1 |
["aws"] |
21 |
| ru-edge-1 |
["aws"] |
5 |
| control-1 |
["aws"] |
11 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 838
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1038 |
| ai-devbox-1 |
https |
357 |
| canary-farm-1 |
http |
2677 |
| canary-farm-1 |
https |
117 |
| control-1 |
http |
3354 |
| frantech-ts |
http |
14046 |
| lauterbourg-01-ts |
http |
993 |
| lauterbourg-01-ts |
https |
363 |
| netcup-ts |
http |
1825 |
| ru-edge-1 |
http |
1008 |
| sponge-01-ts |
http |
1661 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14034 |
| control-1 |
38.54.2.209 |
3336 |
| canary-farm-1 |
109.123.246.142 |
2556 |
| ru-edge-1 |
130.94.89.46 |
1003 |
| netcup-ts |
159.195.21.150 |
983 |
| lauterbourg-01-ts |
89.116.25.211 |
810 |
| sponge-01-ts |
89.167.72.144 |
790 |
| ai-devbox-1 |
inference.fapthropic.com |
737 |
| ai-devbox-1 |
217.15.163.226 |
643 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
506 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (25 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
185.177.72.75 |
33 |
/partner/.env [tarpit-module] → /.env.sandbox [tarpit-module] → /.env.save [env-production] → /.env.shared [tarpit-module] → /wp-config.txt [wp-config] → /custom/.env [tarpit-module] → /.env.sample [env-production] → /database/.env [phpmyadmin-login] → /panel/.env [env-production] → /api/v2/.env [tarpit-module] → /live/.env [env-production] → /page/.env [tarpit-module] |
Bucklog SARL |
FR |
| control-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
178.128.207.138 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
142.93.143.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
139.59.143.102 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
139.59.231.238 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| control-1 |
146.190.103.103 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
146.190.63.48 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 527 sources sent credentials → 423 got a shell (80%) → 307 ran a command (73% of shell-getters, 58% of sources)
- event level: 24855 credential attempts → 8858 accepted logins → 13800 commands (156% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 2152 attempts
New commands this window (0 of 55 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 5110 |
8 |
109.160.32.30 |
"uname -s -v -n -r -m" |
| 1179 |
226 |
181.188.237.208 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1057 |
204 |
192.9.228.120 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 782 |
8 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 782 |
8 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 782 |
8 |
195.178.110.218 |
"uptime -p" |
| 781 |
8 |
195.178.110.218 |
"lspci | grep VGA -c" |
| 780 |
8 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
Credentials: 17010 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1128 |
345gs5662d34 |
345gs5662d34 |
| 856 |
root |
3245gs5662d34 |
| 63 |
root |
123456 |
| 60 |
user |
wasd |
| 54 |
pi |
raspberry |
| 43 |
ubuntu |
3245gs5662d34 |
| 35 |
test |
3245gs5662d34 |
| 31 |
support |
support |