flux fleet digest — 2026-10-09 07:30 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1344 |
131 |
1176 |
120 |
+14% |
| canary-farm-1 |
1996 |
174 |
3725 |
158 |
-46% |
| control-1 |
3138 |
114 |
3131 |
137 |
+0% |
| frantech-ts |
14318 |
79 |
12531 |
90 |
+14% |
| lauterbourg-01-ts |
1577 |
141 |
1184 |
146 |
+33% |
| netcup-ts |
785 |
90 |
1986 |
106 |
-60% |
| ru-edge-1 |
1490 |
104 |
1812 |
130 |
-18% |
| sponge-01-ts |
882 |
100 |
1513 |
108 |
-42% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
env-production-error |
144 |
0.0 |
infx |
| canary-farm-1 |
phpmyadmin-login |
42 |
7.7 |
5.5x |
| control-1 |
docker-registry-manifest |
45 |
10.8 |
4.2x |
| control-1 |
docker-registry-tags |
45 |
10.8 |
4.2x |
| control-1 |
phpmyadmin-login |
31 |
3.5 |
8.9x |
| control-1 |
whm-login |
24 |
4.3 |
5.5x |
| frantech-ts |
docker-registry-manifest |
25 |
7.5 |
3.3x |
| frantech-ts |
docker-registry-tags |
25 |
7.5 |
3.3x |
| frantech-ts |
phpmyadmin-login |
181 |
1.0 |
181.0x |
| netcup-ts |
docker-registry-manifest |
25 |
5.0 |
5.0x |
| netcup-ts |
docker-registry-tags |
25 |
5.0 |
5.0x |
| ru-edge-1 |
docker-registry-manifest |
45 |
8.8 |
5.1x |
| ru-edge-1 |
docker-registry-tags |
45 |
8.8 |
5.1x |
| sponge-01-ts |
docker-registry-manifest |
25 |
6.2 |
4.0x |
| sponge-01-ts |
docker-registry-tags |
25 |
6.2 |
4.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
87 |
613 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 9ff5e462ca0e ⟳ |
22 |
154 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-06 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 4b4cc0ece037 ⟳ |
21 |
147 |
ai-devbox-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
539 |
canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
9 |
451 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| fe0b8d49a878 |
7 |
287 |
ru-edge-1 |
10-09 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 24e7b3a70bf9 |
7 |
328 |
control-1 |
10-09 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| fabbcf845ac5 ⟳ |
5 |
45 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-02 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.git/objects/ea/6ddf1eb6d9c17de39d65347280fff59fb54e17 |
2026-10-09 03:31:11.336090-04:00 |
| canary-farm-1 |
/.git/objects/ca/5f2892499f9cc3d12685ec95166eb9151e7c0b |
2026-10-09 03:31:11.336090-04:00 |
| canary-farm-1 |
/.git/objects/ce/7fb6ebfa4bceebeaf1563a925b91468932aab6 |
2026-10-09 03:31:11.336090-04:00 |
| canary-farm-1 |
/.git/objects/23/d0422b9baea9e4b2539e5ab8ba435530bd9baf |
2026-10-09 03:31:11.336090-04:00 |
| canary-farm-1 |
/be7a1v76vahm3mr8tu |
2026-10-09 03:31:11.336090-04:00 |
| ru-edge-1 |
/diy/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/electronics-store/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/enterprise-kz/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/expert-hrm-nfo/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/gmz/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/intellektinfo_opop/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/jkh_erp/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/meat-mes-erp/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/orticon-leasing/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/pdfgis/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/pm-prof/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/poultry-farm-erp/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/school-att/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| ru-edge-1 |
/usperp/favicon.ico |
2026-10-09 03:15:42.253662-04:00 |
| sponge-01-ts |
/wp-content/plugins/fluentform/readme.txt |
2026-10-09 03:15:42.253662-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-09 03:15:42.902224-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like |
2026-10-09 03:15:42.902224-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/60 |
2026-10-09 03:15:42.902224-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTM |
2026-10-09 03:15:42.902224-04:00 |
| frantech-ts |
Opera/9.80 (Android; Opera Mini/7.5.33361/31.1543; U; en) Pr |
2026-10-09 03:15:42.902224-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (compatible; InternetData.io/1.0; +https://inter |
2026-10-09 03:15:42.902224-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/6 |
2026-10-09 03:15:42.902224-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (compatible; sFox/1.0) |
2026-10-09 03:15:42.902224-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; Android 9; Redmi Note 7) AppleWebKit/537 |
2026-10-09 03:15:42.902224-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 |
2026-10-09 03:15:42.902224-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.60.3 |
13478 |
5 |
13478 |
10-09 02:01 |
10-09 02:03 |
ipsum:1 |
Datacamp Limited |
SG |
0 |
| control-1 |
204.76.203.18 |
1981 |
2 |
580 |
10-08 06:52 |
10-09 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
141.255.162.236 |
709 |
2 |
517 |
10-08 13:00 |
10-08 18:11 |
- |
Private Layer INC |
CH |
0 |
| canary-farm-1 |
87.120.104.29 |
300 |
40 |
150 |
10-08 21:45 |
10-08 21:45 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| ai-devbox-1 |
160.177.245.67 |
242 |
15 |
38 |
10-08 08:23 |
10-08 08:32 |
- |
Office National des Postes e |
MA |
27 |
| lauterbourg-01-ts |
172.104.241.92 |
213 |
28 |
183 |
10-09 05:31 |
10-09 05:32 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
DE |
1 |
| control-1 |
185.177.72.38 |
188 |
19 |
76 |
10-09 05:25 |
10-09 05:30 |
ipsum:4 firehol2 |
Bucklog SARL |
FR |
0 |
| frantech-ts |
158.178.159.133 |
181 |
1 |
1 |
10-08 14:31 |
10-08 14:32 |
- |
Oracle Corporation |
NL |
0 |
| canary-farm-1 |
160.177.245.67 |
164 |
15 |
38 |
10-08 07:55 |
10-08 09:04 |
- |
Office National des Postes e |
MA |
18 |
| netcup-ts |
151.243.18.111 |
150 |
5 |
150 |
10-08 15:10 |
10-08 15:10 |
- |
Dedik Services Limited |
US |
0 |
| ai-devbox-1 |
178.128.169.110 |
144 |
2 |
142 |
10-09 04:21 |
10-09 04:21 |
- |
DigitalOcean, LLC |
GB |
0 |
| lauterbourg-01-ts |
34.156.206.32 |
143 |
7 |
143 |
10-08 20:47 |
10-08 20:48 |
- |
Google LLC |
BE |
0 |
| lauterbourg-01-ts |
35.241.178.74 |
119 |
6 |
119 |
10-08 14:35 |
10-08 14:35 |
- |
Google LLC |
BE |
0 |
| netcup-ts |
193.37.32.88 |
95 |
18 |
88 |
10-08 14:11 |
10-08 14:11 |
ipsum:1 |
F.n.s. Holdings Limited |
SG |
0 |
| canary-farm-1 |
150.241.66.127 |
95 |
11 |
34 |
10-08 15:48 |
10-08 18:31 |
- |
Kyonix Networks Limited |
US |
11 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
15 |
7 |
| control-1 |
12 |
9 |
| ru-edge-1 |
12 |
11 |
| canary-farm-1 |
25 |
16 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ru-edge-1:400x2; control-1:400x2; canary-farm-1:400x4; ai-devbox-1:400x3
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
15 |
| canary-farm-1 |
["aws"] |
25 |
| control-1 |
["aws"] |
12 |
| ru-edge-1 |
["aws"] |
12 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1365
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 188
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
987 |
| ai-devbox-1 |
https |
357 |
| canary-farm-1 |
http |
1677 |
| canary-farm-1 |
https |
319 |
| control-1 |
http |
3138 |
| frantech-ts |
http |
14318 |
| lauterbourg-01-ts |
http |
1076 |
| lauterbourg-01-ts |
https |
501 |
| netcup-ts |
http |
785 |
| ru-edge-1 |
http |
1490 |
| sponge-01-ts |
http |
882 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14307 |
| control-1 |
38.54.2.209 |
3126 |
| ru-edge-1 |
130.94.89.46 |
1486 |
| canary-farm-1 |
109.123.246.142 |
1473 |
| sponge-01-ts |
89.167.72.144 |
873 |
| lauterbourg-01-ts |
89.116.25.211 |
789 |
| netcup-ts |
159.195.21.150 |
779 |
| ai-devbox-1 |
217.15.163.226 |
752 |
| ai-devbox-1 |
inference.fapthropic.com |
579 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
554 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (26 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
| 2026-09-26 |
5606 |
114 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
87.120.104.29 |
40 |
/.git/HEAD [fake-git-error] → /.git/index [fake-git-error] → /wp-config.php [wp-config-error] → /.git/config [fake-git-error] → /wp-config.php.bak [wp-config-error] → /config/database.php [app-config-php-database-error] → /wp-config.php.old [wp-config-error] → /config.php [app-config-php-error] → /wp-config.bak [wp-config-error] → /settings.php [app-config-php-error] → /wp-config.php.save [wp-config-error] → /composer.lock [composer-lock-error] |
Sino Worldwide Trading Limit |
NO |
| lauterbourg-01-ts |
172.104.241.92 |
28 |
/ [kiteworks-root-redirect] → /sdk [not-handled] → /health [observability-health] → /nmaplowercheck1791523910 [not-handled] → /vpn/js/rdx/core/lang/rdx_en.json.gz [citrix-rdx-lang] → /login [kiteworks-shell] → /evox/about [not-handled] → /human.aspx [not-handled] → /api/v2/about [nextjs-api] → /webui [not-handled] → /CFIDE/componentutils/ [coldfusion-componentutils] → /login.php [webshell-sweep-observed] |
Akamai Connected Cloud |
DE |
| ru-edge-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
206.189.225.181 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
165.22.235.3 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| control-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
206.81.12.187 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
164.90.228.79 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
165.227.39.235 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 442 sources sent credentials → 335 got a shell (76%) → 218 ran a command (65% of shell-getters, 49% of sources)
- event level: 12275 credential attempts → 3108 accepted logins → 7132 commands (229% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 970 attempts
New commands this window (0 of 49 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 840 |
188 |
103.208.219.38 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 740 |
163 |
103.208.219.38 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 584 |
3 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 584 |
3 |
195.178.110.218 |
"uptime -p" |
| 583 |
3 |
195.178.110.218 |
"lspci | grep VGA -c" |
| 583 |
3 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 582 |
3 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 582 |
3 |
195.178.110.218 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 7917 distinct pairs offered this window, 153 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
5921 |
anton |
| 1 |
berbidvps |
peer |
| 1 |
cs312 |
usman |
| 1 |
iptvserver |
ali |
| 1 |
keitaro-support |
teamspeak3 |
| 1 |
nari |
runner |
| 1 |
sftpuser |
sxl1234 |
| 1 |
unl4 |
app |