flux fleet digest — 2026-10-10 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2129 |
172 |
1198 |
117 |
+78% |
| canary-farm-1 |
1930 |
157 |
1732 |
162 |
+11% |
| control-1 |
4416 |
123 |
3187 |
137 |
+39% |
| frantech-ts |
14026 |
75 |
14220 |
87 |
-1% |
| lauterbourg-01-ts |
1567 |
181 |
1264 |
146 |
+24% |
| netcup-ts |
393 |
100 |
1992 |
105 |
-80% |
| ru-edge-1 |
2262 |
107 |
1664 |
129 |
+36% |
| sponge-01-ts |
625 |
87 |
1462 |
106 |
-57% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
docker-registry-manifest |
92 |
28.1 |
3.3x |
| ai-devbox-1 |
docker-registry-tags |
90 |
28.6 |
3.1x |
| ai-devbox-1 |
fake-git |
299 |
96.6 |
3.1x |
| ai-devbox-1 |
fake-git-error |
30 |
4.0 |
7.5x |
| ai-devbox-1 |
graphql-introspection |
36 |
10.9 |
3.3x |
| ai-devbox-1 |
method-not-allowed |
25 |
7.0 |
3.6x |
| ai-devbox-1 |
phpmyadmin-login |
218 |
15.0 |
14.5x |
| canary-farm-1 |
issued |
60 |
19.6 |
3.1x |
| control-1 |
fake-git |
191 |
59.9 |
3.2x |
| control-1 |
tarpit |
176 |
50.6 |
3.5x |
| control-1 |
tarpit-disconnect |
176 |
50.4 |
3.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
87 |
605 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 75df0dbb0841 |
12 |
72 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
10-10 |
/wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
11 |
572 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 4a3bf1265dff ⟳ |
10 |
350 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-16 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| b3c6048a4870 |
9 |
360 |
lauterbourg-01-ts |
10-10 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-ji |
| b07c7bb207b4 ⟳ |
8 |
328 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 76d212a95300 ⟳ |
6 |
234 |
ai-devbox-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| control-1 |
/internal/configprops |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/api/docs/ |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/actuator/health/diskSpace.json |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/config/mailgun.yml |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/xai_config.yml |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/wp-config.php.swn |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/rabbitmq/ |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/prometheus/rules |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/package.json.swp |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/brevo_config.json |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/admin/.env.4 |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/config.toml.old |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/sparkpost_credentials.json |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/.git/hooks/post-receive |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/admin/.env.production.bak |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/mongodump.zip |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/sentry/ |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/docker-compose.yml.tar.gz |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/package-lock.json.old |
2026-10-10 03:15:52.077330-04:00 |
| control-1 |
/wp-json/ |
2026-10-10 03:15:52.077330-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Lynx/2.8.7dev.4 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.8d |
2026-10-10 03:31:36.180752-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3. |
2026-10-10 03:15:52.171324-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-10 03:15:52.171324-04:00 |
| control-1 |
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.7.62 Version/11. |
2026-10-10 03:15:52.171324-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-10 03:15:52.171324-04:00 |
| netcup-ts |
Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, lik |
2026-10-10 03:15:52.171324-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-10 03:15:52.171324-04:00 |
| lauterbourg-01-ts |
cms-port-check-go/1.0 |
2026-10-10 03:15:52.171324-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-10 03:15:52.171324-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox |
2026-10-10 03:15:52.171324-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
193.32.248.142 |
13490 |
5 |
13489 |
10-10 01:21 |
10-10 01:22 |
ipsum:2 |
31173 Services AB |
DE |
0 |
| control-1 |
204.76.203.18 |
1871 |
2 |
566 |
10-09 03:34 |
10-10 03:17 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| ru-edge-1 |
87.120.104.29 |
1650 |
140 |
1642 |
10-09 06:12 |
10-09 06:12 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| control-1 |
185.177.72.100 |
1433 |
102 |
1008 |
10-09 18:57 |
10-09 19:17 |
- |
Bucklog SARL |
FR |
0 |
| canary-farm-1 |
34.124.231.201 |
374 |
74 |
223 |
10-10 04:05 |
10-10 04:05 |
- |
Google LLC |
SG |
36 |
| lauterbourg-01-ts |
172.104.241.92 |
213 |
28 |
183 |
10-09 05:31 |
10-09 05:32 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
DE |
1 |
| control-1 |
185.177.72.38 |
188 |
19 |
76 |
10-09 05:25 |
10-09 05:30 |
ipsum:4 firehol2 |
Bucklog SARL |
FR |
0 |
| lauterbourg-01-ts |
185.177.72.205 |
188 |
8 |
76 |
10-10 06:07 |
10-10 06:12 |
ipsum:2 firehol2 |
Bucklog SARL |
FR |
0 |
| ai-devbox-1 |
167.86.124.4 |
183 |
2 |
3 |
10-09 13:57 |
10-09 13:57 |
- |
Contabo GmbH |
FR |
0 |
| control-1 |
104.248.163.59 |
144 |
2 |
142 |
10-09 21:55 |
10-09 21:55 |
- |
DigitalOcean, LLC |
GB |
0 |
| ai-devbox-1 |
144.126.227.243 |
144 |
2 |
142 |
10-09 15:19 |
10-09 15:19 |
- |
DigitalOcean, LLC |
GB |
0 |
| ai-devbox-1 |
178.128.169.110 |
144 |
2 |
142 |
10-09 04:21 |
10-09 04:21 |
- |
DigitalOcean, LLC |
GB |
0 |
| lauterbourg-01-ts |
172.105.76.7 |
125 |
19 |
99 |
10-09 18:17 |
10-09 18:24 |
- |
Akamai Connected Cloud |
DE |
4 |
| frantech-ts |
45.138.12.51 |
88 |
3 |
85 |
10-09 23:11 |
10-09 23:11 |
- |
Tc Datacenter Limited |
LT |
0 |
| sponge-01-ts |
45.138.12.51 |
88 |
3 |
85 |
10-09 09:07 |
10-09 09:07 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
19 |
16 |
| control-1 |
6 |
6 |
| canary-farm-1 |
60 |
16 |
| ru-edge-1 |
14 |
9 |
Mint failures (24h): control-1:400x1; ai-devbox-1:400x9; canary-farm-1:400x7
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
60 |
| ai-devbox-1 |
["aws"] |
19 |
| control-1 |
["aws"] |
6 |
| ru-edge-1 |
["aws"] |
14 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 3385
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1815
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1652 |
| ai-devbox-1 |
https |
477 |
| canary-farm-1 |
http |
1055 |
| canary-farm-1 |
https |
875 |
| control-1 |
http |
4416 |
| frantech-ts |
http |
14026 |
| lauterbourg-01-ts |
http |
1349 |
| lauterbourg-01-ts |
https |
218 |
| netcup-ts |
http |
393 |
| ru-edge-1 |
http |
2262 |
| sponge-01-ts |
http |
625 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14016 |
| control-1 |
38.54.2.209 |
4405 |
| ru-edge-1 |
130.94.89.46 |
2256 |
| canary-farm-1 |
sso.rightabouteverything.show |
1308 |
| ai-devbox-1 |
217.15.163.226 |
1075 |
| ai-devbox-1 |
inference.fapthropic.com |
1046 |
| lauterbourg-01-ts |
89.116.25.211 |
848 |
| canary-farm-1 |
109.123.246.142 |
615 |
| sponge-01-ts |
89.167.72.144 |
610 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
428 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (27 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
| 2026-09-27 |
3455 |
105 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
87.120.104.29 |
140 |
/env [actuator-env] → /.env.yaml [env-production] → /.env.old~ [env-production] → /.env_old [env-production] → /.env.toml [env-production] → /.env.yml [env-production] → /.docker/.env [env-production] → /.env.bak~ [env-production] → /docker/compose/withMongo/.env [tarpit-module] → /docker/compose/.env [env-production] → /app/.env [env-production] → /.env.txt [env-production] |
Sino Worldwide Trading Limit |
NO |
| control-1 |
185.177.72.100 |
102 |
/.gitconfig [gitconfig] → /airflow/ [not-handled] → /ansible/ [not-handled] → /api/actuator/health/elasticsearch [not-handled] → /storage/logs/laravel-2023-01-01.log [not-handled] → /config.js [webapp-config-bundle-js] → /_nodes/ [not-handled] → /gcp-credentials.json [gcp-credentials-json] → /actuator/shutdown [not-handled] → /admin/flyway.json [not-handled] → /server/specs [not-handled] → /.env.prod [env-production] |
Bucklog SARL |
FR |
| canary-farm-1 |
34.124.231.201 |
74 |
/ [tarpit-module] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /nbl5g4g3zns0q07ly6c9 [not-handled] → /mzgha3lfr2sii79pdq2k [not-handled] → /graphql [graphql-introspection] → /.npmrc [npmrc-error] → /.htpasswd [htpasswd-error] → /.env [issued] → /proc/self/environ [proc-environ] → /wp-json [wp-rest-index] → /api/graphql [graphql-introspection] → /.ssh/id_rsa [ssh-private-key-error] |
Google LLC |
SG |
| canary-farm-1 |
167.99.182.39 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| lauterbourg-01-ts |
172.104.241.92 |
28 |
/ [kiteworks-root-redirect] → /sdk [not-handled] → /health [observability-health] → /nmaplowercheck1791523910 [not-handled] → /vpn/js/rdx/core/lang/rdx_en.json.gz [citrix-rdx-lang] → /login [kiteworks-shell] → /evox/about [not-handled] → /human.aspx [not-handled] → /api/v2/about [nextjs-api] → /webui [not-handled] → /CFIDE/componentutils/ [coldfusion-componentutils] → /login.php [webshell-sweep-observed] |
Akamai Connected Cloud |
DE |
| canary-farm-1 |
157.245.105.107 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| ai-devbox-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.226.65.160 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
68.183.180.73 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
146.190.63.248 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| control-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
206.189.225.181 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 532 sources sent credentials → 405 got a shell (76%) → 292 ran a command (72% of shell-getters, 55% of sources)
- event level: 20359 credential attempts → 4510 accepted logins → 8584 commands (190% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 730 attempts
New commands this window (0 of 63 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1166 |
14 |
109.160.32.103 |
"uname -m | awk '{printf $1}'" |
| 1166 |
14 |
109.160.32.103 |
"uname -s -v -n -r -m" |
| 1158 |
227 |
106.12.178.108 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1008 |
202 |
106.12.178.108 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 445 |
2 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 445 |
2 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 445 |
2 |
195.178.110.218 |
"uptime -p" |
| 445 |
2 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
Credentials: 13917 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1106 |
345gs5662d34 |
345gs5662d34 |
| 838 |
root |
3245gs5662d34 |
| 79 |
root |
123456 |
| 55 |
admin |
3245gs5662d34 |
| 54 |
user |
wasd |
| 50 |
pi |
raspberry |
| 39 |
ubuntu |
3245gs5662d34 |
| 34 |
user |
3245gs5662d34 |