flux fleet digest — 2026-10-11 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
3473 |
140 |
1456 |
140 |
+138% |
| canary-farm-1 |
4084 |
172 |
1759 |
161 |
+132% |
| control-1 |
1641 |
111 |
3403 |
136 |
-52% |
| frantech-ts |
16160 |
81 |
14131 |
84 |
+14% |
| lauterbourg-01-ts |
1955 |
146 |
1308 |
149 |
+50% |
| netcup-ts |
1006 |
92 |
1755 |
104 |
-43% |
| ru-edge-1 |
992 |
119 |
1778 |
127 |
-44% |
| sponge-01-ts |
585 |
101 |
1475 |
104 |
-60% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
backup-archive |
28 |
0.0 |
infx |
| ai-devbox-1 |
fake-git |
500 |
138.7 |
3.6x |
| ai-devbox-1 |
fake-git-miss |
642 |
83.0 |
7.7x |
| ai-devbox-1 |
not-handled |
867 |
85.3 |
10.2x |
| canary-farm-1 |
config-json |
32 |
9.7 |
3.3x |
| canary-farm-1 |
env-production |
99 |
29.8 |
3.3x |
| canary-farm-1 |
fake-git |
492 |
123.1 |
4.0x |
| canary-farm-1 |
fake-git-miss |
668 |
0.0 |
infx |
| canary-farm-1 |
not-handled |
920 |
87.1 |
10.6x |
| canary-farm-1 |
webapp-form-profile |
21 |
5.3 |
3.9x |
| canary-farm-1 |
wp-xmlrpc-post |
20 |
6.4 |
3.1x |
| control-1 |
backup-archive |
40 |
11.3 |
3.5x |
| frantech-ts |
tarpit-module |
1414 |
266.4 |
5.3x |
| frantech-ts |
webshell-probe |
34 |
7.2 |
4.7x |
| lauterbourg-01-ts |
phpmyadmin-login |
182 |
4.3 |
42.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
80 |
559 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
23 |
161 |
control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| ed66cc967251 ⟳ |
21 |
84 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 9609f17ada17 |
9 |
216 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-11 |
/rest/api/2/serverInfo [not-handled] → /rest/api/serverInformation [not-handled] → /rest/api/latest/server [not-handled] → /status [not-handled] → /s/1/_/download/resources/com.atlassian.confluence.pl |
| 2bdde2df2cf6 ⟳ |
6 |
48 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
10-05 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credent |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 75df0dbb0841 ⟳ |
5 |
30 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
10-10 |
/wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp |
| 7e61a9500d8b ⟳ |
5 |
245 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::META-INF/MANIFEST.MF |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::META-INF/context.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::WEB-INF/urlrewrite.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::WEB-INF/decorators.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF::spring.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF/classes/atlassian-user.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::WEB-INF::spring.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF/classes/log4j2.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF/classes/dbcp.properties |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF::classes::osuser.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF/classes/confluence-plugins.properties |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF/classes/ehcache.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::WEB-INF/classes/log4j2.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::classes::log4j2.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::classes::ehcache-core.xml |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::..::WEB-INF::classes::build.properties |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/.git/objects/52/43000000020000000000000000000000000000 |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/config/secrets.yml/.git/config |
2026-10-11 03:16:05.581452-04:00 |
| canary-farm-1 |
/config/database.yml/.git/config |
2026-10-11 03:16:05.581452-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT |
2026-10-11 03:31:09.292494-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Geck |
2026-10-11 03:16:05.697340-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0.0.0 |
2026-10-11 03:16:05.697340-04:00 |
| ai-devbox-1 |
git/2.47.3 |
2026-10-11 03:16:05.697340-04:00 |
| netcup-ts |
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR |
2026-10-11 03:16:05.697340-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/5 |
2026-10-11 03:16:05.697340-04:00 |
| control-1 |
WebSiphon/next-0.1 |
2026-10-11 03:16:05.697340-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-11 03:16:05.697340-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-11 03:16:05.697340-04:00 |
| canary-farm-1 |
node |
2026-10-11 03:16:05.697340-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.118.20 |
13502 |
5 |
13502 |
10-11 00:15 |
10-11 00:16 |
ipsum:1 |
tzulo, inc. |
US |
0 |
| frantech-ts |
185.177.72.75 |
1819 |
9 |
644 |
10-10 08:04 |
10-10 08:09 |
- |
Bucklog SARL |
FR |
6 |
| canary-farm-1 |
209.159.155.142 |
1400 |
44 |
396 |
10-11 01:40 |
10-11 02:13 |
- |
Interserver, Inc |
US |
0 |
| ai-devbox-1 |
209.159.155.142 |
1365 |
44 |
396 |
10-11 02:12 |
10-11 02:15 |
- |
Interserver, Inc |
US |
0 |
| canary-farm-1 |
87.120.204.145 |
694 |
1 |
331 |
10-10 14:31 |
10-10 15:28 |
- |
G-Core Labs S.A. |
JP |
0 |
| ai-devbox-1 |
87.120.204.145 |
694 |
1 |
331 |
10-10 14:31 |
10-10 15:28 |
- |
G-Core Labs S.A. |
JP |
0 |
| control-1 |
204.76.203.18 |
413 |
2 |
406 |
10-11 01:49 |
10-11 06:09 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
34.124.231.201 |
374 |
74 |
223 |
10-10 04:05 |
10-10 04:05 |
- |
Google LLC |
SG |
36 |
| netcup-ts |
213.209.159.154 |
326 |
6 |
322 |
10-10 19:04 |
10-10 19:04 |
- |
Feo Prest SRL |
DE |
0 |
| frantech-ts |
79.124.58.82 |
300 |
5 |
150 |
10-10 16:40 |
10-10 16:40 |
- |
Tamatiya EOOD |
BG |
0 |
| canary-farm-1 |
146.235.22.78 |
239 |
65 |
239 |
10-11 04:53 |
10-11 04:54 |
- |
Oracle Corporation |
SG |
0 |
| ru-edge-1 |
161.118.198.110 |
239 |
65 |
239 |
10-11 06:10 |
10-11 06:11 |
- |
Oracle Corporation |
SG |
0 |
| lauterbourg-01-ts |
161.118.211.119 |
239 |
3 |
239 |
10-11 03:13 |
10-11 03:13 |
- |
Oracle Corporation |
SG |
0 |
| control-1 |
146.235.16.170 |
239 |
65 |
239 |
10-10 22:50 |
10-10 22:50 |
- |
Oracle Corporation |
SG |
0 |
| lauterbourg-01-ts |
172.234.162.31 |
231 |
29 |
194 |
10-11 05:22 |
10-11 05:23 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
FR |
1 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
10 |
7 |
| ai-devbox-1 |
18 |
9 |
| ru-edge-1 |
4 |
4 |
| canary-farm-1 |
64 |
15 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
18 |
| canary-farm-1 |
["aws"] |
64 |
| control-1 |
["aws"] |
10 |
| ru-edge-1 |
["aws"] |
4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 3610
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 198
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 4
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2103 |
| ai-devbox-1 |
https |
1370 |
| canary-farm-1 |
http |
2308 |
| canary-farm-1 |
https |
1776 |
| control-1 |
http |
1639 |
| control-1 |
https |
2 |
| frantech-ts |
http |
16160 |
| lauterbourg-01-ts |
http |
1692 |
| lauterbourg-01-ts |
https |
263 |
| netcup-ts |
http |
1006 |
| ru-edge-1 |
http |
992 |
| sponge-01-ts |
http |
585 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
16152 |
| canary-farm-1 |
sso.rightabouteverything.show |
3071 |
| ai-devbox-1 |
inference.fapthropic.com |
2626 |
| control-1 |
38.54.2.209 |
1621 |
| lauterbourg-01-ts |
89.116.25.211 |
1230 |
| netcup-ts |
159.195.21.150 |
989 |
| canary-farm-1 |
109.123.246.142 |
987 |
| ru-edge-1 |
130.94.89.46 |
986 |
| ai-devbox-1 |
217.15.163.226 |
703 |
| sponge-01-ts |
89.167.72.144 |
576 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (28 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
| 2026-09-29 |
3336 |
107 |
| 2026-09-28 |
2863 |
84 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
34.124.231.201 |
74 |
/ [tarpit-module] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /nbl5g4g3zns0q07ly6c9 [not-handled] → /mzgha3lfr2sii79pdq2k [not-handled] → /graphql [graphql-introspection] → /.npmrc [npmrc-error] → /.htpasswd [htpasswd-error] → /.env [issued] → /proc/self/environ [proc-environ] → /wp-json [wp-rest-index] → /api/graphql [graphql-introspection] → /.ssh/id_rsa [ssh-private-key-error] |
Google LLC |
SG |
| control-1 |
146.235.16.170 |
65 |
/index.html [tarpit-module] → /.env.local [env-production] → /sitemap_index.xml [not-handled] → /.env.old [env-production] → /robots.txt [tarpit-module] → /.env.test [env-production] → /.env.prod [env-production] → /site.webmanifest [spa-webmanifest] → / [tarpit-module] → /.env.bak [env-production] → /manifest.json [not-handled] → /.well-known/security.txt [not-handled] |
Oracle Corporation |
SG |
| canary-farm-1 |
146.235.22.78 |
65 |
/.well-known/security.txt [not-handled] → /index.html [tarpit-module] → /site.webmanifest [spa-webmanifest] → /.env [issued] → /.env.development.local [env-production] → /.env.production.local [env-production] → /.env.local [env-production] → /.env.test [env-production] → /.env.sample [env-production] → /.env.dev [env-production] → / [tarpit-module] → /docker/.env [env-production] |
Oracle Corporation |
SG |
| ru-edge-1 |
161.118.198.110 |
65 |
/sitemap_index.xml [not-handled] → / [tarpit-module] → /.env.bak [env-production] → /.env.production.local [env-production] → /.env.backup [env-production] → /public/.env [env-production] → /backend/.env [env-production] → /.env.local [env-production] → /.env.orig [env-production] → /app/.env [env-production] → /manifest.json [not-handled] → /.well-known/security.txt [not-handled] |
Oracle Corporation |
SG |
| canary-farm-1 |
209.159.155.142 |
44 |
/.git/config [fake-git] → /.git/HEAD [fake-git] → /.git/refs/heads/main [fake-git] → /.git/hooks/pre-commit [fake-git-miss] → /.git/hooks/post-commit [fake-git-miss] → /.git/hooks/pre-push [fake-git-miss] → /.git/hooks/post-checkout [fake-git-miss] → /.git/hooks/post-merge [fake-git-miss] → /.git/hooks/post-rewrite [fake-git-miss] → /.git/hooks/pre-rebase [fake-git-miss] → /.git/hooks/post-update [fake-git-miss] → /.git/hooks/pre-auto-gc [fake-git-miss] |
Interserver, Inc |
US |
| ai-devbox-1 |
209.159.155.142 |
44 |
/.git/config [fake-git] → /.git/HEAD [fake-git] → /.git/refs/heads/main [fake-git] → /.git/hooks/pre-commit [fake-git-miss] → /.git/hooks/post-commit [fake-git-miss] → /.git/hooks/pre-push [fake-git-miss] → /.git/hooks/post-checkout [fake-git-miss] → /.git/hooks/post-merge [fake-git-miss] → /.git/hooks/post-rewrite [fake-git-miss] → /.git/hooks/pre-rebase [fake-git-miss] → /.git/hooks/post-update [fake-git-miss] → /.git/hooks/pre-auto-gc [fake-git-miss] |
Interserver, Inc |
US |
| lauterbourg-01-ts |
172.234.162.31 |
29 |
/ [kiteworks-root-redirect] → /vpn/js/rdx/core/lang/rdx_en.json.gz [citrix-rdx-lang] → /nmaplowercheck1791696160 [not-handled] → /cgi-mod/header_logo.cgi [not-handled] → /sdk [not-handled] → /health [observability-health] → /default.jsa [not-handled] → /login [kiteworks-shell] → /evox/about [not-handled] → /favicon.ico [tarpit-module] → /index.cfm [not-handled] → /CFIDE/componentutils/ [coldfusion-componentutils] |
Akamai Connected Cloud |
FR |
| ru-edge-1 |
164.90.228.79 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
206.189.233.36 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
138.197.191.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
165.227.39.235 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 541 sources sent credentials → 404 got a shell (75%) → 328 ran a command (81% of shell-getters, 61% of sources)
- event level: 21864 credential attempts → 3940 accepted logins → 5899 commands (150% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 866 attempts
New commands this window (0 of 56 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1335 |
8 |
109.160.32.169 |
"uname -m | awk '{printf $1}'" |
| 1335 |
8 |
109.160.32.169 |
"uname -s -v -n -r -m" |
| 994 |
227 |
129.121.139.209 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 858 |
204 |
129.121.139.209 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 146 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 146 |
6 |
80.94.92.55 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 115 |
79 |
144.48.118.52 |
"uname -a" |
| 95 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 14430 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 942 |
345gs5662d34 |
345gs5662d34 |
| 715 |
root |
3245gs5662d34 |
| 57 |
pi |
raspberry |
| 45 |
user |
wasd |
| 43 |
root |
123456 |
| 41 |
ubuntu |
3245gs5662d34 |
| 39 |
admin |
3245gs5662d34 |
| 29 |
support |
support |