flux fleet digest — 2026-10-13 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1995 |
147 |
1734 |
132 |
+15% |
| canary-farm-1 |
2384 |
226 |
2163 |
164 |
+10% |
| control-1 |
4659 |
109 |
3012 |
127 |
+55% |
| frantech-ts |
15347 |
88 |
14511 |
82 |
+6% |
| lauterbourg-01-ts |
1583 |
130 |
1567 |
151 |
+1% |
| netcup-ts |
3676 |
105 |
1601 |
101 |
+130% |
| ru-edge-1 |
1042 |
119 |
1770 |
122 |
-41% |
| sponge-01-ts |
3324 |
89 |
1190 |
96 |
+179% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
cmd-injection-php-cgi-rce |
27 |
6.8 |
4.0x |
| ai-devbox-1 |
phpunit-eval-stdin |
226 |
51.0 |
4.4x |
| canary-farm-1 |
phpmyadmin-login |
203 |
44.0 |
4.6x |
| control-1 |
config-json |
23 |
7.6 |
3.0x |
| control-1 |
env-production |
211 |
50.3 |
4.2x |
| control-1 |
fake-git |
470 |
82.0 |
5.7x |
| control-1 |
fake-git-miss |
166 |
10.0 |
16.6x |
| control-1 |
phpmyadmin-login |
175 |
39.6 |
4.4x |
| lauterbourg-01-ts |
phpmyadmin-login |
151 |
39.2 |
3.9x |
| netcup-ts |
tarpit-module |
2909 |
881.4 |
3.3x |
| ru-edge-1 |
fake-git |
235 |
11.6 |
20.3x |
| ru-edge-1 |
fake-git-miss |
83 |
2.0 |
41.5x |
| sponge-01-ts |
tarpit-module |
2694 |
764.6 |
3.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
94 |
649 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ed66cc967251 ⟳ |
18 |
72 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
| 7e61a9500d8b ⟳ |
15 |
735 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 218630667b2c ⟳ |
9 |
378 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
4 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| df15d0ee3ccf ⟳ |
3 |
168 |
canary-farm-1,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 721e73e8d123 ⟳ |
3 |
15 |
ai-devbox-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-17 |
/ [method-not-allowed] → / [tarpit-module] → / [method-not-allowed] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/.git/logs/refs/heads/stg |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/logs/refs/heads/sandbox |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/refs/heads/nightly |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/logs/refs/heads/stage |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/logs/refs/heads/demo |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/refs/remotes/origin/stable |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/refs/heads/canary |
2026-10-13 03:16:01.521136-04:00 |
| ru-edge-1 |
/.git/refs/remotes/origin/beta |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/mysql/mysqlmanager/index.php |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/test.env.js |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/config/aws/credentials |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/config/routes.php |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/.git/refs/heads/stage |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/.git/logs/refs/heads/stage |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/.git/logs/refs/remotes/origin/testing |
2026-10-13 03:16:01.521136-04:00 |
| control-1 |
/.git/logs/refs/heads/bugfix |
2026-10-13 03:16:01.521136-04:00 |
| netcup-ts |
/�.environment |
2026-10-13 03:16:01.521136-04:00 |
| frantech-ts |
/console/.env |
2026-10-13 03:16:01.521136-04:00 |
| frantech-ts |
/�crm/�.env |
2026-10-13 03:16:01.521136-04:00 |
| lauterbourg-01-ts |
/.env.jina |
2026-10-13 03:16:01.521136-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| frantech-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) Apple |
2026-10-13 03:16:01.639931-04:00 |
| ai-devbox-1 |
Mozilla/5.0 vpnfinder |
2026-10-13 03:16:01.639931-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/ |
2026-10-13 03:16:01.639931-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-13 03:16:01.639931-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/ |
2026-10-13 03:16:01.639931-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-13 03:16:01.639931-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-13 03:16:01.639931-04:00 |
| canary-farm-1 |
Mozilla/5.0 Chrome/120 |
2026-10-13 03:16:01.639931-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-13 03:16:01.639931-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-10-13 03:16:01.639931-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.118.20 |
13554 |
5 |
13554 |
10-12 23:56 |
10-12 23:57 |
ipsum:1 |
tzulo, inc. |
US |
0 |
| control-1 |
204.76.203.18 |
2141 |
2 |
579 |
10-12 04:04 |
10-13 06:12 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.162 |
1344 |
3 |
10 |
10-12 12:40 |
10-13 02:38 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
1272 |
2 |
13 |
10-12 14:14 |
10-13 06:09 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
1153 |
3 |
10 |
10-12 12:41 |
10-13 02:38 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| frantech-ts |
185.177.72.75 |
999 |
5 |
264 |
10-12 21:35 |
10-12 21:41 |
- |
Bucklog SARL |
FR |
15 |
| netcup-ts |
45.148.10.238 |
902 |
5 |
355 |
10-12 19:30 |
10-12 19:33 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
14 |
| control-1 |
102.220.161.139 |
845 |
41 |
559 |
10-12 09:44 |
10-12 16:34 |
- |
VPS Dedicated LLC |
SI |
0 |
| netcup-ts |
185.73.23.161 |
748 |
2 |
9 |
10-13 01:29 |
10-13 06:05 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| canary-farm-1 |
161.118.206.143 |
384 |
84 |
384 |
10-12 18:50 |
10-12 18:52 |
- |
Oracle Corporation |
SG |
0 |
| control-1 |
45.148.10.238 |
370 |
20 |
169 |
10-12 10:16 |
10-13 04:42 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
16 |
| ai-devbox-1 |
102.220.161.139 |
348 |
39 |
337 |
10-12 09:24 |
10-12 16:14 |
- |
VPS Dedicated LLC |
SI |
0 |
| ru-edge-1 |
102.220.161.139 |
321 |
18 |
290 |
10-12 09:25 |
10-12 16:15 |
- |
VPS Dedicated LLC |
SI |
0 |
| lauterbourg-01-ts |
161.118.208.28 |
320 |
5 |
320 |
10-12 15:46 |
10-12 15:48 |
- |
Oracle Corporation |
SG |
0 |
| ai-devbox-1 |
173.249.253.116 |
309 |
22 |
55 |
10-12 23:06 |
10-12 23:13 |
- |
tzulo, inc. |
US |
30 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
27 |
13 |
| control-1 |
15 |
12 |
| canary-farm-1 |
30 |
14 |
| ru-edge-1 |
9 |
8 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
27 |
| canary-farm-1 |
["aws"] |
30 |
| ru-edge-1 |
["aws"] |
9 |
| control-1 |
["aws"] |
15 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1711
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 403
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1580 |
| ai-devbox-1 |
https |
415 |
| canary-farm-1 |
http |
1843 |
| canary-farm-1 |
https |
541 |
| control-1 |
http |
4659 |
| frantech-ts |
http |
15347 |
| lauterbourg-01-ts |
http |
1231 |
| lauterbourg-01-ts |
https |
352 |
| netcup-ts |
http |
3676 |
| ru-edge-1 |
http |
1042 |
| sponge-01-ts |
http |
3324 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
15338 |
| control-1 |
38.54.2.209 |
4635 |
| canary-farm-1 |
109.123.246.142 |
1592 |
| netcup-ts |
159.195.21.150 |
1574 |
| ai-devbox-1 |
217.15.163.226 |
1207 |
| lauterbourg-01-ts |
89.116.25.211 |
1119 |
| ru-edge-1 |
130.94.89.46 |
1032 |
| sponge-01-ts |
89.167.72.144 |
895 |
| canary-farm-1 |
sso.rightabouteverything.show |
784 |
| ai-devbox-1 |
inference.fapthropic.com |
777 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (30 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
| 2026-09-30 |
16554 |
113 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
161.118.206.143 |
84 |
/api/.env [env-production] → /.env [issued] → /robots.txt [tarpit-module] → /sitemap_index.xml [not-handled] → /.env.backup [env-production] → /.env.prod [env-production] → /sitemap.xml [tarpit-module] → /.env.example [env-production] → /.env.sample [env-production] → / [tarpit-module] → /.env.save [env-production] → /.env.orig [env-production] |
Oracle Corporation |
SG |
| control-1 |
168.107.90.53 |
65 |
/.well-known/security.txt [not-handled] → / [tarpit-module] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /index.html [tarpit-module] → /manifest.json [not-handled] → /site.webmanifest [spa-webmanifest] → /.env [issued] → /web/.env [env-production] → /src/.env [env-production] → /deploy/.env [env-production] |
Oracle Corporation |
SG |
| control-1 |
102.220.161.139 |
41 |
/aura-l6uw7esxgbw8mjs2lzdkww3e.txt [not-handled] → /.env [issued] → /admin/.env [env-production] → /.env.prod.local [env-production] → /.env.php [tarpit-module] → /public/.env [env-production] → /.env.project [tarpit-module] → /.env.prod [env-production] → /.env.dev [env-production] → /.env.sample [env-production] → /config/prod.env.js [not-handled] → /production/.env [env-production] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.161.139 |
39 |
/aura-7b4vw1d9psp7uzwlpz0d1mia.txt [not-handled] → /.env.local [env-production] → /.env [issued] → / [tarpit-module] → /.env.production [env-production] → /.env.staging [env-production] → /prod/.env [env-production] → /.env.old [env-production] → /.env~ [env-production] → /.env-ci [tarpit-module] → /.wp-config.php.swp [wp-config] → /prod.env.js [not-handled] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
138.68.144.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ru-edge-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.71.81.114 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
139.59.231.238 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
147.182.200.94 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
167.172.158.128 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
157.245.105.107 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 518 sources sent credentials → 344 got a shell (66%) → 259 ran a command (75% of shell-getters, 50% of sources)
- event level: 10684 credential attempts → 3007 accepted logins → 4742 commands (158% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1274 attempts
New commands this window (0 of 82 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1020 |
203 |
103.143.231.24 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 902 |
191 |
103.143.231.24 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 312 |
8 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 312 |
8 |
92.118.39.71 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 209 |
3 |
45.148.10.240 |
"/bin/./uname -s -v -n -r -m" |
| 209 |
3 |
45.148.10.240 |
"uptime -p" |
| 209 |
3 |
45.148.10.240 |
"lspci | grep VGA -c" |
| 209 |
3 |
45.148.10.240 |
"lspci | grep VGA | cut -f5- -d ' '" |
Credentials: 6501 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 963 |
345gs5662d34 |
345gs5662d34 |
| 754 |
root |
3245gs5662d34 |
| 57 |
root |
123456 |
| 55 |
user |
wasd |
| 44 |
pi |
raspberry |
| 39 |
admin |
3245gs5662d34 |
| 39 |
ubuntu |
3245gs5662d34 |
| 29 |
support |
support |