flux fleet digest — 2026-10-15 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2475 |
162 |
1810 |
145 |
+37% |
| canary-farm-1 |
1435 |
168 |
2502 |
194 |
-43% |
| control-1 |
3148 |
110 |
3411 |
118 |
-8% |
| frantech-ts |
14386 |
96 |
14686 |
79 |
-2% |
| lauterbourg-01-ts |
1260 |
146 |
1708 |
149 |
-26% |
| netcup-ts |
4391 |
100 |
2022 |
96 |
+117% |
| ru-edge-1 |
1337 |
118 |
1680 |
113 |
-20% |
| sponge-01-ts |
4674 |
89 |
1698 |
97 |
+175% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
env-production |
229 |
66.9 |
3.4x |
| ai-devbox-1 |
phpmyadmin-login |
164 |
52.1 |
3.1x |
| ai-devbox-1 |
ssh-private-key-error |
22 |
4.0 |
5.5x |
| ai-devbox-1 |
wp-config |
20 |
6.2 |
3.2x |
| control-1 |
ssh-private-key-error |
27 |
6.0 |
4.5x |
| lauterbourg-01-ts |
phpmyadmin-login |
306 |
93.0 |
3.3x |
| lauterbourg-01-ts |
wp-xmlrpc-post |
60 |
0.0 |
infx |
| sponge-01-ts |
llm-endpoint-openai-chat |
90 |
0.0 |
infx |
| sponge-01-ts |
tarpit-module |
3718 |
1192.6 |
3.1x |
| sponge-01-ts |
webshell-probe |
84 |
5.0 |
16.8x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
94 |
654 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
38 |
114 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ |
13 |
637 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
9 |
441 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 1cf777711bea ⟳ |
7 |
56 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 4b4cc0ece037 ⟳ |
6 |
39 |
ru-edge-1 |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ |
5 |
205 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| sponge-01-ts |
/acme/.env |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/admin/.env.staging |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/app_nginx_static_path/.env |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/config.inc.old |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/config.bak |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/settings.php.old |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/config.inc.bak |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/dashboard/admin/info.php |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/.jupyter/jupyter_notebook_config.json |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/settings/.vscode/ftp-sync.json |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/login/.ftpconfig |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/wp-config - Copy.php |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/wp-config-sample.php~ |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/wp-config.0 |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/wp-config.ORG |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/.production |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/test_info2.php |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/tester.php |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/info/info.php |
2026-10-15 03:15:40.162333-04:00 |
| sponge-01-ts |
/a.php |
2026-10-15 03:15:40.162333-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/200 |
2026-10-15 03:15:40.439037-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:91.0) Gecko/2010 |
2026-10-15 03:15:40.439037-04:00 |
| frantech-ts |
Mozilla/5.0 Mozilla/5.0 (Windows NT 6.0; rv:24.0) Gecko/2016 |
2026-10-15 03:15:40.439037-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:89.0) Gecko/2010 |
2026-10-15 03:15:40.439037-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/ |
2026-10-15 03:15:40.439037-04:00 |
| ru-edge-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-15 03:15:40.439037-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-15 03:15:40.439037-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 |
2026-10-15 03:15:40.439037-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-15 03:15:40.439037-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-15 03:15:40.439037-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
176.119.150.64 |
13583 |
5 |
13583 |
10-15 01:26 |
10-15 01:28 |
- |
Owl Limited |
DE |
0 |
| netcup-ts |
185.73.23.162 |
2141 |
3 |
11 |
10-14 03:34 |
10-14 22:37 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2038 |
3 |
8 |
10-14 03:37 |
10-14 22:37 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
1944 |
2 |
579 |
10-14 03:36 |
10-15 05:15 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| sponge-01-ts |
185.73.23.161 |
1274 |
2 |
4 |
10-14 09:15 |
10-15 01:12 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
45.148.10.238 |
836 |
5 |
373 |
10-14 21:14 |
10-14 21:19 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
13 |
| netcup-ts |
185.73.23.161 |
819 |
2 |
8 |
10-14 09:34 |
10-15 02:47 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ru-edge-1 |
141.255.162.237 |
537 |
2 |
537 |
10-15 05:53 |
10-15 05:54 |
- |
Private Layer INC |
CH |
0 |
| sponge-01-ts |
93.123.109.226 |
514 |
5 |
510 |
10-14 10:23 |
10-14 10:23 |
- |
Techoff Srv Limited |
BG |
0 |
| ai-devbox-1 |
79.124.58.82 |
466 |
104 |
403 |
10-14 18:50 |
10-14 18:50 |
- |
Tamatiya EOOD |
BG |
0 |
| control-1 |
79.124.58.82 |
450 |
106 |
450 |
10-15 02:22 |
10-15 02:22 |
- |
Tamatiya EOOD |
BG |
0 |
| lauterbourg-01-ts |
185.177.72.64 |
258 |
7 |
254 |
10-14 04:54 |
10-14 04:56 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| ai-devbox-1 |
194.59.31.39 |
240 |
23 |
105 |
10-14 13:54 |
10-14 19:54 |
- |
12651980 CANADA INC. |
FR |
0 |
| canary-farm-1 |
103.214.20.135 |
196 |
22 |
55 |
10-14 04:15 |
10-14 05:25 |
- |
Host Universal Pty Ltd |
AU |
20 |
| lauterbourg-01-ts |
185.205.222.77 |
154 |
2 |
4 |
10-14 17:52 |
10-14 17:52 |
- |
PT Industri Kreatif Digital |
ID |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
22 |
11 |
| control-1 |
14 |
9 |
| canary-farm-1 |
12 |
8 |
| ru-edge-1 |
7 |
6 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
12 |
| ai-devbox-1 |
["aws"] |
22 |
| control-1 |
["aws"] |
14 |
| ru-edge-1 |
["aws"] |
7 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1088
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 8
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1622 |
| ai-devbox-1 |
https |
853 |
| canary-farm-1 |
http |
1257 |
| canary-farm-1 |
https |
178 |
| control-1 |
http |
3148 |
| frantech-ts |
http |
14386 |
| lauterbourg-01-ts |
http |
1211 |
| lauterbourg-01-ts |
https |
49 |
| netcup-ts |
http |
4391 |
| ru-edge-1 |
http |
1337 |
| sponge-01-ts |
http |
4674 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14373 |
| control-1 |
38.54.2.209 |
3129 |
| ai-devbox-1 |
217.15.163.226 |
1512 |
| netcup-ts |
159.195.21.150 |
1424 |
| sponge-01-ts |
89.167.72.144 |
1353 |
| ru-edge-1 |
130.94.89.46 |
1330 |
| lauterbourg-01-ts |
89.116.25.211 |
1083 |
| canary-farm-1 |
109.123.246.142 |
1059 |
| ai-devbox-1 |
inference.fapthropic.com |
937 |
| canary-farm-1 |
sso.rightabouteverything.show |
360 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (32 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
79.124.58.82 |
106 |
/.htpasswd [htpasswd-error] → /docker-compose.override.yml [docker-compose] → /local_settings.py [app-config-python] → /.ssh/authorized_keys [authorized-keys-error] → /.env.production.local [env-production] → /.env.development [env-production] → /.env.production [env-production] → /.env.test [env-production] → /.env.local [env-production] → /.env [issued] → /.htaccess [not-handled] → /django/settings.py [app-config-python] |
Tamatiya EOOD |
BG |
| ai-devbox-1 |
79.124.58.82 |
104 |
/docker/compose/withRedis/.env [tarpit-module] → /config.js [webapp-config-bundle-js] → /.npmrc [npmrc-error] → /docker/compose/.env [env-production] → /.aws/credentials [aws-credentials-file] → /docker-compose.yaml [docker-compose] → /config/settings.py [app-config-python] → /docker-compose.yml [docker-compose] → /configuration.php [app-config-php] → /.aws/config [aws-config-file] → /docker-compose.override.yml [docker-compose] → /docker/compose/withMySQL/.env [tarpit-module] |
Tamatiya EOOD |
BG |
| canary-farm-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
138.68.86.32 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
134.122.28.88 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
164.92.107.174 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
157.245.105.107 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| control-1 |
139.59.231.238 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
128.199.182.152 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| control-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 543 sources sent credentials → 410 got a shell (76%) → 328 ran a command (80% of shell-getters, 60% of sources)
- event level: 19362 credential attempts → 3180 accepted logins → 3656 commands (115% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 717 attempts
New commands this window (0 of 81 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1200 |
242 |
101.47.155.9 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1054 |
215 |
101.47.155.9 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 172 |
7 |
2.57.122.168 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 172 |
7 |
2.57.122.168 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 152 |
12 |
109.160.32.122 |
"uname -s -v -n -r -m" |
| 152 |
12 |
109.160.32.122 |
"uname -m | awk '{printf $1}'" |
| 113 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 113 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 14314 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1153 |
345gs5662d34 |
345gs5662d34 |
| 865 |
root |
3245gs5662d34 |
| 65 |
pi |
raspberry |
| 56 |
ubuntu |
3245gs5662d34 |
| 52 |
user |
wasd |
| 48 |
root |
123456 |
| 38 |
admin |
3245gs5662d34 |
| 28 |
support |
support |