flux fleet digest — 2026-10-16 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1822 |
171 |
1964 |
151 |
-7% |
| canary-farm-1 |
2453 |
166 |
2308 |
197 |
+6% |
| control-1 |
5453 |
133 |
3381 |
112 |
+61% |
| frantech-ts |
14423 |
91 |
14734 |
81 |
-2% |
| lauterbourg-01-ts |
1111 |
149 |
1694 |
149 |
-34% |
| netcup-ts |
4548 |
144 |
2388 |
95 |
+90% |
| ru-edge-1 |
1438 |
128 |
1727 |
110 |
-17% |
| sponge-01-ts |
4121 |
116 |
2128 |
95 |
+94% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
phpinfo |
57 |
10.1 |
5.6x |
| ai-devbox-1 |
webshell-probe |
68 |
7.5 |
9.1x |
| canary-farm-1 |
phpinfo |
60 |
14.3 |
4.2x |
| canary-farm-1 |
webshell-probe |
68 |
12.0 |
5.7x |
| control-1 |
docker-registry-manifest |
45 |
15.0 |
3.0x |
| control-1 |
docker-registry-tags |
45 |
15.0 |
3.0x |
| control-1 |
env-production |
314 |
92.0 |
3.4x |
| control-1 |
env-production-error |
80 |
19.0 |
4.2x |
| control-1 |
phpinfo |
74 |
8.9 |
8.4x |
| control-1 |
phpinfo-error |
59 |
8.0 |
7.4x |
| control-1 |
sftp-config-error |
38 |
4.1 |
9.2x |
| control-1 |
webshell-probe |
146 |
5.5 |
26.5x |
| frantech-ts |
docker-registry-manifest |
25 |
7.9 |
3.2x |
| frantech-ts |
docker-registry-tags |
25 |
7.9 |
3.2x |
| frantech-ts |
phpmyadmin-login |
155 |
27.7 |
5.6x |
| ru-edge-1 |
docker-registry-manifest |
45 |
15.0 |
3.0x |
| ru-edge-1 |
docker-registry-tags |
45 |
15.0 |
3.0x |
| ru-edge-1 |
env-production-error |
38 |
0.0 |
infx |
| sponge-01-ts |
docker-registry-manifest |
25 |
7.9 |
3.2x |
| sponge-01-ts |
docker-registry-tags |
25 |
7.9 |
3.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
93 |
643 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
14 |
42 |
ai-devbox-1 |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| c540fc530a5a ⟳ |
8 |
312 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 218630667b2c ⟳ |
7 |
299 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| ef1ab74f3d57 ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 4b4cc0ece037 ⟳ |
7 |
48 |
ai-devbox-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 09d3f351065c ⟳ |
7 |
56 |
ai-devbox-1 |
10-14 |
/wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-admin/profile.php [wp-admin-redirect] → /wp-login.php [wp-login-probe] → /wp-admin/ [wp-admin-redirect] → /wp-login.php [wp- |
| 7e61a9500d8b ⟳ |
6 |
294 |
ai-devbox-1,canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| lauterbourg-01-ts |
/mifs/user/login.jsp |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/js/about.js.map |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/main.js.map |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/actuator/env |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/api/config |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/static/js/signin.be1602a3.js.map |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/actuator/env/BREVO_SMTP_KEY |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/static/js/static/js/2911.01c6029c.js |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/static/js/static/js/2803.497076c1.js |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/fluentform/readme.txt |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/wpvivid-backuprestore/readme.txt |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/wp-content/plugins/premium-addons-for-elementor/readme.txt |
2026-10-16 03:16:08.944960-04:00 |
| netcup-ts |
/pl/ |
2026-10-16 03:16:08.944960-04:00 |
| control-1 |
/�admin/�server_info.php |
2026-10-16 03:16:08.944960-04:00 |
| control-1 |
/�secret.txt |
2026-10-16 03:16:08.944960-04:00 |
| control-1 |
/�emails/�ses.js |
2026-10-16 03:16:08.944960-04:00 |
| netcup-ts |
/wp-content/plugins/metform/readme.txt |
2026-10-16 03:16:08.944960-04:00 |
| canary-farm-1 |
/wp-content/plugins/popup-maker/readme.txt |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/static/js/vendors~main.chunk.js.map |
2026-10-16 03:16:08.944960-04:00 |
| lauterbourg-01-ts |
/apis |
2026-10-16 03:16:08.944960-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-16 03:31:06.613656-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/201 |
2026-10-16 03:16:09.051022-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, |
2026-10-16 03:16:09.051022-04:00 |
| canary-farm-1 |
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Tr |
2026-10-16 03:16:09.051022-04:00 |
| netcup-ts |
Mozilla/5.0 (iPad; CPU OS 12_4 like Mac OS X) AppleWebKit/60 |
2026-10-16 03:16:09.051022-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTM |
2026-10-16 03:16:09.051022-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20 |
2026-10-16 03:16:09.051022-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-16 03:16:09.051022-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-16 03:16:09.051022-04:00 |
| netcup-ts |
Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML |
2026-10-16 03:16:09.051022-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.116.20 |
13606 |
5 |
13606 |
10-16 00:12 |
10-16 00:13 |
- |
tzulo, inc. |
US |
0 |
| netcup-ts |
185.73.23.162 |
2556 |
3 |
24 |
10-15 08:18 |
10-16 06:10 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2170 |
3 |
20 |
10-15 08:19 |
10-16 06:05 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
2066 |
2 |
578 |
10-15 03:34 |
10-16 06:11 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.161 |
1163 |
3 |
8 |
10-15 14:59 |
10-16 06:11 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
1090 |
2 |
8 |
10-15 14:56 |
10-16 04:07 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
45.148.10.238 |
757 |
26 |
370 |
10-15 11:55 |
10-15 11:57 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
5 |
| ru-edge-1 |
141.255.162.237 |
537 |
2 |
537 |
10-15 05:53 |
10-15 05:54 |
- |
Private Layer INC |
CH |
0 |
| canary-farm-1 |
102.220.163.155 |
514 |
34 |
511 |
10-15 12:37 |
10-15 12:45 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.163.155 |
514 |
34 |
511 |
10-15 10:21 |
10-15 12:10 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
93.123.109.226 |
514 |
34 |
510 |
10-15 22:07 |
10-15 22:09 |
- |
Techoff Srv Limited |
BG |
0 |
| control-1 |
102.220.163.155 |
514 |
34 |
511 |
10-15 13:10 |
10-15 13:21 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
79.124.58.82 |
450 |
106 |
450 |
10-15 11:00 |
10-15 11:00 |
- |
Tamatiya EOOD |
BG |
0 |
| lauterbourg-01-ts |
176.123.5.6 |
305 |
19 |
252 |
10-15 15:26 |
10-15 15:26 |
- |
Alexhost Srl |
MD |
0 |
| canary-farm-1 |
169.58.99.248 |
152 |
2 |
2 |
10-16 01:05 |
10-16 01:05 |
- |
Contabo GmbH |
FR |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
7 |
6 |
| control-1 |
12 |
10 |
| ru-edge-1 |
9 |
8 |
| canary-farm-1 |
13 |
9 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x4; control-1:400x7; canary-farm-1:400x10; ru-edge-1:400x7
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
7 |
| ru-edge-1 |
["aws"] |
9 |
| canary-farm-1 |
["aws"] |
13 |
| control-1 |
["aws"] |
12 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 822
- multi-entry XFF (forged chains — no proxy appends on the direct path): 25
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 26
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1179 |
| ai-devbox-1 |
https |
643 |
| canary-farm-1 |
http |
2342 |
| canary-farm-1 |
https |
111 |
| control-1 |
http |
5453 |
| frantech-ts |
http |
14423 |
| lauterbourg-01-ts |
http |
1069 |
| lauterbourg-01-ts |
https |
42 |
| netcup-ts |
http |
4548 |
| ru-edge-1 |
http |
1438 |
| sponge-01-ts |
http |
4121 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14414 |
| control-1 |
38.54.2.209 |
5437 |
| canary-farm-1 |
109.123.246.142 |
2251 |
| ru-edge-1 |
130.94.89.46 |
1431 |
| ai-devbox-1 |
217.15.163.226 |
1067 |
| lauterbourg-01-ts |
89.116.25.211 |
1019 |
| sponge-01-ts |
89.167.72.144 |
848 |
| netcup-ts |
159.195.21.150 |
823 |
| ai-devbox-1 |
inference.fapthropic.com |
747 |
| canary-farm-1 |
sso.rightabouteverything.show |
189 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (33 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
79.124.58.82 |
106 |
/.git/HEAD [fake-git] → /.env.bak [env-production] → /.env~ [env-production] → /.ssh/id_rsa [ssh-private-key-error] → /config.js [webapp-config-bundle-js] → /wp-config.old [wp-config] → /.ssh/id_dsa [ssh-private-key-error] → /config/app.php [app-config-php-services] → /.npmrc [npmrc-error] → /.travis.yml [generic-ci-config] → /composer.lock [composer-lock-error] → /instance/config.py [app-config-python] |
Tamatiya EOOD |
BG |
| control-1 |
93.123.109.226 |
34 |
/ [tarpit-module] → /pscan-098b4e0f-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] → /config/.env [env-production-error] |
Techoff Srv Limited |
BG |
| control-1 |
102.220.163.155 |
34 |
/ [tarpit-module] → /pscan-5a38ec3f-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
102.220.163.155 |
34 |
/ [tarpit-module] → /pscan-d36413a6-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.163.155 |
34 |
/ [tarpit-module] → /pscan-d1df6c2b-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
165.22.34.189 |
28 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
146.190.63.248 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
146.190.103.103 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
209.38.248.17 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
46.101.1.225 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| control-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 444 sources sent credentials → 340 got a shell (77%) → 268 ran a command (79% of shell-getters, 60% of sources)
- event level: 26822 credential attempts → 3819 accepted logins → 4791 commands (125% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 5292 attempts
New commands this window (0 of 53 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1173 |
224 |
107.174.82.77 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1055 |
204 |
185.233.3.95 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 777 |
13 |
109.160.32.163 |
"uname -m | awk '{printf $1}'" |
| 777 |
13 |
109.160.32.163 |
"uname -s -v -n -r -m" |
| 256 |
7 |
193.32.162.84 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 256 |
7 |
193.32.162.84 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 122 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 122 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 17002 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1126 |
345gs5662d34 |
345gs5662d34 |
| 865 |
root |
3245gs5662d34 |
| 65 |
root |
123456 |
| 61 |
user |
wasd |
| 48 |
pi |
raspberry |
| 38 |
admin |
3245gs5662d34 |
| 35 |
ubuntu |
3245gs5662d34 |
| 29 |
support |
support |