flux fleet digest — 2026-10-18 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1763 |
222 |
2013 |
158 |
-12% |
| canary-farm-1 |
1943 |
140 |
2402 |
193 |
-19% |
| control-1 |
3050 |
106 |
3469 |
112 |
-12% |
| frantech-ts |
28291 |
88 |
12815 |
83 |
+121% |
| lauterbourg-01-ts |
1247 |
148 |
1610 |
142 |
-23% |
| netcup-ts |
5050 |
88 |
3551 |
101 |
+42% |
| ru-edge-1 |
981 |
108 |
1523 |
113 |
-36% |
| sponge-01-ts |
5346 |
105 |
3201 |
100 |
+67% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-admin-redirect |
42 |
8.8 |
4.8x |
| ai-devbox-1 |
wp-login-credentials |
95 |
31.0 |
3.1x |
| frantech-ts |
phpmyadmin-login |
152 |
24.3 |
6.3x |
| lauterbourg-01-ts |
method-not-allowed |
22 |
5.6 |
3.9x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
75 |
524 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ |
53 |
159 |
ai-devbox-1 |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 4b4cc0ece037 ⟳ |
36 |
255 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 09d3f351065c ⟳ |
15 |
120 |
ai-devbox-1 |
10-14 |
/wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-admin/profile.php [wp-admin-redirect] → /wp-login.php [wp-login-probe] → /wp-admin/ [wp-admin-redirect] → /wp-login.php [wp- |
| b3c6048a4870 ⟳ |
7 |
280 |
lauterbourg-01-ts |
10-10 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-ji |
| 7e61a9500d8b ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 218630667b2c ⟳ |
6 |
252 |
frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/magento/.env |
2026-10-18 03:15:36.537605-04:00 |
| frantech-ts |
/astro/.env |
2026-10-18 03:15:36.537605-04:00 |
| control-1 |
/.netrc |
2026-10-18 03:15:36.537605-04:00 |
| control-1 |
/.netrc |
2026-10-18 03:15:36.537605-04:00 |
| control-1 |
/.git-credentials |
2026-10-18 03:15:36.537605-04:00 |
| control-1 |
/.netrc |
2026-10-18 03:15:36.537605-04:00 |
| control-1 |
/aws.yaml; |
2026-10-18 03:15:36.537605-04:00 |
| lauterbourg-01-ts |
/cal/.env |
2026-10-18 03:15:36.537605-04:00 |
| netcup-ts |
/.cpanel.env |
2026-10-18 03:15:36.537605-04:00 |
| netcup-ts |
/nl |
2026-10-18 03:15:36.537605-04:00 |
| canary-farm-1 |
/.cpanel.env |
2026-10-18 03:15:36.537605-04:00 |
| canary-farm-1 |
/.whm.env |
2026-10-18 03:15:36.537605-04:00 |
| ru-edge-1 |
/aws-credentials.yaml |
2026-10-18 03:15:36.537605-04:00 |
| netcup-ts |
/de-de.html |
2026-10-18 03:15:36.537605-04:00 |
| frantech-ts |
/sveltekit/.env |
2026-10-18 03:15:36.537605-04:00 |
| frantech-ts |
/stage.env |
2026-10-18 03:15:36.537605-04:00 |
| frantech-ts |
/.env.local.old |
2026-10-18 03:15:36.537605-04:00 |
| netcup-ts |
/config/azure.yaml |
2026-10-18 03:15:36.537605-04:00 |
| netcup-ts |
/local.settings.json.bak |
2026-10-18 03:15:36.537605-04:00 |
| ai-devbox-1 |
/t7j908ltksaaaz4b |
2026-10-18 03:15:36.537605-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| ru-edge-1 |
cam-scanner/1.0 |
2026-10-18 03:15:36.650902-04:00 |
| ru-edge-1 |
ivre-masscan/1.3 https://github.com/robertdavidgraham/ |
2026-10-18 03:15:36.650902-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-18 03:15:36.650902-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-18 03:15:36.650902-04:00 |
| canary-farm-1 |
Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML |
2026-10-18 03:15:36.650902-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-18 03:15:36.650902-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/ |
2026-10-18 03:15:36.650902-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-10-18 03:15:36.650902-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firef |
2026-10-18 03:15:36.650902-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-18 03:15:36.650902-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.60.3 |
13669 |
5 |
13612 |
10-17 07:21 |
10-17 07:25 |
ipsum:1 |
Datacamp Limited |
SG |
0 |
| frantech-ts |
146.70.200.3 |
13612 |
5 |
13612 |
10-18 00:31 |
10-18 00:32 |
- |
M247 Europe SRL |
AU |
0 |
| netcup-ts |
185.73.23.162 |
2357 |
2 |
13 |
10-17 03:33 |
10-18 06:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2147 |
2 |
12 |
10-17 03:36 |
10-18 06:13 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
2047 |
2 |
568 |
10-17 03:35 |
10-18 06:14 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| sponge-01-ts |
185.73.23.161 |
2023 |
3 |
14 |
10-17 03:40 |
10-18 02:45 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.161 |
1818 |
3 |
18 |
10-17 12:42 |
10-18 05:13 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ru-edge-1 |
147.224.147.131 |
358 |
71 |
292 |
10-17 12:36 |
10-17 12:36 |
- |
Oracle Corporation |
US |
0 |
| sponge-01-ts |
185.177.72.50 |
304 |
31 |
191 |
10-17 05:30 |
10-17 23:16 |
ipsum:3 firehol2 |
Bucklog SARL |
FR |
49 |
| netcup-ts |
137.23.38.53 |
298 |
11 |
125 |
10-17 20:41 |
10-18 01:30 |
- |
Oracle Corporation |
IN |
0 |
| canary-farm-1 |
137.23.38.53 |
250 |
24 |
125 |
10-17 20:22 |
10-17 21:22 |
- |
Oracle Corporation |
IN |
0 |
| lauterbourg-01-ts |
37.19.200.138 |
180 |
11 |
68 |
10-17 17:53 |
10-17 18:05 |
- |
Datacamp Limited |
US |
18 |
| frantech-ts |
137.23.38.53 |
173 |
11 |
125 |
10-17 20:42 |
10-18 01:00 |
- |
Oracle Corporation |
IN |
0 |
| frantech-ts |
198.100.154.28 |
151 |
1 |
1 |
10-18 00:26 |
10-18 00:26 |
- |
OVH SAS |
CA |
0 |
| sponge-01-ts |
79.124.58.82 |
150 |
5 |
150 |
10-17 22:30 |
10-17 22:30 |
- |
Tamatiya EOOD |
BG |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
11 |
8 |
| ai-devbox-1 |
18 |
17 |
| ru-edge-1 |
6 |
6 |
| canary-farm-1 |
18 |
16 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ru-edge-1:400x1; canary-farm-1:400x3; ai-devbox-1:400x4
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
18 |
| canary-farm-1 |
["aws"] |
18 |
| control-1 |
["aws"] |
11 |
| ru-edge-1 |
["aws"] |
6 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1316
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 21
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1039 |
| ai-devbox-1 |
https |
724 |
| canary-farm-1 |
http |
1705 |
| canary-farm-1 |
https |
238 |
| control-1 |
http |
3049 |
| control-1 |
https |
1 |
| frantech-ts |
http |
28291 |
| lauterbourg-01-ts |
http |
915 |
| lauterbourg-01-ts |
https |
332 |
| netcup-ts |
http |
5050 |
| ru-edge-1 |
http |
981 |
| sponge-01-ts |
http |
5346 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
28278 |
| control-1 |
38.54.2.209 |
3038 |
| canary-farm-1 |
109.123.246.142 |
1447 |
| sponge-01-ts |
89.167.72.144 |
1158 |
| ai-devbox-1 |
inference.fapthropic.com |
1023 |
| ru-edge-1 |
130.94.89.46 |
977 |
| netcup-ts |
159.195.21.150 |
869 |
| ai-devbox-1 |
217.15.163.226 |
712 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
635 |
| lauterbourg-01-ts |
89.116.25.211 |
604 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (35 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
147.224.147.131 |
71 |
/robots.txt [tarpit-module] → / [tarpit-module] → /.env [issued] → /manifest.json [not-handled] → /index.html [tarpit-module] → /site.webmanifest [spa-webmanifest] → /sitemap.xml [tarpit-module] → /.well-known/security.txt [not-handled] → /.env.staging [env-production] → /sitemap_index.xml [not-handled] → /.env.local [env-production] → /.env.development.local [env-production] |
Oracle Corporation |
US |
| canary-farm-1 |
165.22.34.189 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| sponge-01-ts |
185.177.72.50 |
31 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /i8xy3mnsa59v1rwjvsvz9bffb [not-handled] → /1ocs7jt4bbo7x1ciexx1cu2jta.html [not-handled] → /fwifqyeoynl9vddmfni39uh8.php [webshell-sweep-observed] → /wp-login.php [wp-login-probe] → /wp-admin [not-handled] → /login [webapp-form-login] → /admin [webapp-form-profile] → /administrator [not-handled] → /.env [not-handled] |
Bucklog SARL |
FR |
| ai-devbox-1 |
64.23.218.208 |
28 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.227.70.2 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
64.227.70.2 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| control-1 |
167.71.175.236 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
138.68.82.23 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.172.158.128 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
164.90.228.79 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
147.182.200.94 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 474 sources sent credentials → 350 got a shell (74%) → 277 ran a command (79% of shell-getters, 58% of sources)
- event level: 19539 credential attempts → 3586 accepted logins → 6970 commands (194% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 868 attempts
New commands this window (0 of 51 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 846 |
6 |
109.160.32.103 |
"uname -s -v -n -r -m" |
| 828 |
180 |
165.154.254.21 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 719 |
163 |
165.154.254.21 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 682 |
5 |
109.160.32.103 |
"uname -m | awk '{printf $1}'" |
| 392 |
6 |
2.57.122.209 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 390 |
6 |
2.57.122.209 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 305 |
6 |
138.68.241.217 |
"lspci | grep VGA -c" |
| 305 |
6 |
138.68.241.217 |
"/bin/./uname -s -v -n -r -m" |
Credentials: 13850 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 797 |
345gs5662d34 |
345gs5662d34 |
| 586 |
root |
3245gs5662d34 |
| 65 |
root |
123456 |
| 55 |
user |
wasd |
| 52 |
pi |
raspberry |
| 33 |
admin |
3245gs5662d34 |
| 33 |
ubuntu |
3245gs5662d34 |
| 30 |
support |
support |