flux fleet digest — 2026-10-19 07:35 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1666 |
346 |
1769 |
169 |
-6% |
| canary-farm-1 |
1367 |
126 |
2096 |
188 |
-35% |
| control-1 |
3563 |
119 |
3670 |
111 |
-3% |
| frantech-ts |
14612 |
71 |
14548 |
84 |
+0% |
| lauterbourg-01-ts |
1028 |
170 |
1509 |
143 |
-32% |
| netcup-ts |
6486 |
95 |
4129 |
100 |
+57% |
| ru-edge-1 |
896 |
115 |
1522 |
112 |
-41% |
| sponge-01-ts |
10373 |
92 |
3881 |
101 |
+167% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
ssh-private-key-error |
31 |
9.3 |
3.3x |
| ai-devbox-1 |
wp-login-credentials |
233 |
41.6 |
5.6x |
| control-1 |
phpmyadmin-login |
324 |
107.6 |
3.0x |
| netcup-ts |
not-handled |
1475 |
352.7 |
4.2x |
| netcup-ts |
wp-admin-redirect |
42 |
0.0 |
infx |
| sponge-01-ts |
not-handled |
4454 |
406.9 |
10.9x |
| sponge-01-ts |
openapi-spec-json-skeleton |
50 |
2.0 |
25.0x |
| sponge-01-ts |
tarpit |
141 |
42.4 |
3.3x |
| sponge-01-ts |
tarpit-disconnect |
128 |
27.9 |
4.6x |
| sponge-01-ts |
webapp-form-profile |
25 |
4.0 |
6.2x |
| sponge-01-ts |
webshell-probe |
80 |
20.5 |
3.9x |
| sponge-01-ts |
webshell-sweep-observed |
22 |
6.9 |
3.2x |
| sponge-01-ts |
wp-admin-redirect |
84 |
0.0 |
infx |
| sponge-01-ts |
wp-login-probe |
88 |
7.0 |
12.6x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
71 |
497 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
16 |
112 |
ai-devbox-1,canary-farm-1,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
532 |
canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
6 |
294 |
control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
5 |
205 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 321f17b2aca0 ⟳ |
3 |
20 |
ai-devbox-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 218630667b2c ⟳ |
2 |
84 |
control-1,netcup-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/jrb7k26l6qbvc6 |
2026-10-19 03:31:48.646961-04:00 |
| sponge-01-ts |
/config/secrets.js |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/config/hubspot.yml |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/openai.yml |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/google-ai.yml |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/hr/ |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/vertex-ai-credentials.json |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/mcp.yaml |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/webroot/.env |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-content/plugins/wc-designer-pro/readme.txt |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-admin/admin-post.php |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-content/plugins/1-click-migration/readme.txt |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-content/plugins/1-click-migration/ocm_debug.log |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/.config/gcloud/configurations/config_default |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/configurations/config_default |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/app/config/pimcore/google-api-private-key.json |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/api/livez |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/wp-trackback.php |
2026-10-19 03:16:13.943926-04:00 |
| sponge-01-ts |
/.bzr/README |
2026-10-19 03:16:13.943926-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Opera/9.80 (Linux i686; U; fr) Presto/2.10.287 Version/12.00 |
2026-10-19 03:31:48.761794-04:00 |
| control-1 |
NoPing-Endpoint-Discovery/1.0 |
2026-10-19 03:16:14.063715-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Ge |
2026-10-19 03:16:14.063715-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (compatible; js-scanner) |
2026-10-19 03:16:14.063715-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 6.0.1; SM-N910S) AppleWebKit/537 |
2026-10-19 03:16:14.063715-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Linux; Android 8.0.0; LDN-L21) AppleWebKit/537. |
2026-10-19 03:16:14.063715-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-19 03:16:14.063715-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/ |
2026-10-19 03:16:14.063715-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 |
2026-10-19 03:16:14.063715-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ |
2026-10-19 03:16:14.063715-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
193.32.248.130 |
13678 |
5 |
13678 |
10-19 00:18 |
10-19 00:20 |
ipsum:2 |
31173 Services AB |
DE |
0 |
| netcup-ts |
185.73.23.162 |
2288 |
3 |
16 |
10-18 04:10 |
10-18 22:46 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
2146 |
3 |
10 |
10-18 13:55 |
10-19 05:15 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2031 |
3 |
17 |
10-18 04:09 |
10-18 22:44 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
1988 |
2 |
567 |
10-18 03:36 |
10-19 06:10 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.161 |
1714 |
2 |
10 |
10-18 03:37 |
10-19 05:03 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.177.72.70 |
1430 |
31 |
1006 |
10-19 03:22 |
10-19 03:40 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| sponge-01-ts |
85.239.151.82 |
1239 |
7 |
284 |
10-18 16:22 |
10-18 23:16 |
firehol2 |
Interserver, Inc |
ER |
0 |
| sponge-01-ts |
93.123.109.228 |
1220 |
7 |
284 |
10-18 16:42 |
10-18 18:06 |
- |
Techoff Srv Limited |
BG |
0 |
| sponge-01-ts |
45.138.12.22 |
970 |
19 |
419 |
10-18 16:23 |
10-18 21:34 |
- |
Tc Datacenter Limited |
LT |
54 |
| netcup-ts |
93.123.109.228 |
915 |
7 |
284 |
10-18 19:40 |
10-18 19:45 |
- |
Techoff Srv Limited |
BG |
0 |
| sponge-01-ts |
45.138.12.27 |
672 |
19 |
419 |
10-18 21:24 |
10-19 00:08 |
- |
Tc Datacenter Limited |
LT |
54 |
| netcup-ts |
45.138.12.27 |
653 |
19 |
419 |
10-18 23:14 |
10-18 23:30 |
- |
Tc Datacenter Limited |
LT |
54 |
| ai-devbox-1 |
79.124.58.82 |
450 |
106 |
450 |
10-18 09:52 |
10-18 09:52 |
- |
Tamatiya EOOD |
BG |
0 |
| frantech-ts |
85.155.14.15 |
337 |
2 |
300 |
10-18 22:07 |
10-18 22:11 |
- |
SolidCore Hosting LTD |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
14 |
9 |
| ai-devbox-1 |
14 |
11 |
| canary-farm-1 |
16 |
11 |
| ru-edge-1 |
6 |
6 |
| netcup-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
14 |
| canary-farm-1 |
["aws"] |
16 |
| ru-edge-1 |
["aws"] |
6 |
| control-1 |
["aws"] |
14 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2432
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1826
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1309 |
| ai-devbox-1 |
https |
357 |
| canary-farm-1 |
http |
1261 |
| canary-farm-1 |
https |
106 |
| control-1 |
http |
3563 |
| frantech-ts |
http |
14612 |
| lauterbourg-01-ts |
http |
884 |
| lauterbourg-01-ts |
https |
144 |
| netcup-ts |
http |
6486 |
| ru-edge-1 |
http |
896 |
| sponge-01-ts |
http |
10373 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14599 |
| sponge-01-ts |
89.167.72.144 |
6183 |
| control-1 |
38.54.2.209 |
3536 |
| netcup-ts |
159.195.21.150 |
2424 |
| ai-devbox-1 |
217.15.163.226 |
1176 |
| canary-farm-1 |
109.123.246.142 |
1153 |
| ru-edge-1 |
130.94.89.46 |
884 |
| lauterbourg-01-ts |
89.116.25.211 |
829 |
| ai-devbox-1 |
inference.fapthropic.com |
471 |
| canary-farm-1 |
sso.rightabouteverything.show |
201 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (36 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ai-devbox-1 |
79.124.58.82 |
106 |
/.git/index [fake-git] → /wp-config.php [wp-config] → /.git/HEAD [fake-git] → /env.txt [env-production] → /.env.bak~ [env-production] → /.env.toml [env-production] → /.git/config [fake-git] → /.env.yaml [env-production] → /.env.save~ [env-production] → /config.inc.php [webshell-sweep-observed] → /.env.old~ [env-production] → /.yarnrc [yarnrc-error] |
Tamatiya EOOD |
BG |
| canary-farm-1 |
185.177.72.17 |
34 |
/wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /backend/.env [env-production] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /info.php [phpinfo] → /error/ [not-handled] → /api/user [not-handled] → /............\var/log/apache2/access.log [not-handled] |
Bucklog SARL |
FR |
| canary-farm-1 |
195.178.110.22 |
32 |
/app.log [not-handled] → /env [actuator-env] → /www.zip [backup-archive] → /tfplan.json [not-handled] → /backup.7z [backup-archive] → /wp-content/debug.log [wp-debug-log] → /aws-exports.js [aws-amplify-exports-js] → /id_rsa [ssh-private-key-error] → /config.php.bak [app-config-php] → /.heroku/netrc [not-handled] → /error_log [not-handled] → /database.sql [sql-dump] |
Techoff Srv Limited |
BG |
| sponge-01-ts |
185.177.72.70 |
31 |
/.gitconfig [gitconfig] → /airflow/ [not-handled] → /ansible/ [not-handled] → /api/actuator/health/elasticsearch [not-handled] → /storage/logs/laravel-2023-01-01.log [not-handled] → /config.js [not-handled] → /_nodes/ [not-handled] → /gcp-credentials.json [not-handled] → /actuator/shutdown [not-handled] → /admin/flyway.json [not-handled] → /server/specs [not-handled] → /.env.prod [not-handled] |
Bucklog SARL |
FR |
| control-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
64.227.70.2 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ru-edge-1 |
64.226.65.160 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
134.122.28.88 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
138.68.144.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
146.190.63.48 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
146.190.63.248 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.71.81.114 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
146.190.242.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 410 sources sent credentials → 280 got a shell (68%) → 235 ran a command (84% of shell-getters, 57% of sources)
- event level: 34481 credential attempts → 5006 accepted logins → 6723 commands (134% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1036 attempts
New commands this window (0 of 50 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2370 |
1 |
118.142.17.190 |
"echo -e "\x6F\x6B"" |
| 905 |
169 |
115.191.27.139 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 796 |
151 |
115.191.27.139 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 226 |
6 |
195.178.110.232 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 226 |
6 |
195.178.110.232 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 223 |
5 |
179.43.153.2 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 223 |
5 |
179.43.153.2 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
| 223 |
5 |
179.43.153.2 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 26004 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 861 |
345gs5662d34 |
345gs5662d34 |
| 658 |
root |
3245gs5662d34 |
| 68 |
root |
123456 |
| 53 |
user |
wasd |
| 46 |
pi |
raspberry |
| 45 |
ubuntu |
3245gs5662d34 |
| 30 |
admin |
3245gs5662d34 |
| 27 |
support |
support |