flux fleet digest — 2026-10-20 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1930 |
342 |
1857 |
205 |
+4% |
| canary-farm-1 |
3202 |
245 |
2057 |
183 |
+56% |
| control-1 |
4882 |
167 |
3738 |
112 |
+31% |
| frantech-ts |
14474 |
97 |
14537 |
84 |
-0% |
| lauterbourg-01-ts |
1331 |
133 |
1416 |
146 |
-6% |
| netcup-ts |
7441 |
89 |
4862 |
103 |
+53% |
| ru-edge-1 |
1105 |
158 |
1534 |
114 |
-28% |
| sponge-01-ts |
6790 |
114 |
5204 |
102 |
+30% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
adminer-credential-post |
31 |
7.5 |
4.1x |
| ai-devbox-1 |
adminer-login |
32 |
7.5 |
4.3x |
| ai-devbox-1 |
env-production-error |
86 |
0.0 |
infx |
| ai-devbox-1 |
phpinfo-error |
26 |
4.0 |
6.5x |
| ai-devbox-1 |
phpmyadmin-login |
261 |
51.9 |
5.0x |
| ai-devbox-1 |
webapp-config-bundle-js-error |
54 |
0.0 |
infx |
| canary-farm-1 |
fake-git-miss |
264 |
0.0 |
infx |
| canary-farm-1 |
phpinfo-error |
24 |
6.0 |
4.0x |
| canary-farm-1 |
webapp-config-bundle-js-error |
40 |
0.0 |
infx |
| canary-farm-1 |
yii2-debug-view-error |
21 |
5.7 |
3.7x |
| control-1 |
app-config-yaml-error |
39 |
4.0 |
9.8x |
| control-1 |
config-json-error |
38 |
8.0 |
4.8x |
| control-1 |
fake-git-miss |
264 |
84.0 |
3.1x |
| control-1 |
webapp-config-bundle-js-error |
64 |
4.0 |
16.0x |
| sponge-01-ts |
phpmyadmin-login |
154 |
30.3 |
5.1x |
| sponge-01-ts |
phpunit-eval-stdin |
432 |
54.4 |
7.9x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
87 |
609 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
13 |
637 |
canary-farm-1,control-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 8340706ababf ⟳ |
6 |
144 |
ai-devbox-1,canary-farm-1,control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-24 |
/version [docker-daemon-version] → / [tarpit-module] → /v1 [not-handled] → / [tarpit-module] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit] → … |
| 218630667b2c ⟳ |
6 |
252 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| c540fc530a5a ⟳ |
6 |
234 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 321f17b2aca0 ⟳ |
4 |
32 |
canary-farm-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 6d56c36a681f |
4 |
36 |
frantech-ts,lauterbourg-01-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-20 |
/@fs/etc/passwd [not-handled] → /@fs/etc/hosts [not-handled] → /@fs/C:/Windows/win.ini [not-handled] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| control-1 |
/build/runtime-config.js |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/scripts/deploy.sh |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.daytona/config.json |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.env.local.orig |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.env.production.orig |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/etc/environment |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/api/config/ |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/infra/.env.production |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/opt/app/.env.local |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/home/ubuntu/.env.production |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/containers/.env.production |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.env.exoscale |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.env.coreweave |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.env.gmicloud |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/config/azure.yaml |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/config/appsettings.Production.json |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/.aws-sam/build/template.yaml |
2026-10-20 03:15:21.204935-04:00 |
| canary-farm-1 |
/opt/app/ |
2026-10-20 03:15:21.204935-04:00 |
| canary-farm-1 |
/main.pl |
2026-10-20 03:15:21.204935-04:00 |
| control-1 |
/sendgrid.json |
2026-10-20 03:15:21.204935-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 |
2026-10-20 03:32:06.375338-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 |
2026-10-20 03:15:21.329048-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Geck |
2026-10-20 03:15:21.329048-04:00 |
| control-1 |
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.289 Version/1 |
2026-10-20 03:15:21.329048-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-20 03:15:21.329048-04:00 |
| control-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) Apple |
2026-10-20 03:15:21.329048-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHT |
2026-10-20 03:15:21.329048-04:00 |
| frantech-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-20 03:15:21.329048-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 6.0.1; SAMSUNG SM-G920P Build/MM |
2026-10-20 03:15:21.329048-04:00 |
| lauterbourg-01-ts |
Python/3.10 aiohttp/3.14.5 |
2026-10-20 03:15:21.329048-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
138.199.60.3 |
13743 |
5 |
13742 |
10-20 00:31 |
10-20 00:33 |
ipsum:1 |
Datacamp Limited |
SG |
0 |
| netcup-ts |
185.73.23.162 |
2623 |
3 |
20 |
10-19 08:18 |
10-20 02:11 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2369 |
2 |
15 |
10-19 08:13 |
10-20 02:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.161 |
2152 |
3 |
9 |
10-19 03:34 |
10-20 00:06 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
2047 |
2 |
569 |
10-19 03:34 |
10-20 06:09 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.168 |
1717 |
3 |
13 |
10-19 14:50 |
10-20 06:11 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.168 |
1666 |
3 |
13 |
10-19 14:46 |
10-20 06:12 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
875 |
2 |
6 |
10-19 03:35 |
10-19 22:38 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
163.192.195.37 |
800 |
52 |
669 |
10-19 23:04 |
10-19 23:05 |
- |
Oracle Corporation |
US |
0 |
| canary-farm-1 |
34.58.160.181 |
648 |
59 |
300 |
10-19 16:03 |
10-19 16:04 |
- |
Google LLC |
US |
32 |
| lauterbourg-01-ts |
64.181.210.1 |
540 |
18 |
463 |
10-19 11:41 |
10-19 11:42 |
- |
Oracle Corporation |
US |
0 |
| sponge-01-ts |
185.177.72.70 |
485 |
16 |
324 |
10-19 03:34 |
10-19 03:40 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| control-1 |
195.178.110.159 |
384 |
2 |
372 |
10-19 06:15 |
10-19 06:15 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| canary-farm-1 |
195.178.110.159 |
384 |
2 |
372 |
10-20 02:58 |
10-20 02:58 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| control-1 |
147.224.164.154 |
356 |
71 |
290 |
10-20 03:02 |
10-20 03:02 |
- |
Oracle Corporation |
US |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
6 |
5 |
| canary-farm-1 |
53 |
8 |
| ai-devbox-1 |
9 |
7 |
| control-1 |
14 |
9 |
| frantech-ts |
0 |
0 |
| lauterbourg-01-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x12; canary-farm-1:400x13; ru-edge-1:400x4; control-1:400x7
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
9 |
| canary-farm-1 |
["aws"] |
53 |
| ru-edge-1 |
["aws"] |
6 |
| control-1 |
["aws"] |
14 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2139
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 487
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1424 |
| ai-devbox-1 |
https |
506 |
| canary-farm-1 |
http |
2239 |
| canary-farm-1 |
https |
963 |
| control-1 |
http |
4882 |
| frantech-ts |
http |
14474 |
| lauterbourg-01-ts |
http |
1148 |
| lauterbourg-01-ts |
https |
183 |
| netcup-ts |
http |
7441 |
| ru-edge-1 |
http |
1105 |
| sponge-01-ts |
http |
6790 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14464 |
| control-1 |
38.54.2.209 |
4866 |
| sponge-01-ts |
89.167.72.144 |
1875 |
| canary-farm-1 |
109.123.246.142 |
1752 |
| canary-farm-1 |
sso.rightabouteverything.show |
1246 |
| ru-edge-1 |
130.94.89.46 |
1094 |
| ai-devbox-1 |
217.15.163.226 |
1013 |
| lauterbourg-01-ts |
89.116.25.211 |
997 |
| ai-devbox-1 |
inference.fapthropic.com |
908 |
| netcup-ts |
159.195.21.150 |
837 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (37 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| control-1 |
147.224.164.154 |
71 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /manifest.json [not-handled] → /.env.development [env-production-error] → /.env.prod [env-production-error] → /.env.save [env-production-error] → /app/.env [env-production-error] → /config.yaml [app-config-yaml-error] → /settings.json [config-json-error] → /deploy/.env [env-production-error] → /secrets.json [config-json-error] → /config/secrets.yaml [app-config-yaml-error] |
Oracle Corporation |
US |
| canary-farm-1 |
34.58.160.181 |
59 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /jnhssp5rwviazoudrip7 [not-handled] → /graphql [graphql-introspection] → /y11fjrk4mbhdvjojtegc [not-handled] → /api/graphql [graphql-introspection] → /.env.development::$DATA [tarpit-module] → /pages/index.astro.mjs.map [not-handled] → /.env [issued] → /api/admin/config.json [config-json] → /_astro/pages/index.astro.mjs.map [not-handled] |
Google LLC |
US |
| control-1 |
163.192.195.37 |
52 |
/.env.production.local [env-production-error] → /.env.test [env-production-error] → /.env.development.local [env-production-error] → /.env.compose [tarpit-module] → /.credentials [not-handled] → /.env.runpod [tarpit-module] → /.env.inference [tarpit-module] → /web/.env.local [env-production-error] → /server/.env.local [env-production-error] → /environment.txt [not-handled] → / [tarpit-module] → /services/api/.env [tarpit-module] |
Oracle Corporation |
US |
| canary-farm-1 |
195.178.110.22 |
36 |
/app.log [not-handled] → /env [actuator-env] → /www.zip [backup-archive] → /tfplan.json [not-handled] → /backup.7z [backup-archive] → /wp-content/debug.log [wp-debug-log] → /aws-exports.js [aws-amplify-exports-js] → /id_rsa [ssh-private-key-error] → /config.php.bak [app-config-php] → /.heroku/netrc [not-handled] → /error_log [not-handled] → /database.sql [sql-dump] |
Techoff Srv Limited |
BG |
| ai-devbox-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
157.245.36.108 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
206.189.19.19 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
139.59.132.8 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
68.183.9.16 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
164.90.228.79 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
146.190.242.161 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
209.38.208.202 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
104.251.180.112 |
25 |
/.env [issued] → /.env.local [env-production] → /.env.production [env-production] → /.env.prod [env-production] → /.env.dev [env-production] → /.env.development [env-production] → /.env.staging [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] → /.env.save [env-production] → /.env.example [env-production] |
SKN Subnet & Telecom Ltd |
CH |
| ai-devbox-1 |
138.68.82.23 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
206.189.225.181 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 485 sources sent credentials → 343 got a shell (71%) → 303 ran a command (88% of shell-getters, 62% of sources)
- event level: 28019 credential attempts → 5070 accepted logins → 9725 commands (192% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 929 attempts
New commands this window (0 of 51 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1662 |
6 |
168.144.62.63 |
"uname -s -v -n -r -m" |
| 1298 |
3 |
109.160.32.140 |
"uname -m | awk '{printf $1}'" |
| 1140 |
246 |
114.112.96.82 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1006 |
227 |
115.190.216.185 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 550 |
8 |
168.144.62.63 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 550 |
8 |
168.144.62.63 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 550 |
8 |
168.144.62.63 |
"uptime -p" |
| 550 |
8 |
168.144.62.63 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
Credentials: 18430 distinct pairs offered this window, 2 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1 |
ubuntu |
Mannu@123 |
| 1 |
ubuntu |
Bhardwaj@123 |