flux fleet digest — 2026-10-21 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2572 |
124 |
1848 |
232 |
+39% |
| canary-farm-1 |
2223 |
242 |
2174 |
186 |
+2% |
| control-1 |
2892 |
104 |
3770 |
120 |
-23% |
| frantech-ts |
15076 |
91 |
14413 |
85 |
+5% |
| lauterbourg-01-ts |
1505 |
143 |
1380 |
146 |
+9% |
| netcup-ts |
7440 |
122 |
5400 |
101 |
+38% |
| ru-edge-1 |
1659 |
99 |
1543 |
120 |
+7% |
| sponge-01-ts |
6105 |
161 |
5699 |
105 |
+7% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
app-config-yaml |
31 |
5.0 |
6.2x |
| ai-devbox-1 |
fake-git-miss |
264 |
0.0 |
infx |
| ai-devbox-1 |
phpunit-eval-stdin |
148 |
40.4 |
3.7x |
| ai-devbox-1 |
webapp-config-bundle-js |
154 |
29.6 |
5.2x |
| canary-farm-1 |
phpinfo-error |
40 |
10.5 |
3.8x |
| canary-farm-1 |
symfony-profiler-phpinfo-error |
21 |
4.0 |
5.2x |
| canary-farm-1 |
tomcat-path-bypass-env |
40 |
12.5 |
3.2x |
| canary-farm-1 |
webapp-config-bundle-json-error |
20 |
0.0 |
infx |
| ru-edge-1 |
config-json |
30 |
6.6 |
4.6x |
| ru-edge-1 |
fake-git-miss |
33 |
2.0 |
16.5x |
| ru-edge-1 |
webapp-config-bundle-js-error |
20 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
75 |
527 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
11 |
76 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 218630667b2c ⟳ |
8 |
336 |
control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 321f17b2aca0 ⟳ |
4 |
28 |
control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 2747058d6260 |
3 |
84 |
ai-devbox-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
10-21 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit] → /favicon.ico [tarpit-disconnect] → … |
| b1754af1a4e8 |
3 |
15 |
lauterbourg-01-ts |
10-21 |
/ [kiteworks-root-redirect] → /login [kiteworks-shell] → /favicon.ico [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/runpod-volume/.env.local |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/opt/runpod/.env.local |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/home/ubuntu/.env.production |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/.env.akamai |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config/crusoe.yaml |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config/cudo.yaml |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config/paperspace.env |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config/vultr.yaml |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config/koyeb.yaml |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/.env.replicate |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/infrastructure/.env.production |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/settings.ini |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/config.php.txt |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/configs/secrets.json |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/configs/credentials.json |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/backend/config/config.json |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/src/config/settings.json |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/dist/config.json |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/build/env.js |
2026-10-21 03:15:37.512337-04:00 |
| ru-edge-1 |
/bundle.js.map |
2026-10-21 03:15:37.512337-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| frantech-ts |
Mozilla/5.0 (Linux; Android 11; KB2003) AppleWebKit/537.36 ( |
2026-10-21 03:15:37.841290-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-21 03:15:37.841290-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 7.0; Alcatel_5044R) AppleWebKit/ |
2026-10-21 03:15:37.841290-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_0) AppleWebKit/6 |
2026-10-21 03:15:37.841290-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-10-21 03:15:37.841290-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-21 03:15:37.841290-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Fir |
2026-10-21 03:15:37.841290-04:00 |
| control-1 |
Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; f |
2026-10-21 03:15:37.841290-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/5340 (KHTML, like G |
2026-10-21 03:15:37.841290-04:00 |
| frantech-ts |
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.0; Trident/ |
2026-10-21 03:15:37.841290-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
146.70.200.195 |
13747 |
6 |
13747 |
10-21 01:54 |
10-21 01:55 |
- |
M247 Europe SRL |
AU |
0 |
| netcup-ts |
185.73.23.168 |
2448 |
3 |
14 |
10-20 03:34 |
10-21 06:00 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.168 |
2343 |
3 |
11 |
10-20 03:35 |
10-21 06:09 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.162 |
2197 |
2 |
14 |
10-20 11:16 |
10-21 05:25 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
1997 |
3 |
14 |
10-20 11:04 |
10-21 05:27 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
1359 |
2 |
557 |
10-20 03:34 |
10-20 21:40 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.161 |
889 |
2 |
10 |
10-20 08:15 |
10-20 21:40 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| ai-devbox-1 |
147.224.178.252 |
669 |
52 |
669 |
10-20 22:02 |
10-20 22:02 |
- |
Oracle Corporation |
US |
0 |
| ru-edge-1 |
164.152.24.126 |
669 |
52 |
669 |
10-20 19:25 |
10-20 19:25 |
- |
Oracle Corporation |
US |
0 |
| frantech-ts |
163.192.198.182 |
669 |
12 |
669 |
10-20 21:52 |
10-20 21:52 |
- |
Oracle Corporation |
US |
0 |
| netcup-ts |
170.9.228.116 |
669 |
12 |
669 |
10-20 20:24 |
10-20 20:24 |
- |
Oracle Corporation |
US |
0 |
| sponge-01-ts |
185.73.23.161 |
607 |
2 |
8 |
10-20 08:18 |
10-20 21:06 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
45.138.12.24 |
424 |
13 |
319 |
10-21 04:02 |
10-21 05:13 |
- |
Tc Datacenter Limited |
LT |
20 |
| ai-devbox-1 |
195.178.110.159 |
384 |
2 |
372 |
10-20 14:08 |
10-20 14:08 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| control-1 |
85.155.14.16 |
356 |
47 |
356 |
10-20 17:23 |
10-20 17:27 |
- |
SolidCore Hosting LTD |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
16 |
8 |
| ai-devbox-1 |
23 |
16 |
| canary-farm-1 |
24 |
15 |
| ru-edge-1 |
9 |
7 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x5; canary-farm-1:400x6; control-1:400x2; ru-edge-1:400x4; ru-edge-1:?x1
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
23 |
| canary-farm-1 |
["aws"] |
24 |
| control-1 |
["aws"] |
16 |
| ru-edge-1 |
["aws"] |
9 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1325
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 456
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2235 |
| ai-devbox-1 |
https |
337 |
| canary-farm-1 |
http |
1872 |
| canary-farm-1 |
https |
351 |
| control-1 |
http |
2892 |
| frantech-ts |
http |
15076 |
| lauterbourg-01-ts |
http |
1325 |
| lauterbourg-01-ts |
https |
180 |
| netcup-ts |
http |
7440 |
| ru-edge-1 |
http |
1659 |
| sponge-01-ts |
http |
6105 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
15069 |
| control-1 |
38.54.2.209 |
2871 |
| ai-devbox-1 |
217.15.163.226 |
1882 |
| netcup-ts |
159.195.21.150 |
1788 |
| ru-edge-1 |
130.94.89.46 |
1652 |
| canary-farm-1 |
109.123.246.142 |
1534 |
| lauterbourg-01-ts |
89.116.25.211 |
1175 |
| sponge-01-ts |
89.167.72.144 |
1142 |
| ai-devbox-1 |
inference.fapthropic.com |
683 |
| canary-farm-1 |
sso.rightabouteverything.show |
677 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (38 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ai-devbox-1 |
147.224.178.252 |
52 |
/.env.compose [tarpit-module] → /.env.stage [env-production] → /service/.env.production [env-production] → /.env.test [env-production] → /environment [proc-environ] → /.env.dev [env-production] → /env [actuator-env] → /environment.txt [not-handled] → /.env.runpod [tarpit-module] → /.env.development.local [env-production] → /.env.secrets [tarpit-module] → / [tarpit-module] |
Oracle Corporation |
US |
| ru-edge-1 |
164.152.24.126 |
52 |
/.env [issued] → /.env.production [env-production] → /.env.development.local [env-production] → /.env.staging [env-production] → / [tarpit-module] → /.env.test.local [env-production] → /.env.production.local [env-production] → /.env.staging.local [env-production] → /.env.local [env-production] → /.env.development [env-production] → /.env.dev [env-production] → /.env.compose [tarpit-module] |
Oracle Corporation |
US |
| control-1 |
85.155.14.16 |
47 |
/.aws/credentials [aws-credentials-file] → /aws_credentials [not-handled] → /aws_credentials.json [aws-credentials-json] → /.aws/cli/cache [not-handled] → /.aws/sso/cache [not-handled] → /.aws/credentials.old [aws-credentials-file] → /.aws/config.bak [not-handled] → /.aws/credentials.bak [aws-credentials-file] → /.aws/config [aws-config-file] → /aws_config.json [not-handled] → /.s3cfg [s3cfg] → /.boto [boto-config] |
SolidCore Hosting LTD |
DE |
| canary-farm-1 |
185.177.72.69 |
30 |
/wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → /aws/bucket [not-handled] → /aws/buckets [not-handled] → /aws/config/s3.json [not-handled] → /aws/s3/credentials [not-handled] → /aws/s3/env.env [not-handled] → /aws_s3_bucket [not-handled] → /aws_s3_config.json [not-handled] → /s3/.aws/config [not-handled] → /config/aws.php [not-handled] → /.aws/config [aws-config-file] → /aws-codecommit/ [not-handled] |
Bucklog SARL |
FR |
| ai-devbox-1 |
146.70.211.38 |
28 |
/ [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /.env [tracebit-http-error] → /.env.save [env-production-error] → /.env.old [env-production-error] → /.env.prod [env-production-error] |
M247 Europe SRL |
US |
| canary-farm-1 |
157.245.105.107 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| canary-farm-1 |
142.93.129.190 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
138.68.86.32 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
164.92.244.132 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.71.81.114 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
68.183.9.16 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| control-1 |
138.68.82.23 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
206.189.233.36 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 436 sources sent credentials → 303 got a shell (69%) → 243 ran a command (80% of shell-getters, 56% of sources)
- event level: 22319 credential attempts → 16860 accepted logins → 18638 commands (111% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1220 attempts
New commands this window (0 of 50 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 11929 |
1 |
84.42.45.253 |
"echo -e "\x6F\x6B"" |
| 1285 |
2 |
109.160.32.151 |
"uname -s -v -n -r -m" |
| 1285 |
2 |
109.160.32.151 |
"uname -m | awk '{printf $1}'" |
| 1177 |
219 |
113.141.171.139 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1031 |
198 |
113.141.171.139 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 445 |
5 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 445 |
5 |
195.178.110.217 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 132 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 15970 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1152 |
345gs5662d34 |
345gs5662d34 |
| 818 |
root |
3245gs5662d34 |
| 63 |
root |
123456 |
| 62 |
pi |
raspberry |
| 61 |
user |
wasd |
| 60 |
admin |
3245gs5662d34 |
| 52 |
ubuntu |
3245gs5662d34 |
| 43 |
user |
3245gs5662d34 |