flux fleet digest — 2026-10-22 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1943 |
163 |
2031 |
221 |
-4% |
| canary-farm-1 |
3603 |
218 |
2108 |
174 |
+71% |
| control-1 |
2173 |
178 |
3672 |
120 |
-41% |
| frantech-ts |
14378 |
82 |
14536 |
87 |
-1% |
| lauterbourg-01-ts |
1843 |
147 |
1275 |
145 |
+45% |
| netcup-ts |
8295 |
137 |
5732 |
104 |
+45% |
| ru-edge-1 |
1501 |
180 |
1186 |
119 |
+27% |
| sponge-01-ts |
7273 |
109 |
6043 |
112 |
+20% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
fake-git-error |
24 |
5.4 |
4.4x |
| canary-farm-1 |
adminer-credential-post |
42 |
9.4 |
4.5x |
| canary-farm-1 |
adminer-login |
43 |
9.4 |
4.6x |
| canary-farm-1 |
backup-archive |
27 |
4.4 |
6.1x |
| canary-farm-1 |
env-production-error |
152 |
44.0 |
3.5x |
| canary-farm-1 |
phpinfo-error |
50 |
16.4 |
3.0x |
| control-1 |
backup-archive-error |
21 |
1.0 |
21.0x |
| control-1 |
fake-git-error |
314 |
6.7 |
47.1x |
| netcup-ts |
phpmyadmin-login |
154 |
2.2 |
68.4x |
| ru-edge-1 |
phpinfo-error |
25 |
5.3 |
4.7x |
| ru-edge-1 |
tomcat-path-bypass-env |
20 |
5.0 |
4.0x |
| ru-edge-1 |
webapp-config-bundle-js-error |
60 |
20.0 |
3.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
60 |
422 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
27 |
189 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
15 |
735 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 2f886a7c88e7 ⟳ |
8 |
224 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-09 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 1cf777711bea ⟳ |
6 |
57 |
canary-farm-1,control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 80d29a9d099a |
4 |
88 |
frantech-ts,lauterbourg-01-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-22 |
/.claude/.credentials.json [not-handled] → /root/.claude/.credentials.json [not-handled] → /home/ubuntu/.claude/.credentials.json [not-handled] → /home/claude/.claude/.credentials.json [not-handled] → |
| 5b06f50534d3 |
3 |
66 |
ai-devbox-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
10-22 |
/.claude/.credentials.json [claude-credentials] → /root/.claude/.credentials.json [claude-credentials-root] → /home/ubuntu/.claude/.credentials.json [claude-credentials] → /home/claude/.claude/.creden |
| c540fc530a5a ⟳ |
3 |
117 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| netcup-ts |
/babel-plugin-dotenv/test/fixtures/as-alias/.env |
2026-10-22 03:15:52.358294-04:00 |
| netcup-ts |
/msks/.env |
2026-10-22 03:15:52.358294-04:00 |
| netcup-ts |
/docker/db/.env |
2026-10-22 03:15:52.358294-04:00 |
| netcup-ts |
/FE/huey/.env |
2026-10-22 03:15:52.358294-04:00 |
| netcup-ts |
/testing/docker/.env |
2026-10-22 03:15:52.358294-04:00 |
| netcup-ts |
/temanr10/.env |
2026-10-22 03:15:52.358294-04:00 |
| sponge-01-ts |
/micro-app-react/.env |
2026-10-22 03:15:52.358294-04:00 |
| sponge-01-ts |
/cmd/testdata/expected/dot_env/.env |
2026-10-22 03:15:52.358294-04:00 |
| sponge-01-ts |
/boxes/oracle-vagrant-boxes/OLCNE/.env |
2026-10-22 03:15:52.358294-04:00 |
| sponge-01-ts |
/orientdb-client/.env |
2026-10-22 03:15:52.358294-04:00 |
| sponge-01-ts |
/server/laravel/.env |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/site.yml |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/COPYING |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/next.config.js |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/repository.zip |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/source.zip |
2026-10-22 03:15:52.358294-04:00 |
| lauterbourg-01-ts |
/website.zip |
2026-10-22 03:15:52.358294-04:00 |
| canary-farm-1 |
/assets/.git/refs/heads/main |
2026-10-22 03:15:52.358294-04:00 |
| canary-farm-1 |
/dist/.git/COMMIT_EDITMSG |
2026-10-22 03:15:52.358294-04:00 |
| canary-farm-1 |
/client/.git/COMMIT_EDITMSG |
2026-10-22 03:15:52.358294-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-10-22 03:15:53.000293-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Linux; Android 9; SM-G965F) AppleWebKit/537.36 |
2026-10-22 03:15:53.000293-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux i686; rv:16.0) Gecko/20100101 Firefo |
2026-10-22 03:15:53.000293-04:00 |
| canary-farm-1 |
AuthorizedProxySender/2.0 |
2026-10-22 03:15:53.000293-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/ |
2026-10-22 03:15:53.000293-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; U; Android 1.5; de-de; Galaxy Build/CUPC |
2026-10-22 03:15:53.000293-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 5.1.1; A571VL Build/LMY47V; wv) |
2026-10-22 03:15:53.000293-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-10-22 03:15:53.000293-04:00 |
| netcup-ts |
Mozilla/5.0 (compatible; PHP-Inventory-Fingerprint/7.2) |
2026-10-22 03:15:53.000293-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ |
2026-10-22 03:15:53.000293-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.116.20 |
13776 |
6 |
13776 |
10-22 01:54 |
10-22 01:55 |
- |
tzulo, inc. |
US |
0 |
| netcup-ts |
185.73.23.168 |
2965 |
3 |
13 |
10-21 05:27 |
10-22 06:07 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.168 |
2764 |
3 |
12 |
10-21 05:27 |
10-22 06:09 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.162 |
2580 |
2 |
19 |
10-21 03:47 |
10-22 06:10 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
2360 |
2 |
20 |
10-21 03:45 |
10-22 06:14 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
185.73.23.161 |
877 |
2 |
6 |
10-21 07:13 |
10-21 20:27 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| lauterbourg-01-ts |
163.192.211.99 |
587 |
6 |
587 |
10-21 16:40 |
10-21 16:40 |
- |
Oracle Corporation |
US |
0 |
| sponge-01-ts |
163.192.109.234 |
587 |
5 |
587 |
10-21 16:44 |
10-21 16:44 |
- |
Oracle Corporation |
US |
0 |
| control-1 |
147.224.212.88 |
587 |
41 |
587 |
10-21 13:19 |
10-21 13:19 |
- |
Oracle Corporation |
US |
0 |
| canary-farm-1 |
147.224.133.69 |
587 |
42 |
587 |
10-21 18:08 |
10-21 18:08 |
- |
Oracle Corporation |
US |
0 |
| sponge-01-ts |
185.73.23.161 |
567 |
2 |
7 |
10-21 07:04 |
10-21 19:53 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| netcup-ts |
45.138.12.24 |
424 |
13 |
319 |
10-21 04:02 |
10-21 05:13 |
- |
Tc Datacenter Limited |
LT |
20 |
| lauterbourg-01-ts |
151.243.18.111 |
300 |
6 |
150 |
10-21 04:14 |
10-21 04:14 |
- |
Dedik Services Limited |
US |
0 |
| canary-farm-1 |
146.70.211.38 |
292 |
22 |
106 |
10-21 05:50 |
10-21 06:04 |
- |
M247 Europe SRL |
US |
12 |
| netcup-ts |
45.138.12.51 |
264 |
3 |
85 |
10-21 04:25 |
10-21 19:23 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
13 |
10 |
| control-1 |
23 |
14 |
| canary-farm-1 |
28 |
16 |
| ru-edge-1 |
6 |
6 |
Mint failures (24h): ai-devbox-1:400x12; control-1:400x6; canary-farm-1:400x19; ru-edge-1:400x11
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
23 |
| ai-devbox-1 |
["aws"] |
13 |
| ru-edge-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws"] |
28 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1680
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 241
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1471 |
| ai-devbox-1 |
https |
472 |
| canary-farm-1 |
http |
2877 |
| canary-farm-1 |
https |
726 |
| control-1 |
http |
2173 |
| frantech-ts |
http |
14378 |
| lauterbourg-01-ts |
http |
1603 |
| lauterbourg-01-ts |
https |
240 |
| netcup-ts |
http |
8295 |
| ru-edge-1 |
http |
1501 |
| sponge-01-ts |
http |
7273 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14368 |
| canary-farm-1 |
109.123.246.142 |
2445 |
| control-1 |
38.54.2.209 |
2159 |
| netcup-ts |
159.195.21.150 |
1755 |
| sponge-01-ts |
89.167.72.144 |
1571 |
| ru-edge-1 |
130.94.89.46 |
1490 |
| lauterbourg-01-ts |
89.116.25.211 |
1441 |
| canary-farm-1 |
sso.rightabouteverything.show |
1147 |
| ai-devbox-1 |
inference.fapthropic.com |
1001 |
| ai-devbox-1 |
217.15.163.226 |
933 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (39 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
147.224.133.69 |
42 |
/ [tarpit-module] → /.git/info/refs [fake-git] → /.git/HEAD [fake-git] → /.git/COMMIT_EDITMSG [fake-git] → /.git/logs/HEAD [fake-git] → /HEAD [not-handled] → /app/.git/COMMIT_EDITMSG [fake-git] → /config [not-handled] → /app/.git/refs/heads/main [fake-git] → /api/.git/packed-refs [fake-git] → /app/.git/config [fake-git] → /description [not-handled] |
Oracle Corporation |
US |
| control-1 |
147.224.212.88 |
41 |
/ [tarpit-module] → /.git/refs/remotes/origin/HEAD [fake-git-error] → /app/.git/config [fake-git-error] → /api/.git/config.worktree [fake-git-error] → /backend/.git/HEAD [fake-git-error] → /backend/.git/logs/HEAD [fake-git-error] → /api/.git/COMMIT_EDITMSG [fake-git-error] → /frontend/.git/packed-refs [fake-git-error] → /frontend/.git/refs/heads/main [fake-git-error] → /frontend/.git/COMMIT_EDITMSG [fake-git-error] → /web/.git/HEAD [fake-git-error] → /web/.git/info/refs [fake-git-error] |
Oracle Corporation |
US |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqtb3d60d73 [not-handled] → /kmonbasezdfd624a6c [not-handled] → /.env.production [env-production] → /.gitlab-ci.yml [gitlab-ci] → /.htaccess [not-handled] → /.git/config [fake-git] → /web.config [iis-web-config] → /.env.production.local [env-production] → /secrets.yaml [app-config-yaml] → /config.json [config-json] → /application-prod.yml [application-yml] → /.aws/credentials [aws-credentials-file] |
Omniline Investment s.r.o. |
BG |
| ai-devbox-1 |
128.14.224.214 |
32 |
/ [tarpit-module] → /_next/static/_buildManifest.js [not-handled] → /.env.production [env-production] → /.env.staging [env-production] → /.env.local [env-production] → /.env [issued] → /.env.development [env-production] → /.env.prod [env-production] → /.env.test [env-production] → /.env.dev [env-production] → /.env.backup [env-production] → /.env.old [env-production] |
UCLOUD INFORMATION TECHNOLOG |
US |
| ai-devbox-1 |
146.70.211.38 |
28 |
/ [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /.env [tracebit-http-error] → /.env.save [env-production-error] → /.env.old [env-production-error] → /.env.prod [env-production-error] |
M247 Europe SRL |
US |
| canary-farm-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.38.208.202 |
26 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
209.38.248.17 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
157.230.19.140 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
143.244.168.161 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.172.158.128 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
128.199.182.55 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
46.101.1.225 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 361 sources sent credentials → 253 got a shell (70%) → 192 ran a command (76% of shell-getters, 53% of sources)
- event level: 9027 credential attempts → 4038 accepted logins → 7097 commands (176% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1099 attempts
New commands this window (0 of 47 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1288 |
2 |
109.160.32.152 |
"uname -s -v -n -r -m" |
| 1288 |
2 |
109.160.32.152 |
"uname -m | awk '{printf $1}'" |
| 980 |
170 |
14.103.117.84 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 858 |
160 |
14.103.117.84 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 281 |
3 |
45.148.10.61 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 281 |
3 |
45.148.10.61 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
| 281 |
3 |
45.148.10.61 |
"/bin/./uname -s -v -n -r -m" |
| 281 |
3 |
45.148.10.61 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 3577 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 959 |
345gs5662d34 |
345gs5662d34 |
| 610 |
root |
3245gs5662d34 |
| 70 |
root |
123456 |
| 61 |
admin |
3245gs5662d34 |
| 54 |
ubuntu |
3245gs5662d34 |
| 53 |
user |
wasd |
| 43 |
pi |
raspberry |
| 35 |
user |
3245gs5662d34 |