flux fleet digest — 2026-10-23 19:41 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
731 |
125 |
1955 |
221 |
-63% |
| canary-farm-1 |
1323 |
159 |
2418 |
181 |
-45% |
| control-1 |
2290 |
108 |
3533 |
130 |
-35% |
| frantech-ts |
668 |
68 |
14534 |
85 |
-95% |
| lauterbourg-01-ts |
1082 |
99 |
1358 |
145 |
-20% |
| netcup-ts |
2505 |
55 |
6290 |
109 |
-60% |
| ru-edge-1 |
70276 |
96 |
1210 |
127 |
+5709% |
| sponge-01-ts |
1647 |
77 |
6415 |
115 |
-74% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
wp-login-credentials |
48 |
1.0 |
48.0x |
| control-1 |
cmd-injection-php-cgi-rce |
20 |
5.6 |
3.6x |
| control-1 |
docker-registry-manifest |
45 |
15.0 |
3.0x |
| control-1 |
docker-registry-tags |
45 |
15.0 |
3.0x |
| control-1 |
phpunit-eval-stdin |
148 |
39.0 |
3.8x |
| frantech-ts |
docker-registry-manifest |
25 |
7.9 |
3.2x |
| frantech-ts |
docker-registry-tags |
25 |
7.9 |
3.2x |
| netcup-ts |
docker-registry-manifest |
25 |
7.5 |
3.3x |
| netcup-ts |
docker-registry-tags |
25 |
7.5 |
3.3x |
| ru-edge-1 |
app-config-php |
30 |
1.7 |
18.0x |
| ru-edge-1 |
backup-archive |
141 |
3.3 |
42.3x |
| ru-edge-1 |
docker-registry-manifest |
45 |
15.0 |
3.0x |
| ru-edge-1 |
docker-registry-tags |
45 |
15.0 |
3.0x |
| ru-edge-1 |
etc-passwd |
24 |
0.0 |
infx |
| ru-edge-1 |
exchange-autodiscover-probe |
2310 |
0.0 |
infx |
| ru-edge-1 |
exchange-ecp-login |
1546 |
0.0 |
infx |
| ru-edge-1 |
exchange-ews-probe |
1432 |
0.0 |
infx |
| ru-edge-1 |
exchange-oab-probe |
610 |
0.0 |
infx |
| ru-edge-1 |
exchange-owa-landing |
1073 |
1.0 |
1073.0x |
| ru-edge-1 |
fake-svn-error |
69 |
0.0 |
infx |
| ru-edge-1 |
not-handled |
22797 |
258.3 |
88.3x |
| ru-edge-1 |
phpmyadmin-login |
38582 |
16.2 |
2374.3x |
| ru-edge-1 |
rails-database-yml |
27 |
0.0 |
infx |
| ru-edge-1 |
shell-rc |
20 |
4.0 |
5.0x |
| ru-edge-1 |
webshell-probe |
210 |
2.0 |
105.0x |
| ru-edge-1 |
whm-login |
24 |
7.4 |
3.2x |
| sponge-01-ts |
docker-registry-manifest |
25 |
7.9 |
3.2x |
| sponge-01-ts |
docker-registry-tags |
25 |
7.9 |
3.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 4b4cc0ece037 ⟳ |
33 |
232 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 3e1c5eb879e7 ⟳ |
30 |
208 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| c540fc530a5a ⟳ |
10 |
390 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 07424de5d81a |
8 |
312 |
ru-edge-1 |
10-23 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b3c6048a4870 ⟳ |
7 |
280 |
lauterbourg-01-ts |
10-10 |
/ [kiteworks-root-redirect] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-ji |
| 2de0cfe65017 |
7 |
273 |
control-1 |
10-23 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ |
6 |
294 |
canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 81099b9f707e |
5 |
40 |
ai-devbox-1,control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-23 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /favicon.ico [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.git/objects/b0/a638c83a79a201356cca61222a03993b63df6e |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/9a/2ff110f3a1a973d7d5d38781ed1fff53d37dd4 |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/a8/136124db11262a885fcaa9022892df1c1fb82e |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/5d/0e77c2d9ac515aa3c48c62649b6fda6c23c931 |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/07/54489e29d82d7b506b93b5f9aa229e8c57afd7 |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/b5/07143023e685dcb41df1d37dbf199751991da4 |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/8e/39086f73145eb5040767e8aafe38e2dda2afff |
2026-10-23 03:31:09.462648-04:00 |
| canary-farm-1 |
/.git/objects/75/2887da685a3af031ffb8c22c7a1d3867243e71 |
2026-10-23 03:31:09.462648-04:00 |
| ru-edge-1 |
/adminer/checked_accounts.txt |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/iwa/iwa_test.aspx |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/ecp/.sublime-gulp.cache |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/cpanel/adm.php |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/database/_log/error_log |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/ecp/.sunw |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/db/_book |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/dbadmin/2021.tgz |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/HNAP1/.hgrc |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/_phpmyadmin/dat.tar.gz |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/cpanel/admin / |
2026-10-23 03:16:12.624881-04:00 |
| ru-edge-1 |
/database/_mmServerScripts/MMHTTPDB.php |
2026-10-23 03:16:12.624881-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.135 YaBrowser/21.6.3.756 Yowser/2.5 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| lauterbourg-01-ts |
php2shell-109618 |
2026-10-23 03:16:13.021459-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| frantech-ts |
Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (compatible; phase-scan/1.0) |
2026-10-23 03:16:13.021459-04:00 |
| netcup-ts |
Authorized-Audit/1.0 |
2026-10-23 03:16:13.021459-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 UBrowser/5.6.13705.206 Safari/537.36 |
2026-10-23 03:16:13.021459-04:00 |
| canary-farm-1 |
gitdump/1.0 |
2026-10-23 03:16:13.021459-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| ru-edge-1 |
192.153.76.57 |
69576 |
114 |
69174 |
10-22 16:01 |
10-22 17:29 |
- |
Amazon.com, Inc. |
US |
0 |
| netcup-ts |
185.73.23.168 |
1074 |
3 |
11 |
10-22 15:47 |
10-22 21:08 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.168 |
991 |
3 |
8 |
10-22 15:53 |
10-22 21:09 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
213.209.159.175 |
758 |
58 |
419 |
10-22 17:55 |
10-23 03:30 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| netcup-ts |
45.148.10.238 |
700 |
5 |
338 |
10-22 17:25 |
10-22 17:27 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
7 |
| control-1 |
45.148.10.238 |
652 |
31 |
325 |
10-23 02:42 |
10-23 02:45 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
8 |
| canary-farm-1 |
176.65.148.23 |
261 |
1 |
26 |
10-22 22:28 |
10-23 07:31 |
firehol2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| sponge-01-ts |
137.23.38.53 |
160 |
9 |
160 |
10-23 02:21 |
10-23 02:21 |
- |
Oracle Corporation |
IN |
0 |
| lauterbourg-01-ts |
137.23.38.53 |
160 |
9 |
160 |
10-23 01:29 |
10-23 01:30 |
- |
Oracle Corporation |
IN |
0 |
| ai-devbox-1 |
172.237.88.137 |
147 |
21 |
106 |
10-22 22:32 |
10-22 22:33 |
ipsum:1 |
Akamai Connected Cloud |
SG |
1 |
| lauterbourg-01-ts |
207.175.199.227 |
137 |
7 |
137 |
10-22 19:33 |
10-22 19:33 |
- |
Google LLC |
BE |
0 |
| lauterbourg-01-ts |
34.78.112.2 |
114 |
6 |
114 |
10-22 18:46 |
10-22 18:46 |
- |
Google LLC |
BE |
0 |
| ai-devbox-1 |
93.152.221.226 |
103 |
30 |
99 |
10-22 18:49 |
10-22 18:49 |
- |
TechTies Inc. |
DE |
0 |
| netcup-ts |
43.156.228.32 |
98 |
5 |
95 |
10-22 18:38 |
10-22 18:55 |
- |
Tencent Building, Kejizhongy |
SG |
0 |
| netcup-ts |
193.37.32.167 |
95 |
18 |
88 |
10-22 17:16 |
10-22 17:17 |
ipsum:1 |
F.n.s. Holdings Limited |
SG |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
2 |
2 |
| control-1 |
7 |
4 |
| canary-farm-1 |
6 |
5 |
| ru-edge-1 |
3 |
3 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x3; canary-farm-1:400x14; ai-devbox-1:?x2; control-1:400x12; ru-edge-1:400x10
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
7 |
| ru-edge-1 |
["aws"] |
3 |
| canary-farm-1 |
["aws"] |
6 |
| ai-devbox-1 |
["aws"] |
2 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 663
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
470 |
| ai-devbox-1 |
https |
261 |
| canary-farm-1 |
http |
1188 |
| canary-farm-1 |
https |
135 |
| control-1 |
http |
2290 |
| frantech-ts |
http |
668 |
| lauterbourg-01-ts |
http |
816 |
| lauterbourg-01-ts |
https |
266 |
| netcup-ts |
http |
2505 |
| ru-edge-1 |
http |
70276 |
| sponge-01-ts |
http |
1647 |
Top Host headers:
| sensor |
host |
events |
| ru-edge-1 |
130.94.89.46 |
70270 |
| control-1 |
38.54.2.209 |
2283 |
| netcup-ts |
159.195.21.150 |
1367 |
| canary-farm-1 |
109.123.246.142 |
1098 |
| lauterbourg-01-ts |
89.116.25.211 |
737 |
| frantech-ts |
209.141.62.110 |
663 |
| sponge-01-ts |
89.167.72.144 |
647 |
| ai-devbox-1 |
inference.fapthropic.com |
348 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
308 |
| ai-devbox-1 |
217.15.163.226 |
233 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (41 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
192.153.76.57 |
114 |
/ [tarpit-module] → /elmah.axd [observability-elmah] → / [tarpit-disconnect] → / [tarpit] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit-disconnect] → /favicon.ico [tarpit] → /bogus.axd [not-handled] → /efe2b7ba0b4f46df80f35eca58aba9ce [not-handled] → /!.htpasswd [not-handled] → /..;test/ [not-handled] → /.AppleDesktop [not-handled] |
Amazon.com, Inc. |
US |
| control-1 |
213.209.159.175 |
58 |
/site.zip [backup-archive-error] → / [tarpit-module] → /hcvldp59o64orn [not-handled] → /.env [tracebit-http-error] → /settings.json [config-json-error] → /assets/.env [env-production-error] → /assets/config.json [config-json-error] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /admin/.env [env-production-error] → /server/.env [env-production-error] |
Feo Prest SRL |
DE |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt330160c7 [not-handled] → /kmonbasezdc75d449b [not-handled] → /backup/.env [env-production-error] → /.ssh/id_rsa [ssh-private-key-error] → /www/.env [env-production-error] → /db.sql [sql-dump-error] → /deployment.yaml [generic-ci-config-error] → /.env.local [env-production-error] → /app/.env [env-production-error] → /config.php [app-config-php-error] → /.env.production.local [env-production-error] → /ecosystem.config.js [pm2-ecosystem-config-error] |
Omniline Investment s.r.o. |
BG |
| control-1 |
45.148.10.238 |
31 |
/fo.php [webshell-sweep-observed] → /.env [issued] → /aws-config.js [webapp-config-bundle-js] → /.env.prod [env-production] → /helpers/config.js [not-handled] → /php/info.php [phpinfo] → /public/phpinfo.php [phpinfo] → /sys_phpinfo.php [webshell-sweep-observed] → /.aws/credentials [aws-credentials-file] → /backup/.env [env-production] → /database.yml [rails-database-yml] → /env [actuator-env] |
Techoff Srv Limited |
NL |
| ai-devbox-1 |
93.152.221.226 |
30 |
/application/config/email.php [app-config-php-mail-error] → /.env.swp [env-production-error] → /.env~ [env-production-error] → /bootstrap/cache/config.php [app-config-php-error] → /.env.staging [env-production-error] → /config/services.php [app-config-php-services-error] → /.git/HEAD [fake-git-error] → /.env.old [env-production-error] → /.env [tracebit-error] → /config/packages/mailer.yml [not-handled] → /config/mailgun.php [not-handled] → /public/.env [env-production-error] |
TechTies Inc. |
DE |
| ai-devbox-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
165.22.34.189 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
64.227.32.66 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
138.68.82.23 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
209.38.248.17 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
209.97.180.8 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 466 sources sent credentials → 331 got a shell (71%) → 251 ran a command (76% of shell-getters, 54% of sources)
- event level: 34548 credential attempts → 6341 accepted logins → 8733 commands (138% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 679 attempts
New commands this window (2 of 39 distinct):
| events |
IPs |
example source |
command (head) |
| 2 |
1 |
218.157.163.203 |
"scp -t /tmp/1TLz4ZVW" |
| 1 |
1 |
115.190.234.63 |
"echo "root:sbuKXQpoAlOa"|chpasswd|bash" |
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3000 |
1 |
103.241.232.99 |
"echo -e "\x6F\x6B"" |
| 1932 |
3 |
109.160.32.103 |
"uname -s -v -n -r -m" |
| 1932 |
3 |
109.160.32.103 |
"uname -m | awk '{printf $1}'" |
| 371 |
216 |
101.47.158.56 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 323 |
191 |
101.47.158.56 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 259 |
9 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 259 |
9 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 116 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 28090 distinct pairs offered this window, 5794 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 4 |
root |
DsaEwq#21 |
| 3 |
irvps |
irvps |
| 3 |
root |
111111111111 |
| 3 |
dbinst |
123456 |
| 3 |
gns |
gns123 |
| 3 |
zjw |
zjw123 |
| 3 |
spring |
spring123 |
| 3 |
oper |
123456 |