flux fleet digest — 2026-10-24 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2028 |
223 |
1799 |
214 |
+13% |
| canary-farm-1 |
3645 |
241 |
2256 |
180 |
+62% |
| control-1 |
1369 |
152 |
3081 |
126 |
-56% |
| frantech-ts |
1079 |
94 |
12569 |
82 |
-91% |
| lauterbourg-01-ts |
2644 |
205 |
1354 |
138 |
+95% |
| netcup-ts |
1214 |
119 |
5998 |
96 |
-80% |
| ru-edge-1 |
1075 |
98 |
11044 |
123 |
-90% |
| sponge-01-ts |
738 |
107 |
6061 |
109 |
-88% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
backup-archive |
148 |
0.0 |
infx |
| ai-devbox-1 |
sql-dump |
30 |
5.0 |
6.0x |
| canary-farm-1 |
backup-archive |
300 |
8.0 |
37.5x |
| canary-farm-1 |
env-production |
294 |
84.3 |
3.5x |
| canary-farm-1 |
sql-dump |
64 |
12.0 |
5.3x |
| canary-farm-1 |
wp-login-credentials |
81 |
16.7 |
4.9x |
| control-1 |
backup-archive-error |
148 |
11.5 |
12.9x |
| control-1 |
sql-dump-error |
30 |
6.0 |
5.0x |
| lauterbourg-01-ts |
cmd-injection-php-cgi-rce |
21 |
5.0 |
4.2x |
| lauterbourg-01-ts |
openapi-spec-json-skeleton |
22 |
2.4 |
9.2x |
| lauterbourg-01-ts |
php2shell-login |
122 |
0.0 |
infx |
| lauterbourg-01-ts |
php2shell-root |
192 |
0.0 |
infx |
| lauterbourg-01-ts |
tarpit |
70 |
13.3 |
5.3x |
| lauterbourg-01-ts |
tarpit-disconnect |
57 |
11.0 |
5.2x |
| lauterbourg-01-ts |
tarpit-module |
418 |
123.7 |
3.4x |
| lauterbourg-01-ts |
webshell-probe |
40 |
12.6 |
3.2x |
| ru-edge-1 |
fake-git-miss |
264 |
17.5 |
15.1x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
125 |
872 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
11 |
539 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| b07c7bb207b4 ⟳ |
10 |
410 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 2d3e95b722b5 |
9 |
369 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
| c540fc530a5a ⟳ |
7 |
273 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| ef1ab74f3d57 ⟳ |
6 |
294 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
6 |
328 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5c4b5dc2fb71 ⟳ |
5 |
35 |
ai-devbox-1,control-1,frantech-ts,lauterbourg-01-ts,sponge-01-ts ⚠FLEET-WIDE |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.git/objects/2c/d64c902fe68ae9243bd849b93c8809e0ec32b1 |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/env.ts |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/.git/objects/56/ade5e4bf4019e0bf6264a007fe05b702ffdaa3 |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/.git/objects/67/10a499fe6c6f0bd3c281ef7db4d00d5024270b |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/db.ts |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/list.php |
2026-10-24 03:32:38.081037-04:00 |
| canary-farm-1 |
/.git/objects/99/ab678f2abad3b7696edd522009423cc23bb5c0 |
2026-10-24 03:32:38.081037-04:00 |
| netcup-ts |
/shibboleth/.env |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/assets/js/app.js |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/..��..��..��..��..��..��.env |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/.well-known/graphql |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/swagger-ui/ |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/credentials/store/system/domain/_/ |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/horizon/dashboard |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/log-viewer |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/livewire/livewire.js.map |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/vendor/bin/.phpunit/phpunit/src/Util/PHP/eval-stdin.php |
2026-10-24 03:16:14.632543-04:00 |
| lauterbourg-01-ts |
/vendor/phpunit/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
2026-10-24 03:16:14.632543-04:00 |
| ai-devbox-1 |
/data.zip |
2026-10-24 03:16:14.632543-04:00 |
| ai-devbox-1 |
/db.tgz |
2026-10-24 03:16:14.632543-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (compatible; WebMap/1.0; research scanner) |
2026-10-24 03:32:38.380818-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36 |
2026-10-24 03:32:38.380818-04:00 |
| canary-farm-1 |
db-secret-scanner/parsing.py |
2026-10-24 03:32:38.380818-04:00 |
| ru-edge-1 |
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) |
2026-10-24 03:16:14.783869-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 |
2026-10-24 03:16:14.783869-04:00 |
| ru-edge-1 |
Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.4 |
2026-10-24 03:16:14.783869-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0.1 Mobile/15E148 Safari/604.1 |
2026-10-24 03:16:14.783869-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.1 Mobile/15E148 Safari/604.1 |
2026-10-24 03:16:14.783869-04:00 |
| lauterbourg-01-ts |
PHP-LAN-Audit/1.0 |
2026-10-24 03:16:14.783869-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (compatible; research) |
2026-10-24 03:16:14.783869-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
136.66.182.42 |
649 |
57 |
297 |
10-24 05:03 |
10-24 05:03 |
- |
Google LLC |
US |
21 |
| lauterbourg-01-ts |
2.58.56.23 |
597 |
34 |
402 |
10-23 18:26 |
10-23 18:26 |
- |
1337 Services GmbH |
NL |
19 |
| canary-farm-1 |
176.65.148.23 |
453 |
1 |
30 |
10-23 06:27 |
10-24 06:20 |
firehol2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
195.178.110.137 |
392 |
4 |
391 |
10-23 21:06 |
10-23 21:09 |
- |
Techoff Srv Limited |
BG |
0 |
| frantech-ts |
195.178.110.137 |
392 |
2 |
391 |
10-23 12:49 |
10-23 12:50 |
- |
Techoff Srv Limited |
BG |
0 |
| ai-devbox-1 |
195.178.110.137 |
392 |
4 |
391 |
10-23 14:20 |
10-23 14:21 |
- |
Techoff Srv Limited |
BG |
0 |
| ru-edge-1 |
45.138.12.35 |
384 |
2 |
372 |
10-24 03:46 |
10-24 03:47 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
45.148.10.125 |
354 |
2 |
177 |
10-23 11:20 |
10-24 04:56 |
firehol2 |
Techoff Srv Limited |
NL |
0 |
| netcup-ts |
213.209.159.154 |
340 |
5 |
268 |
10-23 07:18 |
10-24 05:14 |
- |
Feo Prest SRL |
DE |
0 |
| canary-farm-1 |
185.177.72.9 |
240 |
41 |
164 |
10-23 13:13 |
10-23 13:16 |
ipsum:1 |
Bucklog SARL |
FR |
19 |
| lauterbourg-01-ts |
185.177.72.49 |
239 |
23 |
181 |
10-23 13:53 |
10-23 13:55 |
ipsum:5 firehol2 |
Bucklog SARL |
FR |
19 |
| sponge-01-ts |
213.209.159.154 |
170 |
5 |
167 |
10-23 10:31 |
10-23 10:31 |
- |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
137.23.38.53 |
160 |
9 |
160 |
10-24 03:51 |
10-24 03:51 |
- |
Oracle Corporation |
IN |
0 |
| canary-farm-1 |
137.23.38.53 |
160 |
32 |
160 |
10-23 17:33 |
10-23 17:34 |
- |
Oracle Corporation |
IN |
0 |
| control-1 |
213.209.159.175 |
155 |
15 |
49 |
10-23 06:17 |
10-23 15:05 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
11 |
5 |
| ai-devbox-1 |
17 |
16 |
| ru-edge-1 |
5 |
3 |
| canary-farm-1 |
63 |
16 |
| frantech-ts |
0 |
0 |
| lauterbourg-01-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): control-1:400x3; ai-devbox-1:?x1; canary-farm-1:400x12; ai-devbox-1:400x3; ru-edge-1:400x3
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
11 |
| canary-farm-1 |
["aws"] |
63 |
| ai-devbox-1 |
["aws"] |
17 |
| ru-edge-1 |
["aws"] |
5 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2354
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 488
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1641 |
| ai-devbox-1 |
https |
387 |
| canary-farm-1 |
http |
2575 |
| canary-farm-1 |
https |
1070 |
| control-1 |
http |
1369 |
| frantech-ts |
http |
1071 |
| frantech-ts |
https |
8 |
| lauterbourg-01-ts |
http |
2235 |
| lauterbourg-01-ts |
https |
409 |
| netcup-ts |
http |
1214 |
| ru-edge-1 |
http |
1075 |
| sponge-01-ts |
http |
738 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
109.123.246.142 |
2203 |
| lauterbourg-01-ts |
89.116.25.211 |
1546 |
| canary-farm-1 |
sso.rightabouteverything.show |
1437 |
| control-1 |
38.54.2.209 |
1354 |
| ai-devbox-1 |
217.15.163.226 |
1233 |
| netcup-ts |
159.195.21.150 |
1096 |
| frantech-ts |
209.141.62.110 |
1063 |
| ru-edge-1 |
130.94.89.46 |
1002 |
| ai-devbox-1 |
inference.fapthropic.com |
778 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
743 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (41 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
136.66.182.42 |
57 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /cn9dmljmheoztclss0nb [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /lt0qksl7ky9omb0xytcb [not-handled] → /graphql [graphql-introspection] → /.env [issued] → /document.php [webshell-sweep-observed] → /static/.env [tarpit-module] → /static/app/.env [tarpit-module] |
Google LLC |
US |
| canary-farm-1 |
185.177.72.9 |
41 |
/wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /backend/.env [env-production] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /info.php [phpinfo] → /error/ [not-handled] → /api/user [not-handled] → /............\var/log/apache2/access.log [not-handled] |
Bucklog SARL |
FR |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt06c3331e [not-handled] → /kmonbasezd0cd3f27b [not-handled] → /.env.test [env-production] → /application.yml [application-yml] → /html/.env [env-production] → /Jenkinsfile [jenkinsfile] → /database.sql [sql-dump] → /.env.old [env-production] → /docker-compose.yml [docker-compose] → /db.sql.gz [backup-archive] → /.env.development [env-production] → /.git-credentials [git-credentials-error] |
Omniline Investment s.r.o. |
BG |
| lauterbourg-01-ts |
2.58.56.23 |
34 |
/ [php2shell-root] → /login [php2shell-login] → /public/ [not-handled] → /index.php [php2shell-index] → /.env [not-handled] → /.env.old [not-handled] → /.env.local [not-handled] → /.env.backup [not-handled] → /.env.bak [not-handled] → /.env.development [not-handled] → /.env.save [not-handled] → /.env.dev [not-handled] |
1337 Services GmbH |
NL |
| canary-farm-1 |
137.23.38.53 |
32 |
/.env [issued] → /.env.local [env-production] → /.env.production [env-production] → /.env.production.local [env-production] → /.env.backup [env-production] → /.env.bak [env-production] → /.env.old [env-production] → /.env.save [env-production] → /.env.dev [env-production] → /.env.staging [env-production] → /.env.test [env-production] → /.env.prod [env-production] |
Oracle Corporation |
IN |
| ai-devbox-1 |
45.138.12.16 |
31 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/entries [fake-svn] → /.git/config [fake-git-error] → /_boost/browser-logs [not-handled] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
146.190.242.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
165.22.235.3 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
138.68.144.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
209.38.248.17 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 582 sources sent credentials → 437 got a shell (75%) → 354 ran a command (81% of shell-getters, 61% of sources)
- event level: 21403 credential attempts → 5422 accepted logins → 7260 commands (134% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 733 attempts
New commands this window (0 of 75 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3000 |
1 |
103.241.232.99 |
"echo -e "\x6F\x6B"" |
| 661 |
2 |
109.160.32.105 |
"uname -s -v -n -r -m" |
| 661 |
2 |
109.160.32.105 |
"uname -m | awk '{printf $1}'" |
| 403 |
317 |
103.187.146.196 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 352 |
279 |
103.187.146.196 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 207 |
6 |
193.32.162.84 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 207 |
6 |
193.32.162.84 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 190 |
4 |
179.43.153.2 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 17593 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 386 |
345gs5662d34 |
345gs5662d34 |
| 331 |
root |
3245gs5662d34 |
| 67 |
root |
123456 |
| 56 |
pi |
raspberry |
| 47 |
user |
wasd |
| 32 |
admin |
admin |
| 29 |
support |
support |
| 13 |
ubuntu |
3245gs5662d34 |