flux fleet digest — 2026-10-25 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2672 |
111 |
1805 |
221 |
+48% |
| canary-farm-1 |
4460 |
207 |
2472 |
196 |
+80% |
| control-1 |
16293 |
114 |
2888 |
133 |
+464% |
| frantech-ts |
767 |
86 |
12654 |
84 |
-94% |
| lauterbourg-01-ts |
3308 |
180 |
1526 |
149 |
+117% |
| netcup-ts |
2031 |
108 |
5490 |
101 |
-63% |
| ru-edge-1 |
16371 |
130 |
11070 |
122 |
+48% |
| sponge-01-ts |
1710 |
112 |
5467 |
109 |
-69% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
docker-compose |
25 |
5.6 |
4.5x |
| ai-devbox-1 |
not-handled |
885 |
154.0 |
5.7x |
| canary-farm-1 |
docker-compose |
36 |
5.5 |
6.5x |
| canary-farm-1 |
not-handled |
1018 |
234.6 |
4.3x |
| canary-farm-1 |
wp-login-probe |
38 |
1.0 |
38.0x |
| control-1 |
docker-compose |
28 |
5.1 |
5.4x |
| control-1 |
not-handled |
14635 |
1360.9 |
10.8x |
| control-1 |
wp-login-credentials |
32 |
1.0 |
32.0x |
| control-1 |
wp-login-probe |
33 |
1.0 |
33.0x |
| lauterbourg-01-ts |
phpmyadmin-login |
162 |
9.4 |
17.2x |
| lauterbourg-01-ts |
wp-xmlrpc-post |
1000 |
60.0 |
16.7x |
| ru-edge-1 |
docker-compose |
26 |
5.2 |
5.0x |
| ru-edge-1 |
fake-git-miss |
264 |
66.8 |
4.0x |
| ru-edge-1 |
not-handled |
14710 |
3426.1 |
4.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
57 |
399 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
30 |
210 |
ai-devbox-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
12 |
588 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ |
8 |
328 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
7 |
328 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 6b025bffa18d |
6 |
23 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| f8bd8d2a7a8c |
5 |
35 |
canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-25 |
/ [tarpit-module] → /index.php [tarpit-module] → / [tarpit-module] → /index.php [tarpit-module] |
| 80905c9f1aa0 |
4 |
16 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → / [php2shell-root] → /login [php2shell-login] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ai-devbox-1 |
/root/.config/fabric/.env |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/root/.kimi-code/credentials/kimi-code.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/root/.kimi-code/config.toml |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.viminfo |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.codeium/windsurf/mcp_config.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.grok/auth.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.config/Exodus/exodus.wallet/passphrase.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.muse-code/credentials.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.config/goose/config.yaml |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/proc/self/cwd/.cache/huggingface/token |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/hotfix/INFRA-198 |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/root/.kube/config |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/root/docker-compose.yaml |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/root/compose.yaml |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/.env.development |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/.git/config |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/.config/github-copilot/hosts.json |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/.netrc |
2026-10-25 03:16:34.781473-04:00 |
| ai-devbox-1 |
/var/www/app/.config/Exodus/exodus.wallet/seed.seco |
2026-10-25 03:16:34.781473-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 |
2026-10-25 03:16:34.971060-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36 |
2026-10-25 03:16:34.971060-04:00 |
| ai-devbox-1 |
KrebsOnSecurity |
2026-10-25 03:16:34.971060-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.0.0 |
2026-10-25 03:16:34.971060-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3048.67 Safari/537.32 |
2026-10-25 03:16:34.971060-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36 |
2026-10-25 03:16:34.971060-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0 |
2026-10-25 03:16:34.971060-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64) Firefox/128.0 |
2026-10-25 03:16:34.971060-04:00 |
| sponge-01-ts |
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E) |
2026-10-25 03:16:34.971060-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 |
2026-10-25 03:16:34.971060-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| control-1 |
103.125.233.17 |
13777 |
6 |
13776 |
10-24 09:18 |
10-24 09:22 |
- |
xTom |
HK |
0 |
| ru-edge-1 |
169.150.211.193 |
13776 |
6 |
13776 |
10-24 11:04 |
10-24 11:05 |
- |
Datacamp Limited |
DE |
0 |
| ru-edge-1 |
195.182.16.183 |
1574 |
42 |
1067 |
10-24 08:21 |
10-24 10:13 |
- |
Amarutu Technology Ltd |
DE |
0 |
| ai-devbox-1 |
195.182.16.183 |
1574 |
42 |
1067 |
10-24 07:41 |
10-24 10:13 |
- |
Amarutu Technology Ltd |
DE |
0 |
| control-1 |
195.182.16.183 |
1574 |
42 |
1067 |
10-24 07:07 |
10-24 10:13 |
- |
Amarutu Technology Ltd |
DE |
0 |
| canary-farm-1 |
195.182.16.183 |
1501 |
41 |
1067 |
10-24 08:25 |
10-24 10:13 |
- |
Amarutu Technology Ltd |
DE |
0 |
| lauterbourg-01-ts |
194.26.192.113 |
1007 |
5 |
5 |
10-24 13:23 |
10-24 13:24 |
- |
1337 Services GmbH |
NL |
1000 |
| netcup-ts |
45.148.10.238 |
909 |
7 |
392 |
10-24 19:51 |
10-24 19:57 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
8 |
| canary-farm-1 |
136.66.182.42 |
649 |
57 |
297 |
10-24 05:03 |
10-24 05:03 |
- |
Google LLC |
US |
21 |
| lauterbourg-01-ts |
195.178.110.137 |
392 |
2 |
391 |
10-24 08:13 |
10-24 08:13 |
- |
Techoff Srv Limited |
BG |
0 |
| ru-edge-1 |
45.138.12.35 |
384 |
2 |
372 |
10-24 03:46 |
10-24 03:47 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
45.138.12.35 |
384 |
2 |
372 |
10-24 16:47 |
10-24 16:47 |
- |
Tc Datacenter Limited |
LT |
0 |
| sponge-01-ts |
85.155.14.15 |
356 |
4 |
356 |
10-24 14:30 |
10-24 14:33 |
- |
SolidCore Hosting LTD |
DE |
0 |
| sponge-01-ts |
213.209.159.154 |
340 |
5 |
268 |
10-24 08:09 |
10-25 04:20 |
- |
Feo Prest SRL |
DE |
0 |
| lauterbourg-01-ts |
130.12.180.117 |
279 |
4 |
73 |
10-25 03:39 |
10-25 03:48 |
ipsum:1 |
Omegatech LTD |
NL |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
13 |
9 |
| ai-devbox-1 |
17 |
14 |
| canary-farm-1 |
62 |
17 |
| ru-edge-1 |
8 |
7 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
62 |
| ai-devbox-1 |
["aws"] |
17 |
| ru-edge-1 |
["aws"] |
8 |
| control-1 |
["aws"] |
13 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1799
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 242
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 4
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2471 |
| ai-devbox-1 |
https |
201 |
| canary-farm-1 |
http |
3375 |
| canary-farm-1 |
https |
1085 |
| control-1 |
http |
16292 |
| control-1 |
https |
1 |
| frantech-ts |
http |
767 |
| lauterbourg-01-ts |
http |
3040 |
| lauterbourg-01-ts |
https |
268 |
| netcup-ts |
http |
2031 |
| ru-edge-1 |
http |
16371 |
| sponge-01-ts |
http |
1710 |
Top Host headers:
| sensor |
host |
events |
| ru-edge-1 |
130.94.89.46 |
16359 |
| control-1 |
38.54.2.209 |
16270 |
| canary-farm-1 |
109.123.246.142 |
3190 |
| ai-devbox-1 |
217.15.163.226 |
2239 |
| netcup-ts |
159.195.21.150 |
1910 |
| sponge-01-ts |
89.167.72.144 |
1696 |
| lauterbourg-01-ts |
89.116.25.211 |
1525 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
1370 |
| canary-farm-1 |
sso.rightabouteverything.show |
1255 |
| frantech-ts |
209.141.62.110 |
750 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (42 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
136.66.182.42 |
57 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /cn9dmljmheoztclss0nb [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /lt0qksl7ky9omb0xytcb [not-handled] → /graphql [graphql-introspection] → /.env [issued] → /document.php [webshell-sweep-observed] → /static/.env [tarpit-module] → /static/app/.env [tarpit-module] |
Google LLC |
US |
| ai-devbox-1 |
195.182.16.183 |
42 |
/etc/passwd [etc-passwd] → /root/.bash_history [bash-history] → /root/.oh-my-zsh [not-handled] → /root/.zsh_history [zsh-history] → /root/docker-compose.yml [docker-compose] → /root/.viminfo [not-handled] → /root/.zshrc [shell-rc] → /root/.bashrc [shell-rc] → /root/.npmrc [npmrc-error] → /root/.ssh/id_rsa [ssh-private-key-error] → /root/.docker/config.json [docker-config] → /root/.git-credentials [git-credentials-error] |
Amarutu Technology Ltd |
DE |
| control-1 |
195.182.16.183 |
42 |
/etc/passwd [etc-passwd] → /root/.bash_history [bash-history] → /root/.zsh_history [zsh-history] → /root/docker-compose.yml [docker-compose] → /root/.oh-my-zsh [not-handled] → /root/.claude/.credentials.json [claude-credentials-root] → /root/.ssh/id_rsa [ssh-private-key-error] → /root/.viminfo [not-handled] → /root/.ssh/id_ed25519 [ssh-private-key-error] → /root/.bashrc [shell-rc] → /root/.profile [shell-rc] → /root/.docker/config.json [docker-config] |
Amarutu Technology Ltd |
DE |
| ru-edge-1 |
195.182.16.183 |
42 |
/etc/passwd [etc-passwd] → /root/.bash_history [bash-history] → /root/.zsh_history [zsh-history] → /root/.bashrc [shell-rc] → /root/.viminfo [not-handled] → /root/.oh-my-zsh [not-handled] → /root/docker-compose.yml [docker-compose] → /root/.zshrc [shell-rc] → /root/.git-credentials [git-credentials-error] → /root/.npmrc [npmrc-error] → /root/.profile [shell-rc] → /root/.docker/config.json [docker-config] |
Amarutu Technology Ltd |
DE |
| canary-farm-1 |
195.182.16.183 |
41 |
/etc/passwd [etc-passwd] → /root/.zsh_history [zsh-history] → /root/.bash_history [bash-history] → /root/.viminfo [not-handled] → /root/.bashrc [shell-rc] → /root/.oh-my-zsh [not-handled] → /root/.zshrc [shell-rc] → /root/.npmrc [npmrc-error] → /root/.profile [shell-rc] → /root/docker-compose.yml [docker-compose] → /root/.git-credentials [git-credentials-error] → /root/.docker/config.json [docker-config] |
Amarutu Technology Ltd |
DE |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt05e51285 [not-handled] → /kmonbasezda5f422a4 [not-handled] → /.env.bak [env-production] → /backup/.env [env-production] → /database.sql [sql-dump] → /.aws/credentials [aws-credentials-file] → /www.zip [backup-archive] → /old/.env [env-production] → /airflow.cfg [airflow-cfg] → /.env.example [env-production] → /config/database.yml [rails-database-yml] → /secrets.json [config-json] |
Omniline Investment s.r.o. |
BG |
| canary-farm-1 |
138.68.82.23 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
164.92.107.174 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
157.245.113.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
206.189.19.19 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 681 sources sent credentials → 525 got a shell (77%) → 460 ran a command (88% of shell-getters, 68% of sources)
- event level: 13011 credential attempts → 3896 accepted logins → 7776 commands (200% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 924 attempts
New commands this window (0 of 1481 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1853 |
3 |
109.160.32.49 |
"uname -s -v -n -r -m" |
| 1853 |
3 |
109.160.32.49 |
"uname -m | awk '{printf $1}'" |
| 546 |
422 |
101.132.159.172 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 463 |
365 |
101.132.159.172 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 175 |
3 |
45.148.10.61 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 175 |
3 |
45.148.10.61 |
"lspci | grep VGA -c" |
| 175 |
3 |
45.148.10.61 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
| 175 |
3 |
45.148.10.61 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
Credentials: 7295 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 522 |
345gs5662d34 |
345gs5662d34 |
| 468 |
root |
3245gs5662d34 |
| 63 |
pi |
raspberry |
| 56 |
user |
wasd |
| 54 |
root |
123456 |
| 31 |
support |
support |
| 24 |
admin |
admin |
| 18 |
ubuntu |
3245gs5662d34 |