flux fleet digest — 2026-10-26 09:16 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1634 |
87 |
1935 |
205 |
-16% |
| canary-farm-1 |
2160 |
216 |
2832 |
205 |
-24% |
| control-1 |
892 |
102 |
4780 |
135 |
-81% |
| frantech-ts |
17368 |
21 |
8722 |
84 |
+99% |
| lauterbourg-01-ts |
14197 |
184 |
1820 |
154 |
+680% |
| netcup-ts |
1540 |
97 |
5059 |
104 |
-70% |
| ru-edge-1 |
4077 |
153 |
13269 |
125 |
-69% |
| sponge-01-ts |
925 |
74 |
4948 |
110 |
-81% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
phpinfo |
64 |
7.7 |
8.3x |
| ai-devbox-1 |
webshell-probe |
68 |
4.0 |
17.0x |
| canary-farm-1 |
phpinfo |
65 |
10.7 |
6.1x |
| canary-farm-1 |
webshell-probe |
68 |
8.0 |
8.5x |
| canary-farm-1 |
wp-login-probe |
130 |
13.3 |
9.8x |
| control-1 |
wp-login-credentials |
115 |
16.5 |
7.0x |
| control-1 |
wp-login-probe |
115 |
11.7 |
9.9x |
| lauterbourg-01-ts |
method-not-allowed |
20 |
5.4 |
3.7x |
| lauterbourg-01-ts |
wp-login-credentials |
51 |
0.0 |
infx |
| lauterbourg-01-ts |
wp-xmlrpc-post |
11807 |
530.0 |
22.3x |
| netcup-ts |
wp-login-credentials |
53 |
13.0 |
4.1x |
| netcup-ts |
wp-login-probe |
53 |
14.8 |
3.6x |
| ru-edge-1 |
env-production |
363 |
45.2 |
8.0x |
| ru-edge-1 |
iis-web-config |
28 |
4.0 |
7.0x |
| ru-edge-1 |
phpinfo |
115 |
6.3 |
18.2x |
| ru-edge-1 |
sftp-config-error |
49 |
3.9 |
12.7x |
| ru-edge-1 |
tarpit-module |
1586 |
428.1 |
3.7x |
| ru-edge-1 |
wp-config |
30 |
4.7 |
6.4x |
| ru-edge-1 |
yii2-debug-view |
23 |
2.3 |
9.9x |
| sponge-01-ts |
phpmyadmin-login |
302 |
41.2 |
7.3x |
| sponge-01-ts |
wp-login-credentials |
40 |
11.0 |
3.6x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
59 |
410 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
19 |
133 |
ai-devbox-1,canary-farm-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| df15d0ee3ccf ⟳ |
7 |
556 |
canary-farm-1,control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 6b025bffa18d ⟳ |
5 |
20 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| 218630667b2c ⟳ |
4 |
168 |
control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 2d3e95b722b5 ⟳ |
4 |
164 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
| 7e61a9500d8b ⟳ |
3 |
147 |
ai-devbox-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/ss_probe_7d1ce3274bbddd1a40338a75436b2280 |
2026-10-26 03:31:43.581698-04:00 |
| netcup-ts |
/.netlify/state.json |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/hetzner.json |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/.scaleway |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/scaleway.json |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/.openstack |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/.softlayer.json |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/.ppk |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/.vpn |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/wg0.conf |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/cisco-vpn |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/paloalto |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/checkpoint |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/mullvad |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/vyprvpn |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/strongvpn |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/globalprotect.conf |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/watchguard.conf |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/forcepoint |
2026-10-26 03:15:43.912471-04:00 |
| netcup-ts |
/proxy.yaml |
2026-10-26 03:15:43.912471-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 |
2026-10-26 03:15:44.667887-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 |
2026-10-26 03:15:44.667887-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3046.80 Safari/537.32 |
2026-10-26 03:15:44.667887-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0 |
2026-10-26 03:15:44.667887-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4294.1377 Mobile Safari/537.36 |
2026-10-26 03:15:44.667887-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15 |
2026-10-26 03:15:44.667887-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 |
2026-10-26 03:15:44.667887-04:00 |
| control-1 |
Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.20 |
2026-10-26 03:15:44.667887-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0.1 Safari/604.3.5 |
2026-10-26 03:15:44.667887-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36 |
2026-10-26 03:15:44.667887-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
23.234.118.146 |
13776 |
6 |
13776 |
10-26 03:29 |
10-26 03:30 |
ipsum:1 |
tzulo, inc. |
US |
0 |
| lauterbourg-01-ts |
136.70.193.85 |
9815 |
5 |
5 |
10-26 05:42 |
10-26 05:59 |
- |
Google LLC |
US |
9807 |
| frantech-ts |
176.119.150.252 |
3074 |
3 |
3074 |
10-25 23:36 |
10-25 23:36 |
- |
Owl Limited |
DE |
0 |
| ru-edge-1 |
102.220.163.241 |
2658 |
39 |
859 |
10-25 08:43 |
10-25 12:13 |
- |
VPS Dedicated LLC |
SI |
0 |
| lauterbourg-01-ts |
194.26.192.113 |
2014 |
5 |
5 |
10-25 08:44 |
10-25 21:07 |
- |
1337 Services GmbH |
NL |
2000 |
| ai-devbox-1 |
102.220.163.241 |
517 |
34 |
511 |
10-25 08:46 |
10-25 12:17 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
93.152.221.96 |
515 |
34 |
511 |
10-25 15:18 |
10-26 05:46 |
- |
TechTies Inc. |
DE |
0 |
| ru-edge-1 |
141.255.162.235 |
477 |
2 |
477 |
10-26 00:15 |
10-26 00:15 |
- |
Private Layer INC |
CH |
0 |
| ai-devbox-1 |
45.138.12.35 |
384 |
2 |
372 |
10-25 21:55 |
10-25 21:55 |
- |
Tc Datacenter Limited |
LT |
0 |
| netcup-ts |
45.138.12.19 |
357 |
1 |
1 |
10-25 14:11 |
10-26 02:28 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
85.155.14.14 |
356 |
47 |
356 |
10-25 22:32 |
10-25 22:36 |
- |
SolidCore Hosting LTD |
DE |
0 |
| frantech-ts |
85.155.14.15 |
356 |
4 |
356 |
10-26 02:56 |
10-26 02:59 |
- |
SolidCore Hosting LTD |
DE |
0 |
| netcup-ts |
85.155.14.14 |
353 |
4 |
353 |
10-25 15:57 |
10-25 16:01 |
- |
SolidCore Hosting LTD |
DE |
0 |
| lauterbourg-01-ts |
34.165.110.232 |
278 |
9 |
273 |
10-25 10:47 |
10-25 10:48 |
- |
Google LLC |
IL |
4 |
| lauterbourg-01-ts |
158.140.191.112 |
254 |
11 |
81 |
10-25 17:08 |
10-25 17:08 |
- |
PT. Eka Mas Republik |
ID |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
14 |
11 |
| control-1 |
7 |
6 |
| canary-farm-1 |
18 |
15 |
| ru-edge-1 |
11 |
7 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): canary-farm-1:400x2; control-1:400x1
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
18 |
| ai-devbox-1 |
["aws"] |
14 |
| ru-edge-1 |
["aws"] |
11 |
| control-1 |
["aws"] |
7 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 3491
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 2156
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1533 |
| ai-devbox-1 |
https |
101 |
| canary-farm-1 |
http |
1946 |
| canary-farm-1 |
https |
214 |
| control-1 |
http |
892 |
| frantech-ts |
http |
17368 |
| lauterbourg-01-ts |
http |
13177 |
| lauterbourg-01-ts |
https |
1020 |
| netcup-ts |
http |
1540 |
| ru-edge-1 |
http |
4077 |
| sponge-01-ts |
http |
925 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
17367 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
13263 |
| ru-edge-1 |
127.0.0.1 |
2141 |
| ru-edge-1 |
130.94.89.46 |
1910 |
| canary-farm-1 |
109.123.246.142 |
1815 |
| ai-devbox-1 |
217.15.163.226 |
1438 |
| netcup-ts |
159.195.21.150 |
1425 |
| sponge-01-ts |
89.167.72.144 |
907 |
| lauterbourg-01-ts |
89.116.25.211 |
878 |
| control-1 |
38.54.2.209 |
876 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (43 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
85.155.14.14 |
47 |
/.aws/credentials [aws-credentials-file] → /.aws/credentials.old [aws-credentials-file] → /.aws/config [aws-config-file] → /aws_credentials.json [aws-credentials-json] → /aws_credentials [not-handled] → /.aws/cli/cache [not-handled] → /.aws/credentials.bak [aws-credentials-file] → /.aws/config.bak [not-handled] → /.aws/sso/cache [not-handled] → /boto.cfg [not-handled] → /aws_config.json [not-handled] → /.azure/azureProfile.json [azure-cli-profile] |
SolidCore Hosting LTD |
DE |
| ru-edge-1 |
102.220.163.241 |
39 |
/ [tarpit-module] → /pscan-d5b81a53-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-4cb28331-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
93.152.221.96 |
34 |
/.env [issued] → / [tarpit-module] → /pscan-c725d57f-nonexistent.txt [not-handled] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
DE |
| canary-farm-1 |
159.89.174.87 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
IN |
| ai-devbox-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
46.101.1.225 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
159.223.132.86 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
207.154.212.47 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 691 sources sent credentials → 519 got a shell (75%) → 470 ran a command (91% of shell-getters, 68% of sources)
- event level: 29862 credential attempts → 5602 accepted logins → 16550 commands (295% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1543 attempts
New commands this window (182 of 8846 distinct):
| events |
IPs |
example source |
command (head) |
| 1 |
1 |
62.171.133.1 |
"sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_13290fd273a4305b3809f736c8cfe138_small_done'"'"''" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_2f60dea24b77597ed25328a4055bc4db_small_math'"'"' "$((165*508+4))"'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'f_check_30b3edf7c3f94b4e4f16550ac42351d8() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_30b3edf7c3f94b4e4f16550ac42351d8_small_fu |
| 1 |
1 |
62.171.133.1 |
"sh -c 'set -- '"'"'check_9e77289e051d50f145531945050a3e06_arg1'"'"' '"'"'check_9e77289e051d50f145531945050a3e06_arg2'"'"'; printf ' |
| 1 |
1 |
62.171.133.1 |
"sh -c 'f_check_0c1fe2b36feeeaf206f4003958e00aa0() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_0c1fe2b36feeeaf206f4003958e00aa0_small_fu |
| 1 |
1 |
62.171.133.1 |
"sh -c 'f_check_538d9a325010a68801783a25c7b3ea6a() { printf '"'"'\n%s|%s\n'"'"' '"'"'check_538d9a325010a68801783a25c7b3ea6a_small_fu |
| 1 |
1 |
62.171.133.1 |
"echo; echo 'check_1acf3b6e8107f2eee213ffe54cf8e3c4_transport_done'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_379152ef27f9cae490babe6c98e2c4fd_small_control'"'"' '"'"'check_379152ef27f9cae490b |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_30b3edf7c3f94b4e4f16550ac42351d8_small_pid'"'"' "$$"'" |
| 1 |
1 |
92.118.39.50 |
"sh -c 'printf '"'"'\n%s\n'"'"' '"'"'check_30b3edf7c3f94b4e4f16550ac42351d8_small_done'"'"''" |
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2119 |
2 |
77.239.124.2 |
"uname -s -v -n -r -m" |
| 2119 |
2 |
77.239.124.2 |
"uname -m | awk '{printf $1}'" |
| 959 |
34 |
14.103.120.124 |
"uname -a" |
| 923 |
1 |
77.239.124.161 |
"(cat /proc/cpuinfo|grep name|cut -f2 -d:|uniq -c && uname -a|cut -d' ' -f1,2,3,7,11|tr '\n' ' ' && echo IPv4 ; curl -s ipv4.icanhazip.com |
| 739 |
413 |
102.23.122.235 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 649 |
371 |
102.23.122.235 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 21 |
16 |
14.103.120.124 |
"cat /proc/cpuinfo | grep name | wc -l" |
| 20 |
19 |
120.26.117.218 |
"uname -s -m" |
Credentials: 20600 distinct pairs offered this window, 1589 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 3 |
root |
Password2019 |
| 2 |
msf |
postgresdev |
| 2 |
akash |
share123 |
| 2 |
akash |
P@ssw9rd |
| 2 |
akash |
lijuntmp |
| 2 |
msf |
tecnici |
| 2 |
msf |
johnny |
| 2 |
msf |
yuchen |