flux fleet digest — 2026-10-27 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1784 |
147 |
1930 |
168 |
-8% |
| canary-farm-1 |
25738 |
197 |
2945 |
218 |
+774% |
| control-1 |
4151 |
130 |
4399 |
132 |
-6% |
| frantech-ts |
14537 |
93 |
9116 |
77 |
+59% |
| lauterbourg-01-ts |
32508 |
138 |
3701 |
156 |
+778% |
| netcup-ts |
990 |
102 |
4352 |
104 |
-77% |
| ru-edge-1 |
23123 |
120 |
13723 |
131 |
+68% |
| sponge-01-ts |
746 |
107 |
3598 |
108 |
-79% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
fake-git |
286 |
81.3 |
3.5x |
| canary-farm-1 |
app-config-php |
26 |
3.5 |
7.4x |
| canary-farm-1 |
app-config-yaml |
32 |
4.0 |
8.0x |
| canary-farm-1 |
aws-config-file |
84 |
2.8 |
29.6x |
| canary-farm-1 |
aws-credentials-file |
178 |
5.3 |
33.7x |
| canary-farm-1 |
config-json |
43 |
10.3 |
4.2x |
| canary-farm-1 |
env-production |
946 |
128.4 |
7.4x |
| canary-farm-1 |
etc-passwd |
135 |
1.0 |
135.0x |
| canary-farm-1 |
etc-shadow |
84 |
1.0 |
84.0x |
| canary-farm-1 |
issued |
340 |
36.3 |
9.4x |
| canary-farm-1 |
not-handled |
1702 |
399.9 |
4.3x |
| canary-farm-1 |
php-filter-issued |
240 |
0.0 |
infx |
| canary-farm-1 |
phpinfo |
83 |
18.7 |
4.4x |
| canary-farm-1 |
phpmyadmin-credential-post |
3113 |
0.0 |
infx |
| canary-farm-1 |
phpmyadmin-login |
572 |
89.2 |
6.4x |
| canary-farm-1 |
phpunit-eval-stdin |
356 |
75.8 |
4.7x |
| canary-farm-1 |
tarpit-module |
15421 |
833.4 |
18.5x |
| canary-farm-1 |
tomcat-manager-console-challenge |
307 |
0.0 |
infx |
| canary-farm-1 |
tomcat-manager-ui |
198 |
0.0 |
infx |
| canary-farm-1 |
tomcat-manager-ui-challenge |
140 |
1.0 |
140.0x |
| canary-farm-1 |
webapp-form-profile |
89 |
8.2 |
10.9x |
| canary-farm-1 |
wp-config |
34 |
5.6 |
6.1x |
| control-1 |
aws-config-file |
20 |
2.4 |
8.3x |
| control-1 |
aws-credentials-file |
33 |
3.1 |
10.5x |
| control-1 |
issued |
68 |
13.0 |
5.2x |
| control-1 |
php-filter-issued |
102 |
0.0 |
infx |
| control-1 |
phpinfo |
62 |
9.3 |
6.7x |
| control-1 |
phpmyadmin-credential-post |
94 |
0.0 |
infx |
| control-1 |
phpmyadmin-login |
71 |
9.2 |
7.7x |
| control-1 |
tarpit-module |
2338 |
601.6 |
3.9x |
| control-1 |
tomcat-manager-console-challenge |
39 |
0.0 |
infx |
| control-1 |
tomcat-manager-ui |
49 |
2.0 |
24.5x |
| control-1 |
webshell-probe |
69 |
3.5 |
19.7x |
| lauterbourg-01-ts |
tarpit-module |
827 |
209.0 |
4.0x |
| lauterbourg-01-ts |
wp-login-credentials |
18032 |
51.0 |
353.6x |
| netcup-ts |
wp-login-probe |
56 |
17.0 |
3.3x |
| ru-edge-1 |
aws-config-file |
98 |
3.3 |
29.4x |
| ru-edge-1 |
aws-credentials-file |
192 |
3.8 |
50.1x |
| ru-edge-1 |
env-production |
660 |
90.6 |
7.3x |
| ru-edge-1 |
env-production-error |
81 |
20.8 |
3.9x |
| ru-edge-1 |
etc-passwd |
146 |
12.5 |
11.7x |
| ru-edge-1 |
etc-shadow |
95 |
1.0 |
95.0x |
| ru-edge-1 |
issued |
377 |
6.9 |
55.0x |
| ru-edge-1 |
php-filter-issued |
574 |
0.0 |
infx |
| ru-edge-1 |
phpinfo-error |
54 |
9.4 |
5.7x |
| ru-edge-1 |
phpmyadmin-credential-post |
1560 |
0.0 |
infx |
| ru-edge-1 |
phpunit-eval-stdin |
400 |
51.1 |
7.8x |
| ru-edge-1 |
tarpit-module |
14823 |
607.1 |
24.4x |
| ru-edge-1 |
tomcat-manager-console-challenge |
321 |
6.0 |
53.5x |
| ru-edge-1 |
tomcat-manager-ui |
296 |
0.0 |
infx |
| ru-edge-1 |
tomcat-manager-ui-challenge |
147 |
4.5 |
32.7x |
| ru-edge-1 |
webapp-form-profile |
85 |
1.8 |
46.4x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
80 |
556 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
32 |
225 |
ai-devbox-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
10 |
490 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| df15d0ee3ccf ⟳ |
9 |
570 |
canary-farm-1,control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-01 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 6b025bffa18d ⟳ |
7 |
51 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 321f17b2aca0 ⟳ |
5 |
36 |
ai-devbox-1,canary-farm-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 2d3e95b722b5 ⟳ |
4 |
164 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/.env.save.backup |
2026-10-27 03:16:46.876668-04:00 |
| canary-farm-1 |
/.env.save.stage |
2026-10-27 03:16:46.876668-04:00 |
| canary-farm-1 |
/.env.save.production |
2026-10-27 03:16:46.876668-04:00 |
| canary-farm-1 |
/mgmt/tm/util/bash |
2026-10-27 03:16:46.876668-04:00 |
| canary-farm-1 |
/django_settings.py |
2026-10-27 03:16:46.876668-04:00 |
| ru-edge-1 |
/backend/administrator/.env |
2026-10-27 03:16:46.876668-04:00 |
| ru-edge-1 |
/.env.save.prod |
2026-10-27 03:16:46.876668-04:00 |
| ru-edge-1 |
/backend/admin/.env |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/aws/secrets.env |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/monitoring |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/settings/integrations |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/settings/webhooks |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/bookings |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/admin/dashboard |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/supabase/config.toml |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/public/admin.json |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/@fs/root/.env |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/.env::$DATA |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/.dev.vars.production |
2026-10-27 03:16:46.876668-04:00 |
| lauterbourg-01-ts |
/.terraform.rc |
2026-10-27 03:16:46.876668-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux i686; rv:110.0) Gecko/20100101 Firefox/110.0 |
2026-10-27 03:32:25.008960-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0 Safari/537.36 |
2026-10-27 03:16:47.009474-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 |
2026-10-27 03:16:47.009474-04:00 |
| frantech-ts |
Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 |
2026-10-27 03:16:47.009474-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770 Safari/537.36 |
2026-10-27 03:16:47.009474-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36 |
2026-10-27 03:16:47.009474-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot) |
2026-10-27 03:16:47.009474-04:00 |
| lauterbourg-01-ts |
CCBot/2.0 (https://commoncrawl.org/faq/) |
2026-10-27 03:16:47.009474-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) |
2026-10-27 03:16:47.009474-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.4 (x64 de) |
2026-10-27 03:16:47.009474-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
93.152.221.96 |
22969 |
94 |
778 |
10-26 05:46 |
10-27 05:19 |
- |
TechTies Inc. |
DE |
3451 |
| ru-edge-1 |
93.152.221.96 |
22069 |
121 |
781 |
10-26 07:06 |
10-27 05:31 |
- |
TechTies Inc. |
DE |
1939 |
| lauterbourg-01-ts |
121.40.140.50 |
20289 |
7 |
6 |
10-26 15:34 |
10-27 05:17 |
- |
Hangzhou Alibaba Advertising |
CN |
20281 |
| frantech-ts |
155.2.191.115 |
13776 |
6 |
13776 |
10-27 01:09 |
10-27 01:10 |
ipsum:1 |
Host Universal Pty Ltd |
US |
0 |
| lauterbourg-01-ts |
136.70.193.85 |
9815 |
5 |
5 |
10-26 05:42 |
10-26 05:59 |
- |
Google LLC |
US |
9807 |
| control-1 |
93.152.221.96 |
3291 |
74 |
657 |
10-26 13:08 |
10-27 02:00 |
- |
TechTies Inc. |
DE |
133 |
| lauterbourg-01-ts |
34.107.23.145 |
1534 |
25 |
397 |
10-26 19:41 |
10-26 19:42 |
- |
Google LLC |
DE |
6 |
| canary-farm-1 |
136.65.203.248 |
623 |
51 |
276 |
10-26 19:00 |
10-26 19:00 |
- |
Google LLC |
US |
21 |
| ai-devbox-1 |
45.138.12.35 |
384 |
2 |
372 |
10-27 01:37 |
10-27 01:37 |
- |
Tc Datacenter Limited |
LT |
0 |
| frantech-ts |
89.46.114.166 |
249 |
5 |
6 |
10-26 06:54 |
10-26 07:04 |
- |
M247 Europe SRL |
US |
0 |
| canary-farm-1 |
165.227.102.187 |
188 |
33 |
70 |
10-27 03:20 |
10-27 03:33 |
- |
DigitalOcean, LLC |
US |
0 |
| canary-farm-1 |
195.178.110.22 |
177 |
2 |
177 |
10-27 05:29 |
10-27 05:29 |
- |
Techoff Srv Limited |
BG |
0 |
| netcup-ts |
130.12.180.117 |
173 |
4 |
74 |
10-26 17:01 |
10-26 17:08 |
ipsum:1 |
Omegatech LTD |
NL |
0 |
| ai-devbox-1 |
52.53.219.121 |
160 |
2 |
144 |
10-26 11:37 |
10-26 11:38 |
- |
Amazon.com, Inc. |
US |
0 |
| ai-devbox-1 |
206.189.239.192 |
152 |
2 |
2 |
10-26 13:56 |
10-26 13:57 |
- |
DigitalOcean, LLC |
US |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
13 |
11 |
| canary-farm-1 |
340 |
18 |
| ru-edge-1 |
377 |
5 |
| control-1 |
68 |
6 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): canary-farm-1:400x1; ru-edge-1:?x3; control-1:400x1
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
340 |
| ai-devbox-1 |
["aws"] |
13 |
| control-1 |
["aws"] |
68 |
| ru-edge-1 |
["aws"] |
377 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 3552
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 455
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1263 |
| ai-devbox-1 |
https |
521 |
| canary-farm-1 |
http |
24745 |
| canary-farm-1 |
https |
993 |
| control-1 |
http |
4151 |
| frantech-ts |
http |
14537 |
| lauterbourg-01-ts |
http |
30925 |
| lauterbourg-01-ts |
https |
1583 |
| netcup-ts |
http |
990 |
| ru-edge-1 |
http |
23123 |
| sponge-01-ts |
http |
746 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
109.123.246.142 |
24615 |
| ru-edge-1 |
130.94.89.46 |
23068 |
| lauterbourg-01-ts |
89.116.25.211 |
20766 |
| frantech-ts |
209.141.62.110 |
14514 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
11446 |
| control-1 |
38.54.2.209 |
4109 |
| ai-devbox-1 |
217.15.163.226 |
1120 |
| canary-farm-1 |
sso.rightabouteverything.show |
1082 |
| netcup-ts |
159.195.21.150 |
869 |
| sponge-01-ts |
89.167.72.144 |
725 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (44 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
| 2026-10-14 |
3578 |
105 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
93.152.221.96 |
121 |
/ [tarpit-module] → /pscan-9c297ba4-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
DE |
| canary-farm-1 |
93.152.221.96 |
94 |
/ [tarpit-module] → /pscan-c725d57f-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
DE |
| control-1 |
93.152.221.96 |
74 |
/ [tarpit-module] → /pscan-f97d5742-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
DE |
| canary-farm-1 |
136.65.203.248 |
51 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /s1kugtmrbwkmqwl8jzi6 [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /cwdxqx9qapqn9m1uos1p [not-handled] → /graphql [graphql-introspection] → /.env [issued] → /static/.env [tarpit-module] → /api/..;/.env [tarpit-module] → /static/..;/..;/..;/..;/proc/self/environ [not-handled] |
Google LLC |
US |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqtaa072be7 [not-handled] → /kmonbasezda2c94182 [not-handled] → /app/.env [env-production] → /.env.production [env-production] → /backup.tar.gz [backup-archive] → /adminer.php [adminer-login] → /.git/logs/HEAD [fake-git] → /application-prod.yml [application-yml] → /.ssh/id_ecdsa [ssh-private-key-error] → /phpinfo.php [phpinfo] → /.aws/credentials [aws-credentials-file] → /application.properties [application-properties] |
Omniline Investment s.r.o. |
BG |
| canary-farm-1 |
165.227.102.187 |
33 |
/.env [issued] → /.env.local [env-production] → /.env.production [env-production] → /.env.dev [env-production] → /.env.bak [env-production] → /.env.backup [env-production] → /.env.staging [env-production] → /.env.old [env-production] → /.env.prod [env-production] → /.env.example [env-production] → /.env.dist [env-production] → /config.yaml [app-config-yaml] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.99.210.137 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
46.101.1.225 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
143.244.168.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
134.209.25.199 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
167.71.175.236 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
209.38.248.17 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 724 sources sent credentials → 539 got a shell (74%) → 491 ran a command (91% of shell-getters, 68% of sources)
- event level: 21280 credential attempts → 4084 accepted logins → 11302 commands (277% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1208 attempts
New commands this window (0 of 5861 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1285 |
2 |
109.160.32.44 |
"uname -s -v -n -r -m" |
| 1285 |
2 |
109.160.32.44 |
"uname -m | awk '{printf $1}'" |
| 664 |
458 |
103.142.26.97 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 579 |
401 |
103.142.26.97 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 442 |
13 |
223.93.164.218 |
"uname -a" |
| 429 |
1 |
77.239.124.161 |
"(cat /proc/cpuinfo|grep name|cut -f2 -d:|uniq -c && uname -a|cut -d' ' -f1,2,3,7,11|tr '\n' ' ' && echo IPv4 ; curl -s ipv4.icanhazip.com |
| 82 |
3 |
209.99.190.186 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 82 |
3 |
209.99.190.186 |
"lspci | grep VGA | cut -f5- -d ' '" |
Credentials: 14701 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 643 |
345gs5662d34 |
345gs5662d34 |
| 596 |
root |
3245gs5662d34 |
| 69 |
user |
wasd |
| 66 |
root |
123456 |
| 65 |
pi |
raspberry |
| 28 |
support |
support |
| 17 |
ubuntu |
3245gs5662d34 |
| 15 |
root |
lin12345 |