flux fleet digest — 2026-10-29 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
12127 |
200 |
3521 |
178 |
+244% |
| canary-farm-1 |
26066 |
348 |
12348 |
252 |
+111% |
| control-1 |
2048 |
153 |
4615 |
128 |
-56% |
| frantech-ts |
28203 |
84 |
7175 |
73 |
+293% |
| lauterbourg-01-ts |
5020 |
181 |
8988 |
157 |
-44% |
| netcup-ts |
742 |
142 |
2770 |
107 |
-73% |
| ru-edge-1 |
1101 |
112 |
19156 |
135 |
-94% |
| sponge-01-ts |
1320 |
120 |
2060 |
97 |
-36% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
env-production-error |
159 |
26.3 |
6.0x |
| ai-devbox-1 |
fake-git |
395 |
120.3 |
3.3x |
| canary-farm-1 |
tarpit-disconnect |
177 |
48.7 |
3.6x |
| canary-farm-1 |
wp-login-credentials |
7131 |
249.2 |
28.6x |
| canary-farm-1 |
wp-xmlrpc-post |
14709 |
2889.6 |
5.1x |
| control-1 |
app-config-php |
22 |
3.3 |
6.6x |
| control-1 |
phpmyadmin-login |
365 |
58.8 |
6.2x |
| control-1 |
wp-xmlrpc-post |
20 |
0.0 |
infx |
| frantech-ts |
not-handled |
27624 |
6622.9 |
4.2x |
| frantech-ts |
phpmyadmin-login |
151 |
6.5 |
23.2x |
| lauterbourg-01-ts |
php2shell-index |
436 |
125.2 |
3.5x |
| lauterbourg-01-ts |
phpunit-eval-stdin |
894 |
231.0 |
3.9x |
| ru-edge-1 |
wp-xmlrpc-post |
21 |
3.0 |
7.0x |
| sponge-01-ts |
wp-login-credentials |
256 |
23.8 |
10.8x |
| sponge-01-ts |
wp-xmlrpc-post |
277 |
4.0 |
69.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
113 |
795 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 362522228887 |
33 |
108 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-29 |
/xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] |
| 4b4cc0ece037 ⟳ |
15 |
105 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 6b025bffa18d ⟳ |
10 |
33 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| 5e7a5d88d947 ⟳ |
7 |
21 |
canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
| 850993125b15 ⟳ |
7 |
328 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7f1ceca48fd5 |
6 |
18 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
10-29 |
/ [tarpit-module] → /app-config.js [not-handled] → /dicom-web/studies [not-handled] |
| 0a08798abff5 |
6 |
37 |
control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
10-29 |
/xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → /xmlrpc.php [wp-xmlrpc-post] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/admin/gravity-forms.php |
2026-10-29 03:31:29.368377-04:00 |
| canary-farm-1 |
/kmonbasezdf31effb5 |
2026-10-29 03:31:29.368377-04:00 |
| canary-farm-1 |
/kmonbaseqt596f2232 |
2026-10-29 03:31:29.368377-04:00 |
| lauterbourg-01-ts |
/config.php.save |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/.ovpn |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/zerotier.conf |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/ikev2.conf |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/forticlient |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/xray.json |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/ss.conf |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/nordvpn |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/windscribe.conf |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/array-vpn |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/sophos |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/barracuda |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/rsa-securid |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/rsa.conf |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/bastion.yml |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/proxy.yml |
2026-10-29 03:16:26.396201-04:00 |
| lauterbourg-01-ts |
/.svn/auth |
2026-10-29 03:16:26.396201-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.2 (x64 de) |
2026-10-29 03:31:30.942849-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 ;Build/0220; |
2026-10-29 03:31:30.942849-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0 |
2026-10-29 03:16:26.533927-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 |
2026-10-29 03:16:26.533927-04:00 |
| canary-farm-1 |
Python-urllib/3.10 |
2026-10-29 03:16:26.533927-04:00 |
| control-1 |
fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de) |
2026-10-29 03:16:26.533927-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 |
2026-10-29 03:16:26.533927-04:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 9; Pixel 2 XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36 |
2026-10-29 03:16:26.533927-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.36 |
2026-10-29 03:16:26.533927-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115 |
2026-10-29 03:16:26.533927-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
8.137.104.136 |
21152 |
7 |
6 |
10-28 05:50 |
10-28 12:55 |
- |
Hangzhou Alibaba Advertising |
CN |
21144 |
| frantech-ts |
169.150.201.41 |
13776 |
6 |
13776 |
10-28 07:17 |
10-28 07:19 |
- |
Datacamp Limited |
DE |
0 |
| frantech-ts |
146.70.200.3 |
13775 |
6 |
13775 |
10-29 01:24 |
10-29 01:25 |
- |
M247 Europe SRL |
AU |
0 |
| ai-devbox-1 |
34.67.167.4 |
9815 |
5 |
5 |
10-28 04:47 |
10-28 05:23 |
- |
Google LLC |
US |
9807 |
| lauterbourg-01-ts |
152.236.14.113 |
3550 |
6 |
7 |
10-28 03:35 |
10-28 11:29 |
- |
Latitude.sh |
CA |
1789 |
| canary-farm-1 |
176.123.5.6 |
854 |
62 |
282 |
10-29 02:21 |
10-29 02:27 |
- |
Alexhost S.r.l. |
MD |
0 |
| canary-farm-1 |
34.95.21.228 |
623 |
51 |
276 |
10-28 18:17 |
10-28 18:17 |
- |
Google LLC |
CA |
21 |
| canary-farm-1 |
180.93.254.108 |
519 |
7 |
6 |
10-28 23:46 |
10-28 23:53 |
- |
Sai gon Postel Corporation |
VN |
510 |
| sponge-01-ts |
180.93.254.108 |
519 |
7 |
6 |
10-28 22:20 |
10-28 22:27 |
- |
Sai gon Postel Corporation |
VN |
510 |
| canary-farm-1 |
102.220.163.241 |
515 |
34 |
511 |
10-28 08:45 |
10-28 18:06 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.163.241 |
514 |
34 |
511 |
10-28 06:19 |
10-28 08:32 |
- |
VPS Dedicated LLC |
SI |
0 |
| ru-edge-1 |
102.220.163.241 |
514 |
34 |
511 |
10-28 08:33 |
10-28 08:35 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
102.220.163.241 |
514 |
34 |
511 |
10-28 09:12 |
10-28 09:15 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
45.138.12.35 |
384 |
2 |
372 |
10-29 05:04 |
10-29 05:04 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
85.155.14.14 |
355 |
4 |
355 |
10-29 01:38 |
10-29 01:42 |
- |
SolidCore Hosting LTD |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
15 |
14 |
| control-1 |
8 |
8 |
| ru-edge-1 |
10 |
8 |
| canary-farm-1 |
72 |
21 |
| frantech-ts |
0 |
0 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:?x1; ai-devbox-1:400x3; canary-farm-1:400x1; ru-edge-1:400x1
Mints by type label:
| sensor |
types |
mints |
| ru-edge-1 |
["aws"] |
10 |
| canary-farm-1 |
["aws"] |
27 |
| ai-devbox-1 |
["aws"] |
15 |
| canary-farm-1 |
["aws","ssh"] |
3 |
| canary-farm-1 |
["ssh"] |
42 |
| control-1 |
["aws"] |
8 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2637
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 486
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
11352 |
| ai-devbox-1 |
https |
775 |
| canary-farm-1 |
http |
24823 |
| canary-farm-1 |
https |
1243 |
| control-1 |
http |
2048 |
| frantech-ts |
http |
28203 |
| lauterbourg-01-ts |
http |
4887 |
| lauterbourg-01-ts |
https |
133 |
| netcup-ts |
http |
742 |
| ru-edge-1 |
http |
1101 |
| sponge-01-ts |
http |
1320 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
28182 |
| canary-farm-1 |
109.123.246.142 |
24487 |
| ai-devbox-1 |
inference.fapthropic.com |
10785 |
| lauterbourg-01-ts |
89.116.25.211 |
4763 |
| control-1 |
38.54.2.209 |
2034 |
| canary-farm-1 |
sso.rightabouteverything.show |
1570 |
| ai-devbox-1 |
217.15.163.226 |
1317 |
| sponge-01-ts |
89.167.72.144 |
1301 |
| ru-edge-1 |
130.94.89.46 |
1095 |
| netcup-ts |
159.195.21.150 |
722 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (46 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
| 2026-10-17 |
2715 |
102 |
| 2026-10-16 |
5453 |
133 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
176.123.5.6 |
62 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /23t7x3d68vun1hanrqkcfd39m [not-handled] → /urn2x2j9y53k1reooizip6qqt.html [not-handled] → /dsr145eifdbwxdjx6ic19ifq.php [webshell-sweep-observed] → /.env [issued] → /.env-example [tarpit-module] → /.env-sample [tarpit-module] → /.env-file [tarpit-module] → /api/image [not-handled] → /.env.dev.local [tarpit-module] |
Alexhost S.r.l. |
MD |
| control-1 |
45.138.12.16 |
57 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
34.95.21.228 |
51 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /sitemap_index.xml [not-handled] → /147h7ycctl3ng84l0eof [not-handled] → /1tzo2g7g3ft84zh6rvm7 [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /.env.local [env-production-error] → /google-services.json [firebase-json-error] → /google-service-account.json [firebase-json-error] → /gc-service.json [gcp-credentials-json-error] → /push_config.json [app-config-json-error] |
Google LLC |
CA |
| canary-farm-1 |
185.177.72.29 |
41 |
/wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /backend/.env [env-production] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /info.php [phpinfo] → /error/ [not-handled] → /api/user [not-handled] → /............\var/log/apache2/access.log [not-handled] |
Bucklog SARL |
FR |
| canary-farm-1 |
176.65.144.71 |
40 |
/kmonbaseqt596f2232 [not-handled] → /kmonbasezdf31effb5 [not-handled] → /.git/HEAD [fake-git] → /.ssh/id_ecdsa [ssh-private-key-error] → /.htpasswd [htpasswd-error] → /config/secrets.yml [rails-secrets-yml] → /credentials.yml [app-config-yaml] → /deployment.yaml [generic-ci-config] → /releases/.env [env-production] → /docker-compose.yml [docker-compose] → /debug.log [not-handled] → /.env.dist [env-production] |
Dedik Services Limited |
CH |
| canary-farm-1 |
93.152.209.6 |
35 |
/kmonbaseqt13535d4c [not-handled] → /kmonbasezd62ec6e8a [not-handled] → /backup.sql [sql-dump] → /laravel.log [not-handled] → /.docker/config.json [docker-config] → /www.zip [backup-archive] → /.env.save [env-production] → /config.php [app-config-php] → /.env.dist [env-production] → /debug.log [not-handled] → /config.json [config-json] → /backups/.env [env-production] |
Omniline Investment s.r.o. |
BG |
| control-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-bede51b2-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-637a4bcb-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-d1872bd5-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-91409ba0-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
164.92.107.174 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 735 sources sent credentials → 552 got a shell (75%) → 476 ran a command (86% of shell-getters, 65% of sources)
- event level: 11944 credential attempts → 6153 accepted logins → 17460 commands (284% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 765 attempts
New commands this window (0 of 6125 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3859 |
6 |
109.160.32.110 |
"uname -s -v -n -r -m" |
| 3859 |
6 |
109.160.32.110 |
"uname -m | awk '{printf $1}'" |
| 608 |
438 |
106.75.153.103 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 511 |
371 |
122.168.197.138 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 341 |
6 |
179.43.153.10 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 341 |
6 |
179.43.153.10 |
"lspci | grep VGA -c" |
| 341 |
6 |
179.43.153.10 |
"/bin/./uname -s -v -n -r -m" |
| 341 |
6 |
179.43.153.10 |
"uptime -p" |
Credentials: 2659 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 585 |
345gs5662d34 |
345gs5662d34 |
| 496 |
root |
3245gs5662d34 |
| 94 |
root |
123456 |
| 72 |
pi |
raspberry |
| 65 |
user |
wasd |
| 50 |
support |
support |
| 25 |
admin |
admin |
| 21 |
cloud |
Wangsu@2017 |