flux fleet digest — 2026-10-31 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1857 |
537 |
5210 |
194 |
-64% |
| canary-farm-1 |
3053 |
218 |
17216 |
284 |
-82% |
| control-1 |
1566 |
138 |
4550 |
130 |
-66% |
| frantech-ts |
15134 |
90 |
9154 |
75 |
+65% |
| lauterbourg-01-ts |
1160 |
128 |
9497 |
174 |
-88% |
| netcup-ts |
913 |
133 |
1492 |
112 |
-39% |
| ru-edge-1 |
1156 |
101 |
9270 |
136 |
-88% |
| sponge-01-ts |
993 |
105 |
1123 |
103 |
-12% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
appsettings-json |
28 |
0.0 |
infx |
| ai-devbox-1 |
config-json |
93 |
8.0 |
11.6x |
| ai-devbox-1 |
firebase-json |
21 |
1.6 |
13.1x |
| ai-devbox-1 |
openapi-spec-json-issued |
37 |
0.0 |
infx |
| ai-devbox-1 |
webapp-config-bundle-json |
43 |
0.0 |
infx |
| ai-devbox-1 |
wp-login-credentials |
201 |
50.5 |
4.0x |
| canary-farm-1 |
adminer-credential-post |
25 |
4.0 |
6.2x |
| canary-farm-1 |
adminer-login |
25 |
5.5 |
4.5x |
| canary-farm-1 |
fake-git-miss |
310 |
78.2 |
4.0x |
| canary-farm-1 |
firebase-json |
46 |
10.9 |
4.2x |
| canary-farm-1 |
openapi-spec-json-issued |
33 |
8.3 |
4.0x |
| canary-farm-1 |
webapp-config-bundle-js |
51 |
10.1 |
5.0x |
| control-1 |
appsettings-json |
27 |
3.0 |
9.0x |
| control-1 |
config-json |
84 |
7.0 |
12.0x |
| control-1 |
firebase-json |
26 |
5.5 |
4.7x |
| control-1 |
openapi-spec-json-issued |
36 |
2.5 |
14.4x |
| control-1 |
webapp-config-bundle-json |
33 |
0.0 |
infx |
| frantech-ts |
openapi-spec-json-skeleton |
35 |
0.0 |
infx |
| lauterbourg-01-ts |
openapi-spec-json-skeleton |
24 |
6.8 |
3.5x |
| ru-edge-1 |
openapi-spec-json-issued |
26 |
5.2 |
5.0x |
| sponge-01-ts |
openapi-spec-json-skeleton |
34 |
2.5 |
13.6x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
81 |
576 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
26 |
179 |
control-1,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 5e7a5d88d947 ⟳ |
15 |
45 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,sponge-01-ts ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
| 1dd16c0704a9 |
4 |
32 |
canary-farm-1,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
10-31 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 321f17b2aca0 ⟳ |
4 |
32 |
canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 218630667b2c ⟳ |
4 |
175 |
ai-devbox-1,canary-farm-1,frantech-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 76d212a95300 ⟳ |
4 |
156 |
ai-devbox-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| d011ee27b332 |
3 |
483 |
frantech-ts,lauterbourg-01-ts,sponge-01-ts ⚠FLEET-WIDE |
10-31 |
/appsettings.json [not-handled] → /appsettings.Development.json [not-handled] → /appsettings.Release.json [not-handled] → /appsettings.Production.json [not-handled] → /appsettings.production.json [not |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/deathstarm68k |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/donkeypussy/deathstar.x86_64 |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/fuckmeh.sh |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/fvbig/zerobot.arc |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/h2.arm64 |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/appsettings.test.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/cloud/config.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/src/config.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/api/v1/config.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/secrets/config.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/secret/config.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/static/manifest.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/prerender-manifest.json |
2026-10-31 03:15:56.779275-04:00 |
| lauterbourg-01-ts |
/environment.development.json |
2026-10-31 03:15:56.779275-04:00 |
| ai-devbox-1 |
/docs/swagger.json |
2026-10-31 03:15:56.779275-04:00 |
| ai-devbox-1 |
/secret/config.json |
2026-10-31 03:15:56.779275-04:00 |
| ai-devbox-1 |
/static/manifest.json |
2026-10-31 03:15:56.779275-04:00 |
| ai-devbox-1 |
/environment.production.json |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/krmine-ppc64 |
2026-10-31 03:15:56.779275-04:00 |
| frantech-ts |
/morte.x86_64 |
2026-10-31 03:15:56.779275-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 |
2026-10-31 03:31:48.083027-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 YaBrowser/21.3.3.234 Yowser/2.5 Safari/537.36 |
2026-10-31 03:15:56.953163-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15 |
2026-10-31 03:15:56.953163-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809 Safari/537.36 |
2026-10-31 03:15:56.953163-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 |
2026-10-31 03:15:56.953163-04:00 |
| lauterbourg-01-ts |
Python/3.10 aiohttp/3.13.0 |
2026-10-31 03:15:56.953163-04:00 |
| netcup-ts |
Mozilla/5.0 (compatible; kx360-lane-a-widescan/1.0) |
2026-10-31 03:15:56.953163-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 |
2026-10-31 03:15:56.953163-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Linux; U; Android 1.5; de-de; HTC Magic Build/PLAT-RC33) AppleWebKit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 FirePHP/0.3 |
2026-10-31 03:15:56.953163-04:00 |
| control-1 |
Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626 Safari/537.36 |
2026-10-31 03:15:56.953163-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
135.136.19.27 |
14154 |
6 |
14154 |
10-31 04:13 |
10-31 04:15 |
ipsum:1 |
M247 Europe SRL |
DE |
0 |
| canary-farm-1 |
45.138.12.35 |
389 |
3 |
377 |
10-30 14:20 |
10-30 16:44 |
- |
Tc Datacenter Limited |
LT |
0 |
| ru-edge-1 |
45.138.12.35 |
384 |
2 |
372 |
10-30 20:28 |
10-30 20:29 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
45.148.10.120 |
356 |
23 |
204 |
10-30 05:55 |
10-31 04:23 |
ipsum:1 firehol2 |
Techoff Srv Limited |
NL |
0 |
| canary-farm-1 |
50.19.185.106 |
324 |
75 |
302 |
10-30 12:25 |
10-30 12:46 |
- |
Amazon.com, Inc. |
US |
0 |
| control-1 |
193.47.62.29 |
227 |
20 |
150 |
10-30 10:56 |
10-30 10:57 |
- |
BestDC Limited |
BG |
0 |
| frantech-ts |
45.138.12.16 |
215 |
14 |
201 |
10-30 13:26 |
10-30 13:51 |
- |
Tc Datacenter Limited |
LT |
0 |
| netcup-ts |
45.138.12.16 |
215 |
14 |
201 |
10-30 08:20 |
10-30 08:45 |
- |
Tc Datacenter Limited |
LT |
0 |
| control-1 |
45.138.12.16 |
215 |
58 |
201 |
10-30 17:44 |
10-30 18:08 |
- |
Tc Datacenter Limited |
LT |
0 |
| ai-devbox-1 |
193.47.62.29 |
212 |
20 |
143 |
10-30 07:11 |
10-30 07:14 |
- |
BestDC Limited |
BG |
0 |
| lauterbourg-01-ts |
45.138.12.16 |
203 |
13 |
202 |
10-30 23:46 |
10-31 00:11 |
- |
Tc Datacenter Limited |
LT |
0 |
| sponge-01-ts |
45.138.12.16 |
191 |
13 |
177 |
10-30 23:47 |
10-31 00:12 |
- |
Tc Datacenter Limited |
LT |
0 |
| ru-edge-1 |
45.138.12.16 |
175 |
50 |
168 |
10-30 04:19 |
10-30 04:58 |
- |
Tc Datacenter Limited |
LT |
0 |
| frantech-ts |
193.47.62.29 |
161 |
3 |
150 |
10-30 06:26 |
10-30 06:27 |
- |
BestDC Limited |
BG |
0 |
| lauterbourg-01-ts |
193.47.62.29 |
161 |
3 |
150 |
10-30 17:20 |
10-30 17:21 |
- |
BestDC Limited |
BG |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
7 |
6 |
| control-1 |
7 |
6 |
| canary-farm-1 |
31 |
21 |
| ru-edge-1 |
3 |
3 |
| frantech-ts |
0 |
0 |
| lauterbourg-01-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x7; canary-farm-1:400x1; control-1:400x5
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["ssh"] |
6 |
| ru-edge-1 |
["aws"] |
3 |
| canary-farm-1 |
["aws","ssh"] |
15 |
| control-1 |
["aws"] |
7 |
| canary-farm-1 |
["aws"] |
10 |
| ai-devbox-1 |
["aws"] |
7 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1864
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1252 |
| ai-devbox-1 |
https |
605 |
| canary-farm-1 |
http |
1853 |
| canary-farm-1 |
https |
1200 |
| control-1 |
http |
1566 |
| frantech-ts |
http |
15134 |
| lauterbourg-01-ts |
http |
1103 |
| lauterbourg-01-ts |
https |
57 |
| netcup-ts |
http |
913 |
| ru-edge-1 |
http |
1156 |
| sponge-01-ts |
http |
993 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
15127 |
| control-1 |
38.54.2.209 |
1544 |
| canary-farm-1 |
sso.rightabouteverything.show |
1517 |
| canary-farm-1 |
109.123.246.142 |
1516 |
| ru-edge-1 |
130.94.89.46 |
1142 |
| ai-devbox-1 |
217.15.163.226 |
1054 |
| sponge-01-ts |
89.167.72.144 |
971 |
| netcup-ts |
159.195.21.150 |
901 |
| lauterbourg-01-ts |
89.116.25.211 |
867 |
| ai-devbox-1 |
inference.fapthropic.com |
789 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (48 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-31 |
1566 |
138 |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
| 2026-10-18 |
3050 |
106 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
50.19.185.106 |
75 |
/.git/config [fake-git] → /.env [issued] → /.env.local [env-production] → /.env.production [env-production] → /.env.development [env-production] → /.env.staging [env-production] → /.env.test [env-production] → /.env.testing [tarpit-module] → /.env.qa [env-production] → /.env.uat [env-production] → /.env.dev [env-production] → /.env.prod [env-production] |
Amazon.com, Inc. |
US |
| control-1 |
45.138.12.16 |
58 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] |
Tc Datacenter Limited |
LT |
| ru-edge-1 |
45.138.12.16 |
50 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
195.178.110.159 |
28 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] |
Techoff Srv Limited |
BG |
| canary-farm-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
64.23.218.208 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
46.101.111.185 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
138.68.144.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
164.90.228.79 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.89.127.165 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
206.81.24.227 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
206.81.12.187 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
165.22.34.189 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
64.226.65.160 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
143.110.217.244 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 646 sources sent credentials → 496 got a shell (77%) → 432 ran a command (87% of shell-getters, 67% of sources)
- event level: 11764 credential attempts → 4903 accepted logins → 15257 commands (311% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 1050 attempts
New commands this window (0 of 6185 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1918 |
3 |
109.160.32.161 |
"uname -s -v -n -r -m" |
| 1916 |
3 |
109.160.32.161 |
"uname -m | awk '{printf $1}'" |
| 874 |
375 |
101.47.8.113 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 725 |
337 |
101.47.8.113 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 498 |
3 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 498 |
3 |
195.178.110.218 |
"lspci | grep VGA -c" |
| 498 |
3 |
195.178.110.218 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
| 498 |
3 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
Credentials: 4417 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 842 |
345gs5662d34 |
345gs5662d34 |
| 612 |
root |
3245gs5662d34 |
| 92 |
root |
123456 |
| 83 |
intel |
123 |
| 70 |
user |
wasd |
| 69 |
pi |
raspberry |
| 65 |
ubuntu |
3245gs5662d34 |
| 53 |
support |
support |