flux fleet digest — 2026-11-01 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2474 |
181 |
5186 |
239 |
-52% |
| canary-farm-1 |
2576 |
274 |
17131 |
280 |
-85% |
| control-1 |
1179 |
104 |
4578 |
128 |
-74% |
| frantech-ts |
30480 |
373 |
11162 |
75 |
+173% |
| lauterbourg-01-ts |
2153 |
195 |
9285 |
163 |
-77% |
| netcup-ts |
1702 |
134 |
1449 |
114 |
+17% |
| ru-edge-1 |
670 |
123 |
9281 |
137 |
-93% |
| sponge-01-ts |
1290 |
133 |
1160 |
103 |
+11% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
webapp-config-bundle-js |
66 |
16.7 |
3.9x |
| frantech-ts |
webshell-sweep-observed |
55 |
4.7 |
11.7x |
| netcup-ts |
phpmyadmin-login |
153 |
2.2 |
68.0x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
62 |
436 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
43 |
301 |
ai-devbox-1,canary-farm-1,control-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 5e7a5d88d947 ⟳ |
8 |
24 |
control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
| 6b025bffa18d ⟳ |
6 |
25 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| b5dcb9cb5461 ⟳ |
6 |
162 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1 ⚠FLEET-WIDE |
09-30 |
/.env [issued] → /vendor/.env [env-production] → /storage/.env [env-production] → /public/.env [env-production] → /api/.env [env-production] → /admin/.env [env-production] → … |
| 1f095db64028 |
4 |
108 |
frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
11-01 |
/.env [not-handled] → /vendor/.env [not-handled] → /storage/.env [not-handled] → /public/.env [not-handled] → /api/.env [not-handled] → /admin/.env [not-handled] → … |
| 54bba88c9f9d ⟳ |
4 |
48 |
canary-farm-1,sponge-01-ts ⚠FLEET-WIDE |
09-05 |
/ [tarpit-module] → / [tarpit] → / [tarpit-module] → / [tarpit] |
| 2d3e95b722b5 ⟳ |
4 |
164 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/gsr1rzyzq_ov |
2026-11-01 02:31:45.864712-05:00 |
| frantech-ts |
/.aws/s3cfg |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/nginx.conf |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/var/log/nginx/error.log |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/federation |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/federation/schema.graphql |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/latest/user-data |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/jolokia/** |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/kubernetes/secrets/** |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/.tf/** |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/production.py.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/log/development.log.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/nuxt.config.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/firebase-messaging-sw.js |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/log4j.properties.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/machine.config.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/WEB-INF/dispatcher-servlet.xml.bak |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/.gradle/ |
2026-11-01 02:15:54.642232-05:00 |
| frantech-ts |
/appsettings.Production.json.bak |
2026-11-01 02:15:54.642232-05:00 |
| ru-edge-1 |
/home/admin/.env.production |
2026-11-01 02:15:54.642232-05:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Python/3.12 aiohttp/3.14.5 |
2026-11-01 02:31:45.983111-05:00 |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| canary-farm-1 |
Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0.0.0 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36 |
2026-11-01 02:15:54.764657-05:00 |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15 |
2026-11-01 02:15:54.764657-05:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 8.0.0; LG-US998) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.88 Mobile Safari/537.36 OPR/68.3.3557.64528 |
2026-11-01 02:15:54.764657-05:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
135.136.19.27 |
28326 |
6 |
14154 |
10-31 04:13 |
11-01 00:11 |
ipsum:1 |
M247 Europe SRL |
DE |
0 |
| ai-devbox-1 |
45.94.31.16 |
1007 |
5 |
5 |
10-31 20:15 |
10-31 20:22 |
- |
1337 Services GmbH |
NL |
1000 |
| netcup-ts |
45.138.12.19 |
568 |
1 |
1 |
10-31 06:06 |
11-01 06:11 |
- |
Tc Datacenter Limited |
LT |
0 |
| canary-farm-1 |
45.138.12.35 |
385 |
3 |
373 |
11-01 00:44 |
11-01 04:10 |
- |
Tc Datacenter Limited |
LT |
0 |
| frantech-ts |
85.155.14.14 |
356 |
4 |
356 |
10-31 17:49 |
10-31 17:53 |
- |
SolidCore Hosting LTD |
DE |
0 |
| sponge-01-ts |
85.155.14.32 |
356 |
4 |
356 |
10-31 21:46 |
10-31 21:47 |
- |
SolidCore Hosting LTD |
DE |
0 |
| lauterbourg-01-ts |
45.138.12.19 |
304 |
1 |
1 |
10-31 06:05 |
11-01 06:04 |
- |
Tc Datacenter Limited |
LT |
0 |
| ai-devbox-1 |
45.138.12.19 |
199 |
1 |
1 |
10-31 06:07 |
11-01 06:13 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
172.104.241.92 |
198 |
28 |
164 |
10-31 12:39 |
10-31 12:39 |
ipsum:3 firehol2 |
Akamai Connected Cloud |
DE |
1 |
| lauterbourg-01-ts |
185.177.72.64 |
170 |
6 |
166 |
10-31 18:32 |
10-31 18:32 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| control-1 |
185.93.89.64 |
157 |
2 |
142 |
10-31 19:42 |
10-31 19:42 |
ipsum:5 firehol2 |
Limited Network LTD |
IR |
0 |
| canary-farm-1 |
45.138.12.19 |
156 |
1 |
1 |
10-31 06:05 |
11-01 06:23 |
- |
Tc Datacenter Limited |
LT |
0 |
| control-1 |
51.83.72.125 |
151 |
1 |
1 |
11-01 00:22 |
11-01 00:23 |
- |
OVH SAS |
FR |
0 |
| ai-devbox-1 |
217.160.35.149 |
151 |
1 |
1 |
10-31 13:19 |
10-31 13:20 |
- |
IONOS SE |
DE |
0 |
| netcup-ts |
14.225.220.240 |
151 |
1 |
1 |
10-31 17:44 |
10-31 17:45 |
- |
VIETNAM POSTS AND TELECOMMUN |
VN |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
8 |
7 |
| ai-devbox-1 |
12 |
9 |
| ru-edge-1 |
5 |
5 |
| canary-farm-1 |
25 |
19 |
| lauterbourg-01-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x4; control-1:400x2; ru-edge-1:400x4; canary-farm-1:400x9
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
12 |
| canary-farm-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws","ssh"] |
15 |
| canary-farm-1 |
["ssh"] |
4 |
| control-1 |
["aws"] |
8 |
| ru-edge-1 |
["aws"] |
5 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2070
- multi-entry XFF (forged chains — no proxy appends on the direct path): 597
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 10
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 593
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2247 |
| ai-devbox-1 |
https |
227 |
| canary-farm-1 |
http |
1643 |
| canary-farm-1 |
https |
933 |
| control-1 |
http |
1177 |
| control-1 |
https |
2 |
| frantech-ts |
http |
30480 |
| lauterbourg-01-ts |
http |
1845 |
| lauterbourg-01-ts |
https |
308 |
| netcup-ts |
http |
1702 |
| ru-edge-1 |
http |
670 |
| sponge-01-ts |
http |
1290 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
29876 |
| netcup-ts |
159.195.21.150 |
1694 |
| ai-devbox-1 |
inference.fapthropic.com |
1352 |
| canary-farm-1 |
sso.rightabouteverything.show |
1326 |
| sponge-01-ts |
89.167.72.144 |
1283 |
| canary-farm-1 |
109.123.246.142 |
1243 |
| control-1 |
38.54.2.209 |
1163 |
| lauterbourg-01-ts |
89.116.25.211 |
1143 |
| ai-devbox-1 |
217.15.163.226 |
1033 |
| ru-edge-1 |
130.94.89.46 |
658 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (49 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-11-01 |
1179 |
104 |
| 2026-10-31 |
1566 |
138 |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
| 2026-10-19 |
3563 |
119 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt267a64a7 [not-handled] → /kmonbasezde99bad72 [not-handled] → /html/.env [env-production-error] → /.git/logs/HEAD [fake-git] → /secrets.json [config-json-error] → /package.json [package-json-error] → /ecosystem.config.js [pm2-ecosystem-config-error] → /application.yml [application-yml-error] → /current/.env [env-production-error] → /info.php [phpinfo-error] → /www.zip [backup-archive-error] → /.docker/config.json [docker-config-error] |
Omniline Investment s.r.o. |
BG |
| lauterbourg-01-ts |
172.104.241.92 |
28 |
/ [php2shell-root] → /cgi-mod/header_logo.cgi [not-handled] → /nmaplowercheck1793450357 [not-handled] → /admin.php [webshell-probe] → /webui [not-handled] → /nmaplowercheck1793450359 [not-handled] → /HNAP1 [hnap1-discovery] → /favicon.ico [tarpit-module] → /default.jsp [not-handled] → /login [php2shell-login] → /evox/about [not-handled] → /api/v2/about [nextjs-api] |
Akamai Connected Cloud |
DE |
| control-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
139.59.143.102 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
207.154.212.47 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
209.97.180.8 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
147.182.149.75 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
138.68.86.32 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| control-1 |
46.101.111.185 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
64.226.65.160 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
159.89.12.166 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.99.182.39 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
143.110.217.244 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
167.71.175.236 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
142.93.0.66 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 612 sources sent credentials → 473 got a shell (77%) → 415 ran a command (88% of shell-getters, 68% of sources)
- event level: 9136 credential attempts → 4671 accepted logins → 11390 commands (244% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 583 attempts
New commands this window (0 of 4292 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1718 |
3 |
109.160.32.148 |
"uname -s -v -n -r -m" |
| 1705 |
3 |
109.160.32.148 |
"uname -m | awk '{printf $1}'" |
| 791 |
359 |
101.32.240.31 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 661 |
317 |
101.32.240.31 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 284 |
12 |
118.145.228.55 |
"whoami" |
| 251 |
4 |
179.43.153.10 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 251 |
4 |
179.43.153.10 |
"lspci | grep VGA -c" |
| 251 |
4 |
179.43.153.10 |
"lspci | grep VGA | cut -f5- -d ' '" |
Credentials: 3457 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 758 |
345gs5662d34 |
345gs5662d34 |
| 554 |
root |
3245gs5662d34 |
| 78 |
root |
123456 |
| 63 |
user |
wasd |
| 61 |
pi |
raspberry |
| 53 |
support |
support |
| 40 |
admin |
3245gs5662d34 |
| 38 |
ubuntu |
3245gs5662d34 |