flux fleet digest — 2026-11-02 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1967 |
212 |
5157 |
249 |
-62% |
| canary-farm-1 |
3875 |
275 |
16862 |
290 |
-77% |
| control-1 |
2098 |
155 |
2419 |
126 |
-13% |
| frantech-ts |
15053 |
82 |
15406 |
116 |
-2% |
| lauterbourg-01-ts |
2022 |
226 |
9120 |
166 |
-78% |
| netcup-ts |
801 |
109 |
1402 |
117 |
-43% |
| ru-edge-1 |
1704 |
254 |
7038 |
136 |
-76% |
| sponge-01-ts |
771 |
129 |
1100 |
106 |
-30% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
issued |
42 |
11.4 |
3.7x |
| canary-farm-1 |
docker-registry-blob |
20 |
6.0 |
3.3x |
| canary-farm-1 |
fake-git-miss |
533 |
124.4 |
4.3x |
| canary-farm-1 |
tracebit-http-error |
21 |
6.7 |
3.1x |
| control-1 |
docker-registry-manifest |
45 |
14.3 |
3.1x |
| control-1 |
docker-registry-tags |
45 |
14.3 |
3.1x |
| control-1 |
phpinfo-error |
63 |
9.4 |
6.7x |
| control-1 |
sftp-config-error |
33 |
9.0 |
3.7x |
| control-1 |
whm-login |
20 |
6.3 |
3.2x |
| frantech-ts |
docker-registry-manifest |
25 |
7.5 |
3.3x |
| frantech-ts |
docker-registry-tags |
25 |
7.5 |
3.3x |
| lauterbourg-01-ts |
llm-endpoint-ollama-chat |
22 |
0.0 |
infx |
| lauterbourg-01-ts |
phpmyadmin-login |
151 |
21.5 |
7.0x |
| netcup-ts |
docker-registry-tags |
20 |
6.4 |
3.1x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
71 |
492 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
17 |
119 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 6b025bffa18d ⟳ |
7 |
28 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| 2d3e95b722b5 ⟳ |
7 |
287 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
| 321f17b2aca0 ⟳ |
6 |
48 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| c540fc530a5a ⟳ |
6 |
234 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 2de0cfe65017 ⟳ |
6 |
234 |
control-1 |
10-23 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5e7a5d88d947 ⟳ |
4 |
12 |
canary-farm-1,control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE |
09-20 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/_debug |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/profiler.php |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/webpack.config.json |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/wsgi.py |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/login/Auth |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/grafana |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/api/explorer |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/api/user |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/api/payments |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/+CSCOE+/session.html |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/wg0.conf |
2026-11-02 02:16:15.677210-05:00 |
| ru-edge-1 |
/dana-na/css/ds.css |
2026-11-02 02:16:15.677210-05:00 |
| canary-farm-1 |
/server/.git/refs/wip/index/refs/heads/dev |
2026-11-02 02:16:15.677210-05:00 |
| canary-farm-1 |
/server/.git/refs/wip/wtree/refs/heads/release |
2026-11-02 02:16:15.677210-05:00 |
| canary-farm-1 |
/server/.git/logs/refs/tags/v1.0 |
2026-11-02 02:16:15.677210-05:00 |
| ai-devbox-1 |
/.git/objects/64/811842cbc83644bca73a1acbe26a099b335031 |
2026-11-02 02:16:15.677210-05:00 |
| frantech-ts |
/getstatus/reload_freeswitch/api status |
2026-11-02 02:16:15.677210-05:00 |
| control-1 |
/pscan-0a7bea32-nonexistent.txt |
2026-11-02 02:16:15.677210-05:00 |
| lauterbourg-01-ts |
/html/.git/reconx-3805bb28ac4c |
2026-11-02 02:16:15.677210-05:00 |
| ai-devbox-1 |
/rf6zr507cq5fd1 |
2026-11-02 02:16:15.677210-05:00 |
New user agents:
| sensor |
user agent |
first seen |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 OPR/62.0.3331.99 |
2026-11-02 02:16:15.805286-05:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 |
2026-11-02 02:16:15.805286-05:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Mobile Safari/537.36 |
2026-11-02 02:16:15.805286-05:00 |
| ru-edge-1 |
axios/1.18.1 |
2026-11-02 02:16:15.805286-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36 |
2026-11-02 02:16:15.805286-05:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.9.17 |
2026-11-02 02:16:15.805286-05:00 |
| ai-devbox-1 |
Mozilla/5.0 (compatible; harvest/1.0) |
2026-11-02 02:16:15.805286-05:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3077.96 Safari/537.32 |
2026-11-02 02:16:15.805286-05:00 |
| control-1 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 OPR/62.0.3331.99 |
2026-11-02 02:16:15.805286-05:00 |
| ru-edge-1 |
Python/3.12 aiohttp/3.14.5 |
2026-11-02 02:16:15.805286-05:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
103.125.233.17 |
14207 |
6 |
14197 |
11-02 01:47 |
11-02 01:50 |
- |
xTom |
HK |
0 |
| control-1 |
102.220.163.241 |
1032 |
60 |
511 |
11-01 09:03 |
11-02 05:44 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
102.220.163.241 |
1028 |
60 |
511 |
11-01 09:06 |
11-02 04:41 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
102.220.163.241 |
871 |
35 |
539 |
11-01 09:54 |
11-02 03:58 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
195.178.110.159 |
395 |
6 |
375 |
11-01 11:06 |
11-02 00:51 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| canary-farm-1 |
45.138.12.35 |
387 |
3 |
374 |
11-01 04:10 |
11-01 10:30 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
104.199.202.179 |
302 |
18 |
171 |
11-01 20:28 |
11-01 20:28 |
- |
Google LLC |
TW |
3 |
| lauterbourg-01-ts |
45.115.27.37 |
267 |
8 |
138 |
11-01 17:26 |
11-01 17:27 |
- |
Contrust Solutions S.R.L. |
MD |
2 |
| ru-edge-1 |
34.96.41.148 |
257 |
68 |
202 |
11-01 12:58 |
11-01 13:00 |
- |
Google LLC |
BE |
0 |
| frantech-ts |
45.138.12.16 |
216 |
14 |
201 |
11-01 07:42 |
11-01 20:58 |
- |
Tc Datacenter Limited |
LT |
0 |
| netcup-ts |
45.138.12.16 |
205 |
13 |
190 |
11-01 07:19 |
11-01 15:45 |
- |
Tc Datacenter Limited |
LT |
0 |
| lauterbourg-01-ts |
139.162.184.146 |
204 |
28 |
170 |
11-01 09:55 |
11-01 09:56 |
- |
Akamai Connected Cloud |
DE |
1 |
| canary-farm-1 |
45.138.12.16 |
191 |
53 |
176 |
11-01 07:00 |
11-01 10:05 |
- |
Tc Datacenter Limited |
LT |
0 |
| ru-edge-1 |
45.138.12.16 |
181 |
50 |
166 |
11-01 07:08 |
11-01 12:50 |
- |
Tc Datacenter Limited |
LT |
0 |
| sponge-01-ts |
185.177.72.64 |
170 |
5 |
166 |
11-01 11:29 |
11-01 11:29 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
42 |
8 |
| control-1 |
9 |
7 |
| canary-farm-1 |
10 |
8 |
| ru-edge-1 |
17 |
14 |
| frantech-ts |
0 |
0 |
Mint failures (24h): ai-devbox-1:400x6; canary-farm-1:400x21; ai-devbox-1:?x1; control-1:400x10; canary-farm-1:?x1; ru-edge-1:400x8
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
42 |
| canary-farm-1 |
["aws"] |
10 |
| control-1 |
["aws"] |
9 |
| ru-edge-1 |
["aws"] |
17 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1642
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 6
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1764 |
| ai-devbox-1 |
https |
203 |
| canary-farm-1 |
http |
3121 |
| canary-farm-1 |
https |
754 |
| control-1 |
http |
2098 |
| frantech-ts |
http |
15053 |
| lauterbourg-01-ts |
http |
1344 |
| lauterbourg-01-ts |
https |
678 |
| netcup-ts |
http |
801 |
| ru-edge-1 |
http |
1700 |
| ru-edge-1 |
https |
4 |
| sponge-01-ts |
http |
771 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
15046 |
| canary-farm-1 |
109.123.246.142 |
2826 |
| control-1 |
38.54.2.209 |
2084 |
| ru-edge-1 |
130.94.89.46 |
1686 |
| ai-devbox-1 |
217.15.163.226 |
1531 |
| canary-farm-1 |
sso.rightabouteverything.show |
1044 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
862 |
| netcup-ts |
159.195.21.150 |
791 |
| sponge-01-ts |
89.167.72.144 |
759 |
| lauterbourg-01-ts |
89.116.25.211 |
753 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (50 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-11-02 |
2098 |
155 |
| 2026-11-01 |
1179 |
104 |
| 2026-10-31 |
1566 |
138 |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
| 2026-10-20 |
4882 |
167 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
34.96.41.148 |
68 |
/threatscout_nonexistent_canary_mvxu5lea [not-handled] → /swagger.json [openapi-spec-json-issued] → /api-docs [openapi-spec-json-issued] → /.env [issued] → /actuator/env [actuator-env] → /actuator/health [actuator-health] → /config [not-handled] → /admin [webapp-form-profile] → /login [webapp-form-login] → /api/v1 [not-handled] → /graphql [graphql-playground] → /wp-config.php [wp-config] |
Google LLC |
BE |
| canary-farm-1 |
102.220.163.241 |
60 |
/ [tarpit-module] → /pscan-b08b5a12-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| control-1 |
102.220.163.241 |
60 |
/ [tarpit-module] → /pscan-0a7bea32-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
45.138.12.16 |
53 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [tracebit-http-error] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.bak [env-production-error] |
Tc Datacenter Limited |
LT |
| ru-edge-1 |
45.138.12.16 |
50 |
/ [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit] → / [tarpit-disconnect] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
93.152.209.6 |
40 |
/kmonbaseqt3147870f [not-handled] → /kmonbasezd68002bc3 [not-handled] → /.env.development [env-production-error] → /package.json [package-json-error] → /.env [tracebit-http-error] → /deployment.yaml [generic-ci-config-error] → /database.yml [rails-database-yml-error] → /www/.env [env-production-error] → /backup.tar.gz [backup-archive-error] → /debug.log [not-handled] → /www.zip [backup-archive-error] → /app/.env [env-production-error] |
Omniline Investment s.r.o. |
BG |
| canary-farm-1 |
68.183.180.73 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| ai-devbox-1 |
102.220.163.241 |
35 |
/ [tarpit-module] → /pscan-a401ba31-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| ai-devbox-1 |
45.138.12.16 |
29 |
/ [tarpit-module] → /.git/config [fake-git-error] → /.svn/wc.db [fake-svn-error] → /.env [tracebit-http-error] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.bak [env-production-error] |
Tc Datacenter Limited |
LT |
| canary-farm-1 |
139.59.143.102 |
28 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| lauterbourg-01-ts |
139.162.184.146 |
28 |
/ [php2shell-root] → /nmaplowercheck1793526944 [not-handled] → /sdk [not-handled] → /inicio.shtml [not-handled] → /cgi-mod/header_logo.cgi [not-handled] → /rest/applinks/1.0/manifest [not-handled] → /health [observability-health] → /evox/about [not-handled] → /favicon.ico [tarpit-module] → /menu.cfm [coldfusion-public-cfm] → /login [php2shell-login] → /confluence/rest/applinks/1.0/manifest [not-handled] |
Akamai Connected Cloud |
DE |
| control-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
209.38.248.17 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ru-edge-1 |
165.227.84.14 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 505 sources sent credentials → 378 got a shell (75%) → 319 ran a command (84% of shell-getters, 63% of sources)
- event level: 8889 credential attempts → 4487 accepted logins → 10675 commands (238% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 526 attempts
New commands this window (0 of 2650 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 2605 |
6 |
77.239.124.2 |
"uname -s -v -n -r -m" |
| 2278 |
5 |
77.239.124.2 |
"uname -m | awk '{printf $1}'" |
| 604 |
278 |
190.60.55.86 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 504 |
243 |
190.60.55.86 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 277 |
4 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 276 |
4 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 276 |
4 |
195.178.110.218 |
"lspci | grep VGA -c" |
| 276 |
4 |
195.178.110.218 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 3052 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 585 |
345gs5662d34 |
345gs5662d34 |
| 443 |
root |
3245gs5662d34 |
| 64 |
root |
123456 |
| 51 |
pi |
raspberry |
| 40 |
user |
wasd |
| 28 |
admin |
3245gs5662d34 |
| 27 |
support |
support |
| 24 |
user |
3245gs5662d34 |