flux fleet digest — 2026-11-03 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
5114 |
314 |
5205 |
267 |
-2% |
| canary-farm-1 |
5791 |
352 |
17107 |
298 |
-66% |
| control-1 |
4625 |
145 |
2591 |
134 |
+78% |
| frantech-ts |
15288 |
103 |
15076 |
125 |
+1% |
| lauterbourg-01-ts |
2381 |
206 |
7381 |
172 |
-68% |
| netcup-ts |
530 |
130 |
1296 |
119 |
-59% |
| ru-edge-1 |
1038 |
131 |
6699 |
150 |
-85% |
| sponge-01-ts |
617 |
121 |
1078 |
114 |
-43% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
phpinfo |
141 |
42.7 |
3.3x |
| ai-devbox-1 |
sftp-config-error |
46 |
12.7 |
3.6x |
| canary-farm-1 |
actuator-env |
21 |
7.0 |
3.0x |
| canary-farm-1 |
app-config-yaml-error |
33 |
5.6 |
5.9x |
| canary-farm-1 |
gitignore |
22 |
2.0 |
11.0x |
| control-1 |
app-config-php |
36 |
11.1 |
3.2x |
| control-1 |
app-config-yaml |
21 |
4.1 |
5.1x |
| control-1 |
env-production |
410 |
109.9 |
3.7x |
| control-1 |
iis-web-config |
36 |
4.7 |
7.7x |
| control-1 |
phpinfo |
277 |
38.1 |
7.3x |
| control-1 |
sftp-config-error |
74 |
13.4 |
5.5x |
| control-1 |
tarpit |
163 |
42.6 |
3.8x |
| control-1 |
tarpit-disconnect |
163 |
42.3 |
3.9x |
| control-1 |
webapp-config-bundle-js |
41 |
9.5 |
4.3x |
| control-1 |
webshell-probe |
370 |
73.8 |
5.0x |
| control-1 |
yii2-debug-view |
37 |
6.3 |
5.9x |
| lauterbourg-01-ts |
phpmyadmin-login |
158 |
50.0 |
3.2x |
| lauterbourg-01-ts |
tarpit |
113 |
10.0 |
11.3x |
| lauterbourg-01-ts |
tarpit-disconnect |
26 |
8.0 |
3.2x |
| lauterbourg-01-ts |
webshell-probe |
38 |
10.9 |
3.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
92 |
648 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 6b025bffa18d ⟳ |
9 |
56 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| b07c7bb207b4 ⟳ |
7 |
328 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7ea1125e0232 ⟳ |
6 |
84 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| ef1ab74f3d57 ⟳ |
5 |
245 |
canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
5 |
287 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 54bba88c9f9d ⟳ |
4 |
48 |
canary-farm-1 |
09-05 |
/ [tarpit-module] → / [tarpit] → / [tarpit-module] → / [tarpit] |
| 4a3bf1265dff ⟳ |
3 |
115 |
ai-devbox-1,canary-farm-1,frantech-ts ⚠FLEET-WIDE |
09-16 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| frantech-ts |
/APO_2.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/CHAPO/CHAPO2.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/FAST/ttessttt.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/Godabeg1.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/LabeRuntime.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/PW/EZcrypted.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/R4JnneaiZebrwCkgG |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/activate.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/adobe/svchost.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/bin/b672b8beeed12e81_build_x64.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/crypted1.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/d.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/doog/crypted.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/dubl2/dubl22allremriki/Ldrdubl2132.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/files/gold/random.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/gh/48-689100-172-171440/447477315432/61442229125 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/images/n.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/img/secured_stub3.ps1 |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/meter_full.exe |
2026-11-03 02:15:35.622972-05:00 |
| frantech-ts |
/microsoft_store/download/version/93.11.1/2fa_code_engine.exe |
2026-11-03 02:15:35.622972-05:00 |
New user agents:
| sensor |
user agent |
first seen |
| ru-edge-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 |
2026-11-03 02:15:35.751347-05:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 |
2026-11-03 02:15:35.751347-05:00 |
| frantech-ts |
Mozilla/5.0 (Linux; Android 12; Pixel 4a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Mobile Safari/537.36 |
2026-11-03 02:15:35.751347-05:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 10; itel L5006C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36 |
2026-11-03 02:15:35.751347-05:00 |
| canary-farm-1 |
Mozilla/5.0 (compatible; SecurityResearch/1.0; ) |
2026-11-03 02:15:35.751347-05:00 |
| canary-farm-1 |
VantageResearchScanner/1.0 (+/scanner; non-intrusive) |
2026-11-03 02:15:35.751347-05:00 |
| sponge-01-ts |
Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36 |
2026-11-03 02:15:35.751347-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0 |
2026-11-03 02:15:35.751347-05:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15 |
2026-11-03 02:15:35.751347-05:00 |
| ai-devbox-1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126.0 |
2026-11-03 02:15:35.751347-05:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
146.70.224.67 |
14874 |
6 |
14864 |
11-03 01:58 |
11-03 02:01 |
- |
M247 Europe SRL |
HK |
0 |
| control-1 |
102.220.163.241 |
2687 |
58 |
515 |
11-02 05:42 |
11-03 03:27 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
45.138.12.10 |
2417 |
125 |
1438 |
11-02 11:47 |
11-02 11:47 |
- |
Tc Datacenter Limited |
LT |
0 |
| ai-devbox-1 |
45.94.31.16 |
2014 |
5 |
5 |
11-02 07:36 |
11-02 22:49 |
- |
1337 Services GmbH |
NL |
2000 |
| ai-devbox-1 |
102.220.163.241 |
1435 |
35 |
516 |
11-02 03:49 |
11-03 02:39 |
- |
VPS Dedicated LLC |
SI |
0 |
| control-1 |
194.180.49.41 |
1136 |
54 |
529 |
11-02 08:23 |
11-03 01:27 |
- |
MEVSPACE sp. z o.o. |
BG |
0 |
| canary-farm-1 |
102.220.163.241 |
1023 |
34 |
511 |
11-02 04:41 |
11-03 01:10 |
- |
VPS Dedicated LLC |
SI |
0 |
| ru-edge-1 |
102.220.163.241 |
516 |
34 |
512 |
11-02 21:08 |
11-03 03:27 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
195.178.110.159 |
385 |
3 |
373 |
11-02 13:55 |
11-03 05:20 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| lauterbourg-01-ts |
198.145.226.37 |
328 |
10 |
85 |
11-03 02:15 |
11-03 02:40 |
- |
M247 Europe SRL |
US |
0 |
| lauterbourg-01-ts |
162.216.241.239 |
327 |
9 |
85 |
11-02 12:43 |
11-02 13:08 |
- |
Dynu Systems Incorporated |
US |
0 |
| lauterbourg-01-ts |
35.240.216.96 |
218 |
10 |
167 |
11-03 05:23 |
11-03 05:25 |
- |
Google LLC |
SG |
4 |
| lauterbourg-01-ts |
52.39.163.179 |
218 |
10 |
167 |
11-03 02:13 |
11-03 02:15 |
- |
Amazon.com, Inc. |
US |
4 |
| canary-farm-1 |
108.181.98.163 |
197 |
19 |
42 |
11-02 08:37 |
11-02 20:18 |
- |
Psychz Networks |
US |
15 |
| canary-farm-1 |
174.138.22.143 |
160 |
29 |
85 |
11-02 10:21 |
11-02 12:33 |
- |
DigitalOcean, LLC |
SG |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
22 |
14 |
| control-1 |
17 |
9 |
| ru-edge-1 |
6 |
6 |
| canary-farm-1 |
27 |
15 |
| frantech-ts |
0 |
0 |
Mint failures (24h): control-1:400x2; ai-devbox-1:?x2; canary-farm-1:400x8; ai-devbox-1:400x3; ru-edge-1:400x1
Mints by type label:
| sensor |
types |
mints |
| ru-edge-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws"] |
27 |
| control-1 |
["aws"] |
17 |
| ai-devbox-1 |
["aws"] |
22 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 3763
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 1
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
4703 |
| ai-devbox-1 |
https |
411 |
| canary-farm-1 |
http |
2942 |
| canary-farm-1 |
https |
2849 |
| control-1 |
http |
4625 |
| frantech-ts |
http |
15288 |
| lauterbourg-01-ts |
http |
1879 |
| lauterbourg-01-ts |
https |
502 |
| netcup-ts |
http |
530 |
| ru-edge-1 |
http |
1038 |
| sponge-01-ts |
http |
617 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
15276 |
| control-1 |
38.54.2.209 |
4613 |
| canary-farm-1 |
sso.rightabouteverything.show |
3449 |
| ai-devbox-1 |
inference.fapthropic.com |
2860 |
| canary-farm-1 |
109.123.246.142 |
2321 |
| ai-devbox-1 |
217.15.163.226 |
2232 |
| ru-edge-1 |
130.94.89.46 |
1029 |
| lauterbourg-01-ts |
89.116.25.211 |
849 |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
795 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
706 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (51 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-11-03 |
4625 |
145 |
| 2026-11-02 |
2098 |
155 |
| 2026-11-01 |
1179 |
104 |
| 2026-10-31 |
1566 |
138 |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
| 2026-10-21 |
2892 |
104 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
45.138.12.10 |
125 |
/openai-proxy.yaml [not-handled] → /openai-proxy/config.json [not-handled] → /ai/credentials.json [not-handled] → /api/bedrock [not-handled] → /api/bedrock-runtime [not-handled] → /config/ai.json [not-handled] → /gpt/config.json [not-handled] → /litellm_config.yaml [litellm-config-error] → /bedrock/config.yml [not-handled] → /bedrock/config.yaml [not-handled] → /config/llm.yaml [not-handled] → /ai/credentials [not-handled] |
Tc Datacenter Limited |
LT |
| control-1 |
102.220.163.241 |
58 |
/.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] → /config/.env [env-production] → /assets/.env [env-production] |
VPS Dedicated LLC |
SI |
| control-1 |
194.180.49.41 |
54 |
/ [tarpit-module] → /pscan-8124d1a0-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
MEVSPACE sp. z o.o. |
BG |
| ai-devbox-1 |
102.220.163.241 |
35 |
/.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] → /config/.env [env-production] → /assets/.env [env-production] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
102.220.163.241 |
34 |
/.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] → /config/.env [env-production] → /assets/.env [env-production] |
VPS Dedicated LLC |
SI |
| ru-edge-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /.git/config [fake-git] → /pscan-a0eeb7e2-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
174.138.22.143 |
29 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → /sitemap.xml [tarpit-module] → /sitemap.xml [tarpit] → /sitemap.xml [tarpit-disconnect] → /debug.log [not-handled] → /_profiler/phpinfo [symfony-profiler-phpinfo] → /config/auth.json [composer-auth-json-error] |
DigitalOcean, LLC |
SG |
| ru-edge-1 |
164.90.208.56 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
157.230.19.140 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
142.93.0.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
206.81.24.227 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
209.97.180.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
157.245.36.108 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| ai-devbox-1 |
64.225.75.246 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| control-1 |
206.189.233.36 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 505 sources sent credentials → 387 got a shell (77%) → 326 ran a command (84% of shell-getters, 65% of sources)
- event level: 13835 credential attempts → 5711 accepted logins → 14542 commands (255% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 455 attempts
New commands this window (0 of 5461 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 3686 |
6 |
109.160.32.47 |
"uname -s -v -n -r -m" |
| 3682 |
6 |
109.160.32.47 |
"uname -m | awk '{printf $1}'" |
| 622 |
286 |
106.243.155.71 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 518 |
244 |
106.243.155.71 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 71 |
2 |
2.57.122.238 |
"nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
| 71 |
2 |
2.57.122.238 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
| 71 |
2 |
2.57.122.238 |
"lspci | grep VGA -c" |
| 71 |
2 |
2.57.122.238 |
"lspci | grep VGA | cut -f5- -d ' '" |
Credentials: 4778 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 599 |
345gs5662d34 |
345gs5662d34 |
| 457 |
root |
3245gs5662d34 |
| 80 |
root |
123456 |
| 77 |
pi |
raspberry |
| 71 |
user |
wasd |
| 37 |
support |
support |
| 28 |
admin |
3245gs5662d34 |
| 19 |
user |
3245gs5662d34 |