flux fleet digest — 2026-11-04 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2491 |
168 |
5681 |
291 |
-56% |
| canary-farm-1 |
10918 |
223 |
14258 |
320 |
-23% |
| control-1 |
3715 |
127 |
2659 |
136 |
+40% |
| frantech-ts |
517 |
106 |
15183 |
126 |
-97% |
| lauterbourg-01-ts |
13059 |
174 |
3077 |
181 |
+324% |
| netcup-ts |
953 |
132 |
1231 |
123 |
-23% |
| ru-edge-1 |
1169 |
123 |
3544 |
152 |
-67% |
| sponge-01-ts |
893 |
101 |
1059 |
116 |
-16% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
actuator-env |
30 |
8.1 |
3.7x |
| canary-farm-1 |
actuator-mappings |
20 |
5.0 |
4.0x |
| canary-farm-1 |
not-handled |
7031 |
635.0 |
11.1x |
| canary-farm-1 |
webapp-config-bundle-js |
348 |
34.4 |
10.1x |
| control-1 |
config-json-error |
21 |
4.7 |
4.5x |
| control-1 |
not-handled |
2007 |
286.6 |
7.0x |
| control-1 |
wp-config-error |
27 |
3.0 |
9.0x |
| lauterbourg-01-ts |
wp-xmlrpc-post |
10000 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
85 |
601 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
14 |
99 |
control-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ |
11 |
531 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 2d3e95b722b5 ⟳ |
11 |
533 |
lauterbourg-01-ts |
10-24 |
/ [php2shell-root] → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp |
| ef1ab74f3d57 ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 218630667b2c ⟳ |
7 |
301 |
ai-devbox-1,control-1,frantech-ts,netcup-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 6b025bffa18d ⟳ |
7 |
24 |
lauterbourg-01-ts |
10-25 |
/ [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module] |
| b07c7bb207b4 ⟳ |
6 |
246 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/c/dKt1W2y99W5syk6cTImOh2Tn-vNV0MjKbZJA_lvd5e3emEY_DM-JUICWhNqbgkVvqnlyR569UY3vjFEXgC9IKWwt367XWi2h |
2026-11-04 02:15:56.144040-05:00 |
| ru-edge-1 |
/c/ApLTkL4XJp0Tfykjzb-yUkgwzxrRWFi_odOgW2_Z8CzWNbOe8bervK9ufUj_O1Ow3xwiRaimTPyhhREPyfGBDPVurLj0UaTp |
2026-11-04 02:15:56.144040-05:00 |
| ru-edge-1 |
/c/BQngenxWWoDUIZVdKsCH2K--IbrP5SOzWA37XNs_P3ND1Bf2lxliCWfrEnvL2HHYMsHIYEJnabsa2pE19PJVuqXUuDS4FSs8 |
2026-11-04 02:15:56.144040-05:00 |
| ru-edge-1 |
/c/dvgz0HyFLC1wgQdU_nMqauw9sum-fgNi3POejq-3qdHSU5vw981Wxm5Wja5PMzPKSrwT_bFNQxJ5Mxdcu_NCet-oiVR7Cu0C |
2026-11-04 02:15:56.144040-05:00 |
| ru-edge-1 |
/c/wIwCOBddxEEsXkfDxKnvMHMl2GG4O3frKQ8DpgHCPshWDeX0BrqbpoIAyjyzSnzvJpHoaPDd-CibAC3YiRtRpr3xCiwlaMqn |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-content/plugins/wp-symposium/server/file_upload_form.php |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-content/plugins/wp-301-redirects/includes/class-log-io.php |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-content/plugins/kaswara/includes/handlers/ajax_handler.php |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-content/plugins/admin-word-count-column/download-csv.php |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config-bak.php |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php.2 |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php_3 |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.phpnew |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php.xampp |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.dump |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.zlib |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php.swm |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.wp-config |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php_orig |
2026-11-04 02:15:56.144040-05:00 |
| canary-farm-1 |
/wp-config.php.BAK |
2026-11-04 02:15:56.144040-05:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Python/3.14 aiohttp/3.14.5 |
2026-11-04 02:31:59.553819-05:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.2 |
2026-11-04 02:31:59.553819-05:00 |
| netcup-ts |
Mozilla/5.0 (Linux; Android 11; RMX1921) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.58 Mobile Safari/537.36 |
2026-11-04 02:15:56.320297-05:00 |
| canary-farm-1 |
ipbase-scanner (+https://ipbase.com/scanner) |
2026-11-04 02:15:56.320297-05:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 13_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.80 Mobile/15E148 Safari/604.1 |
2026-11-04 02:15:56.320297-05:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 |
2026-11-04 02:15:56.320297-05:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/85.0.4183.127 Safari/537.36 |
2026-11-04 02:15:56.320297-05:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0 |
2026-11-04 02:15:56.320297-05:00 |
| frantech-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 |
2026-11-04 02:15:56.320297-05:00 |
| sponge-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/123.0.0.0 |
2026-11-04 02:15:56.320297-05:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| lauterbourg-01-ts |
34.78.138.84 |
10008 |
5 |
5 |
11-03 11:38 |
11-03 11:42 |
- |
Google LLC |
BE |
10000 |
| canary-farm-1 |
195.178.110.247 |
6888 |
7 |
6709 |
11-03 11:45 |
11-03 12:18 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| control-1 |
204.76.203.18 |
1837 |
2 |
579 |
11-03 07:43 |
11-04 06:09 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
195.178.110.159 |
768 |
2 |
376 |
11-03 05:20 |
11-03 16:41 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| canary-farm-1 |
195.178.110.22 |
535 |
11 |
436 |
11-03 19:12 |
11-03 19:12 |
- |
Techoff Srv Limited |
BG |
0 |
| control-1 |
102.220.163.241 |
514 |
34 |
511 |
11-03 02:45 |
11-03 03:27 |
- |
VPS Dedicated LLC |
SI |
0 |
| canary-farm-1 |
85.11.167.204 |
514 |
34 |
511 |
11-03 19:21 |
11-03 20:13 |
- |
TechTies Inc. |
NL |
0 |
| ru-edge-1 |
102.220.163.241 |
514 |
34 |
511 |
11-03 02:39 |
11-03 03:27 |
- |
VPS Dedicated LLC |
SI |
0 |
| ai-devbox-1 |
85.11.167.204 |
514 |
34 |
511 |
11-03 16:46 |
11-03 17:28 |
- |
TechTies Inc. |
NL |
0 |
| control-1 |
158.140.191.104 |
459 |
28 |
85 |
11-03 19:22 |
11-03 19:23 |
- |
PT. Eka Mas Republik |
ID |
0 |
| netcup-ts |
85.155.14.15 |
356 |
4 |
356 |
11-03 13:38 |
11-03 13:41 |
- |
SolidCore Hosting LTD |
DE |
0 |
| ai-devbox-1 |
85.155.14.14 |
353 |
47 |
353 |
11-03 21:10 |
11-03 21:14 |
- |
SolidCore Hosting LTD |
DE |
0 |
| lauterbourg-01-ts |
185.190.54.150 |
297 |
7 |
210 |
11-03 20:02 |
11-03 20:05 |
- |
Epcan GmbH |
DE |
0 |
| lauterbourg-01-ts |
195.178.110.94 |
296 |
8 |
292 |
11-03 10:21 |
11-03 10:24 |
- |
Techoff Srv Limited |
BG |
0 |
| lauterbourg-01-ts |
34.15.150.42 |
278 |
9 |
273 |
11-03 17:42 |
11-03 17:43 |
- |
Google LLC |
TH |
4 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
12 |
10 |
| ai-devbox-1 |
28 |
23 |
| canary-farm-1 |
32 |
26 |
| ru-edge-1 |
11 |
10 |
Mint failures (24h): ai-devbox-1:400x3; canary-farm-1:400x3; control-1:400x1; ru-edge-1:400x1
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
28 |
| control-1 |
["aws"] |
12 |
| canary-farm-1 |
["aws"] |
32 |
| ru-edge-1 |
["aws"] |
11 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2563
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 7
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2141 |
| ai-devbox-1 |
https |
350 |
| canary-farm-1 |
http |
10053 |
| canary-farm-1 |
https |
865 |
| control-1 |
http |
3715 |
| frantech-ts |
http |
517 |
| lauterbourg-01-ts |
http |
11718 |
| lauterbourg-01-ts |
https |
1341 |
| netcup-ts |
http |
953 |
| ru-edge-1 |
http |
1169 |
| sponge-01-ts |
http |
893 |
Top Host headers:
| sensor |
host |
events |
| lauterbourg-01-ts |
cloud.wafflehouseindex.us |
11631 |
| canary-farm-1 |
109.123.246.142 |
9726 |
| control-1 |
38.54.2.209 |
3701 |
| ai-devbox-1 |
217.15.163.226 |
1601 |
| canary-farm-1 |
sso.rightabouteverything.show |
1168 |
| ru-edge-1 |
130.94.89.46 |
1083 |
| netcup-ts |
159.195.21.150 |
947 |
| ai-devbox-1 |
inference.fapthropic.com |
867 |
| lauterbourg-01-ts |
89.116.25.211 |
856 |
| sponge-01-ts |
89.167.72.144 |
640 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (52 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-11-04 |
3715 |
127 |
| 2026-11-03 |
4625 |
145 |
| 2026-11-02 |
2098 |
155 |
| 2026-11-01 |
1179 |
104 |
| 2026-10-31 |
1566 |
138 |
| 2026-10-30 |
1959 |
146 |
| 2026-10-29 |
2048 |
153 |
| 2026-10-28 |
5138 |
112 |
| 2026-10-27 |
4151 |
130 |
| 2026-10-26 |
892 |
102 |
| 2026-10-25 |
16293 |
114 |
| 2026-10-24 |
1369 |
152 |
| 2026-10-23 |
2290 |
108 |
| 2026-10-22 |
2173 |
178 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ai-devbox-1 |
85.155.14.14 |
47 |
/.aws/credentials [aws-credentials-file] → /aws_credentials.json [aws-credentials-json] → /.aws/sso/cache [not-handled] → /.aws/credentials.bak [aws-credentials-file] → /.aws/credentials.old [aws-credentials-file] → /.aws/config [aws-config-file] → /.aws/cli/cache [not-handled] → /.aws/config.bak [not-handled] → /aws_credentials [not-handled] → /.boto [boto-config] → /.azure/config [azure-cli-config] → /.s3cfg [s3cfg] |
SolidCore Hosting LTD |
DE |
| canary-farm-1 |
165.227.84.14 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
164.90.208.56 |
36 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
85.11.167.204 |
34 |
/ [tarpit-module] → /pscan-06716cd3-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
NL |
| canary-farm-1 |
85.11.167.204 |
34 |
/ [tarpit-module] → /pscan-9e18734c-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
TechTies Inc. |
NL |
| ru-edge-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-a0eeb7e2-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| control-1 |
102.220.163.241 |
34 |
/ [tarpit-module] → /pscan-70aa31a1-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] |
VPS Dedicated LLC |
SI |
| canary-farm-1 |
152.89.244.89 |
33 |
/ [tarpit-module] → /@fs/etc/passwd [vite-fs-etc-passwd] → /containers/json [docker-daemon-containers-list] → /actuator/env [actuator-env] → /actuator [observability-actuator-index] → /env [actuator-env] → /actuator/configprops [actuator-configprops] → /actuator/heapdump [actuator-heapdump] → /actuator/jolokia [actuator-jolokia] → /actuator/mappings [actuator-mappings] → /actuator/beans [observability-actuator-beans] → /actuator/jolokia/list [actuator-jolokia] |
aurologic GmbH |
DE |
| control-1 |
158.140.191.104 |
28 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → /sitemap.xml [tarpit-module] → /sitemap.xml [tarpit] → /sitemap.xml [tarpit-disconnect] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env [issued] |
PT. Eka Mas Republik |
ID |
| ai-devbox-1 |
206.81.24.74 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
167.172.232.142 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
209.38.208.202 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
165.22.34.189 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
128.199.182.55 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 317 sources sent credentials → 204 got a shell (64%) → 151 ran a command (74% of shell-getters, 48% of sources)
- event level: 8188 credential attempts → 3363 accepted logins → 10050 commands (299% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 467 attempts
New commands this window (0 of 4494 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1927 |
3 |
109.160.32.47 |
"uname -m | awk '{printf $1}'" |
| 1927 |
3 |
109.160.32.47 |
"uname -s -v -n -r -m" |
| 297 |
114 |
223.221.38.226 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 241 |
100 |
223.221.38.226 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 157 |
1 |
195.178.110.218 |
"/bin/./uname -s -v -n -r -m" |
| 157 |
1 |
195.178.110.218 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 157 |
1 |
195.178.110.218 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 157 |
1 |
195.178.110.218 |
"lspci | grep VGA -c" |
Credentials: 3656 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 175 |
rootssssss23424123123 |
rootssssss23424123123 |
| 149 |
root |
root3245gs5662d34111111111 |
| 111 |
345gs5662d34 |
345gs5662d34 |
| 87 |
root |
3245gs5662d34 |
| 87 |
root |
123456 |
| 69 |
pi |
raspberry |
| 62 |
user |
wasd |
| 32 |
support |
support |