flux fleet digest — 2026-11-05 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| ai-devbox-1 | 6071 | 179 | 3998 | 249 | +52% |
| canary-farm-1 | 5087 | 428 | 9197 | 266 | -45% |
| control-1 | 20567 | 136 | 2315 | 134 | +788% |
| frantech-ts | 3055 | 141 | 15027 | 125 | -80% |
| lauterbourg-01-ts | 4327 | 254 | 3822 | 180 | +13% |
| netcup-ts | 5226 | 165 | 939 | 112 | +457% |
| ru-edge-1 | 3446 | 161 | 1085 | 139 | +218% |
| sponge-01-ts | 3301 | 151 | 971 | 114 | +240% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | tarpit-module | 3532 | 630.3 | 5.6x |
| ai-devbox-1 | wp-login-credentials | 282 | 61.3 | 4.6x |
| ai-devbox-1 | wp-login-probe | 312 | 3.6 | 86.7x |
| ai-devbox-1 | wp-user-enum-core-sitemap | 21 | 1.3 | 15.8x |
| ai-devbox-1 | wp-user-enum-rest-list | 54 | 11.9 | 4.6x |
| ai-devbox-1 | wp-user-enum-rest-single | 240 | 0.0 | infx |
| canary-farm-1 | wp-login-probe | 337 | 16.1 | 20.9x |
| canary-farm-1 | wp-user-enum-rest-list | 53 | 13.3 | 4.0x |
| canary-farm-1 | wp-user-enum-rest-single | 160 | 20.0 | 8.0x |
| control-1 | not-handled | 17224 | 460.0 | 37.4x |
| control-1 | tarpit-module | 2272 | 606.0 | 3.7x |
| control-1 | wp-login-credentials | 168 | 16.3 | 10.3x |
| control-1 | wp-login-probe | 180 | 13.2 | 13.6x |
| control-1 | wp-user-enum-rest-list | 33 | 6.7 | 4.9x |
| control-1 | wp-user-enum-rest-single | 100 | 0.0 | infx |
| frantech-ts | tarpit-module | 2080 | 313.0 | 6.6x |
| frantech-ts | wp-login-credentials | 269 | 0.0 | infx |
| frantech-ts | wp-login-probe | 284 | 4.0 | 71.0x |
| frantech-ts | wp-user-enum-rest-list | 28 | 4.6 | 6.1x |
| frantech-ts | wp-user-enum-rest-single | 140 | 0.0 | infx |
| lauterbourg-01-ts | php2shell-login | 746 | 79.6 | 9.4x |
| lauterbourg-01-ts | wp-login-credentials | 290 | 84.0 | 3.5x |
| lauterbourg-01-ts | wp-login-probe | 322 | 2.3 | 138.0x |
| lauterbourg-01-ts | wp-user-enum-core-sitemap | 21 | 0.0 | infx |
| lauterbourg-01-ts | wp-user-enum-rest-list | 58 | 6.3 | 9.2x |
| lauterbourg-01-ts | wp-user-enum-rest-single | 220 | 0.0 | infx |
| netcup-ts | tarpit-module | 3947 | 418.9 | 9.4x |
| netcup-ts | wp-login-credentials | 283 | 36.3 | 7.8x |
| netcup-ts | wp-login-probe | 312 | 32.0 | 9.8x |
| netcup-ts | wp-user-enum-core-sitemap | 21 | 1.0 | 21.0x |
| netcup-ts | wp-user-enum-rest-list | 56 | 3.4 | 16.3x |
| netcup-ts | wp-user-enum-rest-single | 200 | 20.0 | 10.0x |
| ru-edge-1 | tarpit-module | 2582 | 356.4 | 7.2x |
| ru-edge-1 | wp-login-credentials | 191 | 35.3 | 5.4x |
| ru-edge-1 | wp-login-probe | 205 | 22.8 | 9.0x |
| ru-edge-1 | wp-user-enum-rest-list | 37 | 6.6 | 5.6x |
| ru-edge-1 | wp-user-enum-rest-single | 140 | 20.0 | 7.0x |
| sponge-01-ts | tarpit-module | 2235 | 356.1 | 6.3x |
| sponge-01-ts | wp-login-probe | 192 | 8.8 | 21.9x |
| sponge-01-ts | wp-user-enum-rest-list | 25 | 4.7 | 5.3x |
| sponge-01-ts | wp-user-enum-rest-single | 160 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 128 | 886 | ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 125fa0740adf | 41 | 164 | ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 11-05 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
| c040230cd7b0 | 25 | 300 | ai-devbox-1,canary-farm-1,control-1,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 11-05 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 5e0185746583 ⟳ | 24 | 384 | ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 10-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 8c95f27cfabd | 21 | 546 | ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 11-05 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| eee552d8955a ⟳ | 18 | 4950 | ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 09-22 | /wp-login.php [wp-login-probe] → /wp-json/wp/v2/users [wp-user-enum-rest-list] → / [wp-user-enum-rest-list] → /index.php [wp-user-enum-rest-list] → /feed/ [not-handled] → /wp-sitemap-users-1.xml [wp-u |
| 95d313cbbacc | 16 | 320 | ai-devbox-1,canary-farm-1,control-1,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 11-05 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| e44df586c709 | 16 | 288 | canary-farm-1,control-1,lauterbourg-01-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE | 11-05 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| control-1 | /iranbot-ultimate.sh4 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /krmine | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /krmine-mips | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /krmine-mipsel | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /llx.mips | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /mrraider-armv7 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /notmalware/9suckonmybinary78 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /nyx_bot_linux_amd64 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /nyx_bot_linux_arm64_exec | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /nyx_bot_linux_arm64_hkdf | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /ppprincee6/secured_stub.ps1 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /prince1/secured_stub.ps1 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /princee255/Crypted.ps1 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /rock.exe | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /suzxwgr/afwugem/aimxfrz/DTsecured_stub.ps1 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /tsk/red_stub.ps1 | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /two.exe | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /uploads/141935c46a5c4ff1b84b433e84f36e61.exe | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /uploads/d0d605c01f71464ea16b25c92892dbe0.exe | 2026-11-05 02:15:40.645580-05:00 |
| control-1 | /web/JOHN21/5T5T/35434FGRT.ps1 | 2026-11-05 02:15:40.645580-05:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| netcup-ts | Mozilla/5.0 (iPhone; CPU iPhone OS 26_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1 | 2026-11-05 02:15:41.127644-05:00 |
| netcup-ts | Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 Firefox/158.0 | 2026-11-05 02:15:41.127644-05:00 |
| lauterbourg-01-ts | Mozilla/5.0 (compatible; pathscan/1.0) | 2026-11-05 02:15:41.127644-05:00 |
| ru-edge-1 | git-config-harvester/1.0 | 2026-11-05 02:15:41.127644-05:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 OPR/86.0.4363.50 | 2026-11-05 02:15:41.127644-05:00 |
| frantech-ts | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. | 2026-11-05 02:15:41.127644-05:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0 | 2026-11-05 02:15:41.127644-05:00 |
| lauterbourg-01-ts | curl/8.21.0 | 2026-11-05 02:15:41.127644-05:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15 | 2026-11-05 02:15:41.127644-05:00 |
| lauterbourg-01-ts | undici | 2026-11-05 02:15:41.127644-05:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 23.234.119.146 | 14932 | 6 | 14922 | 11-04 20:14 | 11-04 20:16 | - | tzulo, inc. | US | 0 |
| control-1 | 204.76.203.18 | 2190 | 2 | 580 | 11-04 02:34 | 11-05 05:42 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| lauterbourg-01-ts | 172.18.0.1 | 1204 | 10 | 37 | 11-04 09:47 | 11-05 02:29 | - | 121 | ||
| ai-devbox-1 | 45.94.31.16 | 1007 | 5 | 5 | 11-04 15:44 | 11-04 15:47 | - | 1337 Services GmbH | NL | 1000 |
| sponge-01-ts | 193.47.62.109 | 552 | 7 | 276 | 11-05 05:38 | 11-05 05:43 | - | BestDC Limited | BG | 1 |
| frantech-ts | 139.99.56.79 | 295 | 7 | 10 | 11-04 10:11 | 11-05 02:07 | - | OVH SAS | SG | 11 |
| frantech-ts | 144.126.158.115 | 293 | 7 | 10 | 11-04 09:56 | 11-05 01:37 | - | Contabo Inc. | US | 10 |
| control-1 | 160.187.146.57 | 293 | 7 | 10 | 11-04 10:24 | 11-05 01:44 | - | INTERDIGI JOINT STOCK COMPAN | VN | 10 |
| canary-farm-1 | 176.123.8.213 | 290 | 63 | 175 | 11-05 03:23 | 11-05 03:27 | - | Alexhost S.r.l. | MD | 0 |
| ai-devbox-1 | 34.95.247.158 | 285 | 7 | 13 | 11-04 06:12 | 11-04 19:03 | - | Google LLC | BR | 1 |
| control-1 | 194.180.49.41 | 285 | 27 | 283 | 11-04 16:27 | 11-04 19:12 | - | MEVSPACE sp. z o.o. | BG | 0 |
| lauterbourg-01-ts | 176.123.8.213 | 281 | 18 | 176 | 11-05 04:23 | 11-05 04:26 | - | Alexhost S.r.l. | MD | 0 |
| netcup-ts | 92.118.57.126 | 277 | 7 | 10 | 11-04 09:59 | 11-04 20:34 | - | Contabo Inc. | US | 2 |
| frantech-ts | 123.253.14.241 | 276 | 4 | 11 | 11-04 10:19 | 11-04 10:21 | - | Ishan's Network | IN | 1 |
| ai-devbox-1 | 165.232.174.98 | 275 | 6 | 10 | 11-04 19:14 | 11-04 19:14 | - | DigitalOcean, LLC | SG | 1 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| ai-devbox-1 | 15 | 12 |
| control-1 | 12 | 10 |
| canary-farm-1 | 26 | 16 |
| ru-edge-1 | 6 | 6 |
| lauterbourg-01-ts | 0 | 0 |
| sponge-01-ts | 0 | 0 |
Mint failures (24h): none
Mints by type label:
| sensor | types | mints |
|---|---|---|
| ai-devbox-1 | ["aws"] | 15 |
| control-1 | ["aws"] | 12 |
| ru-edge-1 | ["aws"] | 6 |
| canary-farm-1 | ["aws"] | 26 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1353
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 5930 |
| ai-devbox-1 | https | 141 |
| canary-farm-1 | http | 4230 |
| canary-farm-1 | https | 857 |
| control-1 | http | 20567 |
| frantech-ts | http | 3055 |
| lauterbourg-01-ts | http | 3972 |
| lauterbourg-01-ts | https | 355 |
| netcup-ts | http | 5226 |
| ru-edge-1 | http | 3446 |
| sponge-01-ts | http | 3301 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 20558 |
| netcup-ts | v2202603343434439947.megasrv.de | 4554 |
| ai-devbox-1 | vmi3177282.contaboserver.net | 4199 |
| ru-edge-1 | 130.94.89.46 | 3430 |
| sponge-01-ts | 89.167.72.144 | 3289 |
| frantech-ts | 209.141.62.110 | 3038 |
| canary-farm-1 | vmi3243483.contaboserver.net | 3035 |
| lauterbourg-01-ts | vmi3610064.contaboserver.net | 2436 |
| ai-devbox-1 | inference.fapthropic.com | 1348 |
| lauterbourg-01-ts | 89.116.25.211 | 1180 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (53 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-11-05 | 20567 | 136 |
| 2026-11-04 | 2730 | 100 |
| 2026-11-03 | 4625 | 145 |
| 2026-11-02 | 2098 | 155 |
| 2026-11-01 | 1179 | 104 |
| 2026-10-31 | 1566 | 138 |
| 2026-10-30 | 1959 | 146 |
| 2026-10-29 | 2048 | 153 |
| 2026-10-28 | 5138 | 112 |
| 2026-10-27 | 4151 | 130 |
| 2026-10-26 | 892 | 102 |
| 2026-10-25 | 16293 | 114 |
| 2026-10-24 | 1369 | 152 |
| 2026-10-23 | 2290 | 108 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 176.123.8.213 | 63 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /1ukbyh6gp4oy4jc58jozlc7n4 [not-handled] → /.env [issued] → /..env [not-handled] → /.Env [issued] → /.ENV [issued] → /.aws/config [aws-config-file] → /.aws/credentials [aws-credentials-file] → /.aws/config.bak [not-handled] → /.aws/credentials.bak [aws-credentials-file] | Alexhost S.r.l. | MD |
| canary-farm-1 | 209.38.208.202 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 167.99.181.249 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 64.225.75.246 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| control-1 | 159.89.127.165 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ru-edge-1 | 139.59.143.102 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| control-1 | 64.23.218.208 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 209.97.180.8 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| control-1 | 194.180.49.41 | 27 | / [tarpit-module] → /pscan-04d22ab6-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | MEVSPACE sp. z o.o. | BG |
| ai-devbox-1 | 159.89.127.165 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 138.68.86.32 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| control-1 | 138.68.144.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 138.68.144.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 164.92.244.132 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 165.227.84.14 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 369 sources sent credentials → 235 got a shell (64%) → 166 ran a command (71% of shell-getters, 45% of sources)
- event level: 10865 credential attempts → 4990 accepted logins → 14689 commands (294% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 511 attempts
New commands this window (0 of 4973 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events | IPs | example source | command (head) |
|---|---|---|---|
| 2951 | 5 | 109.160.32.180 | "uname -s -v -n -r -m" |
| 2950 | 5 | 109.160.32.180 | "uname -m | awk '{printf $1}'" |
| 445 | 120 | 107.189.23.48 | "cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 405 | 3 | 2.57.122.238 | "nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 405 | 3 | 2.57.122.238 | "/bin/./uname -s -v -n -r -m" |
| 405 | 3 | 2.57.122.238 | "uptime -p" |
| 405 | 3 | 2.57.122.238 | "nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c" |
| 405 | 3 | 2.57.122.238 | "lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 3499 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts | user | password |
|---|---|---|
| 285 | rootssssss23424123123 | rootssssss23424123123 |
| 217 | root | root3245gs5662d34111111111 |
| 139 | 345gs5662d34 | 345gs5662d34 |
| 105 | root | 3245gs5662d34 |
| 97 | root | 123456 |
| 82 | pi | raspberry |
| 78 | user | wasd |
| 43 | support | support |
HoneyDB sensor (ch-sponge-01-ts — not a flux node)
HoneyDB sensor layer — ch-sponge-01-ts
Window since 2026-11-04T07:34Z. 12143 records, 2984 sessions, 360 source addresses; event kinds: INFO 5875, CONNECT 2982, RX 2453, TX 833.
HoneyDB parses each interaction into structured INFO events; the pcaps behind them are in Arkime under sensor:ch-sponge-01-ts. Records older than 30 days are not retrievable from the platform API.
| service | records | sessions | sources |
|---|---|---|---|
| Telnet | 8728 | 2040 | 105 |
| HTTP | 765 | 204 | 54 |
| MoneroRPC.wallet | 554 | 104 | 4 |
| Docker | 441 | 78 | 14 |
| LND | 436 | 269 | 105 |
| BeaconAPI.web3signer | 404 | 76 | 26 |
| Electrum | 271 | 25 | 13 |
| IPFS | 121 | 41 | 19 |
| MoneroRPC | 106 | 22 | 1 |
| XMRigAPI | 76 | 27 | 15 |
| BitcoinP2P | 70 | 24 | 14 |
| SolanaRPC | 62 | 26 | 10 |
| ClaymoreAPI | 55 | 26 | 11 |
| EVMRPC | 41 | 19 | 5 |
| BeaconAPI.engine | 5 | 1 | 1 |
| BitcoinRPC | 4 | 1 | 1 |
| SubstrateRPC | 4 | 1 | 1 |
Top sources
| source | records |
|---|---|
| 94.183.174.99 | 7342 |
| 176.65.144.71 | 396 |
| 169.150.196.5 | 324 |
| 193.32.249.162 | 308 |
| 14.153.139.117 | 276 |
| 45.148.10.5 | 237 |
| 139.177.207.222 | 171 |
| 85.11.167.83 | 155 |
| 118.143.195.94 | 110 |
| 72.46.87.211 | 75 |
INFO event classes
| event_type | records |
|---|---|
| api_request | 219 |
| client_fingerprint | 145 |
| rpc_call | 129 |
| rest_call | 55 |
| peer_request | 24 |
| session_summary | 19 |
| wallet_open_attempt | 16 |
| miner_api_command | 11 |
| transfer_attempt | 8 |
| exec_create | 7 |
| key_exfil_attempt | 5 |
| cve_attempt | 5 |
Lure paths requested
| path/target | records |
|---|---|
| /.env.bak | 2 |
| /.env | 1 |
| /.env.local | 1 |
| /.env.production | 1 |
Sample high-value events
11-04T12:05ZDocker dropper_indicators from 14.153.139.11711-04T20:44ZDocker dropper_indicators from 106.75.37.12311-04T20:51ZHTTP crypto_lure_request from 176.65.144.71 —/.env.bak11-05T01:09ZHTTP crypto_lure_request from 45.148.10.5 —/.env11-05T01:09ZHTTP crypto_lure_request from 45.148.10.5 —/.env.bak11-05T01:09ZHTTP crypto_lure_request from 45.148.10.5 —/.env.local11-05T01:09ZHTTP crypto_lure_request from 45.148.10.5 —/.env.production11-05T04:52ZDocker dropper_indicators from 14.153.139.117