flux fleet digest — 2026-11-06 07:34 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 4450 315 3133 246 +42%
canary-farm-1 2277 473 6200 277 -63%
control-1 46880 210 4961 132 +845%
frantech-ts 1042 116 11435 133 -91%
lauterbourg-01-ts 2743 191 3723 190 -26%
netcup-ts 2513 106 1580 115 +59%
ru-edge-1 649 122 1420 146 -54%
sponge-01-ts 1436 97 1254 118 +14%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 wp-login-credentials 394 94.3 4.2x
ai-devbox-1 wp-login-probe 395 65.8 6.0x
ai-devbox-1 wp-xmlrpc-post 2000 641.6 3.1x
canary-farm-1 backup-archive 29 5.2 5.6x
control-1 aws-config-file 457 1.7 274.2x
control-1 aws-credentials-file 924 2.6 359.3x
control-1 env-production 2178 138.3 15.8x
control-1 etc-passwd 82 0.0 infx
control-1 etc-shadow 515 0.0 infx
control-1 issued 582 10.7 54.3x
control-1 php-filter-issued 32 0.0 infx
control-1 phpmyadmin-credential-post 4097 10.0 409.7x
control-1 phpmyadmin-login 537 59.9 9.0x
control-1 phpunit-eval-stdin 265 1.7 159.0x
control-1 tarpit-module 34271 861.4 39.8x
control-1 tomcat-manager-console-challenge 259 0.0 infx
control-1 tomcat-manager-ui 74 0.0 infx
control-1 tomcat-manager-ui-challenge 83 1.0 83.0x
control-1 webapp-form-profile 65 1.0 65.0x
lauterbourg-01-ts php2shell-index 304 10.7 28.5x
netcup-ts wp-login-probe 309 93.5 3.3x
ru-edge-1 wp-xmlrpc-post 60 17.0 3.5x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 69 477 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 37 258 canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
df15d0ee3ccf ⟳ 19 2109 ai-devbox-1,canary-farm-1,frantech-ts,lauterbourg-01-ts,netcup-ts ⚠FLEET-WIDE 10-01 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login
6b025bffa18d ⟳ 10 36 lauterbourg-01-ts 10-25 / [php2shell-root] → /login [php2shell-login] → /favicon.ico [tarpit-module]
125fa0740adf ⟳ 9 36 ai-devbox-1,canary-farm-1,lauterbourg-01-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE 11-05 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials]
b6204355c60b 8 48 ai-devbox-1,canary-farm-1,control-1,frantech-ts,sponge-01-ts ⚠FLEET-WIDE 11-06 / [tarpit-module] → /login.htm [not-handled] → /login [webapp-form-login] → /index.htm [not-handled]
81099b9f707e ⟳ 5 43 canary-farm-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 10-23 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /favicon.ico [tarpit-module]
1cf777711bea ⟳ 4 38 ai-devbox-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 09-03 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module]

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
canary-farm-1 /src/config.ts 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/App.vue 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/api.ts 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/main.ts 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/services/api.ts 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/env.ts 2026-11-06 02:34:50.117151-05:00
canary-farm-1 /src/main.js 2026-11-06 02:34:50.117151-05:00
sponge-01-ts /application-azure.properties 2026-11-06 02:15:52.773269-05:00
ai-devbox-1 /inicio.pl 2026-11-06 02:15:52.773269-05:00
lauterbourg-01-ts /faq 2026-11-06 02:15:52.773269-05:00
lauterbourg-01-ts /email.php 2026-11-06 02:15:52.773269-05:00
lauterbourg-01-ts /mailconfig.json 2026-11-06 02:15:52.773269-05:00
lauterbourg-01-ts /apikey.json 2026-11-06 02:15:52.773269-05:00
ai-devbox-1 /.git/objects/a2/45b4bdad44c58cc0a6c6d0dd0cc66d42e6abd0 2026-11-06 02:15:52.773269-05:00
netcup-ts /�events/�.env 2026-11-06 02:15:52.773269-05:00
control-1 /.env.production� 2026-11-06 02:15:52.773269-05:00
control-1 /appsettings.QA.json 2026-11-06 02:15:52.773269-05:00
sponge-01-ts /backend/oracle/config.py 2026-11-06 02:15:52.773269-05:00
sponge-01-ts /cgi-bin/system_mgr.cgi 2026-11-06 02:15:52.773269-05:00
sponge-01-ts /cgi/networkDiag.cgi 2026-11-06 02:15:52.773269-05:00

New user agents:

sensor user agent first seen
lauterbourg-01-ts Mozilla/5.0 (compatible; SecurityResearch/1.0; ) 2026-11-06 02:15:53.016221-05:00
frantech-ts Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1 2026-11-06 02:15:53.016221-05:00
frantech-ts Mozilla/5.0 (Linux; Android 4.0.4; BNTV400 Build/IMM76L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Safari/537.36 2026-11-06 02:15:53.016221-05:00
netcup-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 2026-11-06 02:15:53.016221-05:00
netcup-ts Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 2026-11-06 02:15:53.016221-05:00
ai-devbox-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0.0) Gecko/20100101 Firefox/142.0.0 2026-11-06 02:15:53.016221-05:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:159.0) Gecko/20100101 Firefox/159.0 2026-11-06 02:15:53.016221-05:00
canary-farm-1 Mozilla/5.0 (compatible; CriminalIP/1.0; +https://security.criminalip.io/) 2026-11-06 02:15:53.016221-05:00
sponge-01-ts Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 2026-11-06 02:15:53.016221-05:00
sponge-01-ts Mozilla/5.0 (iPhone; CPU iPhone OS 18 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18 Mobile/15E148 Safari/604.1 2026-11-06 02:15:53.016221-05:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
control-1 194.180.49.41 45031 94 484 11-05 20:57 11-06 06:14 - MEVSPACE sp. z o.o. BG 4373
ai-devbox-1 45.94.31.16 2014 5 5 11-05 10:59 11-06 00:29 - 1337 Services GmbH NL 2000
netcup-ts 193.47.62.109 1142 8 442 11-05 11:19 11-05 11:24 - BestDC Limited BG 4
sponge-01-ts 193.47.62.109 552 7 276 11-05 05:38 11-05 05:43 - BestDC Limited BG 1
control-1 102.220.163.241 521 35 512 11-05 07:31 11-05 22:02 - VPS Dedicated LLC SI 0
ai-devbox-1 102.220.163.241 521 34 512 11-05 07:35 11-05 22:03 - VPS Dedicated LLC SI 0
lauterbourg-01-ts 67.230.190.82 304 1 1 11-06 00:49 11-06 00:50 - IT7 Networks Inc US 302
lauterbourg-01-ts 79.124.58.82 300 6 150 11-05 16:08 11-05 16:08 - Tamatiya EOOD BG 0
control-1 204.76.203.18 294 1 293 11-05 02:34 11-05 05:42 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
canary-farm-1 176.123.8.213 290 63 175 11-05 03:23 11-05 03:27 - Alexhost S.r.l. MD 0
frantech-ts 103.154.62.40 284 2 1 11-05 02:43 11-06 06:01 - VIETNAM POSTS AND TELECOMMUN VN 142
lauterbourg-01-ts 176.123.8.213 281 18 176 11-05 04:23 11-05 04:26 - Alexhost S.r.l. MD 0
lauterbourg-01-ts 34.15.131.22 278 9 273 11-05 21:24 11-05 21:25 - Google LLC TH 4
netcup-ts 195.178.110.159 216 14 201 11-05 20:38 11-06 06:01 ipsum:1 Techoff Srv Limited BG 0
canary-farm-1 195.178.110.159 193 53 178 11-05 20:17 11-06 00:45 ipsum:1 Techoff Srv Limited BG 0

Canary economics (24h)

sensor mints distinct minting IPs
control-1 582 6
ai-devbox-1 21 19
canary-farm-1 32 14
ru-edge-1 4 4
sponge-01-ts 0 0

Mint failures (24h): ru-edge-1:400x3; ai-devbox-1:400x12; canary-farm-1:400x5; control-1:400x12

Mints by type label:

sensor types mints
canary-farm-1 ["aws"] 32
ai-devbox-1 ["aws"] 21
ru-edge-1 ["aws"] 4
control-1 ["aws"] 582

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 2409
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 243
  • XFF present but ignored as the source (all entries internal, or it agrees with the peer): 313
  • XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 539

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 4359
ai-devbox-1 https 91
canary-farm-1 http 1490
canary-farm-1 https 787
control-1 http 46880
frantech-ts http 1042
lauterbourg-01-ts http 2064
lauterbourg-01-ts https 679
netcup-ts http 2513
ru-edge-1 http 649
sponge-01-ts http 1436

Top Host headers:

sensor host events
control-1 38.54.2.209 46468
ai-devbox-1 inference.fapthropic.com 2257
netcup-ts 159.195.21.150 1866
sponge-01-ts 89.167.72.144 1420
lauterbourg-01-ts 89.116.25.211 1331
canary-farm-1 109.123.246.142 1245
ai-devbox-1 217.15.163.226 1074
frantech-ts 209.141.62.110 1021
ai-devbox-1 vmi3177282.contaboserver.net 937
canary-farm-1 sso.rightabouteverything.show 918

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (54 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-11-06 46880 210
2026-11-05 20567 136
2026-11-04 2730 100
2026-11-03 4625 145
2026-11-02 2098 155
2026-11-01 1179 104
2026-10-31 1566 138
2026-10-30 1959 146
2026-10-29 2048 153
2026-10-28 5138 112
2026-10-27 4151 130
2026-10-26 892 102
2026-10-25 16293 114
2026-10-24 1369 152

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
control-1 194.180.49.41 94 / [tarpit-module] → / [tarpit] → /.env.prod [env-production] → /.env [issued] → /.env.dist [env-production] → /.env.save [env-production] → /.env.test [env-production] → /.env.bak [env-production] → /.env.development [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.example [env-production] MEVSPACE sp. z o.o. BG
canary-farm-1 176.123.8.213 63 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /1ukbyh6gp4oy4jc58jozlc7n4 [not-handled] → /.env [issued] → /..env [not-handled] → /.Env [issued] → /.ENV [issued] → /.aws/config [aws-config-file] → /.aws/credentials [aws-credentials-file] → /.aws/config.bak [not-handled] → /.aws/credentials.bak [aws-credentials-file] Alexhost S.r.l. MD
canary-farm-1 195.178.110.159 53 / [tarpit-module] → /.git/config [fake-git] → /.svn/wc.db [fake-svn] → /.env [issued] → / [tarpit-disconnect] → / [tarpit] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /.env.production [env-production] → /.env.backup [env-production] → /.env.old [env-production] → /.env.bak [env-production] Techoff Srv Limited BG
canary-farm-1 164.92.107.174 36 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
control-1 102.220.163.241 35 / [tarpit-module] → /pscan-7514d5be-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] VPS Dedicated LLC SI
ai-devbox-1 102.220.163.241 34 / [tarpit-module] → /pscan-65d0d642-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] VPS Dedicated LLC SI
canary-farm-1 152.89.244.89 31 /actuator/heapdump [actuator-heapdump-error] → /.env [tracebit-http-error] → /.env.prod [env-production-error] → /.env.production [env-production-error] → /.env.local [env-production-error] → /api/.env [env-production-error] → /app/.env [env-production-error] → /actuator/env [actuator-env-error] → /.git/config [fake-git-error] → /actuator/env [actuator-env] → /actuator/heapdump [actuator-heapdump] → /.env [issued] aurologic GmbH DE
canary-farm-1 209.38.208.202 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 167.99.210.137 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
canary-farm-1 64.226.65.160 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 167.99.210.137 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
ai-devbox-1 206.189.19.19 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
canary-farm-1 207.154.212.47 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
control-1 209.97.180.8 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
control-1 206.189.19.19 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 363 sources sent credentials → 244 got a shell (67%) → 187 ran a command (77% of shell-getters, 52% of sources)
  • event level: 15132 credential attempts → 3594 accepted logins → 10433 commands (290% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 551 attempts

New commands this window (0 of 4636 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
1925 4 109.160.32.180 "uname -s -v -n -r -m"
1923 3 109.160.32.180 "uname -m | awk '{printf $1}'"
475 122 103.248.120.6 "cd ~; chattr -ia .ssh; lockr -ia .ssh"
393 117 103.248.120.6 "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b
130 2 209.99.190.186 "nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'"
130 2 209.99.190.186 "/bin/./uname -s -v -n -r -m"
130 2 209.99.190.186 "nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c"
130 2 209.99.190.186 "lspci | grep "3D controller" | cut -f5- -d ' '"

Credentials: 8829 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:

attempts user password
282 rootssssss23424123123 rootssssss23424123123
215 root root3245gs5662d34111111111
161 345gs5662d34 345gs5662d34
122 root 3245gs5662d34
84 root 123456
72 pi raspberry
69 user wasd
40 support support

HoneyDB sensor (ch-sponge-01-ts — not a flux node)

HoneyDB sensor layer — ch-sponge-01-ts

Window since 2026-11-05T07:35Z. 3409 records, 1185 sessions, 376 source addresses; event kinds: CONNECT 1185, INFO 951, RX 690, TX 583.

HoneyDB parses each interaction into structured INFO events; the pcaps behind them are in Arkime under sensor:ch-sponge-01-ts. Records older than 30 days are not retrievable from the platform API.

service records sessions sources
Telnet 973 432 92
HTTP 949 260 84
LND 428 221 64
Electrum 427 73 49
Docker 173 52 33
BeaconAPI.web3signer 87 30 23
IPFS 80 26 20
XMRigAPI 72 22 15
EVMRPC 57 15 5
MoneroRPC.wallet 45 15 6
ClaymoreAPI 37 16 8
BitcoinRPC 27 5 2
BitcoinP2P 20 5 5
SolanaRPC 15 6 2
MoneroRPC 10 2 2
BeaconAPI.engine 9 5 5

Top sources

source records
195.178.110.159 176
207.154.212.224 119
35.210.216.67 75
35.210.98.27 75
35.210.91.33 75
207.180.198.196 75
195.178.110.78 65
35.210.178.252 57
35.206.138.137 57
139.135.59.177 50

INFO event classes

event_type records
rest_call 69
api_request 65
session_summary 33
client_fingerprint 29
rpc_call 19
miner_api_command 14
cve_attempt 13
crypto_lure_request 8
wallet_rpc_probe 7
peer_request 5
peer_version 3
rpc_auth_attempt 3

Lure paths requested

path/target records
/.env 2
/.env.local 2
/.env.production 2
/.env.bak 2

Credential-bearing events

service:event records
BitcoinRPC:rpc_auth_attempt 3

Sample high-value events

  • 11-05T22:53Z Docker dropper_indicators from 220.181.1.163
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.local
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.local
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.production
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.production
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.bak
  • 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.bak