flux fleet digest — 2026-08-29 14:53 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 4066 | 73 | 0 | 0 | n/a |
| ai-devbox-1 | 743 | 44 | 0 | 0 | n/a |
| control-1 | 2052 | 39 | 0 | 0 | n/a |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | env-production-error | 67 | 0.0 | infx |
| ai-devbox-1 | fake-git-error | 30 | 0.0 | infx |
| ai-devbox-1 | not-handled | 47 | 0.0 | infx |
| ai-devbox-1 | phpunit-eval-stdin | 75 | 0.0 | infx |
| ai-devbox-1 | tarpit | 28 | 0.0 | infx |
| ai-devbox-1 | tarpit-disconnect | 27 | 0.0 | infx |
| ai-devbox-1 | tarpit-module | 310 | 0.0 | infx |
| canary-farm-1 | app-config-php-error | 60 | 0.0 | infx |
| canary-farm-1 | app-config-yaml-error | 31 | 0.0 | infx |
| canary-farm-1 | aws-credentials-file-error | 37 | 0.0 | infx |
| canary-farm-1 | config-json-error | 34 | 0.0 | infx |
| canary-farm-1 | env-production-error | 507 | 0.0 | infx |
| canary-farm-1 | fake-git-error | 41 | 0.0 | infx |
| canary-farm-1 | fake-svn-error | 22 | 0.0 | infx |
| canary-farm-1 | firebase-json-error | 31 | 0.0 | infx |
| canary-farm-1 | not-handled | 849 | 0.0 | infx |
| canary-farm-1 | phpinfo-error | 23 | 0.0 | infx |
| canary-farm-1 | phpmyadmin-login | 29 | 0.0 | infx |
| canary-farm-1 | phpunit-eval-stdin | 76 | 0.0 | infx |
| canary-farm-1 | sftp-config-error | 25 | 0.0 | infx |
| canary-farm-1 | sql-dump-error | 34 | 0.0 | infx |
| canary-farm-1 | ssh-private-key-error | 60 | 0.0 | infx |
| canary-farm-1 | tarpit | 62 | 0.0 | infx |
| canary-farm-1 | tarpit-disconnect | 37 | 0.0 | infx |
| canary-farm-1 | tarpit-module | 1262 | 0.0 | infx |
| canary-farm-1 | terraform-tfstate-error | 21 | 0.0 | infx |
| canary-farm-1 | tracebit-http-error | 21 | 0.0 | infx |
| canary-farm-1 | webapp-form-login | 25 | 0.0 | infx |
| canary-farm-1 | wp-config-error | 20 | 0.0 | infx |
| control-1 | env-production-error | 118 | 0.0 | infx |
| control-1 | not-handled | 1512 | 0.0 | infx |
| control-1 | tarpit | 26 | 0.0 | infx |
| control-1 | tarpit-disconnect | 26 | 0.0 | infx |
| control-1 | tarpit-module | 233 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 | 28 | 196 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b | 3 | 147 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 9d8fdd025fdb | 3 | 12 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → /favicon.ico [tarpit-module] |
| cb229971b5a6 | 2 | 30 | canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → … |
| 850993125b15 | 2 | 82 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 | 2 | 82 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 1c8705e7b08f | 2 | 26 | canary-farm-1 | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] |
| 459d08b3a1e3 | 2 | 26 | canary-farm-1 | 08-29 | / [tarpit-module] → / [tarpit] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit] → /favicon.ico [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /open/ | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /.env.example | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /.env.sample | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /.env.swp | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /conf/.env | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /core/.env | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /dashboard/.env | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /configuration.json | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /settings.ini | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /swagger-ui.html | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /console | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /server-status | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /Pipfile | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /cert.pem | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /backup.sql | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /config.php | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /app_dev.php/_profiler/.env | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /.env.stage | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /prod/.env | 2026-08-29 09:42:40.361503-04:00 |
| canary-farm-1 | /demo/.env | 2026-08-29 09:42:40.361503-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-08-29 09:42:45.840092-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-29 09:42:45.840092-04:00 |
| control-1 | curl/7.81.0 | 2026-08-29 09:42:45.840092-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-29 09:42:45.840092-04:00 |
| control-1 | curl/7.74.0 | 2026-08-29 09:42:45.840092-04:00 |
| control-1 | Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.c | 2026-08-29 09:42:45.840092-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Geck | 2026-08-29 09:42:45.840092-04:00 |
| canary-farm-1 | curl/8.5.0 | 2026-08-29 09:42:45.840092-04:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/2010 | 2026-08-29 09:42:45.840092-04:00 |
| canary-farm-1 | Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, li | 2026-08-29 09:42:45.840092-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 213.209.159.175 | 1002 | 60 | 532 | 08-29 02:05 | 08-29 08:56 | ipsum:3 firehol2 | Feo Prest SRL | DE | 0 |
| control-1 | 204.76.203.18 | 926 | 3 | 462 | 08-28 23:38 | 08-29 10:31 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| canary-farm-1 | 35.245.230.215 | 693 | 130 | 533 | 08-29 07:37 | 08-29 07:38 | - | Google LLC | US | 12 |
| control-1 | 87.120.104.29 | 150 | 35 | 150 | 08-29 04:44 | 08-29 04:44 | - | Sino Worldwide Trading Limit | NO | 0 |
| canary-farm-1 | 80.94.95.211 | 131 | 15 | 130 | 08-28 23:47 | 08-28 23:47 | - | SS-Net | RO | 0 |
| canary-farm-1 | 193.29.204.107 | 93 | 3 | 1 | 08-29 10:55 | 08-29 10:58 | - | The State Cyber Protection C | UA | 0 |
| canary-farm-1 | 212.100.171.242 | 49 | 7 | 44 | 08-29 01:40 | 08-29 01:40 | - | OVH SAS | DE | 7 |
| ai-devbox-1 | 169.58.184.188 | 49 | 7 | 44 | 08-29 06:44 | 08-29 06:44 | - | Contabo GmbH | FR | 7 |
| ai-devbox-1 | 129.121.128.70 | 49 | 7 | 44 | 08-29 08:04 | 08-29 08:04 | - | Oracle Corporation | US | 7 |
| canary-farm-1 | 216.57.110.81 | 46 | 7 | 43 | 08-29 01:23 | 08-29 01:23 | ipsum:3 firehol2 | Timeweb, LLP | NL | 4 |
| ai-devbox-1 | 167.71.175.236 | 41 | 27 | 36 | 08-29 10:58 | 08-29 10:58 | ipsum:2 firehol2 | DigitalOcean, LLC | US | 3 |
| ai-devbox-1 | 165.22.34.189 | 41 | 27 | 36 | 08-29 10:58 | 08-29 10:58 | ipsum:2 firehol2 | DigitalOcean, LLC | US | 3 |
| canary-farm-1 | 157.245.113.227 | 41 | 27 | 36 | 08-29 10:55 | 08-29 10:55 | ipsum:1 | DigitalOcean, LLC | US | 3 |
| canary-farm-1 | 46.101.111.185 | 41 | 27 | 36 | 08-29 10:55 | 08-29 10:55 | ipsum:1 | DigitalOcean, LLC | DE | 3 |
| canary-farm-1 | 151.241.171.72 | 28 | 3 | 1 | 08-29 10:57 | 08-29 10:57 | - | 31173 Services AB | DE | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| canary-farm-1 | 2 | 2 |
| ai-devbox-1 | 4 | 4 |
| control-1 | 0 | 0 |
Mint failures (24h): ai-devbox-1:401x4; canary-farm-1:401x21; control-1:401x5
Mints by type label:
| sensor | types | mints |
|---|---|---|
| canary-farm-1 | ["aws","ssh","http"] | 2 |
| ai-devbox-1 | ["aws"] | 4 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 349
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 630 |
| ai-devbox-1 | https | 113 |
| canary-farm-1 | http | 3831 |
| canary-farm-1 | https | 235 |
| control-1 | http | 2052 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| canary-farm-1 | 109.123.246.142 | 3708 |
| control-1 | 38.54.2.209 | 2031 |
| ai-devbox-1 | 217.15.163.226 | 537 |
| canary-farm-1 | sso.rightabouteverything.show | 337 |
| ai-devbox-1 | inference.fapthropic.com | 165 |
| ai-devbox-1 | vmi3177282.contaboserver.net | 12 |
| control-1 | azenv.net | 9 |
| ai-devbox-1 | 2407:3640:2317:7282::1 | 9 |
| ai-devbox-1 | 127.0.0.1 | 8 |
| canary-farm-1 | 2a02:c207:2324:3483::1 | 7 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (0 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 35.245.230.215 | 130 | / [tarpit-module] → /aws_leak_probe_be0a8577 [not-handled] → /.env [tracebit-http-error] → /api/config [app-config-json-error] → /.mcp.json [mcp-config-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.aws/credentials [aws-credentials-file-error] → /etc/passwd [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ-error] → /@vite/env [vite-env-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] | Google LLC | US |
| canary-farm-1 | 213.209.159.175 | 60 | / [tarpit-module] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.development [env-production-error] → /.env.dev [env-production-error] → /.env.staging [env-production-error] → /.env.test [env-production-error] → /.env.example [env-production-error] → /.env.backup [env-production-error] → /.envrc [tarpit-module] → /.aws/config [aws-config-file-error] | Feo Prest SRL | DE |
| control-1 | 87.120.104.29 | 35 | /src/.env [env-production-error] → /html/.env [env-production-error] → /.env.default [env-production-error] → /.env.json [env-production-error] → /wp-config.php.orig [wp-config-error] → /conf/.env [env-production-error] → /.env.bak~ [env-production-error] → /info.php [phpinfo-error] → /client/.env.local [env-production-error] → /.env.dist [env-production-error] → /.git/index [fake-git-error] → /.env.yaml [env-production-error] | Sino Worldwide Trading Limit | NO |
| canary-farm-1 | 46.101.111.185 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 165.22.34.189 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 157.245.113.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 80.94.95.211 | 15 | / [tarpit-module] → /.env [tracebit-http-error] → /api/.env [env-production-error] → /backend/.env [env-production-error] → /phpinfo.php [phpinfo-error] → /admin/.env [env-production-error] → /phpinfo/ [not-handled] → /laravel/.env [env-production-error] → /core/.env [env-production-error] → /test [not-handled] → /.env.example [env-production-error] → /app/.env [env-production-error] | SS-Net | RO |
| control-1 | 34.71.101.121 | 8 | /_ignition/health-check [laravel-ignition-error] → /.env.save [env-production-error] → /.env.prod [env-production-error] → /.env.backup [env-production-error] → /storage/logs/laravel.log [laravel-log-error] → /.env.local [env-production-error] → /.env.example [env-production-error] → /.env.old [env-production-error] → /actuator/configprops [actuator-configprops-error] → /env [actuator-env-error] → /crusader-404-probe [not-handled] → /actuator/env [actuator-env-error] | Google LLC | US |
| ai-devbox-1 | 169.58.184.188 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /test.hello [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | Contabo GmbH | FR |
| canary-farm-1 | 216.57.110.81 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | Timeweb, LLP | NL |
| ai-devbox-1 | 129.121.128.70 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /test.hello [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | Oracle Corporation | US |
| canary-farm-1 | 212.100.171.242 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /test.hello [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | OVH SAS | DE |
| canary-farm-1 | 66.132.195.62 | 5 | / [tarpit-module] → /login [webapp-form-login] → /favicon.ico [tarpit-module] → /favicon.ico [tarpit] → /favicon.ico [tarpit-disconnect] → /rztyew_pfgixdcnc [not-handled] | Censys, Inc. | US |
| control-1 | 43.157.180.116 | 3 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] | Tencent Building, Kejizhongy | BR |