flux fleet digest — 2026-08-30 10:40 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
canary-farm-1 3495 253 4066 73 -14%
ai-devbox-1 5549 413 743 44 +647%
control-1 3186 70 2052 39 +55%

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 actuator-configprops 38 0.0 infx
ai-devbox-1 actuator-configprops-error 137 1.0 137.0x
ai-devbox-1 actuator-env 83 2.0 41.5x
ai-devbox-1 actuator-env-error 274 4.0 68.5x
ai-devbox-1 aws-credentials-file 28 0.0 infx
ai-devbox-1 backup-archive-error 25 0.0 infx
ai-devbox-1 docker-registry-manifest 30 10.0 3.0x
ai-devbox-1 docker-registry-tags 30 10.0 3.0x
ai-devbox-1 env-production 417 0.0 infx
ai-devbox-1 env-production-error 1280 67.0 19.1x
ai-devbox-1 issued 58 4.0 14.5x
ai-devbox-1 laravel-ignition 38 0.0 infx
ai-devbox-1 laravel-ignition-error 138 1.0 138.0x
ai-devbox-1 laravel-log 38 0.0 infx
ai-devbox-1 laravel-log-error 136 1.0 136.0x
ai-devbox-1 not-handled 393 47.0 8.4x
ai-devbox-1 ssh-private-key 21 0.0 infx
ai-devbox-1 tarpit 95 28.0 3.4x
ai-devbox-1 tarpit-disconnect 93 27.0 3.4x
ai-devbox-1 tracebit-http-error 144 4.0 36.0x
ai-devbox-1 wp-config 115 0.0 infx
ai-devbox-1 wp-config-error 420 5.0 84.0x
canary-farm-1 backup-archive-error 20 0.0 infx
canary-farm-1 docker-registry-manifest 30 10.0 3.0x
canary-farm-1 docker-registry-tags 30 10.0 3.0x
canary-farm-1 webapp-config-bundle-js 40 0.0 infx
canary-farm-1 wp-batch-rejected 316 0.0 infx
control-1 env-production 82 0.0 infx
control-1 phpunit-eval-stdin 64 0.0 infx

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 56 398 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 20 140 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
9d8fdd025fdb ⟳ 7 34 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → /favicon.ico [tarpit-module]
850993125b15 ⟳ 6 246 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
b07c7bb207b4 ⟳ 6 246 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
7e61a9500d8b ⟳ 5 245 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
39c2762acf51 4 208 canary-farm-1 08-30 / [wp-batch-rejected] → /index.php [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → /wp-json/Batch/v1 [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] →
1c8705e7b08f ⟳ 3 39 canary-farm-1 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit]

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
canary-farm-1 /api/dev/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /store/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /smtp/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /notifications/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /bulk/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /hosting/phpinfo.php 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /wp-admin/phpinfo.php 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /microservice/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /bin/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /vite/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /uat/phpinfo.php 2026-08-30 06:40:49.890661-04:00
ai-devbox-1 /wiki 2026-08-30 06:40:49.890661-04:00
control-1 /armv7l 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /releases/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /user-panel/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /cd/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /buildkite/.env 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /phpinfo.php.old 2026-08-30 06:40:49.890661-04:00
canary-farm-1 /core/phpinfo.php 2026-08-30 06:40:49.890661-04:00
control-1 /lmips 2026-08-30 06:40:49.890661-04:00

New user agents:

sensor user agent first seen
ai-devbox-1 Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/201 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firef 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firef 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Fir 2026-08-30 06:40:51.210546-04:00
ai-devbox-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-08-30 06:40:51.210546-04:00
ai-devbox-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 2026-08-30 06:40:51.210546-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-08-30 06:40:51.210546-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
control-1 204.76.203.18 2173 3 562 08-29 06:41 08-30 10:40 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
ai-devbox-1 136.110.80.233 723 130 533 08-29 14:58 08-29 14:58 - Google LLC JP 12
canary-farm-1 35.245.230.215 693 130 533 08-29 07:37 08-29 07:38 - Google LLC US 12
control-1 93.152.223.194 365 71 358 08-29 14:11 08-29 14:11 - RMP Protection Limited BG 0
ai-devbox-1 34.166.182.179 353 65 198 08-30 02:21 08-30 03:58 - Google LLC SA 10
canary-farm-1 213.209.159.175 334 60 333 08-29 08:56 08-29 08:56 ipsum:3 firehol2 Feo Prest SRL DE 0
canary-farm-1 34.92.76.191 283 17 272 08-30 06:49 08-30 06:50 - Google LLC HK 4
canary-farm-1 34.50.64.250 226 65 192 08-30 05:13 08-30 05:16 - Google LLC ID 5
canary-farm-1 127.0.0.1 220 1 7 08-30 01:17 08-30 09:04 - 220
control-1 172.232.253.221 204 24 158 08-29 15:31 08-29 15:31 ipsum:1 Akamai Connected Cloud ID 1
canary-farm-1 41.251.202.89 148 15 38 08-29 20:54 08-29 20:59 - Office National des Postes e MA 18
canary-farm-1 193.29.204.107 113 3 1 08-29 10:55 08-29 12:10 - The State Cyber Protection C UA 0
control-1 45.148.10.238 60 5 18 08-29 22:37 08-29 22:41 ipsum:3 firehol2 Techoff Srv Limited NL 14
ai-devbox-1 34.28.244.5 57 15 19 08-30 00:24 08-30 03:11 - Google LLC US 0
canary-farm-1 93.123.109.163 52 8 12 08-30 01:17 08-30 01:18 - Techoff Srv Limited BG 12

Canary economics (24h)

sensor mints distinct minting IPs
control-1 7 3
canary-farm-1 12 11
ai-devbox-1 58 44

Mint failures (24h): canary-farm-1:401x11; ai-devbox-1:401x1; ai-devbox-1:400x143; control-1:400x1

Mints by type label:

sensor types mints
ai-devbox-1 ["aws"] 58
control-1 ["aws"] 7
canary-farm-1 ["aws","ssh","http"] 9
canary-farm-1 ["ssh","http"] 3

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 2101
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 4756
ai-devbox-1 https 793
canary-farm-1 http 2464
canary-farm-1 https 1031
control-1 http 3185
control-1 https 1

Top Host headers:

sensor host events
ai-devbox-1 vmi3177282.contaboserver.net 3268
control-1 38.54.2.209 3167
canary-farm-1 109.123.246.142 2059
canary-farm-1 sso.rightabouteverything.show 1430
ai-devbox-1 217.15.163.226 1177
ai-devbox-1 inference.fapthropic.com 1090
ai-devbox-1 127.0.0.1 5
ai-devbox-1 localhost 2
control-1 038.054.002.209 2
control-1 localhost 2

Control node discovery velocity

  • first event ever: 2026-08-28 11:22 UTC (1 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-08-30 3186 70
2026-08-29 2052 39

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 35.245.230.215 130 / [tarpit-module] → /aws_leak_probe_be0a8577 [not-handled] → /.env [tracebit-http-error] → /api/config [app-config-json-error] → /.mcp.json [mcp-config-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.aws/credentials [aws-credentials-file-error] → /etc/passwd [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ-error] → /@vite/env [vite-env-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] Google LLC US
ai-devbox-1 136.110.80.233 130 / [tarpit-module] → /aws_leak_probe_18788900 [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/proc/1/environ [vite-fs-proc-environ] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.git/HEAD [fake-git] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /aws/credentials [aws-credentials-file] Google LLC JP
control-1 93.152.223.194 71 /.circleci/config.yml [generic-ci-config] → /.htaccess [not-handled] → /.git/HEAD [fake-git] → /.ssh/id_dsa [ssh-private-key] → /settings.php [app-config-php] → /config.py [app-config-python] → /config/app.php [app-config-php-services] → /.git/index [fake-git] → /.git/config [fake-git] → /wp-config.php.old [wp-config] → /wp-config.php.bak [wp-config] → /wp-config.php [wp-config] RMP Protection Limited BG
ai-devbox-1 34.166.182.179 65 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.git/config [fake-git-error] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.save [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] Google LLC SA
canary-farm-1 34.50.64.250 65 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /.env [issued] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.save [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] Google LLC ID
canary-farm-1 213.209.159.175 60 / [tarpit-module] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.development [env-production-error] → /.env.dev [env-production-error] → /.env.staging [env-production-error] → /.env.test [env-production-error] → /.env.example [env-production-error] → /.env.backup [env-production-error] → /.envrc [tarpit-module] → /.aws/config [aws-config-file-error] Feo Prest SRL DE
canary-farm-1 206.189.19.19 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
canary-farm-1 159.89.127.165 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 165.22.34.189 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
ai-devbox-1 142.93.129.190 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
ai-devbox-1 157.245.113.227 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 178.128.207.138 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 167.71.175.236 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 157.245.113.227 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 64.225.75.246 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL