flux fleet digest — 2026-08-30 10:40 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 3495 | 253 | 4066 | 73 | -14% |
| ai-devbox-1 | 5549 | 413 | 743 | 44 | +647% |
| control-1 | 3186 | 70 | 2052 | 39 | +55% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | actuator-configprops | 38 | 0.0 | infx |
| ai-devbox-1 | actuator-configprops-error | 137 | 1.0 | 137.0x |
| ai-devbox-1 | actuator-env | 83 | 2.0 | 41.5x |
| ai-devbox-1 | actuator-env-error | 274 | 4.0 | 68.5x |
| ai-devbox-1 | aws-credentials-file | 28 | 0.0 | infx |
| ai-devbox-1 | backup-archive-error | 25 | 0.0 | infx |
| ai-devbox-1 | docker-registry-manifest | 30 | 10.0 | 3.0x |
| ai-devbox-1 | docker-registry-tags | 30 | 10.0 | 3.0x |
| ai-devbox-1 | env-production | 417 | 0.0 | infx |
| ai-devbox-1 | env-production-error | 1280 | 67.0 | 19.1x |
| ai-devbox-1 | issued | 58 | 4.0 | 14.5x |
| ai-devbox-1 | laravel-ignition | 38 | 0.0 | infx |
| ai-devbox-1 | laravel-ignition-error | 138 | 1.0 | 138.0x |
| ai-devbox-1 | laravel-log | 38 | 0.0 | infx |
| ai-devbox-1 | laravel-log-error | 136 | 1.0 | 136.0x |
| ai-devbox-1 | not-handled | 393 | 47.0 | 8.4x |
| ai-devbox-1 | ssh-private-key | 21 | 0.0 | infx |
| ai-devbox-1 | tarpit | 95 | 28.0 | 3.4x |
| ai-devbox-1 | tarpit-disconnect | 93 | 27.0 | 3.4x |
| ai-devbox-1 | tracebit-http-error | 144 | 4.0 | 36.0x |
| ai-devbox-1 | wp-config | 115 | 0.0 | infx |
| ai-devbox-1 | wp-config-error | 420 | 5.0 | 84.0x |
| canary-farm-1 | backup-archive-error | 20 | 0.0 | infx |
| canary-farm-1 | docker-registry-manifest | 30 | 10.0 | 3.0x |
| canary-farm-1 | docker-registry-tags | 30 | 10.0 | 3.0x |
| canary-farm-1 | webapp-config-bundle-js | 40 | 0.0 | infx |
| canary-farm-1 | wp-batch-rejected | 316 | 0.0 | infx |
| control-1 | env-production | 82 | 0.0 | infx |
| control-1 | phpunit-eval-stdin | 64 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 56 | 398 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 | 20 | 140 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 9d8fdd025fdb ⟳ | 7 | 34 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → /favicon.ico [tarpit-module] |
| 850993125b15 ⟳ | 6 | 246 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 6 | 246 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ | 5 | 245 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 39c2762acf51 | 4 | 208 | canary-farm-1 | 08-30 | / [wp-batch-rejected] → /index.php [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → /wp-json/Batch/v1 [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → |
| 1c8705e7b08f ⟳ | 3 | 39 | canary-farm-1 | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /api/dev/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /store/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /smtp/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /notifications/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /bulk/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /hosting/phpinfo.php | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /wp-admin/phpinfo.php | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /microservice/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /bin/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /vite/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /uat/phpinfo.php | 2026-08-30 06:40:49.890661-04:00 |
| ai-devbox-1 | /wiki | 2026-08-30 06:40:49.890661-04:00 |
| control-1 | /armv7l | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /releases/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /user-panel/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /cd/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /buildkite/.env | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /phpinfo.php.old | 2026-08-30 06:40:49.890661-04:00 |
| canary-farm-1 | /core/phpinfo.php | 2026-08-30 06:40:49.890661-04:00 |
| control-1 | /lmips | 2026-08-30 06:40:49.890661-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/201 | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firef | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firef | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Fir | 2026-08-30 06:40:51.210546-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-30 06:40:51.210546-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 | 2026-08-30 06:40:51.210546-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-30 06:40:51.210546-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 204.76.203.18 | 2173 | 3 | 562 | 08-29 06:41 | 08-30 10:40 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| ai-devbox-1 | 136.110.80.233 | 723 | 130 | 533 | 08-29 14:58 | 08-29 14:58 | - | Google LLC | JP | 12 |
| canary-farm-1 | 35.245.230.215 | 693 | 130 | 533 | 08-29 07:37 | 08-29 07:38 | - | Google LLC | US | 12 |
| control-1 | 93.152.223.194 | 365 | 71 | 358 | 08-29 14:11 | 08-29 14:11 | - | RMP Protection Limited | BG | 0 |
| ai-devbox-1 | 34.166.182.179 | 353 | 65 | 198 | 08-30 02:21 | 08-30 03:58 | - | Google LLC | SA | 10 |
| canary-farm-1 | 213.209.159.175 | 334 | 60 | 333 | 08-29 08:56 | 08-29 08:56 | ipsum:3 firehol2 | Feo Prest SRL | DE | 0 |
| canary-farm-1 | 34.92.76.191 | 283 | 17 | 272 | 08-30 06:49 | 08-30 06:50 | - | Google LLC | HK | 4 |
| canary-farm-1 | 34.50.64.250 | 226 | 65 | 192 | 08-30 05:13 | 08-30 05:16 | - | Google LLC | ID | 5 |
| canary-farm-1 | 127.0.0.1 | 220 | 1 | 7 | 08-30 01:17 | 08-30 09:04 | - | 220 | ||
| control-1 | 172.232.253.221 | 204 | 24 | 158 | 08-29 15:31 | 08-29 15:31 | ipsum:1 | Akamai Connected Cloud | ID | 1 |
| canary-farm-1 | 41.251.202.89 | 148 | 15 | 38 | 08-29 20:54 | 08-29 20:59 | - | Office National des Postes e | MA | 18 |
| canary-farm-1 | 193.29.204.107 | 113 | 3 | 1 | 08-29 10:55 | 08-29 12:10 | - | The State Cyber Protection C | UA | 0 |
| control-1 | 45.148.10.238 | 60 | 5 | 18 | 08-29 22:37 | 08-29 22:41 | ipsum:3 firehol2 | Techoff Srv Limited | NL | 14 |
| ai-devbox-1 | 34.28.244.5 | 57 | 15 | 19 | 08-30 00:24 | 08-30 03:11 | - | Google LLC | US | 0 |
| canary-farm-1 | 93.123.109.163 | 52 | 8 | 12 | 08-30 01:17 | 08-30 01:18 | - | Techoff Srv Limited | BG | 12 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 7 | 3 |
| canary-farm-1 | 12 | 11 |
| ai-devbox-1 | 58 | 44 |
Mint failures (24h): canary-farm-1:401x11; ai-devbox-1:401x1; ai-devbox-1:400x143; control-1:400x1
Mints by type label:
| sensor | types | mints |
|---|---|---|
| ai-devbox-1 | ["aws"] | 58 |
| control-1 | ["aws"] | 7 |
| canary-farm-1 | ["aws","ssh","http"] | 9 |
| canary-farm-1 | ["ssh","http"] | 3 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2101
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 4756 |
| ai-devbox-1 | https | 793 |
| canary-farm-1 | http | 2464 |
| canary-farm-1 | https | 1031 |
| control-1 | http | 3185 |
| control-1 | https | 1 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| ai-devbox-1 | vmi3177282.contaboserver.net | 3268 |
| control-1 | 38.54.2.209 | 3167 |
| canary-farm-1 | 109.123.246.142 | 2059 |
| canary-farm-1 | sso.rightabouteverything.show | 1430 |
| ai-devbox-1 | 217.15.163.226 | 1177 |
| ai-devbox-1 | inference.fapthropic.com | 1090 |
| ai-devbox-1 | 127.0.0.1 | 5 |
| ai-devbox-1 | localhost | 2 |
| control-1 | 038.054.002.209 | 2 |
| control-1 | localhost | 2 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (1 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 35.245.230.215 | 130 | / [tarpit-module] → /aws_leak_probe_be0a8577 [not-handled] → /.env [tracebit-http-error] → /api/config [app-config-json-error] → /.mcp.json [mcp-config-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.aws/credentials [aws-credentials-file-error] → /etc/passwd [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ-error] → /@vite/env [vite-env-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] | Google LLC | US |
| ai-devbox-1 | 136.110.80.233 | 130 | / [tarpit-module] → /aws_leak_probe_18788900 [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/proc/1/environ [vite-fs-proc-environ] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.git/HEAD [fake-git] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /aws/credentials [aws-credentials-file] | Google LLC | JP |
| control-1 | 93.152.223.194 | 71 | /.circleci/config.yml [generic-ci-config] → /.htaccess [not-handled] → /.git/HEAD [fake-git] → /.ssh/id_dsa [ssh-private-key] → /settings.php [app-config-php] → /config.py [app-config-python] → /config/app.php [app-config-php-services] → /.git/index [fake-git] → /.git/config [fake-git] → /wp-config.php.old [wp-config] → /wp-config.php.bak [wp-config] → /wp-config.php [wp-config] | RMP Protection Limited | BG |
| ai-devbox-1 | 34.166.182.179 | 65 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.git/config [fake-git-error] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.save [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] | Google LLC | SA |
| canary-farm-1 | 34.50.64.250 | 65 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /.env [issued] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.backup [env-production-error] → /.env.old [env-production-error] → /.env.save [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] | Google LLC | ID |
| canary-farm-1 | 213.209.159.175 | 60 | / [tarpit-module] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.development [env-production-error] → /.env.dev [env-production-error] → /.env.staging [env-production-error] → /.env.test [env-production-error] → /.env.example [env-production-error] → /.env.backup [env-production-error] → /.envrc [tarpit-module] → /.aws/config [aws-config-file-error] | Feo Prest SRL | DE |
| canary-farm-1 | 206.189.19.19 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 159.89.127.165 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 165.22.34.189 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 157.245.113.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 178.128.207.138 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 157.245.113.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 64.225.75.246 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |