flux fleet digest — 2026-08-31 09:55 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 2095 | 167 | 3780 | 163 | -45% |
| ai-devbox-1 | 9282 | 101 | 3146 | 228 | +195% |
| control-1 | 24100 | 88 | 2619 | 54 | +820% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | webapp-config-bundle-js | 60 | 10.0 | 6.0x |
| ai-devbox-1 | wp-xmlrpc-post | 8146 | 0.0 | infx |
| canary-farm-1 | env-production | 68 | 0.0 | infx |
| canary-farm-1 | tomcat-path-bypass-env | 30 | 10.0 | 3.0x |
| canary-farm-1 | webapp-config-bundle-js | 122 | 40.0 | 3.0x |
| control-1 | app-config-json | 20 | 1.0 | 20.0x |
| control-1 | app-config-php | 31 | 7.0 | 4.4x |
| control-1 | app-config-yaml | 50 | 2.0 | 25.0x |
| control-1 | aws-credentials-file | 33 | 4.0 | 8.2x |
| control-1 | aws-credentials-json | 22 | 0.0 | infx |
| control-1 | backup-archive | 22 | 0.0 | infx |
| control-1 | config-json | 24 | 1.0 | 24.0x |
| control-1 | env-production | 331 | 82.0 | 4.0x |
| control-1 | fake-git | 33 | 8.0 | 4.1x |
| control-1 | fake-git-miss | 47 | 0.0 | infx |
| control-1 | not-handled | 20002 | 1961.0 | 10.2x |
| control-1 | phpinfo | 1825 | 2.0 | 912.5x |
| control-1 | sftp-config-error | 35 | 2.0 | 17.5x |
| control-1 | symfony-profiler-phpinfo | 30 | 0.0 | infx |
| control-1 | webapp-config-bundle-js | 34 | 1.0 | 34.0x |
| control-1 | webshell-probe | 104 | 3.0 | 34.7x |
| control-1 | yii2-debug-view | 22 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 39 | 273 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ | 7 | 343 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ | 5 | 36 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7ea1125e0232 ⟳ | 2 | 29 | ai-devbox-1 | 08-30 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| b9b9f8febd33 | 2 | 15 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 08-31 | / [tarpit-module] → /login [webapp-form-login] → / [tarpit-module] → /login [webapp-form-login] → / [tarpit-module] → /login [webapp-form-login] |
| 9d8fdd025fdb ⟳ | 2 | 14 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → /favicon.ico [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| ai-devbox-1 | /..;/env.production.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /..;/env.prod.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /main.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /debug/render_panel/ | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /web/api/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /api/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /..;/env.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /wp-json/batch/v1 | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /env.prod.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /..;/env.dev.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /src/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /..;/env.development.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /public/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /public/js/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /env.dev.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /login/ | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /config/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /src/api/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /static/js/config.js | 2026-08-31 05:56:06.602675-04:00 |
| ai-devbox-1 | /env.production.js | 2026-08-31 05:56:06.602675-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64) | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (compatible) | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20 | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-08-31 05:56:08.816362-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Fir | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Geck | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/2010 | 2026-08-31 05:56:08.816362-04:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/2010 | 2026-08-31 05:56:08.816362-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; rv:105.0) Gecko/20100101 Firef | 2026-08-31 05:56:08.816362-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 169.150.201.29 | 12707 | 5 | 12707 | 08-31 05:18 | 08-31 05:19 | ipsum:1 | Datacamp Limited | DE | 0 |
| control-1 | 45.148.10.183 | 8300 | 88 | 8262 | 08-31 01:27 | 08-31 01:47 | ipsum:2 firehol2 | Techoff Srv Limited | NL | 0 |
| ai-devbox-1 | 34.63.40.186 | 8153 | 5 | 5 | 08-30 14:12 | 08-30 14:43 | - | Google LLC | US | 8146 |
| control-1 | 204.76.203.18 | 1994 | 3 | 566 | 08-30 05:56 | 08-31 09:51 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| control-1 | 35.247.178.64 | 723 | 130 | 533 | 08-30 11:55 | 08-30 11:55 | - | Google LLC | SG | 12 |
| canary-farm-1 | 34.92.76.191 | 283 | 17 | 272 | 08-30 06:49 | 08-30 06:50 | - | Google LLC | HK | 4 |
| ai-devbox-1 | 81.172.241.94 | 242 | 15 | 38 | 08-31 07:26 | 08-31 08:11 | - | DELTA Fiber Nederland B.V. | NL | 27 |
| canary-farm-1 | 185.165.242.182 | 202 | 22 | 55 | 08-31 02:06 | 08-31 02:13 | - | WorldStream B.V. | NL | 20 |
| canary-farm-1 | 80.94.95.211 | 168 | 15 | 167 | 08-31 03:45 | 08-31 03:45 | - | SS-Net | RO | 0 |
| ai-devbox-1 | 80.94.95.211 | 160 | 15 | 157 | 08-30 21:31 | 08-30 21:31 | - | SS-Net | RO | 0 |
| canary-farm-1 | 43.225.189.141 | 142 | 19 | 42 | 08-30 17:19 | 08-30 17:22 | - | HostRoyale Technologies Pvt | US | 14 |
| canary-farm-1 | 31.59.160.30 | 118 | 8 | 12 | 08-31 00:28 | 08-31 00:29 | - | Miteflux Technologies Ltd | AE | 78 |
| ai-devbox-1 | 47.84.110.109 | 112 | 3 | 4 | 08-30 23:23 | 08-30 23:24 | - | Alibaba (US) Technology Co., | SG | 0 |
| canary-farm-1 | 105.138.220.253 | 74 | 15 | 38 | 08-31 07:11 | 08-31 07:15 | - | Office National des Postes e | MA | 9 |
| canary-farm-1 | 81.172.241.94 | 74 | 15 | 38 | 08-31 07:17 | 08-31 07:20 | - | DELTA Fiber Nederland B.V. | NL | 9 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 19 | 4 |
| canary-farm-1 | 15 | 13 |
| ai-devbox-1 | 11 | 9 |
Mint failures (24h): none
Mints by type label:
| sensor | types | mints |
|---|---|---|
| canary-farm-1 | ["ssh","http"] | 2 |
| canary-farm-1 | ["aws","ssh","http"] | 13 |
| control-1 | ["aws"] | 19 |
| ai-devbox-1 | ["aws"] | 11 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 808
- multi-entry XFF (forged chains — no proxy appends on the direct path): 1
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 9043 |
| ai-devbox-1 | https | 239 |
| canary-farm-1 | http | 1660 |
| canary-farm-1 | https | 435 |
| control-1 | http | 24100 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 24090 |
| ai-devbox-1 | inference.fapthropic.com | 8576 |
| canary-farm-1 | 109.123.246.142 | 1279 |
| canary-farm-1 | sso.rightabouteverything.show | 807 |
| ai-devbox-1 | 217.15.163.226 | 584 |
| ai-devbox-1 | vmi3177282.contaboserver.net | 112 |
| canary-farm-1 | 127.0.0.1 | 4 |
| ai-devbox-1 | 127.0.0.1 | 3 |
| canary-farm-1 | 192.0.2.1 | 2 |
| ai-devbox-1 | 217.015.163.226 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (2 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| control-1 | 35.247.178.64 | 130 | / [tarpit-module] → /aws_leak_probe_8e65e1a4 [not-handled] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /download [not-handled] → /api/config [app-config-json] → /actuator/env [actuator-env] → /etc/passwd [not-handled] → /@fs/proc/1/environ [vite-fs-proc-environ] → /@fs/etc/passwd [vite-fs-etc-passwd] | Google LLC | SG |
| control-1 | 45.148.10.183 | 88 | /settings.php.save [app-config-php] → /developer/crm/info.php [phpinfo] → /api/env.tar.gz [not-handled] → /admin/docker-compose.key [not-handled] → /cache/error_log.save [not-handled] → /dev/lara/phpinfo.php [phpinfo] → /sinatra.log.old.old [not-handled] → /mailer/phpversion.php [phpinfo] → /tmp/debug.inc.save [not-handled] → /.github/workflows/deploy.yml [github-actions-workflow] → /config/mailjet_config.json [not-handled] → /login [webapp-form-login] | Techoff Srv Limited | NL |
| canary-farm-1 | 143.110.213.72 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 207.154.212.47 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 143.244.168.161 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 143.110.217.244 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 159.223.132.86 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 157.230.19.140 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 157.245.113.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 64.227.32.66 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 185.165.242.182 | 22 | / [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] | WorldStream B.V. | NL |
| canary-farm-1 | 43.225.189.141 | 19 | / [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] | HostRoyale Technologies Pvt | US |
| canary-farm-1 | 34.92.76.191 | 17 | / [tarpit-module] → /.git/config [fake-git] → /.env [issued] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.staging [env-production-error] → /.env.development [env-production-error] → /.env.test [env-production-error] → /.env.remote [env-production-error] → /.env.bak [env-production-error] → /.env.backup [env-production-error] → /.env.save [env-production-error] | Google LLC | HK |
| canary-farm-1 | 81.172.241.94 | 15 | / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] | DELTA Fiber Nederland B.V. | NL |
| canary-farm-1 | 105.138.220.253 | 15 | / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] | Office National des Postes e | MA |