flux fleet digest — 2026-08-31 09:55 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
canary-farm-1 2095 167 3780 163 -45%
ai-devbox-1 9282 101 3146 228 +195%
control-1 24100 88 2619 54 +820%

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 webapp-config-bundle-js 60 10.0 6.0x
ai-devbox-1 wp-xmlrpc-post 8146 0.0 infx
canary-farm-1 env-production 68 0.0 infx
canary-farm-1 tomcat-path-bypass-env 30 10.0 3.0x
canary-farm-1 webapp-config-bundle-js 122 40.0 3.0x
control-1 app-config-json 20 1.0 20.0x
control-1 app-config-php 31 7.0 4.4x
control-1 app-config-yaml 50 2.0 25.0x
control-1 aws-credentials-file 33 4.0 8.2x
control-1 aws-credentials-json 22 0.0 infx
control-1 backup-archive 22 0.0 infx
control-1 config-json 24 1.0 24.0x
control-1 env-production 331 82.0 4.0x
control-1 fake-git 33 8.0 4.1x
control-1 fake-git-miss 47 0.0 infx
control-1 not-handled 20002 1961.0 10.2x
control-1 phpinfo 1825 2.0 912.5x
control-1 sftp-config-error 35 2.0 17.5x
control-1 symfony-profiler-phpinfo 30 0.0 infx
control-1 webapp-config-bundle-js 34 1.0 34.0x
control-1 webshell-probe 104 3.0 34.7x
control-1 yii2-debug-view 22 0.0 infx

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 39 273 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
7e61a9500d8b ⟳ 7 343 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
4b4cc0ece037 ⟳ 5 36 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
b07c7bb207b4 ⟳ 4 164 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
850993125b15 ⟳ 4 164 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
7ea1125e0232 ⟳ 2 29 ai-devbox-1 08-30 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
b9b9f8febd33 2 15 ai-devbox-1,control-1 ⚠FLEET-WIDE 08-31 / [tarpit-module] → /login [webapp-form-login] → / [tarpit-module] → /login [webapp-form-login] → / [tarpit-module] → /login [webapp-form-login]
9d8fdd025fdb ⟳ 2 14 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → /favicon.ico [tarpit-module] → / [tarpit-module] → /favicon.ico [tarpit-module]

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
ai-devbox-1 /..;/env.production.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /..;/env.prod.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /main.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /debug/render_panel/ 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /web/api/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /api/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /..;/env.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /wp-json/batch/v1 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /env.prod.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /..;/env.dev.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /src/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /..;/env.development.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /public/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /public/js/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /env.dev.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /login/ 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /config/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /src/api/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /static/js/config.js 2026-08-31 05:56:06.602675-04:00
ai-devbox-1 /env.production.js 2026-08-31 05:56:06.602675-04:00

New user agents:

sensor user agent first seen
ai-devbox-1 Mozilla/5.0 (X11; Linux x86_64) 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (compatible) 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-08-31 05:56:08.816362-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Fir 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Geck 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/2010 2026-08-31 05:56:08.816362-04:00
canary-farm-1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/2010 2026-08-31 05:56:08.816362-04:00
ai-devbox-1 Mozilla/5.0 (Windows NT 10.0; rv:105.0) Gecko/20100101 Firef 2026-08-31 05:56:08.816362-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
control-1 169.150.201.29 12707 5 12707 08-31 05:18 08-31 05:19 ipsum:1 Datacamp Limited DE 0
control-1 45.148.10.183 8300 88 8262 08-31 01:27 08-31 01:47 ipsum:2 firehol2 Techoff Srv Limited NL 0
ai-devbox-1 34.63.40.186 8153 5 5 08-30 14:12 08-30 14:43 - Google LLC US 8146
control-1 204.76.203.18 1994 3 566 08-30 05:56 08-31 09:51 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
control-1 35.247.178.64 723 130 533 08-30 11:55 08-30 11:55 - Google LLC SG 12
canary-farm-1 34.92.76.191 283 17 272 08-30 06:49 08-30 06:50 - Google LLC HK 4
ai-devbox-1 81.172.241.94 242 15 38 08-31 07:26 08-31 08:11 - DELTA Fiber Nederland B.V. NL 27
canary-farm-1 185.165.242.182 202 22 55 08-31 02:06 08-31 02:13 - WorldStream B.V. NL 20
canary-farm-1 80.94.95.211 168 15 167 08-31 03:45 08-31 03:45 - SS-Net RO 0
ai-devbox-1 80.94.95.211 160 15 157 08-30 21:31 08-30 21:31 - SS-Net RO 0
canary-farm-1 43.225.189.141 142 19 42 08-30 17:19 08-30 17:22 - HostRoyale Technologies Pvt US 14
canary-farm-1 31.59.160.30 118 8 12 08-31 00:28 08-31 00:29 - Miteflux Technologies Ltd AE 78
ai-devbox-1 47.84.110.109 112 3 4 08-30 23:23 08-30 23:24 - Alibaba (US) Technology Co., SG 0
canary-farm-1 105.138.220.253 74 15 38 08-31 07:11 08-31 07:15 - Office National des Postes e MA 9
canary-farm-1 81.172.241.94 74 15 38 08-31 07:17 08-31 07:20 - DELTA Fiber Nederland B.V. NL 9

Canary economics (24h)

sensor mints distinct minting IPs
control-1 19 4
canary-farm-1 15 13
ai-devbox-1 11 9

Mint failures (24h): none

Mints by type label:

sensor types mints
canary-farm-1 ["ssh","http"] 2
canary-farm-1 ["aws","ssh","http"] 13
control-1 ["aws"] 19
ai-devbox-1 ["aws"] 11

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 808
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 1
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 9043
ai-devbox-1 https 239
canary-farm-1 http 1660
canary-farm-1 https 435
control-1 http 24100

Top Host headers:

sensor host events
control-1 38.54.2.209 24090
ai-devbox-1 inference.fapthropic.com 8576
canary-farm-1 109.123.246.142 1279
canary-farm-1 sso.rightabouteverything.show 807
ai-devbox-1 217.15.163.226 584
ai-devbox-1 vmi3177282.contaboserver.net 112
canary-farm-1 127.0.0.1 4
ai-devbox-1 127.0.0.1 3
canary-farm-1 192.0.2.1 2
ai-devbox-1 217.015.163.226 1

Control node discovery velocity

  • first event ever: 2026-08-28 11:22 UTC (2 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-08-31 24100 88
2026-08-30 3186 70
2026-08-29 2052 39

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
control-1 35.247.178.64 130 / [tarpit-module] → /aws_leak_probe_8e65e1a4 [not-handled] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /.git-credentials [git-credentials-error] → /.env.local [env-production] → /download [not-handled] → /api/config [app-config-json] → /actuator/env [actuator-env] → /etc/passwd [not-handled] → /@fs/proc/1/environ [vite-fs-proc-environ] → /@fs/etc/passwd [vite-fs-etc-passwd] Google LLC SG
control-1 45.148.10.183 88 /settings.php.save [app-config-php] → /developer/crm/info.php [phpinfo] → /api/env.tar.gz [not-handled] → /admin/docker-compose.key [not-handled] → /cache/error_log.save [not-handled] → /dev/lara/phpinfo.php [phpinfo] → /sinatra.log.old.old [not-handled] → /mailer/phpversion.php [phpinfo] → /tmp/debug.inc.save [not-handled] → /.github/workflows/deploy.yml [github-actions-workflow] → /config/mailjet_config.json [not-handled] → /login [webapp-form-login] Techoff Srv Limited NL
canary-farm-1 143.110.213.72 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 207.154.212.47 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 143.244.168.161 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 143.110.217.244 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
canary-farm-1 159.223.132.86 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 157.230.19.140 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 157.245.113.227 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
ai-devbox-1 64.227.32.66 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
canary-farm-1 185.165.242.182 22 / [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] WorldStream B.V. NL
canary-farm-1 43.225.189.141 19 / [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] HostRoyale Technologies Pvt US
canary-farm-1 34.92.76.191 17 / [tarpit-module] → /.git/config [fake-git] → /.env [issued] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.env.staging [env-production-error] → /.env.development [env-production-error] → /.env.test [env-production-error] → /.env.remote [env-production-error] → /.env.bak [env-production-error] → /.env.backup [env-production-error] → /.env.save [env-production-error] Google LLC HK
canary-farm-1 81.172.241.94 15 / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] DELTA Fiber Nederland B.V. NL
canary-farm-1 105.138.220.253 15 / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] Office National des Postes e MA