flux fleet digest — 2026-09-01 07:15 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 10437 | 159 | 3219 | 164 | +224% |
| ai-devbox-1 | 2621 | 106 | 5191 | 186 | -50% |
| control-1 | 15373 | 107 | 9779 | 66 | +57% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | app-config-php | 21 | 1.0 | 21.0x |
| ai-devbox-1 | app-config-python | 27 | 1.0 | 27.0x |
| ai-devbox-1 | fake-git | 35 | 8.7 | 4.0x |
| ai-devbox-1 | ssh-private-key | 40 | 13.0 | 3.1x |
| ai-devbox-1 | webapp-config-bundle-js | 128 | 35.0 | 3.7x |
| ai-devbox-1 | wp-batch-rejected | 90 | 6.0 | 15.0x |
| canary-farm-1 | app-config-php | 21 | 0.0 | infx |
| canary-farm-1 | app-config-python | 21 | 0.0 | infx |
| canary-farm-1 | env-production | 205 | 68.0 | 3.0x |
| canary-farm-1 | fake-git | 44 | 12.3 | 3.6x |
| canary-farm-1 | phpinfo | 20 | 4.7 | 4.3x |
| canary-farm-1 | ssh-private-key | 29 | 5.0 | 5.8x |
| canary-farm-1 | wp-config | 22 | 0.0 | infx |
| canary-farm-1 | wp-xmlrpc-post | 8146 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 38 | 268 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ | 5 | 245 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 7ea1125e0232 ⟳ | 5 | 72 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 1de56f9af5ba | 3 | 328 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-01 | / [wp-batch-rejected] → /index.php [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → /wp-json/Batch/v1 [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → |
| 4b4cc0ece037 ⟳ | 2 | 14 | ai-devbox-1 | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 5126216e04e5 | 2 | 311 | canary-farm-1 | 09-01 | / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → / [tarpit-module] → /.DS_Store [ds-store] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /setup.cgi | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /local_settings.py | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /.env.new | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /docker/compose/.env | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /client/.env.local | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /src/.env.local | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /pm2.config.js | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /.git/COMMIT_EDITMSG | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /grafana/.env | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /actuator/events | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /actuator/refresh | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /actuator/sessions | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /config.inc.bak | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /vault.json | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /admin/heapdump | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /.sqlite_history | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /config/config.inc.php.dist | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /settings.php.old | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /wp-admin/includes/.env | 2026-09-01 03:16:17.928310-04:00 |
| canary-farm-1 | /cms/wp-config.php | 2026-09-01 03:16:17.928310-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ | 2026-09-01 03:16:17.976406-04:00 |
| canary-farm-1 | Mozilla/5.0 (compatible; osint-scanner/1.0; +research) | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Linux; U; Android 2.1-update1; de-de; HTC Desir | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 | 2026-09-01 03:16:17.976406-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-01 03:16:17.976406-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 169.150.201.29 | 12707 | 5 | 12707 | 08-31 05:18 | 08-31 05:19 | ipsum:1 | Datacamp Limited | DE | 0 |
| canary-farm-1 | 136.119.157.160 | 8153 | 5 | 5 | 08-31 10:43 | 08-31 11:07 | - | Google LLC | US | 8146 |
| control-1 | 204.76.203.18 | 2176 | 3 | 580 | 08-31 03:21 | 09-01 06:30 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| ai-devbox-1 | 93.152.223.194 | 1098 | 93 | 734 | 08-31 20:34 | 08-31 20:34 | - | RMP Protection Limited | BG | 0 |
| canary-farm-1 | 93.152.223.194 | 750 | 93 | 743 | 08-31 10:10 | 08-31 10:11 | - | RMP Protection Limited | BG | 0 |
| ai-devbox-1 | 196.77.107.174 | 242 | 15 | 38 | 08-31 23:01 | 08-31 23:14 | - | Office National des Postes e | MA | 27 |
| ai-devbox-1 | 81.172.241.94 | 242 | 15 | 38 | 08-31 07:26 | 08-31 08:11 | - | DELTA Fiber Nederland B.V. | NL | 27 |
| canary-farm-1 | 196.77.107.174 | 237 | 15 | 38 | 08-31 22:52 | 08-31 23:24 | - | Office National des Postes e | MA | 27 |
| canary-farm-1 | 80.94.95.211 | 168 | 15 | 167 | 08-31 03:45 | 08-31 03:45 | - | SS-Net | RO | 0 |
| ai-devbox-1 | 152.32.235.160 | 133 | 3 | 2 | 09-01 05:36 | 09-01 05:42 | ipsum:3 | UCLOUD INFORMATION TECHNOLOG | US | 0 |
| canary-farm-1 | 93.123.109.163 | 118 | 8 | 12 | 09-01 01:32 | 09-01 01:33 | - | Techoff Srv Limited | BG | 78 |
| canary-farm-1 | 103.215.74.185 | 118 | 8 | 12 | 08-31 10:57 | 08-31 10:59 | - | SoloRDP | US | 78 |
| ai-devbox-1 | 103.215.74.26 | 92 | 9 | 12 | 09-01 04:45 | 09-01 04:45 | - | SoloRDP | US | 78 |
| canary-farm-1 | 81.172.241.94 | 74 | 15 | 38 | 08-31 07:17 | 08-31 07:20 | - | DELTA Fiber Nederland B.V. | NL | 9 |
| canary-farm-1 | 105.138.220.253 | 74 | 15 | 38 | 08-31 07:11 | 08-31 07:15 | - | Office National des Postes e | MA | 9 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 3 | 2 |
| canary-farm-1 | 22 | 15 |
| ai-devbox-1 | 20 | 10 |
Mint failures (24h): none
Mints by type label:
| sensor | types | mints |
|---|---|---|
| control-1 | ["aws"] | 3 |
| ai-devbox-1 | ["aws"] | 20 |
| canary-farm-1 | ["aws","ssh","http"] | 22 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 728
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 2291 |
| ai-devbox-1 | https | 330 |
| canary-farm-1 | http | 10237 |
| canary-farm-1 | https | 200 |
| control-1 | http | 15373 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 15361 |
| canary-farm-1 | sso.rightabouteverything.show | 8637 |
| ai-devbox-1 | 217.15.163.226 | 2024 |
| canary-farm-1 | 109.123.246.142 | 1795 |
| ai-devbox-1 | inference.fapthropic.com | 585 |
| control-1 | 192.0.2.1 | 2 |
| canary-farm-1 | 192.0.2.1 | 2 |
| ai-devbox-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (3 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| ai-devbox-1 | 93.152.223.194 | 93 | /docker-compose.yaml [docker-compose] → /wp-config.php.bak [wp-config] → /configuration.php [app-config-php] → /composer.json [not-handled] → /Gemfile.lock [not-handled] → /config.json [config-json] → /.aws/credentials [aws-credentials-file] → /.circleci/config.yml [generic-ci-config] → /settings.py [app-config-python] → /.htaccess [not-handled] → /.htpasswd [htpasswd-error] → /.env.orig [env-production] | RMP Protection Limited | BG |
| canary-farm-1 | 93.152.223.194 | 93 | /yarn.lock [yarn-lock-error] → /.aws/config [aws-config-file] → /package-lock.json [package-lock-json-error] → /composer.lock [not-handled] → /.env.save [env-production] → /.gitlab-ci.yml [gitlab-ci] → /wp-config.php.bak [wp-config] → /.env.copy [env-production] → /.env.test [env-production] → /.git/HEAD [fake-git] → /.git/index [fake-git] → /wp-config.php [wp-config] | RMP Protection Limited | BG |
| canary-farm-1 | 20.168.94.17 | 32 | /.git/HEAD [fake-git-prepare-disconnect] → /.git/config [fake-git] → /.git/logs/HEAD [fake-git] → /.git/HEAD [fake-git] → /.env [issued] → /.git/refs/heads/master [fake-git] → /.env.local [env-production] → /.env.production [env-production] → /.git/refs/heads/main [fake-git] → /config/database.yml [rails-database-yml] → /.git/index [fake-git] → /config/secrets.yml [rails-secrets-yml] | Microsoft Corporation | US |
| canary-farm-1 | 138.197.191.87 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 139.59.143.102 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 165.227.39.235 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 64.23.218.208 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 157.230.19.140 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 139.59.136.184 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 64.227.70.2 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| canary-farm-1 | 91.92.47.201 | 20 | /server.js [not-handled] → /app.js [webapp-config-bundle-js] → /phpinfo.php [phpinfo] → /.env [issued] → /config.php [app-config-php] → /.git/config [fake-git] → /appsettings.json [appsettings-json] → /wp-config.php [wp-config] → /info.php [phpinfo] → /settings.php [app-config-php] → /.env.bak [env-production] → /web.config [iis-web-config] | TechTies Inc. | NL |
| canary-farm-1 | 81.172.241.94 | 15 | / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] | DELTA Fiber Nederland B.V. | NL |
| canary-farm-1 | 80.94.95.211 | 15 | / [tarpit-module] → /.env [issued] → /api/.env [env-production] → /backend/.env [env-production] → /phpinfo.php [phpinfo] → /admin/.env [env-production] → /phpinfo/ [not-handled] → /laravel/.env [env-production] → /core/.env [env-production] → /test [not-handled] → /.env.example [env-production] → /app/.env [env-production] | SS-Net | RO |
| canary-farm-1 | 105.138.220.253 | 15 | / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] | Office National des Postes e | MA |