flux fleet digest — 2026-09-02 07:15 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 5560 | 139 | 5023 | 163 | +11% |
| ai-devbox-1 | 2838 | 91 | 4549 | 166 | -38% |
| control-1 | 4901 | 114 | 11178 | 76 | -56% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | aws-credentials-file-error | 28 | 1.3 | 21.0x |
| canary-farm-1 | backup-archive | 26 | 0.0 | infx |
| canary-farm-1 | config-json | 22 | 6.0 | 3.7x |
| canary-farm-1 | env-production | 505 | 136.5 | 3.7x |
| canary-farm-1 | issued | 48 | 12.8 | 3.8x |
| canary-farm-1 | k8s-secret-manifest | 22 | 4.0 | 5.5x |
| canary-farm-1 | not-handled | 1400 | 447.5 | 3.1x |
| canary-farm-1 | ssh-private-key | 66 | 13.0 | 5.1x |
| canary-farm-1 | webshell-probe | 79 | 8.2 | 9.6x |
| control-1 | app-config-python | 21 | 6.5 | 3.2x |
| control-1 | fake-git | 49 | 14.0 | 3.5x |
| control-1 | ssh-private-key-error | 29 | 2.0 | 14.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 41 | 289 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| fc683200bf14 | 3 | 30 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 09-02 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] |
| 6a6fdaca6a1f | 3 | 486 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 09-02 | / [tarpit-module] → /.env [issued] → /api/.env [env-production] → /backend/.env [env-production] → /phpinfo.php [phpinfo] → /admin/.env [env-production] → … |
| 0fcbb5e9cff3 | 2 | 10 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-02 | /.git/refs/ [fake-git] → /.git/config [fake-git] → /.git/config [fake-git-error] → /.git/config [fake-git] |
| 1de56f9af5ba ⟳ | 2 | 210 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-01 | / [wp-batch-rejected] → /index.php [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → /wp-json/Batch/v1 [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → |
| 832e8ce8e086 | 2 | 30 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-02 | /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 218630667b2c | 2 | 84 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-02 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 7e61a9500d8b ⟳ | 2 | 98 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| ai-devbox-1 | /git-credentials | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /.git/objects/f9/b4f765b1bd5418ef3451ca336dc870d7fcfc2d | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /server/.env.dist | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /market/.env.bak | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /accounts/.env | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /nodeapi/.env.bak | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /deploy/config.env | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /LARAVEL/.env | 2026-09-02 03:15:44.162128-04:00 |
| ai-devbox-1 | /client/config.env | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /.config.env | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /.env.k8s | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /appsettings.json.bak | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /contentful/.env | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /.shopify/credentials | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /.mongooserc | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /accounts.txt | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /config.prod.php | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /CMakeLists.txt | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /dynatrace/.env | 2026-09-02 03:15:44.162128-04:00 |
| canary-farm-1 | /dynatrace/dynatrace.properties | 2026-09-02 03:15:44.162128-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | l9explore/1.2.2 | 2026-09-02 03:15:44.374780-04:00 |
| ai-devbox-1 | python-httpx/0.26.0 | 2026-09-02 03:15:44.374780-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64; rv:132.9) Gecko/20100101 Fir | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 | 2026-09-02 03:15:44.374780-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.2) Gecko/20 | 2026-09-02 03:15:44.374780-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 94.154.46.243 | 3538 | 117 | 1674 | 09-01 12:13 | 09-01 12:13 | - | Omegatech LTD | US | 0 |
| control-1 | 204.76.203.18 | 2327 | 3 | 578 | 09-01 03:16 | 09-02 05:42 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| control-1 | 94.154.46.250 | 1050 | 107 | 1042 | 09-01 15:55 | 09-01 15:56 | - | Omegatech LTD | US | 0 |
| canary-farm-1 | 185.19.40.40 | 1007 | 5 | 5 | 09-02 05:16 | 09-02 05:17 | - | 1337 Services GmbH | NL | 1000 |
| ai-devbox-1 | 185.19.40.36 | 1007 | 5 | 5 | 09-01 14:55 | 09-01 15:00 | - | 1337 Services GmbH | NL | 1000 |
| control-1 | 34.74.98.8 | 723 | 130 | 533 | 09-01 09:19 | 09-01 09:19 | - | Google LLC | US | 12 |
| ai-devbox-1 | 34.86.163.64 | 711 | 131 | 533 | 09-01 13:36 | 09-01 13:36 | - | Google LLC | US | 12 |
| control-1 | 213.209.159.154 | 169 | 14 | 168 | 09-01 09:55 | 09-01 09:56 | - | Feo Prest SRL | DE | 0 |
| canary-farm-1 | 213.209.159.154 | 168 | 15 | 167 | 09-02 02:53 | 09-02 02:53 | - | Feo Prest SRL | DE | 0 |
| ai-devbox-1 | 80.94.95.211 | 149 | 15 | 146 | 09-01 23:37 | 09-01 23:37 | - | SS-Net | RO | 0 |
| ai-devbox-1 | 152.32.235.160 | 133 | 3 | 2 | 09-01 05:36 | 09-01 05:42 | ipsum:3 | UCLOUD INFORMATION TECHNOLOG | US | 0 |
| canary-farm-1 | 103.168.67.253 | 118 | 8 | 12 | 09-01 10:56 | 09-01 10:57 | - | DIGI VPS | US | 78 |
| ai-devbox-1 | 103.215.74.26 | 92 | 9 | 12 | 09-01 04:45 | 09-01 04:45 | - | SoloRDP | US | 78 |
| control-1 | 20.186.237.132 | 66 | 26 | 57 | 09-01 14:42 | 09-01 14:46 | - | Microsoft Corporation | US | 0 |
| ai-devbox-1 | 20.168.100.246 | 65 | 30 | 57 | 09-01 14:16 | 09-01 14:17 | - | Microsoft Corporation | US | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 20 | 4 |
| canary-farm-1 | 48 | 9 |
| ai-devbox-1 | 20 | 11 |
Mint failures (24h): control-1:400x3; ai-devbox-1:400x16; canary-farm-1:400x3
Mints by type label:
| sensor | types | mints |
|---|---|---|
| canary-farm-1 | ["aws","ssh","http"] | 12 |
| control-1 | ["aws"] | 20 |
| ai-devbox-1 | ["aws"] | 20 |
| canary-farm-1 | ["aws"] | 12 |
| canary-farm-1 | ["aws","http"] | 24 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 345
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 2731 |
| ai-devbox-1 | https | 107 |
| canary-farm-1 | http | 5454 |
| canary-farm-1 | https | 106 |
| control-1 | http | 4901 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 4887 |
| canary-farm-1 | 109.123.246.142 | 4300 |
| ai-devbox-1 | 217.15.163.226 | 1595 |
| canary-farm-1 | sso.rightabouteverything.show | 1247 |
| ai-devbox-1 | inference.fapthropic.com | 1234 |
| canary-farm-1 | vmi3243483.contaboserver.net | 7 |
| canary-farm-1 | 192.0.2.1 | 2 |
| control-1 | 192.0.2.1 | 1 |
| ai-devbox-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (4 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-02 | 4901 | 114 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| ai-devbox-1 | 34.86.163.64 | 131 | / [tarpit-module] → /aws_leak_probe_4acbebe1 [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ-error] → /.env [tracebit-http-error] → /actuator/env [actuator-env-error] → /.git/HEAD [fake-git-error] → /etc/passwd [not-handled] → /app/.env [env-production-error] → /.aws/credentials [aws-credentials-file-error] → /.mcp.json [mcp-config-error] → /api/config [app-config-json-error] | Google LLC | US |
| control-1 | 34.74.98.8 | 130 | / [tarpit-module] → /aws_leak_probe_08fac6f8 [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /etc/passwd [not-handled] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /@fs/proc/1/environ [vite-fs-proc-environ] → /.aws/credentials [aws-credentials-file] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /.env.local [env-production] | Google LLC | US |
| canary-farm-1 | 94.154.46.243 | 117 | /.git/config [fake-git-prepare-disconnect] → /docker-compose.yml [docker-compose] → /wp-config.bak [wp-config] → /composer.lock [not-handled] → /config/settings.py [app-config-python] → /.dockerenv [not-handled] → /docker-compose.override.yml [docker-compose] → /.ssh/authorized_keys [authorized-keys] → /.circleci/config.yml [generic-ci-config] → /settings.py [app-config-python] → /configuration.php [app-config-php] → /composer.json [not-handled] | Omegatech LTD | US |
| control-1 | 94.154.46.250 | 107 | /wp-config.old [wp-config] → /wp-config.bak [wp-config] → /wp-config.php.bak [wp-config] → /yarn.lock [yarn-lock-error] → /composer.json [not-handled] → /.travis.yml [not-handled] → /.ssh/id_rsa [ssh-private-key-error] → /.git/config [fake-git] → /wp-config.php.save [wp-config] → /package-lock.json [package-lock-json-error] → /wp-config.php [wp-config] → /configuration.php [app-config-php] | Omegatech LTD | US |
| ai-devbox-1 | 20.168.100.246 | 30 | /.git/HEAD [fake-git] → /.git/logs/HEAD [fake-git] → /.git/config [fake-git] → /.git/refs/heads/main [fake-git] → /.env [issued] → /.git/index [fake-git] → /.env.local [env-production-error] → /.env.production [env-production-error] → /config/database.yml [rails-database-yml-error] → /config/secrets.yml [rails-secrets-yml-error] → /.git-credentials [git-credentials-error] → /.env.backup [env-production-error] | Microsoft Corporation | US |
| canary-farm-1 | 164.90.228.79 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 167.99.182.39 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 64.227.32.66 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 157.245.36.108 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| control-1 | 20.186.237.132 | 26 | /.git/HEAD [fake-git] → /.git/config [fake-git] → /.git/logs/HEAD [fake-git] → /.env [tracebit-http-error] → /.env.local [env-production-error] → /.env.production [env-production-error] → /.git/refs/heads/master [fake-git] → /config/database.yml [rails-database-yml-error] → /config/secrets.yml [rails-secrets-yml-error] → /.git/refs/heads/main [fake-git] → /.git-credentials [git-credentials-error] → /git-credentials [not-handled] | Microsoft Corporation | US |
| ai-devbox-1 | 146.190.242.161 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 139.59.132.8 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 165.227.173.41 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 91.92.47.201 | 20 | /server.js [not-handled] → /app.js [webapp-config-bundle-js] → /phpinfo.php [phpinfo] → /.env [issued] → /config.php [app-config-php] → /.git/config [fake-git] → /appsettings.json [appsettings-json] → /wp-config.php [wp-config] → /info.php [phpinfo] → /settings.php [app-config-php] → /.env.bak [env-production] → /web.config [iis-web-config] | TechTies Inc. | NL |