flux fleet digest — 2026-09-05 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 5868 | 218 | 6060 | 159 | -3% |
| ai-devbox-1 | 5877 | 269 | 4173 | 148 | +41% |
| control-1 | 3958 | 98 | 7967 | 88 | -50% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | fake-git-error | 161 | 11.4 | 14.1x |
| ai-devbox-1 | phpinfo | 59 | 13.1 | 4.5x |
| ai-devbox-1 | webshell-command | 22 | 0.0 | infx |
| ai-devbox-1 | webshell-probe | 193 | 11.7 | 16.5x |
| ai-devbox-1 | webshell-sweep-observed | 28 | 4.0 | 7.0x |
| ai-devbox-1 | wp-batch-rejected | 173 | 37.6 | 4.6x |
| ai-devbox-1 | wp-login-probe | 42 | 1.5 | 28.0x |
| canary-farm-1 | wp-login-probe | 125 | 19.9 | 6.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 61 | 183 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 34 | 240 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ | 15 | 105 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 4da4da41b920 ⟳ | 4 | 24 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| dd96357f0266 | 2 | 34 | canary-farm-1,control-1 ⚠FLEET-WIDE | 09-05 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| cd84bca56fc8 | 2 | 18 | ai-devbox-1,control-1 ⚠FLEET-WIDE | 09-05 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → / [tarpit-module] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /_vti_pvt/service.pwd | 2026-09-05 03:31:16.523986-04:00 |
| canary-farm-1 | /wp-admin/zzcanary-a8db9ef01357856.php | 2026-09-05 03:31:16.523986-04:00 |
| canary-farm-1 | /user_secrets.yml | 2026-09-05 03:31:16.523986-04:00 |
| control-1 | /goform/formJsonAjaxReq | 2026-09-05 03:31:16.523986-04:00 |
| canary-farm-1 | /database_backup.sql | 2026-09-05 03:31:16.523986-04:00 |
| canary-farm-1 | /wp-admin/setup-config.php | 2026-09-05 03:31:16.523986-04:00 |
| ai-devbox-1 | /sites/.env | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /Serve_time_server/.env | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /web/debug/default/view | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /.deployment-config.json | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /customer/.git/config | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /projeto/config.yaml | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /conta/.git/config | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /cache/api-config.ini | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /testphpinfo | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /test123.php | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /info1.php | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /phptest.php | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /a.php | 2026-09-05 03:15:34.460715-04:00 |
| ai-devbox-1 | /wp-json/wp/v2/users | 2026-09-05 03:15:34.460715-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| canary-farm-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-05 03:31:18.201918-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-05 03:31:18.201918-04:00 |
| control-1 | python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1. | 2026-09-05 03:31:18.201918-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/ | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-05 03:15:34.803236-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 | 2026-09-05 03:15:34.803236-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 87.120.104.29 | 3452 | 117 | 1674 | 09-04 05:06 | 09-04 05:06 | - | Sino Worldwide Trading Limit | NO | 0 |
| control-1 | 94.154.46.243 | 1803 | 116 | 1674 | 09-04 03:42 | 09-04 03:42 | - | Omegatech LTD | US | 0 |
| control-1 | 34.23.228.150 | 803 | 139 | 578 | 09-04 21:34 | 09-04 21:35 | - | Google LLC | US | 12 |
| ai-devbox-1 | 194.180.49.37 | 766 | 37 | 529 | 09-04 16:02 | 09-04 17:36 | - | MEVSPACE sp. z o.o. | BG | 16 |
| ai-devbox-1 | 34.79.70.110 | 742 | 137 | 570 | 09-05 01:57 | 09-05 01:57 | - | Google LLC | BE | 12 |
| control-1 | 194.180.49.37 | 514 | 33 | 511 | 09-04 16:05 | 09-04 17:41 | - | MEVSPACE sp. z o.o. | BG | 0 |
| ai-devbox-1 | 195.178.110.132 | 271 | 8 | 25 | 09-05 01:01 | 09-05 01:10 | ipsum:1 | Techoff Srv Limited | BG | 192 |
| canary-farm-1 | 196.206.35.222 | 257 | 22 | 43 | 09-04 04:07 | 09-04 08:26 | - | Office National des Postes e | MA | 33 |
| ai-devbox-1 | 196.206.35.222 | 254 | 16 | 39 | 09-04 04:06 | 09-04 08:24 | - | Office National des Postes e | MA | 33 |
| ai-devbox-1 | 41.142.109.20 | 242 | 15 | 38 | 09-05 05:12 | 09-05 05:48 | - | Office National des Postes e | MA | 27 |
| canary-farm-1 | 41.142.109.20 | 238 | 15 | 38 | 09-05 05:07 | 09-05 05:27 | - | Office National des Postes e | MA | 27 |
| ai-devbox-1 | 199.116.112.3 | 205 | 7 | 6 | 09-04 17:18 | 09-04 17:21 | ipsum:1 | Performive LLC | US | 0 |
| canary-farm-1 | 80.94.95.211 | 169 | 14 | 168 | 09-04 11:07 | 09-04 11:07 | - | SS-Net | RO | 0 |
| ai-devbox-1 | 2a01:4f8:141:225b::2 | 144 | 2 | 142 | 09-04 11:01 | 09-04 11:01 | - | Hetzner Online GmbH | DE | 0 |
| canary-farm-1 | 2a01:4f8:141:225b::2 | 144 | 2 | 142 | 09-04 16:54 | 09-04 16:54 | - | Hetzner Online GmbH | DE | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 36 | 7 |
| canary-farm-1 | 41 | 20 |
| ai-devbox-1 | 40 | 29 |
Mint failures (24h): control-1:400x16; ai-devbox-1:400x107; canary-farm-1:400x16
Mints by type label:
| sensor | types | mints |
|---|---|---|
| control-1 | ["aws"] | 36 |
| canary-farm-1 | ["aws"] | 41 |
| ai-devbox-1 | ["aws"] | 40 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1885
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 5077 |
| ai-devbox-1 | https | 800 |
| canary-farm-1 | http | 5125 |
| canary-farm-1 | https | 743 |
| control-1 | http | 3958 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| canary-farm-1 | 109.123.246.142 | 4834 |
| control-1 | 38.54.2.209 | 3940 |
| ai-devbox-1 | 217.15.163.226 | 2383 |
| ai-devbox-1 | vmi3177282.contaboserver.net | 2124 |
| ai-devbox-1 | inference.fapthropic.com | 1046 |
| canary-farm-1 | sso.rightabouteverything.show | 990 |
| ai-devbox-1 | 127.0.0.1 | 311 |
| canary-farm-1 | 127.0.0.1 | 31 |
| ai-devbox-1 | rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion | 3 |
| canary-farm-1 | 192.0.2.1 | 2 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (7 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| control-1 | 34.23.228.150 | 139 | / [tarpit-module] → /aws_leak_probe_242e2f39 [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /.aws/credentials [aws-credentials-file] → /.git-credentials [git-credentials-error] → /etc/passwd [not-handled] → /@vite/env [vite-env] → /read [not-handled] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/proc/1/environ [vite-fs-proc-environ] | Google LLC | US |
| ai-devbox-1 | 34.79.70.110 | 137 | / [tarpit-module] → /aws_leak_probe_d8e3e487 [not-handled] → /.env [tracebit-http-error] → /.git/HEAD [fake-git-error] → /@fs/proc/self/environ [vite-fs-proc-environ-error] → /.azure/credentials [azure-credentials-file-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /etc/passwd [not-handled] → /api/config [app-config-json-error] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file-error] → /.mcp.json [mcp-config-error] | Google LLC | BE |
| canary-farm-1 | 87.120.104.29 | 117 | /wp-config.php~ [wp-config] → /.git/HEAD [fake-git] → /.aws/config [aws-config-file] → /wp-config.old [wp-config] → /config/database.php [app-config-php-database] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /config.php [app-config-php] → /composer.lock [not-handled] → /docker-compose.yaml [docker-compose] → /.aws/credentials [aws-credentials-file] → /local_settings.py [app-config-python] | Sino Worldwide Trading Limit | NO |
| control-1 | 94.154.46.243 | 116 | /config/app.php [app-config-php-services] → /configuration.php [app-config-php] → /wp-config.php.save [wp-config] → /.circleci/config.yml [generic-ci-config] → /config.js [webapp-config-bundle-js] → /Jenkinsfile [jenkinsfile] → /.env.tmp [env-production] → /wp-config.php~ [wp-config] → /.env.test [env-production] → /.env.production.local [env-production] → /.aws/config [aws-config-file] → /.env.save [env-production] | Omegatech LTD | US |
| ai-devbox-1 | 161.118.213.214 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env [issued] → /.env.bak [env-production] → /.env.example [env-production] → /sitemap.xml [tarpit-module] → /.DS_Store [ds-store] → /robots.txt [tarpit-module] → /.git/config [fake-git] → /.git/HEAD [fake-git] → /phpinfo.php [phpinfo] | Oracle Corporation | SG |
| canary-farm-1 | 138.2.85.36 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.bak [env-production] → /.env.example [env-production] → /.env.local [env-production] → /.env [issued] → /.git/config [fake-git] → /.git/HEAD [fake-git] → /sitemap.xml [tarpit-module] → /robots.txt [tarpit-module] → /.DS_Store [ds-store] → /phpinfo.php [phpinfo] | Oracle Corporation | SG |
| control-1 | 213.35.109.13 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env.example [env-production] → /.env [issued] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /.git/config [fake-git] → /.DS_Store [ds-store] → /.git/HEAD [fake-git] → /admin/ [webapp-form-profile] | Oracle Corporation | SG |
| ai-devbox-1 | 161.118.218.203 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.bak [env-production] → /.env [issued] → /.env.example [env-production] → /.env.local [env-production] → /.DS_Store [ds-store] → /.git/HEAD [fake-git-error] → /robots.txt [tarpit-module] → /.git/config [fake-git-error] → /sitemap.xml [tarpit-module] → /wp-login.php [wp-login-probe] | Oracle Corporation | SG |
| canary-farm-1 | 161.118.247.96 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env [issued] → /.env.example [env-production] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /.git/HEAD [fake-git] → /.DS_Store [ds-store] → /.git/config [fake-git] → /phpinfo.php [phpinfo] | Oracle Corporation | SG |
| control-1 | 213.35.112.238 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.example [env-production] → /.env.local [env-production] → /.env [issued] → /.env.bak [env-production] → /.git/HEAD [fake-git-error] → /sitemap.xml [tarpit-module] → /.DS_Store [ds-store] → /robots.txt [tarpit-module] → /.git/config [fake-git-error] → /login [webapp-form-login] | Oracle Corporation | SG |
| ai-devbox-1 | 194.180.49.37 | 37 | / [tarpit-module] → /pscan-24f3cc1d-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | MEVSPACE sp. z o.o. | BG |
| control-1 | 194.180.49.37 | 33 | / [tarpit-module] → /pscan-b08c2060-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | MEVSPACE sp. z o.o. | BG |
| ai-devbox-1 | 138.68.82.23 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 209.38.208.202 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 167.99.182.39 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |