flux fleet digest — 2026-09-06 07:31 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 4007 | 324 | 6317 | 180 | -37% |
| ai-devbox-1 | 72053 | 712 | 4907 | 180 | +1368% |
| control-1 | 2523 | 99 | 8240 | 96 | -69% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | actuator-configprops-error | 322 | 54.2 | 5.9x |
| ai-devbox-1 | actuator-env-error | 645 | 110.4 | 5.8x |
| ai-devbox-1 | aws-credentials-file | 41 | 9.4 | 4.3x |
| ai-devbox-1 | env-production-error | 2958 | 541.0 | 5.5x |
| ai-devbox-1 | fake-git | 58784 | 122.6 | 479.6x |
| ai-devbox-1 | fake-git-error | 2355 | 37.6 | 62.6x |
| ai-devbox-1 | firebase-json | 21 | 4.3 | 4.8x |
| ai-devbox-1 | gitignore | 408 | 1.5 | 272.0x |
| ai-devbox-1 | laravel-ignition-error | 322 | 54.4 | 5.9x |
| ai-devbox-1 | laravel-log-error | 322 | 53.8 | 6.0x |
| ai-devbox-1 | phpinfo | 77 | 21.3 | 3.6x |
| ai-devbox-1 | phpmyadmin-login | 41 | 10.4 | 3.9x |
| ai-devbox-1 | tracebit-http-error | 331 | 63.6 | 5.2x |
| ai-devbox-1 | webapp-config-bundle-js-error | 60 | 8.0 | 7.5x |
| ai-devbox-1 | wp-config-error | 966 | 166.4 | 5.8x |
| ai-devbox-1 | wp-login-credentials | 100 | 16.0 | 6.2x |
| ai-devbox-1 | wp-login-probe | 203 | 15.0 | 13.5x |
| canary-farm-1 | webapp-config-bundle-js-error | 60 | 15.2 | 3.9x |
| canary-farm-1 | wp-login-credentials | 336 | 39.0 | 8.6x |
| canary-farm-1 | wp-login-probe | 676 | 36.7 | 18.4x |
| control-1 | env-production-error | 52 | 9.7 | 5.4x |
| control-1 | fake-git | 1730 | 36.1 | 47.9x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 184 | 552 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 4da4da41b920 ⟳ | 47 | 282 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 39 | 273 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 9ff5e462ca0e | 17 | 153 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 289277522a02 | 8 | 97 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 7e61a9500d8b ⟳ | 5 | 245 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| ai-devbox-1 | /owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php | 2026-09-06 03:31:18.118748-04:00 |
| ai-devbox-1 | /public/.git/hooks/push-to-checkout.sample | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /www/.git/logs/refs/stash | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /www/.git/logs/refs/remotes/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /site/.git/hooks/update.sample | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /htdocs/.git/objects/pack/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /wordpress/.git/refs/wip/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /html/.git/refs/wip/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /html/.git/logs/refs/heads/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /htdocs/.git/refs/heads/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /public/.git/info/sparse-checkout | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /www/.git/refs/heads/master | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /htdocs/.git/logs/refs/heads/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /html/.git/refs/heads/develop | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /backend/.git/refs/stash | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /src/.git/logs/refs/stash | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /var/www/.git/refs/tags/v2.0 | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /backend/.git/refs/tags/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /site/.git/logs/refs/remotes/ | 2026-09-06 03:15:47.605626-04:00 |
| ai-devbox-1 | /html/.git/refs/heads/master | 2026-09-06 03:15:47.605626-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-06 03:31:18.991121-04:00 |
| ai-devbox-1 | HTTP Banner Detection (https://security.ipip.net) | 2026-09-06 03:31:18.991121-04:00 |
| canary-farm-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/605 | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple | 2026-09-06 03:15:52.360539-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.4) Gecko | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple | 2026-09-06 03:15:52.360539-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 | 2026-09-06 03:15:52.360539-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| ai-devbox-1 | 34.63.105.214 | 1752 | 3 | 1704 | 09-05 09:44 | 09-05 14:16 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.128.77.76 | 1740 | 2 | 1704 | 09-06 06:02 | 09-06 06:04 | - | Google LLC | ID | 0 |
| ai-devbox-1 | 34.135.88.150 | 1740 | 2 | 1704 | 09-05 08:28 | 09-05 08:31 | - | Google LLC | US | 0 |
| ai-devbox-1 | 136.108.56.155 | 1740 | 2 | 1704 | 09-05 11:24 | 09-05 11:25 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.138.79.19 | 1740 | 2 | 1704 | 09-05 09:00 | 09-05 09:03 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.30.102.4 | 1740 | 2 | 1704 | 09-05 08:54 | 09-05 08:55 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.85.233.150 | 1740 | 2 | 1704 | 09-05 09:16 | 09-05 09:17 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.142.239.121 | 1740 | 2 | 1704 | 09-05 12:07 | 09-05 12:08 | - | Google LLC | SG | 0 |
| ai-devbox-1 | 8.234.133.39 | 1740 | 2 | 1704 | 09-05 09:27 | 09-05 09:30 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.84.190.183 | 1740 | 2 | 1704 | 09-05 11:22 | 09-05 11:25 | - | Google LLC | JP | 0 |
| ai-devbox-1 | 136.110.111.62 | 1740 | 2 | 1704 | 09-05 08:59 | 09-05 09:02 | - | Google LLC | JP | 0 |
| ai-devbox-1 | 34.186.131.126 | 1740 | 2 | 1704 | 09-06 06:01 | 09-06 06:04 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.175.223.218 | 1740 | 2 | 1704 | 09-05 10:19 | 09-05 10:21 | - | Google LLC | ES | 0 |
| ai-devbox-1 | 34.181.252.25 | 1740 | 2 | 1704 | 09-05 08:35 | 09-05 08:37 | - | Google LLC | US | 0 |
| ai-devbox-1 | 136.116.97.224 | 1740 | 2 | 1704 | 09-05 12:11 | 09-05 12:13 | - | Google LLC | US | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 1 | 1 |
| canary-farm-1 | 21 | 11 |
| ai-devbox-1 | 65 | 36 |
Mint failures (24h): control-1:400x4; ai-devbox-1:400x331; canary-farm-1:400x29
Mints by type label:
| sensor | types | mints |
|---|---|---|
| ai-devbox-1 | ["aws"] | 65 |
| canary-farm-1 | ["aws"] | 21 |
| control-1 | ["aws"] | 1 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2244
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 71307 |
| ai-devbox-1 | https | 746 |
| canary-farm-1 | http | 2514 |
| canary-farm-1 | https | 1493 |
| control-1 | http | 2522 |
| control-1 | https | 1 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| ai-devbox-1 | vmi3177282.contaboserver.net | 68541 |
| control-1 | 38.54.2.209 | 2503 |
| ai-devbox-1 | 217.15.163.226 | 2386 |
| canary-farm-1 | 109.123.246.142 | 2148 |
| canary-farm-1 | sso.rightabouteverything.show | 1847 |
| ai-devbox-1 | inference.fapthropic.com | 1116 |
| ai-devbox-1 | localhost | 2 |
| control-1 | localhost | 2 |
| control-1 | 192.0.2.1 | 2 |
| canary-farm-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (8 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 136.85.12.249 | 139 | / [tarpit-module] → /aws_leak_probe_8b3d925e [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /actuator/env [actuator-env] → /@fs/etc/passwd [vite-fs-etc-passwd] → /app/.env [env-production] → /proc/self/environ [proc-environ] → /.env.local [env-production] → /etc/passwd [not-handled] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/proc/1/environ [vite-fs-proc-environ] | Google LLC | SG |
| ai-devbox-1 | 104.196.118.131 | 137 | / [tarpit-module] → /aws_leak_probe_1bd38fbd [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /etc/passwd [not-handled] → /app/.env [env-production] → /@fs/proc/1/environ [vite-fs-proc-environ] → /.azure/credentials [azure-credentials-file] → /download [not-handled] → /.git/HEAD [fake-git] → /@vite/env [vite-env] → /config.js [webapp-config-bundle-js] | Google LLC | US |
| ai-devbox-1 | 161.118.213.214 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env [issued] → /.env.bak [env-production] → /.env.example [env-production] → /sitemap.xml [tarpit-module] → /.DS_Store [ds-store] → /robots.txt [tarpit-module] → /.git/config [fake-git] → /.git/HEAD [fake-git] → /phpinfo.php [phpinfo] | Oracle Corporation | SG |
| canary-farm-1 | 161.118.247.96 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env [issued] → /.env.example [env-production] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /.git/HEAD [fake-git] → /.DS_Store [ds-store] → /.git/config [fake-git] → /phpinfo.php [phpinfo] | Oracle Corporation | SG |
| control-1 | 213.35.109.13 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env.example [env-production] → /.env [issued] → /robots.txt [tarpit-module] → /sitemap.xml [tarpit-module] → /.git/config [fake-git] → /.DS_Store [ds-store] → /.git/HEAD [fake-git] → /admin/ [webapp-form-profile] | Oracle Corporation | SG |
| ai-devbox-1 | 91.245.74.31 | 33 | / [tarpit-module] → /pscan-0e68cf14-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | PC Astra-net | UA |
| ai-devbox-1 | 209.97.180.8 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| ai-devbox-1 | 206.81.24.74 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 167.99.210.137 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 167.99.182.39 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 143.244.168.161 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 167.71.175.236 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 164.92.107.174 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 139.59.136.184 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 185.141.119.179 | 24 | / [tarpit-module] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] | HostRoyale Technologies Pvt | US |