flux fleet digest — 2026-09-07 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 6439 | 197 | 6390 | 190 | +1% |
| ai-devbox-1 | 60032 | 491 | 14407 | 223 | +317% |
| control-1 | 3256 | 108 | 8145 | 100 | -60% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | adminer-credential-post | 30 | 7.0 | 4.3x |
| ai-devbox-1 | adminer-login | 30 | 4.6 | 6.5x |
| ai-devbox-1 | fake-git | 50140 | 8518.9 | 5.9x |
| ai-devbox-1 | fake-git-error | 1735 | 507.6 | 3.4x |
| ai-devbox-1 | gitignore | 348 | 82.8 | 4.2x |
| ai-devbox-1 | phpinfo-error | 34 | 8.8 | 3.9x |
| ai-devbox-1 | phpmyadmin-login | 141 | 15.5 | 9.1x |
| ai-devbox-1 | tomcat-path-bypass-env | 80 | 25.8 | 3.1x |
| ai-devbox-1 | webapp-config-bundle-js-error | 121 | 19.0 | 6.4x |
| ai-devbox-1 | webapp-config-bundle-json-error | 30 | 0.0 | infx |
| ai-devbox-1 | yii2-debug-view-error | 21 | 5.3 | 3.9x |
| canary-farm-1 | phpinfo | 71 | 18.9 | 3.8x |
| canary-farm-1 | phpinfo-error | 67 | 13.7 | 4.9x |
| canary-farm-1 | sftp-config-error | 36 | 11.9 | 3.0x |
| canary-farm-1 | symfony-parameters-yml-error | 40 | 2.5 | 16.0x |
| canary-farm-1 | symfony-profiler-phpinfo-error | 24 | 3.8 | 6.4x |
| canary-farm-1 | webapp-config-bundle-js-error | 220 | 26.2 | 8.4x |
| canary-farm-1 | webapp-config-bundle-json-error | 80 | 0.0 | infx |
| canary-farm-1 | wp-batch-rejected | 229 | 65.4 | 3.5x |
| canary-farm-1 | yii2-debug-view-error | 56 | 3.5 | 16.0x |
| control-1 | aws-credentials-file-error | 31 | 1.5 | 20.7x |
| control-1 | env-production-error | 85 | 24.0 | 3.5x |
| control-1 | firebase-json-error | 22 | 0.0 | infx |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 81 | 243 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 40 | 280 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4da4da41b920 ⟳ | 7 | 42 | canary-farm-1 | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 4b4cc0ece037 ⟳ | 7 | 49 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ | 6 | 294 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 9ff5e462ca0e ⟳ | 3 | 27 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| control-1 | /.aider.model.settings.yml | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /llm_config.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /litellm_config.yaml | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /proxy_config.yaml | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /api/phpinfo.php | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.continue/config.yaml | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.aider.env | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.codeium/settings.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.config/fish/config.fish | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /data.sql | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.windsurf/mcp.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.cursor/config.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.continue/config.ts | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.python_history | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /google.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /web.zip | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /public_html.zip | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.zprofile | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /mcp_config.json | 2026-09-07 03:32:00.411708-04:00 |
| control-1 | /.vscode/mcp.json | 2026-09-07 03:32:00.411708-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| canary-farm-1 | Mozilla/5.0 (compatible; Exabot/3.0; http://www.exabot.com/ | 2026-09-07 03:32:01.858119-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Buil | 2026-09-07 03:32:01.858119-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64; rv:150.14) Gecko/20100101 Fi | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.7) Gecko/2010 | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64; rv:78.19) Gecko/20100101 Fir | 2026-09-07 03:15:10.906218-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64; rv:121.1) Gecko/20100101 Fir | 2026-09-07 03:15:10.906218-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 94.154.46.247 | 2100 | 107 | 1042 | 09-06 19:02 | 09-06 19:02 | - | Omegatech LTD | US | 0 |
| ai-devbox-1 | 35.230.156.15 | 1752 | 3 | 1704 | 09-06 06:28 | 09-06 08:38 | - | Google LLC | GB | 0 |
| ai-devbox-1 | 34.128.77.76 | 1740 | 2 | 1704 | 09-06 06:02 | 09-06 06:04 | - | Google LLC | ID | 0 |
| ai-devbox-1 | 34.74.108.82 | 1740 | 2 | 1704 | 09-06 09:03 | 09-06 09:04 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.186.70.250 | 1740 | 2 | 1704 | 09-06 09:06 | 09-06 09:07 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.39.196.81 | 1740 | 2 | 1704 | 09-06 08:32 | 09-06 08:36 | - | Google LLC | BR | 0 |
| ai-devbox-1 | 34.140.58.110 | 1740 | 2 | 1704 | 09-06 09:05 | 09-06 09:06 | - | Google LLC | BE | 0 |
| ai-devbox-1 | 8.234.65.95 | 1740 | 2 | 1704 | 09-06 09:01 | 09-06 09:02 | - | Google LLC | IN | 0 |
| ai-devbox-1 | 34.186.131.126 | 1740 | 2 | 1704 | 09-06 06:01 | 09-06 06:04 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.187.220.21 | 1740 | 2 | 1704 | 09-06 08:57 | 09-06 08:59 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.22.51.98 | 1740 | 2 | 1704 | 09-06 09:05 | 09-06 09:07 | - | Google LLC | US | 0 |
| ai-devbox-1 | 8.229.46.3 | 1740 | 2 | 1704 | 09-06 08:36 | 09-06 08:39 | - | Google LLC | US | 0 |
| ai-devbox-1 | 34.34.39.122 | 1740 | 2 | 1704 | 09-06 09:07 | 09-06 09:10 | - | Google LLC | NL | 0 |
| ai-devbox-1 | 34.92.227.23 | 1740 | 2 | 1704 | 09-06 08:32 | 09-06 08:34 | - | Google LLC | HK | 0 |
| ai-devbox-1 | 34.102.40.248 | 1740 | 2 | 1704 | 09-06 08:54 | 09-06 08:55 | - | Google LLC | US | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 7 | 5 |
| canary-farm-1 | 49 | 13 |
| ai-devbox-1 | 32 | 27 |
Mint failures (24h): control-1:400x16; canary-farm-1:400x24; ai-devbox-1:400x187
Mints by type label:
| sensor | types | mints |
|---|---|---|
| control-1 | ["aws"] | 7 |
| ai-devbox-1 | ["aws"] | 32 |
| canary-farm-1 | ["aws"] | 49 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2393
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 59024 |
| ai-devbox-1 | https | 1008 |
| canary-farm-1 | http | 5223 |
| canary-farm-1 | https | 1216 |
| control-1 | http | 3256 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| ai-devbox-1 | vmi3177282.contaboserver.net | 55446 |
| canary-farm-1 | 109.123.246.142 | 4612 |
| control-1 | 38.54.2.209 | 3241 |
| ai-devbox-1 | 217.15.163.226 | 2659 |
| canary-farm-1 | sso.rightabouteverything.show | 1816 |
| ai-devbox-1 | inference.fapthropic.com | 1767 |
| ai-devbox-1 | 127.0.0.1 | 152 |
| ai-devbox-1 | localhost | 2 |
| control-1 | 192.0.2.1 | 2 |
| ai-devbox-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (9 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-07 | 3256 | 108 |
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| canary-farm-1 | 34.83.24.21 | 137 | / [tarpit-module] → /aws_leak_probe_7b0ee3a3 [not-handled] → /.env [issued] → /read [not-handled] → /download [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@vite/env [vite-env] → /.env.local [env-production] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /config.js [webapp-config-bundle-js] → /.mcp.json [mcp-config] → /.azure/credentials [azure-credentials-file] | Google LLC | US |
| control-1 | 34.23.20.91 | 137 | / [tarpit-module] → /aws_leak_probe_c34a4cd8 [not-handled] → /.env [tracebit-http-error] → /proc/self/environ [proc-environ-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] → /download [not-handled] → /.aws/credentials [aws-credentials-file-error] → /config.js [webapp-config-bundle-js-error] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/proc/self/environ [vite-fs-proc-environ-error] | Google LLC | US |
| canary-farm-1 | 94.154.46.247 | 107 | /wp-config.bak [wp-config] → /wp-config.php.old [wp-config] → /.git/HEAD [fake-git] → /wp-config.php [wp-config] → /.git/index [fake-git] → /wp-config.php.bak [wp-config] → /settings.php [app-config-php] → /config/app.php [app-config-php-services] → /wp-config.php.save [wp-config] → /wp-config.php~ [wp-config] → /composer.lock [not-handled] → /docker-compose.yml [docker-compose] | Omegatech LTD | US |
| control-1 | 161.118.243.214 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env.example [env-production] → /.env [issued] → /robots.txt [tarpit-module] → /.git/HEAD [fake-git-error] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → /sitemap.xml [tarpit-module] → /wp-login.php [wp-login-probe] | Oracle Corporation | SG |
| canary-farm-1 | 91.245.74.31 | 33 | / [tarpit-module] → /pscan-b08cdf26-nonexistent.txt [not-handled] → /.env [issued] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | PC Astra-net | UA |
| ai-devbox-1 | 45.148.10.238 | 32 | /.env [issued] → /.env.live [env-production] → /.env.prod.local [env-production] → /.aws/credentials.bak [aws-credentials-file] → /env.test [not-handled] → /.env.test.local [env-production] → /.env.server [tarpit-module] → /.env.swp [env-production] → /.env.copy [env-production] → /.env.dev.local [tarpit-module] → / [tarpit-module] → /.env.php [tarpit-module] | Techoff Srv Limited | NL |
| control-1 | 192.253.248.173 | 32 | /.aws/config [aws-config-file-error] → /.env.example [env-production-error] → /.env.travis [tarpit-module] → /.pip.conf [not-handled] → /.env.test [env-production-error] → /.env.ci [env-production-error] → /.env.development [env-production-error] → /.env.staging [env-production-error] → /.env.template [env-production-error] → /.env.docker [env-production-error] → /.env.production [env-production-error] → /.env.local [env-production-error] | Limited Network LTD | NL |
| control-1 | 45.148.10.238 | 32 | /.env.credentials [tarpit-module] → /.env.php [tarpit-module] → /.env.prod.local [env-production] → /.env.dist [env-production] → /.env.prod [env-production] → /.env.backup [env-production] → /.env.copy [env-production] → / [tarpit-module] → /.env.local [env-production] → /.env.production.local [env-production] → /.env [issued] → /.env.dev.local [tarpit-module] | Techoff Srv Limited | NL |
| control-1 | 168.107.91.14 | 30 | / [tarpit-module] → /.env.production [env-production] → /.env [issued] → /.env.bak [env-production] → /.env.example [env-production] → /.env.local [env-production] → /sitemap.xml [tarpit-module] → /.git/HEAD [fake-git] → /robots.txt [tarpit-module] → /.git/config [fake-git] → /.DS_Store [ds-store] → /server-status [server-status-html] | Oracle Corporation | SG |
| canary-farm-1 | 64.227.32.66 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| ai-devbox-1 | 138.197.191.87 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 159.89.12.166 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 159.65.18.197 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 139.59.136.184 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 45.33.103.103 | 27 | / [tarpit-module] → /.git/config [fake-git-error] → / [tarpit] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /index.php [tarpit-module] → /index.php [tarpit] → /.env [tracebit-http-error] → /.env.prod [env-production-error] → /.env.production [env-production-error] → /redmine/.env [tarpit-module] | Akamai Connected Cloud | US |