flux fleet digest — 2026-09-08 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 3751 | 220 | 7011 | 194 | -46% |
| ai-devbox-1 | 3369 | 151 | 21657 | 279 | -84% |
| control-1 | 3376 | 120 | 5167 | 103 | -35% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | phpinfo-error | 47 | 13.8 | 3.4x |
| ai-devbox-1 | symfony-parameters-yml-error | 22 | 5.0 | 4.4x |
| canary-farm-1 | app-config-json | 25 | 8.0 | 3.1x |
| canary-farm-1 | env-production-error | 234 | 11.5 | 20.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| 3e1c5eb879e7 ⟳ | 51 | 358 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| e6e6f15a77e8 ⟳ | 40 | 120 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 4b4cc0ece037 ⟳ | 12 | 84 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 4da4da41b920 ⟳ | 8 | 48 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ | 6 | 294 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 9ff5e462ca0e ⟳ | 3 | 27 | canary-farm-1 | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
| 850993125b15 ⟳ | 3 | 123 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 76d212a95300 ⟳ | 3 | 117 | ai-devbox-1 | 09-03 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /sql.gz | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /.vscode/mcp.json | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /.continue/config.ts | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /.git/objects/3e/b086f3df5c57010fcda268ea01ea7088b12bfb | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /security.txt | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /src/PHPInfo.php | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /�v2/�.env | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /�api2/�.env | 2026-09-08 03:15:09.868183-04:00 |
| ai-devbox-1 | /public/phpinfo.php | 2026-09-08 03:15:09.868183-04:00 |
| ai-devbox-1 | /postgresql:/prod_rw:TWU4wxZshuEF2-bHKRaNww@db.internal:5432/prod | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /zxagimz1r | 2026-09-08 03:15:09.868183-04:00 |
| ai-devbox-1 | /@fs/proc/self/cwd/.config/gcloud/application_default_credentials.json | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /mcp_config.json | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /.claude/mcp.json | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /backup.rar | 2026-09-08 03:15:09.868183-04:00 |
| canary-farm-1 | /uorzragcz1a6_tron3 | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /platform/.env | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /�cgi-bin/�.env | 2026-09-08 03:15:09.868183-04:00 |
| control-1 | /�tests/�.env | 2026-09-08 03:15:09.868183-04:00 |
| ai-devbox-1 | /�configs.json.bak | 2026-09-08 03:15:09.868183-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/12 | 2026-09-08 03:31:56.464070-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.2) Geck | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.18) Gecko/2 | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( | 2026-09-08 03:15:13.200248-04:00 |
| control-1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( | 2026-09-08 03:15:13.200248-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 34.22.137.199 | 839 | 137 | 609 | 09-07 17:26 | 09-07 17:26 | - | Google LLC | BE | 12 |
| canary-farm-1 | 34.83.24.21 | 803 | 137 | 578 | 09-07 05:10 | 09-07 05:10 | - | Google LLC | US | 12 |
| control-1 | 136.85.124.29 | 803 | 138 | 578 | 09-07 15:44 | 09-07 15:45 | - | Google LLC | SG | 12 |
| ai-devbox-1 | 34.104.212.213 | 777 | 137 | 601 | 09-08 03:43 | 09-08 03:43 | - | Google LLC | JP | 12 |
| control-1 | 34.23.20.91 | 742 | 137 | 570 | 09-07 06:11 | 09-07 06:12 | - | Google LLC | US | 12 |
| control-1 | 45.148.10.238 | 660 | 30 | 273 | 09-07 12:19 | 09-07 12:21 | ipsum:3 firehol2 | Techoff Srv Limited | NL | 17 |
| ai-devbox-1 | 102.220.161.87 | 517 | 39 | 512 | 09-07 23:07 | 09-08 02:17 | - | VPS Dedicated LLC | SI | 0 |
| ai-devbox-1 | 45.148.10.238 | 375 | 23 | 175 | 09-07 08:16 | 09-07 08:20 | ipsum:3 firehol2 | Techoff Srv Limited | NL | 16 |
| canary-farm-1 | 104.36.50.16 | 311 | 24 | 68 | 09-07 17:30 | 09-07 21:15 | - | HostRoyale Technologies Pvt | US | 21 |
| ai-devbox-1 | 104.36.50.16 | 307 | 25 | 68 | 09-07 18:27 | 09-07 21:35 | - | HostRoyale Technologies Pvt | US | 21 |
| canary-farm-1 | 34.74.198.14 | 283 | 17 | 272 | 09-07 17:42 | 09-07 17:43 | - | Google LLC | US | 4 |
| control-1 | 204.76.203.18 | 238 | 2 | 236 | 09-08 05:02 | 09-08 07:32 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| ai-devbox-1 | 41.140.11.235 | 152 | 15 | 38 | 09-08 06:41 | 09-08 06:45 | - | Office National des Postes e | MA | 18 |
| ai-devbox-1 | 185.169.252.18 | 143 | 10 | 91 | 09-07 17:18 | 09-07 17:19 | - | Contabo GmbH | FR | 1 |
| control-1 | 161.118.243.214 | 128 | 54 | 117 | 09-07 06:08 | 09-07 06:08 | - | Oracle Corporation | SG | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| canary-farm-1 | 61 | 13 |
| control-1 | 24 | 8 |
| ai-devbox-1 | 16 | 13 |
Mint failures (24h): control-1:400x21; canary-farm-1:400x10; ai-devbox-1:400x24
Mints by type label:
| sensor | types | mints |
|---|---|---|
| control-1 | ["aws"] | 24 |
| ai-devbox-1 | ["aws"] | 16 |
| canary-farm-1 | ["aws"] | 61 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1215
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 3085 |
| ai-devbox-1 | https | 284 |
| canary-farm-1 | http | 2972 |
| canary-farm-1 | https | 779 |
| control-1 | http | 3376 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 3362 |
| canary-farm-1 | 109.123.246.142 | 2732 |
| ai-devbox-1 | 217.15.163.226 | 2241 |
| canary-farm-1 | sso.rightabouteverything.show | 1006 |
| ai-devbox-1 | inference.fapthropic.com | 581 |
| ai-devbox-1 | vmi3177282.contaboserver.net | 382 |
| ai-devbox-1 | 127.0.0.1 | 152 |
| ai-devbox-1 | ip-api.com | 2 |
| control-1 | 192.0.2.1 | 1 |
| ai-devbox-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (10 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-08 | 3376 | 120 |
| 2026-09-07 | 3256 | 108 |
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| control-1 | 136.85.124.29 | 138 | / [tarpit-module] → /aws_leak_probe_524ea0b5 [not-handled] → /.env [issued] → /.azure/credentials [azure-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /app/.env [env-production] → /.aws/credentials [aws-credentials-file] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/proc/1/environ [vite-fs-proc-environ] → /aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] | Google LLC | SG |
| ai-devbox-1 | 34.104.212.213 | 137 | / [tarpit-module] → /aws_leak_probe_aaec3ada [not-handled] → /.env [tracebit-http-error] → /proc/self/environ [proc-environ-error] → /.aws/credentials [aws-credentials-file-error] → /etc/passwd [not-handled] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/proc/1/environ [vite-fs-proc-environ-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json-error] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file-error] → /.azure/credentials [azure-credentials-file-error] | Google LLC | JP |
| control-1 | 34.23.20.91 | 137 | / [tarpit-module] → /aws_leak_probe_c34a4cd8 [not-handled] → /.env [tracebit-http-error] → /proc/self/environ [proc-environ-error] → /app/.env [env-production-error] → /.azure/credentials [azure-credentials-file-error] → /download [not-handled] → /.aws/credentials [aws-credentials-file-error] → /config.js [webapp-config-bundle-js-error] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/proc/self/environ [vite-fs-proc-environ-error] | Google LLC | US |
| canary-farm-1 | 34.22.137.199 | 137 | / [tarpit-module] → /aws_leak_probe_a2cd6c76 [not-handled] → /.env [issued] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/proc/1/environ [vite-fs-proc-environ] → /.azure/credentials [azure-credentials-file] | Google LLC | BE |
| canary-farm-1 | 34.83.24.21 | 137 | / [tarpit-module] → /aws_leak_probe_7b0ee3a3 [not-handled] → /.env [issued] → /read [not-handled] → /download [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@vite/env [vite-env] → /.env.local [env-production] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /config.js [webapp-config-bundle-js] → /.mcp.json [mcp-config] → /.azure/credentials [azure-credentials-file] | Google LLC | US |
| control-1 | 161.118.243.214 | 54 | / [tarpit-module] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /.env.example [env-production] → /.env [issued] → /robots.txt [tarpit-module] → /.git/HEAD [fake-git-error] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → /sitemap.xml [tarpit-module] → /wp-login.php [wp-login-probe] | Oracle Corporation | SG |
| ai-devbox-1 | 102.220.161.87 | 39 | /.env [issued] → / [tarpit-module] → /pscan-b6aa4206-nonexistent.txt [not-handled] → /vendor/.env [env-production] → /lib/.env [env-production] → /lab/.env [env-production] → /cronlab/.env [env-production] → /cron/.env [env-production] → /core/.env [env-production] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] | VPS Dedicated LLC | SI |
| control-1 | 45.148.10.238 | 30 | /.env.dev [env-production] → /config.php.bak [app-config-php] → /inf.php [webshell-sweep-observed] → /.envrc [tarpit-module] → /config.json [config-json] → /env.php [env-production] → / [tarpit-module] → /.env.backup [env-production] → /php_info.php [phpinfo] → /env.bak [env-production] → /pp.php [webshell-sweep-observed] → /api/.env [env-production] | Techoff Srv Limited | NL |
| control-1 | 168.107.91.14 | 30 | / [tarpit-module] → /.env.production [env-production] → /.env [issued] → /.env.bak [env-production] → /.env.example [env-production] → /.env.local [env-production] → /sitemap.xml [tarpit-module] → /.git/HEAD [fake-git] → /robots.txt [tarpit-module] → /.git/config [fake-git] → /.DS_Store [ds-store] → /server-status [server-status-html] | Oracle Corporation | SG |
| canary-farm-1 | 46.101.1.225 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 207.154.197.113 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 159.223.132.86 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 157.245.113.227 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| control-1 | 34.106.12.203 | 26 | /backup.zip [backup-archive] → /dump.sql [sql-dump] → /backup.tar.gz [backup-archive] → /database.sql [sql-dump] → /backup.tar [backup-archive] → /db.sql [sql-dump] → /backup.sql [sql-dump] → /backup.tgz [backup-archive] → /dump.tar.gz [backup-archive] → /www.zip [backup-archive] → /site.zip [backup-archive] → /htdocs.zip [backup-archive] | Google LLC | US |