flux fleet digest — 2026-09-09 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 3751 | 283 | 6056 | 203 | -38% |
| ai-devbox-1 | 4632 | 194 | 21764 | 285 | -79% |
| control-1 | 4280 | 110 | 3453 | 105 | +24% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | app-config-python | 45 | 13.3 | 3.4x |
| ai-devbox-1 | aws-credentials-file | 42 | 13.1 | 3.2x |
| ai-devbox-1 | docker-compose | 22 | 7.2 | 3.0x |
| ai-devbox-1 | firebase-json | 31 | 4.8 | 6.4x |
| ai-devbox-1 | rails-database-yml | 24 | 7.4 | 3.2x |
| ai-devbox-1 | sql-dump | 20 | 6.5 | 3.1x |
| ai-devbox-1 | ssh-private-key-error | 88 | 28.2 | 3.1x |
| canary-farm-1 | wp-rest-auth-required | 50 | 2.8 | 18.2x |
| control-1 | cmd-injection-php-cgi-rce | 32 | 7.5 | 4.3x |
| control-1 | phpunit-eval-stdin | 221 | 46.2 | 4.8x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 76 | 228 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 41 | 289 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4da4da41b920 ⟳ | 16 | 96 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ | 7 | 336 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 4b4cc0ece037 ⟳ | 4 | 29 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 218630667b2c ⟳ | 4 | 168 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 09-02 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 257bc1184fe6 | 3 | 47 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 09-09 | /login [webapp-form-login] → / [tarpit-module] → /login [webapp-form-login] → / [tarpit-module] → /boaform/admin/formLogin [soho-router-credential] → / [tarpit-module] |
| 9ff5e462ca0e ⟳ | 3 | 27 | canary-farm-1 | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| canary-farm-1 | /wp-content/plugins/all-in-one-wp-migration/readme.txt | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /identity | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /.vercel/.env.production.local | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /datagen/emrDataGenerator/.env | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /zend/.env | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /.old/.env | 2026-09-09 03:15:00.804902-04:00 |
| ai-devbox-1 | /.git | 2026-09-09 03:15:00.804902-04:00 |
| ai-devbox-1 | /index.php/phpinfo | 2026-09-09 03:15:00.804902-04:00 |
| ai-devbox-1 | /config/tsconfig.json | 2026-09-09 03:15:00.804902-04:00 |
| ai-devbox-1 | /auth.html | 2026-09-09 03:15:00.804902-04:00 |
| ai-devbox-1 | /api/sonicos/auth | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /wp-content/plugins/updraftplus/readme.txt | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /wp-content/plugins/seo-by-rank-math/readme.txt | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /wp-content/plugins/loginizer/readme.txt | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /login.html | 2026-09-09 03:15:00.804902-04:00 |
| canary-farm-1 | /ext-js/app/common/zld_product_spec.js | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /@fs/app/.config/gcloud/application_default_credentials.json | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /gdpr/.env | 2026-09-09 03:15:00.804902-04:00 |
| control-1 | /fuel/.env | 2026-09-09 03:15:00.804902-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| control-1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/552.49 (KHTML, l | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 16_4 like Mac OS X) Apple | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:132.18) Geck | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537 | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 | 2026-09-09 03:15:00.890685-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537 | 2026-09-09 03:15:00.890685-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 204.76.203.18 | 2311 | 3 | 578 | 09-08 05:02 | 09-09 07:32 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| canary-farm-1 | 35.233.85.98 | 1608 | 5 | 5 | 09-08 08:09 | 09-08 08:10 | - | Google LLC | BE | 1600 |
| ai-devbox-1 | 94.154.46.248 | 1500 | 93 | 743 | 09-08 07:51 | 09-08 07:51 | - | Omegatech LTD | US | 0 |
| ai-devbox-1 | 35.252.125.133 | 839 | 137 | 609 | 09-08 18:51 | 09-08 18:52 | - | Google LLC | US | 12 |
| canary-farm-1 | 136.67.37.69 | 838 | 137 | 609 | 09-08 19:55 | 09-08 19:56 | - | Google LLC | US | 12 |
| control-1 | 136.70.70.191 | 837 | 138 | 609 | 09-09 03:53 | 09-09 03:54 | - | Google LLC | US | 12 |
| ai-devbox-1 | 34.104.212.213 | 777 | 137 | 601 | 09-08 03:43 | 09-08 03:43 | - | Google LLC | JP | 12 |
| control-1 | 213.209.159.154 | 171 | 14 | 170 | 09-09 04:47 | 09-09 04:47 | - | Feo Prest SRL | DE | 0 |
| ai-devbox-1 | 159.26.110.179 | 170 | 48 | 100 | 09-08 11:28 | 09-08 11:58 | - | Proton AG | PL | 0 |
| ai-devbox-1 | 41.140.11.235 | 152 | 15 | 38 | 09-08 06:41 | 09-08 06:45 | - | Office National des Postes e | MA | 18 |
| control-1 | 118.193.57.62 | 133 | 3 | 2 | 09-09 01:17 | 09-09 01:23 | ipsum:4 firehol2 | UCLOUD INFORMATION TECHNOLOG | TH | 0 |
| ai-devbox-1 | 102.220.161.87 | 131 | 35 | 98 | 09-08 09:22 | 09-08 23:00 | - | VPS Dedicated LLC | SI | 0 |
| canary-farm-1 | 41.140.11.235 | 90 | 15 | 38 | 09-08 06:32 | 09-08 06:34 | - | Office National des Postes e | MA | 9 |
| canary-farm-1 | 167.99.79.44 | 80 | 3 | 20 | 09-08 19:11 | 09-08 20:24 | - | DigitalOcean, LLC | SG | 4 |
| ai-devbox-1 | 167.99.79.44 | 80 | 3 | 20 | 09-08 19:12 | 09-08 20:25 | - | DigitalOcean, LLC | SG | 4 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 5 | 2 |
| canary-farm-1 | 31 | 4 |
| ai-devbox-1 | 48 | 10 |
Mint failures (24h): ai-devbox-1:400x18; control-1:400x22; canary-farm-1:400x4
Mints by type label:
| sensor | types | mints |
|---|---|---|
| ai-devbox-1 | ["aws"] | 48 |
| control-1 | ["aws"] | 5 |
| canary-farm-1 | ["aws"] | 31 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 933
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 4267 |
| ai-devbox-1 | https | 365 |
| canary-farm-1 | http | 3190 |
| canary-farm-1 | https | 561 |
| control-1 | http | 4280 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 4263 |
| ai-devbox-1 | 217.15.163.226 | 4053 |
| canary-farm-1 | sso.rightabouteverything.show | 2289 |
| canary-farm-1 | 109.123.246.142 | 1445 |
| ai-devbox-1 | inference.fapthropic.com | 568 |
| canary-farm-1 | 2e6tzh7.257.cz | 8 |
| control-1 | 038.054.002.209 | 1 |
| ai-devbox-1 | 217.015.163.226 | 1 |
| control-1 | 192.0.2.1 | 1 |
| canary-farm-1 | 192.0.2.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (11 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-09 | 4280 | 110 |
| 2026-09-08 | 3376 | 120 |
| 2026-09-07 | 3256 | 108 |
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| control-1 | 136.70.70.191 | 138 | / [tarpit-module] → /aws_leak_probe_f0b17e77 [not-handled] → /.env [issued] → /etc/passwd [not-handled] → /app/.env [env-production] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.aws/credentials [aws-credentials-file] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] → /.azure/credentials [azure-credentials-file] → /proc/self/environ [proc-environ] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] | Google LLC | US |
| ai-devbox-1 | 35.252.125.133 | 137 | / [tarpit-module] → /aws_leak_probe_5f5f0405 [not-handled] → /.env [issued] → /aws/credentials [aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.azure/credentials [azure-credentials-file] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /etc/passwd [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ] → /app/.env [env-production] → /.env.local [env-production] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] | Google LLC | US |
| canary-farm-1 | 136.67.37.69 | 137 | / [tarpit-module] → /aws_leak_probe_3d1153c5 [not-handled] → /.env [issued] → /etc/passwd [not-handled] → /.env.local [env-production] → /.aws/credentials [aws-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.azure/credentials [azure-credentials-file] → /aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] → /app/.env [env-production] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] | Google LLC | US |
| ai-devbox-1 | 34.104.212.213 | 137 | / [tarpit-module] → /aws_leak_probe_aaec3ada [not-handled] → /.env [tracebit-http-error] → /proc/self/environ [proc-environ-error] → /.aws/credentials [aws-credentials-file-error] → /etc/passwd [not-handled] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file-error] → /@fs/proc/1/environ [vite-fs-proc-environ-error] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json-error] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file-error] → /.azure/credentials [azure-credentials-file-error] | Google LLC | JP |
| ai-devbox-1 | 94.154.46.248 | 93 | /.git/config [fake-git] → /.env.development [env-production] → /config.py [app-config-python] → /wp-config.old [wp-config] → /.env.yaml [env-production] → /.env.yml [env-production] → /.htaccess [not-handled] → /.env.backup [env-production] → /.env.old~ [env-production] → /web/.env.local [env-production] → /app.json [heroku-app-json] → /docker/.env [env-production] | Omegatech LTD | US |
| ai-devbox-1 | 159.26.110.179 | 48 | / [tarpit-module] → / [tarpit] → /.env [issued] → /wp-config.php [wp-config] → /.env.production [env-production] → /.aws/credentials [aws-credentials-file] → /.env.prod [env-production] → /.ssh/id_rsa [ssh-private-key-error] → /config.json [config-json] → /dump.sql [sql-dump] → /.claude/.credentials.json [claude-credentials] → /appsettings.json [appsettings-json] | Proton AG | PL |
| ai-devbox-1 | 102.220.161.87 | 35 | / [tarpit-module] → / [tarpit] → /pscan-4d4df521-nonexistent.txt [not-handled] → /app/.env [env-production] → /admin/.env [env-production] → /laravel/.env [env-production] → /api/.env [env-production] → /config/php.ini [not-handled] → /admin/config [cmd-injection-probe] → /index.html [tarpit-module] → /phpinfo.php [phpinfo] → /test.php [phpinfo] | VPS Dedicated LLC | SI |
| ai-devbox-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 143.110.213.72 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 139.59.143.102 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 159.89.174.87 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | IN |
| ai-devbox-1 | 159.65.18.197 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| ai-devbox-1 | 139.59.132.8 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 165.227.39.235 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 64.227.70.2 | 25 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |