flux fleet digest — 2026-09-10 07:36 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 3565 | 253 | 5552 | 216 | -36% |
| ai-devbox-1 | 2438 | 144 | 21473 | 288 | -89% |
| control-1 | 5026 | 95 | 3339 | 100 | +51% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| canary-farm-1 | docker-registry-manifest | 90 | 30.0 | 3.0x |
| canary-farm-1 | docker-registry-tags | 90 | 30.0 | 3.0x |
| canary-farm-1 | fake-git-error | 177 | 5.0 | 35.4x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 61 | 183 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 43 | 301 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4da4da41b920 ⟳ | 14 | 84 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 850993125b15 ⟳ | 11 | 533 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 6 | 328 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7e61a9500d8b ⟳ | 6 | 294 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| c540fc530a5a ⟳ | 5 | 195 | canary-farm-1 | 09-03 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 9ff5e462ca0e ⟳ | 4 | 36 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-06 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| control-1 | /cttvd0gtdq4zcsz3 | 2026-09-10 03:32:19.523567-04:00 |
| canary-farm-1 | /.git/.aws/credentials | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/application-prod.yml | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/terraform.tfstate.backup | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git:8080/login | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/main/api/session/properties | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/login.action | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/main/api/index.php/v1/config/application | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master:8080/default/en_US/index.html | 2026-09-10 03:15:34.752815-04:00 |
| control-1 | /auth1.html | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /config.backup | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /config/tsconfig.json | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/src/.env | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/actuator/env | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/dump.sql | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /api/v1/applications | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/master/solr/admin/info/system | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /api/v1 | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/minio/health/live | 2026-09-10 03:15:34.752815-04:00 |
| canary-farm-1 | /.git/refs/heads/main:8080/login | 2026-09-10 03:15:34.752815-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| canary-farm-1 | Mozilla/5.0 (compatible; getdomaindata/1.0; +https://getdoma | 2026-09-10 03:32:19.586726-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-10 03:15:34.839194-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-10 03:15:34.839194-04:00 |
| control-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 2026-09-10 03:15:34.839194-04:00 |
| control-1 | 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 | 2026-09-10 03:15:34.839194-04:00 |
| control-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Geck | 2026-09-10 03:15:34.839194-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.17) Gec | 2026-09-10 03:15:34.839194-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.11) Gec | 2026-09-10 03:15:34.839194-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.4) Geck | 2026-09-10 03:15:34.839194-04:00 |
| canary-farm-1 | Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 | 2026-09-10 03:15:34.839194-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| control-1 | 204.76.203.18 | 2309 | 3 | 575 | 09-09 03:37 | 09-10 07:31 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| control-1 | 94.154.46.242 | 1050 | 107 | 1042 | 09-09 16:38 | 09-09 16:39 | - | Omegatech LTD | US | 0 |
| canary-farm-1 | 34.6.12.67 | 839 | 137 | 609 | 09-09 09:09 | 09-09 09:09 | - | Google LLC | NL | 12 |
| control-1 | 136.70.70.191 | 837 | 138 | 609 | 09-09 03:53 | 09-09 03:54 | - | Google LLC | US | 12 |
| ai-devbox-1 | 176.65.144.71 | 639 | 88 | 634 | 09-09 21:55 | 09-09 21:56 | - | Dedik Services Limited | CH | 0 |
| canary-farm-1 | 43.228.157.68 | 267 | 28 | 223 | 09-09 20:00 | 09-09 20:05 | ipsum:2 firehol2 | Ghosty Networks LLC | PK | 0 |
| ai-devbox-1 | 160.178.89.73 | 188 | 19 | 46 | 09-09 23:00 | 09-09 23:34 | - | Office National des Postes e | MA | 18 |
| canary-farm-1 | 160.178.89.73 | 174 | 18 | 45 | 09-09 23:10 | 09-09 23:23 | - | Office National des Postes e | MA | 18 |
| control-1 | 213.209.159.154 | 171 | 14 | 170 | 09-09 04:47 | 09-09 04:47 | - | Feo Prest SRL | DE | 0 |
| canary-farm-1 | 213.209.159.154 | 171 | 14 | 169 | 09-09 23:15 | 09-09 23:15 | - | Feo Prest SRL | DE | 0 |
| ai-devbox-1 | 167.71.81.114 | 119 | 36 | 36 | 09-09 20:46 | 09-09 22:05 | - | DigitalOcean, LLC | US | 9 |
| ai-devbox-1 | 104.36.50.16 | 104 | 23 | 67 | 09-09 20:17 | 09-09 20:19 | - | HostRoyale Technologies Pvt | US | 7 |
| canary-farm-1 | 102.220.161.87 | 101 | 33 | 98 | 09-09 13:43 | 09-09 13:47 | - | VPS Dedicated LLC | SI | 0 |
| ai-devbox-1 | 164.92.244.132 | 82 | 27 | 36 | 09-09 14:26 | 09-09 20:39 | ipsum:1 | DigitalOcean, LLC | DE | 6 |
| canary-farm-1 | 206.189.95.232 | 82 | 27 | 36 | 09-09 14:22 | 09-09 21:44 | ipsum:1 | DigitalOcean, LLC | SG | 6 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| control-1 | 11 | 3 |
| ai-devbox-1 | 20 | 14 |
| canary-farm-1 | 41 | 15 |
Mint failures (24h): ai-devbox-1:400x12; canary-farm-1:400x10; control-1:400x23
Mints by type label:
| sensor | types | mints |
|---|---|---|
| control-1 | ["aws"] | 11 |
| canary-farm-1 | ["aws"] | 41 |
| ai-devbox-1 | ["aws"] | 20 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1575
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 1671 |
| ai-devbox-1 | https | 767 |
| canary-farm-1 | http | 2757 |
| canary-farm-1 | https | 808 |
| control-1 | http | 5026 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| control-1 | 38.54.2.209 | 5013 |
| canary-farm-1 | 109.123.246.142 | 2202 |
| canary-farm-1 | sso.rightabouteverything.show | 1354 |
| ai-devbox-1 | inference.fapthropic.com | 1270 |
| ai-devbox-1 | 217.15.163.226 | 1162 |
| control-1 | 127.0.0.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (12 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-10 | 5026 | 95 |
| 2026-09-09 | 3265 | 68 |
| 2026-09-08 | 3376 | 120 |
| 2026-09-07 | 3256 | 108 |
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| control-1 | 136.70.70.191 | 138 | / [tarpit-module] → /aws_leak_probe_f0b17e77 [not-handled] → /.env [issued] → /etc/passwd [not-handled] → /app/.env [env-production] → /@fs/etc/passwd [vite-fs-etc-passwd] → /.aws/credentials [aws-credentials-file] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] → /.azure/credentials [azure-credentials-file] → /proc/self/environ [proc-environ] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] | Google LLC | US |
| canary-farm-1 | 34.6.12.67 | 137 | / [tarpit-module] → /aws_leak_probe_2842dfbd [not-handled] → /.env [issued] → /@fs/proc/1/environ [vite-fs-proc-environ] → /.env.local [env-production] → /.aws/credentials [aws-credentials-file] → /etc/passwd [not-handled] → /@fs/proc/self/environ [vite-fs-proc-environ] → /proc/self/environ [proc-environ] → /aws/credentials [aws-credentials-file] → /app/.env [env-production] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] | Google LLC | NL |
| control-1 | 94.154.46.242 | 107 | /config.json [config-json] → /config/database.php [app-config-php-database] → /composer.json [not-handled] → /wp-config.php [wp-config] → /env [actuator-env] → /package-lock.json [package-lock-json-error] → /wp-config.php.old [wp-config] → /.aws/config [aws-config-file] → /wp-config.php.bak [wp-config] → /wp-config.bak [wp-config] → /docker-compose.override.yml [docker-compose] → /.git/HEAD [fake-git] | Omegatech LTD | US |
| ai-devbox-1 | 176.65.144.71 | 88 | /docker-compose.yml [docker-compose] → /env.txt [env-production] → /.env_backup [env-production] → /yarn.lock [yarn-lock-error] → /.git/config [fake-git] → /.git/HEAD [fake-git] → /instance/config.py [app-config-python] → /.gitlab-ci.yml [gitlab-ci] → /wp-config.php~ [wp-config] → /.env.template [env-production] → /config.py [app-config-python] → /.env_old [env-production] | Dedik Services Limited | CH |
| ai-devbox-1 | 167.71.81.114 | 36 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| canary-farm-1 | 102.220.161.87 | 33 | / [tarpit-module] → /pscan-c187abdc-nonexistent.txt [not-handled] → /app/.env [env-production] → /admin/.env [env-production] → /laravel/.env [env-production] → /api/.env [env-production] → /config/php.ini [not-handled] → /admin/config [cmd-injection-probe] → /index.html [tarpit-module] → /phpinfo.php [phpinfo] → /test.php [phpinfo] → /config.properties [app-config-properties] | VPS Dedicated LLC | SI |
| canary-farm-1 | 43.228.157.68 | 28 | / [tarpit-module] → /.git/ [fake-git-error] → /.git/refs/heads/main/ [fake-git-error] → /.git/refs/heads/master/ [fake-git-error] → /.git/api/.env [tarpit-module] → /.git/refs/heads/master/.env_production [tarpit-module] → /.git/refs/heads/master/.env.bak [tarpit-module] → /.git/refs/heads/master/config/.env [tarpit-module] → /.git/refs/heads/master/public/.env [tarpit-module] → /.git/refs/heads/master/web/.env [tarpit-module] → /.git/refs/heads/master/app/.env [tarpit-module] → /.git/refs/heads/master/.env.docker [tarpit-module] | Ghosty Networks LLC | PK |
| ai-devbox-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 64.227.70.2 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 206.189.19.19 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 143.244.168.161 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | US |
| ai-devbox-1 | 209.97.180.8 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| canary-farm-1 | 139.59.143.102 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 164.90.208.56 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 164.92.244.132 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |