flux fleet digest — 2026-09-11 07:32 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor | events | uniq IPs | 7d avg events | 7d avg uniq | events delta |
|---|---|---|---|---|---|
| canary-farm-1 | 9728 | 179 | 5222 | 232 | +86% |
| ai-devbox-1 | 2914 | 128 | 21045 | 290 | -86% |
| control-1 | 481 | 35 | 3719 | 98 | -87% |
Result-tag spikes (campaign candidates)
| sensor | result | 24h | 7d avg | ratio |
|---|---|---|---|---|
| ai-devbox-1 | app-config-php | 30 | 8.3 | 3.6x |
| ai-devbox-1 | app-config-python | 40 | 4.3 | 9.3x |
| ai-devbox-1 | cmd-injection-php-cgi-rce | 32 | 5.3 | 6.1x |
| ai-devbox-1 | phpunit-eval-stdin | 222 | 49.6 | 4.5x |
| ai-devbox-1 | rails-database-yml | 22 | 2.9 | 7.7x |
| ai-devbox-1 | ssh-private-key-error | 54 | 16.0 | 3.4x |
| canary-farm-1 | method-not-allowed | 30 | 7.9 | 3.8x |
| canary-farm-1 | wp-xmlrpc-post | 8131 | 1300.0 | 6.3x |
Campaign clusters (24h, journey-fingerprinted)
| signature | IPs | events | sensors | first seen | sample journey (6 steps) |
|---|---|---|---|---|---|
| e6e6f15a77e8 ⟳ | 33 | 99 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-03 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ | 32 | 221 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 08-29 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4da4da41b920 ⟳ | 9 | 54 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 09-04 | /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 7e61a9500d8b ⟳ | 9 | 441 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-29 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 1cf777711bea ⟳ | 6 | 57 | ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE | 09-03 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 4b4cc0ece037 ⟳ | 6 | 39 | ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE | 08-30 | / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 850993125b15 ⟳ | 4 | 164 | canary-farm-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ | 4 | 164 | ai-devbox-1 | 08-29 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor | path | first seen |
|---|---|---|
| ai-devbox-1 | /wp-content/plugins/wp-video-lightbox/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /redfish/v1/ | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /redfish | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/optinmonster/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| canary-farm-1 | /nice ports,/Trinity.txt.bak | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /m23la5f96prih5wk | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/kingcomposer/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/wp-central/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /ai/site-profile.json | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/wordpress-database-reset/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| canary-farm-1 | /pk_m84ygqskf2f | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /redfish/v1 | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/iwp-client/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/wp-user-avatar/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/wp-time-capsule/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/wpschoolpress/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| canary-farm-1 | /wp-json/wp/v2/users | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/fancy-product-designer/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
| ai-devbox-1 | /wp-content/plugins/bbpress/readme.txt | 2026-09-11 03:15:38.960765-04:00 |
New user agents:
| sensor | user agent | first seen |
|---|---|---|
| ai-devbox-1 | Mozilla/5.0 (compatible; nmap-http-info) | 2026-09-11 03:31:24.965215-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_7) AppleWebKit/5 | 2026-09-11 03:31:24.965215-04:00 |
| canary-farm-1 | Mozilla/5.0 (compatible; Nmap Scripting Engine; http://nmap. | 2026-09-11 03:15:43.969839-04:00 |
| ai-devbox-1 | python-requests/2.25.1 | 2026-09-11 03:15:43.969839-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-11 03:15:43.969839-04:00 |
| ai-devbox-1 | Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.8.1.1) Gecko/20 | 2026-09-11 03:15:43.969839-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20 | 2026-09-11 03:15:43.969839-04:00 |
| canary-farm-1 | Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firef | 2026-09-11 03:15:43.969839-04:00 |
| canary-farm-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/ | 2026-09-11 03:15:43.969839-04:00 |
| ai-devbox-1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ | 2026-09-11 03:15:43.969839-04:00 |
Top talkers (24h)
| sensor | IP | events | trap fams | paths | first | last | blocklist | ASN org | cc | POSTed |
|---|---|---|---|---|---|---|---|---|---|---|
| canary-farm-1 | 207.175.64.93 | 8139 | 5 | 5 | 09-10 11:26 | 09-10 11:30 | - | Google LLC | BE | 8131 |
| ai-devbox-1 | 94.154.46.245 | 1500 | 93 | 743 | 09-10 16:25 | 09-10 16:25 | - | Omegatech LTD | US | 0 |
| control-1 | 204.76.203.18 | 349 | 2 | 347 | 09-10 03:53 | 09-10 07:31 | ipsum:2 | Pfcloud UG (haftungsbeschran | NL | 0 |
| canary-farm-1 | 109.205.211.201 | 145 | 2 | 142 | 09-10 04:51 | 09-10 20:50 | - | MEVSPACE sp. z o.o. | AZ | 0 |
| canary-farm-1 | 2a01:4f8:161:34c1::2 | 144 | 2 | 142 | 09-11 03:21 | 09-11 03:21 | - | Hetzner Online GmbH | DE | 0 |
| ai-devbox-1 | 2a01:4f8:161:34c1::2 | 144 | 2 | 142 | 09-11 02:19 | 09-11 02:19 | - | Hetzner Online GmbH | DE | 0 |
| ai-devbox-1 | 80.94.95.211 | 102 | 12 | 49 | 09-10 11:06 | 09-11 06:55 | - | SS-Net | RO | 0 |
| ai-devbox-1 | 195.178.110.53 | 92 | 9 | 12 | 09-10 11:07 | 09-10 11:08 | - | Techoff Srv Limited | BG | 78 |
| canary-farm-1 | 213.209.159.175 | 51 | 12 | 49 | 09-10 22:43 | 09-10 22:43 | ipsum:3 firehol2 | Feo Prest SRL | DE | 0 |
| ai-devbox-1 | 23.88.108.246 | 49 | 7 | 44 | 09-10 07:01 | 09-10 07:01 | - | Hetzner Online GmbH | DE | 7 |
| ai-devbox-1 | 85.239.149.72 | 49 | 7 | 44 | 09-11 05:29 | 09-11 05:29 | - | Dedik Services Limited | DE | 7 |
| canary-farm-1 | 149.50.101.31 | 49 | 7 | 44 | 09-11 02:48 | 09-11 02:49 | - | MEVSPACE sp. z o.o. | PL | 7 |
| ai-devbox-1 | 160.250.132.238 | 49 | 7 | 44 | 09-10 19:22 | 09-10 19:22 | - | EZ TECHNOLOGY COMPANY LIMITE | VN | 7 |
| ai-devbox-1 | 13.83.90.155 | 49 | 7 | 44 | 09-10 17:58 | 09-10 17:59 | ipsum:4 | Microsoft Corporation | US | 7 |
| ai-devbox-1 | 89.248.172.33 | 49 | 3 | 1 | 09-10 04:44 | 09-11 05:50 | ipsum:1 | IP Volume inc | NL | 0 |
Canary economics (24h)
| sensor | mints | distinct minting IPs |
|---|---|---|
| canary-farm-1 | 9 | 9 |
| ai-devbox-1 | 19 | 9 |
| control-1 | 0 | 0 |
Mint failures (24h): none
Mints by type label:
| sensor | types | mints |
|---|---|---|
| canary-farm-1 | ["aws"] | 9 |
| ai-devbox-1 | ["aws"] | 19 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 855
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor | protocol | events |
|---|---|---|
| ai-devbox-1 | http | 2591 |
| ai-devbox-1 | https | 323 |
| canary-farm-1 | http | 9262 |
| canary-farm-1 | https | 466 |
| control-1 | http | 481 |
Top Host headers:
| sensor | host | events |
|---|---|---|
| canary-farm-1 | sso.rightabouteverything.show | 8748 |
| ai-devbox-1 | 217.15.163.226 | 2488 |
| canary-farm-1 | 109.123.246.142 | 928 |
| control-1 | 38.54.2.209 | 477 |
| ai-devbox-1 | inference.fapthropic.com | 418 |
| canary-farm-1 | vmi3243483.contaboserver.net | 38 |
| ai-devbox-1 | azenv.net | 1 |
| control-1 | 127.0.0.1 | 1 |
Control node discovery velocity
- first event ever: 2026-08-28 11:22 UTC (13 days live)
- daily unique-IP ramp (newest first):
| day | events | uniq IPs |
|---|---|---|
| 2026-09-11 | 481 | 35 |
| 2026-09-10 | 5026 | 95 |
| 2026-09-09 | 3265 | 68 |
| 2026-09-08 | 3376 | 120 |
| 2026-09-07 | 3256 | 108 |
| 2026-09-06 | 2523 | 99 |
| 2026-09-05 | 3958 | 98 |
| 2026-09-04 | 4632 | 100 |
| 2026-09-03 | 2361 | 105 |
| 2026-09-02 | 4068 | 105 |
| 2026-09-01 | 15373 | 107 |
| 2026-08-31 | 24100 | 88 |
| 2026-08-30 | 3186 | 70 |
| 2026-08-29 | 2052 | 39 |
Kill-chain watchlist (24h)
| sensor | IP | trap fams | journey (chronological) | ASN org | cc |
|---|---|---|---|---|---|
| ai-devbox-1 | 94.154.46.245 | 93 | /.dockerenv [not-handled] → /.git/index [fake-git] → /instance/config.py [app-config-python] → /.travis.yml [not-handled] → /config.js [webapp-config-bundle-js] → /compose/.env [env-production] → /.docker/.env [env-production] → /config.py [app-config-python] → /config.json [config-json] → /.env.1 [tarpit-module] → /.env.copy [env-production] → /.circleci/config.yml [generic-ci-config] | Omegatech LTD | US |
| canary-farm-1 | 143.110.213.72 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| canary-farm-1 | 139.59.132.8 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| canary-farm-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 167.99.210.137 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| ai-devbox-1 | 139.59.136.184 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | DE |
| ai-devbox-1 | 142.93.129.190 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | NL |
| canary-farm-1 | 159.89.127.165 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | CA |
| ai-devbox-1 | 46.101.1.225 | 27 | / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] | DigitalOcean, LLC | GB |
| ai-devbox-1 | 80.94.95.211 | 12 | / [tarpit-module] → /.env [issued] → /backend/.env [env-production] → /api/.env [env-production] → /sendgrid.env [mail-service-env] → /phpinfo/ [not-handled] → /admin/.env [env-production] → /phpinfo.php [phpinfo] → /.env.example [env-production] → /app/.env [env-production] → /app_dev.php/_profiler/open [symfony-parameters-yml] → /appsettings.json [appsettings-json] | SS-Net | RO |
| canary-farm-1 | 213.209.159.175 | 12 | / [tarpit-module] → /.env [issued] → /backend/.env [env-production] → /api/.env [env-production] → /sendgrid.env [mail-service-env] → /phpinfo/ [not-handled] → /admin/.env [env-production] → /phpinfo.php [phpinfo] → /.env.example [env-production] → /app/.env [env-production] → /app_dev.php/_profiler/open [symfony-parameters-yml] → /appsettings.json [appsettings-json] | Feo Prest SRL | DE |
| ai-devbox-1 | 195.178.110.53 | 9 | / [wp-batch-rejected] → /index.php [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-rejected] → /wp-json/Batch/v1 [wp-batch-rejected] → /wp-json/batch/v1/ [wp-batch-rejected] → /blog/wp-json/batch/v1 [wp-batch-rejected] → /wordpress/wp-json/batch/v1 [wp-batch-rejected] → /wp/v2/posts/999999 [not-handled] → / [wp-rest-single] → /wp/v2/pages [not-handled] → / [wp-rest-collection] → /wp-login.php [wp-login-probe] | Techoff Srv Limited | BG |
| control-1 | 157.230.128.50 | 7 | / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /auth.html [sonicwall-portal] → /auth1.html [not-handled] → /sslvpnLogin.html [not-handled] → /api/sonicos/auth [sonicwall-auth] → /api/sonicos/tfa [sonicwall-tfa] → /sonicui/7/sslvpn-portal/ [sonicwall-portal] | DigitalOcean, LLC | US |
| ai-devbox-1 | 160.250.132.238 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /test.hello [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | EZ TECHNOLOGY COMPANY LIMITE | VN |
| ai-devbox-1 | 60.49.60.81 | 7 | /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /test.hello [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /vendor/phpunit/phpunit/LICENSE/eval-stdin.php [phpunit-eval-stdin] → /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] | TM TECHNOLOGY SERVICES SDN. | MY |