flux fleet digest — 2026-09-12 07:32 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
canary-farm-1 4185 153 5023 230 -17%
ai-devbox-1 3562 121 21209 289 -83%
control-1 0 0 3126 89 -100%

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 app-config-python 41 9.9 4.2x
ai-devbox-1 firebase-json 27 8.5 3.2x
ai-devbox-1 rails-database-yml 24 5.7 4.2x
ai-devbox-1 ssh-private-key-error 70 21.4 3.3x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
e6e6f15a77e8 ⟳ 27 81 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 09-03 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe]
3e1c5eb879e7 ⟳ 18 123 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 8 53 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
7e61a9500d8b ⟳ 4 196 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
850993125b15 ⟳ 4 164 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
b07c7bb207b4 ⟳ 4 164 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
5c4b5dc2fb71 2 14 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 09-12 /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect]
c8e0534a08e8 2 80 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 09-12 /.env [issued] → /env.bak [env-production] → /laravel/.env [env-production] → /storage/.env [env-production] → /admin/.env [env-production] → /application/.env [env-production] → …

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
canary-farm-1 /aws_leak_probe_edee14a6 2026-09-12 03:31:20.735783-04:00
ai-devbox-1 /geoserver/ 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /webui 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /p/login/ 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /administrator/manifests/files/joomla.xml 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /info.asp 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /WebApp/js/UI_String.js 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /workplace/home.action 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /cgi-bin/authLogin.cgi 2026-09-12 03:15:41.522896-04:00
canary-farm-1 /wsman 2026-09-12 03:15:41.522896-04:00
canary-farm-1 /api/sonicos/auth 2026-09-12 03:15:41.522896-04:00
canary-farm-1 /.crypto 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /versions 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /officescan/console/html/localization.js 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /kylin/ 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /pom.xml 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /hx/api/about 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /dana-na/nc/nc_gina_ver.txt 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /helpdesk/WebObjects/Helpdesk.woa 2026-09-12 03:15:41.522896-04:00
ai-devbox-1 /lms/db 2026-09-12 03:15:41.522896-04:00

New user agents:

sensor user agent first seen
canary-farm-1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple 2026-09-12 03:31:20.793459-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-12 03:31:20.793459-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
canary-farm-1 94.154.46.249 2100 107 1042 09-11 13:47 09-11 13:48 - Omegatech LTD US 0
ai-devbox-1 94.154.46.246 1500 93 743 09-12 04:12 09-12 04:13 - Omegatech LTD US 0
ai-devbox-1 34.32.131.244 839 137 609 09-11 21:44 09-11 21:44 - Google LLC NL 12
canary-farm-1 136.70.175.146 839 138 609 09-12 06:33 09-12 06:34 - Google LLC US 12
ai-devbox-1 172.237.88.137 168 21 121 09-11 07:46 09-11 07:46 ipsum:1 Akamai Connected Cloud SG 1
ai-devbox-1 160.177.217.115 152 15 38 09-11 20:59 09-11 21:24 - Office National des Postes e MA 18
canary-farm-1 160.177.217.115 148 15 38 09-11 21:38 09-11 21:43 - Office National des Postes e MA 18
canary-farm-1 213.209.159.175 114 16 112 09-11 23:01 09-11 23:01 ipsum:3 firehol2 Feo Prest SRL DE 0
ai-devbox-1 80.94.95.211 102 12 49 09-11 06:53 09-12 02:32 - SS-Net RO 0
canary-farm-1 91.92.47.27 88 15 56 09-11 18:55 09-11 20:13 - TechTies Inc. NL 0
ai-devbox-1 89.248.172.33 49 3 1 09-11 05:50 09-12 07:01 ipsum:1 IP Volume inc NL 0
ai-devbox-1 85.239.149.72 49 7 44 09-11 05:29 09-11 05:29 - Dedik Services Limited DE 7
canary-farm-1 45.43.37.254 49 7 44 09-11 22:48 09-11 22:48 ipsum:4 UCLOUD INFORMATION TECHNOLOG TW 7
canary-farm-1 89.248.172.33 49 3 1 09-11 05:49 09-12 07:00 ipsum:1 IP Volume inc NL 0
ai-devbox-1 129.121.128.70 49 7 44 09-11 22:50 09-11 22:50 - Oracle Corporation US 7

Canary economics (24h)

sensor mints distinct minting IPs
canary-farm-1 28 11
ai-devbox-1 48 12
control-1 0 0

Mint failures (24h): canary-farm-1:400x21

Mints by type label:

sensor types mints
ai-devbox-1 ["aws"] 48
canary-farm-1 ["aws"] 28

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 373
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 3379
ai-devbox-1 https 183
canary-farm-1 http 3995
canary-farm-1 https 190

Top Host headers:

sensor host events
canary-farm-1 109.123.246.142 3804
ai-devbox-1 217.15.163.226 3023
canary-farm-1 sso.rightabouteverything.show 367
ai-devbox-1 inference.fapthropic.com 362
ai-devbox-1 vmi3177282.contaboserver.net 164
ai-devbox-1 ip-api.com 2
canary-farm-1 azenv.net 1
ai-devbox-1 192.0.2.1 1
ai-devbox-1 azenv.net 1
canary-farm-1 192.0.2.1 1

Control node discovery velocity

  • first event ever: 2026-08-28 11:22 UTC (14 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98
2026-09-04 4632 100
2026-09-03 2361 105
2026-09-02 4068 105
2026-09-01 15373 107
2026-08-31 24100 88
2026-08-30 3186 70
2026-08-29 2052 39

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 136.70.175.146 138 / [tarpit-module] → /aws_leak_probe_edee14a6 [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] → /.env.local [env-production] → /@fs/proc/1/environ [vite-fs-proc-environ] → /aws/credentials [aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] Google LLC US
ai-devbox-1 34.32.131.244 137 / [tarpit-module] → /aws_leak_probe_d349c160 [not-handled] → /.env [issued] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/proc/self/environ [vite-fs-proc-environ] → /.aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] → /etc/passwd [not-handled] → /.azure/credentials [azure-credentials-file] → /.env.local [env-production] → /@fs/proc/1/environ [vite-fs-proc-environ] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] Google LLC NL
canary-farm-1 94.154.46.249 107 /.git/HEAD [fake-git] → /package-lock.json [package-lock-json-error] → /config/app.php [app-config-php-services] → /composer.lock [not-handled] → /config/database.php [app-config-php-database] → /.npmrc [npmrc-error] → /Gemfile.lock [not-handled] → /.circleci/config.yml [generic-ci-config] → /.gitlab-ci.yml [gitlab-ci] → /.yarnrc [yarnrc-error] → /docker-compose.override.yml [docker-compose] → /.ssh/authorized_keys [authorized-keys-error] Omegatech LTD US
ai-devbox-1 94.154.46.246 93 /composer.lock [not-handled] → /wp-config.php.old [wp-config] → /composer.json [not-handled] → /configuration.php [app-config-php] → /config/settings.py [app-config-python] → /config/database.php [app-config-php-database] → /wp-config.php [wp-config] → /.aws/config [aws-config-file] → /config.php [app-config-php] → /yarn.lock [yarn-lock-error] → /.git/config [fake-git] → /config/app.php [app-config-php-services] Omegatech LTD US
ai-devbox-1 207.154.197.113 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 139.59.143.102 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 167.71.81.114 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 64.23.218.208 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 159.89.12.166 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 159.65.18.197 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
ai-devbox-1 159.65.18.197 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
ai-devbox-1 165.227.173.41 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 172.237.88.137 21 / [tarpit-module] → /cgi-mod/header_logo.cgi [not-handled] → /health [observability-health] → /favicon.ico [tarpit-module] → /+CSCOE+/logon.html [cisco-webvpn-logon] → /dana-cached/hc/HostCheckerInstaller.osx [ivanti-hostchecker-installer] → /dniapi/userInfos [not-handled] → /CFIDE/componentutils/ [coldfusion-componentutils] → /user [not-handled] → /geoserver/index.html [geoserver-web-landing] → /api/v2/about [nextjs-api] → /dana-na/nc/nc_gina_ver.txt [ivanti-nc-gina-ver] Akamai Connected Cloud SG
canary-farm-1 213.209.159.175 16 / [tarpit-module] → /.env [issued] → /backend/.env [env-production-error] → /api/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /phpinfo/ [not-handled] → /admin/.env [env-production-error] → /phpinfo.php [phpinfo-error] → /.env.example [env-production-error] → /app/.env [env-production-error] → /app_dev.php/_profiler/open [symfony-parameters-yml-error] → /appsettings.json [appsettings-json-error] Feo Prest SRL DE
canary-farm-1 91.92.47.27 15 /.DS_Store [ds-store] → /.aws/config [aws-config-file] → /.aws/config.yaml [not-handled] → /.aws/credentials [aws-credentials-file] → /.aws/credentials.gpg [not-handled] → /.aws/keys.conf [not-handled] → /.cargo/credentials [cargo-credentials] → /.aws/s3/secrets.yaml [not-handled] → /.boto [boto-config] → /.cache/huggingface/token [huggingface-token] → /.azure/accessTokens.json [azure-cli-access-tokens] → /.cargo/credentials.toml [not-handled] TechTies Inc. NL