flux fleet digest — 2026-09-13 07:37 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 3824 57 20853 266 -82%
canary-farm-1 2712 75 4791 217 -43%
control-1 4254 53 2820 82 +51%
frantech-ts 2293 1 116 1 +1877%
netcup-ts 1765 1 53 1 +3230%
ru-edge-1 1165 1 104 1 +1020%
sponge-01-ts 2204 1 375 1 +488%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 wp-xmlrpc-post 60 0.0 infx
control-1 app-config-php-error 28 4.8 5.9x
control-1 app-config-python-error 30 4.3 6.9x
control-1 app-config-yaml-error 23 7.7 3.0x
control-1 aws-credentials-file-error 38 11.3 3.4x
control-1 config-json-error 20 3.8 5.2x
control-1 env-production-error 487 80.2 6.1x
control-1 phpinfo-error 51 8.7 5.9x
control-1 webapp-config-bundle-js-error 34 11.3 3.0x
control-1 webshell-sweep-observed 33 5.1 6.4x
control-1 wp-config-error 37 9.5 3.9x
frantech-ts not-handled 1325 83.0 16.0x
frantech-ts phpunit-eval-stdin 112 0.0 infx
frantech-ts tarpit 26 1.0 26.0x
frantech-ts tarpit-disconnect 26 1.0 26.0x
frantech-ts tarpit-module 713 25.0 28.5x
frantech-ts webshell-sweep-observed 25 0.0 infx
netcup-ts not-handled 871 4.0 217.8x
netcup-ts phpunit-eval-stdin 39 0.0 infx
netcup-ts tarpit 22 4.0 5.5x
netcup-ts tarpit-disconnect 21 4.0 5.2x
netcup-ts tarpit-module 745 32.0 23.3x
ru-edge-1 aws-credentials-file-error 28 0.0 infx
ru-edge-1 env-production 24 0.0 infx
ru-edge-1 env-production-error 69 0.0 infx
ru-edge-1 firebase-json-error 28 0.0 infx
ru-edge-1 not-handled 202 61.0 3.3x
ru-edge-1 phpunit-eval-stdin 74 0.0 infx
ru-edge-1 tarpit-module 232 23.0 10.1x
sponge-01-ts not-handled 1390 40.0 34.8x
sponge-01-ts tarpit 21 4.0 5.2x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
e6e6f15a77e8 ⟳ 35 105 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 09-03 /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe]
3e1c5eb879e7 ⟳ 9 63 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 4 28 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
d3f27a8fb79f 2 206 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 09-13 / [tarpit-module] → /.git/config [fake-git-error] → / [tarpit-module] → /.DS_Store [ds-store] → / [tarpit-module] → / [tarpit] → …
76d212a95300 ⟳ 2 78 ai-devbox-1 09-03 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
c540fc530a5a ⟳ 2 78 canary-farm-1 09-03 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
fd169a55036f 1 1500 ai-devbox-1 09-13 /composer.lock [not-handled] → /wp-config.php.old [wp-config] → /composer.json [not-handled] → /configuration.php [app-config-php] → /config/settings.py [app-config-python] → /config/database.php [app
303811c5ab0a 1 47 canary-farm-1 09-13 /.git/HEAD [fake-git] → /.git/refs/heads/main [fake-git] → /.git/config [fake-git] → /.git/description [fake-git] → /.git/info/exclude [fake-git] → /.git/info/refs [fake-git] → …

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
control-1 /ai/site-profile.json 2026-09-13 03:31:58.976775-04:00
control-1 /api/files 2026-09-13 03:31:58.976775-04:00
sponge-01-ts /aws_leak_probe_7958bac7 2026-09-13 03:31:58.976775-04:00
control-1 /aws_leak_probe_079084eb 2026-09-13 03:31:58.976775-04:00
ru-edge-1 /boaform/admin/formLogin 2026-09-13 03:31:58.976775-04:00
ai-devbox-1 /v3/.env 2026-09-13 03:15:36.666970-04:00
ai-devbox-1 /bucket-name/config/.env 2026-09-13 03:15:36.666970-04:00
ai-devbox-1 /api/.env/wp-includes/leaf 2026-09-13 03:15:36.666970-04:00
ai-devbox-1 /frontend/sendgrid.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /.aws/credentials 2026-09-13 03:15:36.666970-04:00
frantech-ts /.env.php-backup 2026-09-13 03:15:36.666970-04:00
frantech-ts /twilio/.local/bin/aws/config/.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /twilio/.conda/bin/aws/config/.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /module/.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /laravel-sites/dev_grupo_total/.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /.env-openid 2026-09-13 03:15:36.666970-04:00
frantech-ts /.azure/.env 2026-09-13 03:15:36.666970-04:00
frantech-ts /vendor/phpunit/Util/PHP/eval-stdin.php 2026-09-13 03:15:36.666970-04:00
frantech-ts /phpunit/phpunit/Util/PHP/eval-stdin.php 2026-09-13 03:15:36.666970-04:00
frantech-ts /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 2026-09-13 03:15:36.666970-04:00

New user agents:

sensor user agent first seen
sponge-01-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Linux; Android 15; SM-G930P; Build/AP4A.190211. 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Apple 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/6 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple 2026-09-13 03:32:00.439721-04:00
sponge-01-ts Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537 2026-09-13 03:32:00.439721-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
ai-devbox-1 94.154.46.246 1500 93 743 09-12 04:12 09-12 04:13 - Omegatech LTD US 0
canary-farm-1 136.70.175.146 839 138 609 09-12 06:33 09-12 06:34 - Google LLC US 12
canary-farm-1 103.81.230.80 104 23 67 09-12 22:05 09-12 22:07 - HostRoyale Technologies Pvt US 7
ai-devbox-1 103.81.230.80 102 23 65 09-12 20:10 09-12 20:14 - HostRoyale Technologies Pvt US 7
canary-farm-1 129.213.151.234 47 2 45 09-12 05:02 09-12 05:03 - Oracle Corporation US 0
ai-devbox-1 45.156.128.126 43 5 37 09-12 07:35 09-12 07:35 ipsum:2 Sistemas Informaticos, S.A. PT 0
canary-farm-1 138.68.144.227 39 25 34 09-12 20:35 09-12 20:36 ipsum:1 DigitalOcean, LLC GB 3
canary-farm-1 157.245.113.227 39 25 34 09-12 20:35 09-12 20:36 ipsum:1 DigitalOcean, LLC US 3
ai-devbox-1 167.99.181.249 39 25 34 09-12 20:30 09-12 20:31 ipsum:1 DigitalOcean, LLC CA 3
ai-devbox-1 68.183.9.16 39 25 34 09-12 20:30 09-12 20:31 ipsum:1 DigitalOcean, LLC NL 3
ai-devbox-1 45.156.128.47 26 1 26 09-12 07:35 09-12 07:35 ipsum:2 Sistemas Informaticos, S.A. PT 0
ai-devbox-1 104.219.251.64 12 2 1 09-12 12:10 09-12 23:36 - Namecheap, Inc. US 4
ai-devbox-1 47.254.122.247 7 3 1 09-12 07:09 09-12 07:09 - Alibaba (US) Technology Co., US 0
canary-farm-1 74.7.230.38 7 3 1 09-12 19:00 09-12 19:00 ipsum:1 Microsoft Corporation US 0
ai-devbox-1 185.226.197.73 7 3 1 09-12 05:13 09-12 05:13 ipsum:3 Zenlayer Inc PT 0

Canary economics (24h)

sensor mints distinct minting IPs
ru-edge-1 3 1
control-1 5 1
canary-farm-1 13 3
ai-devbox-1 18 5

Mint failures (24h): canary-farm-1:400x44; ru-edge-1:400x13; control-1:400x40; ai-devbox-1:400x45

Mints by type label:

sensor types mints
canary-farm-1 ["aws"] 13
ru-edge-1 ["aws"] 3
control-1 ["aws"] 5
ai-devbox-1 ["aws"] 18

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 625
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 50
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 3545
ai-devbox-1 https 279
canary-farm-1 http 2423
canary-farm-1 https 289
control-1 http 4253
control-1 https 1
frantech-ts http 2293
netcup-ts http 1765
ru-edge-1 http 1165
sponge-01-ts http 2204

Top Host headers:

sensor host events
control-1 38.54.2.209 4167
ai-devbox-1 217.15.163.226 3270
sponge-01-ts 89.167.72.144 2188
canary-farm-1 109.123.246.142 2019
frantech-ts 209.141.62.110 1931
netcup-ts 159.195.21.150 1755
ru-edge-1 130.94.89.46 1151
canary-farm-1 sso.rightabouteverything.show 631
ai-devbox-1 inference.fapthropic.com 515
frantech-ts we-love-the.world 98

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (0 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-13 4254 53
2026-09-12 1813 51
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98
2026-09-04 4632 100
2026-09-03 2361 105
2026-09-02 4068 105
2026-09-01 15373 107
2026-08-31 24100 88

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 136.70.175.146 138 / [tarpit-module] → /aws_leak_probe_edee14a6 [not-handled] → /.env [issued] → /@fs/proc/self/environ [vite-fs-proc-environ] → /etc/passwd [not-handled] → /.aws/credentials [aws-credentials-file] → /proc/self/environ [proc-environ] → /.env.local [env-production] → /@fs/proc/1/environ [vite-fs-proc-environ] → /aws/credentials [aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /@fs/etc/passwd [vite-fs-etc-passwd] Google LLC US
ai-devbox-1 94.154.46.246 93 /composer.lock [not-handled] → /wp-config.php.old [wp-config] → /composer.json [not-handled] → /configuration.php [app-config-php] → /config/settings.py [app-config-python] → /config/database.php [app-config-php-database] → /wp-config.php [wp-config] → /.aws/config [aws-config-file] → /config.php [app-config-php] → /yarn.lock [yarn-lock-error] → /.git/config [fake-git] → /config/app.php [app-config-php-services] Omegatech LTD US
ai-devbox-1 167.99.181.249 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
canary-farm-1 157.245.113.227 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
ai-devbox-1 68.183.9.16 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
canary-farm-1 138.68.144.227 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
ai-devbox-1 103.81.230.80 23 / [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit] → / [tarpit-disconnect] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /index.php [tarpit-module] HostRoyale Technologies Pvt US
canary-farm-1 103.81.230.80 23 / [tarpit-module] → /.git/config [fake-git-error] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] → /wp-json/batch/v1 [wp-batch-multiplex] → /index.php [tarpit-module] HostRoyale Technologies Pvt US
ai-devbox-1 45.156.128.126 5 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /wp-json [wp-rest-index] → /wp-content/plugins/wp-central/readme.txt [not-handled] → /wp-content/plugins/wpschoolpress/readme.txt [not-handled] → /wp-content/plugins/wp-video-lightbox/readme.txt [not-handled] → /wp-content/plugins/kingcomposer/readme.txt [not-handled] → /wp-content/plugins/fancy-product-designer/readme.txt [not-handled] → /wp-content/plugins/contact-form-7/readme.txt [not-handled] → /wp-content/plugins/wordpress-seo/readme.txt [not-handled] → /wp-content/plugins/akismet/readme.txt [not-handled] Sistemas Informaticos, S.A. PT
ai-devbox-1 109.174.130.45 3 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] M247 Europe SRL AE
ai-devbox-1 47.254.122.247 3 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] Alibaba (US) Technology Co., US
canary-farm-1 74.7.230.38 3 /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] Microsoft Corporation US
ai-devbox-1 43.155.162.41 3 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] Tencent Building, Kejizhongy KR
canary-farm-1 80.169.110.222 3 /wp-json/ [wp-rest-index] → / [tarpit-module] → / [tarpit] COLT Technology Services Gro BE
ai-devbox-1 34.90.215.190 3 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] Google LLC NL

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 533 sources sent credentials → 349 got a shell (65%) → 253 ran a command (72% of shell-getters, 47% of sources)
  • event level: 38787 credential attempts → 17886 accepted logins → 12281 commands (69% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 538 attempts

New commands this window (0 of 53 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
4570 7 109.160.32.114 "uname -m | awk '{printf $1}'"
4570 7 109.160.32.114 "uname -s -v -n -r -m"
1078 103 113.88.78.112 "cd ~; chattr -ia .ssh; lockr -ia .ssh"
931 94 113.88.78.112 "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b
246 6 2.57.122.150 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -
246 6 2.57.122.150 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
191 122 125.20.60.69 "uname -a 2>/dev/null"
113 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/

Credentials: 17232 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:

attempts user password
1038 345gs5662d34 345gs5662d34
788 root 3245gs5662d34
119 root root
65 root 123456
59 admin 3245gs5662d34
58 pi raspberry
54 user wasd
52 support support