flux fleet digest — 2026-09-14 07:33 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
2699 |
22 |
11106 |
172 |
-76% |
| canary-farm-1 |
4381 |
18 |
4606 |
182 |
-5% |
| control-1 |
3152 |
1 |
3067 |
76 |
+3% |
| frantech-ts |
1061 |
1 |
1204 |
1 |
-12% |
| netcup-ts |
1115 |
1 |
909 |
1 |
+23% |
| ru-edge-1 |
2331 |
1 |
634 |
1 |
+267% |
| sponge-01-ts |
1300 |
1 |
1290 |
1 |
+1% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
webshell-sweep-observed |
66 |
5.0 |
13.2x |
| canary-farm-1 |
app-config-php-error |
30 |
0.0 |
infx |
| canary-farm-1 |
app-config-python-error |
28 |
0.0 |
infx |
| canary-farm-1 |
aws-credentials-file-error |
35 |
4.2 |
8.3x |
| canary-farm-1 |
env-production-error |
434 |
77.8 |
5.6x |
| canary-farm-1 |
firebase-json-error |
32 |
7.0 |
4.6x |
| canary-farm-1 |
webshell-sweep-observed |
83 |
4.7 |
17.8x |
| canary-farm-1 |
wp-config-error |
33 |
1.0 |
33.0x |
| ru-edge-1 |
not-handled |
1659 |
131.5 |
12.6x |
| ru-edge-1 |
tarpit |
22 |
5.5 |
4.0x |
| ru-edge-1 |
tarpit-disconnect |
21 |
5.0 |
4.2x |
| sponge-01-ts |
phpunit-eval-stdin |
75 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| e6e6f15a77e8 ⟳ |
18 |
54 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ |
3 |
21 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4da4da41b920 ⟳ |
2 |
12 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-04 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 76d212a95300 ⟳ |
2 |
78 |
ai-devbox-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| c540fc530a5a ⟳ |
2 |
78 |
canary-farm-1 |
09-03 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 5c4b5dc2fb71 ⟳ |
1 |
7 |
canary-farm-1 |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
| 2db1533e1147 |
1 |
385 |
canary-farm-1 |
09-14 |
/ [tarpit-module] → /.github/workflows/deploy.yml [github-actions-workflow] → / [tarpit-module] → /.aws/credentials [aws-credentials-file] → /.git/config [fake-git] → /.env.local [env-production] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/parity/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/tests/default_settings/v12.0/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/Nodejs-Projects/play-ground/ManageUserRoles/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/lemonldap-ng-doc/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/application/.env.save |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/zmusic-frontend/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/babel-plugin-dotenv/test/fixtures/override-value/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/resources/docker/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/docker-network-healthcheck/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/resourcesync/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/github-connect/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/var/backup/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/staging/frontend/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/test/bdd/fixtures/demo/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/websocket/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/playground/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/src/assembly/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/ts/prime/.env |
2026-09-14 03:31:53.194911-04:00 |
| canary-farm-1 |
/vendor/github.com/gobuffalo/envy/.env |
2026-09-14 03:31:53.194911-04:00 |
| netcup-ts |
/sitemap.xml |
2026-09-14 03:31:53.194911-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| netcup-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-14 03:31:53.261410-04:00 |
| canary-farm-1 |
0day |
2026-09-14 03:31:53.261410-04:00 |
| frantech-ts |
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.c |
2026-09-14 03:31:53.261410-04:00 |
| frantech-ts |
masscan/1.0 (https://github.com/robertdavidgraham/masscan) |
2026-09-14 03:31:53.261410-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN0 |
2026-09-14 03:31:53.261410-04:00 |
| canary-farm-1 |
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR |
2026-09-14 03:31:53.261410-04:00 |
| canary-farm-1 |
Mozilla/5.0 (X11; Linux x86_64; rv:150.14) Gecko/20100101 Fi |
2026-09-14 03:16:02.067646-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 |
2026-09-14 03:16:02.067646-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 |
2026-09-14 03:16:02.067646-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537 |
2026-09-14 03:16:02.067646-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
136.117.52.210 |
385 |
93 |
262 |
09-14 00:41 |
09-14 00:41 |
- |
Google LLC |
US |
10 |
| ai-devbox-1 |
209.38.248.17 |
39 |
25 |
34 |
09-13 20:42 |
09-13 20:43 |
ipsum:1 |
DigitalOcean, LLC |
DE |
3 |
| canary-farm-1 |
159.89.12.166 |
39 |
25 |
34 |
09-13 20:40 |
09-13 20:41 |
ipsum:2 |
DigitalOcean, LLC |
DE |
3 |
| ai-devbox-1 |
167.71.175.236 |
39 |
25 |
34 |
09-13 20:40 |
09-13 20:41 |
ipsum:2 firehol2 |
DigitalOcean, LLC |
US |
3 |
| canary-farm-1 |
157.230.19.140 |
39 |
25 |
34 |
09-13 20:43 |
09-13 20:43 |
ipsum:1 |
DigitalOcean, LLC |
DE |
3 |
| canary-farm-1 |
74.7.230.38 |
7 |
3 |
1 |
09-13 11:12 |
09-13 11:12 |
ipsum:1 |
Microsoft Corporation |
US |
0 |
| ai-devbox-1 |
36.73.33.48 |
7 |
3 |
1 |
09-13 11:09 |
09-13 11:09 |
- |
PT Telekomunikasi Indonesia |
ID |
0 |
| canary-farm-1 |
205.210.31.18 |
7 |
3 |
1 |
09-13 15:40 |
09-13 15:40 |
ipsum:3 firehol2 |
Google LLC |
US |
0 |
| canary-farm-1 |
36.73.33.48 |
7 |
3 |
1 |
09-13 11:53 |
09-13 11:53 |
- |
PT Telekomunikasi Indonesia |
ID |
0 |
| ai-devbox-1 |
162.240.171.12 |
6 |
2 |
1 |
09-13 05:21 |
09-13 16:48 |
- |
Unified Layer |
US |
2 |
| canary-farm-1 |
160.250.130.168 |
6 |
2 |
1 |
09-13 08:20 |
09-13 20:17 |
- |
VIET DIGITAL TECHNOLOGY LIAB |
VN |
2 |
| ai-devbox-1 |
217.64.102.75 |
3 |
2 |
1 |
09-14 03:18 |
09-14 03:18 |
- |
Society of Mali's Telecommun |
ML |
1 |
| ai-devbox-1 |
87.120.190.142 |
3 |
2 |
1 |
09-13 06:56 |
09-13 06:56 |
- |
SKAT TV Ltd. |
BG |
1 |
| ai-devbox-1 |
197.155.134.251 |
3 |
2 |
1 |
09-13 09:07 |
09-13 09:07 |
- |
Orange Mali SA |
ML |
1 |
| ai-devbox-1 |
87.116.179.87 |
3 |
2 |
1 |
09-13 14:14 |
09-13 14:15 |
- |
Yettel d.o.o. |
RS |
1 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
6 |
1 |
| ru-edge-1 |
1 |
1 |
| control-1 |
2 |
1 |
| canary-farm-1 |
30 |
3 |
Mint failures (24h): control-1:400x14; canary-farm-1:400x33; ru-edge-1:400x1; ai-devbox-1:400x27
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
6 |
| canary-farm-1 |
["aws"] |
30 |
| ru-edge-1 |
["aws"] |
1 |
| control-1 |
["aws"] |
2 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 646
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but clientIp empty (all-internal forged chains): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
2567 |
| ai-devbox-1 |
https |
132 |
| canary-farm-1 |
http |
3870 |
| canary-farm-1 |
https |
511 |
| control-1 |
http |
3152 |
| frantech-ts |
http |
1061 |
| netcup-ts |
http |
1115 |
| ru-edge-1 |
http |
2331 |
| sponge-01-ts |
http |
1300 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
109.123.246.142 |
3765 |
| control-1 |
38.54.2.209 |
3139 |
| ai-devbox-1 |
217.15.163.226 |
2448 |
| ru-edge-1 |
130.94.89.46 |
2318 |
| sponge-01-ts |
89.167.72.144 |
1241 |
| netcup-ts |
159.195.21.150 |
1108 |
| canary-farm-1 |
sso.rightabouteverything.show |
598 |
| frantech-ts |
209.141.62.110 |
586 |
| ai-devbox-1 |
inference.fapthropic.com |
240 |
| frantech-ts |
tls.bunnyfeet.baby |
118 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (1 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
| 2026-09-05 |
3958 |
98 |
| 2026-09-04 |
4632 |
100 |
| 2026-09-03 |
2361 |
105 |
| 2026-09-02 |
4068 |
105 |
| 2026-09-01 |
15373 |
107 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
136.117.52.210 |
93 |
/ [tarpit-module] → /.github/workflows/deploy.yml [github-actions-workflow] → /.aws/credentials [aws-credentials-file] → /.git/config [fake-git] → /.env.local [env-production] → /.gitlab-ci.yml [gitlab-ci] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /.git-credentials [git-credentials-error] → /.gitconfig [gitconfig] → /.env.example [env-production] → /.env [issued] → /graphql [graphql-introspection] |
Google LLC |
US |
| canary-farm-1 |
159.89.12.166 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
209.38.248.17 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
157.230.19.140 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
167.71.175.236 |
25 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
74.7.230.38 |
3 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
Microsoft Corporation |
US |
| canary-farm-1 |
36.73.33.48 |
3 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
PT Telekomunikasi Indonesia |
ID |
| ai-devbox-1 |
36.73.33.48 |
3 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
PT Telekomunikasi Indonesia |
ID |
| canary-farm-1 |
205.210.31.18 |
3 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
Google LLC |
US |
| canary-farm-1 |
188.252.196.40 |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
A1 Hrvatska d.o.o. |
HR |
| canary-farm-1 |
188.27.145.117 |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
Digi Romania S.A. |
RO |
| ai-devbox-1 |
2001:41d0:701:1100::9bea |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
OVH SAS |
DE |
| canary-farm-1 |
66.29.148.110 |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
Namecheap, Inc. |
US |
| ai-devbox-1 |
167.235.85.105 |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
Hetzner Online GmbH |
DE |
| ai-devbox-1 |
77.238.212.180 |
2 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] |
Telemach BH d.o.o. Sarajevo |
BA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 334 sources sent credentials → 237 got a shell (71%) → 148 ran a command (62% of shell-getters, 44% of sources)
- event level: 25510 credential attempts → 14660 accepted logins → 7000 commands (48% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 378 attempts
New commands this window (0 of 56 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1720 |
2 |
109.160.32.91 |
"uname -s -v -n -r -m" |
| 1720 |
2 |
109.160.32.91 |
"uname -m | awk '{printf $1}'" |
| 1258 |
123 |
103.123.53.88 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1089 |
108 |
110.166.87.119 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 216 |
5 |
195.178.110.227 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 216 |
5 |
195.178.110.227 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 98 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 98 |
1 |
45.142.193.164 |
"echo xsec" |
Credentials: 9267 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1232 |
345gs5662d34 |
345gs5662d34 |
| 913 |
root |
3245gs5662d34 |
| 67 |
admin |
3245gs5662d34 |
| 64 |
root |
123456 |
| 60 |
ubuntu |
3245gs5662d34 |
| 50 |
support |
support |
| 45 |
user |
wasd |
| 37 |
pi |
raspberry |