flux fleet digest — 2026-09-15 07:34 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 3851 14 2916 105 +32%
canary-farm-1 1234 9 4312 156 -71%
control-1 5378 1 3052 60 +76%
frantech-ts 2671 1 1157 1 +131%
netcup-ts 732 1 978 1 -25%
ru-edge-1 5168 1 1200 1 +331%
sponge-01-ts 592 1 1293 1 -54%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 app-config-php-error 36 5.0 7.2x
ai-devbox-1 app-config-python-error 28 2.4 11.7x
ai-devbox-1 app-config-yaml-error 26 6.2 4.2x
ai-devbox-1 env-production-error 402 91.2 4.4x
ai-devbox-1 webshell-sweep-observed 110 13.3 8.3x
ai-devbox-1 wp-config-error 36 7.2 5.0x
control-1 app-config-php-error 38 10.5 3.6x
control-1 app-config-python-error 36 11.0 3.3x
control-1 application-yml-error 21 5.3 3.9x
control-1 fake-git-error 76 6.7 11.4x
control-1 k8s-secret-manifest-error 22 5.7 3.9x
control-1 rails-database-yml-error 20 6.2 3.2x
control-1 webshell-sweep-observed 53 9.7 5.5x
frantech-ts not-handled 2034 648.0 3.1x
frantech-ts webshell-sweep-observed 97 14.5 6.7x
ru-edge-1 app-config-php-error 24 1.0 24.0x
ru-edge-1 app-config-python-error 25 2.0 12.5x
ru-edge-1 env-production-error 450 104.5 4.3x
ru-edge-1 fake-git-error 27 3.0 9.0x
ru-edge-1 not-handled 2769 640.7 4.3x
ru-edge-1 tarpit-module 805 211.3 3.8x
ru-edge-1 tracebit-http-error 22 7.0 3.1x
ru-edge-1 webapp-config-bundle-js-error 26 8.5 3.1x
ru-edge-1 webshell-sweep-observed 39 2.0 19.5x
ru-edge-1 wp-config-error 29 4.0 7.2x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 3 21 ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
c540fc530a5a ⟳ 2 78 canary-farm-1 09-03 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
76d212a95300 ⟳ 2 78 ai-devbox-1 09-03 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
95749a9e174c 1 14 ai-devbox-1 09-15 /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] → /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect]
5770acb0995e 1 104 ai-devbox-1 09-15 /.env.docker [env-production-error] → /.env.production.local [env-production-error] → /bootstrap/cache/config.php [app-config-php-error] → /.env.old [env-production-error] → /wp-config.php [wp-config-
5080877ca491 1 97 ai-devbox-1 09-15 /.env~ [env-production-error] → /local_settings.py [app-config-python-error] → /www/.env [env-production-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.swp

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
frantech-ts /version 2026-09-15 03:32:33.033682-04:00
control-1 /bomba/ 2026-09-15 03:32:33.033682-04:00
frantech-ts /v1 2026-09-15 03:32:33.033682-04:00
frantech-ts /api-docs 2026-09-15 03:16:11.691615-04:00
frantech-ts /security.txt 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/QLYRQ8VrUnX1xC2xRcYznXwehcVME0Ua1NlK-_R830tel1LTiQ2rkvmaD8q3bsKzqDW6kr5cKfdgvzL_5OUwlfvV2LjB9t14Z18 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/r9x-QWa6bvlYVC8znPevPmmG0z2oxnR2Mb1iHk2k_ZvIqEEm5tpTYnfHrPnRbYS5qrxF2WiQJXARhhXmROFmKwIFT9ATVdU43to 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/UiHOcPjUXG3_bWDUBA09incTrdBrt1K6uNH7czraUkLcA8E0dx-adI2Gn2ppIbf4whsuSqvfiIZZHEu-7kk1RIRn3S79gKGsL3k 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/cNfYvKMhw4v2ozfoY0C_27LV-257ZXwTp5qx5nx2E_-vb9j6K9-TtNMKywAYFO5jM1r70ItH37KuI-IVo8FD6fCEOzDKLtrJvOI 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/tNoipIRwuEDTZbXtHx4h0mhOkLGyDl_o8Qr5S69Gh6zZ04snYG8Zcjieh8Cdt2t5hUX_dTPCzFMIf9kFHuBvTfPTeyJEHs2FtcA 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/XCh9KSQfjoeDmM6zgkJQcSlYBVK_va-8Zr83a64rYga2piIr-Qz3anKdGqgmo1jDp58myELKHEtK98tsq--KUL9orNWiCbMRe_w 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/WZwNooSdAYmLd_o4J6G5TpuJuDj8-FG6sXerCxPIzADuzD3WFWbYZjyVGxPmy1p63bsy7zJ2pTP2SCKErxu3oigENhUnRp48NzE 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/4Y6-kQQnCDUwY5uSQ2h_u2gZEgudDtWjkX4g_ovViB2JBS_GynFwfvoubh2BiuI_M3sBGU_8EEizgbKgp4kpqvgF42NnwlfLOrY 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/OcQ6ari4znIVKFjoElyN3-vQLWql0CkwJOoND8dOSejlaAK0PXGef8QmZJpOLyBqoy47kqsm1V7SKeH-Qs84-A7HTduYyx3sfXc 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/qivCHBcfuA278su3xlC4q7RMsNydeWPfpm-nxwBDh3CGRTHZae8yN36CkOtCUIAdyBbkH9lJfVfiNDrYN-F5Z4dTnNIHkmp7IrQ 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/40joZhrzW55fQnzKqziuH5CAJeSKmwNIyJVnBa-UVnyPLELhw-Gma9iHQfB6uOcLk7XM41cJleU8RWLe0tyN8USbRvkOoW28mVs 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/DpPolP3WMfy3DeA5cUG_dIb_sA0ftgA7QLbE6dRhnwH3omWEb3Mn-cMBPXB2Ouh6Lkg5p81PcoeKGV0POlT-xcgf66PFU6wcRxI 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/aLNIWKEFWw88rXXg3MNb6alomeL207s0KU4A6fU2pHBqoPiWKeFyXVs8kpWuk_dmFHAQhgM_MCTNAkO5-2O9RYKRLauk7f0Cmwg 2026-09-15 03:16:11.691615-04:00
frantech-ts /c/2WxmLxdMrOj2ABn6B_rVGMxNpVvwR-Y64K3imASZmFjPjuoNc6-4zT4rettaY_Gz8xtC2dx0RvbZnzTnd6ssmRc1oYPy_LQ4F-g 2026-09-15 03:16:11.691615-04:00
frantech-ts /alicloud.js 2026-09-15 03:16:11.691615-04:00

New user agents:

sensor user agent first seen
control-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20 2026-09-15 03:32:33.093335-04:00
netcup-ts Mozilla/5.0 (compatible; KGBMasscann/1.0) 2026-09-15 03:32:33.093335-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like 2026-09-15 03:32:33.093335-04:00
control-1 distort-scanner/1.0 2026-09-15 03:32:33.093335-04:00
frantech-ts Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like 2026-09-15 03:32:33.093335-04:00
sponge-01-ts Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Fir 2026-09-15 03:32:33.093335-04:00
control-1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l 2026-09-15 03:32:33.093335-04:00
netcup-ts Mozilla/5.0 (compatible; nmap-http-info) 2026-09-15 03:32:33.093335-04:00
ru-edge-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/5 2026-09-15 03:16:11.782419-04:00
ru-edge-1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 ( 2026-09-15 03:16:11.782419-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
ai-devbox-1 154.12.227.198 104 30 100 09-14 20:55 09-14 20:55 - Contabo Inc. US 0
ai-devbox-1 152.89.170.191 97 26 88 09-15 04:27 09-15 04:27 - Lumanex Srl IT 0
ai-devbox-1 68.183.180.73 39 25 34 09-14 20:36 09-14 20:38 ipsum:1 DigitalOcean, LLC SG 3
canary-farm-1 142.93.143.8 39 25 34 09-14 20:36 09-14 20:37 ipsum:1 DigitalOcean, LLC NL 3
ai-devbox-1 207.154.212.47 39 25 34 09-14 20:13 09-14 20:14 ipsum:1 DigitalOcean, LLC DE 3
canary-farm-1 143.110.217.244 39 25 34 09-14 20:13 09-14 20:13 ipsum:1 DigitalOcean, LLC CA 3
ai-devbox-1 74.7.228.40 14 3 1 09-14 09:59 09-14 18:41 ipsum:1 Microsoft Corporation US 0
canary-farm-1 212.156.70.154 7 3 1 09-14 18:11 09-14 18:11 - Turk Telekom TR 0
ai-devbox-1 2600:1f16:743:ac02:4ee5:8340:66d6:7382 7 3 1 09-14 09:35 09-14 09:35 - Amazon.com, Inc. US 0
canary-farm-1 172.120.174.25 7 3 1 09-14 22:09 09-14 22:09 - M247 Europe SRL DE 0
ai-devbox-1 93.152.209.10 5 1 1 09-15 03:59 09-15 03:59 - Omniline Investment s.r.o. BG 0
ai-devbox-1 134.122.48.245 5 1 2 09-14 20:42 09-14 20:42 - DigitalOcean, LLC NL 0
ai-devbox-1 93.152.209.11 5 1 1 09-15 04:02 09-15 04:02 - Omniline Investment s.r.o. BG 0
ai-devbox-1 93.152.209.9 5 1 1 09-15 04:02 09-15 04:02 - Omniline Investment s.r.o. BG 0
canary-farm-1 57.129.13.110 1 1 1 09-14 17:00 09-14 17:00 - OVH SAS DE 0

Canary economics (24h)

sensor mints distinct minting IPs
canary-farm-1 3 1
ru-edge-1 1 1
control-1 1 1
ai-devbox-1 2 1

Mint failures (24h): control-1:400x18; canary-farm-1:400x9; ru-edge-1:400x22; ai-devbox-1:400x32; canary-farm-1:?x2

Mints by type label:

sensor types mints
ai-devbox-1 ["aws"] 2
control-1 ["aws"] 1
canary-farm-1 ["aws"] 3
ru-edge-1 ["aws"] 1

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 419
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but clientIp empty (all-internal forged chains): 0

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 3528
ai-devbox-1 https 323
canary-farm-1 http 1138
canary-farm-1 https 96
control-1 http 5378
frantech-ts http 2671
netcup-ts http 732
ru-edge-1 http 5168
sponge-01-ts http 592

Top Host headers:

sensor host events
control-1 38.54.2.209 5353
ru-edge-1 130.94.89.46 5158
ai-devbox-1 217.15.163.226 3391
frantech-ts 209.141.62.110 2231
canary-farm-1 109.123.246.142 1013
netcup-ts 159.195.21.150 723
sponge-01-ts 89.167.72.144 577
ai-devbox-1 inference.fapthropic.com 443
canary-farm-1 sso.rightabouteverything.show 205
frantech-ts we-love-the.world 113

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (2 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-15 5378 1
2026-09-14 3152 1
2026-09-13 4254 53
2026-09-12 1813 51
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98
2026-09-04 4632 100
2026-09-03 2361 105
2026-09-02 4068 105

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
ai-devbox-1 154.12.227.198 30 /.env.docker [env-production-error] → /.env.production.local [env-production-error] → /bootstrap/cache/config.php [app-config-php-error] → /.env.old [env-production-error] → /wp-config.php [wp-config-error] → /.git/HEAD [fake-git-error] → /.env.development [env-production-error] → /config/packages/mailer.yml [not-handled] → /.env.txt [env-production-error] → /.env.bak [env-production-error] → /.env.staging [env-production-error] → /.env.backup [env-production-error] Contabo Inc. US
ai-devbox-1 152.89.170.191 26 /.env~ [env-production-error] → /local_settings.py [app-config-python-error] → /www/.env [env-production-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.swp [env-production-error] → /.env [tracebit-http-error] → /.env.dev [env-production-error] → /email.php [webshell-sweep-observed] → /.env.development [env-production-error] → /settings.js [webapp-config-bundle-js-error] → /config/sendgrid.php [not-handled] Lumanex Srl IT
canary-farm-1 143.110.217.244 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
canary-farm-1 142.93.143.8 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
ai-devbox-1 68.183.180.73 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC SG
ai-devbox-1 207.154.212.47 25 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 2600:1f16:743:ac02:4ee5:8340:66d6:7382 3 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] Amazon.com, Inc. US
canary-farm-1 172.120.174.25 3 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] M247 Europe SRL DE
ai-devbox-1 74.7.228.40 3 /robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] Microsoft Corporation US
canary-farm-1 212.156.70.154 3 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] Turk Telekom TR

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 335 sources sent credentials → 245 got a shell (73%) → 118 ran a command (48% of shell-getters, 35% of sources)
  • event level: 22210 credential attempts → 14604 accepted logins → 8299 commands (57% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 203 attempts

New commands this window (0 of 61 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
2575 3 109.160.32.15 "uname -s -v -n -r -m"
2575 3 109.160.32.15 "uname -m | awk '{printf $1}'"
1113 93 102.91.123.220 "cd ~; chattr -ia .ssh; lockr -ia .ssh"
963 81 102.91.123.220 "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b
271 5 195.178.110.228 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
271 5 195.178.110.228 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -
96 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -
96 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/

Credentials: 7737 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:

attempts user password
1066 345gs5662d34 345gs5662d34
776 root 3245gs5662d34
67 ubuntu 3245gs5662d34
65 root 123456
62 support support
60 admin 3245gs5662d34
45 user wasd
44 pi raspberry