flux fleet digest — 2026-09-16 07:32 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 5582 94 2985 86 +87%
canary-farm-1 4242 119 3953 126 +7%
control-1 4795 62 3338 43 +44%
frantech-ts 3133 67 1535 1 +104%
netcup-ts 987 86 916 1 +8%
ru-edge-1 2625 84 2192 1 +20%
sponge-01-ts 407 74 1118 1 -64%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 webshell-probe 83 14.1 5.9x
canary-farm-1 env-production-error 400 127.6 3.1x
canary-farm-1 fake-git-miss 26 2.7 9.8x
canary-farm-1 vite-fs-aws-credentials-file 40 9.4 4.3x
canary-farm-1 wp-config-error 32 9.0 3.6x
control-1 app-config-python 20 5.2 3.9x
control-1 webshell-probe 48 4.5 10.7x
frantech-ts webshell-probe 55 0.0 infx

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 55 385 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 12 84 ai-devbox-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
b07c7bb207b4 ⟳ 7 328 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
850993125b15 ⟳ 7 287 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
7e61a9500d8b ⟳ 6 294 canary-farm-1,frantech-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
6d284d806b36 5 41 ai-devbox-1,canary-farm-1,control-1,frantech-ts,ru-edge-1 ⚠FLEET-WIDE 09-16 / [tarpit-module] → /goform/formJsonAjaxReq [soho-router-diag] → / [tarpit-module]
fa6433fb567c 4 819 ai-devbox-1,canary-farm-1,control-1,ru-edge-1 ⚠FLEET-WIDE 09-16 / [tarpit-module] → /.env [tracebit-http-error] → /backend/.env [env-production-error] → /api/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /phpinfo/ [not-handled] → …
4a3bf1265dff 3 105 ai-devbox-1,canary-farm-1,control-1 ⚠FLEET-WIDE 09-16 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → …

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
control-1 /site/wp-login.php 2026-09-16 03:31:41.816232-04:00
canary-farm-1 /cms/wp-login.php 2026-09-16 03:31:41.816232-04:00
control-1 /wp/wp-login.php 2026-09-16 03:31:41.816232-04:00
ai-devbox-1 /cms/wp-login.php 2026-09-16 03:31:41.816232-04:00
frantech-ts /wp/wp-login.php 2026-09-16 03:31:41.816232-04:00
frantech-ts /wordpress/wp-login.php 2026-09-16 03:31:41.816232-04:00
control-1 /ouh4dwot7o 2026-09-16 03:31:41.816232-04:00
ai-devbox-1 /wp-login/wp-login.php 2026-09-16 03:31:41.816232-04:00
control-1 /cms/wp-login.php 2026-09-16 03:31:41.816232-04:00
ai-devbox-1 /wordpress/wp-login.php 2026-09-16 03:31:41.816232-04:00
sponge-01-ts /wp/wp-login.php 2026-09-16 03:31:41.816232-04:00
canary-farm-1 /site/wp-login.php 2026-09-16 03:31:41.816232-04:00
ai-devbox-1 /wp/wp-login.php 2026-09-16 03:31:41.816232-04:00
frantech-ts /wp-login/wp-login.php 2026-09-16 03:31:41.816232-04:00
canary-farm-1 /admin/wp-login.php 2026-09-16 03:31:41.816232-04:00
sponge-01-ts /site/wp-login.php 2026-09-16 03:31:41.816232-04:00
sponge-01-ts /wp-login/wp-login.php 2026-09-16 03:31:41.816232-04:00
canary-farm-1 /wp/wp-login.php 2026-09-16 03:31:41.816232-04:00
canary-farm-1 /wp-login/wp-login.php 2026-09-16 03:31:41.816232-04:00
control-1 /admin/wp-login.php 2026-09-16 03:31:41.816232-04:00

New user agents:

sensor user agent first seen
sponge-01-ts Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100 2026-09-16 03:31:41.921962-04:00
sponge-01-ts Mozilla/5.0 (Android 14; Mobile; rv:128.0) Gecko/128.0 Firef 2026-09-16 03:31:41.921962-04:00
frantech-ts Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100 2026-09-16 03:31:41.921962-04:00
frantech-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-16 03:31:41.921962-04:00
frantech-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20 2026-09-16 03:31:41.921962-04:00
control-1 Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) Apple 2026-09-16 03:31:41.921962-04:00
sponge-01-ts Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHT 2026-09-16 03:31:41.921962-04:00
canary-farm-1 Mozilla/5.0 (Android 14; Mobile; rv:128.0) Gecko/128.0 Firef 2026-09-16 03:31:41.921962-04:00
control-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20 2026-09-16 03:31:41.921962-04:00
sponge-01-ts Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) Apple 2026-09-16 03:31:41.921962-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
ai-devbox-1 94.154.46.242 1500 98 743 09-15 15:58 09-15 15:58 - Omegatech LTD US 0
ai-devbox-1 94.154.46.243 1448 98 743 09-15 20:50 09-15 20:50 - Omegatech LTD US 0
ru-edge-1 204.76.203.18 1292 2 561 09-15 12:08 09-16 07:30 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
control-1 204.76.203.18 1278 2 558 09-15 12:06 09-16 07:32 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
canary-farm-1 8.234.173.27 1053 165 784 09-16 00:03 09-16 00:03 - Google LLC US 12
control-1 94.154.46.247 1050 112 1042 09-16 04:01 09-16 04:02 - Omegatech LTD US 0
ai-devbox-1 69.5.20.14 503 21 401 09-15 22:29 09-15 22:30 - Byteplus Pte. Ltd. ID 0
control-1 69.5.20.14 503 21 401 09-16 04:36 09-16 04:37 - Byteplus Pte. Ltd. ID 0
frantech-ts 69.5.20.14 470 6 390 09-16 03:48 09-16 03:49 - Byteplus Pte. Ltd. ID 0
frantech-ts 94.154.46.244 300 4 150 09-16 07:01 09-16 07:01 - Omegatech LTD US 0
canary-farm-1 94.154.46.247 300 36 150 09-15 12:43 09-15 12:43 - Omegatech LTD US 0
canary-farm-1 213.209.159.175 228 16 112 09-15 15:24 09-16 02:34 ipsum:3 firehol2 Feo Prest SRL DE 0
ai-devbox-1 34.17.8.94 218 14 166 09-15 22:28 09-15 22:31 - Google LLC IT 4
ai-devbox-1 80.94.95.211 214 16 212 09-16 00:29 09-16 00:30 - SS-Net RO 0
canary-farm-1 172.105.69.26 214 25 170 09-15 12:59 09-15 12:59 ipsum:3 firehol2 Akamai Connected Cloud DE 1

Canary economics (24h)

sensor mints distinct minting IPs
ru-edge-1 1 1
control-1 8 3
canary-farm-1 23 10
ai-devbox-1 39 14

Mint failures (24h): canary-farm-1:400x37; ru-edge-1:400x1; ai-devbox-1:400x17; control-1:400x5

Mints by type label:

sensor types mints
canary-farm-1 ["aws"] 23
ru-edge-1 ["aws"] 1
control-1 ["aws"] 8
ai-devbox-1 ["aws"] 39

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 800
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 1
  • XFF present but ignored as the source (all entries internal, or it agrees with the peer): 8
  • XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 5016
ai-devbox-1 https 566
canary-farm-1 http 4018
canary-farm-1 https 224
control-1 http 4795
frantech-ts http 3133
netcup-ts http 987
ru-edge-1 http 2625
sponge-01-ts http 407

Top Host headers:

sensor host events
control-1 38.54.2.209 4779
ai-devbox-1 217.15.163.226 4474
canary-farm-1 109.123.246.142 3562
frantech-ts 209.141.62.110 2766
ru-edge-1 130.94.89.46 2622
ai-devbox-1 inference.fapthropic.com 1085
netcup-ts 159.195.21.150 977
canary-farm-1 sso.rightabouteverything.show 453
sponge-01-ts 89.167.72.144 397
canary-farm-1 vmi3243483.contaboserver.net 210

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (3 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-16 4795 62
2026-09-15 5378 1
2026-09-14 3152 1
2026-09-13 4254 53
2026-09-12 1813 51
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98
2026-09-04 4632 100
2026-09-03 2361 105

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 8.234.173.27 165 / [tarpit-module] → /aws_leak_probe_c14dcbdf [not-handled] → /.env [issued] → /@fs/root/.aws/credentials [vite-fs-aws-credentials-file] → /.azure/credentials [azure-credentials-file] → /etc/passwd [not-handled] → /@fs/etc/passwd [vite-fs-etc-passwd] → /@fs/proc/self/environ [vite-fs-proc-environ] → /@fs/home/ec2-user/.aws/credentials [vite-fs-aws-credentials-file] → /@fs/root/.config/gcloud/application_default_credentials.json [vite-fs-firebase-json] → /.aws/credentials [aws-credentials-file] → /.env.local [env-production] Google LLC US
control-1 94.154.46.247 112 /wp-config.old [wp-config] → /wp-config.php.save [wp-config] → /config/database.php [app-config-php-database] → /docker-compose.yaml [docker-compose] → / [tarpit-module] → /wp-config.php.old [wp-config] → /.env.production.local [env-production] → /.env.test [env-production] → /package-lock.json [package-lock-json-error] → /.yarnrc [yarnrc-error] → /.env~ [env-production] → /composer.lock [not-handled] Omegatech LTD US
ai-devbox-1 94.154.46.243 98 /wp-config.php [wp-config] → /.env [issued] → /.env.saved [env-production] → /.ssh/id_dsa [ssh-private-key-error] → /.env_backup [env-production] → /wp-config.php.bak [wp-config] → /docker-compose.yaml [docker-compose] → /.aws/credentials [aws-credentials-file] → /.env.production.local [env-production] → /.env_old [env-production] → /.env.development.local [env-production] → /.circleci/config.yml [generic-ci-config] Omegatech LTD US
ai-devbox-1 94.154.46.242 98 /.git/HEAD [fake-git] → /.gitlab-ci.yml [gitlab-ci] → /.env.old [env-production] → /app/.env [env-production] → /config.py [app-config-python] → /composer.lock [not-handled] → /.env.2 [tarpit-module] → /config/database.php [app-config-php-database] → /.env.save~ [env-production] → /.ssh/id_dsa [ssh-private-key-error] → /Jenkinsfile [jenkinsfile] → /.circleci/config.yml [generic-ci-config] Omegatech LTD US
ru-edge-1 80.94.95.211 49 / [tarpit-module] → /.env [tracebit-http-error] → /backend/.env [env-production-error] → /api/.env [env-production-error] → /sendgrid.env [mail-service-env-error] → /phpinfo/ [not-handled] → /admin/.env [env-production-error] → /phpinfo.php [phpinfo-error] → /.env.example [env-production-error] → /app/.env [env-production-error] → /app_dev.php/_profiler/open [symfony-parameters-yml-error] → /appsettings.json [appsettings-json-error] SS-Net RO
canary-farm-1 94.154.46.247 36 /wp-config.bak [wp-config-error] → /wp-config.old [wp-config-error] → /config.php [app-config-php-error] → /.env~ [env-production-error] → /.env.production.local [env-production-error] → /.htaccess [not-handled] → /config.py [app-config-python-error] → /Gemfile.lock [not-handled] → /configuration.php [app-config-php-error] → /settings.py [app-config-python-error] → /wp-config.php.save [wp-config-error] → /local_settings.py [app-config-python-error] Omegatech LTD US
ai-devbox-1 188.166.99.91 30 /.env.prod [env-production-error] → /.env.test [env-production-error] → /.env.old [env-production-error] → /.env.local [env-production-error] → /.env.development [env-production-error] → /.env.production [env-production-error] → /.env [tracebit-http-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] → /.env.bak [env-production-error] → /.env.docker [env-production-error] DigitalOcean, LLC NL
ai-devbox-1 206.189.19.19 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC GB
canary-farm-1 68.183.180.73 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC SG
canary-farm-1 167.99.181.249 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 138.197.191.87 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 159.223.132.86 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
ai-devbox-1 64.226.65.160 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 142.93.143.8 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
ai-devbox-1 159.89.174.87 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC IN

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 482 sources sent credentials → 370 got a shell (77%) → 169 ran a command (46% of shell-getters, 35% of sources)
  • event level: 46009 credential attempts → 18930 accepted logins → 12724 commands (67% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 734 attempts

New commands this window (0 of 51 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
2809 4 109.160.32.15 "uname -m | awk '{printf $1}'"
2809 4 109.160.32.15 "uname -s -v -n -r -m"
1489 19 120.48.90.166 "uname -a"
1463 1 46.101.165.211 "nproc"
1425 128 101.47.159.50 "cd ~; chattr -ia .ssh; lockr -ia .ssh"
1269 114 101.47.159.50 "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b
323 6 80.94.92.234 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
323 6 80.94.92.234 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -

Credentials: 28479 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:

attempts user password
1388 345gs5662d34 345gs5662d34
1043 root 3245gs5662d34
80 root 123456
72 ubuntu 3245gs5662d34
67 user wasd
61 admin 3245gs5662d34
59 pi raspberry
42 root admin