flux fleet digest — 2026-09-17 07:34 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 3102 130 3528 81 -12%
canary-farm-1 2279 162 4301 112 -47%
control-1 5129 94 3557 43 +44%
frantech-ts 27839 130 1855 14 +1401%
netcup-ts 714 76 930 18 -23%
ru-edge-1 2516 95 2279 18 +10%
sponge-01-ts 1227 116 976 16 +26%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
ai-devbox-1 fake-git 293 54.0 5.4x
ai-devbox-1 fake-git-miss 161 0.0 infx
ai-devbox-1 phpmyadmin-login 31 7.4 4.2x
ai-devbox-1 webapp-config-bundle-js 65 14.7 4.4x
ai-devbox-1 webshell-probe 97 25.9 3.8x
canary-farm-1 fake-git-miss 143 8.5 16.8x
canary-farm-1 webshell-probe 68 7.0 9.7x
control-1 app-config-php 33 9.6 3.4x
control-1 app-config-python 40 8.3 4.8x
control-1 env-production 335 82.0 4.1x
control-1 rails-database-yml 22 5.8 3.8x
control-1 webshell-probe 89 13.2 6.7x
control-1 wp-config 39 10.8 3.6x
frantech-ts not-handled 27261 1283.2 21.2x
ru-edge-1 fake-git 165 1.0 165.0x
sponge-01-ts tarpit-disconnect 26 8.4 3.1x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 81 567 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 16 113 canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
7e61a9500d8b ⟳ 11 539 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
850993125b15 ⟳ 8 367 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
b07c7bb207b4 ⟳ 7 328 ai-devbox-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …
1cf777711bea ⟳ 7 59 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1 ⚠FLEET-WIDE 09-03 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module]
721e73e8d123 3 15 canary-farm-1,frantech-ts,netcup-ts ⚠FLEET-WIDE 09-17 / [method-not-allowed] → / [tarpit-module] → / [method-not-allowed]
8c3f2665d0b4 3 138 ai-devbox-1,canary-farm-1,ru-edge-1 ⚠FLEET-WIDE 09-17 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /vendor/phpunit/phpunit/src/Util/PHP/eval-st

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
sponge-01-ts /config/config.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /PMA/index.php 2026-09-17 03:32:27.022627-04:00
ai-devbox-1 /api/tags 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /admin-app/.env 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /__info.php 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /0.0_phpinfo.php 2026-09-17 03:32:27.022627-04:00
ai-devbox-1 /v1/models 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /private/.env 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /.env.project 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /frontend/web/debug/default/view 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /web/debug/default/view 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /AwsConfig.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /deployment-config.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /credentials/config.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /parameters.yml 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /pma/index.php 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /apps/.env 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /sendgrid.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /ws-config.json 2026-09-17 03:32:27.022627-04:00
sponge-01-ts /php-my-admin/index.php 2026-09-17 03:32:27.022627-04:00

New user agents:

sensor user agent first seen
sponge-01-ts curl/7.29.0 2026-09-17 03:35:16.885786-04:00
sponge-01-ts Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 2026-09-17 03:32:28.093398-04:00
netcup-ts Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; en) Opera 2026-09-17 03:32:28.093398-04:00
sponge-01-ts Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/2010 2026-09-17 03:32:28.093398-04:00
sponge-01-ts Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-17 03:32:28.093398-04:00
ai-devbox-1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) 2026-09-17 03:32:28.093398-04:00
netcup-ts Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Apple 2026-09-17 03:32:28.093398-04:00
sponge-01-ts Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-17 03:32:28.093398-04:00
canary-farm-1 Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefo 2026-09-17 03:32:28.093398-04:00
sponge-01-ts Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Fir 2026-09-17 03:32:28.093398-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
frantech-ts 23.234.119.20 12949 5 12949 09-16 09:53 09-16 09:54 - tzulo, inc. US 0
frantech-ts 138.199.6.195 12949 5 12949 09-17 00:34 09-17 00:36 ipsum:1 Datacamp Limited CH 0
ru-edge-1 204.76.203.18 1885 2 567 09-16 03:34 09-17 07:34 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
control-1 204.76.203.18 1866 2 569 09-16 03:35 09-17 07:34 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
control-1 94.154.46.247 1050 112 1042 09-16 04:01 09-16 04:02 - Omegatech LTD US 0
frantech-ts 69.5.20.14 940 6 395 09-16 03:48 09-16 14:56 - Byteplus Pte. Ltd. ID 0
control-1 69.5.20.14 903 35 433 09-16 04:36 09-16 15:50 - Byteplus Pte. Ltd. ID 0
control-1 94.154.46.250 750 98 743 09-16 12:34 09-16 12:34 - Omegatech LTD US 0
canary-farm-1 102.220.161.102 514 34 511 09-17 00:11 09-17 00:26 - VPS Dedicated LLC SI 0
ai-devbox-1 102.220.161.102 514 34 511 09-16 23:52 09-17 00:05 - VPS Dedicated LLC SI 0
ai-devbox-1 69.5.20.14 409 20 337 09-16 09:23 09-16 20:20 - Byteplus Pte. Ltd. ID 0
ai-devbox-1 41.249.4.249 333 21 54 09-17 03:51 09-17 03:57 - Office National des Postes e MA 29
frantech-ts 94.154.46.244 300 4 150 09-16 07:01 09-16 07:01 - Omegatech LTD US 0
ai-devbox-1 195.178.110.159 295 9 199 09-16 21:58 09-16 22:00 ipsum:1 Techoff Srv Limited BG 0
netcup-ts 185.73.23.162 270 1 1 09-16 09:25 09-17 06:39 - Ruhr-Universitaet Bochum DE 0

Canary economics (24h)

sensor mints distinct minting IPs
ru-edge-1 4 2
ai-devbox-1 21 15
control-1 18 5
canary-farm-1 15 11

Mint failures (24h): ai-devbox-1:400x9; control-1:400x2; canary-farm-1:400x6

Mints by type label:

sensor types mints
ai-devbox-1 ["aws"] 21
control-1 ["aws"] 18
canary-farm-1 ["aws"] 15
ru-edge-1 ["aws"] 4

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 1282
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
  • XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 3

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 2266
ai-devbox-1 https 836
canary-farm-1 http 1836
canary-farm-1 https 443
control-1 http 5129
frantech-ts http 27839
netcup-ts http 714
ru-edge-1 http 2516
sponge-01-ts http 1227

Top Host headers:

sensor host events
frantech-ts 209.141.62.110 27557
control-1 38.54.2.209 5118
ru-edge-1 130.94.89.46 2512
ai-devbox-1 217.15.163.226 1627
canary-farm-1 109.123.246.142 1437
ai-devbox-1 inference.fapthropic.com 1391
canary-farm-1 sso.rightabouteverything.show 829
sponge-01-ts 89.167.72.144 805
netcup-ts 159.195.21.150 430
sponge-01-ts static.144.72.167.89.clients.your-server.de 263

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (4 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-17 5129 94
2026-09-16 4795 62
2026-09-15 5378 1
2026-09-14 3152 1
2026-09-13 4254 53
2026-09-12 1813 51
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98
2026-09-04 4632 100

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
control-1 94.154.46.247 112 /wp-config.old [wp-config] → /wp-config.php.save [wp-config] → /config/database.php [app-config-php-database] → /docker-compose.yaml [docker-compose] → / [tarpit-module] → /wp-config.php.old [wp-config] → /.env.production.local [env-production] → /.env.test [env-production] → /package-lock.json [package-lock-json-error] → /.yarnrc [yarnrc-error] → /.env~ [env-production] → /composer.lock [not-handled] Omegatech LTD US
control-1 94.154.46.250 98 /config/app.php [app-config-php-services] → /wp-config.php.save [wp-config] → /config.php [app-config-php] → /wp-config.php~ [wp-config] → / [tarpit-module] → /.env.production.local [env-production] → /settings.php [app-config-php] → /.env.production [env-production] → /.travis.yml [generic-ci-config] → /.git/config [fake-git] → /package-lock.json [package-lock-json-error] → /wp-config.php.old [wp-config] Omegatech LTD US
canary-farm-1 64.23.218.208 36 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
control-1 69.5.20.14 35 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /.env.local [env-production-error] → /.aliyun/config.json [not-handled] → /config.yml [app-config-yaml-error] → /.env.staging [env-production-error] → /.git/config [fake-git-error] → /aliyun_config.json [not-handled] → /credentials.json [config-json-error] → /oss.json [not-handled] → /alicloud.yml [not-handled] Byteplus Pte. Ltd. ID
canary-farm-1 102.220.161.102 34 / [tarpit-module] → /pscan-d4517fff-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] VPS Dedicated LLC SI
ai-devbox-1 102.220.161.102 34 / [tarpit-module] → /pscan-21c822fe-nonexistent.txt [not-handled] → /.env [tracebit-http-error] → /vendor/.env [env-production-error] → /lib/.env [env-production-error] → /lab/.env [env-production-error] → /cronlab/.env [env-production-error] → /cron/.env [env-production-error] → /core/.env [env-production-error] → /core/app/.env [tarpit-module] → /core/Datavase/.env [tarpit-module] → /database/.env [phpmyadmin-login] VPS Dedicated LLC SI
ai-devbox-1 188.166.99.91 30 /.env.prod [env-production-error] → /.env.test [env-production-error] → /.env.old [env-production-error] → /.env.local [env-production-error] → /.env.development [env-production-error] → /.env.production [env-production-error] → /.env [tracebit-http-error] → /.env.backup [env-production-error] → /.env.staging [env-production-error] → /.env.dev [env-production-error] → /.env.bak [env-production-error] → /.env.docker [env-production-error] DigitalOcean, LLC NL
canary-farm-1 206.81.24.227 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 159.89.174.87 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC IN
canary-farm-1 164.92.107.174 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US
canary-farm-1 159.89.12.166 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 167.99.181.249 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 143.110.213.72 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 178.128.207.138 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
canary-farm-1 143.244.168.161 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC US

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 518 sources sent credentials → 381 got a shell (74%) → 155 ran a command (41% of shell-getters, 30% of sources)
  • event level: 26709 credential attempts → 17933 accepted logins → 8951 commands (50% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 399 attempts

New commands this window (0 of 70 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
2210 4 109.160.32.67 "uname -s -v -n -r -m"
2210 4 109.160.32.67 "uname -m | awk '{printf $1}'"
1248 114 103.189.89.196 "cd ~; chattr -ia .ssh; lockr -ia .ssh"
1082 102 103.189.89.196 "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b
800 1 185.144.27.63 "echo -e "\x6F\x6B""
256 5 2.57.122.209 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
256 5 2.57.122.209 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -
119 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/

Credentials: 11734 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:

attempts user password
1187 345gs5662d34 345gs5662d34
853 root 3245gs5662d34
72 root 123456
58 admin 3245gs5662d34
57 pi raspberry
55 user wasd
51 ubuntu 3245gs5662d34
36 support support