FLUX FLEET — INTEL BRIEFING №69

Period: 2026-10-31 07:33 – 2026-11-01 07:33 UTC (24h, day 67 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 67-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

A new self-labeled kit, RECONX-L2S (217.60.76.22), minted a canary credential on canary-farm-1 at 18:57 stored and worked it in AWS within the same window: a 15-operation read-only enumeration — 31 denied calls, 2 successful sts:GetCallerIdentity — the widest AWS-side use the funnel has produced in 67 days. A second IP, 20.51.189.99, ran GetCallerIdentity against its own 09:25 mint on ai-devbox-1. A 199-source distributed census forged its origin on nearly every request: 593 single-entry X-Forwarded-For forgeries (588 on frantech-ts) versus 2 last window, the second mass XFF-forgery sighting in fleet history. 135.136.19.27 replayed the identical 14,154-path dropper dictionary a second time about 20 hours after №68's record pass — the campaign's first same-IP repeat — and alone drove frantech-ts to +173% above baseline while every other node ran 12–93% below it with full log coverage verified on all 8 sensors. Watch-list answers: OPENAPI-CENSUS took its first 4 mints, VPN-CONF-HUNT promoted on two new nodes, GOWEB-PENTEST fielded three new one-per-sensor operators, XMLRPC-BRUTE returned, and REGISTRY-HUNT walkers minted 6 more credentials they did not use. No fleet-side changes this cycle.

Key Judgements

1. Stolen canaries now feed standing AWS recon workflows, not only validity tests. RECONX-L2S ran 15 distinct read-only operations against its mint within hours (DescribeDBInstances, DescribeInstances, GetRole, GetUser, ListAccessKeys/Buckets/Secrets/Subscriptions/Tables/Topics/Users/FoundationModels, GetSendQuota, LookupEvents, GetCallerIdentity), and 20.51.189.99 ran GetCallerIdentity against a second credential. (High confidence on the events — the Tracebit pull carries all 33 use rows; Moderate on intent — the 31 denials fence the actor at read-only, so this is inventory mapping until a write-shaped call appears.)
2. Width-over-depth distribution is now the dominant hostile collection shape on the fleet. XFF-SWARM spread 593 events over 199 IPs (average 3.0 per IP), the CONFIGBUNDLE pools spread 685 events over roughly 102 IPs in 4 blocks, GOWEB-PENTEST ran three operators one-per-sensor, and №68's 201-IP wp-login spray set the pattern. Per-IP volume stays under every rate-based view, and the XFF forgery poisons source attribution — pivot on user-agent and wordlist. (High confidence — direct query counts; the shape inference rests on four independent campaigns in two windows.)
3. Census templates keep moving between operator blocks. The kmonbase marker moved from 176.65.144.71 (№67) to 93.152.209.6 this window; the l9explore/1.2.2 walker tooling appeared again on CREDSWEEP's 45.138.12.51; OPENAPI-CENSUS's operator switched to the honest-looking label db-secret-scanner/parsing.py for its first mints. (Moderate confidence — the shared markers are direct observations; "circulation" infers a sharing channel the fleet cannot see.)
4. REGISTRY-HUNT's third consecutive mint window with zero observed use reads as deliberate staging. At least 13 DigitalOcean walkers ran the 12-step walk, 6 minted under wrapped l9scan user agents between 20:55 and 21:28 stored, and none called AWS. (High confidence on the counts; Moderate on the hoard interpretation — №67–№68 showed use can lag mint by a day, so absence this window is not absence of intent.)

Active Campaigns (day 67 status)

RECONX-L2S (self-labeled mint-and-enumerate kit) ⚠ NEW — Hostile, active

• Actors: 217.60.76.22, single IP, canary-farm-1 only. Hosting unverified; 217.60.0.0/16 carries the LIBREDTAIL-KIT staging history (CONFIGBUNDLE-KIT №58), so the lineage is a hint, not a link.
• TTPs: a sub-second census burst at 18:57:00 stored under Mozilla/5.0 (compatible; ReconX-L2S/1.0) plus curl/8.6.0 and rotating browser user agents: /.env mint (issued) with /.env.local, /.env.backup, /.env.production answered 200; Laravel trap surfaces /_ignition/health-check, /telescope/requests, /storage/logs/laravel.log answered 200; two self-markers /_l2s_debug_probe__-class paths (/__l2s_debug_probe__, /reconx-790cadc585ee) answered 404; two POST /login webapp-form-login probes. 40+ events inside 0.7 seconds. The AWS side: 15 distinct read-only operations, 31 denials (GetSendQuota×9, ListSubscriptions×4, ListTopics×4, ListFoundationModels×3, ListAccessKeys×2) and 2 successful GetCallerIdentity calls.
• Assessment: a purpose-built credential-qualification kit — mint, test, enumerate, stop. The fleet held at every stage: the fake .env fed the theft, the fake Laravel surfaces denied code paths, and the AWS side leaked nothing beyond account identity. The escalation signal to watch is a write-shaped call (RunInstances class) from any future mint.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIRST FULL AWS WORK-SESSION — Hostile, active

• Actors: 28 collector IPs took 43 credentials in the window (digest issued rows: 50 — canary-farm-1 25 from 19 IPs, ai-devbox-1 12, control-1 8, ru-edge-1 5). Use IPs this window: 217.60.76.22 (RECONX-L2S) and 20.51.189.99 (GetCallerIdentity success on its 09:25 ai-devbox-1 mint, Firefox/125 X11 census operator).
• TTPs: unchanged — /.env-class mints to hostile collectors, then AWS-side validation. Failures: 19×400 pacing singles (canary-farm-1 9, ru-edge-1 4, ai-devbox-1 4, control-1 2), no 401s, no key errors.
• Assessment: same-window mint→use is now observed twice in two windows. Treat every /.env issued row as an operational credential within hours, not a dump awaiting resale. 52.161.59.96 — the №68 Tracebit-only-witness user — now has a flux-side mint (ai-devbox-1, 07:32:55 stored, forged Chrome/124.0.0.0 macOS), closing that attribution gap.

REGISTRY-HUNT / LeakIX (l9scan template + docker-registry walkers) ⟳ — THIRD MINT WINDOW, ZERO USE — Hostile, active

• Actors: at least 13 DigitalOcean walkers filled the digest's kill-chain rows with the 12-step walk (64.225.75.246, 139.59.143.102, 207.154.212.47, 209.97.180.8, 159.89.12.166, 167.99.182.39, 143.110.217.244, 147.182.149.75, 138.68.86.32, 142.93.0.66, 46.101.111.185, 64.226.65.160, 167.71.175.236). Six minted under wrapped l9scan/2.0…(+https://leakix.net) user agents 20:55–21:28 stored: 64.225.75.246 (control-1), 209.97.180.8 + 159.89.12.166 + 143.110.217.244 + 207.154.212.47 (canary-farm-1), 139.59.143.102 (ai-devbox-1).
• TTPs: the walk is unchanged (tarpit → /console/ WebLogic login → /server-status → Confluence login → WHM/cPanel proxy subdomains → /v2/_catalog → registry tags/list → manifests/latest). No AWS calls from the 6 fresh mints this window.
• Assessment: three consecutive mint windows, use in the two prior ones. The pattern is mint-and-hold between use bursts. Watch: delayed AWS operations from the 6, a second SSH-side use, and any walker that skips the walk and goes straight to /.env.

XFF-SWARM (distributed CI/CD-config census with per-request XFF forgery) ⚠ NEW — Hostile, watch

• Actors: 199 source IPs, 1–5 events each (average 3.0), 588 of 593 forgeries on frantech-ts, 3 on control-1, 2 on ai-devbox-1; active 12:35 stored 10-31 → 03:27 stored 11-01.
• TTPs: each request carried an X-Forwarded-For naming a source other than the socket peer — the single-entry forgery signal. Wordlist: /.env variants, /.gitlab-ci.yml, /.circleci/config.yml, /Jenkinsfile, /.travis.yml, /.git/credentials, /api/config, /v3/api-docs, /nginx.conf. Per-IP forged modern browser user agents (Firefox/125 X11, Safari 14.4.1, Android 14 Pixel 8 Pro, Win64 Chrome). 0 mints, 1 POST.
• Assessment: source-attribution poisoning at fleet scale, and the XFF counter is the detector — 593 this window against 2 last window. frantech-ts took 99% because it is certless; the same wordlist against a canary node would mint. The funnel's first XFF-forged mint is the promotion trigger.

VPN-CONF-HUNT (VPN/zero-trust config-store census) ⟳ — PROMOTED — Hostile, active

• Actors: 85.155.14.14 (SolidCore Hosting LTD DE — the №66 origin IP) on frantech-ts, 356 events / 356 unique paths, 17:49–17:53 stored; NEW sibling 85.155.14.32 on sponge-01-ts, 356 events, 21:46–21:47 stored.
• TTPs: same wordlist theme, now with a fourth forgery set — /.aws/credentials.bak, /.heroku/credentials, /surfshark, /zenmate, /warp.conf, /.linode, /.age, /.equinix.json, /.config/gcloud/access_tokens.db, /saml.json, /forcepoint.conf, /bastion.yaml, /.sso, /ikev2.conf; user agents rotate across Mac 14.4.1/14.5, X11 Linux, Win64, and Firefox/126. 0 mints.
• Assessment: the census wants tunnel and identity-store contents — VPN profiles, SSO material, cloud CLI tokens. The promotion triggers set at №66 are met: second and third node, sibling IP. The fleet answered 404-class throughout.

GOWEB-PENTEST (phpMyAdmin login-surface hammer) ⟳ — 25th–27th OPERATORS, ONE-PER-SENSOR SHAPE — Hostile, active

• Actors: 14.225.220.240 (VNPT, VN) netcup-ts 17:44:47–17:45:22; 217.160.35.149 (IONOS, DE) ai-devbox-1 13:19:19–13:20:24; 51.83.72.125 (OVH, FR) control-1 00:22:44–00:23:01. A fourth IP, 103.13.207.81 (Go-http-client/1.1), minted on control-1 at 16:08 stored and then ran 4 phpmyadmin-login events 16:09–16:10.
• TTPs: each operator fired 151 phpmyadmin-login events on 1 path in under 70 seconds under the honest self-label Go Web Pentest Tool. The trio owns netcup-ts's 68.0× spike (153 events). POST bodies carried no captured credentials this window (the verb was in its GET phase).
• Assessment: the same 151-event unit the registry has tracked for 22 windows, now spread one-operator-per-sensor inside a single window — parallelism replaced recurrence. The fake phpMyAdmin served forms throughout; nothing captured.

MEGA-DICTIONARY (dropper-URL dictionary replay) ⟳ — FIRST SAME-IP REPEAT — Hostile, active

• Actors: 135.136.19.27 (M247 Europe SRL DE, ipsum:1) — the №68 record operator — returned at 11-01 00:11 stored and replayed the identical 14,154-path wordlist (the 00:00 UTC hour holds 14,204 frantech-ts events; 28,326 events across the 24-h window counting №68's pass in the overlap).
• TTPs: unchanged — all-unique-path GETs, forged IoT router/NAS user-agent sets, 0 POSTs, 0 mints. The fake surfaces answered 404-class.
• Assessment: the №68 watch item is answered: the record operator is persistent infrastructure, not a one-shot. Same-IP next-day repetition makes 135.136.19.27 a named watchlist entry; a third pass would show a schedule.

OPENAPI-CENSUS (API-spec + app-config census) ⟳ — FIRST MINTS — Hostile, active

• Actors: 193.47.62.29 (BestDC Limited BG) minted 4 credentials — one per canary sensor, 10:44–10:51 stored — under the honest user agent db-secret-scanner/parsing.py. 193.47.62.32 (same /24) ran 103 events on the 4 deception nodes under Go-http-client/1.1.
• TTPs: the spec/config census shape is unchanged; the mint user agent is new for the class and honestly self-labeling.
• Assessment: the №68 watch item ("a first mint from this class") is answered. Four credentials entered the drain from this operator; AWS use of them is the immediate check.

XMLRPC-BRUTE (system.multicall floods) ⟳ — RETURN AFTER TWO IDLE WINDOWS — Hostile, active

• Actors: 45.94.31.16 (1337 Services GmbH NL) — the hosting profile of the campaign's earliest registered operators.
• TTPs: 1,000 multicall POSTs to /xmlrpc.php on ai-devbox-1, 20:15–20:22 stored, under forged Chrome/78; plus single wp-wlwmanifest and wp-user-enum-rest-list probes. A background low-and-slow multicall spray of 1-POST residential IPs continued underneath (for example 212.47.147.176, 71.200.76.135 — bodies begin <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…, quoted head; the remainder is routine XML).
• Assessment: the registered 1,000-POST batch shape, third known hosting block to run it. The fake WordPress answered throughout; 0 mints — login surfaces are not trap families.

CONFIGBUNDLE-SWARM (multi-pool config-bundle census) ⟳ — RETURN, NEW POOLS — Hostile, active

• Actors: 194.5.53.x — 36 IPs, canary-farm-1 + lauterbourg-01-ts, 311 events, 137 paths, 1 mint (194.5.53.193, python-requests/2.34.2); 163.5.241.x — 16 IPs, both EU nodes, 150 events, 1 mint (163.5.241.4, Chrome/105 macOS forgery); 82.197.193.x — 21 IPs, 2 nodes, 103 events, 3 mints (.60 and .98 on canary-farm-1, .143 on ru-edge-1); 185.132.187.x — 29 IPs, canary-farm-1, 121 events, 0 mints.
• TTPs: 2–10 events per IP, user agents rotate across browser forgeries and end at python-requests/2.34.2. The pools own canary-farm-1's webapp-config-bundle-js spike (66 events, 3.9×). 5 mints, 0 observed use.
• Assessment: the swarm model — many light IPs, one wordlist — now runs from four unrelated egress blocks. Every mint is a drain candidate; AWS use is the check.

CONFIG-SWEEP (single-minute config census, forged Googlebot) ⟳ — RETURN, NEW OPERATOR — Hostile, active

• Actors: 93.152.209.6 (Omniline Investment s.r.o., BG), canary-farm-1 only.
• TTPs: 94 events / 94 unique paths / 40 trap families in 63 seconds (18:15:47–18:16:50 stored) under forged Googlebot/2.1, with the kmonbase random-stem markers (/kmonbaseqt267a64a7, /kmonbasezde99bad72) plus the full config battery (/.kube/config, /.ssh/id_ecdsa, /terraform.tfstate, /database.yml, /backup.tar.gz, /secrets.yaml). The same IP collected 3 mints 10-24 → 10-27 per the 6-day Tracebit history.
• Assessment: the kmonbase marker — №67's holder was 176.65.144.71 — has moved to a new operator block, the second template hand-off this window. The fleet minted against it before and held.

CREDSWEEP class (exhaustive .env-variant census) ⟳ — EIGHTH WINDOW — Hostile, active

• Actors: 45.138.12.51 (Tc Datacenter LT) under l9explore/1.2.2 — 63 events on 3 sensors plus a /.env mint on ai-devbox-1 at 04:24 stored; 45.138.12.35 ran canary-farm-1 only (385 events, 00:44–04:10 stored); 194.180.49.41 (MEVSPACE) ran 37 events on 5 sensors and minted on control-1 at 23:24 stored under Go-http-client/1.1. 45.138.12.16 and .6 were absent.
• TTPs: unchanged per-sensor walks from one /24; the /.env [not-handled] cluster in the digest (signature 1f095db64028, 4 IPs, frantech-ts + netcup-ts + sponge-01-ts) is this template and its tail viewed from the certless nodes, where /.env is not a trap path — not a new campaign.
• Assessment: eighth window, 2 mints, still zero observed use from the class. The l9explore UA remains the shared-tooling link to REGISTRY-HUNT (third sighting).

Light watchers

• 45.148.10.120 (Techoff Srv NL; ipsum:1, firehol2) — 4 mints on canary-farm-1 04:12–04:23 stored (12 per 6-day history). The census-plus-mint arm holds; №68's AWS-side user 185.209.196.169 did not fire again.
• 154.162.45.255 — 5 mints (3 canary-farm-1, 2 control-1) under a bare stripped Mozilla/5.0 (Windows NT 10.0; Win64; x64) UA. New collector, no campaign shape yet.
• 150.241.66.127 — 3 mints on ai-devbox-1 01:45 stored (4 per 6-day history since 10-28).
• 217.60.195.235 — 1 mint on canary-farm-1 (Chrome/81 forgery); second LIBREDTAIL-/16 collector this window alongside RECONX-L2S.
• 212.56.54.43 — 1 mint on canary-farm-1 (06:18 stored) under forged Chrome/143 — a version that does not exist yet, which dates the forgery.
• /-tarpit loopers — 91.92.40.12 (all 8 sensors, 551 events), 93.174.93.12 (7 sensors, 367) and 89.248.172.33 (7 sensors, 333), both Python/3.10 aiohttp/3.8.4; 45.138.12.19 hammered / 1,241 times across 5 sensors under osint-scanner/1.0 — benign-listed in the registry, volume quoted for the record.
• Diffuse webshell-sweep wave — frantech-ts's webshell-sweep-observed spike (55 events, 11.7×) has no single operator: roughly 25 light IPs at 2 events each probed /info.php, /phpinfo.php, /0.0_phpinfo.php, /1_1_PhpInfo.php, /config.inc.php — a planted-webshell-checker wordlist. Contributors include the 173.239.214.x trio (X11 Linux UA), 194.180.49.41, and 20.51.189.99.
• Lauterbourg templates alive — the ANDROXGH0ST-KIT cluster (signature 2d3e95b722b5, 4 IPs, 164 events, recurring since 10-24) and the cmd-injection cluster 5e7a5d88d947 (8 IPs, /bin/sh cgi-traversal RCE probes across 5 sensors, 24 events) both persist at low volume.
• Benign research — Censys-range and honest scanner traffic stayed shallow; no benign-listed operator crossed into hostile behavior this window (45.198.224.125's forged Firefox/71 remains hostile-light at 19 events).

Standing actors (persistence check)

• REGISTRY-HUNT DigitalOcean pool — present every window on record; minting for three consecutive windows.
• 45.138.12.x (Tc Datacenter LT) — eighth window; .51 minted, .35 farm-only.
• Techoff blocks (45.148.10.x NL, 195.178.110.x BG) — mint arm active (12 per 6 days for .120).
• 194.180.49.41 (MEVSPACE) — recurring light census arm, now with a control-1 mint.
• 102.220.163.241 (SI-CENSUS) — returned after two idle windows, 4 mints on 4 sensors, 74 per 6-day history.
• 23.132.164.201 — idle-hoard candidate, minted 2 more (9 per 6 days) under a SonyEricsson feature-phone UA and an Android 4.4 forgery.
• TechTies / JNDI-FIELD-INJECT pile — 93.152.221.96 static at 1,088 mints; third consecutive idle window for the injection side.

Absent or paused

WIDE-CONFIG-CENSUS (50.19.185.106), METADATA-HUNT named runners, OMEGA-SWEEP, CF-FRONTED CREDSWEEP, NIGHTAGENT, BUCKLOG-KIT POST stages, CENSUS-284, CRUSADER-SWEEP, KEYDROP-SCANS, WP-XRPC-WALK, TECHOFF-KIT 195.178.110.x spec legs, EXCHANGE-DICT, 8.217.152.4, 140.245.97.208, 121.40.140.50 and 136.70.193.85 (lauterbourg-01-ts baseline heavyweights).

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-10-31 07:33:00 → 2026-11-01 07:33:51 UTC

Fingerprint field ssh.hassh, destination port 22 · 138,121 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 102,600, bahrain-sponge-01-ts 70,338, sensor:bahrain-sponge-01-ts 70,338, sensor:lauterbourg-01-ts 12,878, contabo-sponge-02-ts 11,929, proxy 11,929

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 3,513 sessions from 422 source IPs across 197 networks in 61 countries, port 22, avg 4,946 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS8075 Microsoft Corporation, AS16276 OVH SAS, AS14061 DigitalOcean, LLC, AS150436 Byteplus Pte. Ltd.. Busiest sources: 92.27.101.99, 207.57.127.177, 187.212.13.248, 51.75.27.218, 8.222.225.214. Last 7 days: 10-26 599 IPs, 10-27 653 IPs, 10-28 615 IPs, 10-29 657 IPs, 10-30 583 IPs, 10-31 455 IPs, 11-01 168 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 1,911 sessions from 101 source IPs across 47 networks in 24 countries, port 22, avg 5,089 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS45090 Shenzhen Tencent Computer Systems Company Limited, AS51167 Contabo GmbH, AS16276 OVH SAS. Busiest sources: 175.196.78.7, 8.138.210.122, 8.130.97.165, 60.205.141.233, 8.138.45.99. Last 7 days: 10-26 41 IPs, 10-27 183 IPs, 10-28 119 IPs, 10-29 164 IPs, 10-30 20 IPs, 10-31 101 IPs, 11-01 13 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 33,648 sessions from 85 source IPs across 34 networks in 23 countries, port 22, avg 5,217 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS14061 DigitalOcean, LLC. Busiest sources: 109.160.32.156, 109.160.32.110, 109.160.32.119, 77.239.124.149, 109.160.32.148. Last 7 days: 10-26 38 IPs, 10-27 53 IPs, 10-28 48 IPs, 10-29 58 IPs, 10-30 83 IPs, 10-31 79 IPs, 11-01 42 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: GO-SSH-SWEEP (0a07365cc01f…) is the top inbound fingerprint on 6 of 8 nodes and grew +3,870 sessions day-over-day (33,648). GO-SPRAY-SWEEP re-crossed the dispersed threshold (20 → 101 source IPs, +81). LIBSSH-MASSSWEEP shrank for a second day (616 → 422 source IPs) but still spans 197 networks. No new fingerprints; 41 standing. The 109.160.32.x source block inside GO-SSH-SWEEP again overlaps the uname discovery operators on the frantech-ts honeypot below (example source 109.160.32.148), so the sweep infrastructure and the post-auth shell operators still share hosts. CTL-MASS-SSH (4e066189c3bb…) again owns control-1 (33,077 sessions).

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (33 use events across 2 credentials). Fleet sensors minted 43 credentials to 28 collector IPs; 2 credential(s) reached AWS. Use outcomes: 31 failure, 2 success. Denied operations: GetSendQuota×9, ListSubscriptions×4, ListTopics×4, ListFoundationModels×3, ListAccessKeys×2. 2 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 1088 mints, 2026-10-25 15:18 → 2026-10-27 21:29
• 102.220.163.241: 74 mints, 2026-10-25 09:28 → 2026-10-31 12:39
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 34.95.21.228: 41 mints, 2026-10-28 18:17 → 2026-10-28 18:17
• 45.148.10.120: 12 mints, 2026-10-28 13:34 → 2026-10-31 04:23
• 46.151.178.15: 12 mints, 2026-10-25 17:05 → 2026-10-29 00:56
• 176.123.5.6: 9 mints, 2026-10-29 02:21 → 2026-10-29 02:21
• 23.132.164.201: 9 mints, 2026-10-28 17:55 → 2026-10-31 21:25
• 162.35.242.53: 6 mints, 2026-10-29 15:00 → 2026-10-30 09:33
• 45.138.12.16: 6 mints, 2026-10-28 03:14 → 2026-10-30 18:07
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 105.112.24.243: 5 mints, 2026-10-28 09:46 → 2026-10-28 10:41
• 154.162.45.255: 5 mints, 2026-10-31 15:45 → 2026-10-31 16:29
• 202.65.238.233: 5 mints, 2026-10-29 07:43 → 2026-10-29 07:48
• 206.81.24.74: 5 mints, 2026-10-25 21:04 → 2026-10-29 20:56
• 208.84.100.218: 5 mints, 2026-10-26 01:31 → 2026-10-26 03:41
• 45.138.12.51: 5 mints, 2026-10-27 02:04 → 2026-11-01 04:24
• 140.245.97.208: 4 mints, 2026-10-28 00:50 → 2026-10-28 00:54
• 143.110.217.244: 4 mints, 2026-10-26 21:51 → 2026-10-31 21:21
• 147.182.149.75: 4 mints, 2026-10-25 21:19 → 2026-10-29 19:21
• 150.241.66.127: 4 mints, 2026-10-28 10:00 → 2026-11-01 01:45
• 193.32.248.165: 4 mints, 2026-10-29 22:37 → 2026-10-29 22:53
• 193.47.62.29: 4 mints, 2026-10-31 10:44 → 2026-10-31 10:51
• 213.209.159.154: 4 mints, 2026-10-26 22:00 → 2026-10-27 11:08
• 45.138.12.6: 4 mints, 2026-10-28 16:49 → 2026-10-30 14:19
• 64.225.75.246: 4 mints, 2026-10-28 21:37 → 2026-10-31 20:55
• 64.23.218.208: 4 mints, 2026-10-25 21:41 → 2026-10-30 21:03
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 93.123.109.107: 4 mints, 2026-10-29 17:03 → 2026-10-29 22:21

Attribution notes: the two use credentials belong to RECONX-L2S (217.60.76.22 — minted under ReconX-L2S/1.0, worked within hours) and 20.51.189.99 (a Firefox/125 census operator). REGISTRY-HUNT's six l9scan mints and OPENAPI-CENSUS's four db-secret-scanner mints stayed idle this window — both are now holding pools the next windows must watch.

Fleet Observations

• Volume shift, explained. frantech-ts ran +173% above its 7-day baseline on two passes of the same 14,154-path dictionary replay by 135.136.19.27 (14,185 events in the 04:00 UTC hour of 10-31 — №68's pass, in the window overlap — plus 14,204 in the 00:00 hour of 11-01). Every other node ran below baseline (ai-devbox-1 −52%, canary-farm-1 −85%, control-1 −74%, lauterbourg-01-ts −77%, ru-edge-1 −93%; netcup-ts +17% and sponge-01-ts +11% on light census traffic) because the №64–№66 mega-crawlers, №68's wp-login spray, and the big single-IP censuses all stayed idle. Coverage is verified: every sensor's latest event in v_full lands 10:48–12:33 stored on 11-01, so the drops are real, not sync gaps. Window overlap applies as always: events between digest runs appear in two digests.
• Canary economics. Digest issued rows: 50 mints (canary-farm-1 25 from 19 IPs, ai-devbox-1 12, control-1 8, ru-edge-1 5). Failures: 19×400 upstream rejections in pacing singles (canary-farm-1 9, ru-edge-1 4, ai-devbox-1 4, control-1 2) — no 401s, no key errors. The Tracebit funnel (client-side window trim) counts 43 credentials to 28 collectors, 2 used in AWS, 33 use events (31 denied, 2 GetCallerIdentity successes). netcup-ts, sponge-01-ts, and frantech-ts mint 0 by design (certless); lauterbourg-01-ts ships TRACEBIT_API_KEY= empty, so its absence is config, not failure.
• Attribution/TLS posture. 2,070 requests carried X-Forwarded-For; multi-entry chains 597; XFF-ignored 10; single-entry forgery 593 — the XFF-SWARM census owns 588 of them on frantech-ts. Quote the socketPeer, never the claimed source, for anything in that wave. TLS ran http-led on every node; frantech-ts was all-HTTP (30,480). Top Host header: 209.141.62.110 29,876 (the replay), then sso.rightabouteverything.show 1,326.
• Control-1 discovery velocity. 50 days live. Most recent full day in the window (10-31): 1,566 events / 138 unique IPs; the window's partial 11-01 day ran 1,179 / 104. The 7-day band runs 892–16,293 events with unique IPs at 102–178 — the ramp holds, and the network layer still points the fleet's heaviest single-fingerprint SSH load at this node (4e066189c3bb…, 33,077 sessions).
• First-seen caveats. All first-seen rows in this digest share one sync-batch timestamp (02:15:54 stored), so they are an inventory, not a timeline. The XFF-SWARM wordlist and the VPN-CONF-HUNT paths above are attributed by direct journey queries, not by the table's timestamps.
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 612 sources sent credentials → 473 got a shell (77%) → 415 ran a command (88% of shell-getters, 68% of sources). Event level: 9,136 credential attempts → 4,671 accepted logins → 11,390 commands (244% of accepted logins go on to run something). Telnet (commodity IoT botnets): 583 attempts.

New commands: zero (0 of 4,292 distinct) — a quiet window; operators re-ran known tooling only. New credential pairs: 0 of 3,457 offered. Concentration is unchanged and belongs to one family: 345gs5662d34/345gs5662d34 758 attempts plus root/3245gs5662d34 554 (1,312 combined), then commodity pairs (root/123456 78, user/wasd 63, pi/raspberry 61).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (1,718 + 1,705 events from 3 IPs, example source 109.160.32.148 — a GO-SSH-SWEEP source address), the chattr -ia .ssh + SSH-key-plant pair (791 and 661 events from 359 and 317 sources), and the GPU-discovery strings (nvidia-smi -q | grep "Product Name", lspci | grep VGA — 251 events each from 179.43.153.10 and 3 siblings) all held steady.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 77 endpoints on 22 hosts, 2497 command references and 636 download attempts since 2026-09-18T10:45
• served payloads: 22 distinct artifacts over HTTP 2xx from 7 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37)
• this window: 4 endpoints first seen, 4 active; 33 endpoints seen in the last 7 days remain current
• inventory generated 2026-11-01T07:25:29Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: the new payloads are the jklarm dropper scripts already registered under HONEYPOT-C2 — cf0b50b8b7a8 (1,476 B) and a8db671b58d0 (1,477 B) each run busybox wget across 11 architecture variants and launch ./jkl<arch> selfrep (stage-2 paths http://45.90.163.37/jkl{arm,arm5,arm6,arm7,m68k,mips,mpsl,ppc,sh4,spc,x86}, then self-delete). 45.90.163.37 is therefore the third staging host for this Mirai-selfrep family, after 176.65.139.40 and mirror 185.228.72.128. The jkl* ELF binaries themselves were not captured this window (the wget.sh/curl.sh scripts fetched 2xx; the tftp and ftp legs returned none).

Gaps / Next Collection

1. RECONX-L2S follow-up. One IP, one window. Watch 217.60.76.22 and any ReconX-L2S user agent for a second pass, a second fleet IP, and — the escalation signal — any write-shaped AWS call (RunInstances class) from its 2 held credentials.
2. XFF-SWARM spillover. The wordlist ran against certless frantech-ts. If it reaches a canary node, every forged-source request becomes a mint; check the funnel's first XFF-forged mint and treat its AWS side as the campaign's purpose test.
3. The holding pools. Three groups now hold fresh credentials with no observed use: REGISTRY-HUNT's 6 l9scan mints (third window), OPENAPI-CENSUS's 4 db-secret-scanner mints, and CONFIGBUNDLE-SWARM's 5 pool mints. Any AWS alert against them names the operator's work schedule.
4. jklarm stage-2 binaries. The jkl* ELF samples from 45.90.163.37 were not captured (only the fetcher scripts). If a jkl* URL appears in a future capture vault pull, read the binary headers to confirm the family lineage against the 176.65.139.40 set.
5. GO-SPRAY-SWEEP trajectory. 20 → 101 source IPs in one window. A move past the 200-IP mass threshold would make it the fleet's widest SSH sweep on record.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-01-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-01.md