FLUX FLEET — INTEL BRIEFING №2

Period: 29–30 Aug 2026 (24h, day 2 of operations) Sources: 3 honeypot nodes — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East) Confidence: High (direct observation; first baseline-backed window) Related: Briefing №1 (docs/intel/flux-fleet-intel-briefing-2026-08-29.md); digest medina:/data/flux-logs/reports/flux-digest-2026-08-30.md

BLUF

All four day-1 campaigns recurred on schedule — campaign-signature tracking proved out on its first day (⟳ recurrences across IP rotations). The AI/dev node became the fleet's hottest target (+647%, 413 unique IPs) and the fleet's top canary source (58 mints). A new campaign (WP-BATCH) was caught attempting log poisoning — spoofed X-Forwarded-For: 127.0.0.1 headers designed to make attacks look like localhost activity in downstream analysis — and the underlying flux attribution bug they were exploiting was found and fixed fleet-wide within hours. 77 canary tripwires are now in attacker hands; callbacks pending.

Key Judgements

  1. Campaigns are persistent infrastructure, not one-offs. Every day-1 campaign re-appeared on day 2 with fully rotated source IPs but identical tooling fingerprints. The registry-hunt is on its second IP set (6 fresh DigitalOcean nodes) running the byte-identical 12-step journey. (High confidence — signature tracking)
  2. The AI/dev surface attracts disproportionate targeting. +647% event growth vs farm's −14% — the inference.fapthropic.com identity, LLM/MCP/Docker traps, and AI-themed hostname are drawing scanner interest at multiples of the "hot cloud IP" farm rate. FLEET.md's fastest-moving-surface thesis confirmed in 48h. (Moderate-high confidence — single day, but large effect)
  3. Google Cloud hosts a scanning platform family. At least 6 distinct GCP IPs (US, JP, SA, ID, HK regions) ran comprehensive 65–130-family template sweeps with POSTs — industrial-scale, region-distributed, likely a commercial scan service. GCP should be considered the primary hostile-scan hosting platform in current ops. (High confidence)
  4. At least one actor deliberately targets log analysis. WP-BATCH forged X-Forwarded-For: 127.0.0.1 + X-Real-Ip: 127.0.0.1 to appear as localhost activity — log-evasion tradecraft, suggesting an actor that anticipates defenders reading logs. (High confidence — direct observation)

Active Campaigns (day 2 status)

⟳ REGISTRY-HUNT (supply-chain recon) — recurring, expanded

  • Day 2: 6 fresh DigitalOcean IPs per EU node signature (206.189.19.19, 159.89.127.165, 64.225.75.246, 178.128.207.138, 142.93.129.190 + carryover), 246 events per signature, byte-identical 12-step journey including internal Docker registry enumeration (/v2/internal/api-gateway/, /v2/internal/auth-service/)
  • Two signature variants persist (farm vs aidev tails differ slightly) — same operator, per-target tooling variation
  • Still hasn't touched the control node — it targets EU/cloud-identity boxes specifically

⟳ RCE-SWARM (phpunit/CGI) — recurring, now fleet-wide

  • Signature now ⚠FLEET-WIDE: hit control-1 overnight (64 phpunit-eval-stdin events — its first RCE-family contact), confirming the swarm sweeps everything it can reach, not just cloud-EU
  • Continued POST-bearing exploitation attempts against both EU nodes

⟳ CREDSWEEP (credential-file harvesting) — recurring

  • 213.209.159.175 (Feo Prest, listed) returned with another 334-event sweep; the .env-variant population keeps growing (new day-1 families: /open/, /.env.swp, /conf/.env, Pipfile, cert.pem, swagger-ui.html)
  • New persistent stalker: 204.76.203.18 (Pfcloud UG, NL, ipsum-listed) — 2,173 events over 28h continuous against the control node (562 paths, low-and-slow broad recon). Control is being systematically indexed
  • 87.120.104.29 (BG-linked) was control's #1 journey actor (365 events, 71 families) on day 2

⚠ NEW: WP-BATCH (WordPress batch abuse + log poisoning) — hostile, evasive

  • POSTs to /wp-json/batch/v1 variants (incl. /wordpress/, /blog/ prefixes) with {"requests":[]} bodies, UA WordPress/6.4.3 and forged Chrome — every request carried spoofed X-Forwarded-For: 127.0.0.1 / X-Real-Ip: 127.0.0.1
  • ~12-min periodicity over 8h (01:17–09:04 UTC) on the farm — automation, not manual
  • Root cause exploited: flux's XFF parser returned the attacker-controlled value when all chain entries were internal (return parts[-1] fallback). Fixed fleet-wide 2026-08-30 (return "", fall back to TCP peer); verified spoofed single- and multi-entry chains now resolve to real peer IPs. Upstream-worthy fix
  • Assessment: WordPress REST-API batch exploitation scouting paired with deliberate log-poisoning tradecraft

⟳ METADATA-HUNT (cloud SSRF/IMDS) — recurring, industrialized

  • Multiple GCP IPs running 65–130-family template sweeps with POSTs (35.245.230.215 US, 136.110.80.233 JP, 34.166.182.179 SA, 34.50.64.250 ID, 34.92.76.191 HK) — 136.110.80.233 minted canaries (/.env → issued, aws-credentials files) and probed /__aws_leak_probe_* canary tables on both EU nodes
  • These scans find the canary table markers — they are collecting our tripwires. Callback watch intensifies

New actors of note

  • Techoff Srv Limited (NL/BG, ipsum:3) — POST-bearing probes on farm + control (93.123.109.163, 45.148.10.238)
  • 41.251.202.89 (Moroccan Postal Service ASN) — 148 events, 18 POSTs against the farm — residential-ISP-sourced scanning (rare in this dataset)
  • RMP Protection Ltd (BG) — 365 events, 71 families on control, CI-config-focused (/.circleci/config.yml, /.git/*, .ssh keys)
  • vmi3177282.contaboserver.net (rDNS hostname) appeared as Host header on 3,268 aidev events — a scanner population resolving and using rDNS names

Fleet Observations

  • Canary distribution at scale: 77 mints in 24h (aidev 58, farm 12, control 7 — control minting means the baseline node is now issuing tripwires too). All mints are aws-type; gitlab/ssh types waiting for matching actors. The mint-failure investigation: aidev bare /.env mints 400-rejected by Tracebit during the 00:00–05:00 burst (143×) while variant paths minted fine — pattern suggests upstream duplicate/rate rejection during sweep bursts; monitoring, not actionable fleet-side
  • Farm 401s cleared: zero mint auth failures post-key-fix — the residual 401s in the digest window predate the repair
  • Discovery velocity (control): day 2 = 3,186 events / 70 unique IPs (day 1: 2,052/39) — +55% growth on a certless fresh IP with zero deliberate discovery surface. The Internet's background radiation alone is a growing workload
  • XFF posture: 2,101 requests now arrive with X-Forwarded-For (caddy TLS front traffic + forgeries); zero forged chains post-fix (was the poisoning vector)
  • Host census quirk: aidev's rDNS name drew 3× more requests than its IP literal — scanner populations do reverse-lookups; the fake-domain strategy may benefit from matching rDNS/PTR records in future deployments

Gaps / Next Collection

  1. Tracebit callback watch intensifies — 77 distributed tripwires; first callback = attribution breakthrough
  2. Aidev /.env 400 rejections: collect Tracebit API response details if the pattern repeats (flux logs truncate error bodies); consider whether flux should back off / vary mint labels on 400
  3. Campaign persistence: registry-hunt on day-3 watch; if it rotates to a third IP set, the signature table becomes the primary tracking artifact (IPs are irrelevant)
  4. Journey-signature granularity: registry-hunt's two variants suggest hashing only the first N=12 steps may unify variant families — test next digest cycle