FLUX FLEET — INTEL BRIEFING №29

Period: 2026-09-22 07:33 – 2026-09-23 07:33 UTC (24h, day 28 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 28-day baseline; every result-tag spike traced to a source by spot query)

BLUF

The XFF forgery counter's №28 anomaly is now attributed, and it is one actor: socket peer 102.220.161.87 (VPS Dedicated SI, the standing CREDSWEEP operator) ran its waves across 13.5 hours — 16,544 of the window's 17,561 mismatch rows carry its socket peer, and the forgeries name 8,616 rotating addresses. The forgeries are the ru-edge-1 +275% node spike: at least 10,062 of ru-edge's events came from .87's forged identities, 4,548 of them in the 10:00–19:00 UTC wave that also produced 4,602 of the node's 4,979 unique IPs. Zero AWS use for the sixth consecutive window — 40 credentials went to 30 collector IPs and none converted, so the №28 gap item closes with a hoard verdict, not a consumer. MEGA-DICTIONARY ran a seventh replay (185.209.196.130, 31173 Services AB DE) whose wordlist grew for the first time since №25: 13,008 of 13,134 paths overlap the standing list, and the +126 delta adds eight fresh build stems plus a /bins/redkill.* family. LIBSSH-MASSSWEEP cooled to 301 source IPs from its 327–373 peak; GO-BANNER-SWEEP's pause is settled with a second below-floor miss.

Key Judgements

1. The XFF mismatch wave is one operator hiding a volumetric sweep behind forged client identities, not a scanner fleet. All 17,512 mismatch rows in the window carry socketPeer=102.220.161.87 (16,544) or socketPeer=203.175.125.156 (968); .87 alone asserted 8,616 distinct client IPs across 2,052 paths (mean 2.16 rows per forged address, max 9). The waves are timed, not ambient: 08:27–13:04 UTC (3,994 rows, 1,716 IPs, split 1,995 aidev / 1,999 ru-edge), 12:30–13:04 continuation (3,652 rows on the same node pair), and a 18:01–21:53 straggler tail (430 rows, 409 IPs) plus a separate 968-row burst from .156 at 07:41:43–47 on frantech-ts (968 asserted IPs, 886 paths in under 4 seconds). (High confidence — xffPeerMismatch + socketPeer grouping on v_full; the counter was built for exactly this pivot and its deploy-verification probes are the only prior benign hits.)
2. The .87 forgeries are a volume attack that also poisons first-seen and unique-IP counters; the campaign underneath is still CREDSWEEP. The forged-identity waves ride a 5-UAs-per-IP rotation over the registered .env-variant census families (/redmine/.env, /media/.env, /app_dir/.env, /core/Datavase/.env — the №13 CREDSWEEP fingerprint), with phpinfo walks, phpmyadmin-credential-post (48), and webshell probes underneath; the true-IP leg ran 3,843 rows / 826 paths, 0 mints. First-seen inventory on ru-edge (20 rows at 03:16 sync time) is this wave's tail, not a new actor. (High confidence — forged and true rows share the result families; .87 is the registered CREDSWEEP operator since №13.)
3. MEGA-DICTIONARY's wordlist moved for the first time in four replays: +126 paths, and the delta names eight fresh random build stems. 185.209.196.130 (31173 Services AB, DE; first appearance) replayed 13,134 paths in 89 s at 01:34–01:36 UTC on frantech-ts with the standard 208-IoT-UA rotation; anti-join against all prior frantech history gives 13,008 overlap + 126 fresh. The fresh set is architectural, not incidental: eight 8-char random stems × 8–19 architectures each (acvdfpmy, wezpffnw, ooikocqj, atjozltp, cwlfkwnt, xdzlewkx, tpijtvcr, ypezhbfg), plus /bins/redkill.* (12 archs), /bot.*, /i/<arch>, and a new /stub.mipsel — the same per-arch fan-out shape as the registered manta/sever1078/nokillbins families, which did NOT recur. (High confidence — full anti-join on the frantech path set; the stems have zero prior rows fleet-wide.)
4. The hoard passed 40 credentials from 30 collectors with zero consumption; CREDENTIAL-DRAIN's mint side is now wide and diffuse, its use side dark for six windows. The largest single-window collector set since tracking began (30 IPs vs 22 in №28) minted 40 credentials; 17 are first-ever collectors, and the OMEGA /46 block contributed only 3 (94.154.46.247 ×2, 94.154.43.122 ×1) — the block that minted 35 in №28 went quiet. New multi-mint collectors: 179.43.150.26 (5 across ru-edge/control/aidev, one Mozilla/5.0-bare census, 218 window events) and 45.148.10.171 (3, spread over 3 nodes with 3 rejected /.env attempts in between — the №22 CREDSWEEP-sibling lineage). (High confidence — Tracebit pull cross-checked against issued rows; the per-collector table below carries the 6-day history.)

Active Campaigns (day 28 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — SIXTH ZERO-USE WINDOW (Hostile, active)

• Actors: 30 collector IPs this window (17 first-ever); top holders 213.209.159.175 (50 in 6 days, 3 this window), 179.43.150.26 (5, first window), 94.154.46.244 (16, absent since 09-19), 45.148.10.171 (3). Use side: no AWS activity observed.
• TTPs: 40 credentials minted (digest 47 issued rows straddle the +4h cast boundary; the Tracebit pull is the credential count), 82 upstream rejections (400 Bad Request: ru-edge 31, farm 26, aidev 21, control 4). Mint types: aws on all 4 canary-bearing nodes. ru-edge's 31 rejections sit inside the .87 forged-identity waves — the census fired /.env at burst speed and the upstream rate-limiter refused most of them; php-filter-tracebit-http-error (33) is the same rejection surfaced through a different trap.
• Assessment: the collector set widened at the same moment the OMEGA /46 block went quiet — mint volume now comes from many one-touch collectors instead of two census families. Six windows of zero use says the credentials are being stockpiled, resold, or consumed outside AWS; the persistent list below stays the watch set.

CREDSWEEP / FORGED-IDENTITY WAVES ⟳ — MISMATCH COUNTER'S FIRST MASS EVENT (Hostile, active, renamed trigger event)

• Actors: 102.220.161.87 (VPS Dedicated LLC, SI; standing operator since №13, Mozlila-family census lineage) — 3 waves 08:27–13:04 UTC + straggler to 21:53; 203.175.125.156 (IP Routing Networks / Intergrid SRL family, first appearance) — one 968-row burst 07:41:43–47 on frantech-ts.
• TTPs: single-entry X-Forwarded-For on every row (8,616 rotating asserted IPs from .87, 968 from .156 — none match the socket peer); 5 rotating browser UAs (Chrome 124/125, Safari 17.4.1, Firefox 125, Edge 124) over the .env-variant census; results dominated by tarpit-module (6,050), not-handled (3,030), phpinfo-error (1,102), env-production-error (789); 48 phpmyadmin-credential-post; 0 mints across both actors. The .156 burst covered 886 paths in 3.9 seconds with one forged IP per row — pure identity laundering on the same census shape.
• Assessment: .87 used the mismatch counter's blind spot in reverse — flood with forged sources so per-IP blocking, rate limiting, and first-seen tracking all fragment. The counter caught it on day one of deployment at scale. The campaign beneath (credential census) is unchanged; the TTP layer (attribution forgery) is new for this actor. Treat any future mismatch spike as this actor returning until a second socketPeer proves otherwise.

MEGA-DICTIONARY ⟳ — SEVENTH REPLAY, WORDLIST GREW +126 (Hostile, active)

• Actors: 185.209.196.130 (31173 Services AB, DE; first appearance by this ASN). Prior hosts: 23.234.119.20 (tzulo US), 155.2.191.165 (Host Universal AU), 169.150.201.29 (Datacamp DE), 138.199.6.195 (Datapacket CH), 138.199.60.29 (Datapacket CH), 138.199.60.16 (Datacamp SG).
• TTPs: 13,134 GETs / 13,134 paths / 208 UAs in 1m29s (01:34:48–01:36:17 UTC), 13,130 not-handled, 0 mints; top UAs IoT firmware strings (UniFi Dream Machine, curl/8.5.0, Dlink DIR-862, Phicomm P804-N2, RouterOS/3.8.4). Wordlist now 13,000 + /stub.*×5 + the new families above — the four old build-tag families (manta, sever1078, nokillbins, minerd) contributed 0 rows this replay.
• Assessment: seven replays, seven hosts, one shared manifest that changed hands with a version bump. The random 8-char stems are new-bot drops waiting on live C2; the version tracker stands.

REGISTRY-HUNT / LeakIX ⟳ — 4 RUNNERS, 2 MINTS (Borderline, active)

• Actors: 4 full-kit l9scan IPs (DigitalOcean), all ai-devbox-1: 138.68.86.32, 139.59.132.8, 64.225.75.246, 45.138.12.51 (41 ev each, l9explore for .51); 159.223.132.86 + 46.101.111.185 + 128.199.182.152 + 146.190.103.103 fragments on farm. 138.68.86.32 and 139.59.132.8 minted 1 each.
• TTPs: the 12-step WebLogic → Confluence → WHM/cPanel → docker-registry census (/v2/internal/api-gateway/tags/list, manifests/latest, auth-service/tags/list).
• Assessment: contracted to its smallest wave on record (4 named runners vs 24 in №15, 7 in №28) and aidev-only. The 1-mint-per-IP cadence broke for 2 of 4 runners — the sixth window running with LeakIX as a steady, low-volume collector.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest DE) — 17th consecutive window: control-1 3 mints inside 74 events + farm touches; 50 mints in the 6-day pull, still the fleet's top persistent collector; zero AWS use.
• 213.209.159.154 (Feo Prest DE) — 18th window, second /24 operator: farm + ru-edge 1 mint each, 38 window events; widened no-canary passes continue.
• 80.94.95.211 (SS-Net RO, SS-NET TOOLING) — returned after one idle window: aidev 330 ev / 326 paths (11th window in 14), 0 mints this window (27 in 6-day pull); the №22-observed wordlist-sharing with Feo Prest .175 still holds.
• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 2,334 ev on control + ru-edge (day files: 1,855 + 479 in-window), 572 paths, 0 mints: the continuous loop regime from №13 holds, no growth.
• 89.248.172.33 / 89.248.171.24 (uptime-prober trio) — 285 ev combined on ru-edge; 80.82.77.202 present at 35 ev; benign-shape, report only.
• 185.73.23.162 (Ruhr-Uni Bochum, benign research) — 1,467 ev /-only on netcup + sponge; the digest's 4,100-event netcup+sponge baseline is majority this scanner.
• Benign scanners present: Censys (03:15 first-seen inventory cluster), zgrab, OAI-SearchBot, forestportprobe_2.0 + nmap_ssh2_enum_algos (new network-layer banners, below threshold). Honest UAs, shallow journeys, no mints.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-09-22 07:33:00 → 2026-09-23 07:33:47 UTC

Fingerprint field ssh.hassh, destination port 22 · 76,205 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 47,004, frantech-ts 15,625, sensor:frantech-ts 15,625, contabo-sponge-02-ts 15,291, proxy 15,291, sensor:contabo-sponge-02-ts 15,291

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,128 sessions from 301 source IPs across 153 networks in 53 countries, port 22, avg 4,951 B/session. Networks: AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS14061 DigitalOcean, LLC, AS16276 OVH SAS, AS4766 Korea Telecom. Busiest sources: 190.119.63.98, 43.128.3.201, 72.167.227.34, 122.199.225.53, 167.71.72.95. Last 7 days: 09-17 66 IPs, 09-18 147 IPs, 09-19 328 IPs, 09-20 327 IPs, 09-21 373 IPs, 09-22 297 IPs, 09-23 133 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP cooled to 301 IPs / 153 networks / 5,128 sessions from the 09-19→09-21 peak band (327–373 IPs); the 09-23 daily figure (133) is partial-window censoring, not a trend.
• GO-BANNER-SWEEP (594c5787…) absent at the ≥5-session floor for a second consecutive cycle — pause registered №28, two misses settle it.
• GO-SPRAY-SWEEP (06ff3615a51b…, SSH-2.0-go) also absent at the ≥5-session floor this window after its №28 threshold crossing — one miss since registration; a second consecutive miss at this floor would mark a real pause, but the №28 136-IP burst stays the reference.
• NEW unregistered banner: forestportprobe_2.0 (6 sessions / 6 IPs) and nmap_ssh2_enum_algos (6 / 5) first seen today, below thresholds — named here for continuity, no registration while they stay at single-touch spread.
• Standing single-source clients 0a07365cc01f… (26,115 sessions / 38 IPs) and 16443846184e… (7,720 / 31) are unchanged background; 19532158b559… grew +505 sessions but stays single-source shape (15 IPs).

Fleet Observations

• Mint economics: 40 credentials to 30 collector IPs (digest rows: 47 issued / 49 with the cast boundary). Failures: 82 × 400 Bad Request (ru-edge 31, farm 26, aidev 21, control 4); failure ratio 2.05:1 — the burst-speed signature from the .87 waves on ru-edge, not a key defect (farm and aidev rejections sit inside their own census bursts).
• Zero AWS use, sixth consecutive window. The hoard grows while consumption stays dark: 40 new credentials, 17 first-time collectors, no ConsoleLogin/GetCallerIdentity/denied-op of any kind. Persistent candidates from the 6-day pull: 213.209.159.175 (50), 80.94.95.211 (27), 31.57.219.158 (20), 94.154.46.248 (17, absent this window), 94.154.46.244 (16).
• Attribution posture: 0 empty-clientIp rows in-window (socket-peer build verified again). XFF counters: 16,577 any-XFF, 15,390 multi-entry chains, 909 present-but-ignored, 15,390 single-entry forgeries — 154× the №28 count and the counter's first mass event. The mismatch attribution is in Key Judgement 1: two socket peers, one campaign family. Treat the 8,616 asserted IPs as hostile-pool addresses, not fleet visitors.
• Control velocity: 3,598 events / 121 unique IPs in-window — back inside the 62–145 post-fix band after №28's 145 high; day 11 of the deliberately-fresh dataset, ramp intact.
• Node volume moves, all attributed: ru-edge-1 +275% = .87's forged-identity waves (≥10,062 of 13,642 true-IP-attributable events) riding the census; the node's 4,979 unique IPs are ~91% asserted identities, not hosts. frantech-ts +40% = MEGA-DICTIONARY's seventh replay (13,134 of 17,695). ai-devbox-1 +139% = the OMEGA .244 743-path census (1,492) + .87 wave share (≥1,806 forged rows) + 151.243.18.111's 466-path Googlebot-forged .env walk (first appearance; 466 paths in 19 s, 0 mints). netcup-ts −69% = the 119.40.84.186 XMLRPC flood did not return; the node fell back to its Ruhr-Uni + prober baseline.
• ssh/telnet honeypot (frantech-ts only — single sensor, not fleet-wide): funnel 586 sources → 482 shells (82%) → 296 command-runners (61% of shell-getters). Event level: 9,057 attempts → 5,714 accepted logins → 4,602 commands. Zero new commands (0 of 66 distinct) and zero new credential pairs (0 of 3,845) — fourth consecutive fully static window. Top pairs unchanged: 345gs5662d34 (1,101 attempts) and root/3245gs5662d34 (815). Commodity telnet botnets: 500 attempts. The per-login command rate (4,602/5,714 = 81%) is stable — operators keep working the boxes, the kit stays byte-identical.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 40 credentials to 30 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 50 mints, 2026-09-16 10:16 → 2026-09-23 04:47
• 80.94.95.211: 27 mints, 2026-09-16 21:23 → 2026-09-21 02:12
• 31.57.219.158: 20 mints, 2026-09-18 19:15 → 2026-09-18 19:38
• 94.154.46.248: 17 mints, 2026-09-21 11:45 → 2026-09-22 03:23
• 94.154.46.244: 16 mints, 2026-09-17 09:24 → 2026-09-19 08:51
• 94.154.46.249: 12 mints, 2026-09-21 17:09 → 2026-09-21 17:09
• 176.65.144.71: 10 mints, 2026-09-18 06:02 → 2026-09-18 06:02
• 94.154.46.245: 10 mints, 2026-09-20 17:53 → 2026-09-20 17:53
• 94.154.46.250: 10 mints, 2026-09-16 12:34 → 2026-09-20 21:45
• 102.220.161.139: 8 mints, 2026-09-16 18:55 → 2026-09-20 03:44
• 195.177.94.18: 8 mints, 2026-09-19 23:59 → 2026-09-22 09:52
• 2a01:e0a:3be:cec0:f54c:335a:8d29:be: 8 mints, 2026-09-17 17:04 → 2026-09-17 17:04
• 94.154.46.247: 8 mints, 2026-09-16 04:01 → 2026-09-22 22:53
• 213.209.159.154: 6 mints, 2026-09-17 20:33 → 2026-09-23 00:35
• 23.234.114.118: 6 mints, 2026-09-18 12:28 → 2026-09-18 14:07
• 94.154.46.243: 6 mints, 2026-09-21 16:11 → 2026-09-21 16:11
• 102.220.161.102: 5 mints, 2026-09-18 00:13 → 2026-09-20 03:42
• 167.99.79.44: 5 mints, 2026-09-19 18:01 → 2026-09-19 20:02
• 179.43.150.26: 5 mints, 2026-09-22 14:29 → 2026-09-23 02:50
• 155.117.232.31: 4 mints, 2026-09-20 20:47 → 2026-09-20 21:20
• 178.16.54.184: 4 mints, 2026-09-17 14:21 → 2026-09-17 14:21
• 196.89.218.205: 4 mints, 2026-09-18 00:57 → 2026-09-18 01:39
• 45.138.12.16: 4 mints, 2026-09-20 17:25 → 2026-09-21 01:36
• 69.5.20.14: 4 mints, 2026-09-16 09:23 → 2026-09-16 15:50
• 134.209.25.199: 3 mints, 2026-09-16 21:07 → 2026-09-21 20:20
• 139.59.132.8: 3 mints, 2026-09-17 20:26 → 2026-09-22 20:45
• 152.32.235.180: 3 mints, 2026-09-19 10:55 → 2026-09-23 05:48
• 165.227.173.41: 3 mints, 2026-09-16 14:49 → 2026-09-21 20:33
• 176.65.148.71: 3 mints, 2026-09-16 17:48 → 2026-09-19 07:02
• 209.38.208.202: 3 mints, 2026-09-19 15:25 → 2026-09-20 20:18
• 41.249.4.249: 3 mints, 2026-09-17 03:54 → 2026-09-17 03:55
• 45.148.10.171: 3 mints, 2026-09-23 00:55 → 2026-09-23 05:20
• 45.148.10.5: 3 mints, 2026-09-16 17:10 → 2026-09-23 05:08
• 64.225.75.246: 3 mints, 2026-09-18 20:47 → 2026-09-22 20:32

(The canary section is Summary + funnel only this window; attribution prose sits in Campaigns — the /46 block's exit from the mint table and the two new multi-mint collectors (179.43.150.26, 45.148.10.171) are the evidence points.)

Gaps / Next Collection

1. The .87 forged-identity waves' infrastructure question. 8,616 asserted IPs came from one socket peer in 13.5 hours. Next cycle: check whether the asserted addresses correlate across waves (re-use = a pool, never re-used = a generator), and whether the true-IP leg's 4 issued rows (09-07/09-09 history) repeat — .87 minted 0 this window but its census keeps reaching /.env.
2. 203.175.125.156's identity. One 968-row burst, first and only appearance, 886 paths in 3.9 s, empty UA on its 2 true-IP rows. A second appearance (any node, any layer) names the campaign; until then it stays a one-touch forger inside the CREDSWEEP wave row.
3. MEGA-DICTIONARY version tracking. The +126 delta introduces eight fresh build stems in one replay. Anti-join each future replay against this window's 13,134-path set; if manta/sever1078/nokillbins return alongside the new stems, the operator runs parallel bot generations from one manifest.
4. OMEGA /46 block re-entry. The block minted 35 in №28 and 3 this window (.247 ×2, pool .43.122 ×1). .244 still ran its 743-path census (1,492 ev) — the census continues without mint bursts, which changes the campaign's reward model. Watch whether the block resumes minting or the census moved to collection-by-proxy (the 17 first-time collectors).
5. GO-SPRAY-SWEEP floor check. One miss below the ≥5-session floor since the №28 threshold crossing. A second consecutive miss upgrades the №28 note from "watch" to "paused".

Digest: /data/flux-logs/reports/flux-digest-2026-09-23.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-23.html

Watch next cycle: (1) The .87 forged-identity infrastructure — do the 8,616 asserted IPs recur across waves, and does the true-IP leg mint again. (2) MEGA-DICTIONARY's +126 delta — eight new build stems; anti-join every replay. (3) OMEGA /46 re-entry — the census ran without its mint bursts.