FLUX FLEET — INTEL BRIEFING №36

Period: 2026-09-28 07:34 – 2026-09-29 07:34 UTC (24h, day 34 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile, fourth full window), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 34-day baseline; every volume move and spike traced to a source by spot query)

BLUF

The credential-use pipeline escalated. TechTies 94.26.106.73 minted one canary on ai-devbox-1 at 14:37 and used it inside the same window, and the AWS deny log recorded its first IAM CreateUser attempt (denied, with DescribeRegions also denied). Feo Prest 213.209.159.175 used 5 more hoard credentials across 19 use IPs, so use is now two-window consecutive behavior, not a one-off. XMLRPC-BRUTE returned under a fourth operator class, 134.209.110.125 (DigitalOcean SG) — the same IP minted 4 canaries here the previous window — and ran a two-leg attack on lauterbourg-01-ts: 3,050 system.multicall POSTs plus a 3,049-POST /wp-login.php form dictionary against fixed admin, with password candidates derived from the decoy's own vhost name. Census pressure rebounded on the /46: OMEGA-SWEEP minted a record 44 in-window and its wordlist grew into IaC/DevOps paths, driving ai-devbox-1 +100%, while the MEGA-DICTIONARY replay missed a second time and frantech-ts fell −95%. On the network layer the unregistered ssh-2.0-go fingerprint crossed the dispersed-sweep threshold (36,121 sessions, 72 IPs) and is registered as GO-SSH-SWEEP; mint failures were zero for a second consecutive window.

Key Judgements

1. Mint→use has moved from identity probing to attempted IAM persistence. 94.26.106.73 drew CreateUser (denied) and DescribeRegions (denied) on a credential it minted hours earlier — the first IAM write operation in 12 windows of AWS-side alerts. (High confidence — the operation list comes from the Tracebit alert table below; deny-all policy held.)
2. The Kiteworks decoy's identity leaked into the attacker's wordlist. The lauterbourg XMLRPC-BRUTE runner tried kiteworks in 236 multicall bodies and kiteworksrightabouteverythingshow in 3 — candidates derived from the vhost's TLS hostname, which proves target-specific recon rather than a commodity spray. (High confidence — extracted verbatim from captured POST bodies.)
3. The 94.154.46.0/24 census pool has stepped up its collection rate. Two operators (.246, .245) minted 22 credentials each in synchronized farm+aidev bursts (44 total, the campaign record), the wordlist gained IaC/DevOps paths (/helmfile.yaml, /terraform/terraform.tfvars, /saltstack/.env, /group_vars/all.yml, /jwt.key), and .246's six-day total reached 28 — past .249's 27-credential build-up. (High confidence on counts; Moderate on intent — compounding hoard vs. faster resale is unmeasured.)
4. GO-SSH-SWEEP shares infrastructure signals with HTTP-side hostile actors. Its top networks include Feo Prest SRL (AS208137) — the CREDSWEEP census operator's hosting — its source list carries 213.209.159.212 from that /24, and 109.160.32.x, the /24 running the frantech uname survey cluster, supplies two of its busiest sources. (Moderate confidence — AS and source-IP overlap only; the pcap and HTTP fingerprints are different tools by construction.)

Active Campaigns (day 34 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIRST IAM WRITE ATTEMPT; USE NOW TWO-WINDOW STANDARD (Hostile, active)

• Actors: use side this window: 94.26.106.73 (TechTies Inc., DE — first-time collector), 213.209.159.175 (Feo Prest SRL, DE — 19 use IPs on its thefts), 80.94.95.211 (SS-Net, RO — 4 use IPs). Use IPs are AWS egress infrastructure and appear nowhere in flux logs (the standing CREDENTIAL-DRAIN pattern).
• TTPs: 27 use events across 7 credentials: 13 sts:GetCallerIdentity successes and 14 denials — ListFoundationModels ×12, DescribeRegions ×1, CreateUser ×1. CreateUser is the record's first IAM write attempt; it sits inside the same deny-all boundary that previously logged only Converse and ListFoundationModels recon.
• Assessment: the fleet's canaries now reliably produce credentials an actor will exercise, and the newest user went straight at IAM persistence. The collection-to-use latency for 94.26.106.73 was under one window. Any success beyond GetCallerIdentity, or any CreateUser that is not denied, is the escalation signal.

XMLRPC-BRUTE (system.multicall dictionary) ⟳ — FOURTH OPERATOR CLASS, TWO LEGS, SITE-AWARE WORDLIST (Hostile, active)

• Actors: 134.209.110.125 (DigitalOcean, SG) solo on lauterbourg-01-ts, 17:20–19:04 −04, 6,108 events on 6 paths, 6,099 POSTs. This IP minted 4 canaries on farm+aidev the previous window under an honest Chrome/81 + Mozlila/5.0 typo pair — a minted collector returned as a brute-force operator within 24 hours. The known operator pool (185.19.40.202 1337 Services, 35.233.85.98 GCP, 207.175.64.93 Google BE, 119.40.84.186 BDCOM BD) was absent.
• TTPs: leg one, 3,050 POST /xmlrpc.php in 15 min 14 s (~3.3/s, all 200), bodies wrap wp.getUsersBlogs with fixed username admin in system.multicall envelopes:

  <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data><value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string>… Leg two, 3,049 POST /wp-login.php form logins over 89 min (~1.75 s/POST, all 302) — a slow form dictionary, 2,909 distinct passwords, one body per attempt: log=admin&pwd=zaq123&redirect_to=http://kiteworks.rightabouteverything.show/wp-admin/ The multicall bodies carry vhost-derived candidates: kiteworks ×236, kiteworksrightabouteverythingshow ×3. Preflight matched the registered trio (/wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed), forged Chrome/89.0.4389.114 throughout.

• Assessment: the registered shape now runs under a fourth operator, on the fleet's newest node, with target-specific reconnaissance in the wordlist. The 6,099-POST volume is second only to №16's 8,131-record burst. Watch 134.209.110.125 for a second run and whether the wp-login form leg spreads to other operators.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — RECORD 44-MINT WAVE, WORDLIST GREW (Hostile, active)

• Actors: 94.154.46.246 — canary-farm-1 census 2,100 events / 1,042 paths / 132 families (12 mints, 05:48) + ai-devbox-1 census 1,668 events / 911 paths (10 mints, 14:47); 94.154.46.245 — canary-farm-1 census 2,100 events (12 mints, 10:16) + ai-devbox-1 census 1,453 events / 1,025 paths (10 mints, 19:09) + a 150-path sponge-01-ts touch. Pool singles 94.154.43.164 (aidev) and 94.154.43.125 (farm) minted 1 each at 11:24 under Chrome/147.
• TTPs: forged Googlebot/2.1; the 1,042-path template on trap nodes. The wordlist grew into IaC/DevOps territory first seen this window: /helmfile.yaml, /terraform/terraform.tfvars, /infra/terraform.tfvars.json, /saltstack/.env, /salt/pillar/secrets.sls, /ansible/roles/common/vars/main.yml, /group_vars/all.yml, /.aws/config.bak, /aws/ec2/.env, /k8s-config.yaml, /circle.yml, /heroku.env, /jwt.key, /.hg/store/data/.env.i, /.env2, /.env.20230101 (7 of the sampled new paths hit from .245, 5 from .246).
• Assessment: 44 in-window /46 mints is the campaign record (prior high 27 in №32's 29-IP wave context), and six-day balances now read .246 = 28, .245 = 22. The pool that was already the fleet's model hoarder is collecting roughly twice as fast. Any AWS alert naming the /46 is the escalation signal.

LIBREDTAIL-KIT (phpunit RCE chain, honest UA) ⟳ — 18TH WINDOW, FIRST FULL-KIT LAUTERBOURG (Hostile, active)

• Actors: 16 full-kit IPs at 37 events each across 7 sensors — ai-devbox-1 (169.58.53.194, 2.29.52.122, 94.184.42.24, 185.194.218.241), canary-farm-1 (43.134.108.169, 223.123.65.54, 160.250.132.238), control-1 (103.63.101.24, 89.126.211.166), frantech-ts (212.18.114.31, 150.109.254.122, 88.218.94.33), netcup-ts (79.72.3.119), sponge-01-ts (88.218.94.33, 178.88.115.30), and a first full-kit lauterbourg visit (169.58.158.56). Repeats from №35: 88.218.94.33 and fragment 23.94.192.15 (18 events). Mint-fragments under forged Chrome/39: 103.75.11.189 (7 in six days), 159.26.101.60, 149.40.48.71.
• TTPs: unchanged chain — 610 md5("Hello PHPUnit") probes (1 distinct body), POST /index.php with shell_exec(base64_decode(...)); the 84 captured bodies carry the byte-identical OpenSSH-key echo oracle:

  cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----… The staging host 217.60.103.56 appears in 18 POST bodies from 17 distinct IPs — delivery infrastructure unchanged since №17. The digest's php-cgi leg (/bin/sh, cmd-injection-php-cgi-rce, 14 IPs / 686 events) ran alongside as in №35.

• Assessment: execution-focused, zero kit-side AWS use in 18 windows; the fragments that mint run separate .env stops. The fleet's most stable campaign holds cadence while other censuses rotate.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 7 RUNNERS, EVENING MINT WAVE, LAUTERBOURG TOUCH HELD (Borderline per registry)

• Actors: canary-farm-1: 165.22.34.189, 157.245.204.205, 64.23.218.208, 164.92.107.174; ai-devbox-1: 159.89.174.87, 167.99.181.249, 146.190.103.103 — all DigitalOcean, 27 trap families each, full WebLogic → Confluence → WHM/cPanel → docker-registry walk. 167.99.181.249 crossed to lauterbourg-01-ts again (80 events). UA variants split by node: l9scan/2.0.234313… farm, l9scan/2.0.632323… aidev.
• TTPs: 8 mint rows at the ~1-per-IP cadence in the synchronized 20:03–20:37 −04 evening wave; 146.190.103.103 minted twice.
• Assessment: cadence, node coverage, and mint behavior are unchanged from №35. Borderline per the registry: public leak-scanning service; report activity, keep out of the criminal set.

Feo Prest census family (213.209.159.175) ⟳ — 24TH WINDOW, STILL COLLECTING AND USING (Hostile, active)

• Actors: 213.209.159.175 — 24th consecutive window: 252 events across control-1 and canary-farm-1, 18 mint rows in six 3-mint bursts, 96 in six days (the record hoard). Sibling 213.209.159.154 absent after minting in №34/№35. The /24 also supplies 213.209.159.212 to the GO-SSH-SWEEP source pool (network layer).
• TTPs: /.env [issued] stops under heavy antique-UA rotation (Android Firefox/48, iPod iOS 4.0.5, Chrome/28, SamsungBrowser/2.1, Ubuntu Firefox/2.0.0.14 in this window's set), plus /-tarpit cycling and .env-variant walks.
• Assessment: the fleet's top collector used 5 credentials across 19 AWS-side use IPs this window while collecting 18 more. Hoard-to-use latency and per-window use counts are the numbers that settle hoard-vs-resale for this actor.

Lauterbourg census and POST watchers — WATCH (Hostile, watch)

• 172.235.181.217 (Akamai Connected Cloud, NL, ipsum:4 firehol2) + 172.105.69.26 (Akamai Connected Cloud, DE, ipsum:3 firehol2) — synchronized ~30-second census bursts (210 and 200 events, 165/160 paths): nmaplowercheck* probes, /HNAP1, /rest/applinks/1.0/manifest, /sdk, and a POST /login on the Kiteworks decoy (172.235.181.217) plus lauterbourg first-seens /geoserver/, /apps/zxtm/login.cgi, /cslu/v1/core/conf from .217. POST bodyPreview NULL — the node's capture gap, third window. One host per node, same tooling class; watch for a wider burst or captured bodies.
• 35.185.144.245 (Google LLC, TW) — ai-devbox-1 census, 359 events / 259 paths in 2.5 min under forged Chrome/125 + Chrome/131, 1 mint at 20:05. First observed run; single-IP, wordlist overlaps OMEGA families.
• 94.26.106.73 (TechTies Inc., DE) — ai-devbox-1, 107 events / 101 paths in 8 seconds under honest Go-http-client/1.1 + curl/8.5.0, 30 trap families, 1 mint — then used it on AWS (see CREDENTIAL-DRAIN). Promoted from census noise to a named use-side actor in one window.
• 102.220.161.139 (VPS Dedicated LLC, SI) — second window: synchronized 514-event / 511-path .env-variant censuses on canary-farm-1, control-1, and ai-devbox-1 (16:53, 16:53, 20:26), 34 families, 3 mints (1/node), forged Chrome/126. Same operator family as the №29 forged-XFF waves (102.220.161.87, same block and ASN); no XFF forgery this window.
• UCBrowser-forgery mint singles — 155.117.232.31 (3 mints across control/farm/aidev, 17:17–17:46) and 74.0.42.13 (1 mint, control): same HM NOTE 1W UCBrowser forgery, one-/.env-request runs each. Watch the UA class for a cluster.
• 217.60.76.167 — 2 mints (farm Safari/13.0.3, ru-edge Firefox/114). Note only: same /16 as LIBREDTAIL's staging host 217.60.103.56, different /24; no kit traffic from this IP.

Absent / paused this window

• MEGA-DICTIONARY — second consecutive miss (no replay; frantech-ts −95% to 615 events). The №35 rule fired: status back to paused. A third miss with a fresh operator retires the schedule; a replay returns it to active with the 13,195-path manifest.
• ORACLE-SWEEP — third miss since the №33 un-merge; standing-paused holds. Un-pause on a 140.245.x/161.118.x run with the ~94-path core.
• CONFIG-SWEEP — third idle window; 87.120.104.29 absent.
• METADATA-HUNT — eighth idle; 0 @fs/__aws_leak_probe markers.
• SS-PROBE, NIGHTAGENT (dormant), CRUSADER-SWEEP, CURL-SWEEP, AKAMAI-CONFIG, ALIYUN-PROBE, SYNC-ENUM-WAVE, GCP-ACONF, ENV-CENSUS-3/4 — no activity.
• TOKEN-CRAWLER — no 45.198.224.x traffic this window.
• 45.148.10.171 — absent after five consecutive minting windows (40 in six days; watch for a return).
• №35's lauterbourg census watchers (35.205.254.119, 144.172.99.12, 45.8.19.88, 193.138.195.188) — no in-window repeat and no in-window mints.
• Techoff CVE-prober 195.178.110.22 — absent from the HTTP surface; note the /24's 195.178.110.218 leads an inventory-survey set on the ssh/telnet honeypot (below).

Standing actors (persistence check)

• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop) — 23rd consecutive window on control-1: 2,143 events / 580 paths, ipsum:2. Loop volume rose again (1,310 → 2,143).
• 213.209.159.175 (Feo Prest SRL DE) — 24th window; 18 mint rows, 96 in six days; 5 credentials used via 19 use IPs.
• 80.94.95.211 (SS-Net RO) — 6 mint rows on ai-devbox-1 (two 3-mint bursts) + 1 credential used; the block's senior collector keeps both roles. Sibling 80.94.92.65 absent after minting in №35.
• 185.73.23.162 (Ruhr-Universität Bochum, benign) — sponge-01-ts 1,370 events (14:31–21:26), the scanner's cadence keeps sponge +18%; benign per registry.
• Benign baseline: 16.5.0.236 (8 nodes, 145 events), 93.174.93.12 (5 nodes, 234), 80.82.77.202 (5 nodes, 188), 185.218.86.25 (6 nodes, 94), 195.182.16.23 (7 nodes, 42), 91.92.40.236 (8 nodes, 77), osint-scanner/1.0 45.139.104.34/.35 (4+3 nodes), 45.135.193.198 (4 nodes, 4). The metabase CVE-detector drew the window's single XFF mismatch row (below).

Canary credentials

Summary

7 Tracebit alert(s) fired in the window (27 use events across 7 credentials). Fleet sensors minted 84 credentials to 25 collector IPs; 7 credential(s) reached AWS. Use outcomes: 14 failure, 13 success. Denied operations: ListFoundationModels×12, DescribeRegions×1, CreateUser×1. 13 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 40 mints, 2026-09-23 00:55 → 2026-09-27 18:04
• 94.154.46.246: 28 mints, 2026-09-26 00:30 → 2026-09-28 14:47
• 87.120.104.29: 24 mints, 2026-09-23 18:05 → 2026-09-26 05:33
• 94.154.46.245: 22 mints, 2026-09-28 10:16 → 2026-09-28 19:09
• 94.154.46.249: 15 mints, 2026-09-24 23:37 → 2026-09-25 00:25
• 105.115.10.78: 8 mints, 2026-09-25 23:08 → 2026-09-26 20:32
• 194.127.166.149: 8 mints, 2026-09-24 17:10 → 2026-09-24 18:32
• 94.154.46.247: 8 mints, 2026-09-22 22:53 → 2026-09-24 05:26
• 103.75.11.189: 7 mints, 2026-09-28 04:44 → 2026-09-28 10:35
• 102.220.161.139: 6 mints, 2026-09-26 05:22 → 2026-09-28 20:26
• 109.205.176.10: 6 mints, 2026-09-24 10:44 → 2026-09-29 06:04
• 185.177.72.64: 6 mints, 2026-09-25 15:52 → 2026-09-25 22:51
• 2.27.154.52: 6 mints, 2026-09-25 04:53 → 2026-09-25 05:24
• 62.244.54.240: 6 mints, 2026-09-24 22:18 → 2026-09-24 22:45
• 94.154.46.243: 6 mints, 2026-09-27 10:18 → 2026-09-27 10:19
• 94.154.46.244: 6 mints, 2026-09-24 21:15 → 2026-09-24 21:15
• 136.85.48.119: 5 mints, 2026-09-23 16:49 → 2026-09-25 23:59
• 179.43.150.26: 5 mints, 2026-09-22 14:29 → 2026-09-23 02:50
• 213.209.159.154: 5 mints, 2026-09-22 21:08 → 2026-09-27 04:38
• 134.209.110.125: 4 mints, 2026-09-27 22:51 → 2026-09-27 23:04
• 135.136.55.62: 4 mints, 2026-09-24 06:13 → 2026-09-24 06:51
• 167.99.181.249: 4 mints, 2026-09-25 20:05 → 2026-09-28 20:32
• 194.180.48.253: 4 mints, 2026-09-24 15:50 → 2026-09-24 19:23
• 195.177.94.18: 4 mints, 2026-09-22 04:09 → 2026-09-22 09:52
• 23.234.77.64: 4 mints, 2026-09-25 16:29 → 2026-09-25 17:29
• 45.138.12.51: 4 mints, 2026-09-22 08:13 → 2026-09-26 07:30
• 80.94.92.65: 4 mints, 2026-09-27 21:25 → 2026-09-28 03:00
• 146.190.103.103: 3 mints, 2026-09-22 20:46 → 2026-09-28 20:31
• 155.117.232.31: 3 mints, 2026-09-28 17:19 → 2026-09-28 17:46
• 165.22.34.189: 3 mints, 2026-09-24 20:39 → 2026-09-28 20:32
• 31.57.216.50: 3 mints, 2026-09-25 23:10 → 2026-09-25 23:11
• 41.140.17.206: 3 mints, 2026-09-27 01:56 → 2026-09-27 02:06
• 41.140.198.124: 3 mints, 2026-09-25 03:20 → 2026-09-25 03:28
• 45.153.34.39: 3 mints, 2026-09-23 07:00 → 2026-09-27 01:21
• 46.101.111.185: 3 mints, 2026-09-22 20:31 → 2026-09-27 20:37
• 64.225.75.246: 3 mints, 2026-09-22 20:32 → 2026-09-24 20:39
• 80.87.206.148: 3 mints, 2026-09-26 09:55 → 2026-09-28 18:50

Network-layer recon (Arkime) — 2026-09-28 07:34:00 → 2026-09-29 07:40:25 UTC

Fingerprint field ssh.hassh, destination port 22 · 164,229 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 90,318, sensor:lauterbourg-01-ts 55,137, bahrain-sponge-01-ts 34,097, sensor:bahrain-sponge-01-ts 34,097, frantech-ts 30,995, sensor:frantech-ts 30,995

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,823 sessions from 347 source IPs across 173 networks in 50 countries, port 22, avg 4,921 B/session. Networks: AS4766 Korea Telecom, AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 82.152.132.24, 103.67.78.178, 34.14.122.221, 121.242.232.147, 89.126.208.27. Last 7 days: 09-23 351 IPs, 09-24 330 IPs, 09-25 339 IPs, 09-26 321 IPs, 09-27 316 IPs, 09-28 356 IPs, 09-29 125 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 36,121 sessions from 72 source IPs across 35 networks in 21 countries, port 22, avg 5,285 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS208137 Feo Prest SRL, AS26496 GoDaddy.com, LLC. Busiest sources: 192.253.248.217, 109.160.32.132, 213.209.159.212, 109.160.32.102, 77.239.124.149. Last 7 days: 09-23 36 IPs, 09-24 35 IPs, 09-25 38 IPs, 09-26 41 IPs, 09-27 35 IPs, 09-28 60 IPs, 09-29 36 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• GO-SSH-SWEEP is registered. 0a07365cc01f… crossed the dispersed threshold this window (72 IPs ≥50, 35 networks ≥20) and is named in the campaign registry, keyed by fingerprint. Its banner characterisation (ssh-2.0-go) closes one third of the №33 gap. It is now the top fingerprint on frantech-ts, ru-edge-1, ai-devbox-1, sponge-01-ts, and canary-farm-1, and it grew +27% in sessions (28,364 → 36,121) with +28 source IPs on the day.
• LIBSSH-MASSSWEEP holds the plateau for a tenth day: 347 IPs (+4) / 173 networks / 6,823 sessions (+578). The 09-29 partial count (125) is window censoring.
• The other two heavy singles moved in opposite directions: 4e066189c3bb… nearly doubled (8,433 → 16,664, 16 IPs, control-1's top fingerprint) while 16443846184e… halved (18,790 → 9,656, 44 IPs). Banners for both are still pending — the remaining two thirds of the №33 gap.
• One new below-threshold fingerprint today: a7a87fbe8677… (ssh-2.0-libssh2_1.8.2, 12 sessions, 2 IPs).
• Lauterbourg-01-ts stays the fleet's most probed node by sessions (55,137 from 1,447 source IPs).

Fleet Observations

Canary economics. Digest window: 106 issued rows (canary-farm-1 45, ai-devbox-1 42, control-1 15, ru-edge-1 4); the Tracebit-side dedup sees 84 credentials to 25 collectors — the delta is the 24-hour seam cast. Failures: zero for the second consecutive window, no burst-speed signature, no key defects. Visuals all-time counter: 1,982 issued rows. Seven of the 84 credentials reached AWS this window (see CREDENTIAL-DRAIN) — the seventh consecutive window with at least one minted collector, and use is now two-window standard.

Attribution/TLS posture. XFF counters: any-XFF 775, multi-entry 0, ignored-internal 0, single-entry mismatch 1 — the self-labeled benign metabase-cve-2026-72898-detect/1.0 probe asserting 125.215.151.113 from socket peer 20.164.136.197 (Azure) on /api/session/properties. Benign per the registry; no hostile forgery, no socketPeer pivot warranted; fourteenth clean hostile window since the counter deployed. Host census: every node's own address leads its counts except lauterbourg, where the Kiteworks vhost leads 6,214 vs 349 bare IP — the XMLRPC-BRUTE burst rode the vhost (its redirect_to targets it). Lauterbourg carried 64 https events.

Fleet volume moves and their causes. Every move traces to a named source: lauterbourg-01-ts +225% (6,770) is 90% the 134.209.110.125 burst (6,108); ai-devbox-1 +100% (5,148) is the twin OMEGA censuses (~3,100), 102.220.161.139 (514), 35.185.144.245 (359), and 94.26.106.73 (107); canary-farm-1 +26% (5,804) is the two 2,100-event OMEGA censuses; sponge-01-ts +18% (2,443) is the benign Ruhr-Uni scan (1,370). The decliners all lost census templates at once: frantech-ts −95% (615) — no MEGA-DICTIONARY replay; netcup-ts −92% (613); ru-edge-1 −85% (448); control-1 −26% (3,336) — Pfcloud's loop rose, but the big prior censuses (.243's 1,050, OMEGA control waves) did not repeat.

control-1 discovery velocity. 3,336 events / 107 unique IPs — inside the 62–145 post-fix band for the eleventh consecutive window. Discovery stays flat; the event decline is per-IP volume.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 609 sources sent credentials → 471 got a shell (77%) → 284 ran a command (60% of shell-getters, 47% of sources). Event level: 15,811 credential attempts → 7,390 accepted logins → 14,058 commands — 190% of accepted logins run something, up from 148%, the highest work rate on record for this surface.

Ninth consecutive fully static window: zero new commands (0 of 49 distinct), zero new credential pairs (0 of 3,487). Telnet commodity botnets: 2,644 attempts (flat vs 2,669). The recurring set is unchanged, but its operators moved: the uname -s -v -n -r -m inventory cluster (4,213 events × 2 variants) now runs from 7 IPs led by 109.160.32.150 — the same /24 that supplies two GO-SSH-SWEEP sources — and the lspci/uptime survey set (408 events, 7 IPs) is led by 195.178.110.218, the Techoff block that ran the CVE-prober on the HTTP surface in №33–№34. The chattr -ia .ssh re-plant family (994 events, 226 IPs) and its key-replace companion (836 events, 202 IPs) hold steady. Concentration unchanged: 345gs5662d34/345gs5662d34 959 attempts and root/3245gs5662d34 698 lead.

Gaps / Next Collection

1. Kiteworks POST bodies are still not captured (bodyPreview NULL on every POST, third window running). 172.235.181.217 submitted another POST /login on the decoy. Request the capture-path fix in the ops repo before the next window; the XMLRPC-BRUTE burst shows the node now draws body-carrying attacks worth reading.
2. Banner characterisation for the two remaining heavy fingerprints — 4e066189c3bb… (16,664 sessions, +98%, control-1's top) and 16443846184e… (9,656, −49%). Their opposite trajectories in one window make the characterisation more valuable, not less; 0a07365cc01f… is done (GO-SSH-SWEEP).
3. IAM-write watch. 94.26.106.73 produced the first denied CreateUser. Export its use IP from the alert log, diff against flux logs, and alert on any future IAM-write deny from the TechTies range (94.26.106.0/24 or its mints).
4. OMEGA /46 compounding. .246 holds 28 mints in six days (past .249's 27 build-up), .245 reached 22 in one window. If either draws an AWS alert, the /46 hoard question moves from collection-rate to use.
5. 134.209.110.125 follow-up. A minted collector that returned as a two-leg brute operator is the fleet's first collector-to-attacker conversion on record. Watch for a second run, other nodes, and whether the vhost-derived password candidates (kiteworks*) recur.
6. MEGA-DICTIONARY: back to paused after the second miss. Record any replay's operator and diff the 13,195-path manifest before restoring active status.

Digest: /data/flux-logs/reports/flux-digest-2026-09-29.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-29.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-29.html

Watch next cycle: (1) CREDENTIAL-DRAIN — a repeat IAM-write attempt from 94.26.106.73 or the TechTies range, and whether .175 keeps drawing from the 96-credential hoard. (2) GO-SSH-SWEEP — growth past 72 IPs, plus banner characterisation of 4e066189c3bb… and 16443846184e…. (3) 134.209.110.125 — a second XMLRPC-BRUTE run, and whether the wp-login form leg spreads beyond the Kiteworks node.