FLUX FLEET — INTEL BRIEFING №37

Period: 2026-09-29 07:32 – 2026-09-30 07:32 UTC (24h, day 35 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation; 35-day baseline; main volume moves tied to spot-query evidence)

BLUF

Two synchronized MEGA-DICTIONARY replays dominated the fleet: 23.234.118.146 hit control-1 with 13,292 paths, then 98.98.47.133 hit ru-edge-1 with the same 13,292 paths. ai-devbox-1 drew a first-seen Cloudflare-fronted credential census over inference.fapthropic.com: 54 Cloudflare edge IPs, 7,245 HTTPS events, 76 /.env mints, and a forged crawler/browser UA set. Credential use continued for a third consecutive window, but the IAM-write spike did not repeat: 4 credentials reached AWS, with only GetCallerIdentity success and ListFoundationModels denied. XMLRPC-BRUTE returned on lauterbourg-01-ts under 185.19.40.202 with 1,000 system.multicall POSTs in 89 seconds.

Key Judgements

1. The biggest fleet movement was wordlist replay, not discovery growth. MEGA-DICTIONARY produced 26,584 events across control-1 and ru-edge-1, using a byte-identical 13,292-path manifest on each node. (High confidence — spot query found 13,292 shared paths and zero POSTs.)
2. The Cloudflare-fronted ai-devbox wave is a new credential-collection lane. It produced 7,245 HTTPS events from 54 Cloudflare edge IPs, 83 result families, and 76 mints; all requests hit inference.fapthropic.com, and the socket peer stayed the Docker gateway. (High confidence on counts; Moderate on actor identity because Cloudflare hides the origin.)
3. Mint→use stayed active but did not escalate past yesterday's IAM attempt. Tracebit saw 24 AWS events across 4 credentials: 12 GetCallerIdentity successes and 12 denied ListFoundationModels calls. (High confidence — the canary section is Tracebit-derived; no CreateUser appeared in this window.)
4. The SSH banner layer cooled from two flagged sweeps to one. LIBSSH-MASSSWEEP remained broad at 365 IPs and 183 networks, while GO-SSH-SWEEP fell below the dispersed threshold at 32 IPs and 12 networks despite 26,477 sessions. (High confidence — recon digest keyed on ssh.hassh.)

Active Campaigns (day 35 status)

CF-FRONTED CREDSWEEP (Cloudflare-fronted credential census) ⚠ NEW — HIGH-YIELD AIDEV MINT WAVE (Hostile, active)

• Actors: 54 Cloudflare edge IPs on ai-devbox-1, led by 104.28.222.46 (2,688 events, 20 mints), 104.28.254.47 (835 events, 11 mints), 104.28.222.16 (156 events, 9 mints), and 162.158.182.99 (152 events, 6 mints). All requests used inference.fapthropic.com over HTTPS. The origin is hidden; every row used socket peer 172.18.0.1 with no XFF mismatch.
• TTPs: 7,245 events, 289 paths, 83 result families, and 76 /.env mints. The wave rotated forged Googlebot/2.1, ChatGPT-User/1.0, Chrome 135, Firefox 137, Safari 18.4, and Android Pixel 8 UAs. The path mix was credential-heavy: /.env, /.aws/credentials, /.kube/config, /service-account.json, /config.json, /wp-config.*, /backup.sql, /server.key, /.ssh/id_rsa, /sftp-config.json, /assets/env.js, and /wrangler.toml. No @fs, __aws_leak_probe, or MCP markers appeared, so this is not the registered METADATA-HUNT template.
• Assessment: this is the highest-yield collection event of the window, and it accounts for the ai-devbox-1 issued, backup-archive, config-json, wp-config, aws-credentials-file, and openapi-spec-json-issued spikes. Treat the Cloudflare edge list as delivery infrastructure, not actor identity. Any AWS use tied to the 76 credentials is the next escalation signal.

MEGA-DICTIONARY (IoT dropper-URL dictionary) ⟳ — PAUSE LIFTED AGAIN, TWIN REPLAY (Hostile, active)

• Actors: 23.234.118.146 (tzulo, US; ipsum:1) on control-1, then 98.98.47.133 (Zenlayer, MY) on ru-edge-1. Each host ran 13,292 GET requests and 13,292 distinct paths. Neither host minted credentials.
• TTPs: byte-identical 13,292-path replay. control-1 ran from 08:59:54 to 09:01:45 -04. ru-edge-1 ran from 10:02:25 to 10:04:42 -04. The manifest is still mostly not-handled, with only four classified trap hits per replay: exchange-powershell-pre-auth, observability-profiler-index, llm-endpoint-ollama-ps, and gravitysmtp-miss.
• Assessment: the campaign left pause one day after the №36 pause call. The wordlist holder now used a fresh tzulo sibling and a Zenlayer host in the same window. The invariant remains the path manifest, not the source IP.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — THIRD CONSECUTIVE USE WINDOW, IAM WRITE DID NOT REPEAT (Hostile, active)

• Actors: use side this window tied to 213.209.159.175 (Feo Prest, DE) and 80.94.95.211 (SS-Net, RO). 213.209.159.175 minted 9 control-1 credentials and used 2 credentials from 11 AWS-side IPs. 80.94.95.211 used 2 credentials from 9 AWS-side IPs, but those mints sit outside the flux window.
• TTPs: 24 AWS events across 4 credentials: 12 GetCallerIdentity successes and 12 ListFoundationModels denials. No CreateUser, DescribeRegions, ConsoleLogin, or storage operation appeared.
• Assessment: yesterday's IAM write attempt did not become a second-day pattern. The important continuity is that hoarded credentials still get exercised across many AWS egress IPs. The deny-all policy held.

XMLRPC-BRUTE (system.multicall dictionary) ⟳ — LAUTERBOURG RETURN UNDER 1337 SERVICES (Hostile, active)

• Actors: 185.19.40.202 (1337 Services GmbH, NL) on lauterbourg-01-ts. It sent 1,007 events in 89 seconds, including 1,000 POSTs.
• TTPs: every POST hit /xmlrpc.php and wrapped wp.getUsersBlogs inside system.multicall. The 1,000 captured bodies were all distinct hashes, with a fixed admin username and a one-password-per-body dictionary. Representative body head:

  <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data><value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string>

• Assessment: the campaign returned to lauterbourg after yesterday's DigitalOcean operator. This run is smaller than №36's 6,099-POST two-leg burst, but it proves the Kiteworks node remains in the WordPress brute-force target set.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — RU-EDGE MINT BURST, NO AWS USE (Hostile, active)

• Actors: 94.154.46.245 (Omegatech LTD, US) on ru-edge-1. It sent 1,350 events, 1,342 paths, 138 result families, and 6 /.env mints in 17 seconds. The UA stayed forged Googlebot/2.1.
• TTPs: broad SaaS and credential census. The run hit .env, wp-config, CI files, Git internals, SSH keys, cloud config, Rails initializers, package manifests, actuator endpoints, and observability files. It caused the ru-edge-1 env-production, fake-git, ssh-private-key, and wp-config spikes.
• Assessment: the pool stayed active after yesterday's record 44-mint wave, but this window's run was single-node. 94.154.46.245 now holds 28 mints in the 6-day Tracebit window and still shows no observed AWS use.

CREDSWEEP operators (VPS Dedicated, Feo Prest, 45.148.10.171) ⟳ — BROAD RETURN, MIXED DEPTH (Hostile, active)

• Actors: 102.220.161.102 (VPS Dedicated LLC, SI) hit seven sensors with 1,543 events and 7 mints. 102.220.161.139 hit five sensors with 288 events and 6 mints. 213.209.159.154 hit canary-farm-1 with 378 events, 342 paths, and 34 mints. 45.148.10.171 returned after its №36 absence with 11 light events across seven sensors and 5 mints.
• TTPs: 102.220.161.102 mixed Git object walks, .env variants, CI config, Docker config, aws files, phpinfo, and fake crawler UAs. 213.209.159.154 used antique Firefox on canary-farm-1 for a dense /.env-class mint burst. 45.148.10.171 kept its one-/.env stop pattern under rotating mobile/browser UAs.
• Assessment: CREDSWEEP now has three active sub-pools in one window: VPS Dedicated census, Feo Prest hoard collection, and 45.148.10.171 solo collection. Feo Prest remains the most important collector because .175 also ties to AWS use.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — STEADY BORDERLINE COLLECTION (Borderline per registry)

• Actors: DigitalOcean l9scan runners on canary-farm-1 and ai-devbox-1, including 64.227.32.66, 139.59.231.238, 146.190.103.103, 147.182.149.75, 159.89.174.87, 209.38.208.202, and 143.110.217.244.
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → Docker registry journey stayed intact. The canary section attributes 8 mints to l9scan-shaped rows in this window.
• Assessment: LeakIX stays reportable because it collects credentials, but the honest UA and stable public-service identity keep it outside the criminal set.

MALWARE-DICT and TECHOFF / PHPSWEEP ⟳ — BACKGROUND WATCH (Hostile, active)

• MALWARE-DICT: 204.76.203.18 ran its 24th control-1 loop: 2,185 events, 581 paths, empty UA, zero mints. Volume rose again from 2,143 to 2,185.
• TECHOFF / PHPSWEEP: 45.148.10.238 returned on frantech-ts with 640 events, 335 paths, and 11 POSTs. The POST body capture was NULL, so the HTTP side still cannot classify the exploit payloads.
• Assessment: both families stayed below the briefing lead. Keep MALWARE-DICT keyed to the Pfcloud /24 loop and TECHOFF keyed to body-bearing POSTs when capture exists.

Absent / paused this window

• GO-SSH-SWEEP stayed busy at 26,477 sessions but fell below the dispersed threshold at 32 source IPs and 12 networks. Keep it registered, but do not count it as a flagged sweep today.
• LIBREDTAIL-KIT did not produce a briefing-grade RCE run in the digest window.
• METADATA-HUNT, NIGHTAGENT, ORACLE-SWEEP, CONFIG-SWEEP, SS-PROBE, TOKEN-CRAWLER, CRUSADER-SWEEP, CURL-SWEEP, AKAMAI-CONFIG, ALIYUN-PROBE, ENV-CENSUS-3/4, and SYNC-ENUM-WAVE had no material in-window run.

Standing actors (persistence check)

• 204.76.203.18 (Pfcloud UG NL, MALWARE-DICT loop): 24th consecutive window; 2,185 events / 581 paths, up from 2,143.
• 213.209.159.175 (Feo Prest SRL DE): 25th window; 9 control-1 mints in-window, 102 mints in the 6-day Tracebit window, and 2 credentials used from 11 AWS-side IPs.
• 80.94.95.211 (SS-Net RO): 3 /.env mint failures on ai-devbox-1 plus 2 AWS-used credentials from older mints.
• 185.73.23.162 (Ruhr-Uni Bochum, benign): netcup-ts + sponge-01-ts 862 events, honest Software Security Research/1.0 UA, /-only and /cdn-cgi/trace-style shallow pattern.
• 45.148.10.171 (CREDSWEEP-NAMED): returned after one absent window; 5 mints in-window and 44 mints in the 6-day Tracebit window.

Canary credentials

Summary

5 Tracebit alert(s) fired in the window (24 use events across 4 credentials). Fleet sensors minted 162 credentials to 38 collector IPs; 4 credential(s) reached AWS. Use outcomes: 12 failure, 12 success. Denied operations: ListFoundationModels×12. 12 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 44 mints, 2026-09-23 04:22 → 2026-09-29 13:09
• 213.209.159.154: 37 mints, 2026-09-26 07:33 → 2026-09-30 00:02
• 94.154.46.245: 28 mints, 2026-09-28 10:16 → 2026-09-29 15:04
• 94.154.46.246: 28 mints, 2026-09-26 00:30 → 2026-09-28 14:47
• 87.120.104.29: 24 mints, 2026-09-23 18:05 → 2026-09-26 05:33
• 104.28.222.46: 20 mints, 2026-09-29 19:00 → 2026-09-29 20:29
• 94.154.46.249: 15 mints, 2026-09-24 23:37 → 2026-09-25 00:25
• 102.220.161.139: 12 mints, 2026-09-26 05:22 → 2026-09-30 05:52
• 104.28.254.47: 11 mints, 2026-09-29 19:00 → 2026-09-29 20:27
• 104.28.222.16: 9 mints, 2026-09-29 22:28 → 2026-09-29 22:28
• 105.115.10.78: 8 mints, 2026-09-25 23:08 → 2026-09-26 20:32
• 194.127.166.149: 8 mints, 2026-09-24 17:10 → 2026-09-24 18:32
• 102.220.161.102: 7 mints, 2026-09-29 08:40 → 2026-09-29 23:06
• 103.75.11.189: 7 mints, 2026-09-28 04:44 → 2026-09-28 10:35
• 109.205.176.10: 6 mints, 2026-09-24 10:44 → 2026-09-29 06:04
• 162.158.182.99: 6 mints, 2026-09-29 22:28 → 2026-09-30 02:52
• 185.177.72.64: 6 mints, 2026-09-25 15:52 → 2026-09-25 22:51
• 2.27.154.52: 6 mints, 2026-09-25 04:53 → 2026-09-25 05:24
• 62.244.54.240: 6 mints, 2026-09-24 22:18 → 2026-09-24 22:45
• 94.154.46.243: 6 mints, 2026-09-27 10:18 → 2026-09-27 10:19
• 94.154.46.244: 6 mints, 2026-09-24 21:15 → 2026-09-24 21:15
• 94.154.46.247: 6 mints, 2026-09-24 05:25 → 2026-09-24 05:26
• 104.28.232.40: 5 mints, 2026-09-30 02:48 → 2026-09-30 02:48
• 136.85.48.119: 5 mints, 2026-09-23 16:49 → 2026-09-25 23:59
• 104.23.223.43: 4 mints, 2026-09-29 22:28 → 2026-09-29 22:32
• 134.209.110.125: 4 mints, 2026-09-27 22:51 → 2026-09-27 23:04
• 135.136.55.62: 4 mints, 2026-09-24 06:13 → 2026-09-24 06:51
• 167.99.181.249: 4 mints, 2026-09-25 20:05 → 2026-09-28 20:32
• 194.180.48.253: 4 mints, 2026-09-24 15:50 → 2026-09-24 19:23
• 23.234.77.64: 4 mints, 2026-09-25 16:29 → 2026-09-25 17:29
• 64.227.32.66: 4 mints, 2026-09-23 16:01 → 2026-09-29 20:29
• 80.94.92.65: 4 mints, 2026-09-27 21:25 → 2026-09-28 03:00
• 104.23.221.190: 3 mints, 2026-09-29 22:28 → 2026-09-29 22:32
• 104.28.254.16: 3 mints, 2026-09-29 22:28 → 2026-09-29 22:28
• 104.28.254.46: 3 mints, 2026-09-29 19:00 → 2026-09-29 19:00
• 146.190.103.103: 3 mints, 2026-09-28 20:16 → 2026-09-29 20:14
• 155.117.232.31: 3 mints, 2026-09-28 17:19 → 2026-09-28 17:46
• 161.35.96.60: 3 mints, 2026-09-27 11:08 → 2026-09-29 19:33
• 165.22.34.189: 3 mints, 2026-09-24 20:39 → 2026-09-28 20:32
• 209.38.208.202: 3 mints, 2026-09-25 20:34 → 2026-09-29 20:13
• 31.57.216.50: 3 mints, 2026-09-25 23:10 → 2026-09-25 23:11
• 41.140.17.206: 3 mints, 2026-09-27 01:56 → 2026-09-27 02:06
• 41.140.198.124: 3 mints, 2026-09-25 03:20 → 2026-09-25 03:28
• 45.138.12.51: 3 mints, 2026-09-24 07:10 → 2026-09-26 07:30
• 45.153.34.39: 3 mints, 2026-09-23 07:00 → 2026-09-27 01:21
• 80.87.206.148: 3 mints, 2026-09-26 09:55 → 2026-09-28 18:50

Network-layer recon (Arkime) — 2026-09-29 07:32:00 → 2026-09-30 07:32:32 UTC

Fingerprint field ssh.hassh, destination port 22 · 125,383 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 71,306, sensor:lauterbourg-01-ts 32,009, frantech-ts 27,527, sensor:frantech-ts 27,527, bahrain-sponge-01-ts 21,302, sensor:bahrain-sponge-01-ts 21,302

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 7,005 sessions from 365 source IPs across 183 networks in 46 countries, port 22, avg 4,920 B/session. Networks: AS8075 Microsoft Corporation, AS150436 Byteplus Pte. Ltd., AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS14061 DigitalOcean, LLC, AS4766 Korea Telecom. Busiest sources: 102.88.137.213, 139.198.113.29, 20.141.30.9, 76.23.15.127, 87.106.29.151. Last 7 days: 09-24 330 IPs, 09-25 339 IPs, 09-26 321 IPs, 09-27 316 IPs, 09-28 356 IPs, 09-29 355 IPs, 09-30 138 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Network-layer notes

• LIBSSH-MASSSWEEP stayed at plateau. It rose from 6,823 to 7,005 sessions and from 347 to 365 source IPs. It remains the only flagged sweep.
• GO-SSH-SWEEP cooled by spread but not by volume. It fell from 72 to 32 source IPs and from 35 to 12 networks, so it missed the dispersed threshold. Sessions fell from 36,121 to 26,477 but still led the fleet by count.
• The two heavy single-source fingerprints diverged. 16443846184e… rose from 9,656 to 11,153 sessions. 4e066189c3bb… fell from 16,664 to 8,998 sessions. Both still need banner characterization.
• Lauterbourg stayed the most scanned node by SSH sessions. Arkime counted 32,009 sessions to 89.116.25.211.

Fleet Observations

Canary economics. Digest rows show 169 mints: ai-devbox-1 94, canary-farm-1 46, control-1 20, and ru-edge-1 9. Tracebit dedup sees 162 credentials to 38 collector IPs because it joins across the pull window. Four credentials reached AWS. Mint failures returned after two clean windows: ai-devbox-1 logged 7 upstream 400s, and control-1 logged 1. The failure rows were tracebit-http-error / Bad Request on /.env, mostly inside the Cloudflare ai-devbox wave, plus 3 rows from 80.94.95.211 and 1 control-1 row from 172.93.215.8.

Attribution and TLS posture. XFF counters rose to 8,059 requests with any XFF, still with zero multi-entry chains and zero ignored-internal rows. The two single-entry mismatches were both the benign metabase-cve-2026-72898-detect/1.0 probe: canary-farm-1 asserted 60.175.55.103 from socket peer 20.247.251.4, and ai-devbox-1 asserted 170.242.250.32 from socket peer 8.215.201.250. Host census stayed identity-driven: ai-devbox-1 logged 7,586 events for inference.fapthropic.com, and lauterbourg-01-ts logged 1,246 for kiteworks.rightabouteverything.show.

Fleet volume moves and causes. control-1 rose to 16,554 events (+291%) because 23.234.118.146 ran the 13,292-path MEGA-DICTIONARY replay. ru-edge-1 rose to 15,593 events (+522%) because 98.98.47.133 ran the same 13,292-path replay and 94.154.46.245 ran a 1,350-event OMEGA census. ai-devbox-1 rose to 9,093 events (+190%) because the Cloudflare-fronted census produced 7,245 HTTPS events. frantech-ts fell to 1,380 events (-87%) because no MEGA-DICTIONARY replay hit it this window. canary-farm-1 fell to 1,933 events (-57%) after yesterday's dual OMEGA burst did not repeat.

control-1 discovery velocity. control-1 is 17 days live. It logged 16,554 events from 113 unique IPs in the digest window. Unique-IP count stays inside the 62–145 post-fix band; event count spiked because one replay host ran 13,292 paths.

First-seen and result-tag spikes. The digest's first-seen path inventory on control-1 and ru-edge-1 came from MEGA-DICTIONARY: /fvbig/sever1078.mips, /hiddenbin/reflect.m68k, /kushnet.sh4, /tranphuonglinh.sh, /update.*, /usa.sh, /uwu.*, and /uxaarp/usagi1/main/*. lauterbourg-01-ts logged 20 llm-endpoint-ollama-chat events from 104.168.115.214 under AutoGenX-Engine/9.1, plus 2 /api/tags events. Treat that as an LLM endpoint probe against the Kiteworks node, not an AI-devbox-only surface.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 630 sources sent credentials → 509 got a shell (81%) → 327 ran a command (64% of shell-getters, 52% of sources). Event level: 12,121 credential attempts → 5,719 accepted logins → 8,591 commands. That is 150% of accepted logins, down from yesterday's 190% but still heavy post-auth work.

Tenth fully static command window. New commands: 0 of 68 distinct. New credential pairs: 0 of 3,989. Telnet commodity attempts fell to 1,957 from 2,644. The recurring uname -s -v -n -r -m inventory cluster stayed dominant at 1,555 events per variant from 3 IPs led by 109.160.32.150. The .ssh replant family stayed broad: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,508 events from 288 IPs, and the key-replace companion ran 1,274 events from 264 IPs. Credential concentration stayed high: 345gs5662d34 / 345gs5662d34 drew 1,442 attempts, and root / 3245gs5662d34 drew 1,119.

Gaps / Next Collection

1. Cloudflare-fronted origin attribution. The new ai-devbox wave hides the actor behind Cloudflare edges. Watch the 76 minted credentials first; origin work belongs outside the trap logs.
2. MEGA-DICTIONARY manifest drift. The twin replay shared all 13,292 paths. Diff the next replay against this manifest before marking the campaign stable again.
3. IAM-write watch. CREDENTIAL-DRAIN did not repeat CreateUser. Keep the alert on any IAM write operation from 213.209.159.175, 80.94.95.211, or the Cloudflare-fronted mint set.
4. GO-SSH-SWEEP and heavy fingerprint banners. GO-SSH-SWEEP stayed high-volume but missed threshold. Characterize 4e066189c3bb… and 16443846184e… before naming either.
5. Lauterbourg XMLRPC continuity. 185.19.40.202 brought the 1337 Services XMLRPC shape back to the Kiteworks node. Watch for the wp-login form leg to return.

Digest: /data/flux-logs/reports/flux-digest-2026-09-30.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-09-30.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-09-30-r2.html

Watch next cycle: (1) CF-FRONTED CREDSWEEP — any AWS use from the 76 ai-devbox credentials. (2) MEGA-DICTIONARY — whether the 13,292-path manifest replays on a third node. (3) CREDENTIAL-DRAIN — any IAM write operation after the one-day CreateUser spike.