FLUX FLEET — INTEL BRIEFING №39

Period: 2026-10-01 07:33 – 2026-10-02 07:33 UTC (24h, day 37 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 37-day baseline, main volume moves tied to spot-query evidence)

BLUF

A new single-IP campaign, ZKILLU-GITWALK, owns this window's volume. One Zkillu SAS host ran 14,787 events against canary-farm-1 in 10 minutes — 11,281 of them fake-git misses against the trap's git decoy — and drove the node to +262% over its 7-day average. Credential use ran for a fifth consecutive window: thieves drew SES quota and SMS attribute recon again (85 denied calls of each), and the Feo Prest hoarder 213.209.159.175 set a record hoard of 114 credentials in 6 days. SS-Net's standing collector 80.94.95.211 changed cadence — 34 canaries minted in one 27-second burst, then one credential used in AWS. The fleet minted 119 credentials to 27 collectors with zero mint failures, the first failure-free window since №36.

Key Judgements

1. ZKILLU-GITWALK builds its target list from our own served HTML. First-seen paths include /.git/logs/refs/<h1>Index, /.git/logs/refs/<pre>, and /.git/logs/refs/<hr> — HTML tag fragments as path segments. The tool extracted link targets from rendered decoy pages and walked them against the fake git repository. (High confidence on the mechanism from path evidence. Moderate on intent — one IP, one node, GET-only, so recon-scale mapping is the read and mirror-exfil intent is unmeasured.)
2. Credential theft consolidated around three named repeat actors. Three of the four credentials used in AWS trace to Feo Prest .175 (hoard 114/6d, record), SS-Net .211 (52/6d), and the Bucklog family (its second use event after №38's .49). The SES pair from №38 repeated at higher volume: 85 GetSendQuota plus 85 GetSMSAttributes denials. (High confidence — Tracebit alert operations are direct evidence, and the deny-all policy held.)
3. SS-Net .211 moved from trickle collector to burst harvester. Its prior cadence was 1–4 mints per window across 16 appearances. This window it minted 34 on ai-devbox-1 in 27 seconds and then used one credential from 2 AWS-side IPs. (High confidence on the behavior change. Moderate on the cause — new tooling and a new operator are indistinguishable at this resolution.)
4. The OMEGA /46 pool is still recruiting operators. 94.154.46.250 is a first appearance from the block, and its 1,007-path wordlist is the second-widest single-IP run in the series after .246's 1,042. (Moderate confidence — one window of evidence, wordlist overlap with the .24x core untested this cycle.)

Active Campaigns (day 37 status)

ZKILLU-GITWALK (single-IP git-internals mass walk) ⚠ NEW — Hostile, active

• Actors: 169.40.142.2 (Zkillu SAS, FR), one IP, one node, not on ipsum or firehol2. The full run lasted 10 minutes (12:46–12:56 UTC+4 on 10-01) and produced the fleet-record single-IP event: 14,787 events, 10,150 paths, 44 trap families. The hour-12 burst on canary-farm-1 is 14,899 of the node's 16,146 in-window events.
• TTPs: the journey opens with HEAD / and robots/sitemap probes through the tarpit, then a config census at 12:46:21 — /.env (issued ×2, the campaign's mints), /.aws/credentials, /credentials.json, /secrets.json, /config/app.php, /.circleci/config.yml, /.github/workflows/main.yml, /sites/default/settings.php, /_profiler/phpinfo, /actuator/configprops. The bulk is the git walk: 11,281 fake-git-miss, 2,333 fake-git, 760 fake-git-redirect, with real-looking internals (/backend/.git/hooks/post-commit, /backend/.git/objects/28/) beside HTML-fragment garbage (/.git/logs/refs/<h1>Index). User agent is bare stripped Chrome with no platform token: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. First-seen paths carry the same 03:15 sync-arrival timestamp, so treat the inventory, not the times, as the evidence.
• Assessment: this is a scraper that parses our decoy content and feeds it back as a wordlist — the fleet's fake-git and canary surfaces shaped the attack itself. The 2 mints make it a collector, but its hoard behavior is unobserved. No POST payloads were captured this window anywhere in the fleet. The walker is GET-only. Fleet design validation: the tarpit held the census legs to 302s, and the fake-git decoy absorbed 14.4k requests at zero intel cost.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIFTH USE WINDOW, SES REPEAT (Hostile, active)

• Actors (use side): 185.177.72.9 (Bucklog SARL, FR — ipsum:1) minted 1 on canary-farm-1 at 18:30 (honest curl/8.7.1) and used 2 credentials from 5 AWS-side IPs. 213.209.159.175 (Feo Prest) used 1 from 4 IPs. 80.94.95.211 (SS-Net, RO) used 1 from 2 IPs. No use IP appears in flux logs — the split persists.
• TTPs: 181 use events across 4 credentials — 8 sts:GetCallerIdentity successes and denied GetSendQuota ×85, GetSMSAttributes ×85, ListFoundationModels ×3. The SES pair is a repeat of №38 at higher volume. The Bucklog mint→use gap was minutes. The family's lineage now spans the day-7 reverse-shell kit, the №33 collector .64, the №38 user .49, and this window's .9 (which also ran 188 events of phpinfo/webshell sweeps on canary-farm-1, with sibling .29 running the same 76-path set on frantech-ts at 23:49).
• Assessment: sender-infrastructure recon is now a standing behavior, not a one-off probe. The deny log keeps showing enumeration of what an AWS account owns, under a deny-all policy that held. The three repeat actors account for 114 + 52 + 1 canaries in 6 days — the hoard is concentrated, and use follows hoard size.

SS-NET TOOLING (standing .env walker, SS-Net RO) ⟳ — BURST ESCALATION (Hostile, active)

• Actors: 80.94.95.211 (SS-Net, RO), 16th window in the series. Sibling collector 80.94.92.65 added 4 mints (9/6d).
• TTPs: 200 events on ai-devbox-1 (15:23–15:24 UTC+4) with 34 mints inside a 27-second burst, under the Android-4.4.2/VirtualBox Chrome/30 forgery. One credential reached AWS in-window (see CREDENTIAL-DRAIN). The forged-UA rotation and .env-variant wordlist are unchanged.
• Assessment: the actor now harvests at census speed and spends what it takes. Watch for the burst cadence to become its default, and for its use-side IPs to overlap Feo Prest's.

OMEGA-SWEEP (/46 census pool, Googlebot forgery) ⟳ — NEW OPERATOR .250 (Hostile, active)

• Actors: 94.154.46.250 (Omegatech LTD, US) — first appearance from the block, which now spans .242–.250. Ru-edge run: 1,765 events / 1,007 paths / 129 families in three passes 02:03–05:48 UTC+4, 11 mints under forged Googlebot/2.1. A 150-path light pass hit lauterbourg-01-ts at 13:32. Pool singles 94.154.43.84 and 94.154.43.122 minted 1 each (Chrome/147 forgery, 00:20).
• TTPs: the kill-chain journey shows wp-config.bak, /.git/HEAD, /.aws/credentials, /yarn.lock, /docker-compose.yml, /.circleci/config.yml, /.gitlab-ci.yml, /.ssh/id_dsa — the IaC/DevOps growth from №36 plus the core credential families. Ru-edge's wp-config (4.8×), rails-database-yml (3.7×), and app-config-* (~3.4×) digest spikes are all this run.
• Assessment: standing census, now with a ninth host in the block. No observed AWS use from the /46 range. The 6-day hoard leaders in the block remain .246 (28) and .249 (12 in the last pull window).

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — NINE-RUNNER WAVE (Borderline)

• Actors: 9 runners across canary-farm-1, ai-devbox-1, and lauterbourg-01-ts. Full-kit l9scan journeys (27 families each): 164.90.208.56 (farm), 157.245.204.205 (farm), 64.226.65.160 (farm), 159.89.174.87 (farm), 165.22.34.189 (aidev), 143.110.217.244 (aidev), 164.92.107.174 (aidev) — all DigitalOcean. The lauterbourg pair 206.189.19.19 and 167.71.175.236 ran under the Kiteworks-root signature abf92a331d66. l9explore 45.138.12.51 hit aidev (20 families, 1 mint).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry journey is intact. Eight mints landed at 1 per IP inside the 20:36–23:17 UTC+4 wave (l9scan/2.0.234313… on farm, l9scan/2.0.632323… on aidev).
• Assessment: collection continues at a steady 1-mint-per-runner cadence. The lauterbourg pair shows the template still parses node identity. Honest UA and public service identity keep LeakIX borderline, per registry.

CREDSWEEP operators (.env census family) ⟳ — NEW DO-SG OPERATOR, FEO MINT BURSTS (Hostile, active)

• Actors: 188.166.248.40 (DigitalOcean, SG) — first appearance: frantech-ts 1,710 events / 515 paths in 3 minutes (16:02–16:05), 17 small POST / (5–21 bytes, bodies not captured). Feo Prest .154 minted 33 on control-1 in 18 seconds (06:57, Safari/412 PPC forgery) and ran a 170-event sponge census at 14:00. .175 added 36 control-1 mints in two bursts (10:00, 21:32–47). 45.148.10.171 minted 6 across three nodes (7th consecutive window, 37/6d). 102.220.161.87 minted 1 on aidev. 102.220.161.139 minted 3 (ru-edge + aidev ×2, honest Go-http-client/1.1).

• TTPs: the new operator runs a directory-prefixed .env fanout (/payments/.env, /gitlab-ci/.env, /s3/.env.bak, /stockapi/.env, /.env.keys) under per-request UA rotation that includes a new typo-forgery variant, quoted verbatim:

  Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

  This extends the registered Mozlila forgery with Bulid and Moblie typos. The tarpit held all 515 paths to 302/404.

• Assessment: the census family keeps recruiting single-run operators while the Feo Prest pair concentrates minting. The typo forgeries remain the family fingerprint across operator changes.

WP-FORM-BRUTE (distributed wp-login form brute) ⟳ — SECOND WINDOW (Hostile, active)

• Actors: signature df15d0ee3ccf — 7 IPs / 740 events on canary-farm-1, netcup-ts, ru-edge-1, sponge-01-ts. The sponge runner 47.104.246.244 (Hangzhou Alibaba, CN) held 134 events / 67 POSTs on one path across 26 hours. The smaller parallel shape ed66cc967251 (wp-login + xmlrpc, ⟳ since 09-23) ran 12 IPs / 48 events on ai-devbox-1 and canary-farm-1.
• TTPs: probe → credentials → probe journeys. wp-login-probe spiked 3.4× on ai-devbox-1 and 4.1× on ru-edge-1. Form tokens and the fixed log=admin carry over from №38.
• Assessment: the wave shrank from 11 runners to 7 but persists past its 23-hour first-run span. Pair count stays far below the WP-LOGIN-BRUTE 200-pair growth alarm. Runner ASN enrichment is still outstanding.

SONICWALL-VPN-PROBE (SSL-VPN portal walk) ⚠ NEW — Hostile, watch

• Actors: signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor on ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts, 52 events total.
• TTPs: /auth.html (sonicwall-portal 200) → /auth1.html → /sslvpnLogin.html → companion webshell paths. 0 mints, no POSTs observed. Lineage: №14's 45.79.218.38 ran the same 15-event shape solo from a Linode IP.
• Assessment: one tooling kit probing VPN portals fleet-wide. The fake 200 on sonicwall-portal gives the operator a false liveness signal. Promote on a return with credential POSTs.

LIBREDTAIL-KIT (phpunit RCE + key-exfil oracle) ⟳ — 20TH WINDOW (Hostile, active)

• Actors: the php-cgi delivery cluster 7e61a9500d8b (⟳ since 08-29) ran 5 IPs / 245 events on control-1 and netcup-ts.
• TTPs: /bin/sh cgi-traversal plus cmd-injection-php-cgi-rce journeys, per the digest cluster row. The staging host 217.60.103.56 is unchanged since №17.
• Assessment: execution-seeking kit, steady background presence. No bodies quoted this window — the cluster row carries no bodyPreview.

MALWARE-DICT (Pfcloud loop) and absences

• MALWARE-DICT: 204.76.203.18 ran its 26th consecutive control-1 loop: 1,550 events / 565 paths, down from 2,107. The loop continues to slow.
• MEGA-DICTIONARY: first miss since the №38 double replay — no replay in-window, and frantech-ts fell −76% to 2,496 events as a result. A second consecutive miss re-opens the pause under the №35 rule. Manifest frozen at 13,297 paths.
• Absent or paused: CF-FRONTED CREDSWEEP (no Cloudflare wave, second window), METADATA-HUNT (no @fs/__aws_leak_probe marker rows in the digest's spike or first-seen tables, eighth window), ORACLE-SWEEP (standing-paused, fourth), CONFIG-SWEEP (no new run since №33), SS-PROBE, NIGHTAGENT (dormant, dropper retired), XMLRPC-BRUTE (no multicall flood in the digest), CRUSADER-SWEEP, CURL-SWEEP, GCP-ACONF, AKAMAI-CONFIG, ALIYUN-PROBE, ENV-CENSUS-3/4, SYNC-ENUM-WAVE.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest): record hoard — 114 mints in 6 days — plus a third consecutive use window. Control-1 top-talker legs: 378-event census at 06:57 and 242-event census at 21:33, both minting.
• 213.209.159.154 (Feo Prest): 71 mints/6d, including the 33-mint 18-second burst. Its census arm reached control-1 and sponge-01-ts.
• 80.94.95.211 / 80.94.92.65 (SS-Net, RO): burst escalation this window. See SS-NET TOOLING.
• 45.148.10.171: 7th consecutive minting window, 6 mints across three nodes, 37/6d, zero use.
• 204.76.203.18 (Pfcloud UG, NL): 26th loop window, 1,550 events, volume declining.
• 206.209.210.3 (unattributed): new coordinated collector — 4 mints on 4 sensors in one window (21:40 → 05:10), a different forged browser UA at each stop. First single-IP four-sensor collector sweep on record. Watch for a second window.
• 102.220.161.87 / .139 (VPS Dedicated, SI): both minted. .139 now sits at 14/6d.
• Benign probers, unchanged: 89.248.172.33 (5 nodes) and 93.174.93.12 (4 nodes) fixed-cadence / handshakes. 185.218.86.25 returned to all 7 trap nodes /-only (95 events), the №13 benign shape.

Network-layer recon (Arkime) — 2026-10-01 07:33:00 → 2026-10-02 07:33:46 UTC

Fingerprint field ssh.hassh, destination port 22 · 95,799 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 62,991, bahrain-sponge-01-ts 26,706, sensor:bahrain-sponge-01-ts 26,706, frantech-ts 16,465, sensor:frantech-ts 16,465, sensor:lauterbourg-01-ts 13,682

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,077 sessions from 328 source IPs across 156 networks in 57 countries, port 22, avg 4,932 B/session. Networks: AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom, AS9318 SK Broadband Co Ltd. Busiest sources: 89.109.4.236, 147.90.234.15, 95.172.142.52, 160.251.101.169, 129.121.99.2. Last 7 days: 09-26 321 IPs, 09-27 316 IPs, 09-28 356 IPs, 09-29 355 IPs, 09-30 365 IPs, 10-01 350 IPs, 10-02 112 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 351 sessions from 98 source IPs across 80 networks in 36 countries, port 22, avg 5,048 B/session. Networks: AS4775 Globe Telecoms, AS14061 DigitalOcean, LLC, AS28006 CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP, AS8345 JSC ER-Telecom Holding, AS45706 Tele Globe Global, PT. Busiest sources: 222.127.142.214, 27.123.7.187, 90.158.37.141, 112.199.113.210, 91.185.39.130. Last 7 days: 09-17 274 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 27,602 sessions from 71 source IPs across 28 networks in 19 countries, port 22, avg 5,145 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS48282 Hosting technology LTD, AS58519 Cloud Computing Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Busiest sources: 77.239.124.151, 77.239.124.154, 109.160.32.137, 77.239.124.145, 109.160.32.30. Last 7 days: 09-26 41 IPs, 09-27 35 IPs, 09-28 60 IPs, 09-29 57 IPs, 09-30 65 IPs, 10-01 84 IPs, 10-02 18 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon notes: GO-SPRAY-SWEEP (06ff3615…) re-crossed the dispersed threshold — 98 IPs / 80 networks, the third crossing on record after the №34 re-pause. GO-SSH-SWEEP (0a07365c…) crossed for the second consecutive window and stays the volume leader at 27,602 sessions, with its busiest sources in the 77.239.124.x and 109.160.32.x blocks — the same /24 that works the frantech ssh honeypot after a shell. LIBSSH-MASSSWEEP holds its plateau (328 IPs, inside the 316–365 band, day 11). The unnamed heavy 16443846184e… ran 12,935 sessions from 43 IPs — fifth cycle without banner characterization. 4e066189c3bb… was absent a second window. Treat it as paused unless it returns. sponge-01-ts inbound rose to 26,706 tagged sessions (+59%), now the second-heaviest tag after the generic honeypot class.

Fleet Observations

Canary economics. The digest shows 153 mint rows: ai-devbox-1 47 (13 IPs), control-1 74 (5 IPs), canary-farm-1 18 (13 IPs), ru-edge-1 14 (4 IPs). Tracebit dedup sees 119 credentials to 27 collectors. Mint failures: zero — the first failure-free window since №36, against a prior band of 0.1–11.6 failures per mint. Two collector families drove the mint surge: Feo Prest (.154 33 + .175 36 on control-1) and SS-Net .211 (34 on ai-devbox-1). Digest mints-by-type lists aws everywhere and adds an ssh label on 16 canary-farm-1 rows — worth a look next cycle against the canary menu config. All-time issued rows stand at 2,460 (visuals counter).

Attribution and TLS posture. XFF counters: any 15,580 / multi-entry 0 / ignored-internal 377 / single-entry mismatch 0. The any-XFF count tracks the canary-farm-1 burst volume through the Caddy front-end (14,852 HTTPS events) and carries no forgery signal: multi-entry and mismatch both zero, so the №29-style attribution laundering did not recur. Host census stays vhost-led on the proxied nodes (sso.rightabouteverything.show 14,991, inference.fapthropic.com 349) and bare-IP-led elsewhere.

Volume moves and causes. canary-farm-1 +262% (15,946) — ZKILLU-GITWALK. frantech-ts −76% (2,496) — no MEGA-DICTIONARY replay. ai-devbox-1 −63% (1,193) — no Cloudflare wave for a second window. control-1 −54% (2,751) — the 7-day average carries the 16,554 spike day from the №37 replay seam. lauterbourg-01-ts −63% (1,018) and netcup-ts −43% (741) — no replay and no Ruhr-Uni scanner. ru-edge-1 −10% (2,529) — the .250 census nearly offset the missing replay volume. sponge-01-ts −21% (1,240).

Result-tag spike attribution. Every spike ≥3× has a cause: canary-farm-1's fake-git trio and frantech's tarpit-module (3.2×, 1,263) belong to the walker and the .40 census. Control's issued (4.0×) is the Feo bursts. Ru-edge's config spikes and both wp-login-probe spikes belong to .250 and WP-FORM-BRUTE. The sponge phpmyadmin-login spike (57.0×) is one IP: 43.139.215.32 ran 57 POSTs against a single phpMyAdmin path in 14 seconds under the honest self-label Go Web Pentest Tool — a single burst, no fanout, watch-class.

control-1 discovery velocity. control-1 is 19 days live. It logged 2,751 events from 115 unique IPs. The unique-IP count sits inside the 62–145 post-fix band for the thirteenth consecutive window.

Pipeline. No node changes this cycle. The CHAINS dict in flux-visuals.py gained ZKILLU-GITWALK, SONICWALL-VPN-PROBE, and SS-NET TOOLING, and nine rows refreshed. The campaign registry update is part of this cycle. The visuals dashboard rerun after the CHAINS edit saved as -r2. No new digest quirks. The 153-row digest mint count versus 119 Tracebit credentials is the established window-seam cast.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 606 sources sent credentials → 461 got a shell (76%) → 299 ran a command (65% of shell-getters, 49% of sources). Event level: 36,872 credential attempts → 5,137 accepted logins → 9,985 commands (194% of accepted logins go on to run something, up from 137%).

Twelfth fully static window. New commands: 0 of 66 distinct. New credential pairs: 0 of 27,243. Telnet commodity attempts fell to 611 from 815. The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,162 events from 240 IPs, and the key-replace companion ran 1,005 events from 220 IPs. The uname -m | awk / uname -s -v -n -r -m inventory pair ran 1,316 events each from 6 IPs led by 109.160.32.104 — the GO-SSH-SWEEP /24 also works this honeypot after a shell. A GPU/host survey set (lspci | grep VGA, nvidia-smi -q, /bin/./uname, uptime -p) ran 523 events each from 3 IPs led by 195.178.110.218 (Techoff block). Credential concentration is unchanged: 345gs5662d34/345gs5662d34 drew 1,110 attempts and root/3245gs5662d34 drew 801.

Gaps / Next Collection

1. ZKILLU-GITWALK second appearance. One IP, one node so far. Diff any return's path set against this window's 10,150 to measure wordlist reuse, and check whether the 2 minted canaries get used.
2. SES escalation. A third SES window, or any SESv2 or ses:SendEmail attempt, would mark sender-infrastructure targeting as standing behavior. Pivot 185.177.72.9's 5 AWS-side use IPs against the Bucklog staging map.
3. MEGA-DICTIONARY manifest check. A second consecutive miss re-opens the pause. On the next replay, anti-join against the frozen 13,297-path manifest.
4. Banner characterization, cycle five. 16443846184e… (12,935 sessions, 43 IPs) is still unnamed. Confirm 4e066189c3bb…'s absence is a pause and not a retention-floor artifact.
5. OMEGA .250 spread. Check whether the 1,007-path wordlist appears on other /46 hosts, and anti-join it against .246's 1,042-path core.
6. WP-FORM-BRUTE runner enrichment. ASN attribution for the 7 active runners is outstanding, and the 200-pair growth alarm frame stays armed.
7. ssh-type mint label. Verify against the canary menu config whether the 16 ssh-labelled farm mints are a new canary type or a label drift.

Digest: /data/flux-logs/reports/flux-digest-2026-10-02.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-02.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-02-r2.html

Watch next cycle: (1) ZKILLU-GITWALK — second IP or node, and whether its 2 canaries reach AWS. (2) CREDENTIAL-DRAIN — a third SES window, plus SS-Net .211's burst cadence. (3) MEGA-DICTIONARY — a second miss re-opens the pause. Anti-join the next replay against the 13,297-path manifest.