FLUX FLEET — INTEL BRIEFING №41

Period: 2026-10-03 07:33 – 2026-10-04 07:33 UTC (24h, day 39 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 39-day baseline, every ≥3× result-tag spike attributed to a named actor or campaign)

BLUF

LeakIX ran its largest wave on record: 31 l9scan IPs pushed 1,471 events and collected 22 canaries across five sensors, with first appearances on lauterbourg-01-ts and sponge-01-ts. WP-FORM-BRUTE went fleet-wide in its fourth window: a ~25-runner roster with one shared 6-UA set logged ~840 wp-json user-enum events and 430+ credential POSTs on 7 of 8 nodes, and the SYNC-ENUM-WAVE campaign merged into it on shared runners. The MEGA-DICTIONARY replay returned under a third Datacamp-range host, and the wordlist grew by 34 paths to 13,359 — its first miner entries. Credential use ran a seventh consecutive window: Feo Prest .175 and SS-Net .211 each spent one canary for sts:GetCallerIdentity successes and denied ListFoundationModels calls. ai-devbox-1 covered the full window again, but its 268 MB rotated log is still un-ingested, so all-time counters stay depressed.

Key Judgements

1. SYNC-ENUM-WAVE and WP-FORM-BRUTE are one operation. Five registered SYNC-ENUM runner IPs (103.154.62.39, 119.198.229.152, 178.128.122.173, 43.162.124.26, 119.47.88.254) appear inside today's WP-FORM roster, and every runner carries the same 6-UA set led by forged Chrome/127.0.0.0 on macOS. The merged campaign now pairs enumeration with credential submission. (High confidence — the IP and UA overlap is measured, not inferred.)
2. LeakIX scaled across both collection layers in one window. The HTTP side set a fleet record (31 IPs, five sensors, 22 mints) and a client with the ssh-2.0-leakix_scanner banner appeared in Arkime the same day. (High confidence on the volumes. Moderate on coordination — the brand links the two layers, but an operator link between the HTTP fleet and the 5-session SSH client is unproven.)
3. The MEGA-DICTIONARY artifact is under active maintenance and pivoting to miners. The anti-join against the pooled six-host artifact shows +34 paths, and seven are xmrig miner payloads — the first in the dictionary's history. (High confidence — the growth is measured against every path the six replay hosts ever served.)
4. The credential-use economy is now standing behavior. Seven consecutive windows with observed AWS use, three actor classes (criminal hoarders, a commodity kit operator, LeakIX), and successes still confined to sts:GetCallerIdentity. (High confidence on the streak. The deny-all policy held through all 8 use events this window.)

Active Campaigns (day 39 status)

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — RECORD WAVE, FIVE SENSORS (Borderline)

• Actors: 31 l9scan IPs (vs 24 in №40 and №15), 1,471 events, 22 mints, plus 6 burst-rejected mints (404 Bad Request at /.env). Spread: ai-devbox-1 13 IPs / 548 events, canary-farm-1 12 / 490, lauterbourg-01-ts 8 / 312 (the abf92a331d66 Kiteworks cluster), control-1 2 / 82, sponge-01-ts 1 / 39 — the first lauterbourg and sponge appearances. Most runners are DigitalOcean. Cross-node reuse persists (46.101.111.185 on 3 sensors, 159.89.174.87, 64.227.32.66, 167.99.182.39, 159.89.127.165 on 2 each).
• TTPs: the registered WebLogic → Confluence → WHM/cPanel → docker-registry journey is intact, at 27 trap families per runner. Runners mint at /.env (22 issued, 6 rejected under burst speed — the №17 quirk shape).
• Assessment: collection volume grew 4% over the №40 record while the footprint spread from three to five sensors. LeakIX stays borderline per the registry (honest UA, public service identity), but the №40 AWS use and this scale-up erode the distinction. Network-layer sibling: fd65145f… (ssh-2.0-leakix_scanner, 5 sessions, 5 IPs, first seen 10-04) — registered as LEAKIX-SSH.

WP-FORM-BRUTE (distributed wp-login brute + user enumeration) ⟳ — FLEET-WIDE, SYNC-ENUM-WAVE MERGED (Hostile, active)

• Actors: ~25 runners on 7 of 8 nodes (frantech-ts excepted). Persisted: 39.105.208.239 (Hangzhou Alibaba, aidev), 160.250.204.33 (netcup), 43.162.124.26, 178.128.122.173, 217.60.198.3 (ru-edge + sponge). New: 51.178.48.203 (OVH, sponge, 88 events / 34 POSTs), 51.195.6.20 (OVH, ru-edge, 63 / 36), 185.216.203.177 (Contabo, farm, 62 / 35), 211.57.200.119, 1.209.110.147, 51.210.150.97, 51.210.10.40, 220.86.115.27, 69.57.172.119, 119.47.88.254, 58.127.77.173, 49.235.161.59, 118.31.79.124, 129.212.232.185, 159.65.149.131, 202.191.58.34 and ~8 more at 5–34 events each. The 217.60.196.x block added three runners (.174, .181, plus a 4-node .196.124 census leg) beside .198.3. One IPv6 runner (2407:1c00:6103:ffb0::).

• TTPs: stage 1 enumerates wp-json users (list + single-ID fetches — /wp-json/wp/v2/users/7 and /users/17 first-seen, ~840 enum events, spikes 110× on sponge and 39.4× on ru-edge). Stage 2 POSTs wp-login.php, one password per body, testcookie + _wpnonce on most legs. Usernames now rotate: log=admin|webmaster|editor. Bodies observed verbatim:

  • log=admin&pwd=9103&redirect_to=http://217.15.163.226/wp-admin/&testcookie=1 (39.105.208.239 — second numeric burst, 131 POSTs / 131 bodies, password range 8,890–12,321)
  • _wpnonce=03830496a3&log=editor&pwd=editor12345&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In
  • log=editor&pwd=Bot%40123456&wp-submit=Log+In&redirect_to=https%3A%2F%2Finference.fapthropic.com%2Fwp-admin%2F&testcookie=1
  • log=admin&pwd=admin&redirect_to=https%3A%2F%2Fsso.rightabouteverything.show%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In

  The redirect_to value derives from the target vhost — the runners resolve fleet identity per node. New journey signature 5e0185746583 (probe→creds loop, 6 IPs, 4 nodes). The ed66cc967251 wp-login+xmlrpc parallel leg ran 20 IPs.

• Assessment: the campaign tripled its roster, added an enumeration stage, and rotates usernames — a maintained tool, not a loose bot collection. Pair counts stay far below the WP-LOGIN-BRUTE 200-pair alarm. Every login lands on the fake WordPress, so no credential success is possible by design.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — THIRD DATACAMP HOST, +34 PATHS (Hostile, active)

• Actors: 138.199.6.234 (Datacamp Limited, CH) — one 1-event frantech touch on 09-27, then the full replay 04:44–04:46 UTC 10-04: 13,358 events / 13,358 paths in ~2 minutes, 209 rotating UAs, 0 POSTs, 0 mints. Prior hosts: 138.199.60.29 and 138.199.60.16 (same Datacamp range), tzulo 23.234.117.146/.118.146, 31173 Services 193.32.126.191/.131, 185.213.155.227, Zenlayer 98.98.47.133.
• TTPs: the anti-join against the pooled six-host artifact shows +34 paths (13,325 → 13,359): /xm/xmrig-static-{arm64,armv7,x64} + /xmrig-{aarch64,arm,x64,x86} (first miner entries), /pid.{armv5tel,armv6l,armv7l,ppc64le}, an 11-member x86_64_{clean,dbg,fin,new,nl,nowd,ns,nsr,sr,t8,v2} stage set, /b_{kt,lt,persist,wt}, /bot-linux-{amd64,arm64,mips,mipsle}, /cur.sh, /l4_armv7l, /mrun, /s/l3.sh.
• Assessment: a third growth event in three replays (+6, +27, +34) marks the dictionary as maintained. The miner entries signal a payload pivot worth tracking. All 13,358 paths landed on a deception surface at zero intel cost.

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — SEVENTH USE WINDOW (Hostile, active)

• Actors (use side): Feo Prest .175 used 1 credential from 4 AWS-side IPs (mint side: control-1). SS-Net .211 used 1 from 4 AWS-side IPs, with 2 in-window mints on ai-devbox-1. No use IP appears in flux logs — the split persists.
• TTPs: 8 use events across 2 credentials — 4 sts:GetCallerIdentity successes, 4 denied ListFoundationModels. The №40 LeakIX use did not repeat, and the SES pair stayed out for a third window. Hoards: .175 120/6d, .154 71/6d, .171 21/6d.
• Assessment: two standing operators spent credentials in the same window again. Successes stay confined to identity calls — the deny-all policy held.

CREDSWEEP family (.env census and collectors) ⟳ — .171 NINTH WINDOW, NEW /24 COLLECTOR (Hostile, active)

• Actors: 45.148.10.171 — ninth consecutive minting window: 2 mints plus 2 rejected under Firefox/12 and OPR/19 forgeries (21/6d), light passes on 7 sensors. NEW: 185.255.126.x /24 on control-1 — 6 IPs minted 1 canary each, and .205 ran a 20-path webapp-config-bundle-js census under Firefox/105 (owns the control 5.1× spike). 105.112.176.254 minted 4/6d (aidev+farm). 91.92.41.8 (TechTies sibling block) minted 4/6d. 102.220.161.87 ran a 1-event touch on all 7 reachable sensors, no mints.
• TTPs: antique-UA forgery rotation carries. The 185.255.126.x shape — per-IP single mints plus one census leg — resembles the one-touch collector families of №15 and №39.
• Assessment: collector recruitment continues while Feo Prest concentrates minting. The new /24 earns a watch line. A second window with mints promotes it.

GIT-VAULT (git-internals walk) ⟳ — SECOND CONSECUTIVE WINDOW (Hostile, active)

• Actors: 104.207.39.149 + 65.111.3.141 (3xK Tech GmbH, US), canary-farm-1, 04:23 and 05:26 local — the same pair, the same hour offset as №40.
• TTPs: honest git/2.40.0 UA, identical 144-event / 142-path walks (HEAD, index, ORIG_HEAD, packed-refs, COMMIT_EDITMSG, FETCH_HEAD, the full hooks/*.sample set). 0 mints, 0 POSTs.
• Assessment: two windows on a fixed schedule reads as standing recon, not a one-off. Promote on a secrets-path extension or a mint.

BUCKLOG-KIT (Bucklog SARL /24) ⟳ — CENSUS OPERATOR, SECOND WINDOW (Hostile, active)

• Actors: 185.177.72.75 — netcup 956 events in №40, control-1 1,022 events / 410 paths / 35 families in 5 minutes (10:01–10:06 UTC 10-03) today. The original kit operators (.66/.53) stay dormant since day 7.
• TTPs: .env-variant and config census (the kill-chain walk: /.env.copy → config/database.yml → wp-config.php → directory .env fanout). 5 POSTs to / were tarpit-eaten with no bodies captured. 0 mints.
• Assessment: the block runs census-class collection on a fresh node each window. Any phpunit or RCE POST promotes this to full kit.

LIBREDTAIL-KIT (phpunit RCE + key-exfil oracle) ⟳ — DELIVERY-CLUSTER WINDOW (Hostile, active)

• Actors: the 7e61a9500d8b php-cgi delivery cluster ran 15 IPs / 737 events fleet-wide. No full-kit (eval-stdin probe) legs observed this window — lauterbourg-01-ts, the №40 center, fell 60%.
• Assessment: the kit's delivery stage runs continuously even when the exploit stage rests. Staging host 217.60.103.56 unchanged since №17.

Watch-class singles (no campaign yet)

• 45.79.123.76 (Akamai Connected Cloud, IN): 219 events / 161 paths / 25 families in 11 seconds on control-1 under a stripped Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 UA, plus 5 empty-UA POSTs to /. POST bodies not captured.
• 82.118.29.x cluster (6+ IPs): paired aidev+sponge runs, Firefox/105 (Win/Ubuntu) + Chrome/106 rotation, webshell-sweep-observed rows, and 3 adminer-credential-post events on ai-devbox-1 — the INFOCREST POST shape under new infrastructure. Promote on a second run.
• 157.245.250.244 (DigitalOcean): frantech-ts, 26 wp-batch-multiplex POSTs to one path over 9 hours under forged Chrome/126 — a low-and-slow SQLi multiplexer, owns the frantech 26× spike.
• 140.245.97.208 (Oracle): 9-event Chrome/39 touches on aidev + farm. Far below the ORACLE-SWEEP un-pause trigger (the ~117-path core). That campaign stays paused.

Absent or paused

OMEGA-SWEEP (first miss after .250's second run — pool singles 94.154.43.129/.164 minted 1 each), CF-FRONTED CREDSWEEP (fourth window), METADATA-HUNT (tenth marker-light window), XMLRPC-BRUTE (silent — today's 25 wp-xmlrpc-post events are WP-FORM-BRUTE's ed66 leg), CONFIG-SWEEP, SS-PROBE, NIGHTAGENT (dormant), ORACLE-SWEEP, SONICWALL-VPN-PROBE, ZKILLU-GITWALK, CRUSADER-SWEEP, CURL-SWEEP, GCP-ACONF, ALIYUN-PROBE, ENV-CENSUS-3/4. MALWARE-DICT: 204.76.203.18 ran its 28th control-1 loop — 2,248 events / 578 paths, recovered from №40's 872, plus a 6-event ru-edge touch. TOKEN-CRAWLER's /24 ran one-touch passes on all 8 nodes (45.198.224.124/.125) with no /c/ wave.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (8 use events across 2 credentials). Fleet sensors minted 54 credentials to 34 collector IPs; 2 credential(s) reached AWS. Use outcomes: 4 success, 4 failure. Denied operations: ListFoundationModels×4. 4 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.154: 71 mints, 2026-09-27 04:38 → 2026-10-02 12:39
• 45.148.10.171: 21 mints, 2026-09-27 05:53 → 2026-10-04 07:23
• 94.154.46.245: 18 mints, 2026-09-28 10:16 → 2026-09-29 15:04
• 94.154.46.246: 12 mints, 2026-09-28 05:48 → 2026-09-28 05:49
• 94.154.46.249: 12 mints, 2026-10-01 01:07 → 2026-10-01 01:07
• 80.94.92.65: 11 mints, 2026-09-27 21:25 → 2026-10-04 00:44
• 94.154.46.250: 11 mints, 2026-10-02 02:03 → 2026-10-02 05:48
• 102.220.161.139: 8 mints, 2026-09-28 16:53 → 2026-10-01 21:00
• 109.205.176.10: 7 mints, 2026-09-27 06:40 → 2026-10-03 17:55
• 155.117.232.31: 6 mints, 2026-09-28 17:19 → 2026-10-02 22:03
• 94.154.46.243: 6 mints, 2026-09-27 10:18 → 2026-09-27 10:19
• 102.220.161.102: 4 mints, 2026-09-29 08:40 → 2026-09-29 23:06
• 102.220.161.87: 4 mints, 2026-09-30 16:51 → 2026-10-02 14:51
• 103.75.11.189: 4 mints, 2026-09-28 05:28 → 2026-09-28 10:35
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 161.35.96.60: 4 mints, 2026-09-27 11:08 → 2026-10-01 19:14
• 165.22.34.189: 4 mints, 2026-09-28 20:32 → 2026-10-02 20:16
• 91.92.41.8: 4 mints, 2026-09-28 21:58 → 2026-10-04 02:31
• 206.189.19.19: 3 mints, 2026-10-02 21:35 → 2026-10-03 20:42
• 206.209.210.3: 3 mints, 2026-10-01 21:40 → 2026-10-02 05:10
• 217.60.76.167: 3 mints, 2026-09-28 13:15 → 2026-10-02 22:14
• 41.140.8.33: 3 mints, 2026-10-02 22:14 → 2026-10-02 22:15
• 45.138.12.51: 3 mints, 2026-10-02 10:20 → 2026-10-04 04:20
• 46.101.111.185: 3 mints, 2026-09-27 20:37 → 2026-10-03 20:42
• 64.227.32.66: 3 mints, 2026-09-29 20:04 → 2026-09-30 17:55

Network-layer recon (Arkime) — 2026-10-03 07:33:00 → 2026-10-04 07:33:48 UTC

Fingerprint field ssh.hassh, destination port 22 · 120,703 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 79,674, frantech-ts 28,885, sensor:frantech-ts 28,885, sensor:lauterbourg-01-ts 20,881, bahrain-sponge-01-ts 18,215, sensor:bahrain-sponge-01-ts 18,215

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,003 sessions from 318 source IPs across 155 networks in 55 countries, port 22, avg 4,928 B/session. Networks: AS8075 Microsoft Corporation, AS150436 Byteplus Pte. Ltd., AS16276 OVH SAS, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS14061 DigitalOcean, LLC. Busiest sources: 45.195.221.26, 129.121.139.106, 103.43.191.43, 101.47.8.113, 20.55.45.217. Last 7 days: 09-28 356 IPs, 09-29 355 IPs, 09-30 365 IPs, 10-01 350 IPs, 10-02 332 IPs, 10-03 346 IPs, 10-04 113 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 22,764 sessions from 87 source IPs across 30 networks in 20 countries, port 22, avg 5,131 B/session. Networks: AS209854 Cyberzone S.A., AS213790 Limited Network LTD, AS205089 Alfahost LLC, AS45102 Alibaba US Technology Co., Ltd., AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Busiest sources: 109.160.32.36, 109.160.32.115, 109.160.32.136, 109.160.32.45, 109.160.32.113. Last 7 days: 09-28 60 IPs, 09-29 57 IPs, 09-30 65 IPs, 10-01 84 IPs, 10-02 64 IPs, 10-03 68 IPs, 10-04 50 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon notes. GO-SSH-SWEEP (0a07365c…) re-crossed the dispersed threshold: 87 source IPs / 30 networks / 22,764 sessions (+24 IPs day-over-day), with the 109.160.32.x sources busiest again — the registry already notes that block's overlap with Feo Prest infrastructure. LIBSSH-MASSSWEEP held its 15-day plateau (318 IPs, band 316–373). 16443846184e… reached 15,969 sessions from 49 IPs in its seventh cycle without banner characterization, e37f354a101a… stayed frantech-ts's top fingerprint at 10,528, and 4e066189c3bb… returned for a second consecutive window (5,341 sessions, +802). The new ssh-2.0-leakix_scanner fingerprint is registered as LEAKIX-SSH in assets/recon-names.tsv and the campaign registry.

Fleet Observations

Pipeline. ai-devbox-1 covered the full window: the 05:06 UTC 10-03 rotation predates the window start, so this cycle's aidev cells (1,594 events, −43% vs the 7-day average) are real, not floors. The gap stays open — env-canary.jsonl.1 (268 MB) is still outside the digest glob, the all-time issued counter remains at its post-rotation 1,484 baseline (pre-rotation 2,460), and every pre-10-03 aidev event is invisible. The fix belongs in the ops repo: ingest rotated files, or rotate behind the sync boundary.

Canary economics. Digest mint rows: ai-devbox-1 24 (19 IPs), canary-farm-1 20 (16), control-1 15 (14), ru-edge-1 6 (4) — 65 rows. Tracebit dedupe: 54 credentials to 34 collectors. Mint failures 8×400, zero 401s: 6 are REGISTRY-HUNT burst rejections at /.env (the №17 quirk shape), 2 are 45.148.10.171. Every mint carries ["aws"].

Attribution and TLS posture. XFF counters: any 1,265 / multi-entry 0 / ignored-internal 2 / single-entry mismatch 5. All five mismatches are benign: 4 carry the registered method-fingerprint prober 162.243.83.227's X-Forwarded-For: 1.2.3.4 test value, and 1 is a self-labeled metabase-cve-2026-72898-detect/1.0 detector from socket peer 169.40.142.190 (the same /24 as ZKILLU-GITWALK's 169.40.142.2 — note only). No hostile forgery signal. Host census: vhost-led on the proxied nodes (sso.rightabouteverything.show 752, inference.fapthropic.com 730, kiteworks.rightabouteverything.show 568) and bare-IP-led elsewhere.

Volume moves and causes. frantech-ts +30% (14,091) — the MEGA-DICTIONARY replay (13,358 events). sponge-01-ts +54% (1,694) — the WP-FORM wave (286 enum events on that node, 51.178.48.203's 293 events the largest single share). canary-farm-1 −61% (1,941) and ru-edge-1 −56% (1,386) — no ZKILLU-class mass and no CF wave, with the l9scan wave the largest single component on both. lauterbourg-01-ts −60% (930) — №40's phpunit spike did not repeat. ai-devbox-1 −43% (1,594) — the 7-day average still carries pre-rotation full days. netcup-ts −14% (960) — №40's Bucklog leg moved to control. control-1 −11% (4,542).

control-1 discovery velocity. Day 21: 4,542 events from 157 unique IPs — unique IPs left the 62–145 band for the first time in 15 windows. Cause: the l9scan control leg (2 IPs), Bucklog .75's census (410 paths), and the 185.255.126.x mint cluster.

Result-tag spike attribution. All 12 spikes ≥3× have causes: the ten wp-user-enum-rest / wp-login spikes are the WP-FORM-BRUTE wave (39.105.208.239 owns 131 of aidev's 178 credential events). The control webapp-config-bundle-js 5.1× is 185.255.126.205 (20 of 33). The frantech wp-batch-multiplex 26× is 157.245.250.244.

Fleet-side changes this cycle. The CHAINS dict in flux-visuals.py gained updates for CREDENTIAL-DRAIN, REGISTRY-HUNT, OMEGA-SWEEP (→ idle), CREDSWEEP, MALWARE-DICT, GIT-VAULT, SYNC-ENUM-WAVE (→ merged), MEGA-DICT, WP-FORM-BRUTE, and SS-NET TOOLING, plus a new BUCKLOG-KIT entry. TALKER_CAMPAIGNS gained 37 entries and 2 relabels. recon-names.tsv gained LEAKIX-SSH. The visuals dashboard ran once — /data/flux-logs/reports/flux-fleet-visuals-2026-10-04.html. The campaign registry carries this cycle's merges and status changes.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 610 sources sent credentials → 500 got a shell (82%) → 267 ran a command (53% of shell-getters, 44% of sources). Event level: 43,604 credential attempts → 3,314 accepted logins → 3,646 commands (110% of accepted logins go on to run something).

Fourteenth fully static window. New commands: 0 of 46 distinct. New credential pairs: 0 of 31,654. Telnet commodity attempts jumped to 3,925 from 736 (5.3×) — unexplained from the condensed feed, which carries no per-source telnet breakdown. The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,076 events from 202 IPs, and the key-replace companion ran 928 from 188. The uname inventory set ran 320 events from 47 IPs led by 120.48.175.69, and the 92.118.39.71 / 62.171.133.1 environment-survey pair held at 218 and 121 events each. Credential concentration: 345gs5662d34/345gs5662d34 drew 1,044 attempts and root/3245gs5662d34 drew 779.

Gaps / Next Collection

1. Restore ai-devbox-1 history (third cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary. All-time counters stay wrong until then.
2. WP-FORM-BRUTE fifth window. Re-count the roster and diff against ~25 runners. Watch for further username rotation, a third numeric burst, and any change in what the fake WordPress returns to the runners.
3. REGISTRY-HUNT follow-through. Does the 31-IP wave repeat at scale? Watch LEAKIX-SSH (fd65145f…) for session growth, and whether the l9scan class spends another canary in AWS.
4. MEGA-DICTIONARY anti-join. Diff the next replay against the 13,359 mark. Three growth events in three replays make the next delta a trend. Watch for a fourth Datacamp host or a same-host repeat — 138.199.6.234's 09-27 single touch suggests prior scouting.
5. Network-layer banner characterization, cycle seven. 16443846184e… (15,969 sessions), e37f354a101a… (10,528, frantech top), and 084386fa7ae5… (50 IPs) remain unnamed. Check whether 4e066189c3bb… holds a third window.
6. 185.255.126.x /24 and the 82.118.29.x cluster. A second window with mints (former) or adminer POSTs (latter) promotes both.
7. CREDENTIAL-DRAIN eighth window. Watch for a LeakIX-class use repeat and the SES pair's return.

Digest: /data/flux-logs/reports/flux-digest-2026-10-04.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-04.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-04.html

Watch next cycle: (1) WP-FORM-BRUTE's fifth window — roster diff and username rotation. (2) REGISTRY-HUNT — a repeat of the 31-IP record wave, LEAKIX-SSH growth, and any l9scan AWS use. (3) MEGA-DICTIONARY — anti-join against 13,359. The +6/+27/+34 series wants a fourth point.