FLUX FLEET — INTEL BRIEFING №42

Period: 2026-10-04 07:33 – 2026-10-05 07:33 UTC (24h, day 40 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 40-day baseline, every ≥3× result-tag spike attributed to a named actor or campaign)

BLUF

WP-FORM-BRUTE ran its fifth window with a doubled roster — 46 runner IPs touched the wp-login surfaces — but dropped its enumeration stage entirely: zero wp-user-enum-rest events after ~840 in №41. A new one-POST generation derives passwords from the target vhost (pwd=inference against the fapthropic decoy, pwd=sso against the rightabouteverything decoy), so the tool now guesses from fleet identity, not a fixed list. The MEGA-DICTIONARY replay returned to its №30 host 185.213.155.227 and pushed the wordlist to 13,398 paths (+39, the fourth consecutive growth event, with new Aurora and manta dropper families); it owns frantech-ts's +59%. Credentials reached AWS for the eighth consecutive window: Feo Prest .175 spent one canary for two sts:GetCallerIdentity successes against two denied ListFoundationModels calls, and the fleet minted 35 credentials with zero failures. lauterbourg-01-ts logged its first third-party traffic — two Google IPs walked the fake Kiteworks app (⚠ NEW KITEWORKS-CRAWL) — while the №41 record LeakIX wave contracted to 17 IPs.

Key Judgements

1. WP-FORM-BRUTE iterates its tooling between windows. The roster doubled while the enumeration stage vanished, and a Chrome/152-class generation submitted vhost-derived passwords. (High confidence — the roster count and the zero enum rows are measured, and the bodies are captured verbatim.)
2. The MEGA-DICTIONARY artifact is under active maintenance and now carries two new dropper families. The anti-join against the same host's own 09-24 set shows +209 paths; against the №41 pooled mark, +39 (13,359 → 13,398). /bins/aurora.* and /bin/manta.* (13 architectures) are new. (High confidence — same-host diff, no cross-host guesswork.)
3. The credential-use economy is standing behavior and stays identity-only. Eight consecutive windows with observed AWS use; successes remain confined to sts:GetCallerIdentity; the deny-all policy held through both denied calls this window. (High confidence — Tracebit alerts across eight windows of continuity.)
4. The Kiteworks decoy graduated from dark to collected within ten days of first footprint. Two Google IPs walked the app shell, /login, and 23 asset bundles in ~1-minute passes. (Moderate confidence — one window, two IPs, no credential paths yet; the only prior traffic was the 09-25 operator validation fetch.)

Active Campaigns (day 40 status)

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — FIFTH WINDOW, ENUMERATION DROPPED, VHOST-DERIVED PASSWORDS (Hostile, active)

• Actors: 46 runner IPs produced wp-login probe, credential, or xmlrpc events (vs ~25 in №41). The df15 credential class ran 370 POSTs from 6 IPs on canary-farm-1, netcup-ts, and sponge-01-ts — 169.58.163.25 (35 POSTs), 178.128.122.173 (34), 167.71.201.22 (33), 119.47.88.254 (30), 51.91.8.17 (29), 160.191.89.83 (25), 173.212.198.43 (16) — all under one forged Chrome/126.0.0.0 macOS UA. The ed66cc967251 wp-login+xmlrpc leg ran 21 IPs / 84 events on ai-devbox-1 and canary-farm-1. NEW journey signature 2bdde2df2cf6 (probe → credentials → xmlrpc): 4 IPs on ai-devbox-1, first seen today.
• TTPs: the df15 bodies keep the registered shape — _wpnonce=0089d13211&log=admin&pwd=89&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In (passwords in this set: 89, password, wpadmin123, Welcome123!, P%40ssw0rd123, 1591, 1091234%40). NEW: a one-POST generation under Chrome/152-class UAs submits vhost-derived passwords verbatim:
  • log=admin&pwd=inference&wp-submit=Log+In&redirect_to=https%3A%2F%2Finference.fapthropic.com%2Fwp-admin%2F&testcookie=1 (189.15.123.15, 91.244.17.124)
  • log=admin&pwd=sso&wp-submit=Log+In&redirect_to=https%3A%2F%2Fsso.rightabouteverything.show%2Fwp-admin%2F&testcookie=1 (162.213.171.214, 201.214.157.221)
  • log=admin&pwd=amen123&... ran against both vhosts; Admin%40123 ran against the sso host. XMLRPC legs wrap system.multicall. Every login lands on the fake WordPress, so no credential success is possible by design.
• Assessment: the operators revised the tool rather than swapping actors: registered runners 178.128.122.173 and 119.47.88.254 persist across the change, and the new generation kept the probe-then-POST rhythm. The passwords name our decoy hosts: the runners resolve fleet identity per node before they guess. Pair counts stay far below the WP-LOGIN-BRUTE 200-pair alarm.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — SAME-HOST RETURN, +39 PATHS (Hostile, active)

• Actors: 185.213.155.227 (31173 Services AB, DE) — the №30 replay host — on frantech-ts 03:32–04:33 UTC: 13,398 events / 13,398 distinct paths over ~1 hour, a slow pass against the ~2-minute bursts of prior hosts. 0 POSTs, 0 mints. Prior hosts: 138.199.6.234, 138.199.60.29/.16 (Datacamp), tzulo 23.234.117.146/.118.146, 31173 193.32.126.191/.131, Zenlayer 98.98.47.133.
• TTPs: the anti-join against this host's own 09-24 set shows +209 paths; against the №41 pooled mark, +39 (13,359 → 13,398) — the fourth straight growth event (+6, +27, +34, +39). New families this window: /bins/aurora.* (Aurora botnet, 11+ architectures), /bin/manta.* (13 architectures), /release/DS.*, /302/302{m,w,l}, /Pemex.sh, /backdoor.sh, and random-token paths (/Cetoyoj, /Wuvulule).
• Assessment: a maintained, shared artifact that passes between at least seven operator hosts. The payload set pivots further from mirai-class droppers toward Aurora and manta stages, after №41's first miner entries. All 13,398 requests landed on a deception surface at zero intel cost.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — CONTRACTED AFTER THE RECORD WAVE (Borderline)

• Actors: 17 l9scan/l9explore IPs / 1,219 events (vs 31 IPs / 1,471 in №41), minting 12 credentials at 1/IP across control-1, ai-devbox-1, canary-farm-1, ru-edge-1, and lauterbourg-01-ts (00:03–05:39 UTC); zero burst rejections. The DigitalOcean pool dominates. 165.227.173.41 hit two sensors (aidev + lauterbourg), 209.97.180.8 three (aidev, netcup, ru-edge), 46.101.111.185 repeated from №41.
• TTPs: the registered 27-family journey (WebLogic → Confluence → WHM/cPanel → docker-registry → /graphql) is intact — twelve 27-family journeys sit on the kill-chain watchlist. Sibling shape: 45.138.12.51 (Tc Datacenter LT) minted 2 under l9explore/1.2.2 — LeakIX's exploit-grade client — with a 20-family .env/CI census (176 events on aidev, 88 on sponge; 4/6d mints).
• Assessment: a down day inside a standing collection program, not a departure: template, pacing (1 mint per IP), and sensor spread all held. LEAKIX-SSH (fd65145f…) was absent in Arkime.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — EIGHTH USE WINDOW (Hostile, active)

• Actors (use side): Feo Prest .175 used 1 credential from 4 AWS-side IPs (mint side: control-1). No use IP appears in flux logs — the split persists.
• TTPs: 4 use events on 1 credential — 2 sts:GetCallerIdentity successes, 2 denied ListFoundationModels. Hoards: .154 72/6d, .175 104/6d, .171 20/6d. The SES pair stayed out a fourth window.
• Assessment: the eighth consecutive use window keeps the pattern — identity discovery first, capability calls denied. The deny-all policy is the control that holds this line.

CREDSWEEP family (.env census and collectors) ⟳ — .171 TENTH WINDOW, NEW /24 CLUSTER (Hostile, active)

• Actors: 45.148.10.171 — tenth consecutive minting window, 6 mints across 4 sensors (20/6d), zero rejections. NEW: 45.154.138.x /24 on control-1 — .72 and .51 each ran a 20-path webapp-config-bundle-js census under Chrome/106 and minted 1 each; .88 minted 1 under Chrome/39; six more IPs (.57, .60, .67, .73, .78, .87) touched once each under python-requests/2.34.2. This /24 owns the control webapp-config-bundle-js 4.1× spike (43 of 46 events). Feo .154 minted 2 on control under a Safari/522.11.3 forgery and ran a 293-path census on both no-canary nodes (netcup 15:09 UTC 10-04, sponge 07:04 UTC 10-05 — byte-shared wordlist). SS-Net collector 80.94.92.65 minted 7 across 3 sensors (17/6d); primary .211 was absent — its first miss in five windows.
• TTPs: antique and rotating UA forgery carries. The 45.154.138.x shape — per-IP single mints, census legs, python-requests touches — matches №41's 185.255.126.x one-touch family, which did not return.
• Assessment: collector recruitment continues. The new /24 earns a watch line and promotes on a second mint window.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⚠ NEW

• Actors: 34.52.229.253 and 35.205.254.119 (Google LLC, BE), lauterbourg-01-ts, ~1-minute passes (144 and 119 events).
• TTPs: kiteworks-root-redirect → /login (kiteworks-shell 200) → 23 kiteworks-asset JS bundle fetches → webshell-sweep-observed ×2, webshell-probe, and a not-handled census. UAs: a bare stripped Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (no platform token — the ZKILLU-GITWALK class) and full Chrome/128.0.0.0. 0 mints.
• Assessment: the first third-party collection against the Kiteworks profile since the node stood up. The fleet's TLS decoys now draw real recon on two of three profiles. Promote on credential paths or a second node.

GIT-VAULT (git-internals walk) ⟳ — THIRD CONSECUTIVE WINDOW, NEW IP (Hostile, active)

• Actors: 216.26.239.111 (3xK Tech GmbH, cc BR) on canary-farm-1 at 18:48 UTC 10-04 — the third IP in the set after 104.207.39.149 and 65.111.3.141 (№40–№41).
• TTPs: the identical 144-event / 142-path walk (HEAD, index, ORIG_HEAD, packed-refs, COMMIT_EDITMSG, FETCH_HEAD, the full hooks/*.sample set). 0 mints, 0 POSTs.
• Assessment: a fixed daily schedule with IP rotation — standing recon. Promote on a secrets-path extension or a mint.

BUCKLOG-KIT (Bucklog SARL /24) ⟳ — THIRD CENSUS WINDOW (Hostile, active)

• Actors: 185.177.72.75 — netcup-ts 460 events / 247 paths (06:24–06:28 UTC) and frantech-ts 115 events / 59 paths (04:44–04:49 UTC). The №41 control run did not repeat.
• TTPs: .env-variant and config census; 12 webshell-probe results on netcup (part of that node's 3.6× spike). 0 mints, 0 captured POSTs.
• Assessment: the block runs census-class collection on a fresh node each window. Any phpunit or RCE POST promotes this to full kit.

TOKEN-CRAWLER (45.198.224.x /24) ⟳ — FULL TEMPLATE RETURN (Hostile, active)

• Actors: the /24; .124 and .125 ran bare tarpit-module passes across 7-8 nodes (80 and 64 events).
• TTPs: 9 fresh /c/<100-char random token> paths on frantech-ts (all first-seen this window) + .env directory variants on netcup-ts (/queue/.env, /tokens/.env, /mail/.env). 0 mints.
• Assessment: the full №28/№30 template is back after five quiet windows. Correlation stays on the /24, never on paths. Promote on a mint or POST run.

Watch-class singles (no campaign yet)

• 79.124.58.82 (Tamatiya EOOD, BG): netcup-ts, 300 events / 150 paths under forged Googlebot/2.1 — owns the netcup webshell-probe spike (12 of 27) with webshell-sweep-observed and dockerenv-marker results. Promote on a repeat.
• 195.178.110.28 (Techoff Srv, BG — ipsum:2/firehol2): frantech-ts, 131 events / 131 paths + 1 POST. The same /24's .217/.218 ran the SSH-side uname inventory (221 events each) and nvidia-smi/lspci GPU enumeration (157 events ×2 IPs) on the frantech honeypot — GPU survey precedes crypto-miner drops.
• 193.32.204.199 (registry watch): git-config walker, 148 events across 3 nodes.
• 85.215.106.36 (Azure, python-httpx/0.28.1): 27 tarpit events on one node.
• 94.154.43.100 (OMEGA pool range, bare Mozilla/5.0): / passes on 7 nodes, 77 events, 0 mints — a new light-touch shape from the pool range.

Absent or paused

OMEGA-SWEEP (second consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again under forged Chrome/147), CF-FRONTED CREDSWEEP (fifth window), METADATA-HUNT (eleventh marker-light window), XMLRPC-BRUTE standalone (silent — today's xmlrpc events are WP-FORM-BRUTE's ed66 leg), CONFIG-SWEEP, SS-PROBE, NIGHTAGENT (dormant), ORACLE-SWEEP, SONICWALL-VPN-PROBE, ZKILLU-GITWALK, CRUSADER-SWEEP, CURL-SWEEP, GCP-ACONF, ALIYUN-PROBE, ENV-CENSUS-3/4, 185.255.126.x (no second window). MALWARE-DICT: 204.76.203.18 ran its 29th control-1 loop — 2,173 events / 570 paths, control-only.

Standing actors (persistence check)

• 45.148.10.171 — tenth consecutive minting window, volume steady (6 mints), zero use.
• Feo Prest .175 — minted and used in the same window again; .154 returned after a one-window gap with a two-node census and 2 control mints.
• 80.94.92.65 — standing collector, 7 mints this window (17/6d); primary .211 broke a five-window streak.
• GIT-VAULT 3xK set — third consecutive day, third IP.
• BUCKLOG .75 — third consecutive census day, node rotates.
• 185.73.23.162 (Ruhr-Universität Bochum, Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de) and +https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de) — benign academic reverse-proxy measurement crawler, in the logs since 09-16. It rides the tarpit loop (1,469 events across netcup + sponge) and shares the netcup not-handled 4.9× spike. Benign by honest UA and /-plus-/en* journeys.
• 204.76.203.18 (Pfcloud) — 29th MALWARE-DICT loop.
• 89.248.172.33 (uptime-prober trio) — 225 events across 5 nodes, aiohttp, benign-shape.

Network-layer recon (Arkime) — 2026-10-04 07:33:00 → 2026-10-05 07:34:10 UTC

Fingerprint field ssh.hassh, destination port 22 · 132,240 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 81,015, sensor:lauterbourg-01-ts 27,947, frantech-ts 26,112, sensor:frantech-ts 26,112, bahrain-sponge-01-ts 18,641, sensor:bahrain-sponge-01-ts 18,641

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,980 sessions from 362 source IPs across 175 networks in 59 countries, port 22, avg 4,914 B/session. Networks: AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom. Busiest sources: 94.61.235.86, 2.180.32.104, 167.233.84.182, 80.102.218.187, 121.242.232.147. Last 7 days: 09-29 355 IPs, 09-30 365 IPs, 10-01 350 IPs, 10-02 332 IPs, 10-03 346 IPs, 10-04 343 IPs, 10-05 145 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 25,153 sessions from 101 source IPs across 41 networks in 25 countries, port 22, avg 5,101 B/session. Networks: AS209854 Cyberzone S.A., AS213790 Limited Network LTD, AS205089 Alfahost LLC, AS48090 Techoff Srv Limited, AS14061 DigitalOcean, LLC. Busiest sources: 192.253.248.216, 77.239.124.156, 109.160.32.36, 109.160.32.160, 109.160.32.49. Last 7 days: 09-29 57 IPs, 09-30 65 IPs, 10-01 84 IPs, 10-02 64 IPs, 10-03 68 IPs, 10-04 106 IPs, 10-05 38 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365c…) crossed the dispersed threshold for the third time in four windows: 101 source IPs / 41 networks / 25,153 sessions (+14 IPs day-over-day), with the 109.160.32.x block busiest again and Techoff AS48090 newly in its network set. LIBSSH-MASSSWEEP (f555226d…) held its 16-day plateau (362 IPs, band ~330-370). 16443846184e… reached 17,232 sessions from 41 IPs in its eighth cycle without banner characterization. LEAKIX-SSH (fd65145f…) was absent.

Canary credentials

Summary

1 Tracebit alert(s) fired in the window (4 use events across 1 credentials). Fleet sensors minted 35 credentials to 24 collector IPs; 1 credential(s) reached AWS. Use outcomes: 2 success, 2 failure. Denied operations: ListFoundationModels×2. 2 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.154: 72 mints, 2026-09-30 00:02 → 2026-10-04 18:15
• 45.148.10.171: 20 mints, 2026-09-29 09:35 → 2026-10-04 11:00
• 94.154.46.245: 18 mints, 2026-09-28 10:16 → 2026-09-29 15:04
• 80.94.92.65: 17 mints, 2026-09-30 16:17 → 2026-10-05 04:50
• 94.154.46.246: 12 mints, 2026-09-28 05:48 → 2026-09-28 05:49
• 94.154.46.249: 12 mints, 2026-10-01 01:07 → 2026-10-01 01:07
• 94.154.46.250: 11 mints, 2026-10-02 02:03 → 2026-10-02 05:48
• 102.220.161.139: 8 mints, 2026-09-28 16:53 → 2026-10-01 21:00
• 109.205.176.10: 7 mints, 2026-09-28 05:36 → 2026-10-04 19:28
• 155.117.232.31: 6 mints, 2026-09-28 17:19 → 2026-10-02 22:03
• 102.220.161.102: 4 mints, 2026-09-29 08:40 → 2026-09-29 23:06
• 102.220.161.87: 4 mints, 2026-09-30 16:51 → 2026-10-02 14:51
• 103.75.11.189: 4 mints, 2026-09-28 05:28 → 2026-09-28 10:35
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 165.22.34.189: 4 mints, 2026-09-28 20:32 → 2026-10-02 20:16
• 45.138.12.51: 4 mints, 2026-10-02 10:20 → 2026-10-04 06:58
• 91.92.41.8: 4 mints, 2026-09-28 21:58 → 2026-10-04 02:31
• 157.245.204.205: 3 mints, 2026-09-28 20:11 → 2026-10-04 20:34
• 159.89.174.87: 3 mints, 2026-09-30 18:19 → 2026-10-04 20:34
• 161.35.96.60: 3 mints, 2026-09-28 21:36 → 2026-10-01 19:14
• 167.99.181.249: 3 mints, 2026-10-02 21:35 → 2026-10-04 20:34
• 206.189.19.19: 3 mints, 2026-10-02 21:35 → 2026-10-03 20:42
• 206.209.210.3: 3 mints, 2026-10-01 21:40 → 2026-10-02 05:10
• 209.97.180.8: 3 mints, 2026-09-30 21:01 → 2026-10-04 20:34
• 217.60.76.167: 3 mints, 2026-09-28 13:15 → 2026-10-02 22:14
• 41.140.8.33: 3 mints, 2026-10-02 22:14 → 2026-10-02 22:15
• 46.101.111.185: 3 mints, 2026-10-03 20:38 → 2026-10-05 01:39
• 64.227.32.66: 3 mints, 2026-09-29 20:04 → 2026-09-30 17:55

Fleet Observations

Pipeline. ai-devbox-1 covered the full window again; its −66% cell still rides a 7-day average that carries pre-rotation days. The gap stays open — env-canary.jsonl.1 (268 MB) remains outside the digest glob, and all-time counters sit at their post-rotation baseline (1,581 mints all-time per the visuals run). Fourth cycle with this gap open. The fix belongs in the ops repo: ingest rotated files, or rotate behind the sync boundary.

Canary economics. Digest mint rows: ai-devbox-1 16 (11 IPs), control-1 12 (9), canary-farm-1 11 (9), ru-edge-1 4 (4) — 43 rows. Tracebit dedupe: 35 credentials to 24 collectors. Mint failures: zero — no 400/401 rows; the l9scan wave ran at 1/IP pacing and no census burst hit /.env at burst speed. Every mint carries ["aws"].

Attribution and TLS posture. XFF counters: any 684 / multi-entry 0 / ignored-internal 7 / single-entry mismatch 0. No hostile forgery signal. Host census: bare-IP-led on six of eight nodes; decoy vhosts carried sso.rightabouteverything.show 378 and inference.fapthropic.com 276 — the hosts the WP-FORM vhost-derived runners resolve before they guess.

Volume moves and causes. frantech-ts +59% (14,096) — MEGA-DICTIONARY (13,398). netcup-ts +124% (2,480) — Bochum crawler 765 + Bucklog 460 + 79.124.58.82 300 + Feo .154 296. sponge-01-ts +59% (1,994) — Bochum 704 + Feo .154 296 + WP-FORM legs. The other five nodes fell hard — canary-farm-1 −81% (955), ru-edge-1 −86% (471), ai-devbox-1 −66% (980), control-1 −44% (2,928), lauterbourg-01-ts −60% (888) — because the №41 record l9scan wave, the CF-fronted census, and ZKILLU-class mass all stayed home; the remaining traffic is the standing collector set.

control-1 discovery velocity. Day 22: 2,928 events from 133 unique IPs — back inside the 84–157 band after №41's 157-IP exit.

Result-tag spike attribution. All three ≥3× spikes trace to named actors: control webapp-config-bundle-js 4.1× = 45.154.138.x (43 of 46 events); netcup not-handled 4.9× = the Bochum crawler + 79.124.58.82 + Feo .154; netcup webshell-probe 3.6× = 79.124.58.82 (12) + Bucklog .75 (12) + Feo .154 (3).

Fleet-side changes this cycle. CHAINS in flux-visuals.py gained KITEWORKS-CRAWL and updates for WP-FORM-BRUTE, MEGA-DICT, REGISTRY-HUNT, CREDSWEEP, CREDENTIAL-DRAIN, TOKEN-CRAWLER, BUCKLOG-KIT, GIT-VAULT, SS-NET TOOLING, and OMEGA-SWEEP; TALKER_CAMPAIGNS gained 34 entries. The visuals dashboard ran once — /data/flux-logs/reports/flux-fleet-visuals-2026-10-05.html. The campaign registry carries this cycle's new rows and status changes.

New digest quirk (№42). The first-seen section of flux-digest-2026-10-05.md carries six NUL bytes inside path rows (the netcup .env-variant lines), so the file is not valid UTF-8 until stripped. Digest content is otherwise unaffected; the fix belongs in the ops repo digest writer. Reported for the ops backlog.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 640 sources sent credentials → 512 got a shell (80%) → 286 ran a command (56% of shell-getters, 45% of sources). Event level: 44,949 credential attempts → 2,976 accepted logins → 4,119 commands (138% of accepted logins go on to run something — a second consecutive window above 100%).

Fifteenth fully static window. New commands: 0 of 54 distinct. New credential pairs: 0 of 32,743. Telnet commodity attempts rose again to 4,728 (from 3,925). The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 936 events from 195 IPs, and the key-replace companion ran 813 from 181. New emphasis this window: inventory stages from the Techoff /24 — 195.178.110.217 ran a two-variant uname survey (221 events each) and 195.178.110.218 plus one sibling ran nvidia-smi/lspci GPU enumeration (157 events each). Credential concentration: 345gs5662d34/345gs5662d34 drew 902 attempts and root/3245gs5662d34 drew 678.

Gaps / Next Collection

1. Restore ai-devbox-1 history (fourth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary. All-time counters stay wrong until then.
2. WP-FORM-BRUTE sixth window. Does the enumeration stage return, and does the vhost-derived password generation spread beyond one-POST runners? Diff the roster against 46 IPs.
3. MEGA-DICTIONARY anti-join. Diff the next replay against 13,398. A fifth point turns the +6/+27/+34/+39 series into a rate. Watch 185.213.155.227's cadence — two replays ten days apart.
4. KITEWORKS-CRAWL second window. A repeat on any node promotes the campaign; watch for credential paths against the Kiteworks profile.
5. 45.154.138.x /24. A second mint window promotes the cluster; diff its census against 185.255.126.x's (both control-led, both config-bundle-led).
6. l9explore spread. Count l9explore/1.2.2 occurrences fleet-wide next window and check for AWS use of 45.138.12.51's 4/6d hoard.
7. Digest NUL-byte quirk. Locate the digest step that emits NULs from raw log paths; the fix belongs in the ops repo.
8. Network layer. GO-SSH-SWEEP crossed the dispersed threshold a third time (101 IPs, +14 day-over-day) — watch for further growth. 16443846184e… (17,232 sessions) still lacks banner characterization, cycle eight. LEAKIX-SSH absent — watch for a return.

Digest: /data/flux-logs/reports/flux-digest-2026-10-05.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-05.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-05.html

Watch next cycle: (1) WP-FORM-BRUTE — does the enumeration stage return, and does the vhost-derived password generation spread? (2) MEGA-DICTIONARY anti-join vs 13,398 — the +6/+27/+34/+39 series wants a fifth point. (3) KITEWORKS-CRAWL and the 45.154.138.x /24 — second windows for both.