FLUX FLEET — INTEL BRIEFING №44

Period: 2026-10-06 07:32 – 2026-10-07 07:33 UTC (24h, day 42 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 42-day baseline, every ≥3× result-tag spike attributed to a named actor)

BLUF

The mint-to-use funnel changed shape: for the first time, the operators who minted canaries used them from the same IPs. Two LeakIX/REGISTRY-HUNT DigitalOcean runners (157.230.19.140, 167.99.181.249) validated their own credentials in AWS minutes after the 20:01 EDT mint wave, and Bucklog SARL 185.177.72.205 probed SES (34 denied GetSMSAttributes + 34 denied GetSendQuota), the SES operation's first appearance since №38. The 102.220.161.x block (VPS Dedicated SI) ran the largest collection operation of the window: 102.220.161.102 minted a fleet-record 27 canaries on ru-edge in 17 minutes behind a spoofed Host: 127.0.0.1 header, while sibling .87 censused netcup and ai-devbox-1. MEGA-DICTIONARY replayed under a new host class (176.119.150.252, Owl Limited DE) and grew +31 paths to 13,445 — the sixth consecutive growth event. Volume moved to the deception nodes: netcup-ts +191%, sponge-01-ts +96% (the benign Bochum research crawler plus a wider Bucklog census), ru-edge-1 +55% (the two SI/Sino census operators); canary-farm-1 fell 64% and control-1 56% against averages inflated by the record №41–№43 waves. Mint failures stayed at zero for a third window (70 credentials to 26 collectors).

Key Judgements

1. Canaries now attract same-session use by named HTTP campaigners, not just off-fleet egress. The two l9scan runners minted at 20:01 EDT and called sts:GetCallerIdentity (success) plus ListBuckets (denied) as themselves; every prior use window separated the mint IP from the use IP. (High confidence — Tracebit binds each use event to a credential whose mint row carries the same clientIp.)
2. 102.220.161.x is a standing multi-node collection operation and the fleet's most productive active collector. In one window the block ran a 2,797-event, 55-family census with 27 mints on ru-edge (a single-IP record, one above 136.117.52.210's 26 in №20), a 722-event census on netcup, and a 599-event census plus 2 mints on ai-devbox-1 — its second consecutive window after №43's git walk. (High confidence — mint rows, journeys, and the spoofed-Host attribution are all measured.)
3. MEGA-DICTIONARY remains a maintained, shared artifact, and its growth rate is rising. The anti-join against №43's 13,414 paths shows +31 new and 0 dropped under a new host from an ASN class (Owl Limited DE) that had not carried it before; the growth series now reads +6/+27/+34/+39/+17/+31. (High confidence — full path-set anti-join on 26,859 events.)
4. The credential stage is consolidating across kits. NIGHTAGENT's second operator ran the full form-login → wp-batch SQLi → adminer chain without the phpunit or dropper stages, with a fresh 22-character adminer password per pass — the INFOCREST credential shape — and CONFIG-SWEEP's operator re-minted for the first time since №33. (Moderate confidence — bodies captured verbatim, but two windows per operator is a thin base for a trend.)

Active Campaigns (day 42 status)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — TENTH USE WINDOW, SPLIT COLLAPSED (Hostile, active)

• Actors (use side): 185.177.72.205 (Bucklog SARL FR) — 2 credentials, GetCallerIdentity success + denied SES ops; 157.230.19.140 and 167.99.181.249 (DigitalOcean, REGISTRY-HUNT l9scan runners) — 1 credential each, GetCallerIdentity success + denied ListBuckets; 80.94.95.211 (SS-Net RO) — 1 credential, GetCallerIdentity success + denied ListFoundationModels ×2. No use IP is new to the fleet; all four minted in this window.
• TTPs: 78 use events across 5 credentials: 72 denied, 6 sts:GetCallerIdentity successes. Denied operations: GetSMSAttributes ×34, GetSendQuota ×34 (SES enumeration — absent since №38), ListFoundationModels ×2, ListBuckets ×2. The deny-all policy held; successes leak account identity at most.
• Assessment: the leak-to-cash loop now includes in-operator validation: LeakIX-class scanners check what they steal before resale. The SES pair's return, credited to a Bucklog IP, links a census campaign to mail-related credential demand. Hoards persist: 213.209.159.175 77/6d, .154 38/6d, 45.148.10.171 28/6d.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — FIRST ALL-8-SENSOR WAVE (Borderline, active)

• Actors: 18 l9scan IPs, 847 events, all 8 sensors, wave 19:56–20:38 EDT, all DigitalOcean. UA variants 2.0.6343, 2.0.930323, 2.0.234313, 2.0.632323. 12 IPs ran the registered 27-family journey onto the kill-chain watchlist; 14 mints at 1/IP (64.225.75.246 took 3 across ru-edge + ai-devbox-1).
• TTPs: tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enumeration (/v2/internal/...), then /.env mint at 1 per IP.
• Assessment: steady-state collection at unchanged scale (18 IPs in both №43 and №44). The development is downstream: two runners self-validated their mints in AWS (see CREDENTIAL-DRAIN).

SI-CENSUS (102.220.161.x, VPS Dedicated LLC SI) ⚠ NEW — PROMOTED ON SECOND WINDOW (Hostile, active)

• Actors: 102.220.161.102 — ru-edge-1 only, 2,797 events / 55 trap families / 1,503 paths, 10:39–11:47 EDT; 102.220.161.87 — netcup-ts (722 events / 350 paths, 23:02–23:20 EDT) + ai-devbox-1 (599 events / 564 paths, 11:58–12:09 EDT). Lineage: №43 ran .102's 144-path git walk on ai-devbox-1; the block's .139 collected in №35–№36.
• TTPs: .102 set Host: 127.0.0.1 on 2,793 of its 2,797 ru-edge requests — the origin-spoofing probe family first seen in №13 — and rotated a Chrome/126 forgery. Its census covers .env variants in 20+ directories (/dataset1/.env, /deploy/.env, /docker/php/.env, /dotfiles/.env…), wp-config variants, git internals, and minted 27 at /.env in three bursts (10:40, 10:47, 10:54–10:57 EDT). .87 fetched /.hgignore and a Zend-style config set (/config/database.config.php, /application/config/config.php, /config/ai.json) under 5 rotating UAs and minted 2 on ai-devbox-1.
• Assessment: a single block now runs census, git-walk, and mint-collection roles across four nodes, with deliberate header spoofing against reverse-proxy assumptions. Its 27 held credentials are hostile-held inventory until they expire — watch AWS.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — TENTH REPLAY, HOST ROTATED TO OWL LIMITED (Hostile, active)

• Actors: 176.119.150.252 (Owl Limited DE — new host class) on frantech-ts 01:24:07–01:25:37 EDT: 13,445 events / 13,445 distinct paths in 90 seconds, GET-only, 208 UA rotation, 0 POSTs, 0 mints. Host ledger: 31173 Services AB ×2, Datacamp ×3, tzulo ×2, Zenlayer ×2, Owl ×1.
• TTPs: anti-join against №43's 13,414-path set: +31 new / 0 dropped. New paths: /bots/{bot,dldr,mb,go_bot}.* families, /bins/morte.{arm,x86_64}, /bins/xnxnxnxn* ×6 architectures, /pack/agent/nodewatchd-linux-386, /nyx_bot_linux_amd64_exec, /Hilix.sh, /87sbhas6as.sh, /adb.arm7, /m.sh.
• Assessment: the sixth straight growth event (+6/+27/+34/+39/+17/+31) with a second host change in two days. The artifact keeps absorbing other actors' tooling names; the fleet's deception surface absorbs every replay at zero cost.

NIGHTAGENT (form login → wp-batch SQLi kit) ⟳ — .49 SECOND RUN, CREDENTIAL STAGES ONLY (Hostile, active)

• Actors: 185.213.193.49 (Zenlayer US) — five passes: canary-farm-1 07:37 + 11:02 + 17:58 EDT, ai-devbox-1 11:32 + 13:24 EDT; three passes minted (3 canaries, 6/6d). 105.159.4.244 absent.
• TTPs: POST /login/ with user=root&pass=wrong; wp-batch multiplex carrying the SQLi probe ...author_exclude=0%29+UNION+SELECT+...CONCAT%280x7c7c%2CHEX%28CAST%28%28SELECT+0x4f4b%29AS+CHAR%29%29%2C0x7c7c%29... (the ||OK|| oracle); /.env mint; config-bundle census; phpMyAdmin path set (20 of canary-farm-1's 21 phpmyadmin-login events — the 6.0× spike); then three adminer-credential-post bodies per pass with auth[username]=prod_rw and a fresh 22-character password each pass (8LB9tLMFj2cQ2llBuH7vPA, Y6kVIvepMM16CeMI-5YwoQ, 1ocYDyySV4cQEz4RIXb7Kg).
• Assessment: the operator dropped the phpunit verify and the broken dropper POST entirely this window and ran a pure credential kit whose adminer anatomy matches INFOCREST-KIT. The fleet's staged kits continue to share stages; attribution rests on the journey, not one body.

CONFIG-SWEEP (87.120.104.29, Sino Worldwide NO) ⟳ — SECOND CONSECUTIVE WINDOW, FIRST MINTS SINCE №33 (Hostile, active)

• Actors: 87.120.104.29, first ru-edge appearance: 1,650 events / 140 trap families / 1,642 paths in one burst at 20:39 EDT under forged Googlebot/2.1.
• TTPs: wp-config variant census (~, .old, .orig, .bak), /.git/HEAD, .travis.yml, laravel/.env, 12 SSH private-key paths (/id_rsa, /.ssh/id_ed25519, /ssl/server.key, /private/server.key…) that drove ru-edge's new ssh-private-key-error tag (30 events, inf ratio), and 6 mints at /.env.
• Assessment: after №43's commodity webshell-probe run on netcup, the operator re-armed the original wide census and re-crossed the mint line on a third node. ru-edge now holds its credentials.

BUCKLOG-KIT (Bucklog SARL FR /24) ⟳ — THIRD CENSUS WINDOW, FIRST MINT, SES LINK (Hostile, active)

• Actors: 185.177.72.75 (netcup-ts, 1,096 events / 485 paths / 4 POSTs, 18:52–18:59 EDT — the largest Bucklog census on record), 185.177.72.9 (frantech-ts, 188 events), 185.177.72.205 (canary-farm-1, 188 events).
• TTPs: the census arm walks credential and webshell paths. New: .205 minted 1 at /.env under curl/8.7.1 at 20:22 EDT and used 2 credentials in AWS — GetCallerIdentity success plus the SES enumeration (see CREDENTIAL-DRAIN).
• Assessment: the block's original RCE kit stayed dormant since day 7, but its census arm now mints and consumes. The SES operation pair and a Bucklog mint in one window is the strongest link yet between a census campaign and a specific AWS service demand.

MEVSPACE-GITWALK (git-internals walk, env-named refs) ⟳ — THIRD-GENERATION OPERATOR (Hostile, watch)

• Actors: 2a01:4f9:c015:3f79::1 (Hetzner, new /16 — prior operators sat in 2a01:4f8::/32) on canary-farm-1: 144 events, 143 fake-git + 1 gitignore.
• TTPs: /.git/HEAD, ORIG_HEAD, packed-refs, FETCH_HEAD, info/refs, and the registered env-named families refs/wip/wtree/, refs/wip/index/, logs/refs/{heads,tags}/.
• Assessment: the template persists across three operator generations and three years of fleet rotations; the fleet's fake-git surface returns decoys throughout. The №43 3xK Tech trio stayed out a second window.

ENVRC-SWEEP (distributed env-path walker) ⟳ — SECOND WINDOW, WORDLIST GREW GARBAGE SUFFIXES (Hostile, active)

• Actors: the two registered signatures ran ru-edge-only this window (d045b89fe96b /.envrc 6 IPs, e4cbfe2556fa /var/.env 6 IPs, 42 events each). Two NEW quote-garbage variant signatures appeared: c7411f59a56f (/var/.env"], 10 IPs on control-1 + frantech-ts + netcup-ts) and a157d6c255ee (/.envrc"], 9 IPs adding ru-edge-1) — ~19 residential-class IPs at 9–17 events each, first seen 10-07.
• TTPs: single-path repeats into the tarpit under rotating forgeries; the "] suffixes mark a wordlist scraped from rendered HTML (the ZKILLU mechanism). 0 mints.
• Assessment: one tooling family, now with four signatures; the tarpit absorbs every walk. Promote the variants to a separate row if they acquire mints or non-tarpit results.

SS-PROBE (self-marking __ss_probe walker) ⟳ — SAME OPERATOR, ON SCHEDULE (Hostile, active)

• Actors: 105.112.26.83 (second consecutive window): 4 mints in 1 hour (ai-devbox-1 ×3 + canary-farm-1, 03:50–04:50 EDT), marker /__ss_probe_6044ce427532cb1225692c4f1807383d__, python-requests/2.31.0.
• TTPs/Assessment: unchanged registered template — marker guarantees first-seen, single /.env mint per node, immediate exit. The 24-hour repeat cadence makes this a standing collector.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — CONTRACTED (Hostile, active)

• Actors: 80 credential POSTs from 13 IPs + 9 xmlrpc POSTs from 6 IPs; the ed66cc967251 wp-login+xmlrpc leg is the only cluster-table signature (6 IPs / 24 events, aidev + farm). №42's one-POST vhost generation stayed out.
• TTPs/Assessment: probe → credential POST against the fake WordPress. Roster shrank 42 → 13 runner IPs and the wp-json enumeration stage stayed out a third window; the 200-pair alarm stays armed, pair counts well below it.

SS-NET TOOLING (80.94.x standing collector) ⟳ — ACTIVE

• Actors: 80.94.95.211 minted 2 on ai-devbox-1 (Chrome/5.0.358 forgery, 18:25 EDT) and used 1 credential (4 ops); 80.94.92.65 minted 1 on control-1 (Chrome/75 Android forgery).
• TTPs/Assessment: the .211 mint→use loop continues for a second window; the deny-all policy held against ListFoundationModels.

Watch-class singles (no campaign yet)

• 185.196.220.132 (ColocaTel NL, ipsum:1): lauterbourg-01-ts, 715 events / 282 paths / 2 POSTs, 20:50–02:48 EDT — a curl/8.6.0 env census (/.environment, /.env.aws, /.env.vonage, /craft/.env, /hubspot/.env…), all tarpit-absorbed. Owns 530 of lauterbourg's 796 tarpit-module spike events (6.5×).
• 45.156.87.44: new honest-labeled UA Mozilla/5.0 (compatible; opendir-scanner/1.0), 6 tarpit-absorbed probes on 3 nodes including random path /glixnjj4y0; the 45.156.x basin produced WP-ENUM's generations. Censys logged the same path once.
• 159.26.101.78 (Proton-adjacent range): 1 mint on canary-farm-1 (Chrome/81 forgery, 21:47 EDT) + 1 phpmyadmin-login probe — the range produced the fleet's most consequential actor (159.26.110.179, №14).
• First-time single-mint collectors: 8.136.198.137 (Chrome/120), 209.99.189.217 (Chrome/124), 45.128.233.118 (UCBrowser Android forgery).
• 140.245.97.208 (Oracle): 3 mints/6d, latest on canary-farm-1 06:30 EDT (Chrome/39) — the ORACLE-SWEEP un-merge trigger watches this block for a standalone census run; none yet.

Absent or paused

METADATA-HUNT (tenth consecutive marker-absent window, 0 __aws_leak_probe/@fs events), OMEGA-SWEEP (fourth miss; pool single 94.154.43.31 ran 8-node light passes, 8 events), GIT-VAULT (3xK trio out a second window), CF-FRONTED CREDSWEEP (seventh window), KITEWORKS-CRAWL (first absence — no kiteworks-shell passes; vhost volume 1,106 under generic censuses only), LLM-ENDPOINT-PROBE (no second window — 104.168.115.214 absent, 0 endpoint events), SONICWALL-VPN-PROBE, ZKILLU-GITWALK, CRUSADER-SWEEP, XMLRPC-BRUTE standalone (today's 9 xmlrpc posts are WP-FORM-BRUTE's ed66 leg), LEAKIX-SSH at the network layer (third absence). MALWARE-DICT: 204.76.203.18 ran its 31st loop (1,372 events / 570 paths) and /24 siblings .237 and .219 ran 8-node Edg/90 light touches (64/32 events).

Standing actors (persistence check)

• 45.148.10.171 — twelfth consecutive minting window: 7 mints across farm/aidev×2/control (28/6d), antique forged-UA rotation now including Mozilla/2.0 (compatible; Ask Jeeves/Teoma).
• REGISTRY-HUNT — nightly wave, now covering every sensor; volume flat at 18 IPs.
• 102.220.161.x / 45.148.10.171 / SS-Net pair / Feo Prest hoarders — the collector set that carries the mint→use pipeline; all present or holding hoards.
• 45.198.224.x — .124/.125 ran their bare 8-node tarpit passes (90/72 events); the /24 has appeared every window this week.
• 204.76.203.x — 31st dictionary loop; six-host sibling count unchanged.
• 185.73.23.162/.161 (Ruhr-Universität Bochum, Software Security Research/1.0) — benign academic crawler, second window, volume tripled to 2,798 + 787 events on netcup + sponge (drove sponge's +96%).
• 3e1c5eb879e7 /-handshake pool (85 IPs, fleet-wide) and 7e61a9500d8b php-cgi RCE probe cluster (11 IPs, 539 events) — standing background clusters.

Network-layer recon (Arkime) — 2026-10-06 07:32:00 → 2026-10-07 07:33:07 UTC

Fingerprint field ssh.hassh, destination port 22 · 106,397 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 68,928, bahrain-sponge-01-ts 26,874, sensor:bahrain-sponge-01-ts 26,874, frantech-ts 16,276, sensor:frantech-ts 16,276, sensor:lauterbourg-01-ts 15,965

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,602 sessions from 312 source IPs across 158 networks in 57 countries, port 22, avg 4,949 B/session. Networks: AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom. Busiest sources: 123.31.29.131, 107.150.105.10, 172.171.233.230, 122.15.129.26, 187.212.59.26. Last 7 days: 10-01 350 IPs, 10-02 332 IPs, 10-03 346 IPs, 10-04 343 IPs, 10-05 360 IPs, 10-06 297 IPs, 10-07 128 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 34,749 sessions from 108 source IPs across 36 networks in 23 countries, port 22, avg 5,049 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS208137 Feo Prest SRL. Busiest sources: 192.253.248.216, 109.160.32.115, 109.160.32.42, 109.160.32.38, 77.239.124.143. Last 7 days: 10-01 84 IPs, 10-02 64 IPs, 10-03 68 IPs, 10-04 106 IPs, 10-05 112 IPs, 10-06 98 IPs, 10-07 50 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365c…) held near its record — 34,749 sessions (−799), 108 source IPs (−10) — with AS208137 Feo Prest still in its network set; this window's busiest sources rotated to 109.160.32.x and 192.253.248.216, and the 77.239.124.x post-shell uname survey did not run on frantech's honeypot (the sweep worked without the shell stage this cycle). LIBSSH-MASSSWEEP (f555226d…) held its plateau on day 18: 312 IPs, −26 day-over-day. 16443846184e… ran its tenth uncharacterised cycle (16,177 sessions, +1,217). 084386fa7ae5… contracted to 60 IPs (from 72). New fingerprint e54ef3ec27fe1fea7ab64d3fa05359fd stayed below thresholds (27 sessions / 19 IPs) — watch it. LEAKIX-SSH absent a third window. No new registrations; recon-names.tsv unchanged.

Canary credentials

Summary

5 Tracebit alert(s) fired in the window (78 use events across 5 credentials). Fleet sensors minted 70 credentials to 26 collector IPs; 5 credential(s) reached AWS. Use outcomes: 72 failure, 6 success. Denied operations: GetSMSAttributes×34, GetSendQuota×34, ListFoundationModels×2, ListBuckets×2. 6 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 77 mints, 2026-10-01 10:00 → 2026-10-04 07:45
• 213.209.159.154: 38 mints, 2026-10-01 06:57 → 2026-10-04 18:15
• 45.148.10.171: 28 mints, 2026-09-30 14:33 → 2026-10-07 03:52
• 102.220.161.102: 27 mints, 2026-10-06 10:40 → 2026-10-06 10:57
• 80.94.92.65: 20 mints, 2026-09-30 16:17 → 2026-10-06 07:01
• 94.154.46.249: 12 mints, 2026-10-01 01:07 → 2026-10-01 01:07
• 94.154.46.250: 11 mints, 2026-10-02 02:03 → 2026-10-02 05:48
• 109.205.176.10: 7 mints, 2026-09-30 07:44 → 2026-10-07 01:33
• 102.220.161.87: 6 mints, 2026-09-30 16:51 → 2026-10-06 12:09
• 185.213.193.49: 6 mints, 2026-10-06 00:22 → 2026-10-06 13:26
• 87.120.104.29: 6 mints, 2026-10-06 20:39 → 2026-10-06 20:39
• 64.225.75.246: 5 mints, 2026-10-02 21:21 → 2026-10-06 20:37
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 105.112.26.83: 4 mints, 2026-10-06 03:50 → 2026-10-06 04:50
• 155.117.232.31: 4 mints, 2026-09-30 17:11 → 2026-10-02 22:03
• 159.89.12.166: 4 mints, 2026-09-30 18:19 → 2026-10-06 20:37
• 45.138.12.51: 4 mints, 2026-10-02 10:20 → 2026-10-04 06:58
• 128.199.182.152: 3 mints, 2026-10-03 06:14 → 2026-10-06 20:26
• 139.59.143.102: 3 mints, 2026-09-30 11:34 → 2026-10-06 20:05
• 140.245.97.208: 3 mints, 2026-10-03 09:14 → 2026-10-07 06:30
• 157.245.113.227: 3 mints, 2026-09-30 17:55 → 2026-10-05 20:27
• 159.89.174.87: 3 mints, 2026-09-30 18:19 → 2026-10-04 20:34
• 165.22.34.189: 3 mints, 2026-09-30 11:36 → 2026-10-02 20:16
• 165.227.84.14: 3 mints, 2026-10-02 20:15 → 2026-10-06 20:37
• 172.93.215.8: 3 mints, 2026-10-03 13:07 → 2026-10-05 14:17
• 20.221.59.215: 3 mints, 2026-10-03 21:56 → 2026-10-05 08:49
• 206.189.19.19: 3 mints, 2026-10-02 21:35 → 2026-10-03 20:42
• 206.209.210.3: 3 mints, 2026-10-01 21:40 → 2026-10-02 05:10
• 206.81.24.227: 3 mints, 2026-09-30 20:57 → 2026-10-05 20:43
• 209.97.180.8: 3 mints, 2026-09-30 21:01 → 2026-10-04 20:34
• 41.140.8.33: 3 mints, 2026-10-02 22:14 → 2026-10-02 22:15
• 45.153.34.249: 3 mints, 2026-10-06 00:12 → 2026-10-06 17:40
• 46.101.111.185: 3 mints, 2026-10-03 20:38 → 2026-10-05 01:39
• 68.183.9.16: 3 mints, 2026-10-02 20:42 → 2026-10-06 20:00
• 91.92.41.8: 3 mints, 2026-10-04 02:30 → 2026-10-04 02:31
• 93.113.206.248: 3 mints, 2026-10-05 20:30 → 2026-10-05 20:37

Fleet Observations

Canary economics. Digest mint rows: ru-edge-1 37 (6 IPs), ai-devbox-1 16 (9), canary-farm-1 16 (13), control-1 6 (6) — 75 rows, every one ["aws"]; lauterbourg-01-ts 0. Tracebit dedupe: 70 credentials to 26 collectors. Mint failures: zero, third consecutive window — the two big ru-edge bursts (27 mints in 17 minutes, 6 in 7 seconds) passed without a single 400/401, so upstream burst rejection stays rate-bound rather than volume-bound.

Attribution and TLS posture. XFF counters: any 4,706 / multi-entry 0 / ignored-internal 3,167 / single-entry mismatch 1 — the mismatch is the same self-labeled benign probe as №42–№43 (metabase-cve-2026-72898-detect/1.0 on ai-devbox-1, socket peer 169.40.142.190, header asserts 149.14.106.212). Host census: bare-IP-led on seven of eight nodes; the one anomaly is ru-edge's Host: 127.0.0.1 cell (2,791 events), which SI-CENSUS's .102 spoofed on 2,793 of its requests. The decoy vhosts: kiteworks.rightabouteverything.show 1,106 (all generic census traffic — the dedicated Kiteworks crawlers stayed out) and inference.fapthropic.com absent from the top-host table (vhost-directed collection dropped this window).

Volume moves and causes. netcup-ts +191% (4,272) = Bochum crawler 1,774 + Bucklog census 1,096 + SI-CENSUS .87 722. sponge-01-ts +96% (2,421) = Bochum pair 1,811. ru-edge-1 +55% (5,153) = .102's census (2,096 in the 10:00 UTC hour) + .29's burst (1,684 in the 20:00 hour). frantech-ts +12% (14,306) = MEGA-DICTIONARY's 13,445 in 90 seconds. lauterbourg-01-ts +33% (1,631) = 185.196.220.132's env census. canary-farm-1 −64% (1,462), control-1 −56% (2,313), ai-devbox-1 −29% (1,642) — the №41–№43 record waves (31-IP l9scan, CF-fronted census, ZKILLU-class mass) stayed home.

Result-tag spike attribution. Every ≥3× spike traces to a named actor: ru-edge issued 5.0× (37) = .102 (27) + .29 (6) + 4 singles; ru-edge env-production 4.0× (503) = .102 (316) + .29 (187); ru-edge ssh-private-key-error (30, new tag) = .29 (12 key paths) + .102 (2); canary-farm phpmyadmin-login 6.0× (21) = NIGHTAGENT .49 (20) + 159.26.101.78 (1); lauterbourg tarpit-module 6.5× (796) = .132 (530) + a 16.216.88.x cluster (~110); netcup tarpit-module 3.7× (2,902) and not-handled 3.3× (1,063) = the Bochum crawler's deep /-plus-/en* journeys; the four-node tarpit-module spikes share the standing pools.

control-1 discovery velocity. Day 24: 2,313 events from 126 unique IPs — inside the 84–157 band, sixteenth consecutive window.

Digest quirks. The №42 NUL-byte defect RETURNED: flux-digest-2026-10-07.md carries 10 NUL bytes (20,626 bytes total; this briefing read it through a NUL-strip). The defect is intermittent across three runs — the digest writer needs a sanitize step in the ops repo. The ai-devbox-1 rotated-file gap (env-canary.jsonl.1, 268 MB) enters its sixth cycle; all-time counters stay depressed (1,708 all-time issued rows this run vs 2,460 pre-rotation).

Fleet-side changes this cycle. CHAINS in flux-visuals.py: added MEVSPACE-GITWALK and SI-CENSUS; NIGHTAGENT, CREDENTIAL-DRAIN, REGISTRY-HUNT, MEGA-DICT, CONFIG-SWEEP, WP-FORM-BRUTE, ENVRC-SWEEP, SS-PROBE, SS-NET TOOLING, BUCKLOG-KIT notes updated; KITEWORKS-CRAWL and LLM-ENDPOINT-PROBE marked absent/idle; METADATA-HUNT idle count corrected. TALKER_CAMPAIGNS +12 entries, with 102.220.161.x remapped from CREDSWEEP to SI-CENSUS. recon-names.tsv unchanged. The visuals dashboard ran three times (flux-fleet-visuals-2026-10-07.html, -r2, -r3) as the chain set was updated; the briefing links -r3.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 698 sources sent credentials → 588 got a shell (84%) → 335 ran a command (57% of shell-getters, 48% of sources). Event level: 42,530 credential attempts → 3,949 accepted logins → 6,343 commands (161% of accepted logins go on to run something — fourth window above 100%).

Seventeenth static command window. New commands: 0 of 53 distinct. The .ssh replant pair stays dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh ran 1,318 events from 253 IPs, and the key-replace companion 1,142 from 231. The Techoff /24's GPU survey continued: 195.178.110.218 plus one block sibling ran the nvidia-smi/lspci VGA enumeration set at 394 events per command. The GO-SSH-SWEEP /24's uname hardware survey did not run this window. Telnet commodity attempts rose to 841 (from 708).

New credential pairs: 6 of 35,463 — all single-attempt shealyn self-name probes (shealyn/shealyn12345, /shealyn1234, /shealyn123, /shealyn1, /shealyn), a username-equal-password pattern against one account name. Concentration: the fleet-standard 345gs5662d34-class pairs continue to dominate volume; no new dominant pair.

Gaps / Next Collection

1. Follow SI-CENSUS's 27 credentials. The block's ru-edge hoard is the largest single-IP haul since tracking began. Watch Tracebit for AWS use from IPs absent from flux logs, and the block for a third window.
2. Restore ai-devbox-1 history (sixth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
3. Fix the digest NUL-byte defect (ops repo). Three occurrences in four runs. Add a sanitize step and a byte check to the digest writer, not to this workflow.
4. MEGA-DICTIONARY rate. The growth series has six points; a seventh on .252's next replay turns it into a rate. Host cadence is now daily.
5. NIGHTAGENT dropper check. .49 ran credential-only this window. Does .244 return with the phpunit stage, and does any pass carry a corrected dropper URL or a night.php fetch?
6. KITEWORKS third window and LLM-ENDPOINT second window. Two decoy profiles drew dedicated clients in №42–№43 and went quiet in №44; watch for returns, and capture lauterbourg's LLM request bodies if the probe comes back.
7. Network layer. Characterize 16443846184e… (tenth cycle, 16,177 sessions, no banner change) and e54ef3ec… (new, below threshold); correlate GO-SSH-SWEEP's rotated busiest sources with hp accepted logins per source.

Digest: /data/flux-logs/reports/flux-digest-2026-10-07.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-07.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-07-r3.html

Watch next cycle: (1) SI-CENSUS — do 102.220.161.102's 27 canaries reach AWS, and does the block run a third window? (2) MEGA-DICTIONARY — seventh replay and growth point under the new Owl DE host. (3) REGISTRY-HUNT mint-and-use — do more l9scan runners follow the two that validated their own credentials?