FLUX FLEET — INTEL BRIEFING №45

Period: 2026-10-07 07:34 – 2026-10-08 07:34 UTC (24h, day 43 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 43-day baseline, every ≥3× result-tag spike attributed to a named actor)

BLUF

WP-FORM-BRUTE escalated to the largest credential-posting operation in fleet history: 886 wp-login.php credential POSTs (canary-farm-1 459, control-1 427) from a roster led by ≥15 IPs in 12651980 CANADA INC.'s adjacent 217.60.196.x/198.x blocks, synchronized across two sensors with a year-themed dictionary (Admin#2026, Webmaster!2024, P@ssw0rd@2026). The mint→use funnel held its new same-session shape for the second window: all 4 credentials used in AWS were minted and consumed by the same IP, including the first joint use by the two standing Feo Prest hoarders. A self-labeled keyhunt operator minted 8 canaries on ai-devbox-1 in a config census — registered as KEYHUNT, the window's only new campaign. MEGA-DICTIONARY replayed 13,474 dropper-URL paths on frantech-ts in 2 minutes under a returning Datacamp-class host, its seventh consecutive growth event. The defenses held: 0 mint failures (fourth window), 0 XFF forgeries, deny-all limited AWS successes to sts:GetCallerIdentity.

Key Judgements

1. Credential validation is now standard operator behavior, and the hoarder class joined it. 9 of the last 9 used canaries (№44–№45) were validated by the minting IP itself inside the observation window. The Feo Prest pair 213.209.159.154/.175 — 119 mints across 6 days between them — each used a credential for the first time, and first-time collector 209.99.189.217 self-validated its single mint. (High confidence — Tracebit binds each use event to a credential whose mint row carries the same clientIp.)
2. The WP-FORM-BRUTE escalation is a coordinated operation, not commodity noise. ≥15 CANADA-block IPs posted 18–44 credential POSTs each in the same 10:48–22:17 EDT span on two sensors, with identical _wpnonce+testcookie anatomy and one password theme; a second trio ran the same census-then-brute sequence on both sensors 14 minutes apart. (High confidence — bodies captured verbatim on both nodes; start times align within 16 minutes.)
3. Both TLS decoy profiles now attract dedicated tooling. The Kiteworks crawl template returned under a synchronized 4-IP AWS cluster (16.216.88.x), and 468 of ai-devbox-1's 737 inference.fapthropic.com vhost events came from the keyhunt operator. Vhost-directed collection resumed after №44's absence. (High confidence — result-tag sequences match the registered template step for step.)
4. MEGA-DICTIONARY remains one maintained, shared artifact. 13,474 distinct paths in a 2-minute replay — at least +29 paths against №44's 13,445 — under a host class (Datacamp CZ) that carried it before. Host rotation continues; the wordlist only grows. (High confidence — distinct-path count on the full window; growth is a floor because dropped paths are not re-checked this cycle.)

Active Campaigns (day 43 status)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ELEVENTH USE WINDOW, ALL SELF-USE (Hostile, active)

• Actors (use side): 213.209.159.154 and 213.209.159.175 (Feo Prest SRL) — 1 credential each, 4 ops each: GetCallerIdentity ✓ + 3× denied ListFoundationModels; mint sides canary-farm-1 (04:55 EDT) and control-1 (11:02 EDT). 80.94.95.211 (SS-Net RO) — 1 credential, 3 ops (GetCallerIdentity ✓ + 2× denied), minted on ai-devbox-1 02:50 EDT. 209.99.189.217 — 1 credential, GetCallerIdentity ✓ only; minted on ai-devbox-1 16:10 EDT the previous day.
• TTPs: mint at /.env, then sts:GetCallerIdentity validation within the same session; denied ListFoundationModels enumeration. 13 use events across 4 credentials: 7 success, 6 denied.
• Assessment: the leak-to-cash loop's validation stage is universal now — hoarders, standing collectors, and one-time collectors all check their steals. The deny-all policy held; successes leak account identity at most. Hoards: .175 79/6d, .154 40/6d, 45.148.10.171 34/6d, 80.94.92.65 23/6d.

WP-FORM-BRUTE (distributed wp-login credential POST) ⟳ — EIGHTH WINDOW, MAJOR ESCALATION (Hostile, active)

• Actors: CANADA class (12651980 CANADA INC., AE): 15 block IPs in the top POSTer table — 217.60.198.11 (44 POSTs), 217.60.198.14 (39, farm+control), 217.60.198.18 (28), and twelve 217.60.196.x IPs (18–23 each) split across canary-farm-1 and control-1. Trio class: 160.251.210.23 (GMO JP), 107.190.185.67 (Silver Star US), 51.210.150.97 (OVH FR) — 586 events each, both sensors. Singles: 43.162.96.166 (23), 159.223.213.68 (21), 162.243.247.186 (20), 185.216.203.177 (18), 43.162.124.26 (18).
• TTPs: probe → POST with verbatim bodies — _wpnonce=e91b2ba910&log=admin&pwd=Admin%232026&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In; the trio used log=webmaster&pwd=P%40ssw0rd%402026 and rotated Passw0rd/password@2026 variants on a 16–17-minute cadence over 11 hours. NEW: wp.getAuthors xmlrpc method (2 POSTs, replacing the absent system.multicall). Enumeration returned on one IP: 40× wp-user-enum-rest-single (217.60.198.14, control-1 — the inf-tag spike).
• Assessment: a single organization now fields a distributed brute with a shared, year-dated wordlist. The fake WordPress surfaces absorbed all 886 POSTs; the 2026 theme dates the list and will rotate. The block's 217.60.x lineage also covers the LIBREDTAIL staging /16 and the all-node light scanner 217.60.242.51 — one provider, many roles.

KEYHUNT (self-labeled config-census collector) ⚠ NEW — FIRST WINDOW (Hostile, active)

• Actors: 168.119.64.101 (Hetzner DE), single IP, single node (ai-devbox-1): 428 events / 83 paths / 21 trap families, 4 passes 06:18–13:22 EDT.
• TTPs: honest UA Mozilla/5.0 (keyhunt); git stages under honest git/2.34.1. Census: /config.yaml, /config.yml, /values.yaml, /secrets.yaml, /conf/config.yaml, docker-compose, litellm-admin-unauthenticated, actuator-env, firebase-json, aws-credentials-file, .netrc, LLM /v1/models, then a fake-git walk. 8 mints at /.env (8/6d — all this window). Owns ai-devbox-1's app-config-yaml 14.8× spike (37 of 37) and 24 of 30 config-json events.
• Assessment: a Kubernetes/Helm-and-LLM-config specialist. The self-labeling UA follows the SS-PROBE/keyhunt pattern of tooling that does not hide. Zero observed AWS use of its 8 canaries at window close — hostile-held inventory.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — TWELFTH REPLAY, DATACAMP HOST RETURN (Hostile, active)

• Actors: 178.249.209.163 (Datacamp Limited CZ, ipsum:1) on frantech-ts 02:09:20–02:11:19 EDT: 13,474 events / 13,474 distinct paths, GET-only, 208 UAs (UPnP router class this pass: Mi Router 3E, UniFi Dream Machine Pro, Totolink A3002RU, HTTPD/7.1.1 UPnP/1.0 Phicomm/P804-N2, python-requests). The burst is 95% of frantech's window volume.
• TTPs: dropper-URL dictionary (/*.sh, /*.mips arch families, /bin/*); new paths include first-seen /ce.sh and /qv3.mips. Growth floor +29 against №44's 13,445; growth series +6/+27/+34/+39/+17/+31/+29.
• Assessment: seventh straight growth event; host ledger now 31173 ×2, Datacamp ×4, tzulo ×2, Zenlayer ×2, Owl ×1. The artifact circulates between hosting classes and absorbs other actors' tool names; the deception surface absorbs every replay at zero cost.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — FLAT WAVE, NO SELF-USE (Borderline, active)

• Actors: 17 l9scan IPs / 811 events (№44: 18/847) in a 19:54–21:06 EDT wave across canary-farm-1, ai-devbox-1, control-1, ru-edge-1, lauterbourg-01-ts (Kiteworks vhost), sponge-01-ts; all DigitalOcean. 12 IPs minted 1 each (206.189.95.232 hit two sensors); l9explore 45.138.12.51 added 87 events and 1 mint (5/6d).
• TTPs: tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enumeration (/v2/internal/...) → /.env mint at 1/IP; UA variants 2.0.6343/2.0.930323/2.0.234313/2.0.632323.
• Assessment: steady-state collection at unchanged scale. The №44 development did NOT repeat: none of the 13 l9scan canaries reached AWS this window — same-session use is common, not universal.

BUCKLOG-KIT (Bucklog SARL FR /24 census arm) ⟳ — FOURTH WINDOW, CENSUS MOVED TO CONTROL-1 (Hostile, active)

• Actors: 185.177.72.75 on control-1 — 564 events / 277 paths / 33 trap families (the window's deepest single-IP family spread) / 1 POST, 08:41–08:45 EDT; 185.177.72.64 censused netcup-ts (256 events / 253 paths, ipsum:1). .9 and .205 absent.
• TTPs: env-variant directory fanout (/partner/.env, /panel/.env, /live/.env, /.env.sandbox, /.env.sample — several served as env-production decoys), wp-config.txt, phpMyAdmin paths; 0 mints this window.
• Assessment: the census arm rotates nodes each window (netcup №44 → control №45); the №44 mint+SES-use from .205 remains a single observation. The original RCE kit stays dormant since day 7.

SS-PROBE (self-marking canary farmer) ⟳ — THIRD OPERATOR GENERATION (Hostile, active)

• Actors: 105.115.5.210 — 3 runs (ai-devbox-1 19:33, canary-farm-1 20:06, ai-devbox-1 20:24 EDT) + sibling 105.115.6.147 (ai-devbox-1 21:06); 4 mints.
• TTPs: GET /__ss_probe_<fresh-32-hex>__ (markers f8ef5b8e…, 0eab5285…, b9091048…, c7c68297…) under python-requests/2.31.0, then one /.env mint, then exit.
• Assessment: the 105.115.x pool produced №33's operator (105.115.10.78) and now two more; the template persists across operator rotations on a daily cadence.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — TEMPLATE RETURN UNDER AWS CLUSTER (Hostile, active)

• Actors: 16.216.88.25/.51/.102/.126 (AWS US, synchronized) on lauterbourg-01-ts 05:23–05:24 EDT, ~30–41 events each; the №42–№43 Google BE pair stayed out a second window. Generic vhost traffic: 143.244.57.86 (DigitalOcean, 98 not-handled census), 31.56.58.43 (50), plus the l9scan wave.
• TTPs: kiteworks-root-redirect → /login [kiteworks-shell] → 3–4 kiteworks-asset JS bundles → tarpit passes. Vhost volume 506 (down from №44's 1,106); 5 IPs reached kiteworks-shell.
• Assessment: the dedicated-crawl template now has a third operator class; the decoy fingerprints tooling at zero cost. 0 mints.

Watch-class singles (no campaign yet)

• 79.124.58.82 (Tamatiya EOOD BG): lauterbourg-01-ts, 300 events / 150 paths in 60 s at 19:55 EDT under forged Googlebot/2.1 — config census (/package-lock.json, /composer.json, /.aws/credentials, wp-config variants, /.git/index), 14 webshell-probe, kiteworks-root-redirect ×2, dockerenv-marker ×2. The dockerenv shape matches CONFIG-SWEEP's №43 netcup pass.
• 141.255.162.236 (Private Layer CH): ru-edge-1, 262 events / 254 distinct favicon.ico paths across 1C-Bitrix/Russian-business vhost directories (/1c/, /1c-bitrix/, /Mango/, /MedLife/, /alfa/, /billing/…) in 20 s at 23:02 EDT — vhost-dictionary enumeration, probably favicon-hash indexing. 1 phpmyadmin-login probe. New shape; watch for a second node.
• 45.153.34.39: new sibling of .249 — 6 mints/6d across canary-farm-1, control-1, ai-devbox-1 under Chrome/120.0 forgery; .249 absent.
• 45.148.10.171: thirteenth consecutive minting window — 8 mints across canary-farm-1/ai-devbox-1/control-1 (34/6d), antique forged-UA rotation (Ask Jeeves/Teoma, SAMSUNG-SGH-E250 Googlebot-Mobile).
• CONFIG-SWEEP (87.120.104.29): 150 events — the light Googlebot/2.1 pass, third consecutive window after №44's 1,650-event ru-edge burst; 6 mints/6d on ru-edge.
• ENVRC-SWEEP: third window — quote-garbage variants persisted (a157d6c255ee 7 IPs, c7411f59a56f 7 IPs, 49 events each) and e4cbfe2556fa ran ru-edge again (8 IPs, 53 events); d045b89fe96b absent; 0 mints.
• OMEGA-SWEEP pool singles: 94.154.43.84 + .164 minted 1 each at 09:48 EDT under forged Chrome/147 — the recurring pattern; fifth consecutive /46-census miss.
• SI-CENSUS: contracted to 4 events (.87, three sensors); the block's 27 ru-edge credentials from №44 remain held with zero observed AWS use.

Absent or paused

NIGHTAGENT (first absence after two .49 windows), MEVSPACE-GITWALK (first miss after №44's return), METADATA-HUNT (eleventh marker-absent window — 0 __aws_leak_probe/@fs events), GIT-VAULT (3xK trio out a third window), CF-FRONTED CREDSWEEP (eighth window), LLM-ENDPOINT-PROBE (second window — keyhunt's /v1/models fetches are its own census, not the AutoGenX probe), XMLRPC-BRUTE standalone (0 multicall bodies), SONICWALL-VPN-PROBE, ZKILLU-GITWALK, TOKEN-CRAWLER (3 incidental /c/% events), LEAKIX-SSH at the network layer (fourth absence).

Standing actors (persistence check)

• 45.148.10.171 — 13 windows; hoard 34/6d, still zero AWS use.
• Feo Prest pair .154/.175 — daily mints, now daily use; the fleet's most complete mint→use operators.
• SS-Net pair (80.94.95.211 / 80.94.92.65) — .211 minted 2 and used 1; .65 minted 4 across three sensors (23/6d).
• 45.198.224.x — .124/.125 bare tarpit passes on all 8 nodes (86/74 events); the /24 appeared in every window this week.
• 204.76.203.x — sibling .219 light touches on all 8 nodes; dictionary host .18 not in this window's top talkers.
• 185.73.23.162 (Ruhr-Universität Bochum, Software Security Research/1.0) — benign academic crawler, third window, volume DOWN 54% (1,637 vs 3,585).
• 3e1c5eb879e7 /-handshake pool (103 IPs, fleet-wide) and 7e61a9500d8b php-cgi RCE probe cluster (15 IPs, 733 events) — standing background.
• 93.174.93.12 / 89.248.171.24 — benign fixed-cadence probers, unchanged.

Network-layer recon (Arkime) — 2026-10-07 07:34:00 → 2026-10-08 07:34:12 UTC

Fingerprint field ssh.hassh, destination port 22 · 102,632 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 63,423, bahrain-sponge-01-ts 27,287, sensor:bahrain-sponge-01-ts 27,287, sensor:lauterbourg-01-ts 18,923, frantech-ts 13,549, sensor:frantech-ts 13,549

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,190 sessions from 334 source IPs across 166 networks in 54 countries, port 22, avg 4,936 B/session. Networks: AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS16276 OVH SAS, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED. Busiest sources: 95.90.13.168, 43.130.33.11, 101.32.240.31, 222.108.100.117, 152.32.182.8. Last 7 days: 10-02 332 IPs, 10-03 346 IPs, 10-04 343 IPs, 10-05 360 IPs, 10-06 297 IPs, 10-07 350 IPs, 10-08 108 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 28,094 sessions from 89 source IPs across 29 networks in 21 countries, port 22, avg 5,039 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS208137 Feo Prest SRL. Busiest sources: 192.253.248.216, 77.239.124.146, 77.239.124.155, 77.239.124.144, 109.160.32.32. Last 7 days: 10-02 64 IPs, 10-03 68 IPs, 10-04 106 IPs, 10-05 112 IPs, 10-06 98 IPs, 10-07 100 IPs, 10-08 32 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP pulled back in sessions (28,094, −6,655) and IPs (89, −19) but re-armed its shell stage: the sweep's /24 ran the uname -s -v -n -r -m hardware survey on frantech's honeypot at 5,110 events from 8 IPs — the first shell-stage activity since №43 (see the honeypot section). LIBSSH-MASSSWEEP held its day-19 plateau: 334 IPs, +22 day-over-day. 16443846184e… grew again — 23,147 sessions (+6,970), 38 IPs, eleventh uncharacterised cycle. e54ef3ec27fe… doubled to 37 IPs (+18) and now sits 13 IPs under the dispersed threshold — register it if it crosses. 2ec37a7cc8da… (2,087 sessions, 17 IPs, +395) and control-1's top fingerprint 4e066189c3bb… (7,737, −2,276) remain uncharacterised standing actors. Two new below-threshold fingerprints: ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.19 (5 sessions/5 IPs) and ssh-2.0-nmap-ssh2-hostkey (6 sessions/1 IP). lauterbourg-01-ts absorbed 18,923 inbound sessions from 3,875 source IPs — the heaviest per-node scan pressure, on its 14th day. LEAKIX-SSH absent a fourth window. No new registrations; recon-names.tsv unchanged.

Canary credentials

Summary

4 Tracebit alert(s) fired in the window (13 use events across 4 credentials). Fleet sensors minted 58 credentials to 34 collector IPs; 4 credential(s) reached AWS. Use outcomes: 7 success, 6 failure. Denied operations: ListFoundationModels×6. 7 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 34 mints, 2026-10-01 10:34 → 2026-10-07 20:18
• 102.220.161.102: 27 mints, 2026-10-06 10:40 → 2026-10-06 10:57
• 80.94.92.65: 23 mints, 2026-10-01 20:19 → 2026-10-08 03:11
• 94.154.46.250: 11 mints, 2026-10-02 02:03 → 2026-10-02 05:48
• 168.119.64.101: 8 mints, 2026-10-07 06:48 → 2026-10-07 13:20
• 109.205.176.10: 7 mints, 2026-10-01 10:51 → 2026-10-08 03:34
• 140.245.97.208: 6 mints, 2026-10-03 09:14 → 2026-10-07 12:29
• 185.213.193.49: 6 mints, 2026-10-06 00:22 → 2026-10-06 13:26
• 45.153.34.39: 6 mints, 2026-10-07 12:42 → 2026-10-08 02:14
• 87.120.104.29: 6 mints, 2026-10-06 20:39 → 2026-10-06 20:39
• 167.99.181.249: 5 mints, 2026-10-02 21:35 → 2026-10-07 20:00
• 45.138.12.51: 5 mints, 2026-10-02 10:20 → 2026-10-08 00:50
• 64.225.75.246: 5 mints, 2026-10-02 21:21 → 2026-10-06 20:37
• 102.220.161.87: 4 mints, 2026-10-02 13:57 → 2026-10-06 12:09
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 105.112.26.83: 4 mints, 2026-10-06 03:50 → 2026-10-06 04:50
• 20.221.59.215: 4 mints, 2026-10-03 21:56 → 2026-10-07 07:23
• 206.189.95.232: 4 mints, 2026-10-03 06:08 → 2026-10-07 20:05
• 105.115.5.210: 3 mints, 2026-10-07 19:34 → 2026-10-07 20:24
• 128.199.182.152: 3 mints, 2026-10-03 06:14 → 2026-10-06 20:26
• 139.59.143.102: 3 mints, 2026-10-05 19:53 → 2026-10-07 20:03
• 146.190.103.103: 3 mints, 2026-10-03 06:26 → 2026-10-07 20:01
• 146.190.63.48: 3 mints, 2026-10-02 21:05 → 2026-10-07 20:25
• 157.230.19.140: 3 mints, 2026-10-05 20:29 → 2026-10-07 19:58
• 159.89.12.166: 3 mints, 2026-10-04 20:33 → 2026-10-06 20:37
• 165.227.84.14: 3 mints, 2026-10-02 20:15 → 2026-10-06 20:37
• 172.93.215.8: 3 mints, 2026-10-03 13:07 → 2026-10-05 14:17
• 206.189.19.19: 3 mints, 2026-10-02 21:35 → 2026-10-03 20:42
• 206.209.210.3: 3 mints, 2026-10-01 21:40 → 2026-10-02 05:10
• 41.140.8.33: 3 mints, 2026-10-02 22:14 → 2026-10-02 22:15
• 45.153.34.249: 3 mints, 2026-10-06 00:12 → 2026-10-06 17:40
• 46.101.111.185: 3 mints, 2026-10-03 20:38 → 2026-10-05 01:39
• 68.183.9.16: 3 mints, 2026-10-02 20:42 → 2026-10-06 20:00
• 91.92.41.8: 3 mints, 2026-10-04 02:30 → 2026-10-04 02:31
• 93.113.206.248: 3 mints, 2026-10-05 20:30 → 2026-10-05 20:37

Fleet Observations

Canary economics. Digest mint rows: ai-devbox-1 32 (20 IPs), canary-farm-1 21 (13), control-1 11 (8), ru-edge-1 5 (5) — 69 rows, every one ["aws"]; lauterbourg-01-ts 0. Tracebit dedupe: 58 credentials to 34 collectors. Mint failures: zero, fourth consecutive window.

Attribution and TLS posture. XFF counters: any 838 / multi-entry 0 / ignored-internal 1 / single-entry mismatch 0. The self-labeled metabase-cve-2026-72898-detect/1.0 probe that carried the single mismatch in №42–№44 stayed out. Host census: bare-IP-led on six of eight nodes; ai-devbox-1 is vhost-led for the first time (inference.fapthropic.com 737 vs 643 bare) on keyhunt's 468 vhost events plus the l9scan wave; lauterbourg's kiteworks.rightabouteverything.show carried 506.

Volume moves and causes. ru-edge-1 −45% (1,008) — №44's spikes fell out of the window (SI-CENSUS's 2,797-event census → 4 events; CONFIG-SWEEP's 1,650-event burst → a 150-event pass). canary-farm-1 −30% (2,794) — NIGHTAGENT (0 events) and the №44 record l9scan wave both out. frantech-ts −4% (14,046) — the MEGA-DICT replay replaced last window's replay almost exactly. ai-devbox-1 +10% (1,395) — keyhunt's 428 and the vhost traffic. control-1 +4% (3,354) — its first wp-login wave (≈880 probe+credential events). lauterbourg +15% (1,356) — the .82 census, the AWS cluster's crawl, and generic censuses. sponge +16% (1,661) — a spread-out baseline rise across 03:00–08:00 UTC (Bochum 804 + standing pools); no single cause. netcup −4% (1,825) — the Bochum crawler's volume halved.

Result-tag spike attribution. Every ≥3× spike traces to a named actor: canary-farm wp-login-credentials 8.2× (459) and wp-login-probe 7.2× (464) = the 217.60.x CANADA class + the trio + singles; control-1 wp-login-credentials inf (427), wp-login-probe 108× (433), wp-user-enum-rest-single inf (20) = the same class, first control-1 appearance; ai-devbox-1 app-config-yaml 14.8× (37) = keyhunt (37 of 37), config-json 3.1× (30) = keyhunt (24) + census background.

control-1 discovery velocity. Day 25: 3,354 events from 146 unique IPs — inside the 84–157 band, seventeenth consecutive window. The wp-login wave is the first campaign-shaped traffic the baseline node drew.

Digest quirks. The №42 NUL-byte defect did NOT reproduce this run (0 NUL bytes in 20,703) — third occurrence in five runs, ops fix still pending. The ai-devbox-1 rotated-file gap (env-canary.jsonl.1, 268 MB) enters its seventh cycle; all-time counters stay depressed. First-seen timestamps again cluster at one sync-arrival minute (03:16) — inventory, not timeline.

Fleet-side changes this cycle. CHAINS in flux-visuals.py: added KEYHUNT; updated WP-FORM-BRUTE (escalation), MEGA-DICT, REGISTRY-HUNT, SS-PROBE, KITEWORKS-CRAWL, BUCKLOG-KIT, CONFIG-SWEEP, ENVRC-SWEEP, OMEGA-SWEEP, CREDENTIAL-DRAIN, NIGHTAGENT and SI-CENSUS (→ idle), MEVSPACE-GITWALK (→ idle). TALKER_CAMPAIGNS +5 (178.249.209.163, 168.119.64.101, 185.177.72.64, 107.190.185.67, 141.255.162.236). recon-names.tsv unchanged. The visuals dashboard ran once (flux-fleet-visuals-2026-10-08.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 527 sources sent credentials → 423 got a shell (80%) → 307 ran a command (73% of shell-getters, 58% of sources). Event level: 24,855 credential attempts → 8,858 accepted logins → 13,800 commands (156% of accepted logins go on to run something).

The GO-SSH-SWEEP shell stage re-armed. uname -s -v -n -r -m ran 5,110 events from only 8 IPs (example source 109.160.32.30 — the sweep's /24). The survey last ran in №43 and was absent №44; 5,110 events from 8 sources is the heaviest post-shell activity on record and coincides with the sweep's session pullback. Telnet commodity attempts rose to 2,152 (from 841). The Techoff /24's GPU survey continued (nvidia-smi/lspci enumeration at 782 events per command, 195.178.110.218 + block siblings), and the .ssh replant pair stayed dominant (chattr -ia .ssh 1,179 events/226 IPs; key-replace 1,057/204).

Eighteenth static command window. New commands: 0 of 55 distinct. New credential pairs: 0 of 17,010 — concentration unchanged: 345gs5662d34/345gs5662d34 1,128 attempts, root/3245gs5662d34 856.

Gaps / Next Collection

1. WP-FORM-BRUTE's CANADA class. Does the 217.60.196.x/198.x wave repeat, and does the 2026-themed dictionary rotate? The roster and wordlist are the campaign's identity now — track both, not the IPs.
2. Held-credential watch. keyhunt's 8, SI-CENSUS's 27, and the Feo Prest hoards (79+40/6d) — any AWS use beyond sts:GetCallerIdentity/denied ListFoundationModels is a finding. Check whether .154/.175 escalate past validation now that they use.
3. MEGA-DICTIONARY eighth growth point. The +6/+27/+34/+39/+17/+31/+29 series is one replay from an eight-point rate; log the next host in the ledger.
4. Network layer. e54ef3ec27fe… is 13 IPs under the dispersed threshold after doubling — characterize it if it crosses. Characterize 16443846184e… (eleventh cycle, 23,147 sessions) and control-1's 4e066189c3bb….
5. ai-devbox-1 history (seventh cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
6. Digest NUL defect (ops repo). 3 of 5 runs affected through today. Sanitize in the digest writer, not this workflow.
7. 141.255.162.236's favicon/vhost enum. If it returns on a second node, register the shape (vhost-dictionary + favicon-hash indexing).

Digest: /data/flux-logs/reports/flux-digest-2026-10-08.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-08.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-08.html

Watch next cycle: (1) WP-FORM-BRUTE — does the CANADA-block class repeat, and does the 2026 wordlist rotate? (2) Credential use — do keyhunt's 8, SI-CENSUS's 27, or the Feo Prest hoards reach AWS, and does any use go beyond GetCallerIdentity + denied enumeration? (3) e54ef3ec27fe… at the dispersed-sweep threshold and MEGA-DICT's eighth growth point.