FLUX FLEET — INTEL BRIEFING №47

Period: 2026-10-09 07:34 – 2026-10-10 07:34 UTC (24h, day 45 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 45-day baseline, every ≥3× result-tag spike attributed to a named actor)

BLUF

METADATA-HUNT ended a 12-window marker-absent streak with its largest change on record: one Google Cloud runner (34.124.231.201) ran a 21-second code-execution census against canary-farm-1 under 33 forged AI-crawler user agents and minted 40 canaries — the largest single-IP haul in fleet history (prior record 27, №44). The kit moved from config census to exploitation attempts: Langflow @exec subprocess probes, Flowise customMCP, IceCoder terminal-xhr.php, designer file-reads, template traversal, php-cgi shell_exec, and the classic /@fs Vite credential traversals. REGISTRY-HUNT ran about 49 l9scan IPs across all 8 sensors and rolled out a deeper 5-level Jira traversal variant on lauterbourg (10 IPs). CONFIG-SWEEP re-ran its 1,650-event ru-edge burst and minted 6 (12 held in 6 days, none used), GIT-VAULT reactivated under a third operator class (a synchronized DigitalOcean trio, identical 144-event walks), and MEGA-DICTIONARY logged its 14th replay under a new host class (31173 Services AB, DE; +11 paths). The mint→use funnel stayed at zero for a second window: 84 credentials to 33 collectors, no AWS calls; 17 mint attempts 400-failed.

Key Judgements

1. METADATA-HUNT upgraded from census to exploitation. The returning runner kept the campaign's two identity markers — the forged AI-crawler UA set and the /@fs/home/<user>/.aws/credentials Vite traversals — and added a code-execution stage list the fleet had never recorded: Langflow /api/v1/validate/code (@exec('raise Exception(__import__("subprocess").check_output("env 2>/dev/null…), Flowise /api/v1/node-load-method/customMCP, /lib/terminal-xhr.php (command=env&password=bypass&csrf=x), /read-document and /api/designer/v1/file-content ({"file_path":"/proc/self/environ"}, {"file_path":".env"}), /api/templates/preview ({"templateFile":"../../../../.env"}), /api/fs/exec ({"command":"env","args":[]}), and php-cgi RCE bodies <?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?> on 7 paths. (High confidence — the markers, the UA family, and the mint-batch shape (25→40) match the registered template; the wordlist change is the upgrade the №16 rule predicted.)
2. The LeakIX toolset is widening beyond its IP pool. About 49 l9scan IPs hit all 8 sensors, and the Tc Datacenter IP 45.138.12.51 ran LeakIX's other tools (l9explore/1.2.2, l9tcpid/v1.1.0) on frantech-ts and sponge-01-ts (88 events each). The new deeper Jira traversal (..::..::..::..::..::META-INF) ran from 10 IPs on one node — a staged rollout, not fleet-wide adoption yet. (High confidence — 8 UA variants from one self-labeled family plus a second and third tool of the same brand.)
3. Bucklog's census arm is scaling up inside its /24. New operator IP 185.177.72.100 ran control-1's largest census of the campaign — 1,433 digest-table events (1,637 raw, 408 of them tarpit pairing rows), 1,008 paths, 102 trap families in 20 minutes, under curl/8.7.1 — and owns all 10 of control's first-seen SaaS/backup paths (xai_config.yml, config/mailgun.yml, brevo_config.json, sparkpost_credentials.json, mongodump.zip, docker-compose.yml.tar.gz, sentry/, rabbitmq/, prometheus/rules, /internal/configprops). The /24 fielded three IPs on two sensors and minted through .205. (Moderate confidence — one 20-minute window; a second window fixes the operator count.)
4. The credential funnel produced inventory, not evidence, for a second window. 84 minted credentials reached 33 collectors; Tracebit fired zero AWS alerts and zero successful calls. The last observed use remains №45's same-session self-use. (High confidence for the window — a use outside the pull window would look identical to no use.)

Active Campaigns (day 45 status)

METADATA-HUNT (GCP AI-config census → code-execution kit) ⟳ — RETURNED, MAJOR WORDLIST UPGRADE (Hostile, active)

• Actors: 34.124.231.201 (Google Cloud, SG), single runner, canary-farm-1 only, one 21-second pass 08:05:03–08:05:24 UTC 10-10. No second runner and no other node this window.
• TTPs: tarpit-module 302 entry → graphql introspection on /graphql, /api/graphql, /v1/graphql → prototype-pollution form POSTs to /login, /api/auth, /dashboard, /admin (bodies start {"then":"$1:__proto__:t…) → code-execution census: Langflow /api/v1/validate/code body {"code":"@exec('raise Exception(__import__("subprocess").check_output("env 2>/dev/null… (capture truncated at 90 bytes); Flowise /api/v1/node-load-method/customMCP + /flowise/… (both 404); /lib/terminal-xhr.php and /icecoder/lib/terminal-xhr.php POST command=env&password=bypass&csrf=x (200); /read-document and /api/designer/v1/file-content POSTs {"file_path":"/proc/self/environ"} and {"file_path":".env"} (200); /api/templates/preview POSTs {"templateFile":"../../../../proc/self/environ"} and {"templateFile":"../../../../.env"} (200); /api/fs/exec POST {"command":"env","args":[]} (200); php-cgi RCE bodies <?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?> across /index.php, /php-cgi/php-cgi.exe, /cgi-bin/php-cgi.exe, /cgi-bin/php, /cgi-bin/php-cgi (200); /bin/sh cgi-traversal-command → Vite traversals /@fs/home/ec2-user/.aws/credentials and /@fs/home/ubuntu/.aws/credentials → env-production ×35, firebase-json ×13, app-config-json ×11, webapp-config-bundle-js ×10, proc-environ ×17 → a NEW debug-trigger path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show plus two random-token paths → 40 mints at /.env in an 8-second burst (08:05:04–08:05:12 UTC), each under a different forged AI-crawler UA: ChatGLM-Spider/1.0, YiBot/1.0, cohere-ai, Bytespider, Bravebot/1.0, GrokBot/1.0, PerplexityBot/1.0, Perplexity-User/1.0, xAI-Grok/1.0, Baiduspider/2.0, PanguBot/1.0, ClaudeBot/1.0, Claude-User/1.0, Claude-SearchBot/1.0, Kimi-SearchBot/1.0, KimiBot/1.0, MoonshotBot/1.0, DuckAssistBot/1.1, Applebot/0.1, YouBot/1.0, Google-Extended, DeepSeekBot/1.0, Amazonbot/0.1, MistralAI-User/1.0, Qwenbot/1.0, Hunyuan/1.0, GPTBot/1.4, ChatGPT-User/1.0, OAI-SearchBot/1.4, CCBot/2.0, Googlebot/2.1, Meta-ExternalAgent/1.0 — 33 distinct UA strings over the pass. Totals: 374 events / 223 paths / 74 trap families / 36 POSTs.
• Assessment: the template's goal moved from collected config files to runtime secrets: most code-exec bodies read env or /proc/self/environ, which reaches secrets that never touch disk. The UA set grew well beyond the №13–№14 roster (Kimi, DeepSeek, Mistral, Qwen, Hunyuan, PanguBot, cohere, DuckAssist, Bravebot, ChatGLM, YiBot, xAI-Grok are new strings). The 40-mint burst is the new batch shape — the №16 rule called a changed wordlist an upgrade, and the mint record (prior single-IP record 27, SI-CENSUS №44) shows it. Farm's issued 3.1× spike (60) is this IP's 40 mints plus the REGISTRY-HUNT wave. The decoys answered every probe at zero cost; the 40 canaries are hostile-held inventory until they expire or trip.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — ALL-8-SENSOR WAVE + DEEPER-JIRA ROLLOUT (Borderline, active)

• Actors: about 49 l9scan IPs across all 8 sensors (farm 16, aidev 16, lauterbourg 10, control 2 + 1 curl, ru-edge 2, netcup 1, sponge 1, frantech 1), all DigitalOcean classes. Journey signatures: 850993125b15 farm 11 IPs / 572 events; NEW b3c6048a4870 lauterbourg 9 IPs / 360 events; b07c7bb207b4 aidev 8 IPs / 328; 76d212a95300 aidev 6 IPs / 234. The wave also owns the lauterbourg kiteworks vhost this window (428 of its events from 8 runner IPs at ~40 each — the dedicated KITEWORKS-CRAWL classes stayed out). Evening mint wave 23:46 UTC 10-09 – 03:12 UTC 10-10: 22 of the window's 33 collector IPs were l9scan runners. Repeat minters: 68.183.9.16 (three passes — control 20:07, aidev 23:12, aidev 02:21; 6 mints/6d), 157.230.19.140 (3 sensors), 159.89.12.166 (2 sensors, 117 events), 167.99.182.39 and 64.226.65.160 (2 each).
• TTPs: tarpit → WebLogic console → Confluence → deeper Jira archive traversal /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties — 5 ..:: levels against №46's 2; 11 events from 10 IPs, all on lauterbourg → WHM/cPanel proxy paths → docker-registry enumeration (aidev docker-registry-manifest 3.3× / tags 3.1×; 68.183.9.16 and 159.89.12.166 10 each) → graphql introspection (16 runners, 2–4 each) → /.env mint at ~1/IP. 8 UA variants; the largest clusters run l9scan/2.0.234313… (farm) and l9scan/2.0.632323… (aidev). Toolset side-channel: 45.138.12.51 (Tc Datacenter, LT — the №43 KITEWORKS-CRAWL block) ran l9explore/1.2.2 (87 events) + l9tcpid/v1.1.0 (1) on frantech-ts 03:11 UTC and sponge-01-ts 13:07 UTC, 85 paths each, 0 mints — the brand's second and third tools in fleet logs.
• Assessment: a versioned scanner fleet continues to rotate IPs while adopting stage changes in place. The deeper traversal appeared on exactly one node's signature — watch it spread to the other three signatures. 22 l9scan-held canaries plus the wave's volume produced no AWS calls by window close.

CONFIG-SWEEP (Googlebot-forged config census) ⟳ — FIFTH WINDOW, ru-edge BURST + 6 MINTS (Hostile, active)

• Actors: 87.120.104.29 (Sino Worldwide, NO), ru-edge-1 only this window; 12 canaries held over 6 days, none used.
• TTPs: 1,650 events / 1,642 paths / 140 trap families in about one minute (10:12 UTC 10-09) under forged Googlebot/2.1. env-production ×187, ssh-private-key-error ×28 (12 SSH-private-key paths), webshell-probe ×39, app-config-python/php ×48, wp-config ×21. 6 mints at /.env (10:12:40–10:12:50 UTC) — the campaign's second ru-edge mint run after №44, riding the census burst.
• Assessment: volume oscillates (150 → 300 → 1,650 → 1,650 across the last four windows) while the kit's mint behavior matures: the №46 farm burst lost both attempts to 400s; this one landed 6. Speed plus spread now pays it credentials.

GIT-VAULT (git-internals walk) ⟳ — REACTIVATED, THIRD OPERATOR CLASS (Hostile, active)

• Actors: a synchronized DigitalOcean trio, one walk each: 178.128.169.110 (aidev, 08:21 UTC), 144.126.227.243 (aidev, 19:19 UTC), 104.248.163.59 (control-1, 01:55 UTC 10-10).
• TTPs: identical 144-event / 142-path / 1-minute git-internals walks — 143 fake-git + 1 gitignore — under stale Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0. Owns aidev's fake-git 3.1× spike (299) and control's fake-git 3.2× spike (191). 0 mints.
• Assessment: the 144/142 walk shape now has a third hosting class (3xK Tech GmbH №40–№42, VPS Dedicated SI №43 via 102.220.161.102, DigitalOcean №47) — the template circulates as commodity tooling. The 30 fake-git-error events on aidev came separately from 45.148.10.5 (20) — a new active IP in the CREDSWEEP /24-adjacent block, watch it.

BUCKLOG-KIT (Bucklog SARL FR /24 census arm) ⟳ — WIDEST WINDOW, NEW OPERATOR IP (Hostile, active)

• Actors: three /24 IPs on two sensors: 185.177.72.100 (NEW) on control-1, 22:57–23:17 UTC 10-09; 185.177.72.38 on control-1, 09:25–09:30 UTC (188 events — its fourth consecutive window); 185.177.72.205 on lauterbourg-01-ts 10:07–10:12 UTC 10-10 (244 raw events) plus a single /.env mint on control-1 under curl/8.7.1 at 23:47 UTC.
• TTPs (.100): curl/8.7.1 census, 1,008 paths / 102 families: not-handled ×679, tarpit-module ×255, tarpit + tarpit-disconnect ×204 each (owns control's tarpit 3.5× spikes), env-production ×46, fake-git ×37, backup-archive ×17, app-config-yaml ×10; owns all 10 of control's first-seen paths this window (xai_config.yml, config/mailgun.yml, brevo_config.json, sparkpost_credentials.json, mongodump.zip, docker-compose.yml.tar.gz, sentry/, rabbitmq/, prometheus/rules, /internal/configprops, and companions). GET-only, 0 POSTs.
• Assessment: the census arm keeps rotating operators inside the /24 and its wordlist grows each window — SaaS-config (mailgun, brevo, sparkpost, xai) and backup-archive paths are new classes for this kit. The family's only use event remains .205's №44 mint + SES calls; its control mint this window is the second.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — FOURTEENTH REPLAY, NEW HOST CLASS (Hostile, active)

• Actors: 193.32.248.142 (31173 Services AB, DE — a new host class for this campaign; ipsum:2) on frantech-ts, 05:21–05:22 UTC 10-10: 13,490 events / 13,489 distinct paths in about 2 minutes, GET-only, 94% of the node's window volume.
• TTPs: dropper-URL dictionary replay under 200+ router/IoT user agents (Linksys, TP-LINK, Xiaomi, MikroTik, OpenWrt, Tenda, Synology, ZTE, UniFi, Huawei HG532e, Roku, Dalvik/SHIELD, AmazonEchoShow, Nest Hub, boa, RomPager, Micro_httpd, plus Wget/curl/Python/AIOHTTP families). Anti-join against №46's wordlist: +11 / −0 (13,478 → 13,489) — growth series +31 / +29 / +4 / +11. The artifact carried 1 event each of other actors' campaign paths (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth).
• Assessment: ninth straight growth event and a sixth host class. 31173 Services AB already replayed under a FR address (№34); the DE address extends the same operator base. The deception surface absorbs each replay at zero cost.

WP-FORM-BRUTE (distributed wp-login credential POST) ⟳ — TENTH WINDOW, NEW RESIDENTIAL CLASS (Hostile, active)

• Actors: NEW signature 75df0dbb0841 (first seen this window): 12 residential IPs — 196.189.57.251, 177.244.108.43, 189.121.202.231, 45.190.174.67, 49.207.132.38, 120.28.68.59, 5.30.96.90 (ai-devbox-1); 184.145.82.135, 181.20.147.123, 196.188.229.243, 191.118.42.128, 157.15.228.19 (canary-farm-1) — plus scattered single-POST probes. The №45 CANADA class and the №46 22-IP 9ff5e462ca0e cluster are absent.
• TTPs: each IP runs exactly 6 events — probe → 3 credential POSTs → probe — 36 credential POSTs total, fixed log=admin, one small dictionary (Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1!), bodies like log=admin&pwd=admin%40123&wp-submit=Log+In&redirect_to=https%3A%2F%2Fsso.rightabouteverything…. First class whose redirect_to matches the vhost it hits (sso.rightabouteverything.show on farm, inference.fapthropic.com on aidev).
• Assessment: a low-and-slowest generation: 12 IPs × 3 passwords each, spread across the whole day, vhost-aware. The roster, not the IPs, remains the identity; the vhost awareness is new for this campaign.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⚠ NEW — SECOND WINDOW, SECOND NODE (Hostile, active)

• Actors: №46: 158.178.159.133 (Oracle, NL) on frantech-ts — 181 POSTs to /mysql/dbadmin/index.php in 26 s. №47: 167.86.124.4 (Contabo, FR) on ai-devbox-1 — 183 events / 3 paths / 181 phpmyadmin-login results in one minute (17:57 UTC 10-09), GET-only, 0 POSTs.
• TTPs: both runs self-identify with the honest UA string Go Web Pentest Tool and hammer phpMyAdmin login surfaces at ~181 events per pass.
• Assessment: promoted from watch single on the second window, second node, second ASN, same self-labeled tool. The tool changed verb (POST → GET) between runs; volume identical. Two operators of one commodity tool is the standing read.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — SECOND ZERO-USE WINDOW (Hostile, active)

• Actors: mint side 33 collector IPs; top holders 34.124.231.201 (40), 80.94.92.65 (6), 87.120.104.29 (6), 45.148.10.171 (2). Use side: nobody — 0 AWS alerts, 0 successful calls.
• TTPs: mint at /.env under census and wave traffic; no validation calls observed.
• Assessment: №46–№47 are the first back-to-back zero-use windows since №42. 84 fresh credentials (plus 99 digest mint rows) are hostile-held until expiry. The persistent hoards stand: 45.148.10.171 40/6d (fifteenth consecutive minting window; new Lynx/2.8.7dev.4 and Nokia Symbian forgeries), 80.94.92.65 27/6d now spread over 4 sensors (the SS-Net sibling returned to minting with 6, including Wget/1.9.1 on control — the SS-Net pair's primary .211 stayed out a second window), 34.124.231.201 40 (new), 87.120.104.29 12/6d.

Watch-class singles (no campaign yet)

• 172.104.241.92 (Akamai Connected Cloud, DE, ipsum:3+firehol2): lauterbourg, third window, 219 events / 183 paths / 28 families in one minute (09:31 UTC 10-09) under an Android Redmi Note 8 Pro UA — kiteworks-root-redirect + kiteworks-shell, nmaplowercheck, Citrix rdx, ColdFusion CFIDE, geoserver, observability-health, webshell sweep.
• 172.105.76.7 (Akamai Connected Cloud, DE): lauterbourg, third window, 125 events / 99 paths / 19 families (22:17–22:24 UTC 10-09) with 4 POSTs: /mcp_message, /api/v1/fabric_device_auth/fortigate/init ×2, and a Citrix SAMLRequest=PHNhbX… POST to /saml/login. Same node three windows; registration trigger stays a second node.
• 104.251.180.112 (Go-http-client/1.1): 3 sensors (frantech, aidev, control), 151 events, minted 1 on aidev (01:21 UTC 10-10) and touched fake-git twice — first-time collector, watch a second mint.
• 187.153.106.106 (Telmex MX residential): 4 sensors, 119 events, owns most of aidev's method-not-allowed spike (5 of 25; REGISTRY-HUNT runners carry the rest).
• 173.239.214.15/.16/.9/.19 + 185.198.240.155/.157: paired mint-and-census cluster on aidev + ru-edge around 19:43–19:46 UTC (Chrome/106 + Firefox/106 forgeries, phpmyadmin-login 10/10/10/7, one /.env mint each on two of them).
• 45.148.10.5: 20 fake-git-error events on aidev — first /24-adjacent activity beyond .171 since №13's .238.

Absent or paused

NIGHTAGENT (second absence since the №46 return), EMPERORS-KIT (second absence — its 6 canaries stay unused), KEYHUNT (second absence — 8 canaries unused), SI-CENSUS (third idle window; 27 held ru-edge credentials unused), ENVRC-SWEEP (all four signatures absent), OMEGA-SWEEP (seventh consecutive /46-census miss; pool single 94.154.43.158 minted 1 on aidev and .122/.135 made crossnode touches), METADATA-HUNT → RETURNED (absence streak ends at 12 windows), MEVSPACE-GITWALK, XMLRPC-BRUTE standalone, SONICWALL-VPN-PROBE, LLM-ENDPOINT-PROBE, KITEWORKS-CRAWL's dedicated classes (Google BE third absence, Tc Datacenter second — the vhost now serves REGISTRY-HUNT's variant), LEAKIX-SSH network layer, SS-Net primary 80.94.95.211 (second consecutive miss while .92.65 mints), Feo Prest .154/.175 (0 window mints; №45 uses stand), NIGHTAGENT's former operators, BUCKLOG .64/.9, the CANADA wp-form class, the №46 9ff5e462ca0e cluster, 141.255.162.236's favicon/vhost enum (absent after two growth windows), Bochum academic crawler 185.73.23.162 (second absent window).

Standing actors (persistence check)

• 45.148.10.171 — fifteenth consecutive minting window (2 on farm, Lynx + Symbian forgeries), hoard 40/6d, still zero AWS use.
• 87.120.104.29 — fifth consecutive window; volume oscillating, mints now 12/6d.
• 185.177.72.x (BUCKLOG) — .38 fourth consecutive window on control; .205 and new .100 active; family hoard grows.
• 204.76.203.18 (Pfcloud, NL) — MALWARE-DICT loop on control-1 continues (1,871 events / 566 paths across the full window in the top-talker table).
• REGISTRY-HUNT repeat minters — 68.183.9.16 (6/6d), 157.230.19.140 (4/6d), 159.89.12.166, 167.99.182.39, 64.226.65.160: 2+ consecutive windows each.
• 3e1c5eb879e7 /-handshake pool — 87 IPs / 605 events on 7 sensors, standing background; 7e61a9500d8b php-cgi RCE probe cluster — 11 IPs / 539 events on 7 sensors; 4a3bf1265dff tarpit pool — 10 IPs / 350 events on 5 sensors.

Network-layer recon (Arkime) — 2026-10-09 07:34:00 → 2026-10-10 07:34:56 UTC

Fingerprint field ssh.hassh, destination port 22 · 119,961 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 80,422, frantech-ts 32,798, sensor:frantech-ts 32,798, bahrain-sponge-01-ts 29,723, sensor:bahrain-sponge-01-ts 29,723, sensor:lauterbourg-01-ts 24,201

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,952 sessions from 320 source IPs across 157 networks in 54 countries, port 22, avg 4,933 B/session. Networks: AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS31898 Oracle Corporation, AS14061 DigitalOcean, LLC. Busiest sources: 189.203.163.10, 94.20.62.126, 165.154.162.74, 192.9.228.120, 99.92.204.98. Last 7 days: 10-04 343 IPs, 10-05 360 IPs, 10-06 297 IPs, 10-07 350 IPs, 10-08 309 IPs, 10-09 317 IPs, 10-10 123 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 24,292 sessions from 84 source IPs across 29 networks in 16 countries, port 22, avg 5,133 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS43754 Asiatech Data Transmission company, AS208137 Feo Prest SRL, AS213790 Limited Network LTD. Busiest sources: 109.160.32.30, 77.239.124.145, 109.160.32.136, 109.160.32.148, 109.160.32.103. Last 7 days: 10-04 106 IPs, 10-05 112 IPs, 10-06 98 IPs, 10-07 100 IPs, 10-08 66 IPs, 10-09 88 IPs, 10-10 29 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) gave back most of yesterday's record: 24,292 sessions (−10,057) while its source pool widened back to 84 IPs / 29 networks — the concentrated 70-IP phase lasted exactly one window and the shape returned to dispersed. Its busiest sources are the 109.160.32.x and 77.239.124.145 addresses again, and the frantech honeypot logged the /24's uname survey the same window (see the hp section) — sweep, shells, and hardware inventory remain one operation. LIBSSH-MASSSWEEP (f555226df196…) held its plateau on day 22 (320 IPs, +18) as the window's second flagged sweep. control-1 absorbed 29,747 inbound sessions (269 source IPs); its top fingerprint 4e066189c3bb… fell below the section's 15-IP floor at 14 sources but raised its session count to about 13,000 (+5,434 day-over-day, roughly 928 sessions per IP) — the unnamed concentrator keeps intensifying on the fresh-IP baseline, fourteenth uncharacterized cycle. 16443846184e… pulled back to 10,533 sessions / 26 IPs (twelfth cycle); 03a80b21afa8… grew to 40 IPs / 807 sessions (+17); 084386fa7ae5… contracted 69 → 49 IPs; 19532158b559… logged a third growth window (3,165 sessions, +296). No new fingerprints today; the tag-label drift noted in №43 persists (bahrain-sponge tags mirror control-1 counts; pcap pipeline read-only, recorded not fixed).

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 84 credentials to 33 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 45.148.10.171: 40 mints, 2026-10-03 08:28 → 2026-10-10 07:09
• 102.220.161.102: 27 mints, 2026-10-06 10:40 → 2026-10-06 10:57
• 80.94.92.65: 27 mints, 2026-10-03 09:29 → 2026-10-09 22:13
• 87.120.104.29: 12 mints, 2026-10-06 20:39 → 2026-10-09 06:12
• 168.119.64.101: 8 mints, 2026-10-07 06:48 → 2026-10-07 13:20
• 80.94.95.211: 8 mints, 2026-10-04 00:52 → 2026-10-08 02:50
• 146.190.103.103: 7 mints, 2026-10-03 06:26 → 2026-10-09 20:10
• 150.241.66.127: 7 mints, 2026-10-04 13:24 → 2026-10-08 18:55
• 109.205.176.10: 6 mints, 2026-10-03 17:55 → 2026-10-09 05:41
• 140.245.97.208: 6 mints, 2026-10-03 09:14 → 2026-10-07 12:29
• 185.213.193.49: 6 mints, 2026-10-06 00:22 → 2026-10-06 13:26
• 213.209.159.175: 6 mints, 2026-10-03 10:06 → 2026-10-07 11:02
• 45.153.34.39: 6 mints, 2026-10-07 12:42 → 2026-10-08 02:14
• 68.183.9.16: 6 mints, 2026-10-03 19:51 → 2026-10-10 02:21
• 105.115.6.147: 5 mints, 2026-10-07 21:06 → 2026-10-08 15:27
• 160.177.245.67: 5 mints, 2026-10-08 07:57 → 2026-10-08 09:04
• 206.189.95.232: 5 mints, 2026-10-03 06:08 → 2026-10-08 19:33
• 105.112.176.254: 4 mints, 2026-10-04 00:55 → 2026-10-04 02:03
• 105.112.26.83: 4 mints, 2026-10-06 03:50 → 2026-10-06 04:50
• 139.59.143.102: 4 mints, 2026-10-05 19:53 → 2026-10-09 21:03
• 157.230.19.140: 4 mints, 2026-10-05 20:29 → 2026-10-09 21:06
• 167.99.181.249: 4 mints, 2026-10-03 06:09 → 2026-10-07 20:00
• 167.99.210.137: 4 mints, 2026-10-03 06:09 → 2026-10-08 18:46
• 20.221.59.215: 4 mints, 2026-10-03 21:56 → 2026-10-07 07:23
• 206.189.225.181: 4 mints, 2026-10-05 19:55 → 2026-10-09 21:06
• 208.84.100.218: 4 mints, 2026-10-09 04:22 → 2026-10-09 05:34
• 209.99.188.170: 4 mints, 2026-10-07 17:51 → 2026-10-09 18:35
• 213.209.159.154: 4 mints, 2026-10-04 18:15 → 2026-10-08 04:55
• 64.225.75.246: 4 mints, 2026-10-05 20:08 → 2026-10-06 20:37
• 64.227.32.66: 4 mints, 2026-10-06 20:37 → 2026-10-09 19:46
• 105.115.5.210: 3 mints, 2026-10-07 19:34 → 2026-10-07 20:24
• 128.199.182.152: 3 mints, 2026-10-03 06:14 → 2026-10-06 20:26
• 128.199.182.55: 3 mints, 2026-10-08 20:14 → 2026-10-09 19:48
• 139.59.136.184: 3 mints, 2026-10-05 20:27 → 2026-10-09 21:05
• 142.93.143.8: 3 mints, 2026-10-03 05:23 → 2026-10-09 19:46
• 157.245.113.227: 3 mints, 2026-10-04 20:03 → 2026-10-08 17:32
• 157.245.204.205: 3 mints, 2026-10-04 20:34 → 2026-10-08 19:36
• 159.89.12.166: 3 mints, 2026-10-04 20:33 → 2026-10-06 20:37
• 164.92.244.132: 3 mints, 2026-10-03 20:42 → 2026-10-08 19:29
• 172.93.215.8: 3 mints, 2026-10-03 13:07 → 2026-10-05 14:17
• 209.99.189.217: 3 mints, 2026-10-06 15:38 → 2026-10-09 01:07
• 45.138.12.51: 3 mints, 2026-10-04 04:20 → 2026-10-08 00:50
• 45.153.34.249: 3 mints, 2026-10-06 00:12 → 2026-10-06 17:40
• 46.101.111.185: 3 mints, 2026-10-03 20:38 → 2026-10-05 01:39
• 64.226.65.160: 3 mints, 2026-10-03 07:57 → 2026-10-09 21:05
• 91.92.41.8: 3 mints, 2026-10-04 02:30 → 2026-10-04 02:31
• 93.113.206.248: 3 mints, 2026-10-05 20:30 → 2026-10-05 20:37

Attribution notes. 87.120.104.29's 6 window mints (10:12:40–50 UTC, digest and v_full both show them; its 6-day list above shows 12/6d) did not render as a per-collector row — a section-table gap to fix in the ops repo, not a data question. 208.84.100.218 (symfony census collector) minted 4 across 3 sensors; 209.99.188.170 (Chrome/124) 3 across 3 sensors — both standing, unattributed.

Fleet Observations

Canary economics. Digest mint rows: canary-farm-1 60 (16 IPs — 40 of them 34.124.231.201's burst), ai-devbox-1 19 (16), ru-edge-1 14 (9), control-1 6 (6) — 99 rows; Tracebit dedupe: 84 credentials to 33 collectors. Mint failures rose to 17×400 (ai-devbox-1 9, canary-farm-1 7, control-1 1, ru-edge-1 0) from 11 last cycle — all 400 Bad Request, the known speed-triggered upstream rejection, scattered across census bursts and the l9scan wave. The window set a fleet record: most canaries minted to a single IP in one pass (40).

Attribution and TLS posture. XFF counters: any 3,385 / multi-entry 0 / ignored-internal 1,815 / single-entry mismatch 0 — the fifth straight window with no forgery signal. Host census stays bare-IP-led on all 8 nodes; canary-farm-1's sso.rightabouteverything.show carried 1,308 vhost events, ai-devbox-1's inference.fapthropic.com 1,046, lauterbourg's kiteworks.rightabouteverything.show 428 (all REGISTRY-HUNT runners this window).

Volume moves and causes. ai-devbox-1 +78% (2,129): 16 REGISTRY-HUNT IPs, the GIT-VAULT pair, 167.86.124.4's 181-event hammer, and the method-not-allowed bump. control-1 +39% (4,416): Bucklog .100's 1,433-event census, the 204.76.203.18 loop (1,871), and its tarpit spikes. ru-edge-1 +36% (2,262): CONFIG-SWEEP's 1,650-event burst. lauterbourg +24% (1,567): the 10-IP deep-Jira wave, Bucklog .205, and the two Akamai scanners. frantech-ts −1% (14,026): the MEGA-DICT replay holds the node at its usual level. netcup-ts −80% (393) and sponge-01-ts −57% (625): the №44–№45 census traffic aged out and REGISTRY-HUNT shrank to one touch on each — bare-floor windows for both deception nodes. canary-farm-1 +11% (1,930): the METADATA-HUNT burst.

Result-tag spike attribution. Every ≥3× spike has a named cause: farm issued 3.1× (60) = 34.124.231.201 (40) + the REGISTRY-HUNT wave; aidev phpmyadmin-login 14.5× (218) = 167.86.124.4 (181) + the 173.239.214.x/185.198.240.x cluster; aidev fake-git 3.1× (299) = the GIT-VAULT trio's two aidev walks (286); aidev fake-git-error 7.5× (30) = 45.148.10.5 (20) + l9scan runners; aidev docker-registry-manifest/tags 3.3×/3.1× = the REGISTRY-HUNT wave; aidev graphql-introspection 3.3× (36) = 16 l9scan runners; control fake-git 3.2× (191) = 104.248.163.59 (143) + Bucklog .100 (37); control tarpit/tarpit-disconnect 3.5× (176 each in the spike table) = Bucklog .100 (204 each raw) + .38 (56 each).

control-1 discovery velocity. Day 27: 4,416 events from 123 unique IPs — inside the 84–157 band, nineteenth consecutive window.

Digest quirks. First-seen timestamps again cluster at the sync-arrival minutes (03:15/03:31 local) — treat first-seen as inventory, not timeline; the 10 first-seen control paths belong to Bucklog .100's census, not a 07:15 UTC event. Verified convention note: the top-talker table excludes tarpit-disconnect pairing rows — raw v_full counts run 204 higher for .100 (1,637 vs 1,433) and 56 higher for .205 (244 vs 188); quote table numbers for consistency, raw numbers for pair analysis. The ai-devbox-1 rotated-file gap enters its ninth cycle; all-time counters stay depressed. The canary section's per-collector table dropped 87.120.104.29's 6 window mints (see Attribution notes).

Fleet-side changes this cycle. CHAINS in flux-visuals.py: METADATA-HUNT → active (returned, upgraded), GIT-VAULT → active (DigitalOcean trio), KITEWORKS-CRAWL → idle (classes absent, vhost carried by REGISTRY-HUNT), +GOWEB-PENTEST; notes updated for REGISTRY-HUNT, CONFIG-SWEEP, BUCKLOG-KIT, MEGA-DICT, WP-FORM-BRUTE, CREDENTIAL-DRAIN. TALKER_CAMPAIGNS +6. recon-names.tsv unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-10.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 532 sources sent credentials → 405 got a shell (76%) → 292 ran a command (72% of shell-getters, 55% of sources). Event level: 20,359 credential attempts → 4,510 accepted logins → 8,584 commands (190% of accepted logins go on to run something). Telnet (commodity IoT botnets): 730 attempts, down from 970.

Twentieth static command window. New commands: 0 of 63 distinct. The GO-SSH-SWEEP /24's uname survey re-armed after a silent window: uname -m | awk '{printf $1}' and uname -s -v -n -r -m at 1,166 events each from 14 IPs (example source 109.160.32.103) — the same addresses the Arkime sweep flags as busiest. The Techoff /24's GPU survey continued (uname, lspci, nvidia-smi, uptime at 445 events each from 2 IPs, example 195.178.110.218). The .ssh replant pair stayed dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,158 events / 227 IPs and the key-replace chain at 1,008 / 202.

Credential concentration returned. 13,917 distinct pairs offered, 0 new — and the top pair drew 1,106 attempts (345gs5662d34/345gs5662d34) with root/3245gs5662d34 at 838: the fixed-pair sprayers that rotated away in №46 are back. No new pairs to report.

Gaps / Next Collection

1. METADATA-HUNT's 40 canaries. Does the record haul reach AWS, and does the code-execution kit return — on farm again, or against ai-devbox-1's LLM surface where the Langflow/Flowise paths belong? A second runner or node upgrades the assessment from census-plus to staged operation.
2. REGISTRY-HUNT's deeper-Jira stage. It ran on lauterbourg's signature only (10 IPs). Does it propagate to the other three signatures, and do the wave's 22 collector-held canaries produce AWS calls?
3. GIT-VAULT's DigitalOcean trio. A second synchronized window settles the fourth-generation operator class question for the 144/142 walk; check whether the walks gain the object-hash fetch stage that would merge it with GIT-VAULT's №13 shape.
4. GO-SSH-SWEEP's oscillation and the unnamed concentrator. The sweep alternated record-concentrated → dispersed in two windows; and 4e066189c3bb… keeps intensifying on control-1 (14 IPs, ~13,000 sessions, fourteenth unnamed cycle) — characterize intent and consider naming it once it crosses a threshold again.
5. Bucklog .100's wordlist. Diff its 1,008-path set on a return; the SaaS-config and backup-archive classes are new to the kit.
6. GOWEB-PENTEST's third window. Verb and node switched each run so far; a third operator IP makes the commodity-tool read solid.
7. Held-inventory watch. 45.148.10.171 (40/6d), keyhunt's 8, SI-CENSUS's 27, the Feo Prest hoards, 34.124.231.201's 40 — any use beyond sts:GetCallerIdentity is a finding.
8. ai-devbox-1 history (ninth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
9. Canary section table gap. 87.120.104.29's 6 window mints missing from the per-collector table — fix belongs in the ops repo.

Digest: /data/flux-logs/reports/flux-digest-2026-10-10.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-10.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-10-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-10.md

Watch next cycle: (1) METADATA-HUNT — do the 40 minted canaries reach AWS, and does the code-execution kit return on a second node or runner? (2) REGISTRY-HUNT — does the 5-level Jira traversal spread beyond lauterbourg, and do the wave's 22 collector-held canaries get used? (3) GO-SSH-SWEEP — does the dispersed shape hold, does the /24 shell stage keep working the honeypot, and does 4e066189c3bb… cross back over the section floor on control-1?