FLUX FLEET — INTEL BRIEFING №48

Period: 2026-10-10 07:34 – 2026-10-11 07:34 UTC (24h, day 46 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 46-day baseline, every ≥3× result-tag spike attributed to a named actor or standing pool)

BLUF

ORACLE-SWEEP ended a 14-window absence with a new tool generation: five Oracle-range IPs, one per sensor on five nodes, ran a synchronized 239-path census under the new honest UA WebSiphon/next-0.1 — 2.5× the registered ~94-path core — and minted 3 canaries. The mint→use funnel produced its first AWS activity in three windows: two collectors validated their own canaries from the same IPs that minted them (209.97.180.8 and 128.199.182.55), with 3 sts:GetCallerIdentity successes; the deny-all policy held. A new campaign went fleet-wide on its first day: ATLASSIAN-REST-PROBE (signature 9609f17ada17, 9 IPs, 7 sensors) fingerprinted Confluence REST endpoints, and 87.120.204.145 hammered both EU nodes with 1,388 events and an 8-level archive traversal. The №23 GIT-VAULT-family watch single 209.159.155.142 (Interserver US) returned on both EU nodes at 2,765 events and minted 12 canaries — the largest haul in that campaign's record. MEGA-DICTIONARY ran its fifteenth replay (13,502 paths, +13); the two EU nodes closed +132% and +138% over baseline on the census waves while control-1 fell 52% to 1,641 events.

Key Judgements

1. Oracle-range census tooling returned upgraded and synchronized. Five IPs — 146.235.16.170, 146.235.22.78, 161.118.198.110, 161.118.211.119 (all Oracle Corporation SG) and 134.185.95.195 — ran one pass each on five nodes within a 7-hour span. Each pass hit 239 paths in 37–66 s under WebSiphon/next-0.1 and covered 65 result families: .env variants, config bundles, CI/CD files, cloud-credential stores, AI/LLM configs, and OCI-specific paths such as /oracle/oci_api_key.pem. The UA changed from forged Chrome/126 to an honest self-label, and the wordlist grew 2.5×. (High confidence — the one-IP-per-node shape, pacing, and .env-census core match the registered ORACLE-SWEEP profile; the sponge leg ran only 64 paths, so the roster may hold more than five operators.)
2. The mint→use funnel is live again, and the users are the minters. Tracebit fired 2 alerts: 3 sts:GetCallerIdentity calls succeeded from 209.97.180.8 (minted on ru-edge this window) and 128.199.182.55 (minted on canary-farm-1 on 10-08). Both are same-IP mint-and-use — the №44 pattern that previously marked REGISTRY-HUNT runners. (High confidence for the window — Tracebit alerts are direct evidence; a use outside the pull window would look identical to no use, per the standing caveat.)
3. A new Atlassian recon campaign reached 7 sensors on day one. Signature 9609f17ada17 probes /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, and /status — version fingerprinting for Confluence. The primary operator 87.120.204.145 (G-Core Labs) drove 1,388 events across the EU nodes with an 8-UA modern rotation and an 8-level ..:: archive traversal into com.atlassian.confluence.plugins.dashboard-actions; №47's REGISTRY-HUNT Jira traversal used 5 levels. (Moderate confidence — first window; the operator roster and intent remain open.)
4. GIT-VAULT's commodity template gained another operator class, and the newest one mints at scale. 209.159.155.142 (Interserver US), a №23 watch single, ran both EU nodes with 396 paths and 44 families each, a 5-stage UA rotation (git/2.39.0, bare Mozilla/5.0, Firefox/109, node, and first-seen git/2.47.3), full .git/hooks/ enumeration, and 12 mints (6 per node). (Moderate confidence — one window at this scale; a second window will settle the fourth-operator-class read.)

Active Campaigns (day 46 status)

ORACLE-SWEEP (Oracle-range .env+config census) ⟳ — RETURNED, NEW TOOL GENERATION (Hostile, active)

• Actors: 146.235.16.170 (control-1, pass 02:50 UTC), 161.118.211.119 (lauterbourg-01-ts, 03:13), 134.185.95.195 (sponge-01-ts, 03:16 — 64-path short leg, hosting unverified), 146.235.22.78 (canary-farm-1, 04:53), 161.118.198.110 (ru-edge-1, 06:10). One IP per node; no IP repeated across nodes.
• TTPs: WebSiphon/next-0.1 (honest, self-labeled; first fleet sighting), GET-only, 239 paths per node in 37–66 s (sponge leg 64 paths). Census covers .env variants (/.env*, /docker/.env, /app/.env, /.env.prod…), config bundles (/config.json, /settings.json, appsettings*.json, /application.properties), CI/CD (.gitlab-ci.yml, Jenkinsfile, .github/workflows/deploy.yml, azure-pipelines.yml, buildspec.yml, cloudbuild.yaml, appspec.yml), cloud credentials (/.aws/credentials, /service-account.json, /.azure/accessTokens.json, /.config/gcloud/application_default_credentials.json, /.oci/*, /oracle/oci_api_key.pem), IaC (terraform tfvars/tfstate, docker-compose ×5, k8s manifests, helm values), and AI/LLM paths (/litellm_config.yaml, /.cursor/mcp.json, /.mcp.json, /webui/.env, /flowise/.env, /anythingllm/.env, /dify/.env). 3 mints at /.env (control, farm, ru-edge — 1 each); 0 POSTs.
• Assessment: the campaign resumed with a broader wordlist and dropped its browser forgery for an honest label — the same upgrade path METADATA-HUNT took in №47 (census → honest labels → exploitation). The OCI-specific paths fit operators who run on Oracle Cloud and enumerate the credentials they know best. The 3 canaries are hostile-held inventory. Watch the 64-path sponge leg: it either trails the main tool or is a second, lighter worker.

ATLASSIAN-REST-PROBE (Confluence REST version fingerprinting) ⚠ NEW — fleet-wide first window (Hostile recon, active)

• Actors: primary 87.120.204.145 (G-Core Labs, JP-labeled): 694 events on each EU node (1,388 total, 331 paths per node, 8-UA rotation: Chrome/123, Chrome/124 in four platform variants, Firefox/125 in two, Safari/17.4; all not-handled, 0 mints) plus light touches on the other 6 sensors (1–10 events each). Lighter runners with the same UA set: 45.207.159.88 (14 events, aidev+farm) and 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb (9 events) at 14:24 — 7 minutes before .145's EU pass at 14:31. Single touches: 172.234.162.31 (lauterbourg), 139.162.33.108 (aidev). Digest cluster 9609f17ada17: 9 IPs / 216 events / 7 sensors.
• TTPs: the REST discovery set /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, /status, then the archive traversal /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::META-INF/MANIFEST.MF and 19 companion paths (8 ..:: levels; targets pom.properties, context.xml, urlrewrite.xml, spring.xml, log4j2.xml, ehcache.xml, dbcp.properties, confluence-plugins.properties). No hostile POST bodies were captured this window — the campaign is GET-only so far.
• Assessment: serverInfo returns the Confluence version; the archive traversal reads build identifiers from pom.properties. Together they fingerprint a Confluence install for exploit selection, and the deeper traversal (8 levels vs REGISTRY-HUNT's 5) suggests a newer exploit-chain toolkit. Zero mints and zero credential paths so far — recon, not collection. A second operator IP or node upgrades the assessment.

GIT-VAULT (git-internals walk) ⟳ — FOURTH OPERATOR CLASS, MINT CAPABILITY (Hostile, active)

• Actors: 209.159.155.142 (Interserver, US) on canary-farm-1 (1,400 events) and ai-devbox-1 (1,365), sequential passes 01:40–02:13 and 02:12–02:15. First window since №23, when it ran one node at low volume under git/2.39.0.
• TTPs: 396 paths / 44 families per node. Stages: git walk under git/2.39.0 (804+772 events) with full hooks enumeration — pre-commit, post-commit, pre-push, post-checkout, post-merge, pre-rebase, post-update, pre-auto-gc all fake-git-miss (1,310 total); config census under Firefox/109 (276+274, 4 mints each) and bare Mozilla/5.0 (284+284: sql-dump ×32, backup-archive ×16, application-properties ×28); a node-UA leg (24+23, 2 mints each); and a short git/2.47.3 stage (12+12, first-seen UA). Results also include env-production ×60, phpinfo ×24, webshell-probe ×24, wp-config ×20. 12 mints total.
• Assessment: the walk shape the fleet first saw at 396-path scale now carries a mint capability the campaign never had (prior classes: 0–1 mints per window). The UA ladder — honest git, bare Mozilla, forged Firefox, node, newer git — reads as tool staging rather than evasion noise. The 12 canaries are hostile-held inventory.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — CONTRACTED WAVE, TWO SELF-USES (Borderline, active)

• Actors: 11 runner IPs minted 1 canary each — farm 5 (138.197.191.87, 165.227.39.235, 206.189.233.36, 209.38.208.202, 128.199.182.55†), aidev 3 (142.93.129.190, 165.227.173.41, 167.99.210.137), control 1 (157.245.36.108), ru-edge 2 (164.90.228.79, 209.97.180.8) — all DigitalOcean classes; † = sibling of mapped runner 128.199.182.152, campaign link unproven. Journey signature 850993125b15 ran 6 IPs / 246 events on farm; the 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry catalog/tags/manifests) appears on 9 watchlist IPs across 4 sensors. l9explore/1.2.2 (45.138.12.51, Tc Datacenter LT) fell to a single lauterbourg touch.
• TTPs: unchanged 27-family journey; 1 mint per IP at /.env; no deeper-Jira events this window (№47's 5-level traversal stayed on lauterbourg's signature and did not run).
• Assessment: the wave contracted from ~49 IPs (№47) to ~11 while its yield changed qualitatively: two runners validated their own canaries in AWS rather than hold them. The fleet's longest-running template is again the funnel's main supplier.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — USE WINDOW AFTER TWO ZERO WINDOWS (Hostile, active)

• Actors: mint side 30 collector IPs; use side 209.97.180.8 and 128.199.182.55 (both also the minters).
• TTPs: 3 sts:GetCallerIdentity calls, all successful. No denied operations this window — the users stopped at identity validation.
• Assessment: 53 fresh credentials to 30 collectors, 0 mint failures (first clean window since №45). Same-IP mint-and-use is now 11 of 13 use events across the campaign's history — validation-before-resale or single-operator self-use remains the standing read. Hoards: 45.148.10.171 45/6d (sixteenth consecutive minting window; 8 this window — aidev 4, farm 2, control 2), 34.124.231.201 40/6d, 209.159.155.142 12 (new), 80.94.92.65 21/6d (absent), 87.120.104.29 12/6d (absent).

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — FIFTEENTH REPLAY, TENTH STRAIGHT GROWTH (Hostile, active)

• Actors: 23.234.118.20 (tzulo, inc., US, ipsum:1) on frantech-ts — the third tzulo host in the ledger (№23: 23.234.119.20, №34: 23.234.117.146).
• TTPs: 13,502 events / 13,502 distinct paths in 54 s (00:15:40–00:16:34), GET-only, 200+ router/IoT user agents (Tenda, TP-LINK, Xiaomi, MikroTik, UniFi, Synology, ZTE, Huawei HG532e, Roku, Dalvik, boa, RomPager, Micro_httpd, libwww-perl/6.68). Anti-join against №47's set: +13 / −0 (13,489 → 13,502). New paths: a GitLab-raw installer set /mogh739/metrics-agents/-/raw/main/* and its /mogh739/static-assets/ twin (11 paths: agent-install.sh, agentd-linux-{arm64,x64}, collector-legacy-linux-x64, collector-linux-{arm64,x64}), /d/432936b3a0439572/o/nnnnnede/init.sh2, /payload/1ay0eknhal4o/6lpiz8.sh.
• Assessment: the artifact grew again under a new host; the new GitLab-raw families name current operator infrastructure — a GitLab project that serves dropper installers. The deception surface absorbed the replay at zero cost.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — THIRD WINDOW, THIRD NODE (Hostile, active)

• Actors: 109.123.251.103 on lauterbourg-01-ts — same /16 as canary-farm-1's public IP (109.123.246.142). That is a hosting coincidence, not attribution. Prior: 158.178.159.133 (Oracle NL, №46), 167.86.124.4 (Contabo FR, №47).
• TTPs: 181 phpmyadmin-login GETs on 1 path in 1.1 s (07:37), 0 POSTs — the №47 verb.
• Assessment: three windows, three operators, three nodes, three ASNs, one self-labeled tool at ~181 events per pass. The commodity-tool read is now solid.

WP-FORM-BRUTE (distributed wp-login credential POST) ⟳ — ELEVENTH WINDOW, SAME CLASS (Hostile, background)

• Actors: signature 75df0dbb0841 (first seen №47): 5 IPs / 30 events on farm+aidev, each IP probe → 3 credential POSTs → probe. Background clusters ed66cc967251 (21 IPs / 84 events, wp-login+xmlrpc) and 2bdde2df2cf6 (6 IPs / 48) carried the rest; farm's wp-xmlrpc 3.1× spike (20) is scattered 1-event POSTs from rotating IPs.
• Assessment: the low-and-slow residential class persists at steady volume; no vhost or payload change observed.

Watch-class singles (no campaign yet)

• 172.234.162.31 (Akamai Connected Cloud, FR, ipsum:3+firehol2): lauterbourg, 234+5 events / 194 paths / 29 families in a 21-second pass under an Android SM-G981U UA, 1 POST: kiteworks-root-redirect → /login (kiteworks-shell) → Citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk → ColdFusion CFIDE — the third Akamai-class lauterbourg vhost scanner (after 172.104.241.92, 172.105.76.7) and a new /8 for the class.
• 79.124.58.82 (Tamatiya EOOD, BG): frantech 300 events / 150 paths in one minute — owns the node's webshell-probe 4.7× spike (34); the dockerenv shape from №45.
• 185.177.72.75 (Bucklog SARL, FR): frantech 1,819 events / 644 paths in 5 minutes under a 10-UA browser rotation with the Mozlila/5.0 typo forgery present, plus 4 POSTs (bodies not pulled this cycle). First .75 window on frantech at this size; the /24's census arm keeps widening its node coverage.
• 23.94.145.124: canary-farm-1, 11 webapp-form-profile events under 3 UAs — new form-probe actor, watch.
• 206.209.210.3: new collector, 3 mints on canary-farm-1 across two consecutive windows (10-10, 10-11) — the first new collector to repeat across windows on record.
• 129.213.151.234 (research-scan/1.0, Oracle — registry borderline): returned; 4 backup-archive events on farm and minted 1 canary. Honest-UA collectors that mint stay on the report list.

Absent or paused

METADATA-HUNT (runner absent after the №47 return — its 34.124.231.201 pass re-appears in today's digest tables only through the +4 h cast overlap; 40/6d hoard unchanged), CONFIG-SWEEP (first miss in six windows; 87.120.104.29 out, 12/6d held), NIGHTAGENT (third absence), EMPERORS-KIT (third), KEYHUNT (third), SI-CENSUS (fourth idle), OMEGA-SWEEP (eighth consecutive /46 miss; no pool singles this window), ENVRC-SWEEP, CF-FRONTED CREDSWEEP (eighth), KITEWORKS-CRAWL dedicated classes (fourth absence; the vhost carried GOWEB-PENTEST and the Akamai scanner), LEAKIX-SSH network layer, SS-Net sibling 80.94.92.65 (second absence — the primary 80.94.95.211 returned, see Standing actors).

Standing actors (persistence check)

• 45.148.10.171 — sixteenth consecutive minting window (8 mints: aidev 4, farm 2, control 2), hoard 45/6d, still zero AWS use.
• Feo Prest pair (213.209.159.154 / .175) — both ran control's backup-archive census (20 events each; .154 under Chrome/4.0.224.2, .175 under MSIE/4.01 Windows CE). .154 also hit netcup (326 paths in 6 s, MSIE/7.0 .NET UA) and control (72 events / 15 families / 2 mints). CREDSWEEP lineage, 4/6d combined.
• 80.94.95.211 (SS-Net primary) — returned on aidev: 20 backup-archive events under an Android Chrome/45 Mobile UA plus 2 mints (8/6d). First window after two misses.
• REGISTRY-HUNT repeat minters — 142.93.129.190, 165.227.173.41, 167.99.210.137, 206.81.24.227, 209.38.208.202, 138.197.191.87: 2+ windows each.
• Tarpit pools — 3e1c5eb879e7 80 IPs / 559 events on 7 sensors; 4b4cc0ece037 23 IPs / 161 events on 4; php-cgi RCE cluster 7e61a9500d8b 5 IPs / 245 events on 4. These pools own frantech's tarpit-module 5.3× spike (1,414).
• 204.76.203.18 (Pfcloud, NL) — MALWARE-DICT loop on control-1 continues (413 events).

Network-layer recon (Arkime) — 2026-10-10 07:34:00 → 2026-10-11 07:34:47 UTC

Fingerprint field ssh.hassh, destination port 22 · 110,019 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 80,393, bahrain-sponge-01-ts 36,464, sensor:bahrain-sponge-01-ts 36,464, frantech-ts 22,274, sensor:frantech-ts 22,274, sensor:lauterbourg-01-ts 13,870

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,568 sessions from 309 source IPs across 144 networks in 55 countries, port 22, avg 4,913 B/session. Networks: AS16276 OVH SAS, AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS4766 Korea Telecom. Busiest sources: 43.133.140.5, 60.250.246.239, 162.243.147.237, 165.231.143.109, 2.26.83.92. Last 7 days: 10-05 360 IPs, 10-06 297 IPs, 10-07 350 IPs, 10-08 309 IPs, 10-09 317 IPs, 10-10 344 IPs, 10-11 91 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 28,758 sessions from 120 source IPs across 49 networks in 30 countries, port 22, avg 5,081 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS208137 Feo Prest SRL, AS213790 Limited Network LTD, AS150895 EZ TECHNOLOGY COMPANY LIMITED. Busiest sources: 109.160.32.151, 77.239.124.150, 77.239.124.146, 109.160.32.48, 109.160.32.132. Last 7 days: 10-05 112 IPs, 10-06 98 IPs, 10-07 100 IPs, 10-08 66 IPs, 10-09 88 IPs, 10-10 116 IPs, 10-11 35 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) re-grew to 28,758 sessions (+4,466) from 120 IPs (+36) / 49 networks. Its busiest sources are again the 109.160.32.x and 77.239.124.x addresses, and that /24's uname survey ran on the frantech honeypot this window (1,335 events per command from 8 IPs) — sweep, shells, and hardware inventory remain one operation. LIBSSH-MASSSWEEP (f555226df196…) held day 22 at 309 IPs (−11). The unnamed concentrator 4e066189c3bb… grew to 18,151 sessions (+5,152) from 22 IPs on control-1 — fifteenth day on record, still unnamed, still below the 50-IP dispersed floor. The window's biggest mover is 98f63c4d9c87…: 5,007 sessions (+4,653) from 17 IPs, today's top fingerprint on ai-devbox-1 (12 days on record, 97-IP peak). control-1 absorbed 36,464 inbound sessions from 225 sources — the fleet's heaviest target again; frantech took 22,274 from 2,801 sources. No new fingerprints; recon-names.tsv unchanged.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (3 use events across 2 credentials). Fleet sensors minted 53 credentials to 30 collector IPs; 2 credential(s) reached AWS. Use outcomes: 3 success. 3 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Attribution notes. 209.97.180.8 is a REGISTRY-HUNT runner from this window's wave (the 27-family docker-registry journey on ru-edge); 128.199.182.55 minted on canary-farm-1 on 10-08 and is a /24 sibling of mapped runner 128.199.182.152 — campaign link unproven. The wave's new first-time collectors: 206.209.210.3 (3 mints), 45.43.62.50, 64.89.163.14, 167.172.232.142, 178.128.0.112, and the ORACLE-SWEEP trio. Digest mint rows total 96 (farm 64 from 15 IPs, aidev 18 from 9, control 10 from 7, ru-edge 4 from 4); the Tracebit-side dedupe gives 53 credentials to 30 collectors.

Fleet Observations

Canary economics. 96 digest mint rows; 53 credentials to 30 collectors after dedupe; 2 credentials used (3 events, 3 GetCallerIdentity successes). Mint failures: 0 — the first zero-failure window since №45 (№46: 11×400, №47: 17×400). The fleet's all-time mint counter passed 2,000 (2,001 issued rows).

Attribution and TLS posture. XFF counters: any 3,610 / multi-entry 0 / ignored-internal 198 / single-entry mismatch 4 — the six-window clean streak ended, and the counter worked as designed. All 4 rows are 162.243.83.227 (the registered HTTP method fingerprint prober) asserting X-Forwarded-For: 1.2.3.4 on / GETs to control-1 and ai-devbox-1 (2 events each, empty + bare Mozilla/5.0 UA pairs); socketPeer named the real source in every row. A shallow prober picking its own attribution is attribution noise, not a laundering campaign — pivot rules held. Host census stays bare-IP-led on all 8 nodes.

Volume moves and causes. canary-farm-1 +132% (4,084): ORACLE-SWEEP, the .142 GIT-VAULT pass, and the REGISTRY-HUNT wave. ai-devbox-1 +138% (3,473): the same actors plus .145's 694-event REST hammer. lauterbourg +50% (1,955): GOWEB-PENTEST, the WebSiphon pass, and the Akamai vhost scanner. frantech-ts +14% (16,160): the MEGA-DICT replay and the tarpit pools. control-1 −52% (1,641): №47's Bucklog census and the Pfcloud loop (413 vs 1,871) aged out. netcup-ts −43% (1,006), ru-edge-1 −44% (992), sponge-01-ts −60% (585): the №44–№45 census traffic aged out; bare-floor windows for the deception nodes.

Result-tag spike attribution. Every ≥3× spike has a named cause: farm+aidev fake-git 4.0×/3.6×, fake-git-miss infx/7.7×, not-handled 10.6×/10.2× = 209.159.155.142 (946 fake-git + 1,310 fake-git-miss across the pair) with .145's REST hammer on not-handled; farm+aidev backup-archive = .142 (8+8) and 80.94.95.211 (20 on aidev); farm config-json 3.3× and env-production 3.3× = the WebSiphon census; farm webapp-form-profile 3.9× (21) = 23.94.145.124 (11) + the 34.124.231.201 cast-overlap rows (6); farm wp-xmlrpc-post 3.1× = scattered 1-event singles; control backup-archive 3.5× (40) = Feo Prest .154 (20) + .175 (20); frantech tarpit-module 5.3× (1,414) = the standing tarpit pools; frantech webshell-probe 4.7× (34) = 79.124.58.82; lauterbourg phpmyadmin-login 42× (182) = GOWEB-PENTEST 109.123.251.103 (181).

control-1 discovery velocity. Day 28: 1,641 events from 111 unique IPs — inside the 84–157 band, twentieth consecutive window. The event count is the quietest in the band; unique-IP discovery is unaffected.

Digest quirks. The +4 h cast overlap put 34.124.231.201's №47 pass into today's top-talker and kill-chain tables (374 events) and its 6 webapp-form-profile rows into the farm spike — cross-check against №47 before counting any pre-07:34-UTC actor as new. First-seen timestamps again cluster at the 03:15/03:16 sync-arrival minutes — inventory, not timeline. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). The ai-devbox-1 rotated-file gap enters its tenth cycle.

Fleet-side changes this cycle. flux-visuals.py CHAINS: +ATLASSIAN-REST-PROBE; ORACLE-SWEEP → active (returned, new generation); CONFIG-SWEEP and METADATA-HUNT → idle; notes updated for GIT-VAULT, REGISTRY-HUNT, CREDENTIAL-DRAIN, MEGA-DICT, GOWEB-PENTEST. TALKER_CAMPAIGNS +13. recon-names.tsv unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-11.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 541 sources sent credentials → 404 got a shell (75%) → 328 ran a command (81% of shell-getters, 61% of sources). Event level: 21,864 credential attempts → 3,940 accepted logins → 5,899 commands (150% of accepted logins go on to run something). Telnet (commodity IoT botnets): 866 attempts, up from 730.

Twenty-first static command window. New commands: 0 of 56 distinct. The GO-SSH-SWEEP /24's uname survey ran again: uname -m | awk '{printf $1}' and uname -s -v -n -r -m at 1,335 events each from 8 IPs (example source 109.160.32.169) — the same /24 Arkime flags as the sweep's busiest sources. The .ssh replant pair stayed dominant: cd ~; chattr -ia .ssh; lockr -ia .ssh at 994 events / 227 IPs and the key-replace chain at 858 / 204. The SS-Net block appeared at the shell stage: 80.94.92.55 ran the PATH-export + uname loop at 146 events / 6 IPs. The Techoff host 62.171.133.1 continued its survey (95 events).

Credential concentration persists. 14,430 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 942 attempts and root/3245gs5662d34 at 715 — the fixed-pair sprayers hold the funnel for a third window. No new pairs to report.

Gaps / Next Collection

1. ATLASSIAN-REST-PROBE's next move. Does the serverInfo fingerprinting graduate to Confluence exploit stages? The 8-level archive traversal already reads build identifiers. A second operator IP or node firms up the roster.
2. ORACLE-SWEEP's new generation. Do the wave's 3 mints or the 53 collector-held credentials reach AWS? Does the 64-path sponge short leg grow to the full 239-path census? A second window settles the operator count.
3. The two self-using runners. 209.97.180.8 and 128.199.182.55 stopped at GetCallerIdentity. Escalation to denied enumeration (the №44 shape) is the finding to watch.
4. GIT-VAULT's Interserver class. A second window at this scale settles the fourth-operator-class question. Check whether git/2.47.3 replaces git/2.39.0 as the walk's primary stage.
5. 4e066189c3bb… on control-1. 18,151 sessions (+5,152) from 22 IPs — fifteenth day, still unnamed, still under the 50-IP dispersed floor. Name it if it crosses or if its per-IP volume pattern resolves.
6. Bucklog .75's POST bodies. The census arm ran GET-only to date. Pull bodyPreview on its next window.
7. ai-devbox-1 history (tenth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
8. hp static streak. Twenty-one windows without a new command; the fixed-pair sprayers (345gs5662d34 942 + root/3245gs5662d34 715) still own the funnel. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-11.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-11.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-11.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-11.md

Watch next cycle: (1) ORACLE-SWEEP's WebSiphon generation — a second node set or IP roster, and whether the wave's 3 mints reach AWS. (2) ATLASSIAN-REST-PROBE — spread beyond 87.120.204.145's EU hammer, and any exploit-stage payloads after the version fingerprinting. (3) CREDENTIAL-DRAIN — do the two self-using runners escalate past GetCallerIdentity, and does the funnel repeat with the ORACLE-SWEEP or GIT-VAULT mints?