FLUX FLEET — INTEL BRIEFING №49

Period: 2026-10-11 07:32 – 2026-10-12 07:32 UTC (24h, day 47 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 47-day baseline, every ≥3× result-tag spike attributed to a named actor or standing pool)

BLUF

ORACLE-SWEEP ran a second synchronized one-IP-per-sensor wave — five fresh Oracle Singapore hosts, the same 239-path WebSiphon/next-0.1 census, 3 mints — and is now a repeat fleet operator rather than a one-off. The mint→use funnel produced a new shape: one credential minted by Bucklog host 185.177.72.64 on control-1 was validated from 4 distinct AWS-side IPs (sts:GetCallerIdentity ×3 succeeded, bedrock:ListFoundationModels ×2 denied) — the first single-credential multi-egress use in the campaign's history; a second credential (minter 72.251.220.23, curl/8.7.1) drew GetCallerIdentity ✓ plus a denied s3:ListBuckets from one IP. GOWEB-PENTEST tripled its coverage in one cycle: three new operators hit three new nodes (sponge-01-ts, control-1, canary-farm-1), all GET-only, no captured credential body across six windows. MEGA-DICTIONARY ran its sixteenth replay on frantech-ts under a third 31173 Services AB host and grew +33 paths to 13,535 (akuma and nodewatchd dropper families new). Fleet-side: mint failures stayed at zero for a second window, the all-time mint counter passed 2,000 (2,042 issued rows), and all four XFF forgery counters sat at or near zero.

Key Judgements

1. ORACLE-SWEEP is a standing synchronized census operation. Five fresh Oracle SG IPs (146.235.22.78, 161.118.198.110, 134.185.90.18, 152.69.221.133, 140.245.112.148) ran one pass each on five sensors within a 10-hour span, each 239 events / 239 paths / 65 result families in under a minute, under the same honest WebSiphon/next-0.1 UA as №48 — new IP roster, identical tool. (High confidence — the one-IP-per-node pacing, wordlist size, and result mix match the registered №48 generation exactly; the campaign has now run twice on schedule.)
2. The credential use side has split from the mint side. 185.177.72.64 minted 2 canaries on control-1 at 23:36 EDT and one of them ran 5 operations from 4 distinct AWS-side IPs — every prior use event in this pipeline came from a single IP per credential (the №32 watch item). This reads as theft-to-handoff rather than self-validation, and it voids the "same-IP mint-and-use = self-use" heuristic as a general rule. (Moderate confidence — Tracebit ties the operations to that credential with high fidelity, but the 4 egress IPs are observed only as AWS-side sources, not linked to each other.)
3. GOWEB-PENTEST is a commodity tool circulating through rented egress, not an operator team. Six windows, six operators, six nodes, six ASNs (Oracle NL → Contabo FR → same-/16 neighbour → VNG VN → DigitalOcean IN → Link3 BD), one self-labeled UA, ~151–181 phpmyadmin-login GETs per pass, zero POSTs since №46. The fleet's login decoys absorb it at zero cost. (High confidence — the per-pass event count and UA are identical across all six runs.)
4. The MEGA-DICTIONARY artifact is actively maintained and shared between host classes. The sixteenth replay added 33 paths with zero drops (13,502 → 13,535, eleventh straight growth), including two new multi-arch dropper families (/bins/android/akuma_* ×19, /pack/agent/nodewatchd-linux-* ×8) — and the host ledger now shows 31173 Services AB running three replays. (High confidence — per-replay anti-join; the artifact has never lost a path.)

Active Campaigns (day 47 status)

ORACLE-SWEEP (Oracle-range .env+config census) ⟳ — SECOND CONSECUTIVE WINDOW (Hostile, active)

• Actors: 146.235.22.78 (canary-farm-1, 04:53 EDT), 161.118.198.110 (ru-edge-1, 06:10), 134.185.90.18 (netcup-ts, 09:28), 152.69.221.133 (ai-devbox-1, 14:52), 140.245.112.148 (frantech-ts, 14:12). All Oracle Corporation SG. All five IPs are new since №48's wave; no overlap between windows' rosters.
• TTPs: WebSiphon/next-0.1 (honest self-label), GET-only, 239 events / 239 paths / 65 families per node in under a minute — same census core as №48: .env variants, config bundles, CI/CD files, cloud-credential stores (/.aws/credentials, /service-account.json, /.oci/*), IaC, AI/LLM configs, OCI-specific paths. Kill-chain journeys are step-identical to №48's (tarpit/robots → sitemap → .env ladder → /.env [issued]). 3 mints: farm 04:53:20, ru-edge 06:10:25, aidev 14:52:33 EDT.
• Assessment: two windows, two rosters, one tool. The wave targets cloud-stored credentials broadly and mints what the canary nodes expose; the two no-canary sensors (netcup, frantech) saw the full census but produced nothing to steal. The 3 fresh canaries are hostile-held inventory. A third window confirms a fixed cadence — watch the roster rotation pattern.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — SECOND USE WINDOW, FIRST MULTI-EGRESS USE (Hostile, active)

• Actors: mint side 29 collector IPs; use side: 4 AWS-side IPs behind 185.177.72.64's credential (sources unobserved in flux logs) and 1 AWS-side IP behind 72.251.220.23's.
• TTPs: 7 use events across 2 credentials: 4× sts:GetCallerIdentity succeeded, 2× bedrock:ListFoundationModels denied, 1× s3:ListBuckets denied — all recurring operation classes, deny-all held, no ConsoleLogin or IAM attempt. The .64 credential ran GetCallerIdentity ×3 + ListFoundationModels ×2 across its 4 egress IPs; 72.251.220.23's credential (minted aidev 08:43 EDT under curl/8.7.1) drew GetCallerIdentity ✓ + ListBuckets ✗ from its single use IP.
• Assessment: 41 credentials reached 29 collectors; 0 mint failures (second clean window). The 4-egress split ends the pipeline's all-same-IP streak (11 of 13 use events had been same-IP through №48) and matches the campaign's №20 origin shape (separate egress, automated validation). Hoards: 45.148.10.171 43/6d (seventeenth consecutive minting window), 34.124.231.201 40/6d (absent), 80.94.92.65 19/6d (4 mints this window across 6 nodes), 87.120.104.29 12/6d (absent).

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — FOURTH TO SIXTH WINDOWS IN ONE CYCLE (Hostile, active)

• Actors: 58.84.1.216 (VNG Corporation, VN) on sponge-01-ts — 181 GETs / 1 path in 39 s (09:50 EDT); 139.59.74.7 (DigitalOcean, IN) on control-1 — 151 GETs / 1 path in 11 s (19:32); 27.147.153.210 (Link3 Technologies, BD) on canary-farm-1 — 151 GETs / 1 path in 29 s (15:32). None blocklisted.
• TTPs: unchanged — Go Web Pentest Tool UA, one phpMyAdmin login path hammered per pass, GET-only (the №47 verb), 0 POSTs, 0 mints.
• Assessment: three new operators and three new nodes in a single window ends any single-operator read: the tool is shared, the egress is rented per run, and the fleet's phpMyAdmin decoys are on a circulating target list. Six windows without one captured body keeps the intent read at login-surface probing.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — CONTRACTED WAVE, L9EXPLORE WIDENED (Borderline, active)

• Actors: 12 runner IPs minted 13 canaries in the 19:57–20:35 EDT evening wave — farm 7 (143.110.213.72, 157.245.113.227, 147.182.200.94, 209.38.248.17, 157.245.204.205, 143.244.168.161, +1), aidev 3 (159.89.127.165 ×2, 139.59.231.238, 206.81.24.227), control 2 (165.22.34.189, 128.199.182.55), ru-edge 2 (146.190.63.48, 157.245.113.227) — all DigitalOcean classes. Digest cluster 850993125b15: 6 IPs / 246 events farm-only; the 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry) appears on 4 sensors in the kill-chain table. 128.199.182.55 — №48's self-user — returned as a minter. LeakIX tools widened: l9explore/1.2.2 host 45.138.12.51 (Tc Datacenter LT) touched 5 sensors (440 events) and minted 3 (control 09:02, farm 00:38, aidev 02:50 EDT).
• TTPs: unchanged 27-family journey, 1 mint per IP at /.env; no deeper-Jira events this window.
• Assessment: the wave holds at reduced spread while its per-IP yield stays at 1 mint; LeakIX's own tooling is now a fleet-wide minting class of its own. Borderline per registry — a public leak-scanning service, reported separately from criminal actors.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — SIXTEENTH REPLAY, ELEVENTH STRAIGHT GROWTH (Hostile, active)

• Actors: 185.209.196.172 (31173 Services AB, DE, ipsum:2) on frantech-ts — the ASN's third replay host (№30: 185.213.155.227, №34: 193.32.126.191).
• TTPs: 13,535 events / 13,535 distinct paths in ~1 minute (00:48 EDT), GET-only, no companion probes. Anti-join against №48's set: +33 / −0 (13,502 → 13,535). New paths: /bins/android/akuma_* ×19 architectures, /pack/agent/nodewatchd-linux-* ×8 architectures, /bins/payloads/{c,w}.sh, /svc/u.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64. Host ledger: Datacamp ×5, tzulo ×3, 31173 ×3, Zenlayer ×2, Owl ×1.
• Assessment: the dictionary keeps growing under rotating hosting; the new families name current dropper infrastructure (akuma, nodewatchd). The deception surface absorbed 13,535 requests at zero cost.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — RETURN AFTER THREE IDLE WINDOWS (Hostile, active)

• Actors: 3 fresh IPs — 223.123.65.54 (frantech+lauterbourg), 202.155.18.56 (lauterbourg+control), 37.60.225.222 (frantech+ru-edge) — ~98 events / 44 paths each, 2 nodes per IP.
• TTPs: honest UA libredtail-http; phpunit-eval-stdin → cmd-injection-php-cgi-rce / cgi-traversal-rce-command / cmd-injection-apache-cgi-shell → docker-daemon-containers-list, plus kiteworks-root-redirect on the lauterbourg legs. Dropper stage unobserved — no POST bodies captured. 0 mints.
• Assessment: the execution-hunting kit resumed on schedule shape (~49 ev per node-run) with a fresh IP roster; the fleet's fake webshells and tarpits held. Watch for the dropper POST /bin/sh returning with a capture.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — THIRD WINDOW (Hostile, active)

• Actors: 45.138.12.25 (Tc Datacenter Limited, LT — the same block as №43's .27 and l9explore's .51) on lauterbourg-01-ts, 143 events / 7 families, 10:14 EDT.
• TTPs: full crawl shape — kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep-observed + webshell-probe + 101-path not-handled census.
• Assessment: three windows, three operator classes (Google BE ×2, AWS 16.216.88.x, Tc Datacenter LT ×2) fingerprint the Kiteworks decoy the same way. The LT block now links this campaign to REGISTRY-HUNT's l9explore tooling — correlation by hosting, not yet by operator.

AKAMAI-VHOST-SCAN (lauterbourg vhost + admin-surface census) ⚠ NEW — PROMOTED FROM WATCH (Hostile recon, active)

• Actors: 172.234.162.31 (Akamai Connected Cloud, FR, ipsum:3+firehol2) — second consecutive window, 231 events / 194 paths / 29 families in a ~1-minute pass (05:22 EDT). Class history: 172.104.241.92 and 172.105.76.7 (Akamai DE) ran third windows on lauterbourg in №46–№47.
• TTPs: kiteworks-root-redirect → /login [kiteworks-shell] → Citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk (1 POST, 441 bytes, body not captured) → /health → ColdFusion CFIDE → singles for Fortinet, Ivanti, Exchange OWA, Cisco WebVPN, GeoServer, Next.js, OpenAPI, and an ollama-version probe. One POST across two windows.
• Assessment: a VPN-gateway/admin-panel fingerprint sweep riding the lauterbourg TLS vhosts — breadth over depth, 0 mints across the class. The /sdk POST body is the collection gap; a second IP or a second node upgrades the read.

CREDSWEEP (.env-variant + credential census) ⟳ — 45.148.10.238 RETURNED (Hostile, active)

• Actors: 45.148.10.238 (Techoff Srv Limited, NL, ipsum:3+firehol2) on netcup-ts — first window for this IP since №17-era absences and its first netcup leg: 617 events / 348 paths in 3 minutes (21:57–22:00 EDT), 12 trap families.
• TTPs: the standing template — .env-variant directory fanout + config/AWS/SES paths under a 7-UA antique rotation with the Mozlila/5.0 (…Bulid/NRD90M…Moblie…) typo forgery intact (the registered check). 4 POSTs to / only (3–15 bytes, tarpit 302s, bodyPreview NULL). 0 mints.
• Assessment: a long-dormant standing operator is back with its forgery unchanged — the /24's siblings (.5 minted 1 on control 13:11 EDT, first; .171 on its seventeenth window) keep the family the fleet's most persistent census collector. The typo UA remains the identity check.

Watch-class singles (no campaign yet)

• 31.56.53.82 (Snowcore Inc, AE): frantech-ts, 342 events / 325 paths / 12 families over 6.5 h (07:32–13:58 EDT) under Chrome/123 — a dev-repo structure census: owns frantech's first-seen /bot/server.js, /frontend/README.md, /server/tsconfig.json, /backend/requirements.txt, /backend/ecosystem.config.js, /src/manage.py, /db/dump.sql, /deploy/Dockerfile, /CODEX.md, /payment-config, plus OpenAPI skeletons ×12 and .gitignore ×7. 0 mints, 0 POSTs. Register on a second node.
• 206.209.210.3 — third consecutive minting window (3 mints: farm ×2, control), 6 nodes touched lightly. The only collector on record to repeat across three windows after first appearance.
• 94.154.43.74 / .122 (OMEGA-SWEEP pool): 2 mints at 18:03 EDT under forged Chrome/147 — the /46 census stays absent (ninth window) but its pool keeps minting singles.
• TOKEN-CRAWLER pool — 45.198.224.124 and .125 touched all 8 sensors (~85 events each), /24 rotation intact, no mints, no POSTs: background per registry.
• 204.76.203.18 (Pfcloud, NL) — MALWARE-DICT loop on control-1 continues (2,122 events / 579 paths); sibling .219 touched all 8 nodes (32 events).
• Tarpit pools — 3e1c5eb879e7 83 IPs / 579 events on 7 sensors; php-cgi RCE cluster 7e61a9500d8b 14 IPs / 686 events on 6 sensors (includes the LIBREDTAIL legs); 218630667b2c control+ru-edge.
• 80.94.92.65 (SS-Net sibling): 4 mints across farm/aidev, 6 nodes touched, 19/6d — the primary .211 stayed out a second window.
• Feo Prest .154 (213.209.159.154) — ran sponge-01-ts (326 events / 322 paths, 06:19 EDT): a new node for the CREDSWEEP /24 pair; .175 absent.

Absent or paused

GIT-VAULT (Interserver .142 and the DO trio out; 12/6d hoard stands), ATLASSIAN-REST-PROBE (first absence after its №48 debut), METADATA-HUNT (second runner-absent window), CONFIG-SWEEP (second miss; 87.120.104.29 out, 12/6d held), NIGHTAGENT (fourth), EMPERORS-KIT (fourth), KEYHUNT (fourth), SI-CENSUS (fifth idle), OMEGA-SWEEP /46 census (ninth miss; pool singles minted 2), ENVRC-SWEEP, CF-FRONTED CREDSWEEP (ninth), KITEWORKS-CRAWL dedicated Google/AWS classes, LEAKIX-SSH network layer, SS-Net primary 80.94.95.211 (second), Bucklog census arm .38/.75/.9/.100/.205, Bochum crawler.

Standing actors (persistence check)

• 45.148.10.171 — seventeenth consecutive minting window: 5 mint rows across aidev/farm/control under the rotating antique-UA set; hoard 43/6d, still zero AWS use.
• 80.94.92.65 (SS-Net sibling) — 4 mints this window (19/6d), 6 nodes; the SS-Net family's active arm while .211 rests.
• 45.148.10.238 — returned after ~25 absent windows with the Mozlila/5.0 forgery intact; CREDSWEEP lineage confirmed by UA and wordlist shape.
• 204.76.203.18 (Pfcloud) — MALWARE-DICT loop, day 20+ on control-1, 2,122 events this window; the /24's sibling .219 probed all 8 sensors.
• REGISTRY-HUNT repeat minters — 157.245.113.227 (farm+ru-edge, 4/6d), 157.245.204.205 (3/6d), 206.81.24.227 (4/6d), 159.89.127.165 (3/6d), 139.59.231.238 (3/6d), 143.110.213.72 (3/6d): the evening-wave collector base persists across windows.
• 206.209.210.3 — three consecutive minting windows (3 mints this window), 6 nodes; the first collector to show this pattern.
• Tarpit pools + TOKEN-CRAWLER /24 — constant background; TOKEN-CRAWLER touched all 8 sensors again (45.198.224.124/.125).

Network-layer recon (Arkime) — 2026-10-11 07:32:00 → 2026-10-12 07:32:54 UTC

Fingerprint field ssh.hassh, destination port 22 · 117,771 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 72,175, bahrain-sponge-01-ts 27,647, sensor:bahrain-sponge-01-ts 27,647, frantech-ts 24,632, sensor:frantech-ts 24,632, sensor:lauterbourg-01-ts 20,183

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,867 sessions from 311 source IPs across 152 networks in 53 countries, port 22, avg 4,961 B/session. Networks: AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd.. Busiest sources: 61.43.121.132, 179.32.213.29, 43.173.111.217, 106.12.146.250, 202.165.22.102. Last 7 days: 10-06 297 IPs, 10-07 350 IPs, 10-08 309 IPs, 10-09 317 IPs, 10-10 344 IPs, 10-11 303 IPs, 10-12 99 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 21,638 sessions from 97 source IPs across 37 networks in 25 countries, port 22, avg 5,112 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS208137 Feo Prest SRL, AS213790 Limited Network LTD, AS150895 EZ TECHNOLOGY COMPANY LIMITED. Busiest sources: 109.160.32.135, 77.239.124.152, 109.160.32.139, 109.160.32.154, 109.160.32.36. Last 7 days: 10-06 98 IPs, 10-07 100 IPs, 10-08 66 IPs, 10-09 88 IPs, 10-10 116 IPs, 10-11 90 IPs, 10-12 41 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) contracted to 21,638 sessions (−7,120) from 97 IPs (−23) / 37 networks; its busiest sources stay the 109.160.32.x / 77.239.124.x addresses whose /24 uname survey ran on the frantech honeypot again this window (94 events per command from 7 IPs, example 109.160.32.36) — sweep, shells, and hardware inventory remain one operation. LIBSSH-MASSSWEEP (f555226df196…) held its ~310-IP plateau on day 23 (5,867 sessions / 152 networks). The window's biggest mover is the unnamed 16443846184e…: 16,506 sessions (+10,220) from 49 IPs (+21) / 21 networks — 15 days on record, now netcup's top fingerprint, still below the 50-IP dispersed floor. The control-1 concentrator 4e066189c3bb… ran its sixteenth day at 11,068 sessions (−7,083) from 18 IPs and stays unnamed. 98f63c4d9c87… (lauterbourg's top) eased to 3,886 sessions / 16 IPs. Two new fingerprints first seen today, both single-source and below thresholds (ssh-2.0-openssh_10.0p2 debian-7, 9 sessions; ssh-2.0-openssh_8.9p1 ubuntu-3ubuntu0.17, 8 sessions). recon-names.tsv unchanged — nothing crossed a naming threshold.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (7 use events across 2 credentials). Fleet sensors minted 41 credentials to 29 collector IPs; 2 credential(s) reached AWS. Use outcomes: 4 success, 3 failure. Denied operations: ListFoundationModels×2, ListBuckets×1. 4 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Attribution notes. 185.177.72.64 is the Bucklog SARL FR census arm — its credential is the funnel's first to split across 4 AWS-side egress IPs (5 ops: GetCallerIdentity ×3 ✓ + ListFoundationModels ×2 ✗), the /24's second mint→use after №44's .205 SES run. 72.251.220.23 minted on ai-devbox-1 under curl/8.7.1 at 08:43 EDT and self-used from one IP (GetCallerIdentity ✓ + ListBuckets ✗) — a new first-time collector that used its own credential inside the window. The REGISTRY-HUNT evening wave supplied 13 of the 47 digest mint rows (12 runners); l9explore 45.138.12.51 minted on 3 of its 5 touched sensors. First-time collectors this window: 72.251.220.23, 74.208.99.178, 80.87.206.148, 135.136.20.12, 162.254.24.228, 45.148.10.5, 152.69.221.133 (ORACLE-SWEEP), 94.154.43.74/.122, 143.244.168.161, 147.182.200.94, 209.38.248.17. Digest mint rows total 47 (farm 17 from 15 IPs, aidev 15 from 12, control 11 from 9, ru-edge 4 from 4); the Tracebit-side dedupe gives 41 credentials to 29 collectors. The 39 unused credentials stay hostile-held inventory until they expire — silent counts clamp at 0 when a window splits a mint from its use.

Fleet Observations

Canary economics. 47 digest mint rows; 41 credentials to 29 collectors after dedupe; 2 credentials used (7 events, 4 GetCallerIdentity successes, 3 denied operations). Mint failures: 0 — second consecutive zero-failure window. The fleet's all-time mint counter passed 2,000 (2,042 issued rows).

Attribution and TLS posture. XFF counters: any 1,068 / multi-entry 0 / ignored-internal 2 / single-entry mismatch 0 — a clean window after №48's 4-row noise from the registered benign method-fingerprint prober. Host census stays bare-IP-led on all 8 nodes; the TLS vhosts carried lauterbourg kiteworks 696 and canary-farm sso 387 events.

Volume moves and causes. ai-devbox-1 −39% (1,045): №48's GIT-VAULT and REST hammers aged out. canary-farm-1 −20% (1,644): the №48 ORACLE/GIT-VAULT/REGISTRY stack thinned to the ORACLE pass plus a lighter REGISTRY wave. ru-edge-1 −53% (808), netcup-ts −23% (1,353), sponge-01-ts −16% (1,109): the №44–№45 census traffic stays aged out; sponge's phpmyadmin spike (58.84.1.216, 182) is the node's largest single-IP load. control-1 +3% (3,089): the Pfcloud loop (2,122) offsets the quiet day. frantech-ts +2% (14,687): MEGA-DICT (13,535) replaces last cycle's replay at the same scale. lauterbourg-01-ts +15% (1,678): the Akamai scanner, KITEWORKS-CRAWL .25, the LIBREDTAIL legs, and 31.58.218.10's vhost probes.

Result-tag spike attribution. All three ≥3× spikes are GOWEB-PENTEST: farm+aidev+control phpmyadmin-login 8.9×/13.2×/39.0× — canary-farm-1 152 = 27.147.153.210 (151), control-1 152 = 139.59.74.7 (151), sponge-01-ts 182 = 58.84.1.216 (181); 45.138.12.51's l9explore passes add 1 phpmyadmin GET on each of 5 sensors and 31.56.53.82 adds 3 on frantech. No unexplained spikes.

control-1 discovery velocity. Day 29: 3,089 events from 115 unique IPs — inside the 84–157 band, twenty-first consecutive window. Discovery continues at baseline while event volume stays mid-band.

Digest quirks. NEW: the fleet-24h spot query prints its burst histogram under an hour_utc header, but the buckets carry local −04 times (MEGA-DICT's 00:48 EDT burst lands in the 10-12 00:00 bucket, not 04:00) — read histogram hours as EDT until the ops repo fixes the label. The +4 h ingest cast again pulls late-window actors into two digests — cross-check against №48 before counting pre-07:32-UTC actors as new (all five ORACLE-SWEEP passes above are genuinely new: №48's roster is fully disjoint). First-seen timestamps cluster at the 03:15/03:16 sync-arrival minutes — inventory, not timeline. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). The ai-devbox-1 rotated-file gap enters its eleventh cycle.

Fleet-side changes this cycle. flux-visuals.py CHAINS: +AKAMAI-VHOST-SCAN; KITEWORKS-CRAWL and LIBREDTAIL-KIT → active (returns); GIT-VAULT and ATLASSIAN-REST-PROBE → idle; notes updated for ORACLE-SWEEP, CREDENTIAL-DRAIN, REGISTRY-HUNT, GOWEB-PENTEST, MEGA-DICT, BUCKLOG-KIT, CREDSWEEP. TALKER_CAMPAIGNS +23 (incl. 172.234.162.31 promotion and the 45.138.12.51 relabel to REGISTRY-HUNT (l9explore)). recon-names.tsv unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-12.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 554 sources sent credentials → 415 got a shell (75%) → 324 ran a command (78% of shell-getters, 58% of sources). Event level: 17,657 credential attempts → 3,011 accepted logins → 3,545 commands (118% of accepted logins go on to run something). Telnet (commodity IoT botnets): 1,216 attempts, up from 866.

Twenty-second static command window. New commands: 0 of 92 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,128 events / 246 IPs; the key-replace chain at 1,004 / 230). The SS-Net block ran its PATH-export + uname loops at shell stage (80.94.92.55, 293+292 events); Techoff 62.171.133.1 continued its survey (101+101). The GO-SSH-SWEEP /24's uname survey ran again — uname -m | awk '{printf $1}' and uname -s -v -n -r -m at 94 events each from 7 IPs (example 109.160.32.36), the same /24 Arkime flags as the sweep's busiest sources.

Credential concentration persists. 11,296 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 1,074 attempts and root/3245gs5662d34 at 818 — the fixed-pair sprayers hold the funnel for a fourth window. No new pairs to report.

Gaps / Next Collection

1. The 4-egress Bucklog credential. Which AWS-side identities and ASNs sit behind the 4 use IPs; whether the credential draws more operations or a ConsoleLogin attempt before expiry; whether the second .64 mint follows it.
2. ORACLE-SWEEP's third window. Roster rotation pattern (fresh Oracle SG IPs each time so far), whether the 64-path short-leg behavior returns, and whether the campaign's 6 held canaries reach AWS.
3. 16443846184e…. 16,506 sessions / 49 IPs — the day's biggest network-layer mover, unnamed after 15 days. Name it if it re-disperses or crosses the 50-IP floor; a banner read would settle its relationship to GO-BANNER-SWEEP.
4. AKAMAI-VHOST-SCAN. Does the class leave lauterbourg; capture the /sdk POST body (441 bytes, unlogged preview) on a return.
5. 31.56.53.82's dev-repo census. A second node or window promotes it; the paths name a Node/Django project-layout wordlist worth tracking as an artifact.
6. GOWEB-PENTEST's first POST. Six windows GET-only; any POST return restarts the credential-capture question.
7. ai-devbox-1 history (eleventh cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
8. hp static streak. Twenty-two windows without a new command; the fixed-pair sprayers still own the funnel. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-12.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-12.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-12.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-12.md

Watch next cycle: (1) the 4-egress Bucklog credential — escalation past denied enumeration, and whether ORACLE-SWEEP's or REGISTRY-HUNT's fresh mints get used the same way; (2) ORACLE-SWEEP's third window — roster rotation and cadence confirmation; (3) 16443846184e… on netcup — naming decision if it crosses the dispersed floor, plus the fleet-24h histogram label fix in the ops repo.