FLUX FLEET — INTEL BRIEFING №50

Period: 2026-10-12 07:33 – 2026-10-13 07:33 UTC (24h, day 48 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 48-day baseline, every ≥3× result-tag spike attributed to a named actor or standing pool)

BLUF

The mint→use funnel ran its largest use window on record: 5 credentials / 28 AWS events, led by a synchronized Contabo pair — IPv4 169.58.180.111 and IPv6 2a02:c207:2350:9697::1, the funnel's first IPv6 collector — that started minting on ai-devbox-1 and canary-farm-1 at 08:22 EDT 10-12 and validated their own canaries with EC2 enumeration classes; a third credential was used from 131.193.125.163, a University of Illinois at Chicago address that never appears in flux logs. ORACLE-SWEEP ran its third consecutive window on three sensors under a fresh Oracle Singapore roster and widened its census ~60% to 384 paths, minting 2. Fleet volume on the deception-only nodes moved for a benign reason: Ruhr-Universität Bochum's self-identifying softsec research crawler (~4,500 events at /, honest UA, zero mints) drove sponge-01-ts +179% and netcup-ts +130%, all absorbed by tarpits. MEGA-DICTIONARY ran its seventeenth replay and grew +19 paths to 13,554; REGISTRY-HUNT reached all 8 sensors; SI-CENSUS returned on 4 sensors and minted 6, meeting its promotion trigger; GOWEB-PENTEST opened three more operator/node pairs (windows seven through nine). Mint failures stayed at zero for a third window.

Key Judgements

1. The funnel now has a self-service tier alongside the hoard tier. The Contabo pair minted 20 canaries and self-used 4 of them inside the window from one IP per credential (sts:GetCallerIdentity ✓; denied GetServiceQuota, DescribeInstances, DescribeRegions, DescribeInstanceTypes, ListNotebookInstances) — the same mint-and-consume shape №44–№45 and №48 saw, now from a coordinated IPv4+IPv6 pair that began minting at the same minute. (High confidence — Tracebit per-alert logs tie each use to its credential; the 08:22:xx EDT mint starts and the identical EC2 operation classes link the two collectors.)
2. ORACLE-SWEEP is a scheduled census operation with a maintained wordlist. Third window, third fully fresh Oracle SG roster, one pass per sensor, same honest WebSiphon/next-0.1 UA — and the census grew from 239 to 235–384 paths with new k8s, Terraform, Firebase, and AI-config families. (High confidence — pacing, UA, and result mix match the registered №48–№49 generations; the additions are counted from per-IP path sets.)
3. This cycle's biggest fleet-volume moves are benign research scanning, not hostile load. Two Ruhr-Universität Bochum hosts under Software Security Research/1.0 (+https://*.softsec.ruhr-uni-bochum.de) produced 2,425 of sponge-01-ts's 3,324 events and 2,092 of netcup-ts's 3,676, hammering / and language variants into tarpits at zero fleet cost. Fleet-volume math should net them out. (High confidence — honest self-identifying UAs, 10–14 paths, 0 POSTs, 0 mints.)
4. SI-CENSUS's return re-arms the fleet's largest single-block credential hoard. 102.220.161.139 came back after five idle windows with the full census+mint shape: 1,518 events on 4 sensors and 6 fresh mints, on top of the 27 ru-edge credentials it already holds — 33 held canaries from one /24, zero observed AWS use. (Moderate confidence — the mints and census are observed; the block has contracted to near-zero twice before, and use remains unobserved.)

Active Campaigns (day 48 status)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — THIRD USE WINDOW, RECORD (Hostile, active)

• Actors: mint side 80 credentials to 32 collector IPs. Use side: 2 credentials behind 169.58.180.111 (Contabo GmbH, FR), 2 behind 2a02:c207:2350:9697::1 (Contabo, IPv6 — the funnel's first IPv6 collector), 1 behind 131.193.125.163 (University of Illinois at Chicago, AS6200 — outside the flux window; Tracebit is the only witness).
• TTPs: 28 use events — 6× sts:GetCallerIdentity ✓, 22 denied: GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2. Both Contabo collectors minted from 08:22 EDT 10-12 (9 + 11 mints across ai-devbox-1 and canary-farm-1) and each used 2 of its own credentials from 1 IP — EC2 enumeration classes; the IPv6 credential also drew ListBuckets. All successes were GetCallerIdentity; deny-all held; no ConsoleLogin or IAM attempt. 0 mint failures — third consecutive clean window.
• Assessment: the campaign now shows three use shapes: self-use (Contabo pair, №44's LeakIX pair, 72.251.220.23), handoff (№49's 4-egress Bucklog credential), and unattributed single use (UIC). The 75 unused credentials stay hostile-held inventory until TTL. Hoards: 45.148.10.171 45/6d (18th minting window), 34.124.231.201 40/6d, 102.220.161.102 27/6d, 80.94.92.65 15/6d, 208.84.100.218 10/6d.

ORACLE-SWEEP (Oracle-range .env+config census) ⟳ — THIRD WINDOW, CENSUS WIDENED (Hostile, active)

• Actors: 168.107.90.53 (Oracle SG, /24 sibling of №12's 168.107.91.14) on control-1 — 235 ev / 235 paths in 107 s, 09:48 EDT, 1 mint; 161.118.208.28 on lauterbourg-01-ts — 320 / 320, 15:46 EDT; 161.118.206.143 on canary-farm-1 — 384 ev / 384 paths / 84 families in 86 s, 18:50 EDT, 1 mint. All fresh since №49; no roster overlap with №48–№49.
• TTPs: honest UA WebSiphon/next-0.1, GET-only, one census pass per sensor. The wordlist grew ~60% over the 239-path №48/№49 core — new families observed on the farm pass: k8s-secret-manifest, kubeconfig, terraform-tfstate/terraform-tfvars, firebase-json, litellm-config, openai-config-flat, doctl-config, streamlit-secrets, vercel-json, aws-amplify-exports, plus ssh-private-key-error/authorized-keys-error probes. Journey shape unchanged (tarpit/robots → sitemap → .env ladder → /.env [issued]).
• Assessment: three windows, three rosters, one maintained tool — the cadence read from №49 holds. The census now targets IaC state, k8s secrets, and AI stacks, not only .env files. The 2 fresh mints (farm, control) bring the campaign's held canaries to 5 across two windows; all remain unused.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — ALL-8 WAVE (Borderline, active)

• Actors: l9scan runners on every sensor — canary-farm-1: 167.71.81.114 (123 ev, 3 mints), 64.227.70.2, 138.68.144.227, 167.172.232.142; ai-devbox-1: 167.172.158.128, 167.99.182.39, 157.245.105.107, 159.89.12.166 (41 ev, 1 mint each); control-1: 165.227.84.14 + 139.59.231.238 (1 mint each); ru-edge-1: 46.101.111.185 + 147.182.200.94 (1 mint each); single-pass 39-ev legs on frantech-ts (206.189.95.232), sponge-01-ts (167.71.175.236), netcup-ts (134.122.28.88); kiteworks-vhost legs 206.81.12.187, 165.22.235.3, 167.99.182.39 (40 ev each, lauterbourg). All DigitalOcean classes. l9explore 45.138.12.51 (Tc Datacenter LT): 87 ev / 1 mint on ai-devbox-1, 6/6d. ~14 mint rows from the class.
• TTPs: unchanged 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry), 1 mint per runner at /.env; no deeper-Jira events this window.
• Assessment: the widest spread since №46, now including all three deception-only nodes and the lauterbourg TLS vhost at ~40 ev per leg. Repeat minters from №49 (147.182.200.94, 139.59.231.238, 167.99.182.39, 159.89.12.166, 157.245.105.107) mark a persistent collector base behind the rotating roster. Borderline per registry — a public leak-scanning service, reported separately from criminal actors.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — SEVENTH TO NINTH WINDOWS (Hostile, active)

• Actors: 103.242.78.199 (Universitas Muhammadiyah Jember, AS151541, ID) on canary-farm-1 — 151 GETs / 1 path in 39 s, 09:32 EDT; 188.166.218.48 (DigitalOcean SG) on control-1 — 151 / 1 in 22 s, 13:54 EDT; 172.104.173.62 (Linode, Akamai Connected Cloud SG) on lauterbourg-01-ts — 151 / 1 in 49 s, 04:52 EDT. None blocklisted. All three nodes are first-time targets for this campaign.
• TTPs: unchanged — Go Web Pentest Tool UA, one phpMyAdmin login path per pass, GET-only, 0 POSTs, 0 mints.
• Assessment: nine windows, nine operators, nine nodes, nine ASNs — the commodity-tool read is settled; the fleet's phpMyAdmin decoys sit on a circulating target list, and one operator now rides a university network. A captured credential body remains the missing evidence for intent.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — SEVENTEENTH REPLAY (Hostile, active)

• Actors: 23.234.118.20 (tzulo, Inc. US, ipsum:1) on frantech-ts — the tzulo ASN's third replay host (№23: 23.234.119.20, №34: 23.234.117.146).
• TTPs: 13,554 events / 13,554 distinct paths in 54 s (23:56:24–23:57:18 EDT), GET-only, no companion probes, 200+ router/IoT/device UAs (Tenda, TP-Link, D-Link, Wavlink, Synology, MikroTik, Ubiquiti, Huawei, Xiaomi, Phicomm, Ruijie, FAST, Mercury, WD My Cloud, plus Python-requests/OkHttp singles). Anti-join against №49's set: +19 / −1 (13,536 → 13,554 as measured). New: /bins/dvr/akuma_* ×13 architectures + /bins/telnet/akuma_x64 (the akuma family grows into dvr/telnet dirs), /armv7-l7 + /x64s-l7 (L7-filter variants), /enroll.sh, /nezha-agent, /in, /ront. 0 mints.
• Assessment: twelfth consecutive growth-or-hold replay; the dictionary keeps absorbing current dropper infrastructure names (akuma, nezha-agent). The deception surface absorbed 13,554 requests at zero cost.

SI-CENSUS (102.220.161.x multi-template census) ⟳ — RETURN, PROMOTION MET (Hostile, active)

• Actors: 102.220.161.139 (VPS Dedicated LLC, SI) on 4 sensors — control-1 845 ev / 41 families / 559 paths, ai-devbox-1 348 / 39 / 337, ru-edge-1 321 / 18 / 290, canary-farm-1 light; 09:24–09:59 EDT; 1,518 events total.
• TTPs: the registered template — .env directory fanout (env-production ×211 node-wide), fake-git walk (fake-git 264+ on control), config censuses, and a UA rotation now including ClaudeBot, GPTBot, and Googlebot forgeries alongside Chrome 125/126 and Firefox 127. 6 mints: control 3, ru-edge 2, aidev 1.
• Assessment: the block's promotion trigger ("any census or mint run") is met twice over. The /24 now holds 33 fleet canaries (27 ru-edge from №44 + these 6) with zero observed AWS use — the largest single-block hoard we track.

INFOCREST-KIT (composite adminer/wp-batch kit) ⟳ — SEVENTH OPERATOR (Hostile, active)

• Actors: 173.249.253.116 (tzulo, Inc. US) on lauterbourg-01-ts, ai-devbox-1, canary-farm-1 — 765 events, 30 POSTs, 23:05–00:04 EDT; 6 mints (aidev 3, farm 3).
• TTPs: the registered composite anatomy — tarpit cycling → phpmyadmin-login ×60 → adminer prod_rw POSTs with a fresh 22-char password per attempt (y6BURr5uveZT_CgBSbVP7w, t60rl7Ls-JPLsVBDfD1S3Q, body verbatim: auth%5Bdriver%5D=server&auth%5Bserver%5D=&auth%5Busername%5D=prod_rw&auth%5Bpassword%5D=…&auth%5Bdb%5D=) → webapp-config-bundle-js census ×120 → wp-batch multiplex (207 responses nesting {"requests": [{"method": "POST", "path": "///"}, {"method": "POST", "path": "/wp/v2/posts", …) + tomcat-path-bypass-env ×30. New stage: webapp-form-login ×6 with user=root&pass=wrong (NightAgent's login body) + kiteworks-vhost legs on lauterbourg. No phpunit verify or dropper body captured.
• Assessment: a seventh operator runs the kit on three nodes at once — first lauterbourg legs, first form-login stage, and the fleet's second tzulo-hosted campaign this window (MEGA-DICT is the other). The 6 mints are the kit's largest haul; watch them for AWS use.

MEVSPACE-GITWALK (git-internals walk, stale Firefox/78) ⟳ — REVIVED, WORDLIST EXPANDED (Hostile, active)

• Actors: 159.223.234.149 (DigitalOcean NL) on ru-edge-1 — 143 fake-git in 2.5 s, 17:48 EDT; 178.62.42.21 (DigitalOcean UK) on control-1 — 143 in 3 s, 00:56 EDT 10-13. Third and fourth operators under the template; both fresh.
• TTPs: stale Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 UA intact. Wordlist expanded with environment-named refs — first-seen this window: /.git/refs/heads/{stg,sandbox,nightly,stage,demo,canary}, /.git/refs/remotes/origin/{stable,beta}, /.git/logs/refs/heads/{stage,demo,bugfix}, /.git/logs/refs/remotes/origin/testing. 0 mints.
• Assessment: the fake-git spike (ru-edge 20.3×, control 5.7×; fake-git-miss 41.5×/16.6×) is fully attributed to this pair plus SI-CENSUS .139's walk. The env-named-ref expansion continues the wordlist drift №9 documented; the served decoy HTML keeps feeding it.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — EIGHTH WINDOW (Hostile, active)

• Actors: six fresh IPs, all runs on ai-devbox-1, 37 ev each: 103.183.69.112 (08:40 EDT), 107.150.123.48 (14:39), 104.234.186.154 (20:11), 107.173.53.218 (22:27), 124.158.13.141 (23:38 — also frantech-ts), 103.79.184.145 (02:18 EDT 10-13). 124.158.13.141 is the only cross-node runner.
• TTPs: honest UA libredtail-http; phpunit-eval-stdin → cmd-injection-php-cgi-rce / cgi-traversal-rce-command on three runs. Dropper stage unobserved — no POST bodies captured. 0 mints. The kit owns aidev's phpunit-eval-stdin 4.4× spike (226 events) and cmd-injection-php-cgi-rce 4.0× (27).
• Assessment: the execution-hunting kit now concentrates on the AI/dev surface — six passes on one node in one window is its densest day. The fleet's fake webshells and tarpits held; the dropper POST remains the unobserved stage.

CONFIGBUNDLE-SWARM (config-bundle census + .env mints) ⟳ — NEW OPERATOR CLASS (Hostile, active)

• Actors: 167.99.79.44 (DigitalOcean SG) under Chrome/81 — 137 events / 20 paths across control-1, ru-edge-1, canary-farm-1, ai-devbox-1 in 19 min (17:35–17:55 EDT).
• TTPs: the registered 20-path webapp-config-bundle-js census + 7 /.env mints (farm 3, aidev 2, control 1, ru-edge 1) — the swarm's largest single-IP mint haul, against 1–3 per IP in prior classes.
• Assessment: third operator block (after 45.154.138.x and Linode 45.79.200.28) and a step-change in mint rate. The 7 held canaries are hostile-held inventory; check the 6d window before claiming any never saw use.

EMPERORS-KIT (self-labeled EmperorsTools webshell kit) ⟳ — RETURN AFTER FOUR IDLE WINDOWS (Hostile, active)

• Actors: 150.241.66.127 (Kyonix Networks US) — the original and only operator — on control-1 (22 phpmyadmin-login, 04:24–05:47 EDT) and canary-farm-1 (22, 04:00–04:16), Chrome/91 forgery.
• TTPs: phpMyAdmin surface pressure only this window; 0 mints; the phpunit verify and the GitHub dropper were not re-observed.
• Assessment: the kit's operator is alive and back on cadence; the execution stages remain the watch item.

BUCKLOG-KIT census arm ⟳ — FRANTECH LEG, SIBLING MINT (Hostile, active)

• Actors: 185.177.72.75 (Bucklog SARL FR) on frantech-ts — 999 ev / 264 paths / 5 families in 6 min (21:35 EDT), first census-arm run on this node; 15 POSTs. Sibling 185.177.72.49 minted 1 on control-1 (19:06 EDT).
• TTPs: 11-UA modern rotation (Chrome 131 ×4 platforms, Firefox 134, Safari 18.2, Edge 131, iPhone 18.2, Android 14) including the CREDSWEEP Mozlila/5.0 (…Bulid/NRD90M…Moblie…) typo forgery (79 ev) — the /24 now carries the typo UA too.
• Assessment: the /24 keeps spreading across nodes (.64's №49 multi-egress use, .49's mint, .75's frantech census). The typo-UA overlap with CREDSWEEP is tooling sharing, not yet operator identity.

CREDSWEEP (.env-variant + credential census) ⟳ — .238 SECOND WINDOW, FIRST MINT (Hostile, active)

• Actors: 45.148.10.238 (Techoff Srv Limited, NL, ipsum:3+firehol2) — second consecutive window: netcup-ts 902 ev / 355 paths / 14 POSTs (19:30 EDT) + control-1 370 / 169 / 16 POSTs; first recorded mint on control-1 at 04:39 EDT. 45.148.10.5 touched sponge-01-ts + frantech-ts (112 ev, new nodes for it, 0 mints).
• TTPs: standing template, Mozlila typo forgery intact. 45.148.10.171: 18th consecutive minting window — 6 mint rows across aidev/farm/control/ru-edge, hoard 45/6d, zero use.
• Assessment: the /24's most persistent census operator finally converted a census into a mint; .171 remains the fleet's longest-running collector.

WP-FORM-BRUTE (distributed wp-login form brute) ⟳ — ELEVENTH WINDOW (Hostile, background)

• Actors: ed66 leg — 18 IPs / 72 events (farm+aidev); df15 leg — 3 IPs / 168 events on farm+netcup+ru-edge (netcup and ru-edge are new nodes for df15).
• TTPs: unchanged probe → credential POST → probe shape; below the 200-pair growth alarm.
• Assessment: roster rotation continues; keep as background.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — GOOGLE CLASS RETURNS (Hostile, active)

• Actors: 104.199.36.53 (Google Cloud) on lauterbourg-01-ts — 117 ev under the bare stripped-Chrome UA + 25 under Chrome/128.
• TTPs: crawl shape on the kiteworks vhost; the same vhost also carried REGISTRY-HUNT's three l9scan legs. Dedicated Tc Datacenter and AWS classes absent.
• Assessment: the decoy now draws three recurring operator classes (Google, AWS, Tc Datacenter LT) at zero cost; credential paths or a mint remain the promotion bar.

Watch-class singles (no campaign yet)

• Benign research: Ruhr-Universität Bochum softsec crawler — 185.73.23.161 (finn) and 185.73.23.162 (goose), UA Software Security Research/1.0 (+https://finn|goose.softsec.ruhr-uni-bochum.de): 4,517 events on netcup-ts + sponge-01-ts over 14 h, / + language variants (/en/, /de/home.html, /it/, /pl), 10–14 paths, 0 POSTs, 0 mints — the sponge/netcup volume mover; add to the benign list on a second window.
• 64.89.161.172 (Netiface LLC, LU): new UA Mozilla/5.0 vpnfinder, ai-devbox-1 / only, tarpit 302s — a VPN-endpoint finder; register on a second run.
• 180.93.238.65 (Saigon Postel, VN): minted 1 on ru-edge 02:14 EDT, 2 nodes touched. 77.90.185.125 (Limited Network LTD, DE — an AS213790 network in GO-SSH-SWEEP's set): minted 1 on control 22:18 EDT. 185.93.89.112: minted 1 on farm 19:33 EDT. First-time collectors; check 6d windows before claims.
• 206.209.210.3 — fourth consecutive minting window (2 mints on farm, 7/6d, 6 nodes): still the only collector repeating past three windows.
• 208.84.100.218 — 5 mint rows across 4 sensors, 10/6d.
• 204.76.203.18 (Pfcloud, NL) — MALWARE-DICT loop, day 21+ on control-1, 2,141 events / 579 paths; sibling .219 touched all 8 sensors (27 ev).
• TOKEN-CRAWLER pool — 45.198.224.124/.125 touched all 8 sensors (~85 events each), /24 rotation intact, 0 mints.
• Tarpit pools — 3e1c5eb879e7 94 IPs / 649 events fleet-wide; 218630667b2c 9 IPs / 378 on 5 sensors; df15d0ee3ccf covered under WP-FORM-BRUTE.
• Benign fixed-cadence probers — 89.248.172.33 (324 ev, 7 sensors), 80.82.77.202 (315, 7 sensors), 93.174.93.12, 3.129.187.38, 18.116.101.220, 54.211.5.80 (getdomaindata/1.0, lauterbourg): unchanged shapes.

Absent or paused

AKAMAI-VHOST-SCAN (first absence — 172.234.162.31 out; the kiteworks vhost carried REGISTRY-HUNT legs instead), ATLASSIAN-REST-PROBE (second), METADATA-HUNT (third runner-absent window), CONFIG-SWEEP (third miss; 87.120.104.29 out, 12/6d held), NIGHTAGENT (fifth), KEYHUNT (fifth), OMEGA-SWEEP /46 census (tenth miss; the pool singles are silent too this window), CF-FRONTED CREDSWEEP (tenth), ENVRC-SWEEP, GIT-VAULT (second), LEAKIX-SSH (network layer; fingerprint absent from the recon table), SS-Net .211 and sibling .92.65, ZKILLU-GITWALK, LLM-ENDPOINT-PROBE, EMPERORS-KIT's GitHub-dropper stage, 185.177.72.64 (№49's multi-egress minter), 31.56.53.82 (Snowcore dev-repo census).

Standing actors (persistence check)

• 45.148.10.171 — eighteenth consecutive minting window: 6 mint rows across 4 sensors; hoard 45/6d, still zero AWS use. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — MALWARE-DICT loop, day 21+ on control-1, 2,141 events this window; the /24's sibling .219 probed all 8 sensors.
• 206.209.210.3 — fourth consecutive minting window (2 mints, 7/6d): the only collector on record repeating past three.
• 45.148.10.238 — second consecutive window; converted a census into its first mint.
• REGISTRY-HUNT repeat minters — 147.182.200.94 (3/6d), 139.59.231.238 (5/6d), 167.99.182.39 (3/6d), 157.245.105.107 (3/6d), 159.89.12.166 (3/6d), 64.227.70.2 (4/6d), 167.71.81.114 (6/6d): the evening-wave collector base persists behind the rotating roster.
• TOKEN-CRAWLER /24 + tarpit pools — constant background; TOKEN-CRAWLER touched all 8 sensors again.

Network-layer recon (Arkime) — 2026-10-12 07:33:00 → 2026-10-13 07:33:57 UTC

Fingerprint field ssh.hassh, destination port 22 · 131,309 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 77,738, bahrain-sponge-01-ts 26,092, sensor:bahrain-sponge-01-ts 26,092, sensor:ru-vps-01-ts 25,002, frantech-ts 24,257, sensor:frantech-ts 24,257

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,047 sessions from 313 source IPs across 157 networks in 54 countries, port 22, avg 4,968 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS8075 Microsoft Corporation, AS16276 OVH SAS, AS150436 Byteplus Pte. Ltd., AS14061 DigitalOcean, LLC. Busiest sources: 40.74.68.248, 41.173.43.34, 129.121.97.74, 94.180.139.162, 165.231.143.109. Last 7 days: 10-07 350 IPs, 10-08 309 IPs, 10-09 317 IPs, 10-10 344 IPs, 10-11 303 IPs, 10-12 319 IPs, 10-13 101 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 27,067 sessions from 72 source IPs across 20 networks in 16 countries, port 22, avg 5,051 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS208137 Feo Prest SRL, AS213790 Limited Network LTD, AS131423 Branch of Long Van System Solution JSC - Hanoi. Busiest sources: 109.160.32.47, 109.160.32.152, 109.160.32.159, 109.160.32.162, 109.160.32.157. Last 7 days: 10-07 100 IPs, 10-08 66 IPs, 10-09 88 IPs, 10-10 116 IPs, 10-11 90 IPs, 10-12 81 IPs, 10-13 37 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) re-crossed the dispersed threshold at its highest session count on record (27,067, +5,429) but from its narrowest source set (72 IPs / 20 networks): volume concentrated into the 109.160.32.x /24, which supplies all five busiest sources. The /24's uname survey did not reappear in the hp command table this window — first window the sweep and the hardware inventory decoupled. LIBSSH-MASSSWEEP (f555226df196…) held its ~310-IP plateau on day 24 (6,047 sessions / 157 networks). The unnamed 16443846184e… contracted to 10,271 sessions / 29 IPs (from 16,506 / 49) and stays netcup's top fingerprint at 16 days on record, below the 50-IP floor. 084386fa7ae5… turned distributed (83 sessions / 61 IPs / 11 networks); 03a80b21afa8… is the day's largest single-source class (638 / 31). LEAKIX-SSH (fd65145f481d…) is absent — 0 sessions. Fleet inbound totaled 131,309 sessions (+13,538 vs №49). recon-names.tsv unchanged — nothing crossed a naming threshold.

Canary credentials

Summary

5 Tracebit alert(s) fired in the window (28 use events across 5 credentials). Fleet sensors minted 80 credentials to 32 collector IPs; 5 credential(s) reached AWS. Use outcomes: 22 failure, 6 success. Denied operations: GetServiceQuota×8, DescribeInstances×4, DescribeRegions×4, DescribeInstanceTypes×2, ListNotebookInstances×2. 6 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 45 mints, 2026-10-06 08:06 → 2026-10-12 19:51
• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 102.220.161.102: 27 mints, 2026-10-06 10:40 → 2026-10-06 10:57
• 80.94.92.65: 15 mints, 2026-10-06 07:01 → 2026-10-11 17:52
• 209.159.155.142: 12 mints, 2026-10-11 01:40 → 2026-10-11 02:15
• 87.120.104.29: 12 mints, 2026-10-06 20:39 → 2026-10-09 06:12
• 208.84.100.218: 10 mints, 2026-10-09 04:22 → 2026-10-12 17:51
• 168.119.64.101: 8 mints, 2026-10-07 06:48 → 2026-10-07 13:20
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 206.209.210.3: 7 mints, 2026-10-10 08:02 → 2026-10-13 05:56
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 109.205.176.10: 6 mints, 2026-10-07 01:33 → 2026-10-12 15:06
• 150.241.66.127: 6 mints, 2026-10-08 18:17 → 2026-10-08 18:55
• 173.249.253.116: 6 mints, 2026-10-12 23:08 → 2026-10-13 00:03
• 213.209.159.175: 6 mints, 2026-10-07 11:02 → 2026-10-12 19:47
• 45.138.12.51: 6 mints, 2026-10-08 00:50 → 2026-10-12 12:58
• 45.153.34.39: 6 mints, 2026-10-07 12:42 → 2026-10-08 02:14
• 80.94.95.211: 6 mints, 2026-10-06 18:25 → 2026-10-10 20:25
• 105.115.6.147: 5 mints, 2026-10-07 21:06 → 2026-10-08 15:27
• 128.199.182.55: 5 mints, 2026-10-08 20:14 → 2026-10-11 20:05
• 146.190.103.103: 5 mints, 2026-10-07 20:01 → 2026-10-09 20:10
• 160.177.245.67: 5 mints, 2026-10-08 07:57 → 2026-10-08 09:04
• 167.71.81.114: 5 mints, 2026-10-08 19:29 → 2026-10-12 20:41
• 68.183.9.16: 5 mints, 2026-10-06 20:00 → 2026-10-10 02:21
• 105.112.26.83: 4 mints, 2026-10-06 03:50 → 2026-10-06 04:50
• 139.59.231.238: 4 mints, 2026-10-07 20:33 → 2026-10-12 19:58
• 140.245.97.208: 4 mints, 2026-10-07 06:30 → 2026-10-07 12:29
• 167.99.210.137: 4 mints, 2026-10-07 20:25 → 2026-10-10 20:28
• 209.99.188.170: 4 mints, 2026-10-07 17:51 → 2026-10-09 18:35
• 213.209.159.154: 4 mints, 2026-10-08 04:55 → 2026-10-11 01:02
• 64.227.32.66: 4 mints, 2026-10-06 20:37 → 2026-10-09 19:46
• 105.115.5.210: 3 mints, 2026-10-07 19:34 → 2026-10-07 20:24
• 139.59.143.102: 3 mints, 2026-10-06 20:05 → 2026-10-09 21:03
• 143.110.213.72: 3 mints, 2026-10-07 20:25 → 2026-10-11 19:57
• 157.230.19.140: 3 mints, 2026-10-06 20:01 → 2026-10-09 21:06
• 157.245.113.227: 3 mints, 2026-10-08 17:32 → 2026-10-11 20:07
• 157.245.204.205: 3 mints, 2026-10-08 18:42 → 2026-10-11 20:35
• 172.93.215.8: 3 mints, 2026-10-11 00:27 → 2026-10-12 16:55
• 178.128.207.138: 3 mints, 2026-10-06 20:09 → 2026-10-10 20:43
• 185.213.193.49: 3 mints, 2026-10-06 11:04 → 2026-10-06 13:26
• 206.189.225.181: 3 mints, 2026-10-08 19:33 → 2026-10-09 21:06
• 206.189.95.232: 3 mints, 2026-10-07 19:54 → 2026-10-08 19:33
• 209.38.208.202: 3 mints, 2026-10-08 19:33 → 2026-10-10 20:44
• 209.99.189.217: 3 mints, 2026-10-06 15:38 → 2026-10-09 01:07
• 217.60.76.167: 3 mints, 2026-10-10 03:42 → 2026-10-12 10:00
• 64.225.75.246: 3 mints, 2026-10-06 19:56 → 2026-10-06 20:37
• 64.227.70.2: 3 mints, 2026-10-09 19:46 → 2026-10-12 20:30

Attribution notes. 169.58.180.111 and 2a02:c207:2350:9697::1 are the synchronized Contabo pair — both started minting at 08:22 EDT 10-12 on ai-devbox-1 + canary-farm-1 and each self-used 2 credentials from 1 IP with EC2 enumeration classes; the IPv6 address is the funnel's first IPv6 collector. 131.193.125.163 (University of Illinois at Chicago) used 1 credential for GetCallerIdentity ✓ from outside the flux window — Tracebit is the only witness; the minter is unobserved. 167.99.79.44 is CONFIGBUNDLE-SWARM's new class (7 mints / 19 min); 173.249.253.116 is INFOCREST-KIT's seventh operator (6 mints); 161.118.206.143 and 168.107.90.53 are ORACLE-SWEEP's third-window minters; 102.220.161.139 is SI-CENSUS's return (6 mints); 45.148.10.238 recorded its first mint (control-1 04:39 EDT); 185.177.72.49 extends the Bucklog /24. The REGISTRY-HUNT class supplied ~14 mint rows. Digest mint rows total 81 (farm 30 from 14 IPs, aidev 27 from 13, control 15 from 12, ru-edge 9 from 8); Tracebit dedupe gives 80 credentials to 32 collectors. The 75 unused credentials stay hostile-held inventory until they expire — silent counts clamp at 0 when a window splits a mint from its use.

Fleet Observations

Canary economics. 81 digest mint rows; 80 credentials to 32 collectors after dedupe; 5 credentials used (28 events, 6 GetCallerIdentity successes, 22 denied operations). Mint failures: 0 — third consecutive zero-failure window. The all-time issued-row counter reached 2,122.

Attribution and TLS posture. XFF counters: any 1,711 / multi-entry 0 / ignored-internal 403 / single-entry mismatch 0. The ignored-internal counter rose from №49's 2 to 403 with the window's volume; every counted entry was internal or peer-agreeing, and the forgery signal stayed zero. Host census stays bare-IP-led on all 8 nodes; the TLS vhosts carried canary-farm sso.rightabouteverything.show (784 HTTP Host hits, 541 HTTPS events) and ai-devbox inference.fapthropic.com (777 / 415); lauterbourg's kiteworks vhost drew REGISTRY-HUNT legs, the Google-class crawl, and INFOCREST legs.

Volume moves and causes. sponge-01-ts +179% (3,324): the Bochum softsec crawler (2,425). netcup-ts +130% (3,676): the same crawler (2,092). control-1 +55% (4,659): the Pfcloud loop (2,141, 46% of the node) plus SI-CENSUS .139 (845) and ORACLE-SWEEP's control pass (235). frantech-ts +6% (15,347): MEGA-DICT's 17th replay (13,554). ai-devbox-1 +15% (1,995): LIBREDTAIL's six runs (222) + SI-CENSUS (348) + the REGISTRY wave. canary-farm-1 +10% (2,384): GOWEB, CONFIGBUNDLE-SWARM, ORACLE-SWEEP's widest pass. lauterbourg-01-ts +1% (1,583). ru-edge-1 −41% (1,042 vs a 1,770 7-day average): none of the week's large census passes repeated on the node; its one spike (fake-git 20.3×) is attributed.

Result-tag spike attribution. All 13 ≥3× spikes have causes: phpmyadmin-login farm 203 = GOWEB (151) + INFOCREST .116 (30) + EMPERORS .127 (22); control 175 = GOWEB (151) + EMPERORS (22) + singles; lauterbourg 151 = GOWEB; phpunit-eval-stdin aidev 226 = LIBREDTAIL (6×37); cmd-injection-php-cgi-rce aidev 27 = LIBREDTAIL (3×5) + the standing php-cgi pool; fake-git/fake-git-miss ru-edge 235/83 and control 470/166 = MEVSPACE template pair + SI-CENSUS .139; tarpit-module sponge 2,694 / netcup 2,909 = the Bochum crawler; env-production control 211 and config-json 23 = SI-CENSUS + ORACLE-SWEEP censuses. No unexplained spikes.

control-1 discovery velocity. Day 30: 4,659 events from 109 unique IPs — unique-IP count inside the 84–157 band (22nd consecutive window); event volume is the node's second-highest, driven by the Pfcloud loop and the day's census passes, not by new discoverers.

Digest quirks. First-seen timestamps again cluster at the 03:16 sync-arrival minute — inventory, not timeline. The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk; MEGA-DICT's 23:56 EDT replay lands in the 10-12 23:00 bucket). The +4 h ingest cast pulls late-window actors into two digests — cross-checked against №49: the Contabo pair's 08:22 EDT mints are genuinely new (after №49's 03:32 EDT window end), as are every mint row above except where 6d history is cited. The ai-devbox-1 rotated-file gap enters its twelfth cycle. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention).

Fleet-side changes this cycle. flux-visuals.py CHAINS: SI-CENSUS and MEVSPACE-GITWALK → active; EMPERORS-KIT → recurring; AKAMAI-VHOST-SCAN → idle; notes added for ORACLE-SWEEP, CREDENTIAL-DRAIN, REGISTRY-HUNT, GOWEB-PENTEST, MEGA-DICT, LIBREDTAIL-KIT, INFOCREST-KIT, CONFIGBUNDLE-SWARM, BUCKLOG-KIT, WP-FORM-BRUTE, KITEWORKS-CRAWL. TALKER_CAMPAIGNS +11 (the ORACLE roster, GOWEB trio, MEVSPACE pair, INFOCREST .116, CONFIGBUNDLE .44, CREDSWEEP-NAMED .171). recon-names.tsv unchanged (no new named network campaign). The visuals dashboard ran once (flux-fleet-visuals-2026-10-13.html).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 518 sources sent credentials → 344 got a shell (66%) → 259 ran a command (75% of shell-getters, 50% of sources). Event level: 10,684 credential attempts → 3,007 accepted logins → 4,742 commands (158% of accepted logins go on to run something). Telnet (commodity IoT botnets): 1,274 attempts, up from 1,216.

Twenty-third static command window. New commands: 0 of 82 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,020 events / 203 IPs; the key-replace chain at 902 / 191). 92.118.39.71's class ran its PATH-export + uname loops (312 + 312 events from 8 IPs). 45.148.10.240 ran the hardware survey (uname -s -v -n -r -m, uptime -p, lspci | grep VGA ×209 from 3 IPs). The GO-SSH-SWEEP /24's uname survey did not appear in the command table this window — first decouple from the sweep's network-layer activity.

Credential concentration persists. 6,501 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 963 attempts and root/3245gs5662d34 at 754 — the fixed-pair sprayers hold the funnel for a fifth window. No new pairs to report.

Gaps / Next Collection

1. The Contabo pair. Do the 20 held canaries draw more AWS operations or a ConsoleLogin before TTL; what shared tooling links the IPv4 and IPv6 collectors (same-minute mint start, identical EC2 operation classes); does either return for a second mint run.
2. 131.193.125.163 (UIC). How a university-network address validated a fleet canary outside the flux window — compromised host, campus research scan, or resale; Tracebit is the only witness, and the minter is unobserved.
3. ORACLE-SWEEP's fourth window. Whether the widened 235–384-path census is the new core; whether the campaign's 5 held canaries (3 from №49, 2 from №50) reach AWS.
4. 16443846184e…. 10,271 sessions / 29 IPs at day 16, still netcup's top fingerprint and unnamed — name it if it re-disperses or crosses the 50-IP floor; a banner read would settle its relationship to GO-BANNER-SWEEP.
5. INFOCREST-KIT .116. Capture the kit's phpunit/dropper stage on a return (absent this window); decide whether the tzulo ASN hosting two campaigns in one window (MEGA-DICT + INFOCREST) is coincidence or shared infrastructure.
6. Bochum crawler. Second window promotes it to the benign list and lets fleet-volume baselines net it out.
7. ai-devbox-1 history (twelfth cycle). Ingest env-canary.jsonl.1 (268 MB) or move rotation behind the sync boundary.
8. hp static streak. Twenty-three windows without a new command; the fixed-pair sprayers still own the funnel. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-13.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-13.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-13.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-13.md

Watch next cycle: (1) the Contabo IPv4+IPv6 self-use pair — whether their 20 held canaries draw operations past denied EC2 enumeration, and whether the UIC use repeats; (2) ORACLE-SWEEP's fourth window — whether the cadence holds under the widened census, and any AWS use from the campaign's 5 held canaries; (3) 16443846184e… naming decision on netcup, plus a second Bochum window before the benign list absorbs it.