FLUX FLEET — INTEL BRIEFING №52

Period: 2026-10-14 07:34 – 2026-10-15 07:34 UTC (24h, day 50 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 50-day baseline, all 10 result-tag spikes attributed, mint and use sides verified against Tracebit)

BLUF

The OMEGA-SWEEP census template escaped its home /46 block for a second time: 79.124.58.82 (Tamatiya EOOD, BG) ran 104–106-family config censuses against ai-devbox-1 and control-1 in 9–11-second passes under the campaign's forged Googlebot UA and minted 3 canaries. The mint→use funnel logged a second consecutive zero-use window — 49 credentials to 25 collector IPs, 0 AWS events — while a new mint collector emerged: 194.59.31.39 took 8 canaries off ai-devbox-1 in a slow 6-hour census. MEGA-DICTIONARY ran its nineteenth replay (13,583 paths in 91 s from a new host, 176.119.150.64, Owl Limited DE); 12,995 of its paths match the saved dictionary capture, so the shared artifact keeps growing. Benign research scanning drove the big volume moves: the Bochum softsec crawler's third window pushed netcup +117% and sponge +175%, canary-farm fell −43% with METADATA-HUNT's record burst absent, and at the network layer GO-SSH-SWEEP set a session record (30,946) while LIBSSH-MASSSWEEP fielded its widest source set (358 IPs / 177 networks, day 26).

Key Judgements

1. The OMEGA-SWEEP template is circulating property, not a single crew's tool. 79.124.58.82 reproduced the registered census — forged Googlebot/2.1, 104 families on ai-devbox-1 (466 events / 403 paths in 11 s), 106 on control-1 (450 / 450 in 9 s) — from a Bulgarian hosting net with no overlap with the absent 94.154.46.x operators, and converted 3 mints. This is the second documented escape (№15 was the first). (High confidence — UA, family breadth, and journey match the registered template; the operator is new.)
2. Zero AWS use for a second window is hoard growth, not de-escalation. 49 fresh credentials went to 25 collectors; the standing hoards grew (45.148.10.171 to 50/6d on a 20th consecutive minting window) and 14 REGISTRY-HUNT runners minted 1 each. The three largest untraced batches (45.148.10.171 50, 35.253.66.111 41, 34.124.231.201 40) remain hostile-held until TTL. (High confidence — Tracebit alerts are the only use witness; none fired.)
3. The git-internals walk template is consolidating under one tooling family. The exact 144-event/142-path synchronized pair returned under fresh sibling IPs (104.207.37.126, 65.111.4.237) with the honest git/2.40.0 UA that №51 attributed to MEVSPACE-GITWALK's fifth operator — the same shape №40–№42 registered as GIT-VAULT's 3xK Tech GmbH pair. Two registry names now describe one walk; a third sibling IP should trigger a merge review. (Moderate confidence — shape and UA match is observed; an operator link between the two names is unproven.)
4. LLM decoy endpoints are on circulating tooling lists. A second operator — 52.250.210.67 (Azure), honest UA Python/3.12 aiohttp/3.14.5 — probed sponge-01-ts: 6 model-list paths (only /v1/models answered 200), then 90 POST /v1/chat/completions in 11 seconds, all 200. That follows №43's AutoGenX engine on lauterbourg and MEGA-DICT's replay grazing llm-endpoint-ollama-ps. (Moderate confidence — two independent operators observed; intent beyond endpoint validation is unmeasured because request bodies were not captured.)

Active Campaigns (day 50 status)

OMEGA-SWEEP (record-width config census, forged Googlebot) ⟳ — SECOND TEMPLATE ESCAPE, MINTING (Hostile, active)

• Actors: 79.124.58.82 (Tamatiya EOOD, BG) — ai-devbox-1 18:50:44–55 EDT (466 events / 403 paths / 104 families) + control-1 02:22:45–54 EDT 10-15 (450 / 450 / 106 families). No overlap with the 94.154.46.x roster; the /46 block itself stayed silent a 12th window.
• TTPs: forged Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html), GET-only. Families per the registered template: env-production 108+101, ssh-private-key-error 22+27, wp-config 14+9, fake-git 12+7, app-config-python 11+9, terraform-tfvars 8, docker-compose 6+6, application-yml 5, plus tarpit riding. Mints: 3 [issued] at /.env-class paths (2 on ai-devbox-1, 1 on control-1); 0 mint failures.
• Assessment: the fleet's widest census template now has a second independent operator, and this one converts to credentials on the first run. The census drove ai-devbox's env-production and both nodes' ssh-private-key-error spikes. The 3 held canaries join the use-side watch; the 106-family control pass shows the template's family list is still growing upstream.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — SECOND ZERO-USE WINDOW (Hostile, active)

• Actors: mint side 49 credentials to 25 collector IPs. Use side: none — 0 alerts, 0 AWS events.
• TTPs: funnel 49/25/0. Mint failures: 0 (first fully clean failure window since №16). All-time issued-row counter 2,297. NEW top collector: 194.59.31.39 — 8 mints on ai-devbox-1 (13:54–19:54 EDT) behind a slow 6-hour config census (240 events / 105 paths / 23 families; bare stripped-Chrome + Chrome/124 UAs; 0 POSTs). Other batches: 45.148.10.171 9 across 4 sensors (50/6d, 20th consecutive window), 79.124.58.82 3, 37.60.226.187 3 on control-1 (5/6d), 80.94.95.211 2 on ai-devbox-1 (6/6d), 213.209.159.175 2, 185.177.72.64 2, 180.93.236.215 2 on control-1 (new collector), 172.239.158.26 1+1 (farm + control, 3/6d), 45.148.10.5 1 on control-1 (CREDSWEEP /24 sibling), and the 14 single-mint REGISTRY-HUNT runners.
• Assessment: two silent use windows after №50's record use. The untraced queue grew by 49; the three largest hoards (50, 41, 40) age toward TTL with no validation call. Whether that means resale-market dormancy or off-observation use is unmeasured — Tracebit is the only witness.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 19-RUNNER WAVE, ALL 8 SENSORS (Borderline, active)

• Actors: 19 l9scan/l9explore IPs, 1,052 events, all 8 sensors. 14 runners minted exactly 1 each: 159.223.132.86, 206.189.19.19, 138.68.86.32, 165.22.34.189, 134.122.28.88, 64.23.218.208, 164.92.107.174, 157.245.105.107, 167.99.210.137, 139.59.231.238, 128.199.182.152, 128.199.182.55, 167.172.232.142 (DigitalOcean pool), 45.138.12.51 (l9explore, Tc Datacenter LT, 7/6d). NEW l9explore/1.2.2 operator 193.32.204.199 — 195 fake-git events on canary-farm-1 plus 49+49 not-handled on netcup and frantech (the №15 watch single, now identified).
• TTPs: unchanged 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum), 1 mint per runner at /.env. The .199 leg adds a git-config walk and l9tcpid/v1.1.0 banner probes.
• Assessment: the repeat-minter base persists behind full roster rotation, now with a second tool identified (l9explore) walking the same decoys. Borderline per registry — a public leak-scanning service, reported separately from criminal actors.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — NINETEENTH REPLAY, NEW HOST (Hostile, active)

• Actors: 176.119.150.64 (Owl Limited, DE) on frantech-ts — 13,583 events / 13,583 distinct paths in 91 s (01:26:53–01:28:24 EDT 10-15), ipsum-clean, 0 mints.
• TTPs: GET-only router/IoT UA set (ASUS RT-AC55U, TP-LINK Archer C80, Tenda AC1200, Tencent WiFi Router, curl/8.2.1, Chrome/119 aarch64); 13,579 not-handled, 4 single decoy hits (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth). Wordlist +18 vs №51's 13,565; 12,995 of 13,583 paths match the saved 13,000-path capture (+583 growth against the 09-19 snapshot).
• Assessment: another growth replay under a fresh host — and the host org name (Owl Limited) matches SS-PROBE's Owl Limited JP registrant, a naming coincidence worth tracking, not proof of a link. The replay alone is 94% of frantech's day and hides the node's real baseline. Deception surface absorbed it at zero cost.

GIT-VAULT (git-internals walk) ⟳ — PAIR RETURNED UNDER SIBLING IPS (Hostile, active)

• Actors: 104.207.37.126 (canary-farm-1, 14:11:44–50 EDT) + 65.111.4.237 (ai-devbox-1, 15:45:00–10 EDT) — byte-identical 144 events / 142 paths each, honest UA git/2.40.0. Light git/2.40.0 singles 45.3.48.30 + 45.3.37.79 (1 event each).
• TTPs: the №40–№42 shape — /.git/HEAD → internals walk, 142 paths in 6–10 s, 0 mints.
• Assessment: same hosting classes (3xK-Tech-block siblings), same shape, same UA №51 credited to MEVSPACE's operator. One walk template, two registry names — see Key Judgement 3.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — THREE NEW OPERATORS IN ONE WINDOW (Hostile, active)

• Actors: 34.211.136.159 (AWS US) lauterbourg 151 GETs / 1 path in 28 s (23:23 EDT); 185.205.222.77 (PT Industri Kreatif Digital, ID) lauterbourg 151 / 1 (17:52 EDT); 185.47.64.239 (Nowatel Sp. z o.o., PL) ai-devbox-1 151 / 1 in 28 s (23:23 EDT). 130.12.180.32 added 2 singles on lauterbourg.
• TTPs: unchanged — Go Web Pentest Tool UA, one phpMyAdmin login path per pass, GET-only, 0 POSTs, 0 mints. The pair owns lauterbourg's 306-event phpmyadmin-login spike (3.3×) with .239 owning ai-devbox's (151 of 164).
• Assessment: thirteenth–fifteenth windows, sixteenth–eighteenth operator IPs, three ASNs, three nodes in one day — the fleet's phpMyAdmin decoys circulate on a shared target list, and the list now includes ai-devbox. A captured credential body remains the missing intent evidence.

XMLRPC-BRUTE (xmlrpc system.multicall brute) ⟳ — RETURNED, SIXTH OPERATOR (Hostile, active)

• Actors: 85.204.70.116 (Hydra Communications Ltd, GB, AS25369) — lauterbourg-01-ts, 01:16:08–10 EDT 10-15, forged Chrome/78.
• TTPs: the registered preflight trio (/wp-includes/wlwmanifest.xml 200, /wp-json/wp/v2/users/ 200, oembed 404) then 60 POST /xmlrpc.php [wp-xmlrpc-post] in 1.5 s — bodies 480–491 B, all opening <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…, all 200. 0 mints.
• Assessment: first run since №16's record burst, again under a fresh operator and again single-account multicall shape (bodies truncated at the parameter list; the username is not visible in the captured head). The wp-xmlrpc-post spike is wholly this actor.

LLM-ENDPOINT-PROBE (LLM decoy endpoint use) ⟳ — SECOND OPERATOR, SECOND NODE (Hostile, active)

• Actors: 52.250.210.67 (Microsoft Azure, US) — sponge-01-ts only, 09:47:41–52 EDT, honest UA Python/3.12 aiohttp/3.14.5. №43's 104.168.115.214 (AutoGenX, lauterbourg) stayed absent.
• TTPs: 6 model-list probes in 5 ms (/model/info, /api/v1/models, /api/models, /openai/v1/models 404; /v1/models [llm-endpoint-models-list] 200; /v1beta/models 404) then ~90 POST /v1/chat/completions [llm-endpoint-openai-chat] in 11 s — all 200, bodies 142–234 B, not captured. Owns sponge's infinite llm-endpoint-openai-chat spike (90 vs 2.0 avg).
• Assessment: the decoy's OpenAI-compatible chat surface now draws automated clients from two independent operators on two nodes. The deception answered every request; what the clients do with 200s is unmeasured until a body is captured.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — CHAIN POOL FLEET-WIDE (Hostile, active)

• Actors: 186.182.105.49 (honest UA libredtail-http) — ru-edge-1, 49 events / 44 paths. The /bin/sh + php-cgi cmd-injection journey cluster 7e61a9500d8b (first seen 08-29) ran fleet-wide: 13 IPs / 637 events / 6 sensors.
• TTPs: the registered chain (md5 probe → key-exfil php-cgi RCE → /bin/sh dropper); dropper host not captured this window. 0 mints.
• Assessment: the kit's runners keep rotating; the fleet-wide cluster count (13 IPs) is the widest single-window footprint on record for the signature. Fake webshells and tarpits held.

INFOCREST-KIT (composite adminer/wp-batch kit) ⟳ — RETURN ON 4 SENSORS (Hostile, active)

• Actors: 103.214.20.135 (Host Universal Pty, AU) — canary-farm-1, ai-devbox-1, sponge-01-ts, ru-edge-1 (533 events, 04:15–05:25 EDT). №51's sixth-sensor operator 173.249.253.116 absent.
• TTPs: census legs (webapp-config-bundle-js, config-backup paths ×5 on sponge) + phpmyadmin-login 10 on ai-devbox-1; no adminer POST bodies captured this window; 0 mints.
• Assessment: the kit's operator rotation continues; the lighter footprint suggests a census pass rather than the full adminer anatomy.

CREDSWEEP (.env census + mint collection) ⟳ — NETCUP FIRST, TECHOFF SIBLING ACTIVE (Hostile, active)

• Actors: 45.148.10.238 (Techoff Srv, NL) — netcup-ts FIRST run: 836 events / 373 paths / 13 POSTs in 5 min (21:14–21:19 EDT), 16 modern UA rotation including the Mozlila/5.0 typo forgery (the campaign fingerprint), ipsum:3+firehol2. Same-ASN operator 93.123.109.226 (Techoff Srv, BG) — sponge-01-ts: 514 events / 510 paths in under a minute (10:23 EDT), Chrome/126: webshell-probe 84 (16.8×) + webshell-sweep-observed 2 + the config-backup census that owns sponge's first-seen inventory. 45.148.10.5 minted 1 on control-1.
• TTPs: the POST bodies on netcup were not captured (no bodyPreview rows); the census breadth (373 paths) and typo forgery match the registered template.
• Assessment: two Techoff operators worked two deception nodes in one window — the /24's toolset now spans census, webshell probing, and git walks across the fleet's no-canary surface. Zero mint conversion on netcup (no canaries there) keeps the mint economy on the canary nodes.

METADATA-HUNT (GCP template sweeps → code-exec + mint) ⟳ — MARKER-ONLY PROBE (Hostile, active)

• Actors: 144.172.64.99 (bare Mozilla/5.0 UA) — the @fs Vite file-read pair /@fs/proc/self/environ [vite-fs-proc-environ] + /@fs/etc/passwd [vite-fs-etc-passwd], 2 each, on both EU nodes. №51's record runner 35.253.66.111 and the named-runner roster: absent.
• TTPs: no __aws_leak_probe, no census, no mints — only the 8 file-read marker events.
• Assessment: the campaign's signature survives on a minimal probe; 41 fresh canaries from №51 remain unwatched inventory. Whether the full runner returns or the template has degraded to single-marker checks is the next-window read.

Standing actors (persistence check)

• 45.148.10.171 — twentieth consecutive minting window: 9 mints across canary-farm-1 (4), ai-devbox-1 (2), ru-edge-1 (2), control-1 (1); hoard 50/6d, zero AWS use throughout; light passes on all 8 sensors (17 events). The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — MALWARE-DICT loop, day 24+ on control-1: 1,944 events / 579 paths (58% of the node, ipsum:2). Sibling .219 touched all 8 sensors (24 events).
• REGISTRY-HUNT repeat minters — 167.99.210.137 (4/6d), 206.189.19.19 → first window, 157.245.105.107 (3/6d), 134.122.28.88 (2/6d), 64.23.218.208 (2/6d), 139.59.231.238 (4/6d), 128.199.182.55 (6/6d), 167.172.232.142 (4/6d), 45.138.12.51 (7/6d): the collector base persists at 1 mint per runner per window.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — third window, benign-listed: netcup 2,960 of 4,391 events (67%), sponge 3,312 of 4,674 (71%).
• TOKEN-CRAWLER pool 45.198.224.x — .124 (88 ev) and .125 (72 ev) touched all 8 sensors again; 0 mints.
• Tarpit pools — 3e1c5eb879e7 94 IPs / 654 events fleet-wide; ef1ab74f3d57 9 / 441; 1cf777711bea 7 / 56; 4b4cc0ece037 6 / 39 (ru-edge). Constant background.
• Benign fixed-cadence probers — 80.82.77.202 (423 ev, 7 sensors), 89.248.172.33 (441, 7), 34.140.3.155, 130.12.180.32 (47, all 8), 71.6.155.70 (8, all 8): unchanged shapes.
• SI-CENSUS block — 5 events from 1 IP (102.220.161.x): a light touch, not a census; the block's 33 held credentials stand.

Absent or paused

CONFIG-SWEEP (87.120.104.29 absent; 18 held credentials unwatched), PROTON-CENSUS (first absence; 2 held credentials unwatched), ORACLE-SWEEP (WebSiphon 0 events), EMPERORS-KIT (second idle), NIGHTAGENT (seventh), KEYHUNT (seventh), SI-CENSUS census arm, CF-FRONTED CREDSWEEP (twelfth), OMEGA-SWEEP /46 block (twelfth), SS-PROBE (0 marker events), MEVSPACE-GITWALK (the window's git walks belong to GIT-VAULT's pair), ZKILLU-GITWALK, SONICWALL-VPN-PROBE, ATLASSIAN-REST-PROBE (fourth), AKAMAI-VHOST-SCAN (third), KITEWORKS-CRAWL (all three IPs absent), CONFIGBUNDLE-SWARM, GIT-VAULT's original Microsoft-hosted operator, WP-FORM-BRUTE's №51 wp-admin leg (pool contracted to 38 IPs / 114 events), XMLRPC-BRUTE's 1337/207.175 operator classes.

Network-layer recon (Arkime) — 2026-10-14 07:34:00 → 2026-10-15 07:34:19 UTC

Fingerprint field ssh.hassh, destination port 22 · 105,185 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 66,673, bahrain-sponge-01-ts 38,657, sensor:bahrain-sponge-01-ts 38,657, sensor:ru-vps-01-ts 16,199, sensor:lauterbourg-01-ts 12,548, contabo-sponge-02-ts 9,765

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,463 sessions from 358 source IPs across 177 networks in 54 countries, port 22, avg 4,937 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS150436 Byteplus Pte. Ltd., AS132203 Tencent Building, Kejizhongyi Avenue, AS4766 Korea Telecom. Busiest sources: 52.237.80.79, 125.212.251.7, 212.56.213.212, 52.224.109.126, 103.155.47.50. Last 7 days: 10-09 317 IPs, 10-10 344 IPs, 10-11 303 IPs, 10-12 319 IPs, 10-13 283 IPs, 10-14 336 IPs, 10-15 143 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 30,946 sessions from 108 source IPs across 42 networks in 24 countries, port 22, avg 5,067 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS208137 Feo Prest SRL, AS48090 Techoff Srv Limited. Busiest sources: 192.253.248.216, 109.160.32.37, 77.239.124.143, 77.239.124.145, 77.239.124.150. Last 7 days: 10-09 88 IPs, 10-10 116 IPs, 10-11 90 IPs, 10-12 81 IPs, 10-13 97 IPs, 10-14 95 IPs, 10-15 61 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) set a session record — 30,946 (+14% from №51's 27,067) — from 108 IPs / 42 networks, with the busiest sources split across 192.253.248.216, 109.160.32.x, and 77.239.124.x; AS48090 Techoff Srv Limited stays in its network list, and this window the same ASN worked two HTTP nodes (CREDSWEEP). The /24's uname survey re-appeared in the hp command table (below) — the №51 decouple ended. LIBSSH-MASSSWEEP (f555226df196…) broke its ~280–310-IP plateau: 358 source IPs across 177 networks (day 26), still below the 200-IP mass threshold on sessions. 16443846184e… grew +22% again (12,398 → 15,098 sessions) at 40 IPs / 25 networks — day 18, still unnamed, still under the 50-IP floor. New below-threshold fingerprint e54ef3ec27fe… (33 sessions / 19 IPs). contabo-sponge-02-ts logged 9,765 sessions in Arkime with no flux logs yet.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 49 credentials to 25 collector IPs; none reached AWS. Use outcomes: 0 success, 0 failure.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 50 mints, 2026-10-08 09:56 → 2026-10-15 05:24
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 87.120.104.29: 18 mints, 2026-10-09 06:12 → 2026-10-13 19:31
• 209.159.155.142: 12 mints, 2026-10-11 01:40 → 2026-10-11 02:15
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 206.209.210.3: 10 mints, 2026-10-10 08:02 → 2026-10-13 22:04
• 208.84.100.218: 10 mints, 2026-10-09 04:22 → 2026-10-12 17:51
• 80.94.92.65: 10 mints, 2026-10-09 11:59 → 2026-10-11 17:52
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 109.205.176.10: 7 mints, 2026-10-08 03:34 → 2026-10-14 20:10
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 45.138.12.51: 7 mints, 2026-10-10 18:27 → 2026-10-14 09:18
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 128.199.182.55: 6 mints, 2026-10-08 20:14 → 2026-10-14 20:07
• 150.241.66.127: 6 mints, 2026-10-08 18:17 → 2026-10-08 18:55
• 213.209.159.175: 6 mints, 2026-10-10 23:11 → 2026-10-15 03:07
• 80.94.95.211: 6 mints, 2026-10-10 20:25 → 2026-10-15 03:19
• 140.245.97.208: 5 mints, 2026-10-13 15:46 → 2026-10-13 15:51
• 160.177.245.67: 5 mints, 2026-10-08 07:57 → 2026-10-08 09:04
• 167.71.81.114: 5 mints, 2026-10-08 19:29 → 2026-10-12 20:41
• 37.60.226.187: 5 mints, 2026-10-10 00:57 → 2026-10-14 16:42
• 105.115.6.147: 4 mints, 2026-10-08 13:27 → 2026-10-08 15:27
• 139.59.231.238: 4 mints, 2026-10-09 19:46 → 2026-10-14 19:58
• 146.190.103.103: 4 mints, 2026-10-08 19:36 → 2026-10-09 20:10
• 157.245.204.205: 4 mints, 2026-10-08 18:42 → 2026-10-13 20:27
• 167.172.232.142: 4 mints, 2026-10-10 19:58 → 2026-10-14 20:10
• 167.99.210.137: 4 mints, 2026-10-08 17:33 → 2026-10-14 20:01
• 185.177.72.64: 4 mints, 2026-10-11 23:36 → 2026-10-14 22:52
• 213.209.159.154: 4 mints, 2026-10-08 04:55 → 2026-10-11 01:02
• 64.227.32.66: 4 mints, 2026-10-08 20:15 → 2026-10-13 20:47
• 68.183.9.16: 4 mints, 2026-10-08 18:46 → 2026-10-10 02:21
• 146.190.63.248: 3 mints, 2026-10-08 18:42 → 2026-10-13 20:08
• 157.245.105.107: 3 mints, 2026-10-09 21:03 → 2026-10-14 20:11
• 157.245.113.227: 3 mints, 2026-10-08 17:32 → 2026-10-11 20:07
• 167.99.182.39: 3 mints, 2026-10-09 19:48 → 2026-10-13 20:47
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 172.93.215.8: 3 mints, 2026-10-11 00:27 → 2026-10-12 16:55
• 206.189.225.181: 3 mints, 2026-10-08 19:33 → 2026-10-09 21:06
• 206.189.233.36: 3 mints, 2026-10-09 23:12 → 2026-10-13 20:47
• 209.38.208.202: 3 mints, 2026-10-08 19:33 → 2026-10-10 20:44
• 209.99.188.170: 3 mints, 2026-10-09 03:48 → 2026-10-09 18:35
• 217.60.76.167: 3 mints, 2026-10-10 03:42 → 2026-10-12 10:00
• 64.227.70.2: 3 mints, 2026-10-09 19:46 → 2026-10-12 20:30
• 79.124.58.82: 3 mints, 2026-10-14 18:50 → 2026-10-15 02:22

Attribution notes. 194.59.31.39 is the window's new top collector — the slow 6-hour ai-devbox-1 census in Watch-class singles below; 8 mints at /.env-class paths with zero POSTs. 79.124.58.82 is the OMEGA-SWEEP escape (2 aidev + 1 control). 45.148.10.171 added 9 across 4 sensors (50/6d, 20th consecutive window). 45.148.10.5 is a CREDSWEEP /24 sibling (1 on control-1). The 14 single-mint rows map 1:1 to REGISTRY-HUNT runners (159.223.132.86, 206.189.19.19, 138.68.86.32, 165.22.34.189, 134.122.28.88, 64.23.218.208, 164.92.107.174, 157.245.105.107, 167.99.210.137, 139.59.231.238, 128.199.182.152, 128.199.182.55, 167.172.232.142, 45.138.12.51). 37.60.226.187 (3 on control-1, 5/6d), 180.93.236.215 (2, new), and 172.239.158.26 (2, 3/6d) are unattributed single-window or slow-repeat collectors — join against journeys before naming. Digest rows: 55 mint rows vs 49 Tracebit credentials (per-row vs per-credential counting, №20 convention).

Watch-class singles (no campaign yet)

• 141.255.162.237 (Private Layer, CH) — ru-edge-1: 537 events / 537 distinct paths in ~1 min (05:53–05:54 EDT), bare stripped-Chrome UA. Paths are a Russian 1C/Bitrix-style directory dictionary with /favicon.ico suffixes (/buh/, /unf/, /bp/, /ut/, /ut11/, /zup/, /trade/, /retail/, /base/, /test/…) — 536 not-handled + 1 phpmyadmin-login. A geo-aware web-root census against the Russia node; promote on a second run or any mint.
• 194.59.31.39 (12651980 CANADA INC., FR) — ai-devbox-1: 240 events / 105 paths / 23 families over 6 h (13:54–19:54 EDT), two UA legs (bare stripped-Chrome 125 + Chrome/124 115), 0 POSTs — and 8 mints, the window's largest haul. The only collector on record minting from a low-and-slow census rather than a burst.
• 193.32.204.199 — identified this window as l9explore/1.2.2 (LeakIX family): folded into REGISTRY-HUNT above.
• 176.119.150.64's Owl Limited org name matches SS-PROBE's Owl Limited JP registrant — tracked as a naming coincidence until an IP or tooling link appears.
• First-seen inventory (03:15 sync-arrival cluster): sponge-01-ts's config-backup set (/config.inc.old, /config.bak, /wp-config.0, /wp-config.ORG, /wp-config - Copy.php, /.production, /tester.php, /a.php, jupyter/ftp-sync configs) belongs to 93.123.109.226's sweep; new stale-Firefox/Gecko UA forgeries (NT 5.1 rv:1.7.3, NT 6.1 rv:91.0/89.0, Mozilla/5.0 Mozilla/5.0 doublet) across 6 sensors are inventory, not timelines.
• ENVRC-SWEEP pool — 16 /.envrc-class events, recurring, 0 mints.

Fleet Observations

Canary economics. 55 digest mint rows; 49 credentials to 25 collectors after dedupe; 0 credentials used (0 alerts, 0 AWS events). Mint failures: 0 — the fleet's cleanest failure window since №16; no 400s, no 401s, no upstream connection errors. All-time issued-row counter: 2,297. Per-node mints: ai-devbox-1 22 / control-1 14 / canary-farm-1 12 / ru-edge-1 7.

Attribution and TLS posture. XFF counters: any 1,088 / multi-entry 0 / ignored-internal 8 / single-entry mismatch 0 — no attribution forgery on the direct path this window. Host census is bare-IP-led on all 8 sensors: the TLS vhosts carried ai-devbox inference.fapthropic.com (937 vs 1,512 bare-IP) and canary-farm sso.rightabouteverything.show (360 vs 1,059) — both vhost-light versus №51, and lauterbourg ran 1,083 bare-IP vs 49 HTTPS.

Volume moves and causes. netcup-ts +117% (4,391): Bochum crawler 2,960 (67%) + CREDSWEEP .238 (836). sponge-01-ts +175% (4,674): Bochum 3,312 (71%) + Techoff .226 (514). ai-devbox-1 +37% (2,475): the OMEGA escape .82 (466) + .39's slow census (240) + REGISTRY-HUNT runners + the wp pool. canary-farm-1 −43% (1,435): №51's METADATA-HUNT burst (650) and INFOCREST .116 leg absent. lauterbourg-01-ts −26% (1,260): ORACLE-SWEEP's 873-event pivot pass absent, replaced by GOWEB ×2 (302) + Bucklog .64 (258). frantech-ts −2% (14,386): hides MEGA-DICT's 13,583-event replay (94% of the node). ru-edge-1 −20% (1,337): CONFIG-SWEEP's 3,000-event return absent. control-1 −8% (3,148): the Pfcloud loop continues at 1,944 (58%).

Result-tag spike attribution. All 10 ≥3× spikes have causes: ai-devbox env-production 229 (3.4×) = .82 (108) + .39 (64) + l9explore .51 (36) + Bucklog .64 (20); ai-devbox phpmyadmin-login 164 (3.1×) = GOWEB .239 (151) + INFOCREST (10); ai-devbox ssh-private-key-error 22 (5.5×) = .82; ai-devbox wp-config 20 (3.2×) = .82 (14) + .39 (3); control ssh-private-key-error 27 (4.5×) = .82; lauterbourg phpmyadmin-login 306 (3.3×) = GOWEB (151 + 151) + singles; lauterbourg wp-xmlrpc-post 60 (inf) = XMLRPC-BRUTE .116; sponge llm-endpoint-openai-chat 90 (inf) = LLM-ENDPOINT-PROBE .67; sponge tarpit-module 3,718 (3.1×) = the Bochum crawler; sponge webshell-probe 84 (16.8×) = Techoff .226.

control-1 discovery velocity. Day 32: 3,148 events from 110 unique IPs — unique-IP count inside the 84–157 band for a 24th consecutive window; volume third-highest on record for the node, driven by the Pfcloud loop and the OMEGA escape pass, not by new discoverers.

Digest quirks. First-seen timestamps again cluster at the 03:15:39–40 sync-arrival minute — inventory, not timeline. The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk; the frantech 13,651 bucket at 10-15 01:00 is the 01:26 EDT replay). The +4 h ingest cast pulls late-window actors into two digests — cross-checked against №51: every run cited above starts after №51's 07:34 UTC window end (Bochum's 03:34 EDT start rides the boundary), except where 6d history is cited. The ai-devbox-1 rotated-file gap enters its fourteenth cycle. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). No new quirk this cycle.

Fleet-side changes this cycle. flux-visuals.py CHAINS: OMEGA-SWEEP, GIT-VAULT, LLM-ENDPOINT-PROBE → active; CONFIG-SWEEP, ORACLE-SWEEP, SS-PROBE, MEVSPACE-GITWALK, PROTON-CENSUS, EMPERORS-KIT, NIGHTAGENT, KITEWORKS-CRAWL, CONFIGBUNDLE-SWARM → idle; notes updated for GOWEB-PENTEST, METADATA-HUNT, REGISTRY-HUNT, CREDSWEEP, XMLRPC-BRUTE, MALWARE-DICT, MEGA-DICT, CREDENTIAL-DRAIN, LIBREDTAIL-KIT, INFOCREST-KIT, WP-FORM-BRUTE, BUCKLOG-KIT. recon-names.tsv unchanged (no new named network campaign; e54ef3ec27fe… stays unnamed below threshold). Registry: no new campaign rows; watch singles 141.255.162.237 and 194.59.31.39 recorded with promotion triggers; status updates for 12 campaigns. Infrastructure one-liner: ninth sensor contabo-sponge-02-ts now logs 9,765 Arkime sessions per window, still without flux logs.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 543 sources sent credentials → 410 got a shell (76%) → 328 ran a command (80% of shell-getters, 60% of sources). Event level: 19,362 credential attempts → 3,180 accepted logins → 3,656 commands (115% of accepted logins go on to run something). Telnet (commodity IoT botnets): 717 attempts, down from 2,628.

Twenty-fifth static command window. New commands: 0 of 81 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,200 events / 242 IPs; the key-replace chain at 1,054 / 215). The hardware surveys continue: 2.57.122.168's class ran the uname battery (172 events / 7 IPs), 62.171.133.1 solo (113), and 109.160.32.122 — GO-SSH-SWEEP's /24 — is back in the command table (uname -s -v -n -r -m + uname -m | awk, 152 events / 12 IPs), re-coupling the network-layer sweep with post-compromise enumeration after №51's decouple.

Credential concentration persists. 14,314 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 1,153 attempts and root/3245gs5662d34 at 865 — the fixed-pair sprayers hold the funnel for a seventh window. No new pairs to report.

Gaps / Next Collection

1. 194.59.31.39's 8-canary haul. First collector to mint from a low-and-slow census. Does it return to ai-devbox-1, spread nodes, or validate any of the 8 on the AWS side; the 6-hour cadence (13:54–19:54 EDT) is the fingerprint to match.
2. OMEGA-SWEEP's second escape. 79.124.58.82's 3 held canaries are the use-side watch; whether the Tamatiya operator repeats on a third node tells us whether the template has a standing second crew or passed through once.
3. GIT-VAULT / MEVSPACE merge review. The 144-ev/142-path git/2.40.0 walk now has three appearance classes (3xK pair №40–№42, MEVSPACE's №51 operator, this window's siblings). A third sibling IP should merge the rows; a captured walk wordlist would settle it.
4. 141.255.162.237's 1C favicon dictionary. A geo-aware census against the Russia node. Name and promote on a second run; check whether the /buh|/ut|/zup list correlates with ru-edge's other first-seen paths.
5. The zero-use streak. Two windows, 151 credentials deep (49 + №51's 102). TTL expiries versus validation calls: Tracebit's alert feed is the only witness; check the three 40+ hoards (45.148.10.171, 35.253.66.111, 34.124.231.201) for expiry-window edges.
6. 16443846184e… — day 18, 15,098 sessions (+22%), 40 IPs, unnamed. Name it if it re-disperses or crosses the 50-IP floor; a banner read would settle its relationship to GO-BANNER-SWEEP.
7. contabo-sponge-02-ts onboarding. 9,765 Arkime sessions per window and rising; watch for its first flux logs and add it to the roster.
8. hp static streak. Twenty-five windows without a new command; the fixed-pair sprayers hold the funnel; telnet fell to 717 attempts. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-15.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-15.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-15.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-15.md

Watch next cycle: (1) 194.59.31.39's 8 fresh canaries — the first slow-census mint collector; does it return, spread, or validate on AWS; (2) OMEGA-SWEEP's escape operator 79.124.58.82 — a third-node repeat would show a standing second crew; (3) the GIT-VAULT/MEVSPACE merge question — a third 144-ev git/2.40.0 sibling should merge the two registry rows.