FLUX FLEET — INTEL BRIEFING №53

Period: 2026-10-15 07:33 – 2026-10-16 07:33 UTC (24h, day 51 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 51-day baseline, all 20 result-tag spikes attributed, mint and use sides verified against Tracebit)

BLUF

The CREDSWEEP directory-fanout template changed hands and spread: a new block from the same VPS Dedicated (SI) org that runs SI-CENSUS — 102.220.163.155 — replayed the census byte-for-byte against ai-devbox-1, canary-farm-1, and control-1 (514 events / 511 paths / 34 families each, Chrome/126.0.0.0, pscan-<8hex> marker) and minted one canary on every node. The OMEGA-SWEEP escape operator 79.124.58.82 hit control-1 a second time the same day (11:00:55 EDT, 450 events / 106 families, 1 mint — its fourth pass in 26 h), which reads as a standing crew rather than a one-pass visitor. The mint→use funnel logged a third consecutive zero-use window — 38 credentials to 27 collector IPs, 0 AWS events, streak now 189 — while 45.148.10.171 minted in its 21st consecutive window. MEGA-DICTIONARY ran its twentieth replay (13,606 paths in ~1 minute from 23.234.116.20, tzulo inc. US), and REGISTRY-HUNT's docker-registry stage drove the fleet's 3.0–3.2× manifest/tags spikes. Benign research scanning again owned the big volume moves: the Bochum softsec crawler took 82% of netcup-ts (+90%) and 79% of sponge-01-ts (+94%).

Key Judgements

1. The CREDSWEEP fanout template now runs under at least three operator organizations, and the newest one converts on first contact. 102.220.163.155 (VPS Dedicated LLC SI) reproduced the registered directory fanout — /vendor/.env, /cronlab/.env, /core/Datavase/.env, /database/.env — synchronously on three nodes with per-node-identical result counts, and minted at /.env on all three. The same org owns the SI-CENSUS block (102.220.161.x, 33 held credentials), and Techoff Srv operators (93.123.109.226, 45.148.10.238) worked control-1 in the same window. (High confidence — journeys are byte-identical modulo the pscan nonce; the org link to 102.220.161.x is registration data, and the mint rows are direct observation.)
2. 79.124.58.82 is a standing OMEGA-SWEEP operator, not a template that passed through once. The Tamatiya EOOD host ran ai-devbox-1 18:50 EDT 10-14, control-1 02:22 EDT 10-15, and control-1 again 11:00:55–56 EDT 10-15 (450 events / 450 paths / 106 families, forged Googlebot/2.1, /jenkins/.env + /strapi/.env answered 200, 1 mint; 4 mints/6d). A same-day second pass at a different hour is crew behavior, and the census's family list is still growing (106 on control). (High confidence — timestamped journeys; the "standing crew" reading is inference from cadence, and a third-node pass would confirm it.)
3. Three zero-use windows mean the hostile credential inventory is compounding, not shrinking. 38 fresh credentials went to 27 collectors; the standing hoards grew (45.148.10.171 to 48/6d across a 21st consecutive minting window; 206.209.210.3 returned at 11/6d) and ten REGISTRY-HUNT runners minted ~12 more. The largest untraced batches (45.148.10.171 48, 35.253.66.111 41, 34.124.231.201 40) remain hostile-held until TTL. (High confidence — Tracebit alerts are the only use witness; none fired.)
4. GO-SSH-SWEEP concentrated: a session record from a collapsing source set. The ssh-2.0-go fingerprint set a record 31,271 sessions, but from 65 source IPs across 13 networks — down from 108 IPs / 42 networks — and its Arkime shape dropped from dispersed sweep to distributed. The fleet-wide session total held (~107,054, +1.8%), so the pool is hitting harder per source, not wider. Its /24 (109.160.32.163) also kept running the uname survey on the frantech honeypot (777 events / 13 IPs), the second window of network-layer↔post-compromise coupling. (Moderate confidence — counts are direct; whether the concentration is one operator consolidating or a shared fingerprint is unmeasured.)

Active Campaigns (day 51 status)

CREDSWEEP (.env directory-fanout census + mint collection) ⟳ — NEW SAME-ORG BLOCK, 3-NODE SYNCHRONIZED RUN, MINTING (Hostile, active)

• Actors: 102.220.163.155 (VPS Dedicated LLC SI) — ai-devbox-1 10:21–12:10 EDT, canary-farm-1 12:37–12:45 EDT, control-1 13:10–13:21 EDT 10-15; 514 events / 511 paths / 34 families per node, journeys identical except the pscan-<8hex>-nonexistent.txt nonce. Techoff Srv operators: 93.123.109.226 (BG) — control-1 22:07–22:09 EDT, 514 events / 510 paths, second window after №52's sponge pass; 45.148.10.238 (NL) — control-1 757 events / 370 paths / 26 families / 5 POSTs (11:55–11:57 EDT, ipsum:3+firehol2). Feo Prest 213.209.159.154 minted 2 on canary-farm-1 (4/6d).
• TTPs: single forged UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 on the .155 legs; per-node result profile identical (tarpit-module 118, not-handled 113, env-production 81, webshell-probe 68, phpinfo 54, sftp-config-error 12); /.env [issued] on every node — 3 canaries. The .226 control pass ran the error-census variant (env-production-error 80, phpinfo-error 54) and minted 2 at /.env.
• Assessment: the fanout census is shared commodity tooling that survives operator churn; the SI org runs it alongside SI-CENSUS as a second template. Three synchronized mint conversions on a first run make .155 an immediate use-side watch, and control-1 absorbed three separate census operators plus the Pfcloud loop in one day — the node's +61% is census traffic, not new discoverers.

OMEGA-SWEEP (record-width config census, forged Googlebot) ⟳ — THIRD PASS, STANDING-CREW SIGNAL (Hostile, active)

• Actors: 79.124.58.82 (Tamatiya EOOD, BG) — control-1 11:00:55–56 EDT 10-15: 450 events / 450 paths / 106 families in under a second. The /46 block stayed silent a 13th window.
• TTPs: forged Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html), GET-only; the 106-family census with ssh-private-key-error 27, env-production mints at /jenkins/.env and /strapi/.env (200), actuator and web.config families. 1 mint; 4 mints/6d across three passes.
• Assessment: three passes in 26 hours across two nodes, including a same-day second pass at a different hour, is scheduled work. The escape operator now holds 4 canaries; the fleet's widest census template has at least one crew outside the /46 block, and its family list is the largest on record.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — DOCKER-REGISTRY STAGE FLEET-WIDE (Borderline, active)

• Actors: DigitalOcean pool runners on 5+ sensors; the farm cluster c540fc530a5a carried 8 IPs / 312 events. Minting runners this window: 165.22.34.189 (2, farm, 4/6d), 46.101.111.185 (2, control, 3/6d), and eight at 1 each — 146.190.63.248 (3/6d), 146.190.103.103 (2/6d), 209.38.248.17, 46.101.1.225, 64.225.75.246, 64.23.218.208 (2/6d), 157.245.113.227 (3/6d), 134.122.28.88 (2/6d).
• TTPs: unchanged 27-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → /v2/_catalog → /v2/internal/api-gateway/ tags+manifests). The docker-registry stage drove four sensor-level spikes: control-1 and ru-edge-1 docker-registry-manifest/tags 45+45 (3.0×), frantech-ts and sponge-01-ts 25+25 (3.2×).
• Assessment: the repeat-minter base persists behind full roster rotation at ~1 mint per runner. Borderline per registry — a public leak-scanning service, reported separately from criminal actors.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — THIRD ZERO-USE WINDOW (Hostile, active)

• Actors: mint side 38 credentials to 27 collector IPs (41 digest issued rows). Use side: none — 0 alerts, 0 AWS events.
• TTPs: funnel 38/27/0. Mint failures 28×400 (farm 10, control 7, ru-edge 7, ai-devbox 4) — burst-driven upstream rejections, incl. 4 tracebit-http-error rows from 155.117.232.31 (watch single below). All-time issued-row counter 2,336. New collectors: 102.220.163.155 (3), the 195.177.94.17/.222 pair (2), 93.123.109.226 (2), 185.198.240.17, 20.57.168.64 (Azure), 47.79.200.145, 209.99.189.217, 216.247.106.202, 74.208.99.178, 146.190.63.48, 46.101.1.225, 64.225.75.246 — 13 first-window collector IPs. 45.148.10.171: 5 credentials / 8 issued rows across 4 sensors (48/6d, 21st consecutive window). 206.209.210.3 returned (1, 11/6d). 79.124.58.82's fourth canary came at the 11:00 EDT control pass (4/6d). №52's 8-canary collector 194.59.31.39 did not return.
• Assessment: the streak is 189 credentials across three windows. The three large hoards age toward TTL with no validation call; whether that is resale dormancy or off-observation use is unmeasured — Tracebit is the only witness.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary) ⟳ — TWENTIETH REPLAY, TZULO ASN AGAIN (Hostile, active)

• Actors: 23.234.116.20 (tzulo, inc., US) on frantech-ts — 13,606 events / 13,606 distinct paths in ~1 minute (00:12–00:13 EDT 10-16), ipsum-clean, 0 mints.
• TTPs: GET-only router/IoT UA dictionary replay; 94% of frantech's day. The host's ASN is the same tzulo block that ran the №34 double-replay (23.234.117.146) — the artifact keeps circulating through the same small-provider pool.
• Assessment: replay cadence is now twenty windows deep; the deception surface absorbs it at zero cost, but the replay keeps hiding frantech's real baseline. Wordlist delta versus №52's 13,583 not path-diffed this cycle.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — SIXTEENTH WINDOW, NEW CONTABO OPERATOR (Hostile, active)

• Actors: 169.58.99.248 (Contabo GmbH, FR) — canary-farm-1, 151 GETs on /phpMyAdmin-5.2/index.php in ~1 minute (01:05 EDT 10-16), plus 1 not-handled on /admin/sysadmin/index.php. №52's three operators absent.
• TTPs: unchanged — Go Web Pentest Tool-class pass, one phpMyAdmin login path, GET-only, 0 POSTs, 0 mints.
• Assessment: sixteenth window, nineteenth operator IP, fifth ASN — the fleet's phpMyAdmin decoys sit on a circulated target list, and a captured credential body remains the missing intent evidence.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — POOL + WP-ADMIN LEG ACTIVE (Hostile, active)

• Actors: pool e6e6f15a77e8 — 14 IPs / 42 events on ai-devbox-1; wp-admin leg 09d3f351065c returned — 7 IPs / 56 events (/wp-admin/profile.php, /wp-admin/ redirects around /wp-login.php credential posts).
• TTPs: probe → credential POST → probe cycles with forged modern Chrome UAs; 0 mints; well below the 200-pair alarm.
• Assessment: constant background with a persistent second stage; no change in intent.

LIBREDTAIL-KIT (phpunit RCE chain) ⟳ — CLUSTER CONTRACTED (Hostile, active)

• Actors: cluster 7e61a9500d8b — 6 IPs / 294 events / 5 sensors (down from №52's 13 / 637 / 6). No single named runner this window.
• TTPs: the registered chain (md5 probe → key-exfil php-cgi RCE → /bin/sh dropper); dropper host not captured this window. 0 mints.
• Assessment: the kit keeps rotating runners at low volume; fake webshells and tarpits held.

MALWARE-DICT (Pfcloud loop) ⟳ — DAY 25+ ON CONTROL (Hostile, active)

• Actors: 204.76.203.18 (Pfcloud UG, NL) — control-1 2,066 events / 578 paths (38% of the node, ipsum:2).
• TTPs: unchanged continuous dropper-URL loop.
• Assessment: volume dipped with the node's mix; the /24 remains a standing multi-host operator.

Standing actors (persistence check)

• 45.148.10.171 — twenty-first consecutive minting window: 5 credentials / 8 issued rows across canary-farm-1 (3), ai-devbox-1 (2), ru-edge-1 (2), control-1 (1); hoard 48/6d, zero AWS use throughout; 17 events across all 8 sensors. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — day 25+ on control-1 (see MALWARE-DICT).
• REGISTRY-HUNT repeat minters — 165.22.34.189 (4/6d), 46.101.111.185 (3/6d), 157.245.113.227 (3/6d), 146.190.63.248 (3/6d), 45.138.12.51 (8/6d, incl. 1 on control-1 this window), 109.205.176.10 (7/6d), 64.23.218.208, 134.122.28.88, 146.190.103.103: the collector base persists at ~1 mint per runner per window.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — fourth window, benign-listed: netcup-ts 3,719 of 4,548 events (82%), sponge-01-ts 3,260 of 4,121 (79%). Both nodes' baselines net down to a few hundred events without it.
• TOKEN-CRAWLER pool 45.198.224.x — .124 (87 ev) and .125 (72 ev) touched all 8 sensors again; 0 mints.
• Tarpit pools — 3e1c5eb879e7 93 IPs / 643 events fleet-wide; ef1ab74f3d57 7 / 343; 218630667b2c 7 / 299; 4b4cc0ece037 7 / 48. Constant background.
• Benign fixed-cadence probers — 89.248.172.33 (441 ev, 7 sensors), 80.82.77.202 (387, 7), 34.140.3.155 (42, all 8), 130.12.180.32 (42, all 8), 71.6.155.70 (8, all 8): unchanged shapes.

Absent or paused

XMLRPC-BRUTE (silent again after №52's return), LLM-ENDPOINT-PROBE (no third operator), GIT-VAULT pair (merge question open), CONFIG-SWEEP (second absence), PROTON-CENSUS (second), ORACLE-SWEEP, EMPERORS-KIT (third), NIGHTAGENT (eighth), KEYHUNT, SS-PROBE, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, ATLASSIAN-REST-PROBE (fifth), AKAMAI-VHOST-SCAN (fourth), KITEWORKS-CRAWL's registered operators, CONFIGBUNDLE-SWARM, CF-FRONTED CREDSWEEP (thirteenth), OMEGA /46 block (thirteenth), SI-CENSUS 102.220.161.x, INFOCREST-KIT's 103.214.20.135, METADATA-HUNT census + marker (the 8 in-window @fs events are №52's 05:57–06:00 EDT run riding the +4 h ingest cast — verified, no repeat), 194.59.31.39 (№52's 8-canary collector — absent), 80.94.95.211 (SS-NET).

Network-layer recon (Arkime) — 2026-10-15 07:33:00 → 2026-10-16 07:34:40 UTC

Fingerprint field ssh.hassh, destination port 22 · 107,054 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 75,867, bahrain-sponge-01-ts 41,182, sensor:bahrain-sponge-01-ts 41,182, frantech-ts 15,639, sensor:frantech-ts 15,639, sensor:ru-vps-01-ts 11,654

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,155 sessions from 320 source IPs across 167 networks in 61 countries, port 22, avg 4,920 B/session. Networks: AS8075 Microsoft Corporation, AS150436 Byteplus Pte. Ltd., AS14061 DigitalOcean, LLC, AS16276 OVH SAS, AS132203 Tencent Building, Kejizhongyi Avenue. Busiest sources: 134.122.93.100, 43.153.121.250, 145.239.85.118, 147.90.234.13, 50.6.241.208. Last 7 days: 10-10 344 IPs, 10-11 303 IPs, 10-12 319 IPs, 10-13 283 IPs, 10-14 336 IPs, 10-15 352 IPs, 10-16 109 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SSH-SWEEP (0a07365cc01f…) set the session record (31,271, +1%) but its shape changed: 65 IPs / 13 networks / 9 countries, down from 108 / 42 / 24, and the fingerprint now classifies as distributed rather than dispersed — concentration, not spread (Key Judgement 4). LIBSSH-MASSSWEEP (f555226df196…) stayed flagged on day 27: 320 IPs / 167 networks / 61 countries, inside its ~280–360-IP plateau, still below the 200-source mass threshold on sessions. 16443846184e… fell 35% to 9,853 sessions at 32 IPs / 23 networks — day 19, still unnamed, still under the 50-IP floor. GO-SPRAY-SWEEP (06ff3615a51b…) returned to the table after its pause: 355 sessions from 39 IPs / 34 networks / 21 countries in a 48-minute burst (12:50–13:38) — 39 IPs sits under the 50-IP dispersed floor, so no flag. New in the table: 2ec37a7cc8da… — 2,018 sessions / 18 IPs / 3 networks / 4 countries, single-source shape, unnamed; the narrow network set with sustained all-day volume is the part to watch. contabo-sponge-02-ts's session tag is absent today (9,765 yesterday) — the ninth sensor's provisioning stalled or its tag dropped; next cycle confirms which.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 38 credentials to 27 collector IPs; none reached AWS. Use outcomes: 0 success, 0 failure.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 48 mints, 2026-10-09 04:49 → 2026-10-15 17:42
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 87.120.104.29: 18 mints, 2026-10-09 06:12 → 2026-10-13 19:31
• 209.159.155.142: 12 mints, 2026-10-11 01:40 → 2026-10-11 02:15
• 206.209.210.3: 11 mints, 2026-10-10 08:02 → 2026-10-15 11:17
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 208.84.100.218: 10 mints, 2026-10-09 04:22 → 2026-10-12 17:51
• 80.94.92.65: 10 mints, 2026-10-09 11:59 → 2026-10-11 17:52
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 45.138.12.51: 8 mints, 2026-10-10 18:27 → 2026-10-16 01:31
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 109.205.176.10: 7 mints, 2026-10-09 05:41 → 2026-10-15 21:41
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 213.209.159.175: 6 mints, 2026-10-10 23:11 → 2026-10-15 03:07
• 80.94.95.211: 6 mints, 2026-10-10 20:25 → 2026-10-15 03:19
• 140.245.97.208: 5 mints, 2026-10-13 15:46 → 2026-10-13 15:51
• 37.60.226.187: 5 mints, 2026-10-10 00:57 → 2026-10-14 16:42
• 128.199.182.55: 4 mints, 2026-10-09 19:48 → 2026-10-14 20:07
• 139.59.231.238: 4 mints, 2026-10-09 19:46 → 2026-10-14 19:58
• 165.22.34.189: 4 mints, 2026-10-11 19:58 → 2026-10-15 21:06
• 167.172.232.142: 4 mints, 2026-10-10 19:58 → 2026-10-14 20:10
• 167.71.81.114: 4 mints, 2026-10-09 19:48 → 2026-10-12 20:41
• 185.177.72.64: 4 mints, 2026-10-11 23:36 → 2026-10-14 22:52
• 213.209.159.154: 4 mints, 2026-10-11 01:02 → 2026-10-15 09:15
• 79.124.58.82: 4 mints, 2026-10-14 18:50 → 2026-10-15 11:00
• 102.220.163.155: 3 mints, 2026-10-15 10:21 → 2026-10-15 13:10
• 146.190.63.248: 3 mints, 2026-10-09 19:59 → 2026-10-15 17:50
• 157.245.105.107: 3 mints, 2026-10-09 21:03 → 2026-10-14 20:11
• 157.245.113.227: 3 mints, 2026-10-11 19:59 → 2026-10-15 18:39
• 167.99.182.39: 3 mints, 2026-10-09 19:48 → 2026-10-13 20:47
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 172.93.215.8: 3 mints, 2026-10-11 00:27 → 2026-10-12 16:55
• 206.189.233.36: 3 mints, 2026-10-09 23:12 → 2026-10-13 20:47
• 209.99.188.170: 3 mints, 2026-10-09 03:48 → 2026-10-09 18:35
• 217.60.76.167: 3 mints, 2026-10-10 03:42 → 2026-10-12 10:00
• 46.101.111.185: 3 mints, 2026-10-12 20:06 → 2026-10-15 20:32
• 64.227.70.2: 3 mints, 2026-10-09 19:46 → 2026-10-12 20:30
• 68.183.9.16: 3 mints, 2026-10-09 20:07 → 2026-10-10 02:21

Attribution notes. 102.220.163.155 is the window's only multi-node mint collector — the CREDSWEEP synchronized run (one /.env mint per node). 79.124.58.82's fourth canary came at the 11:00 EDT control pass. 93.123.109.226's 2 mints sit inside its error-census walk. The ten REGISTRY-HUNT single/double-mint rows map 1:1 to the runner list in that section. 195.177.94.17/.222 are a same-/28 minting pair on farm + ru-edge (the 4-sensor scanner family in cross-node reuse). 213.209.159.154 (Feo Prest) minted 2 on farm — the CREDSWEEP census operator back in the mint economy. 45.148.10.171's 8 issued rows dedupe to 5 credentials (per-row vs per-credential counting, №20 convention).

Watch-class singles (no campaign yet)

• 155.117.232.31 — 4 sensors (aidev, farm, control, ru-edge), 182 events: composite census kit under stale forgeries (Firefox/77.0 macOS + Chrome/91/93 + python-requests/2.32.5) — env-production-error fanout 38+38, phpmyadmin-login 22, phpunit-eval-stdin 4, fake-git 3, and 4 tracebit-http-error mint failures. Kit-shaped (INFOCREST class) but the UA set does not match the kit's modern rotation; promote on a repeat or any issued mint.
• 176.123.5.6 (Alexhost Srl, MD) — lauterbourg-01-ts 305 events / 252 paths / 19 families (15:26 EDT) under a 9-UA modern rotation, plus 15 events on canary-farm-1: 14 kiteworks-asset bundle fetches + not-handled census + tarpit; owns lauterbourg's first-seen cluster (/mifs/user/login.jsp, /actuator/env, /actuator/env/BREVO_SMTP_KEY, .js.map source maps). KITEWORKS-CRAWL-shaped; promote on a repeat.
• 74.208.99.178 (IONOS, DE) — ai-devbox-1 + lauterbourg-01-ts, 38 events: phpinfo probes (2 on aidev) and 1 /.env mint (2/6d). Light; watch for a second mint.
• 141.255.162.237 — no second run: today's 537-event row on ru-edge is №52's 05:53–06:00 EDT 1C/Bitrix favicon dictionary riding the +4 h ingest cast (verified by timestamp). Promotion trigger (a genuinely new run) not met.
• First-seen inventory (03:16 sync-arrival cluster): lauterbourg's source-map/actuator/MobileIron set belongs to 176.123.5.6; control's /admin/server_info.php, /secret.txt, /emails/ses.js and the WordPress plugin readme.txt fanouts across farm/netcup are inventory, not timelines.

Fleet Observations

Canary economics. 41 digest issued rows; 38 credentials to 27 collectors after dedupe; 0 credentials used (0 alerts, 0 AWS events). Mint failures: 28×400 (farm 10, control 7, ru-edge 7, ai-devbox 4) — upstream rejections under census-burst pacing, the same mechanism №17/№19 documented; 4 of them are 155.117.232.31's tracebit-http-error rows. No 401s. All-time issued-row counter: 2,336 (per the visuals run's computation; window sums overcount the cast boundary). Per-node mints: canary-farm-1 13 / control-1 12 / ru-edge-1 9 / ai-devbox-1 7.

Attribution and TLS posture. XFF counters: any 822 / multi-entry 25 / ignored-internal 26 / single-entry mismatch 0 — no attribution forgery on the direct path. The multi-entry counter moved off zero for the first time in the recent record (№52: 0): 25 requests carried forged multi-hop chains; none were used as the source, so attribution held, but the chain-forgery behavior is new and worth one cycle of characterization. Host census is bare-IP-led on all 8 sensors: the TLS vhosts carried ai-devbox inference.fapthropic.com (747 vs 1,179 HTTP) and canary-farm sso.rightabouteverything.show (189 vs 2,342); lauterbourg ran 1,069 bare-IP vs 42 HTTPS.

Volume moves and causes. control-1 +61% (5,453, a node record): the Pfcloud loop 2,066 + three census operators (.155 514, .226 514, .238 757) + the OMEGA pass 450. netcup-ts +90% (4,548): Bochum 3,719 (82%). sponge-01-ts +94% (4,121): Bochum 3,260 (79%). canary-farm-1 +6% (2,453): .155's census (514) + REGISTRY-HUNT farm cluster (312). ai-devbox-1 −7% (1,822): №52's OMEGA escape + .39 census fell out of window, replaced by .155 (514) and the wp pool. lauterbourg-01-ts −34% (1,111): ORACLE-SWEEP's 873-event pivot pass and №52's replay absent; GOWEB replaced by the Alexhost census (305). frantech-ts −2% (14,423): hides MEGA-DICT's 13,606-event replay (94% of the node). ru-edge-1 −17% (1,438): CONFIG-SWEEP's 3,000-event return absent.

Result-tag spike attribution. All 20 ≥3× spikes have causes: ai-devbox webshell-probe 68 (9.1×) = 102.220.163.155; ai-devbox phpinfo 57 (5.6×) = .155 (54) + singles; canary-farm phpinfo 60 (4.2×) = .155 (54); canary-farm webshell-probe 68 (5.7×) = .155; control webshell-probe 146 (26.5×) = .155 (68) + Techoff .226 (68) + .238 (8) + OMEGA (2); control phpinfo 74 (8.4×) = .155 (54) + .238 (12) + OMEGA (3); control phpinfo-error 59 (7.4×) = .226 (54); control env-production 314 (3.4×) = OMEGA (106-family census) + .155 + .226; control env-production-error 80 (4.2×) = .226; control sftp-config-error 38 (9.2×) = .155 (12) + .226 (12) + l9scan runners + singles; control + ru-edge docker-registry-manifest/tags 45+45 (3.0×) = REGISTRY-HUNT; frantech + sponge docker-registry-manifest/tags 25+25 (3.2×) = REGISTRY-HUNT; frantech phpmyadmin-login 155 (5.6×) = the frantech GOWEB/REGISTRY-HUNT phpMyAdmin legs; ru-edge env-production-error 38 (inf) = 155.117.232.31.

control-1 discovery velocity. Day 33: 5,453 events from 133 unique IPs — the node's highest volume on record, but unique-IP count sits inside the 84–157 band for a 25th consecutive window. The volume record is census traffic (three operators + the Pfcloud loop), not new discoverers.

Digest quirks. First-seen timestamps again cluster at the sync-arrival minute (03:16:08–09) — inventory, not timeline. The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk). The +4 h ingest cast pulled №52's late-window events into both digests — cross-checked by timestamp: 141.255.162.237 (05:53 EDT) and 144.172.64.99 (05:57 EDT) are №52 runs, not new activity; 79.124.58.82's 11:00 EDT control pass is genuinely new and post-№52. The ai-devbox-1 rotated-file gap enters its fifteenth cycle. Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). No new quirk this cycle; the XFF multi-entry shift is an actor signal, not a pipeline quirk.

Fleet-side changes this cycle. flux-visuals.py CHAINS: XMLRPC-BRUTE, LLM-ENDPOINT-PROBE, GIT-VAULT, INFOCREST-KIT, METADATA-HUNT, SS-NET TOOLING → idle; statuses otherwise unchanged; №53 notes added for GOWEB-PENTEST, CREDENTIAL-DRAIN, OMEGA-SWEEP, REGISTRY-HUNT, CREDSWEEP, MEGA-DICT, LIBREDTAIL-KIT, WP-FORM-BRUTE, MALWARE-DICT, KITEWORKS-CRAWL (candidate operator), SI-CENSUS. recon-names.tsv unchanged (no new named network campaign; 2ec37a7cc8da… stays unnamed below threshold). Registry: CREDSWEEP fanout template noted as multi-org shared tooling; OMEGA third pass; watch singles 155.117.232.31, 176.123.5.6, 102.220.163.155 recorded with promotion triggers.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 444 sources sent credentials → 340 got a shell (77%) → 268 ran a command (79% of shell-getters, 60% of sources). Event level: 26,822 credential attempts → 3,819 accepted logins → 4,791 commands (125% of accepted logins go on to run something). Telnet (commodity IoT botnets): 5,292 attempts, back up from №52's 717.

Twenty-sixth static command window. New commands: 0 of 53 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,173 events / 224 IPs; the key-replace chain at 1,055 / 204). The uname surveys continue: 109.160.32.163's class — GO-SSH-SWEEP's /24 — ran 777+777 events / 13 IPs, 62.171.133.1 solo (122+122), 193.32.162.84's battery 256 events / 7 IPs. Second consecutive window of network-layer↔post-compromise coupling.

Credential concentration persists. 17,002 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 1,126 attempts and root/3245gs5662d34 at 865 — the fixed-pair sprayers hold the funnel for an eighth window. No new pairs to report.

Gaps / Next Collection

1. 102.220.163.155's three canaries. First synchronized multi-node mint run; whether the SI org's second template spreads to more nodes or validates on AWS is the use-side watch. Byte-identical pacing (aidev 10:21, farm 12:37, control 13:10 EDT) is the fingerprint.
2. 79.124.58.82's cadence. Three passes in 26 h; a fourth pass or a third node confirms the standing-crew read and makes the escape a full campaign with its own row.
3. The zero-use streak. Three windows, 189 credentials. TTL expiries versus validation calls: Tracebit's alert feed is the only witness; check the three 40+ hoards (45.148.10.171, 35.253.66.111, 34.124.231.201) for expiry-window edges.
4. GO-SSH-SWEEP's shape change. Record sessions from 65 IPs / 13 networks. One more window settles whether this is consolidation into fewer hosts (crew behavior) or a shared fingerprint switching roles; a banner/KEX comparison across the old and new source sets would answer it.
5. 2ec37a7cc8da… — 2,018 sessions / 18 IPs / 3 networks, all day, unnamed. Name it if it re-disperses, crosses the 50-IP floor, or shows a banner worth registering.
6. XFF multi-entry chains (25). First non-zero window in the recent record; none used as source. Identify the forgers next cycle and decide whether this is a new attribution signal or one campaign's quirk.
7. contabo-sponge-02-ts. Its Arkime tag vanished (9,765 sessions yesterday → absent today); confirm whether provisioning stalled or the tag dropped.
8. hp static streak. Twenty-six windows without a new command; telnet resurged to 5,292 attempts. New commands remain the only post-compromise tripwire in the pipeline.

Digest: /data/flux-logs/reports/flux-digest-2026-10-16.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-16.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-16.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-16.md

Watch next cycle: (1) 79.124.58.82's cadence — a fourth pass or third node makes the OMEGA escape a standing crew; (2) 102.220.163.155's three fresh canaries and node spread — the SI org's second template; (3) the zero-use streak at 189 credentials and the three 40+ hoards aging toward TTL.