FLUX FLEET — INTEL BRIEFING №54

Period: 2026-10-16 07:33 – 2026-10-17 07:33 UTC (24h, day 52 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 52-day baseline, both result-tag spikes attributed, mint and use sides verified against Tracebit)

BLUF

Credential use returned after three zero windows: a canary minted at /.aws/credentials on ai-devbox-1 by 209.99.188.170 at 06:25:15Z ran sts:GetCallerIdentity successfully at 08:55:32Z from the same IP, under a self-labeled validator UA kingfisher-scanner/1.2.0 — the first use since 10-12 and a validator tool new to the funnel. BUCKLOG-KIT's RCE stage surfaced on sponge-01-ts: 185.177.72.50 fired 22 phpunit POSTs in 4 seconds with the payloads captured (md5 verify, Laravel env/log readers, .aws/credentials and .ssh hunts, an id; hostname; uname -a exec probe); the fake webshell answered 200 throughout. The census economy kept adding operators: CREDSWEEP's 102.220.163.155 minted a fourth canary on a second, farm-only pass, Feo Prest 213.209.159.154 ran identical censuses on both no-canary nodes plus control-1, and GIT-VAULT returned under a fourth 3xK Tech IP. Volume split hard: the benign Bochum crawler pushed netcup-ts +63% and sponge-01-ts +89%, MEGA-DICTIONARY missed frantech-ts for the first time in 20 replays (node −97%), and OMEGA-SWEEP went fully silent (79.124.58.82's fourth pass never came; the /46 block missed a 14th window). At the network layer, fingerprint 16443846184e… crossed the dispersed threshold (13,277 sessions / 64 IPs / 22 networks) and is registered as GO-SCATTER-SWEEP, while GO-SSH-SWEEP re-dispersed to 26,376 sessions.

Key Judgements

1. The window's use event is an automated inventory check, not an operation. The only AWS call was sts:GetCallerIdentity, it succeeded, it came from the minting IP itself 2 h 30 m after mint, and the UA self-identifies as kingfisher-scanner/1.2.0. The mint also came from /.aws/credentials rather than /.env — the first use-side event the funnel has tied to an AWS-credential-file path. (High confidence — the Tracebit alert log is direct evidence; whether the validator screens for resale or for the actor's own use is unmeasured.)
2. BUCKLOG-KIT runs a full execution-and-collection kit behind its census arm. 185.177.72.50's captured bodies stage an md5-verified phpunit RCE probe, eight-level traversal readers for .env, Laravel config, logs, and SQLite, a secrets sweep naming .ssh/id_rsa, .ssh/id_ed25519, and .aws/credentials, and a command-execution probe ($cmd="id; hostname; uname -a 2>/dev/null"). The deception surface held: every POST drew a fake-200 webshell or a 404, and no dropper or reverse shell appeared. (High confidence — payloads captured verbatim; whether the kit read real content back is not visible in bodyPreview.)
3. The census commodity keeps minting under new operators while hoards age unused. Four separate operator additions worked this window — .155's second pass (4 canaries all-time), Feo Prest .154's three-node day, stripped-UA newcomer 191.217.250.172 (2 mints, plus METADATA-HUNT's /@fs marker), and GIT-VAULT's fourth 3xK IP — against a use side of one validation call. The 40+ credential hoards (45.148.10.171 at 48/6d, 35.253.66.111 at 41, 34.124.231.201 at 40) remain hostile-held inventory. (High confidence on the observations; the hoard-to-resale inference stays open — Tracebit is the only use witness.)
4. GO-SCATTER-SWEEP's threshold crossing is pool widening, not intensification. Sessions rose 35% (9,853 → 13,277) while source IPs doubled (32 → 64) and networks held (23 → 22), so per-source volume fell (308 → 207 sessions/IP). The ssh-2.0-go banner matches GO-SSH-SWEEP's class, but the fingerprint differs, and no authentication is attempted. (Moderate confidence — counts are direct; whether one crew runs both fingerprints is unmeasured.)

Active Campaigns (day 52 status)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — USE RETURNED: VALIDATOR CALL, STREAK BROKEN AT 189 (Hostile, active)

• Actors: mint side 55 credentials to 37 collector IPs (57 digest issued rows). Use side: 209.99.188.170 — same-IP validation, the funnel's established self-use pattern (№44, №45, №48). Its sibling 209.99.189.217 minted 2 (aidev + control); the pair holds 287 flux events since 10-06.
• TTPs: credential ai-devbox-1-217.15.163.226-20261016T062515Z-c602f128 minted 06:25:15Z at /.aws/credentials (Chrome/124 Windows forgery, HTTP), used 08:55:32Z as sts:GetCallerIdentity — success — from 209.99.188.170 with UA kingfisher-scanner/1.2.0 Mozilla/5.0 (…Chrome/140.0.0.0…), principal legacyOwnerAccess assumed role. One success, zero denied operations. The flux mint row sits at the +4 h cast seam (06:25:15 EDT logged vs 06:25:15Z actual); Tracebit is authoritative. Mint failures 14×400 (aidev 7, farm 5, ru-edge 2). Hoards: 45.148.10.171 48/6d (22nd consecutive minting window — farm 2 + ru-edge 1 this window), 35.253.66.111 41, 34.124.231.201 40, 213.209.159.175 10/6d, 140.245.97.208 9/6d across three sensors, 45.138.12.51 10/6d.
• Assessment: the validator pattern confirms collectors screen credentials before (or instead of) operating them. kingfisher-scanner/1.2.0 is a new self-label in the funnel; a success beyond identity calls from this IP or its hoard is the escalation signal.

CREDSWEEP (.env directory-fanout census + mint collection) ⟳ — SECOND .155 WINDOW, FEO PREST THREE-NODE DAY, NEW STRIPPED-UA OPERATOR (Hostile, active)

• Actors: 102.220.163.155 (VPS Dedicated LLC SI) — canary-farm-1 only this window, 514 events 22:57–00:46 EDT, 1 mint at /.env 22:57:50 EDT (4 all-time); the SI org's second template now has a two-window history. Feo Prest 213.209.159.154 — netcup-ts 171 events in 4 s (18:18 EDT), sponge-01-ts 171 events in 11 s (23:42 EDT, byte-identical 167 paths), control-1 46 events (20:49 EDT) with 2 mints; three antique forgeries (Safari/7.1.8 on macOS 10.9, Android/4.1.2, Chrome/11 on XP). 213.209.159.175 minted 4 on control-1 (10/6d). New operator 191.217.250.172 (Samuel Dierich, US) — ai-devbox-1 178 events in 5 min (08:12–08:17 EDT) under a bare stripped-Chrome UA, with /.env mints at 08:12:15 and 08:17:10 bookending the walk and /@fs/.env + /@fs/.env.local probes (METADATA-HUNT's Vite marker, 4 events).
• TTPs: unchanged pscan-<8hex> fanout on the .155 legs; per-node-identical result profiles; mint-at-start-and-end bookending on the newcomer.
• Assessment: the fanout census survives operator churn and now runs under at least four organizations; the newcomer's @fs rows show METADATA-HUNT's template circulating as fragments inside other censuses.

BUCKLOG-KIT (GravitySMTP/NextAuth census + phpunit RCE) ⟳ — RCE STAGE CAPTURED ON SPONGE (Hostile, active)

• Actors: 185.177.72.50 (Bucklog SARL FR, ipsum:3+firehol2) — sponge-01-ts 05:30–05:31 EDT, 277 events / 191 paths / 22 POSTs in 4 s. Census arm 185.177.72.64 — sponge-01-ts 12:53–12:55 EDT, 258 events (183 not-handled, webshell probes, 0 POSTs captured of note).
• TTPs: nine POST /_ignition/execute-solution (404) interleaved with 13 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php (fake 200), in order: verify <?php echo md5("6b3804159d5abceb"); ?>; a ---PATHSCAN_ENV_BEGIN--- reader walking .env ×5 relative depths; config readers (config/database.php, config/app.php, config/mail.php, bootstrap/cache/config.php) with $maxfiles=48; $budget=524288 and 8-level ../ loops; storage/logs/laravel.log, storage/framework, composer.lock, and database/database.sqlite readers; a secrets sweep $names=array(".ssh/id_rsa",".ssh/id_ed25519",".aws/credentials",".git-credentials",".npmrc",".docke…"; and the exec probe $nonce="d11531bc79e6ccb7"; $cmd="id; hostname; uname -a 2>/dev/null"viashell_exec`. No dropper or reverse shell this run.
• Assessment: the kit wants execution and local secret collection, not web credentials; the fleet's fake-200 webshells fed it success signals at zero cost. Whether any reader returned real bytes is not visible in bodyPreview — the check is in Gaps.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — 25-MINT WINDOW, DOCKER STAGE BELOW SPIKES (Borderline, active)

• Actors: farm cluster 850993125b15 14 IPs / 693 events; aidev sibling b07c7bb207b4 7 IPs / 328 events. Sixteen runners minted 25 issued rows: 209.38.208.202 ×3, 209.38.248.17, 64.23.218.208, 143.110.213.72 ×2 each, twelve at 1 (164.90.208.56, 147.182.149.75, 147.182.200.94, 159.223.132.86, 159.89.174.87, 159.89.12.166, 157.245.105.107, 164.90.228.79, 167.172.158.128, 167.99.182.39, 64.227.32.66, 143.244.168.161).
• TTPs: the unchanged 27-family journey (tarpit → WebLogic → Confluence → WHM/cPanel → /v2/_catalog → docker-registry tags/manifests); the docker stage ran fleet-wide but under the 3× spike line this window.
• Assessment: the repeat-minter base persists at ~1 mint per runner; borderline per registry (public leak-scanning service), reported separately from criminal actors.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — SEVENTEENTH WINDOW (Hostile, active)

• Actors: 190.93.152.243 (Colombia CO) — canary-farm-1 151 GETs on /db/webdb/index.php in ~1 minute (18:50 EDT) plus 2 singles (/phppma, /sql/myadmin). №53's operator absent. Twentieth operator IP, sixth country.
• TTPs: unchanged — honest Go Web Pentest Tool UA, one phpMyAdmin login path, GET-only, 0 POSTs, 0 mints.
• Assessment: the fleet's phpMyAdmin decoys remain on a circulated target list; a captured credential body is still the missing intent evidence.

ATLASSIAN-REST-PROBE (Confluence/JIRA version + archive traversal) ⟳ — RETURNED ON LAUTERBOURG AFTER FIVE IDLE WINDOWS (Hostile, active)

• Actors: digest cluster b3c6048a4870 — 7 IPs / 280 events on lauterbourg-01-ts (signature first seen 10-10). Runner overlap with REGISTRY-HUNT: 159.89.174.87, 147.182.200.94, 167.172.158.128, and 128.199.182.55 all minted elsewhere this window.
• TTPs: kiteworks-root-redirect → /console/ [weblogic-console-login] → /download/resources/jira.webresources:color-picker-popup/images/..::×5::META-INF::maven::com.atlassian.jira::atlassian-ji… archive traversal. The registered /rest/api/2/serverInfo stage is absent from the sample; the Jira traversal uses 5 levels versus №48's 8.
• Assessment: moderate attribution — the family shape (Confluence/JIRA version + archive metadata reads) matches, but the missing REST stage and the lauterbourg-only spread stop short of a confirmed registration match. A second window with the REST stage settles it.

GIT-VAULT (git-internals walk) ⟳ — FOURTH 3xK IP (Hostile, active)

• Actors: 104.167.19.205 (3xK Tech GmbH, US) — canary-farm-1 06:34:29–32 EDT. The registered trio (104.207.39.149, 65.111.3.141, 216.26.239.111) and №52's pair all absent.
• TTPs: the exact registered shape — 144 events / 142 paths in 3 s, honest git/2.40.0, 143 fake-git + 1 gitignore, 0 mints.
• Assessment: the template circulates inside one ASN across four block IPs; the MEVSPACE merge trigger (third sibling) is now met on the 3xK side — the registry row should treat 3xK as the standing operator class.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — POOL + WP-ADMIN LEG (Hostile, active)

• Actors: pool e6e6f15a77e8 47 IPs / 141 events; 54 distinct IPs / 165 wp-login events on ai-devbox-1. wp-admin leg 09d3f351065c 5 IPs / 40 events.
• TTPs: probe → credential POST → probe cycles, forged modern Chrome UAs; 0 mints; well below the 200-pair alarm.
• Assessment: constant background; no change in intent.

MALWARE-DICT (Pfcloud loop) ⟳ — DAY 26+ ON CONTROL (Hostile, active)

• Actors: 204.76.203.18 (Pfcloud UG, NL) — control-1 2,017 events / 569 paths (74% of the node, ipsum:2).
• TTPs: unchanged continuous dropper-URL loop.
• Assessment: standing multi-host operator; the loop now defines control-1's baseline more than any census does.

Standing actors (persistence check)

• 45.148.10.171 — twenty-second consecutive minting window: 3 issued rows (canary-farm-1 2, ru-edge-1 1), hoard 48/6d, zero AWS use throughout, 10 events across 7 sensors. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — day 26+ on control-1 (see MALWARE-DICT).
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — fifth window, benign-listed: netcup-ts 4,028 of 4,770 events (84%), sponge-01-ts 3,518 of 4,894 (72%). Both nodes' baselines net down to a few hundred events without it.
• TOKEN-CRAWLER pool 45.198.224.x — .124 (97 ev) and .125 (73 ev) touched all 8 sensors again, including 21 lauterbourg kiteworks-root-redirect touches; 0 mints.
• 45.138.12.51 (Tc Datacenter LT) — REGISTRY-HUNT's l9explore runner, 10/6d mints, ai-devbox-1 top-talker at 176 events.
• REGISTRY-HUNT repeat minters — 109.205.176.10 (7/6d), 140.245.97.208 (9/6d, ru-edge + aidev + farm), 128.199.182.55 (4/6d), 209.38.208.202 / 209.38.248.17 / 64.23.218.208 (4/6d each), 143.110.213.72 / 143.244.168.161 / 146.190.63.248 / 147.182.200.94 / 157.245.105.107 / 159.89.12.166 / 167.99.182.39 / 206.81.24.227 (3/6d each).
• 209.99.188.170 / 209.99.189.217 collector pair — 287 flux events since 10-06 across adjacent /24s; .170 validated a canary this window (CREDENTIAL-DRAIN), .217 minted 2.
• Benign fixed-cadence probers — 89.248.172.33 (387 ev, 7 sensors), 80.82.77.202 (378, 7), 34.140.3.155 (31, 5), 130.12.180.32 (11, 4); light 7–8-sensor walkers 87.192.41.180 (70), 45.135.193.198 (24), 185.15.209.148 (14), 77.83.39.94 (13), 103.170.217.198 (11). Unchanged shapes.

Absent or paused

MEGA-DICTIONARY (first miss after 20 replays — the whole frantech-ts −97%), OMEGA-SWEEP (79.124.58.82's fourth pass missing and the /46 block's 14th), LIBREDTAIL-KIT (cluster absent, first miss after two windows), XMLRPC-BRUTE (6 background events, second silent window), LLM-ENDPOINT-PROBE (10 background events, no third operator), METADATA-HUNT named runners (only .172's 4 @fs rows), CONFIG-SWEEP (third absence), NIGHTAGENT (ninth), KEYHUNT, SS-PROBE, ZKILLU-GITWALK, MEVSPACE-GITWALK, SONICWALL-VPN-PROBE, EMPERORS-KIT (fourth), PROTON-CENSUS (third), ORACLE-SWEEP standalone, CF-FRONTED CREDSWEEP (fourteenth), CONFIGBUNDLE-SWARM, SI-CENSUS 102.220.161.x, AKAMAI-VHOST-SCAN (fifth), KITEWORKS-CRAWL's 176.123.5.6 (no promotion), 155.117.232.31, 194.59.31.39 (second), 80.94.95.211.

Network-layer recon (Arkime) — 2026-10-16 07:33:00 → 2026-10-17 07:33:32 UTC

Fingerprint field ssh.hassh, destination port 22 · 108,124 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 79,656, bahrain-sponge-01-ts 33,396, sensor:bahrain-sponge-01-ts 33,396, frantech-ts 23,425, sensor:frantech-ts 23,425, sensor:lauterbourg-01-ts 12,853

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 4,309 sessions from 241 source IPs across 129 networks in 51 countries, port 22, avg 4,918 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS4766 Korea Telecom, AS31898 Oracle Corporation, AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.. Busiest sources: 118.39.219.45, 129.121.74.52, 43.245.248.2, 129.121.117.162, 50.6.241.208. Last 7 days: 10-11 303 IPs, 10-12 319 IPs, 10-13 283 IPs, 10-14 336 IPs, 10-15 352 IPs, 10-16 281 IPs, 10-17 62 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 26,376 sessions from 75 source IPs across 26 networks in 16 countries, port 22, avg 5,035 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS48090 Techoff Srv Limited, AS146943 Tier 4 Cloud Services, AS45899 VNPT Corp. Busiest sources: 77.239.124.152, 77.239.124.148, 109.160.32.143, 77.239.124.144, 109.160.32.141. Last 7 days: 10-11 90 IPs, 10-12 81 IPs, 10-13 97 IPs, 10-14 95 IPs, 10-15 94 IPs, 10-16 80 IPs, 10-17 25 IPs.
• 16443846184eafde36765c9bab2f4397 — client banner ssh-2.0-go, 13,277 sessions from 64 source IPs across 22 networks in 17 countries, port 22, avg 5,655 B/session. Networks: AS205089 Alfahost LLC, AS12876 Scaleway S.a.s., AS24961 WIIT AG, AS14061 DigitalOcean, LLC, AS48090 Techoff Srv Limited. Busiest sources: 89.163.140.136, 77.239.124.34, 77.239.124.80, 77.239.124.33, 51.15.21.35. Last 7 days: 10-11 49 IPs, 10-12 31 IPs, 10-13 36 IPs, 10-14 41 IPs, 10-15 32 IPs, 10-16 64 IPs, 10-17 24 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. 16443846184e… crossed the dispersed threshold on day 20 and is registered as GO-SCATTER-SWEEP (added to recon-names.tsv and the registry this cycle): 13,277 sessions (+35%), 64 IPs (2×), 22 networks, banner ssh-2.0-go — Key Judgement 4's widening read. GO-SSH-SWEEP (0a07365cc01f…) re-dispersed after №53's distributed concentration: 26,376 sessions / 75 IPs / 26 networks / 16 countries, with the 77.239.124.x and 109.160.32.x sets still busiest. LIBSSH-MASSSWEEP (f555226df196…) held its ~280–360-IP plateau at 241 IPs on day 28, below the 200-source mass line on sessions. GO-SPRAY-SWEEP (06ff3615a51b…) stayed below the table — the pause continues. 2ec37a7cc8da… is unchanged (2,437 sessions / 18 IPs / 3 networks, day 20, sub-threshold, unnamed). New to the table: e54ef3ec27fe… at 25 sessions / 15 IPs / 7 networks — sub-threshold, watch only. Fleet session total 108,124 (+1.0%); lauterbourg-01-ts now carries its own tag (12,853 sessions); the contabo-sponge-02-ts tag is absent a second day.

Canary credentials

Summary

1 Tracebit alert(s) fired in the window (1 use events across 1 credentials). Fleet sensors minted 55 credentials to 37 collector IPs; 1 credential(s) reached AWS. Use outcomes: 1 success. 1 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 48 mints, 2026-10-10 07:09 → 2026-10-16 22:35
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 34.124.231.201: 40 mints, 2026-10-10 04:05 → 2026-10-10 04:05
• 209.159.155.142: 12 mints, 2026-10-11 01:40 → 2026-10-11 02:15
• 87.120.104.29: 12 mints, 2026-10-13 11:39 → 2026-10-13 19:31
• 206.209.210.3: 11 mints, 2026-10-10 08:02 → 2026-10-15 11:17
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 213.209.159.175: 10 mints, 2026-10-10 23:11 → 2026-10-16 23:44
• 45.138.12.51: 10 mints, 2026-10-10 18:27 → 2026-10-17 01:36
• 140.245.97.208: 9 mints, 2026-10-13 15:46 → 2026-10-16 19:43
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 109.205.176.10: 7 mints, 2026-10-10 08:05 → 2026-10-17 01:38
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 208.84.100.218: 6 mints, 2026-10-12 15:41 → 2026-10-12 17:51
• 213.209.159.154: 6 mints, 2026-10-11 01:02 → 2026-10-16 20:49
• 80.94.95.211: 6 mints, 2026-10-10 20:25 → 2026-10-15 03:19
• 80.94.92.65: 5 mints, 2026-10-11 13:35 → 2026-10-16 07:17
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 128.199.182.55: 4 mints, 2026-10-10 19:57 → 2026-10-17 03:52
• 165.22.34.189: 4 mints, 2026-10-11 19:58 → 2026-10-15 21:06
• 167.172.232.142: 4 mints, 2026-10-10 19:58 → 2026-10-14 20:10
• 185.177.72.64: 4 mints, 2026-10-11 23:36 → 2026-10-14 22:52
• 209.38.208.202: 4 mints, 2026-10-10 20:44 → 2026-10-17 02:37
• 209.38.248.17: 4 mints, 2026-10-11 20:32 → 2026-10-16 21:02
• 37.60.226.187: 4 mints, 2026-10-14 07:08 → 2026-10-14 16:42
• 64.23.218.208: 4 mints, 2026-10-14 20:03 → 2026-10-17 04:08
• 79.124.58.82: 4 mints, 2026-10-14 18:50 → 2026-10-15 11:00
• 139.59.231.238: 3 mints, 2026-10-11 20:35 → 2026-10-14 19:58
• 143.110.213.72: 3 mints, 2026-10-11 19:57 → 2026-10-16 19:01
• 143.244.168.161: 3 mints, 2026-10-11 20:35 → 2026-10-16 21:05
• 146.190.63.248: 3 mints, 2026-10-13 20:08 → 2026-10-16 21:05
• 147.182.200.94: 3 mints, 2026-10-11 20:15 → 2026-10-16 18:47
• 157.245.105.107: 3 mints, 2026-10-12 20:41 → 2026-10-16 18:47
• 157.245.113.227: 3 mints, 2026-10-11 19:59 → 2026-10-15 18:39
• 159.89.12.166: 3 mints, 2026-10-12 20:41 → 2026-10-17 02:27
• 167.71.81.114: 3 mints, 2026-10-12 20:03 → 2026-10-12 20:41
• 167.99.182.39: 3 mints, 2026-10-12 20:42 → 2026-10-17 04:08
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 172.93.215.8: 3 mints, 2026-10-11 00:27 → 2026-10-12 16:55
• 206.81.24.227: 3 mints, 2026-10-10 20:43 → 2026-10-16 19:01
• 209.99.189.217: 3 mints, 2026-10-16 03:02 → 2026-10-16 11:19
• 217.60.76.167: 3 mints, 2026-10-10 03:42 → 2026-10-12 10:00
• 46.101.111.185: 3 mints, 2026-10-12 20:06 → 2026-10-15 20:32

Attribution notes. 209.99.188.170 is the window's only use-side row — its mint predates the flux window start (06:25:15Z vs 07:33Z; the flux issued row appears at the +4 h cast seam), so Tracebit is the mint's sole flux-side witness and the journey comes from its 158 all-time flux events: a frantech-ts pass (tarpit, openapi-spec-json-skeleton, webshell-sweep-observed) and the ai-devbox-1 config census that minted — aws-credentials-file ×2, env-production, docker-compose, app-config-php, iis-web-config, ssh-private-key-error, over /terraform.tfstate, /docker-compose.yml, /id_rsa, /web.config, /.git/config paths. 102.220.163.155's single farm mint maps to the CREDSWEEP second window. The sixteen REGISTRY-HUNT rows map 1:1 to that section's runner list. 92.38.172.10 is a new two-sensor collector (aidev + control, 23:16 EDT, 5 events on 5 sensors). 129.213.151.234 (research-scan/1.0, borderline per registry) minted on ru-edge. 140.245.97.208 (Oracle space) collected on three sensors (9/6d).

Watch-class singles (no campaign yet)

• 45.67.216.15 (Contabo GmbH, FR) — lauterbourg-01-ts 161 events / 17 families / 84 paths (17:15–17:16 EDT), forged Chrome/126: webshell-probe 28 (owns most of the node's 5.5× spike), not-handled 93, observability-health 8, kiteworks legs 12, telescope/gravitysmtp singles, 2 POST / (302s, bodies empty). Promote on a repeat or any mint.
• 93.152.221.158 — lauterbourg-01-ts 46 events in 19 s (09:19 EDT) under 6 rotating modern UAs, webshell-probe 11. Same /24 as CONFIG-SWEEP's departed 93.152.223.194 — lineage note only. Promote on a repeat.
• 104.64.127.170 + 172.105.54.41 — Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about); UA, 2 events each on netcup-ts / lauterbourg-01-ts / frantech-ts in ~1 s bursts (04:30–05:47 EDT). Onlyscans-branded banner scanner; promote on volume or a credential path.
• First-seen inventory (03:15 sync-arrival cluster): sponge/netcup .env directory variants (/client-app/.env, /basic-network/.env, /.git/.env, /repos/.env, /services/traefik/.env, /hasura/.env), lauterbourg's /server.php, /manage/env, /old.php, /wp-content/plugins/bitfire/bitfire_data/config.ini, and the favicon/WiseNet image paths — inventory, not timelines.

Fleet Observations

Canary economics. 57 digest issued rows; 55 credentials to 37 collectors after dedupe; 1 credential used (1 success, 0 denied). Mint failures: 14×400 (aidev 7, farm 5, ru-edge 2) — upstream rejections under census-burst pacing, the №17/№19 mechanism; no 401s. All-time issued-row counter: 2,409 (visuals run). Per-node mints: canary-farm-1 21 / 18 IPs, ai-devbox-1 20 / 16, control-1 10 / 6, ru-edge-1 6 / 6.

Attribution and TLS posture. XFF counters: any 1,711 / multi-entry 6 / ignored-internal 7 / single-entry mismatch 0. №53's 25-request multi-entry burst did not persist (6 this window, none used as source) — one more quiet window closes that watch. Host census flipped on lauterbourg-01-ts: the kiteworks.rightabouteverything.show vhost carried 830 events versus 576 bare-IP (№53: 42 versus 1,069) — the Atlassian cluster plus KITEWORKS-class walkers went TLS-led. ai-devbox-1's inference.fapthropic.com led at 1,235 (bare 731); canary-farm-1's sso.rightabouteverything.show 744 (bare 1,379).

Volume moves and causes. netcup-ts +63% (4,770): Bochum 4,028 (84%). sponge-01-ts +89% (4,894): Bochum 3,518 (72%) + Bucklog .50/.64 (535) + Feo Prest 171. frantech-ts −97% (487): MEGA-DICTIONARY's 13,606-event replay absent — the entire delta. control-1 −27% (2,715): №53's three-census barrage fell out of window; the Pfcloud loop (2,017) remains the base load. ru-edge-1 −48% (889): CONFIG-SWEEP and OMEGA absent. canary-farm-1 −10% (2,132): .155's census (514) replaced №53's larger cluster. ai-devbox-1 −2% (1,990). lauterbourg-01-ts −11% (1,441): Alexhost and the ORACLE pivot pass absent, partly offset by the Atlassian cluster (280) and the Contabo walker (161).

Result-tag spike attribution. Both spikes have causes: canary-farm-1 phpinfo 73 (3.6×) = 102.220.163.155 (54) + singles; lauterbourg-01-ts webshell-probe 42 (5.5×) = 45.67.216.15 (28) + 93.152.221.158 (11) + singles.

control-1 discovery velocity. Day 34: 2,715 events from 102 unique IPs. The unique-IP count sits inside the 84–157 band for a 26th consecutive window; volume fell 27% from №53's census-driven record. No new discoverers.

Digest quirks. First-seen timestamps again cluster at the sync-arrival minute (03:15:44–55) — inventory, not timeline. The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk). The +4 h ingest cast put one row on the seam this cycle: the validator's mint (flux 06:25:15 EDT = Tracebit 06:25:15Z; Tracebit authoritative — cross-checked against the alert log). Top-talker counts exclude tarpit-disconnect pairing rows (№47 convention). The ai-devbox-1 rotated-file gap enters its sixteenth cycle. No new quirk this cycle.

Fleet-side changes this cycle. flux-visuals.py CHAINS: OMEGA-SWEEP, MEGA-DICT, LIBREDTAIL-KIT → idle; ATLASSIAN-REST-PROBE, GIT-VAULT → active; №54 notes added for GOWEB-PENTEST, CREDENTIAL-DRAIN, REGISTRY-HUNT, CREDSWEEP, BUCKLOG-KIT (RCE capture), XMLRPC-BRUTE, MALWARE-DICT, WP-FORM-BRUTE, CONFIG-SWEEP, LLM-ENDPOINT-PROBE, KITEWORKS-CRAWL; TALKER_CAMPAIGNS gained 185.177.72.50, 190.93.152.243, 104.167.19.205, 209.99.188.170. recon-names.tsv: GO-SCATTER-SWEEP registered (16443846184e…). Visuals rerun after the CHAINS edit: flux-fleet-visuals-2026-10-17-r2.html.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 411 sources sent credentials → 324 got a shell (79%) → 265 ran a command (82% of shell-getters, 64% of sources). Event level: 19,441 credential attempts → 3,765 accepted logins → 6,429 commands (171% of accepted logins go on to run something). Telnet (commodity IoT botnets): 857 attempts, down from №53's 5,292.

Twenty-seventh static command window. New commands: 0 of 54 distinct. The .ssh replant pair stays dominant (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,006 events / 201 IPs; the key-replace chain at 913 / 191). The hardware-survey battery continues: 142.93.43.28's class ran uptime -p, lspci, /bin/./uname -s -v -n -r -m, and nvidia-smi -q product-name extraction — 342 events each across 6 IPs; 8.134.58.87 soloed 625 echo-probe events. Recurring commands are context, not news.

Credential concentration persists. 14,371 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 951 attempts and root/3245gs5662d34 at 714 — the fixed-pair sprayers hold the funnel for a ninth window. No new pairs to report.

Gaps / Next Collection

1. kingfisher-scanner/1.2.0. Identify the validator tool and watch 209.99.188.170 for any call beyond GetCallerIdentity — the 10-16 credential is TTL-live until 18:25:16Z, and the IP's three 10-09 canaries age in the same hoard pattern as the 40+ lists.
2. BUCKLOG-KIT's read-back question. The fake-200 webshell makes .50's run look successful; whether any reader or the exec probe returned real bytes needs a bodyBytesRead/response-size check against the captured nonce (d11531bc79e6ccb7). A second RCE-stage IP or a dropper POST promotes the stage to standing.
3. GO-SCATTER-SWEEP's second dispersed window. One more window confirms the pool-widening read; a KEX/banner comparison against GO-SSH-SWEEP's current source set would settle whether one crew runs both ssh-2.0-go fingerprints.
4. MEGA-DICTIONARY's miss. A second consecutive window retires the replay cadence to paused; the wordlist stands at №53's 13,606 paths.
5. .155's spread. The second pass was farm-only; a third node or an AWS validation makes the SI org a confirmed multi-template, multi-node operator.
6. contabo-sponge-02-ts. Its Arkime tag is absent a second day (9,765 sessions in №52, absent since) — confirm whether provisioning stalled or the tag dropped.
7. lauterbourg walkers. 45.67.216.15 and 93.152.221.158 both merit repeat checks; either returning with a mint or a POST body promotes them.

Digest: /data/flux-logs/reports/flux-digest-2026-10-17.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-17.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-17-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-17.md

Watch next cycle: (1) 209.99.188.170 / kingfisher-scanner — any AWS call beyond GetCallerIdentity from the validated hoard; (2) BUCKLOG-KIT's RCE stage — read-back check on .50's run and any second operator IP; (3) GO-SCATTER-SWEEP's second dispersed window and MEGA-DICTIONARY's second miss.