FLUX FLEET — INTEL BRIEFING №55

Period: 2026-10-17 07:33 – 2026-10-18 07:33 UTC (24h, day 53 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 53-day baseline, use side verified against Tracebit alert logs; the two provisioning attempts are quote-level facts)

BLUF

Credential abuse escalated from single validations to fleet-scale cloud inventory sweeps: 18 Tracebit alerts carried 2,227 AWS events across 11 canaries, against a mint side of 45 credentials to 33 collectors. One egress IP, 168.222.244.156, ran an identical 23-operation inventory sweep (EC2, RDS, KMS, Secrets Manager, SSM, CodePipeline, Lambda, CloudFormation, CodeBuild) with Boto3/1.43.114 against the canaries of seven LeakIX/REGISTRY-HUNT runners; 185.209.196.169 used the canary of a NEW ru-edge census operator, WebSiphon/next-0.1, and drew the fleet's first provisioning-shaped calls — denied ec2:RunInstances and ec2:PurchaseCapacityBlock. All 1,051 successful calls were sts:GetCallerIdentity; the legacyOwnerAccess-DenyAll policy denied the other 1,176 operations. MEGA-DICTIONARY returned from its first miss in 21 windows with two new operators replaying the identical 13,612-path wordlist on frantech-ts (+121%, 96% of the node's volume). The network layer flagged four dispersed sweeps: GO-SPRAY-SWEEP re-crossed its threshold and GO-SSH-SWEEP reached a record 124 source IPs.

Key Judgements

1. LeakIX's mint base now feeds an automated AWS inventory validator, not ad-hoc curiosity. Seven credentials minted by seven different l9scan runners were each worked through the same 23-operation sweep from one egress IP, 168.222.244.156, within minutes of the 19:58–20:42 UTC mint wave — about 289 events per credential, one UA (Boto3/1.43.114 … os/linux#7.0.0-38-generic … lang/python#3.12.15), every operation denied except GetCallerIdentity. (High confidence — the Tracebit alert logs are direct evidence; whether 168.222.244.156 is LeakIX's own screen or a downstream buyer of the hoards is unmeasured.)
2. WebSiphon is the first actor to attempt compute provisioning with a fleet canary. Its ru-edge census minted at 12:36:43 UTC, and the two credentials were worked from 185.209.196.169 with sts:GetCallerIdentity, SSM GetParameter, EC2 DescribeVpcs/DescribeImages/DescribeCapacityBlockOfferings, Service Quotas reads, and denied ec2:RunInstances + ec2:PurchaseCapacityBlock. (High confidence on the calls — they are in the alert logs. Moderate on intent: quota and capability screening versus an actual launch attempt are indistinguishable from outside; both were denied.)
3. MEGA-DICTIONARY is a shared marketplace artifact, not a crew. Two new operators on unrelated hosting (Datacamp SG, M247 Europe) fetched the same 13,612-path wordlist within one window, and 13,606 paths (99.96%) were already on record from 20 prior replays by at least six other hosts. The wordlist persists; the hosts are disposable. (High confidence — the anti-join is exact; the acquisition channel between operators is unknown.)
4. Attribution on the Cloudflare-fronted vhost is now actively polluted. A 13:04 UTC burst on ai-devbox-1 rode the Cloudflare edge (socket peer 104.28.250.135) while its single-entry X-Forwarded-For names impossible sources — including two RFC-multicast addresses (225.237.161.35, 233.90.58.220) — and two of the window's canary mints carry those multicast labels. The real collector sits behind the CF edge and is unknown; pivot on socketPeer, never on clientIp, for these rows. (High confidence on the mechanics — 20 rows inspected individually.)

Active Campaigns (day 53 status)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ESCALATION: 11 CANARIES USED, 3 USE IPS, FIRST PROVISIONING ATTEMPTS (Hostile, active)

• Actors: mint side 53 digest issued rows = 45 credentials to 33 collector IPs after Tracebit dedupe. Use side: 168.222.244.156 (23-op sweep against 7 credentials from 138.68.82.23, 147.182.200.94, 157.230.19.140 ×2 sensors, 159.223.132.86, 164.90.228.79, 167.71.175.236, 64.23.218.208); 185.209.196.169 (WebSiphon's 2 ru-edge credentials; the /24 hosted MEGA-DICT replays 185.209.196.130/.172 in №49/№51 — lineage note only); 137.23.38.53 (self-validated 2 of its own mints, Python-urllib/3.14 — the funnel's established self-use pattern).
• TTPs: the 23-op sweep ran EC2 Describe* ×12, RDS DescribeDBInstances, KMS ListKeys, Secrets Manager ListSecrets, SSM DescribeParameters, DynamoDB ListTables, Lambda ListFunctions20150331, EKS ListClusters, CodeBuild/CodePipeline List*, CloudFormation ListStacks/ListStackSets, plus GetCallerIdentity, in a polling loop (~289 events/credential). Denied-operation leaders: DescribeParameters ×119, ListSecrets ×91, ListKeys ×91, DescribeDBInstances ×84, ListTables ×84. Outcomes: 1,051 successes — all sts:GetCallerIdentity — and 1,176 denials under legacyOwnerAccess-DenyAll. WebSiphon's use added GetParameter, ListServiceQuotas/GetServiceQuota, DescribeCapacityBlockOfferings, and the two denied provisioning calls.
• Assessment: collectors now screen credentials with full service-by-service inventory tooling before (or instead of) operating them, and at least one actor probed for compute-launch capability. Any success beyond GetCallerIdentity, from either use IP or from the 43-/12-mint hoards (45.148.10.171, 213.209.159.175), is the escalation signal. The DenyAll policy and per-canary principal held at zero effective permission.

WEBSIPHON (7-second, 71-family config/secret census) ⚠ NEW (Hostile, active)

• Actors: 147.224.147.131 (Oracle Corporation US) — ru-edge-1 only, 380 events / 292 paths / 71 trap families in 7.3 s (12:36:43–12:36:50 UTC), single honest UA WebSiphon/next-0.1. The family count is the second highest on record (OMEGA-SWEEP's 107).
• TTPs: /.env [issued] first — the window's mint — then the walk: 30 env-production variants, config.json/secrets.json/settings.json, app-config-yaml ×8, terraform-tfstate ×8 + terraform-tfvars ×4, k8s-secret-manifest ×5, aws-credentials-file ×5 + aws-credentials-json ×3, firebase-json ×5, serverless-config, streamlit-secrets, rails-secrets-yml, docker-compose, wp-config. Tarpit absorbed the remainder.
• Assessment: a purpose-built high-speed census that goes straight for cloud and orchestration secrets, and its operator immediately worked the take in AWS. Watch for a second node or IP; the UA is the fingerprint.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — RUNNERS' CANARIES VALIDATED FROM ONE EGRESS (Borderline, active)

• Actors: ~18 issued rows to 16 l9scan IPs in the 19:58–20:42 UTC wave — 64.23.218.208 ×3 (aidev ×2 + farm), 157.230.19.140 ×2 (control + aidev), and one each from 128.199.182.55, 138.68.82.23, 147.182.200.94, 159.223.132.86, 159.89.12.166, 164.90.228.79, 165.22.34.189, 167.71.175.236, 167.172.158.128, 167.172.232.142, 167.99.182.39, 167.99.210.137. Farm cluster 850993125b15 6 IPs / 246 events; the tarpit-only sibling 4b4cc0ece037 ran 36 IPs across farm/aidev/control/ru-edge. UA variants as before (l9scan/2.0.632323… aidev-class, 2.0.234313… farm-class, 2.0.930323…, 2.0.6343…).
• TTPs: the unchanged 27-family journey (tarpit → WebLogic → Confluence → WHM/cPanel → /v2/_catalog → docker-registry tags/manifests), ~1 mint per runner — and, for the first time, downstream AWS validation of those mints by 168.222.244.156 (see CREDENTIAL-DRAIN).
• Assessment: the repeat-minter base persists at ~1 mint per runner and now demonstrably hands off to an AWS-side validator. Borderline per registry; the leak-scanner brand no longer means harmless when its mints are inventory-swept within minutes.

BUCKLOG-KIT (census + phpunit RCE kit) ⟳ — THREE RUNS, NEW CAPABILITY BATTERY (Hostile, active)

• Actors: 185.177.72.50 (Bucklog SARL FR, ipsum:3+firehol2) — sponge-01-ts, 304 events / 40 phpunit-eval-stdin POSTs in three passes (05:31, 10:53, 23:11–23:17 UTC). Census arm 185.177.72.64 absent.
• TTPs: pass 1 and 2 re-ran the №54 kit — md5 verify <?php echo md5("6b3804159d5abceb"); ?>, the ---PATHSCAN_ENV_BEGIN--- reader, $maxfiles=48 (then 56) config/log/sqlite readers with 8-level ../ loops, the secrets sweep naming .ssh/id_rsa, .ssh/id_ed25519, .aws/credentials, and the exec probe $nonce="d11531bc79e6ccb7"; $cmd="id; hostname; uname -a 2>/dev/null"; pass 2 adds a $skip config-reader variant. Pass 3 is a NEW capability battery: <?php echo "AUDITOK|".PHP_VERSION."|"; … cwd walker; A:VERSION:exec/noexec shell_exec check over a fixed .env path list; ID:getmyuid:hostname; ENV:APP_ENV:APP_KEY; four execution-mechanism tests (echo "C1"."C2", M».(1+1), variable echo, print, ); md5/sha1/time/strlen oracles; then a PATHSCAN re-run and ENVK: getenv()` key dump + composer.lock reader. Every POST drew a fake-200 webshell.
• Assessment: the operator moved from file-read kits to an explicit survey of which PHP execution and disclosure primitives work on the target. The fake 200s fed every probe at zero cost. Whether any reader returned real bytes is still not visible in bodyPreview (second cycle with this gap).

MEGA-DICTIONARY (shared IoT dropper-URL wordlist replay) ⟳ — RETURNED AFTER ONE MISS, TWO OPERATORS, ONE WORDLIST (Hostile, active)

• Actors: 138.199.60.3 (Datacamp Limited SG, ipsum:1) — frantech-ts 13,669 events 07:21:45–07:25:22 UTC (3 m 37 s); 146.70.200.3 (M247 Europe SRL) — frantech-ts 13,612 events 00:31:16–00:32:50 UTC (1 m 34 s). Sixth and seventh hosting organizations on the wordlist (after tzulo, 31173 Services AB ×2, Pfcloud-class hosts, Datacamp CH/US legs).
• TTPs: both fetched 13,612 distinct paths, 1:1 events-to-paths for .3 and 57 duplicate fetches for .138.199.60.3; anti-join against all prior frantech history: 13,606 of 13,612 paths (99.96%) seen before — 6 new paths each. Results: not-handled 13,665 / 13,608 plus one each gravitysmtp-miss, llm-endpoint-ollama-ps, exchange-powershell-pre-auth, observability-profiler-index. Hundreds of rotating IoT/router/NAS user agents (D-Link, TP-LINK, Synology, Wavlink, MikroTik, RomPager, boa, DD-WRT…), GET-only, 0 POSTs, 0 mints. Together the two replays are 27,281 of the node's 28,291 events (96%).
• Assessment: the artifact circulates among unrelated hosting customers; tracking the wordlist (not the hosts) is the right model. The +6-path drift matches the №34 growth pattern — keep the anti-join delta per replay.

INFOCREST-KIT (adminer prod_rw + wp-batch composite kit) ⟳ — RETURNED, THREE NODES IN ONE SESSION (Hostile, active)

• Actors: 37.19.200.138 (Datacamp Limited US) — canary-farm-1 106 events (17:21–17:26 UTC), lauterbourg-01-ts 180 (17:53–18:05), ai-devbox-1 115; 2 mints (farm /.env under Chrome/107 at 17:24, aidev under Firefox/105 at 18:32). UAs rotate: Firefox/105, python-requests/2.32.5, Chrome/106, Chrome/107.
• TTPs: the registered anatomy — POST /adminer.php, /adminer/adminer.php, /admin/adminer.php with auth[username]=prod_rw&auth[password]=ZbtXxWNnjb15U0CjE1zYTw (fresh 22-char password, INFOCREST shape); wp-batch-rejected {"requests": []} then a nested-multiplex {"requests": [{"method": "POST", "path": "///"}, …]} 207; form login user=root&pass=wrong; on lauterbourg the kiteworks legs (POST kiteworks-root-redirect ×8, kiteworks-login-attempt 401); webshell-sweep HEADs; phpmyadmin GETs.
• Assessment: the commodity kit now rides the Kiteworks decoy too. Operator and password rotate per run, exactly per registry. A captured successful adminer login remains the missing intent evidence.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — EIGHTEENTH WINDOW, FIRST FRANTECH PASS (Hostile, active)

• Actors: 198.100.154.28 (OVH SAS CA) — frantech-ts, 151 GETs on /mysql/webdb/index.php in 13 s (00:26:35–00:26:48 UTC). №54's operator absent. Twenty-first operator IP, seventh node-node pairing, first on frantech.
• TTPs: unchanged — honest Go Web Pentest Tool UA, one phpMyAdmin login path, GET-only, 0 POSTs, 0 mints; owns frantech's phpmyadmin-login 6.3× spike (152 events).
• Assessment: the decoy list keeps circulating; a captured credential body is still unseen.

OMEGA-SWEEP (150-path byte-identical census) ⟳ — REGISTERED OPERATOR RETURNED (Hostile, active)

• Actors: 79.124.58.82 (Tamatiya EOOD BG) — sponge-01-ts, 150 GETs / 150 paths / 5 families in ~1 minute (22:30 UTC). The /46 census block (94.154.46.x) missed a 15th window.
• TTPs: the registered 150-path pass shape, 1:1 events-to-paths.
• Assessment: the standing crew read from №52–№53 is back on; watch whether the pass count resumes its 3-passes/26-h cadence.

KEYDROP-SCANS (Onlyscans-branded banner scanner) ⚠ PROMOTED FROM №54 WATCH (Hostile, active)

• Actors: 104.64.127.170 + 172.105.54.41 under Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about); — the pair touched all 8 sensors, 2 events per sensor (/.env + /.git/config), and minted on every canary node they could: ru-edge 07:08, control 09:19, canary-farm 11:29 (.170) and ai-devbox 13:04 (.41) — 4 mints.
• TTPs: minimal two-path checker per node; .git/config drew fake-git on canary nodes, not-handled on certless ones.
• Assessment: promotion condition met exactly as armed in №54 ("volume or a credential path"). A banner scanner that collects credentials gets tracked as a collector; the 4 canaries are hostile-held inventory.

ATLASSIAN-REST-PROBE (Confluence/JIRA version + archive traversal) ⟳ — SECOND WINDOW, REST STAGE STILL ABSENT (Hostile, active — moderate attribution)

• Actors: cluster b3c6048a4870 again — 7 IPs / 280 events on lauterbourg-01-ts; runners overlap REGISTRY-HUNT (128.199.182.55, 147.182.200.94, 159.89.174.87, 64.227.70.2 all minted elsewhere this window).
• TTPs: kiteworks-root-redirect → /console/ [weblogic-console-login] → the 5-level Jira color-picker archive traversal. The registered /rest/api/2/serverInfo stage: 0 hits in the window (checked directly). The lauterbourg method-not-allowed spike (22, 3.9×) is separate — OPTIONS/PROPFIND probes led by 45.79.190.96 (13 on /).
• Assessment: two consecutive windows without the REST stage hold attribution at moderate; a third window with the stage present would re-confirm the №48 registration rather than a REGISTRY-HUNT sub-variant.

WP-FORM-BRUTE (distributed wp-login brute) ⟳ — POOL GREW, WP-ADMIN LEG QUADRUPLED (Hostile, active)

• Actors: pool e6e6f15a77e8 53 IPs / 159 events (was 47); wp-admin leg 09d3f351065c 15 IPs / 120 events (was 5 IPs / 40).
• TTPs: probe → credential POST → probe cycles, forged modern Chrome UAs; 0 mints; pair count well below the 200-pair alarm.
• Assessment: background growth, not a shift in intent; the wp-admin leg's 3× IP growth is the number to watch.

Standing actors (persistence check)

• 45.148.10.171 — twenty-third consecutive minting window: 3 issued rows (canary-farm-1 2, ru-edge-1 1), hoard 43/6d, zero AWS use throughout, 13 events across 8 sensors. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — day 27+ on control-1: 2,047 of 3,050 node events (67%), ipsum:2. The loop still defines control-1's baseline.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — sixth window, benign-listed: netcup-ts 4,175 of 5,050 events (83%), sponge-01-ts 4,170 of 5,346 (78%). Both nodes' baselines net down to a few hundred events without it.
• TOKEN-CRAWLER pool 45.198.224.x — .124 (97 ev) and .125 (73 ev) touched all 8 sensors again, 21 lauterbourg kiteworks-root-redirect touches; 0 mints.
• 45.138.12.51 (Tc Datacenter LT) — REGISTRY-HUNT's l9explore runner, 9/6d mints, 176 events across frantech + sponge.
• 213.209.159.175 (Feo Prest) — 4 mints on control-1, hoard 12/6d, four antique UA forgeries; 45.138.12.51 and 109.205.176.10 (7/6d) both minted again.
• Crossnode mint collectors to watch: 92.38.172.10 (3/6d, Mozilla/5.0 (compatible), 5 sensors), 23.234.78.109 (2 mints, farm + aidev), 192.253.248.173 (2 mints, farm + control — and 192.253.248.216 is GO-SSH-SWEEP's busiest network-layer source this window, a same-/24 two-layer presence), 213.254.175.25/.244 (python-requests/2.26.0 pair), and 130.12.180.168/.171 (Chrome/147, mints on aidev + farm at 16:49 — new hosts in the /24 of benign-listed prober 130.12.180.32; not auto-benign, watch).
• Benign fixed-cadence probers — 89.248.172.33 (378 ev, 7 sensors), 80.82.77.202 (378, 7), 34.140.3.155 (43, 8), 130.12.180.32 (11, 4); light 7–8-sensor walkers 87.192.41.180, 45.135.193.198, 103.170.217.198, 77.83.39.94. Unchanged shapes.

Absent or paused

METADATA-HUNT named runners (second consecutive idle window — no __aws_leak_probe/@fs/.mcp.json markers beyond noise), CF-FRONTED CREDSWEEP (the №37 operator absent; the CF-fronted burst this window is XFF noise, not the census), CONFIG-SWEEP (fourth absence), OMEGA's /46 block (15th), XMLRPC-BRUTE (silent), NIGHTAGENT (tenth), LIBREDTAIL-KIT, CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, EMPERORS-KIT, PROTON-CENSUS, ORACLE-SWEEP standalone, CONFIGBUNDLE-SWARM, KITEWORKS-CRAWL's 176.123.5.6, LLM-ENDPOINT-PROBE (no third operator), AKAMAI-VHOST-SCAN, SI-CENSUS 102.220.161.x, CREDSWEEP's 102.220.163.155 (second absent window after two passes) and Feo Prest 213.209.159.154, the 209.99.188.170/.217 collector pair, MEGA-DICTIONARY's prior hosts, Bucklog census arm 185.177.72.64, lauterbourg watch singles 45.67.216.15 and 93.152.221.158.

Network-layer recon (Arkime) — 2026-10-17 07:33:00 → 2026-10-18 07:34:09 UTC

Fingerprint field ssh.hassh, destination port 22 · 120,812 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 82,940, bahrain-sponge-01-ts 35,021, sensor:bahrain-sponge-01-ts 35,021, frantech-ts 25,245, sensor:frantech-ts 25,245, sensor:ru-vps-01-ts 20,729

Flagged sweeps (4) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 4,816 sessions from 268 source IPs across 138 networks in 53 countries, port 22, avg 4,931 B/session. Networks: AS4766 Korea Telecom, AS16276 OVH SAS, AS8075 Microsoft Corporation, AS14061 DigitalOcean, LLC, AS31898 Oracle Corporation. Busiest sources: 86.102.111.211, 199.19.225.232, 43.173.123.204, 220.80.223.144, 61.220.235.10. Last 7 days: 10-12 319 IPs, 10-13 283 IPs, 10-14 336 IPs, 10-15 352 IPs, 10-16 281 IPs, 10-17 257 IPs, 10-18 86 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 29,216 sessions from 124 source IPs across 54 networks in 23 countries, port 22, avg 5,236 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS208137 Feo Prest SRL, AS25184 Afranet. Busiest sources: 192.253.248.216, 77.239.124.144, 77.239.124.146, 77.239.124.147, 77.239.124.149. Last 7 days: 10-12 81 IPs, 10-13 97 IPs, 10-14 95 IPs, 10-15 94 IPs, 10-16 80 IPs, 10-17 129 IPs, 10-18 26 IPs.
• 16443846184eafde36765c9bab2f4397 — client banner ssh-2.0-go, 13,044 sessions from 55 source IPs across 22 networks in 17 countries, port 22, avg 5,639 B/session. Networks: AS205089 Alfahost LLC, AS12876 Scaleway S.a.s., AS24961 WIIT AG, AS7629 5F L.V. Locsin Bldg, AS63961 Bangladesh Research and Education Network BdREN. Busiest sources: 89.163.140.136, 77.239.124.66, 77.239.124.41, 77.239.124.79, 51.15.21.35. Last 7 days: 10-12 31 IPs, 10-13 36 IPs, 10-14 41 IPs, 10-15 32 IPs, 10-16 64 IPs, 10-17 46 IPs, 10-18 37 IPs.
• …and 1 more flagged fingerprint(s) in recon-2026-10-18-r3.json.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. The four flagged fingerprints are all registered campaigns, first time the flag list has no unnamed entrant. GO-SPRAY-SWEEP (06ff3615a51b…) re-crossed the dispersed threshold — 54 IPs / 33 networks / 255 sessions — after the №54 pause row; its bursty re-cross pattern (№28, №32, now №55) is the standing shape. GO-SSH-SWEEP (0a07365cc01f…) set its record spread: 124 source IPs (+49 day-over-day) across 54 networks, 29,216 sessions, with 192.253.248.216 the busiest single source — the same /24 as HTTP-side mint collector 192.253.248.173, a two-layer presence worth a flag but not yet a merge. GO-SCATTER-SWEEP (16443846184e…) confirmed its second dispersed window (55 IPs / 22 networks / 13,044 sessions, −233): the №54 pool-widening read stands, still no authentication, still a distinct fingerprint from GO-SSH-SWEEP. LIBSSH-MASSSWEEP (f555226df196…) held its plateau on day 29: 268 IPs / 138 networks, inside the ~257–360 band it has occupied for a month. Unflagged but rising: 98ddc5604ef6… (3,475 sessions, +2,455, 20 IPs / 13 networks, 15 days on record) — below threshold, watch. 4e066189c3bb… carried 16,595 sessions on 11 IPs, control-1's top fingerprint. Session tags drifted this cycle — bahrain-sponge-01-ts (35,021) now labels control-1's traffic, ru-vps-01-ts (20,729) labels ru-edge-1's, and contabo-sponge-02-ts (11,713) labels canary-farm-1's; the per-node table is IP-keyed and unaffected (this also resolves №54's gap item: the contabo tag exists again, attached to another node's sessions — a tagging regression, not a provisioning change).

Canary credentials

Summary

19 Tracebit alert(s) fired in the window (2350 use events across 11 credentials). Fleet sensors minted 45 credentials to 33 collector IPs; 11 credential(s) reached AWS. Use outcomes: 1239 failure, 1111 success. Denied operations: DescribeParameters×119, ListSecrets×98, ListKeys×98, ListTables×91, DescribeDBInstances×91. 1111 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 43 mints, 2026-10-11 04:19 → 2026-10-17 23:32
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 213.209.159.175: 12 mints, 2026-10-12 19:47 → 2026-10-17 23:28
• 87.120.104.29: 12 mints, 2026-10-13 11:39 → 2026-10-13 19:31
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 140.245.97.208: 9 mints, 2026-10-13 15:46 → 2026-10-16 19:43
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 206.209.210.3: 9 mints, 2026-10-11 07:21 → 2026-10-15 11:17
• 45.138.12.51: 9 mints, 2026-10-11 09:02 → 2026-10-17 01:36
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 109.205.176.10: 7 mints, 2026-10-11 11:37 → 2026-10-18 04:42
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 208.84.100.218: 6 mints, 2026-10-12 15:41 → 2026-10-12 17:51
• 165.22.34.189: 5 mints, 2026-10-11 19:58 → 2026-10-17 20:29
• 80.94.92.65: 5 mints, 2026-10-11 13:35 → 2026-10-16 07:17
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 159.89.12.166: 4 mints, 2026-10-12 20:41 → 2026-10-17 20:23
• 167.172.232.142: 4 mints, 2026-10-12 19:55 → 2026-10-17 20:23
• 185.177.72.64: 4 mints, 2026-10-11 23:36 → 2026-10-14 22:52
• 209.38.248.17: 4 mints, 2026-10-11 20:32 → 2026-10-16 21:02
• 213.209.159.154: 4 mints, 2026-10-15 09:15 → 2026-10-16 20:49
• 37.60.226.187: 4 mints, 2026-10-14 07:08 → 2026-10-14 16:42
• 79.124.58.82: 4 mints, 2026-10-14 18:50 → 2026-10-15 11:00
• 80.94.95.211: 4 mints, 2026-10-13 20:10 → 2026-10-15 03:19
• 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
• 128.199.182.55: 3 mints, 2026-10-11 20:05 → 2026-10-17 03:52
• 139.59.231.238: 3 mints, 2026-10-11 20:35 → 2026-10-14 19:58
• 143.110.213.72: 3 mints, 2026-10-11 19:57 → 2026-10-16 19:01
• 143.244.168.161: 3 mints, 2026-10-11 20:35 → 2026-10-16 21:05
• 146.190.63.248: 3 mints, 2026-10-13 20:08 → 2026-10-16 21:05
• 157.245.105.107: 3 mints, 2026-10-12 20:41 → 2026-10-16 18:47
• 157.245.113.227: 3 mints, 2026-10-11 19:59 → 2026-10-15 18:39
• 167.71.81.114: 3 mints, 2026-10-12 20:03 → 2026-10-12 20:41
• 167.99.182.39: 3 mints, 2026-10-12 20:42 → 2026-10-17 04:08
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 209.38.208.202: 3 mints, 2026-10-16 20:15 → 2026-10-17 02:37
• 209.99.189.217: 3 mints, 2026-10-16 03:02 → 2026-10-16 11:19
• 46.101.111.185: 3 mints, 2026-10-12 20:06 → 2026-10-15 20:32
• 64.227.70.2: 3 mints, 2026-10-12 20:30 → 2026-10-17 20:00
• 92.38.172.10: 3 mints, 2026-10-16 23:16 → 2026-10-17 07:55

Attribution notes. The 23-op sweep is one tool on one egress IP (168.222.244.156, UA Boto3/1.43.114 … os/linux#7.0.0-38-generic … lang/python#3.12.15, plus one python-httpx/0.28.1 GetCallerIdentity probe per credential) across seven credentials minted 19:58–20:42 UTC 10-17 by seven l9scan runners; the sweep started within minutes of the mints and ran ~289 events per credential. WebSiphon's two credentials were worked by 185.209.196.169 (Boto3/1.43.108 … os/linux#5.15.0 + python-urllib3/2.7.0). 137.23.38.53's two canaries were self-validated from the minting IP (Python-urllib/3.14) — the funnel's established self-use pattern (№44, №45, №48, №54). 204.184.134.5 and 233.90.58.220 carry XFF-claimed source labels from the CF-fronted burst (Fleet Observations); their real collector is unknown, so treat those two mints as attributed-to-unknown. The seven swept credentials TTL-expired ~07:58–08:42 UTC 10-18.

Fleet Observations

Canary economics. 53 digest issued rows; 45 credentials to 33 collectors after Tracebit dedupe; 11 credentials reached AWS (1,051 GetCallerIdentity successes, 1,176 denied operations). Mint failures 8×400 (aidev 4, farm 3, ru-edge 1) — census-burst pacing, the №17/№19 mechanism; no 401s. All-time issued-row counter: 2,469 (visuals run). Per-node mints: canary-farm-1 18 / 16 IPs, ai-devbox-1 18 / 17, control-1 11 / 8, ru-edge-1 6 / 6.

Attribution and TLS posture. XFF counters: any 1,316 / multi-entry 0 (№53's watch closed) / ignored-internal 1 / single-entry mismatch 21 (25 raw rows including 4 tarpit-disconnect pairing rows). Decomposition of the 21: 20 on ai-devbox-1 from the CF edge (socket peer 104.28.250.135) in the 13:04 UTC burst — five claimed sources (131.14.194.8, 225.237.161.35 and 233.90.58.220, both RFC multicast, 204.184.134.5, plus one more), Chrome/123-class UA, 2 mints inside the burst; 4 rows X-Forwarded-For: 1.2.3.4 from benign-listed method-fingerprint prober 162.243.83.227 (2 control + 2 aidev, tarpit-module); and 1 true direct-connection forgery on lauterbourg — UA metabase-cve-2026-72898-detect/1.0 (benign detection probes only) claiming 136.107.40.111 over socket peer 177.136.231.47, one /api/session/properties GET. Host census: lauterbourg's kiteworks.rightabouteverything.show vhost led at 635 vs 604 bare-IP (second TLS-led window); ai-devbox-1's inference.fapthropic.com 1,023 vs 712 bare.

Volume moves and causes. frantech-ts +121% (28,291): the two MEGA-DICTIONARY replays, 96% of the node. sponge-01-ts +67% (5,346): Bochum 4,170 (78%) + Bucklog .50 (304) + OMEGA's 150-path pass. netcup-ts +42% (5,050): Bochum 4,175 (83%). control-1 −12% (3,050): Pfcloud loop 2,047 is the base load; no census barrage this window. ru-edge-1 −36% (981): no census bursts; WebSiphon's 380 events are the largest single-IP share. canary-farm-1 −19% (1,943): CREDSWEEP .155 absent; REGISTRY-HUNT farm cluster 246 is the largest block. ai-devbox-1 −12% (1,763). lauterbourg-01-ts −23% (1,247): watch single 45.67.216.15 (161 in №54) absent, partly offset by the Atlassian cluster (280) and INFOCREST (180).

Result-tag spike attribution. All four spikes have causes: frantech-ts phpmyadmin-login 152 (6.3×) = 198.100.154.28 (151, GOWEB-PENTEST); ai-devbox-1 wp-admin-redirect 42 (4.8×) + wp-login-credentials 95 (3.1×) = WP-FORM-BRUTE's 53-IP pool and 15-IP wp-admin leg; lauterbourg-01-ts method-not-allowed 22 (3.9×) = 45.79.190.96 OPTIONS/PROPFIND probes (13) + REGISTRY-HUNT singles.

control-1 discovery velocity. Day 35 (first event 2026-09-12 07:59 UTC): 3,050 events from 106 unique IPs. The unique-IP count sits inside the 84–157 band for a 27th consecutive window; no new discoverers.

Digest quirks. First-seen timestamps again cluster at the sync-arrival minute (03:15:36) across 7 sensors — inventory, not timeline (control's /.netrc ×3 + /.git-credentials + /aws.yaml;, farm's /.cpanel.env + /.whm.env, netcup's /config/azure.yaml + /local.settings.json.bak, ru-edge's /aws-credentials.yaml, frantech's /magento/.env + /astro/.env + /sveltekit/.env + /stage.env + /.env.local.old, lauterbourg's /cal/.env). The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk). Spot-query totals run slightly above digest cells (fleet-24h rerun after the digest: frantech 28,371 vs 28,291) — the aligned-window drift between digest run time and query time, expected. The ai-devbox-1 rotated-file gap enters its seventeenth cycle. Arkime session-tag drift: see the recon reading — bahrain-sponge-01-ts, ru-vps-01-ts, contabo-sponge-02-ts no longer label their namesakes' IPs; the IP-keyed per-node table is unaffected. No new quirk this cycle.

Fleet-side changes this cycle. flux-visuals.py CHAINS: WEBSIPHON and KEYDROP-SCANS added; OMEGA-SWEEP, INFOCREST-KIT, MEGA-DICT → active; notes updated for CREDENTIAL-DRAIN (escalation), REGISTRY-HUNT (validation), BUCKLOG-KIT (capability battery), GOWEB-PENTEST (18th window), ATLASSIAN-REST-PROBE (second window). TALKER_CAMPAIGNS gained 146.70.200.3, 147.224.147.131, 185.209.196.169, 37.19.200.138, 198.100.154.28, 79.124.58.82, 104.64.127.170, 172.105.54.41. recon-names.tsv unchanged — all four flagged fingerprints were already registered. Visuals rerun after the CHAINS edit: flux-fleet-visuals-2026-10-18-r2.html.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 474 sources sent credentials → 350 got a shell (74%) → 277 ran a command (79% of shell-getters, 58% of sources). Event level: 19,539 credential attempts → 3,586 accepted logins → 6,970 commands (194% of accepted logins go on to run something). Telnet (commodity IoT botnets): 868 attempts.

Twenty-eighth static command window. New commands: 0 of 51 distinct. The recurring set holds: .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh at 828 events / 180 IPs; key-replace chain 719 / 163), hardware-survey battery (uname variants, lspci | grep VGA -c), and the PATH-export recon pairs from 2.57.122.209's class (392 + 390). Recurring commands are context, not news.

Credential concentration persists. 13,850 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 797 attempts and root/3245gs5662d34 at 586 — the fixed-pair sprayers hold the funnel for a tenth window. No new pairs to report.

Gaps / Next Collection

1. 185.209.196.169 and the provisioning attempts. Watch for any RunInstances/PurchaseCapacityBlock success (the denies came from legacyOwnerAccess-DenyAll), a second WebSiphon IP or node, and the tool itself — WebSiphon/next-0.1 has no other sightings in the fleet's history. The 185.209.196.x /24 also hosted MEGA-DICT replays (№49/№51): same-block, unproven link.
2. 168.222.244.156. Decide whether the 23-op validator is LeakIX's own screen or a downstream consumer: a banner/KEX or timing correlation against the runners' l9scan sessions would help; any success beyond GetCallerIdentity from the seven swept credentials (TTL ran to ~08:04–08:42 UTC 10-18) is the escalation signal.
3. BUCKLOG-KIT read-back, third cycle. The AUDITOK battery shows the operator is mapping which primitives work; bodyBytesRead is request-side, so real return bytes are still unmeasured. A dropper POST or a second RCE-stage IP settles the staging question.
4. MEGA-DICTIONARY's wordlist drift. Track the anti-join delta per replay (6 new paths this window); a third operator or a growth burst is the marketplace-health signal.
5. Arkime tag repair. bahrain-sponge-01-ts / ru-vps-01-ts / contabo-sponge-02-ts labels no longer track their namesakes' IPs — an ops-repo fix, not a briefing action; confirm after the next recon-digest run.
6. lauterbourg walkers. 45.67.216.15 (absent after №54's 161-event pass) and 93.152.221.158 both merit repeat checks; the Atlassian cluster needs a REST-stage sighting to settle attribution.
7. KEYDROP-SCANS. A second minting window makes the Onlyscans scanner a standing collector; watch for volume growth beyond the 2-event-per-node walk.

Digest: /data/flux-logs/reports/flux-digest-2026-10-18.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-18.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-18-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-18.md

Watch next cycle: (1) 185.209.196.169 / WebSiphon — any provisioning success or a second node; (2) 168.222.244.156 — any AWS call beyond GetCallerIdentity from the seven swept hoards; (3) MEGA-DICTIONARY's wordlist drift and whether a third operator joins the two new hosts.