FLUX FLEET — INTEL BRIEFING №57

Period: 2026-10-19 07:33 – 2026-10-20 07:34 UTC (24h, day 55 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 55-day baseline, use side verified against Tracebit alert logs; hostile POST bodies are quote-level facts)

BLUF

A Google Cloud host ran the fleet's heaviest single-IP mint burst on record and paired it with live execution probes: 34.58.160.181 took 48 canary mints (41 credentials) from canary-farm-1 in 18 seconds, then POSTed working RCE payloads at langflow and ICEcoder endpoints — all under 33 forged AI-crawler user agents. WEBSIPHON scaled from one operator to six IPs on four sensors in one window, all Oracle US egress, and its template cousin SES-QUOTA-PROBE (137.23.38.53) drew 84 AWS events including 72 denied ses:GetSendQuota calls — the first SES-shaped use in fleet history. A new 99-IP distributed pool (173.239.214.x + 185.198.240.x) ran low-and-slow adminer/phpMyAdmin credential POSTs across five sensors, and BUCKLOG's dormant RCE arm returned on sponge-01-ts (284 phpunit events). MEGA-DICTIONARY grew +64 paths on a second record-class replay. At the network layer, LIBSSH-MASSSWEEP widened to 421 source IPs (one short of its peak), GO-SPRAY-SWEEP re-crossed the dispersed threshold, and GO-SSH-SWEEP set a session record (36,733) from a shrinking pool. Mint failures were 36×400 (burst pacing, no key errors); all XFF forgery counters stayed at zero.

Key Judgements

1. The census class now carries execution stages. AI-EXEC-HUNT POSTed live RCE payloads (langflow /api/v1/validate/code with a subprocess env-dump, ICEcoder terminal-xhr.php with command=env&password=bypass), BUCKLOG's RCE arm ran 284 phpunit events, and LIBREDTAIL's phpunit arm spread to a near-record 14 IPs across 7 sensors. (High confidence on the mechanics — bodies are captured verbatim. Moderate on operator-side success perception: every stage landed on decoy 200s/302s, so what the operators believed is unmeasured.)
2. Honest-UA collectors became a multi-operator fleet. WEBSIPHON went from 1 registered operator to 6 IPs / 4 sensors / 3 Oracle-US blocks in one window; SES-QUOTA-PROBE escalated from self-validation to SES/IAM probing; EMPERORS-KIT minted for the first time. The self-labeling UA remains the fleet's most reliable identity anchor. (High confidence on the counts. Moderate on organization: shared template and egress class, but the operator link between the six WEBSIPHON IPs is unproven.)
3. Credential hoards are being worked, not spent. 75 credentials went to 19 collectors; only 2 drew AWS calls, both by an existing collector scaling up its probing. The window's largest new hoard (41 credentials, AI-EXEC-HUNT) saw zero use through window close. (High confidence — Tracebit alert log is the use-side witness, pull-window caveat applies.)
4. Volume moves are census-driven, not discovery-driven. Four sensors moved +30–56%, and every result-tag spike attributes to a named census arm. control-1's unique-IP count hit a record 167 on runner arrivals; netcup-ts's +53% is 87% benign research crawler (Bochum, now three hosts). (High confidence — per-IP attribution is complete for all 14 spikes.)

Active Campaigns (day 55 status)

AI-EXEC-HUNT (AI-crawler census + live RCE probes + mass minting) ⚠ NEW (Hostile, active)

• Actors: 34.58.160.181 (Google LLC US), single IP, single burst on canary-farm-1, 20:03:42–20:04:00 UTC (18 s). No prior fleet history.
• TTPs: 648 events / 300 paths / 59 trap families / 33 distinct user agents under a full forged AI-crawler rotation (Googlebot/2.1, GPTBot/1.4, OAI-SearchBot, ChatGPT-User, Claude-User, Claude-SearchBot, ClaudeBot, PerplexityBot/Perplexity-User, Kimi/MoonshotBot, DeepSeekBot, Bytespider, Meta-ExternalAgent/WebIndexer/Fetcher, Applebot, GrokBot, YouBot, Bravebot, CCBot, DuckAssistBot, Hunyuan, ChatGLM-Spider, Qwenbot, cohere-ai, Amazonbot, Baiduspider). 48 mint rows (issued + vite-fs-issued — 41 Tracebit credentials, the largest single-IP haul on record, tied with 35.253.66.111's 41). Execution probes with captured bodies: POST /api/v1/validate/code → code-exec-api-validate 200, body {"code":"@exec('raise Exception(__import__("subprocess").check_output("env 2> (langflow CVE-2025-3248 class); POST /lib/terminal-xhr.php + /icecoder/lib/terminal-xhr.php → code-exec-api-exec 200, body command=env&password=bypass&csrf=x; flowise node-load-method/customMCP + node-custom-function (404); multipart JSON-action probes ------r2s926xynu59lcd … {"then":"$1:_ against /login, /admin, /dashboard, /settings, /api/auth (302s); graphql-introspection 200s on /graphql, /api/graphql, /v1/graphql; /@fs/.env + /@fs/root/.env + /@fs/proc/self/environ mints; marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show (404).
• Assessment: the METADATA-HUNT template (@fs markers, AI-crawler UA set) reused with a new execution stage that no prior census carried. The operator wants env dumps and LLM-stack code execution, not only files. The decoys held: every probe landed on fake surfaces at zero cost. The 41 credentials are hostile-held inventory — zero AWS use at window close; that check is the number-one collection priority. Operator link to METADATA-HUNT unproven.

WEBSIPHON (honest-UA config census) ⟳ — 1 → 6 OPERATORS (Hostile, active)

• Actors: all Oracle US egress, three blocks: 163.192.195.37 (control-1, 800 ev / 669 paths / 52 fams in 12 s, 1 mint), 64.181.210.1 (lauterbourg-01-ts, 564 ev / 463 paths in 1.4 s), 147.224.164.154 (control-1, 378 ev / 290 paths / 71 fams in 3 s), 149.130.220.90 (control-1, 157 ev / 69 paths, 1 mint) + 147.224.209.232 (canary-farm-1, identical 157 ev / 69 paths, 1 mint) — a twin pair that implies one operator on two egress IPs, unproven — and 163.192.221.136 (sponge-01-ts, 151 ev / 63 paths). All under the honest UA WebSiphon/next-0.1.
• TTPs: the registered census (env variants, config/secret/terraform/k8s/aws families) now with app-config-yaml and config-json depth: .37 alone owns 31 of control-1's 39 app-config-yaml-error events and 27 of its 38 config-json-error events, plus 34 of its webapp-config-bundle-js-error spike. 3 mints taken on touch; no AWS use of them observed in-window.
• Assessment: the №55 single operator was a template other crews adopted, or one crew scaled out — the twin 157/69 pair and the shared UA argue one playbook. Oracle egress rotates; the UA is the tracker. Watch the mint side: WebSiphon's №55 credentials were worked in AWS within the window; these three have not been (yet).

SES-QUOTA-PROBE (collector turned SES/IAM prober) ⚠ PROMOTED (Hostile, active)

• Actors: use side 137.23.38.53 (never appears in flux logs, all-time); mint side its 3 canary-farm-1 credentials from 2026-10-17/18.
• TTPs: 84 AWS events across 2 credentials from the single use IP: DENIED ses:GetSendQuota ×72, DENIED iam:GetUser ×6, plus sts:GetCallerIdentity successes (6). Third window: №55 mint + self-validation, №56 expanded census + self-validation, №57 SES/IAM probing.
• Assessment: GetSendQuota ×72 is a denial-loop against bulk-sender onboarding — a bulk-mail staging signal, not identity curiosity. The DenyAll policy held (zero effective permission), but the intent shifted from "validate my take" to "probe what this identity can do in SES/IAM". Watch for a second use IP or a success beyond GetCallerIdentity.

ADMINER-SWARM (distributed adminer/phpMyAdmin census + credential POSTs) ⚠ NEW (Hostile, active)

• Actors: 99 IPs across two /24s: 173.239.214.x (70 IPs / 969 ev / 5 sensors) + 185.198.240.x (29 IPs / 767 ev / 5 sensors), ~14 events per IP; light legs on the 4-canary sensors. Heaviest single: 23.234.78.109 (tzulo US) — 6 adminer-credential-post + 6 adminer-login + 20 phpmyadmin-login + 2 mints on ai-devbox-1.
• TTPs: / + /index.php + adminer/phpMyAdmin login-surface enumeration (/admin/adminer.php, /adminer.php, /adminer/adminer.php, /PMA/index.php, /php-myadmin/index.php, /phpmyadmin2/index.php), then 3 credential POSTs per IP; rotating Chrome/105–107 + Firefox/105–106 forgeries; 3 mints (173.239.214.253 ru-edge, 173.239.214.238 aidev, 185.198.240.22 farm). Owns ai-devbox-1's adminer-credential-post 4.1× and adminer-login 4.3× spikes.
• Assessment: WP-FORM-BRUTE's per-IP-one-POST economics applied to the adminer surface — rate-limit evasion at pool scale. Whether the two /24s are one crew or two buyers of one kit is open; the path set is the identity. No captured credential body yet.

BUCKLOG-KIT (census + phpunit RCE arms) ⟳ — RCE ARM RETURNED (Hostile, active)

• Actors: all on sponge-01-ts this window: census arm 185.177.72.70 (639 ev, curl/8.7.1, second window), RCE arm 185.177.72.50 (284 phpunit-eval-stdin events — its first RCE volume since №8), mint collector 185.177.72.64 (2 mints on ru-edge-1 01:57 UTC, 4/6d).
• TTPs: census unchanged (gitconfig → airflow/ansible/actuator → GCP/AI credential paths, openapi skeletons 200); the RCE arm's return restores the kit's full shape — phpunit CVE-2017-9841 verify stage at 284 events, no captured webshell-echo body this window.
• Assessment: the kit's operator keeps both arms warm and rotates hosts per window. .50's return after eight idle windows is the campaign's most significant move since №39; a captured <?php echo verify body or a second node is the escalation signal.

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — NEAR-RECORD SPREAD (Hostile, active)

• Actors: ~14 IPs at a uniform 37 events each across 7 sensors — cluster 7e61a9500d8b 13 IPs / 637 ev on canary-farm-1, control-1, frantech-ts, ru-edge-1, sponge-01-ts, plus lauterbourg-01-ts's first appearance (92.5.155.195). Honest-UA background runner 103.160.205.37 (libredtail-http) ran its chain on farm+frantech and added docker-daemon-containers-list to the sequence.
• TTPs: unchanged per-IP chain — cgi-traversal-rce-command on /bin/sh → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce, key-exfil POST body unobserved again (ninth consecutive cycle without a dropper body).
• Assessment: commodity RCE-verify kit at scale; one IP per sensor per window, with lauterbourg-01-ts added this window. The uniform 37-event volume is the tracker; the dropper host stays unmeasured.

TECHOFF / PHPSWEEP kit (Techoff Srv BG /24 multi-actor day) ⟳ (Hostile, active)

• Actors: 195.178.110.22 — all 8 sensors (182 ev, forged Chrome/134), including a /@fs/etc/passwd, /@fs/etc/hosts, /@fs/C:/Windows/win.ini family on frantech-ts, lauterbourg-01-ts, netcup-ts, sponge-01-ts (fleet-wide signature 6d56c36a681f, first seen 10-20 — the @fs Vite-traversal marker's first appearance on the no-canary nodes). 195.178.110.159 — 528 fake-git-miss events split 264/264 across control-1 and canary-farm-1 (the digest's identical-count pairing), 384 ev per node. 195.178.110.137 minted in №56; absent today.
• TTPs: .22 walked actuator-env, backup-archive, id_rsa, config.php.bak, database.sql, aws-amplify paths (36 fams on farm) on top of the /@fs probes; .159 ran a git-internals wordlist against both EU nodes in one shape.
• Assessment: one hosting org, three behaviors, one window — census, marker probing, and git walking. The /@fs family on certless nodes shows the METADATA-HUNT marker set circulating beyond its original operators. The /24 is the tracker.

MEGA-DICTIONARY (shared IoT dropper-URL wordlist replay) ⟳ — +64 PATHS (Hostile, active)

• Actors: 138.199.60.3 (Datacamp Limited SG — the №55 host, absent №56) — frantech-ts 13,744 events, 04:31–04:33 UTC (94.9% of the node's window), 13,742 distinct paths, 0 POSTs, 0 mints.
• TTPs: anti-join against all-time frantech history: 13,678 of 13,742 seen before — 64 new paths, the second record-class growth in two windows (№56 was +66): a /0c0et52nq5kb/assets/js/* hex-bucket family (10 sampled) plus dropper families /beacon.arm, /beacon.x86, /cegg_{arm,arm64,mips,mipsle,x86,x86_64}, /gb.arm, /gb.x86, /hydra-{arm,armv5,arm64,mips,mipsel}.
• Assessment: the artifact is under sustained development — two growth events in two days by two operators. Adoption signal to watch: a second host fetching the grown list.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — HOARD OPERATORS RETURNED IN-WINDOW (Borderline, active)

• Actors: the 25-family l9scan journey ran on 10+ DigitalOcean runners across 4 sensors — including №56's outside-flux AWS users back on the HTTP surface: 138.68.82.23, 157.230.19.140 (minted 1 on ai-devbox-1 20:25 UTC, l9scan/2.0.632323 UA), 164.90.228.79, 157.245.36.108, 206.189.19.19, 139.59.132.8, 68.183.9.16, 146.190.242.161, 206.189.225.181, 209.38.208.202. New runner 138.68.86.32 (l9scan/2.0.930323) 78 ev / 25 fams on 2 sensors. Farm cluster c540fc530a5a 6 IPs / 234 ev. l9explore runner 45.138.12.51 absent.
• TTPs: unchanged journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum), ~1 mint per runner; graphql-introspection stages now standard.
• Assessment: the hoard crews are not one-shot visitors — they return window after window, mint again, and keep drawing AWS calls after the flux window closes. Borderline brand, hostile economics.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — SES-SHAPED USE (Hostile, active)

• Actors: mint side 82 digest issued rows → 75 Tracebit credentials to 19 collector IPs. Use side: 137.23.38.53 only (see SES-QUOTA-PROBE). Hoards: 34.58.160.181 41 (0 use), 45.148.10.171 44/6d across 4 sensors (25th consecutive minting window), 213.209.159.175 18/6d, 80.94.92.126 8/6d on 4 sensors, 37.60.226.187 7/6d, 213.209.159.154 6/6d — now on 4 sensors (canary-farm-1, sponge-01-ts, netcup-ts, control-1), 45.138.12.51 7/6d.
• TTPs: outcomes 78 failure / 6 success; all successes sts:GetCallerIdentity; the denial mix is new — GetSendQuota ×72 + GetUser ×6 replaced the past EC2/RDS inventory pattern. 36×400 mint failures (aidev 12, farm 13, control 7, ru-edge 4 — burst-pacing rejections, no 401s).
• Assessment: no bulk use this window; what changed is the shape of probing (SES/IAM). The DenyAll policy and per-canary principal held at zero effective permission. Feo Prest .154's spread to 4 sensors is the new positional fact.

EMPERORS-KIT (phpunit webshell + adminer kit) ⟳ — ESCALATED, FIRST MINTS (Hostile, active)

• Actors: 150.241.66.127 (Kyonix Networks US; registered operator) — ai-devbox-1, canary-farm-1, control-1; second consecutive window.
• TTPs: env-production census at scale (76 events on aidev — the node's entire env-production-error spike owner — plus 38 on farm), config-json + phpinfo + yii2-debug-view legs, 11 phpmyadmin-login GETs, and 2 FIRST MINTS on control-1 (22:44 + 00:22 UTC, Firefox/77 forgery).
• Assessment: the kit moved from admin-surface probing to credential collection. Its copy() dropper targets a public repo — the repo-liveness check (phpunit verify echo) is still unobserved; the 2 held canaries are the use-side watch.

GOWEB-PENTEST (self-labeled Go phpMyAdmin hammer) ⟳ — 21st + 22nd OPERATORS (Hostile, active)

• Actors: 152.136.33.217 (sponge-01-ts) and 200.4.96.35 (ai-devbox-1) — 151 phpmyadmin-login GETs each, one node and one login path apiece; first double-header across two deception nodes.
• TTPs: unchanged — honest Go Web Pentest Tool UA, GET-only, 0 POSTs, 0 mints.
• Assessment: the decoy list keeps circulating; 22 operator IPs over 13 windows, zero credential bodies captured. A captured POST body remains the collection gap.

SS-NET TOOLING (.env-variant walk + mint collection) ⟳ — BLOCK ROTATION (Hostile, active)

• Actors: registered operator 80.94.95.211 absent again; siblings minted 8 — 80.94.92.126 (5 credentials across canary-farm-1, ai-devbox-1, ru-edge-1, control-1; 8/6d) under antique forgeries (POLARIS/6.01 BREW, Opera 7.51, Chrome/14) and 80.94.92.65 (3 on ai-devbox-1 + control-1; 4/6d).
• TTPs: unchanged single /.env fetches, one mint at a time, no census volume.
• Assessment: the 80.94.9x.x block operates collector duty as a service — the /24, not any one IP, is the identity. Hoard 12/6d across the two live siblings, zero observed use.

Standing actors (persistence check)

• 45.148.10.171 — twenty-fifth consecutive minting window: 3 in-window credentials on farm/aidev/control (44/6d), zero AWS use throughout, antique-UA forgery set. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud UG NL) — day 29+ of the MALWARE-DICT loop on control-1: 2,047 of 5,025 node events (41%), ipsum:2. Sibling 204.76.203.219 ran its light 8-sensor walk (23 ev) again.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose + NEW .168 winston) — eighth window, benign-listed: netcup-ts 6,492 of 7,441 events (87%), sponge-01-ts 4,910 of 6,790 (72%). .168's UA verifies into the same Software Security Research/1.0 (+https://winston.softsec.ruhr-uni-bochum.de) family — benign extension, third host.
• TOKEN-CRAWLER pool 45.198.224.x — .124 (108 ev) and .125 (66 ev) touched all 8 sensors again; 0 mints.
• Feo Prest pair — 213.209.159.175 4 mints on control-1 (18/6d); 213.209.159.154 now on 4 sensors (6/6d).
• 137.23.38.53 — promoted to SES-QUOTA-PROBE (above); no longer a watch single.
• Benign fixed-cadence probers — 89.248.172.33 (441 ev, 7 sensors), 80.82.77.202 (387, 7), 34.140.3.155 (31, 7), Censys-class 71.6.x trio, 3.129.187.38 (visionheight.com/scan, returned on 3 sensors incl. a kiteworks-shell touch), 45.77.61.56 (CyberConvoyScout/1.0, 6 sensors, tarpit-only — benign family per №13), 194.26.192.12 / 156.225.1.106 / 43.161.251.162 / 150.107.36.82 / 46.151.178.14 (tarpit-only walkers, 1 fam each).
• Crossnode singles: 206.189.19.19 + 138.68.86.32 (REGISTRY-HUNT), 103.160.205.37 (LIBREDTAIL), 130.12.180.164 + .168 (first-time collector pair, Chrome/147.0.0.0, 8 s apart, 1 mint each — new, watch), 85.155.14.16 (1 mint, Firefox/126), 209.87.169.179 (light 4-sensor census, 20 ev).

Absent or paused

METADATA-HUNT named runners (fourth idle window — toolkit circulated, see Key Judgement 1), WP-FORM-BRUTE's 233-IP pool (first absence after the №56 alarm), CVENGINE-KIT (first miss after №56 debut), CENSUS-284 (both buyers silent), OMEGA-SWEEP (79.124.58.82 absent), INFOCREST-KIT, CONFIG-SWEEP (sixth absence), CF-FRONTED CREDSWEEP, KEYDROP-SCANS (second miss), XMLRPC-BRUTE (silent), NIGHTAGENT (twelfth), CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, PROTON-CENSUS, ORACLE-SWEEP standalone, CONFIGBUNDLE-SWARM (45.154.138.x), KITEWORKS-CRAWL's Google BE pair, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS 102.220.161.x, ENVRC-SWEEP, ATLASSIAN-REST-PROBE, WP-ENUM's 129.x generation, KEYHUNT, WEBSIPHON's original operator 147.224.147.131 (its template continues under the six new IPs).

Network-layer recon (Arkime)

Fingerprint field ssh.hassh, destination port 22 · 137,603 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 96,868, bahrain-sponge-01-ts 43,810, sensor:bahrain-sponge-01-ts 43,810, frantech-ts 24,408, sensor:frantech-ts 24,408, sensor:sponge-01-ts 15,542

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 7,766 sessions from 421 source IPs across 203 networks in 57 countries, port 22, avg 4,938 B/session. Networks: AS16276 OVH SAS, AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS4766 Korea Telecom, AS31898 Oracle Corporation. Busiest sources: 54.38.241.200, 187.103.105.17, 116.71.136.125, 81.192.46.49, 112.151.168.124. Last 7 days: 10-14 336 IPs, 10-15 352 IPs, 10-16 281 IPs, 10-17 257 IPs, 10-18 324 IPs, 10-19 418 IPs, 10-20 116 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 4,730 sessions from 165 source IPs across 119 networks in 46 countries, port 22, avg 4,991 B/session. Networks: AS62633 HostRush, AS55836 Reliance Jio Infocomm Limited, AS16276 OVH SAS, AS63862 PT Pascal Solusi Nusantara, AS131353 NhanHoa Software company. Busiest sources: 207.231.111.150, 115.242.183.82, 151.80.213.177, 103.49.28.98, 77.120.112.191. Last 7 days: 10-15 39 IPs, 10-19 165 IPs, 10-20 7 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 36,733 sessions from 66 source IPs across 27 networks in 17 countries, port 22, avg 5,120 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS137095 Dm Lot Infotech Solutions Private Limited, AS208137 Feo Prest SRL, AS213790 Limited Network LTD. Busiest sources: 109.160.32.37, 109.160.32.112, 109.160.32.40, 109.160.32.179, 109.160.32.35. Last 7 days: 10-14 95 IPs, 10-15 94 IPs, 10-16 80 IPs, 10-17 129 IPs, 10-18 95 IPs, 10-19 71 IPs, 10-20 23 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. All three flagged sweeps are registered campaigns; nothing new to register. LIBSSH-MASSSWEEP (f555226d…) widened to 421 source IPs (+92 day-over-day) across 203 networks — one short of its 422-IP all-time peak. GO-SSH-SWEEP (0a07365cc01f…) set a session record (36,733, +10,827) while its pool contracted to 66 IPs (−26): intensification per source (busiest 109.160.32.x hosts), not spread. GO-SPRAY-SWEEP (06ff3615a51b…) re-crossed the dispersed threshold (165 IPs / 119 networks / 4,730 sessions) one window after its №56 miss — the bursty on/off pattern (№28, №32, №55, №57) is now the campaign's signature. GO-SCATTER-SWEEP (16443846184e…) stayed below threshold in single-source shape (30 IPs / 19 networks) despite 17,422 sessions (+8,249). Standing below-threshold fingerprints: 03a80b21afa8… (600 sessions / 28 IPs / 22 networks, 15 days on record) and a591c4ddccc9… (26 IPs, +14 day-over-day, 12 days) — both one quiet step from the dispersed floor; name on a crossing. New sub-threshold fingerprints today: b12d2871a118… (openssh-keyscan banner, 8 sessions / 2 IPs) and 419da4c91ddb… (libssh_0.10.4, 330 sessions from 1 IP — a newer libssh banner than MASSSWEEP's 0.9.6; single-source, watch). recon-names.tsv unchanged.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (84 use events across 2 credentials). Fleet sensors minted 75 credentials to 19 collector IPs; 2 credential(s) reached AWS. Use outcomes: 78 failure, 6 success. Denied operations: GetSendQuota×72, GetUser×6. 6 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 45.148.10.171: 44 mints, 2026-10-13 08:58 → 2026-10-20 04:47
• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 35.253.66.111: 41 mints, 2026-10-13 10:37 → 2026-10-13 10:37
• 213.209.159.175: 18 mints, 2026-10-15 03:07 → 2026-10-20 04:04
• 87.120.104.29: 12 mints, 2026-10-13 11:39 → 2026-10-13 19:31
• 140.245.97.208: 9 mints, 2026-10-13 15:46 → 2026-10-16 19:43
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 80.94.92.126: 8 mints, 2026-10-17 10:09 → 2026-10-20 02:52
• 103.214.20.135: 7 mints, 2026-10-14 01:15 → 2026-10-14 05:45
• 37.60.226.187: 7 mints, 2026-10-14 07:08 → 2026-10-20 05:25
• 45.138.12.51: 7 mints, 2026-10-13 20:31 → 2026-10-19 00:13
• 213.209.159.154: 6 mints, 2026-10-15 09:15 → 2026-10-19 06:24
• 109.205.176.10: 5 mints, 2026-10-13 17:09 → 2026-10-18 04:42
• 206.209.210.3: 5 mints, 2026-10-13 05:56 → 2026-10-15 11:17
• 64.23.218.208: 5 mints, 2026-10-14 20:03 → 2026-10-17 20:42
• 79.124.58.82: 5 mints, 2026-10-14 18:50 → 2026-10-18 09:52
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 146.190.63.248: 4 mints, 2026-10-13 20:08 → 2026-10-18 20:39
• 165.22.34.189: 4 mints, 2026-10-14 20:11 → 2026-10-17 20:29
• 185.177.72.64: 4 mints, 2026-10-14 22:52 → 2026-10-20 01:57
• 23.234.78.109: 4 mints, 2026-10-17 20:53 → 2026-10-20 05:35
• 80.94.92.65: 4 mints, 2026-10-16 07:17 → 2026-10-19 08:25
• 80.94.95.211: 4 mints, 2026-10-13 20:10 → 2026-10-15 03:19

Attribution notes. Both in-window credentials were worked by 137.23.38.53 — now SES-QUOTA-PROBE — from its 10-17/10-18 farm hoard; the 84-event SES/IAM probing is the funnel's first non-inventory use shape. The window's largest new hoard (34.58.160.181, 41) had zero observed use at window close — Tracebit is the only witness for the hours after the cutoff, and the pull-window caveat applies to every zero in this table.

Fleet Observations

Canary economics. 82 digest issued rows; 75 credentials to 19 collectors after Tracebit dedupe; 2 credentials reached AWS (6 GetCallerIdentity successes, 78 denied operations — denial leaders GetSendQuota×72, GetUser×6). Mint failures 36×400, all "400 Bad Request" — the burst-pacing rejection class (farm 13 of 53 mint attempts, aidev 12, control 7, ru-edge 4), no 401s, so no key malformation. All-time issued-row counter: 2,633 (visuals run). Per-node mints: canary-farm-1 53 / 8 IPs, control-1 14 / 9, ai-devbox-1 9 / 7, ru-edge-1 6 / 5.

Attribution and TLS posture. XFF counters: any-XFF 2,139 / multi-entry 0 / ignored-internal 487 / single-entry mismatch 0. No actor chose its own attribution this window. TLS split held: canary-farm-1 963 HTTPS events split across the IP and sso.rightabouteverything.show (1,246), ai-devbox-1 506 across the IP and inference.fapthropic.com (908); lauterbourg-01-ts 183 HTTPS under the raw IP (its Kiteworks vhost drew no top-host volume). Host-header census is otherwise IP-dominated — no new vanity-host probing.

Volume moves and causes. canary-farm-1 +56% (3,202): AI-EXEC-HUNT 648 + Techoff .159 384 + REGISTRY-HUNT farm cluster 234 + WebSiphon 157 + ADMINER-SWARM ~80 + EMPERORS 38. netcup-ts +53% (7,441): Bochum trio 6,492 (87%, benign). sponge-01-ts +30% (6,790): Bochum 4,910 (72%) + Bucklog .70/.50 (923) + GOWEB 151 + WebSiphon 151. control-1 +31% (4,882): WebSiphon trio 1,335 + Pfcloud 2,047 base + Techoff .159 384. frantech-ts −0% (14,474): one MEGA-DICT replay (13,744, 94.9% of the node). ru-edge-1 −28% (1,105): no census wave replaced №56's legs. ai-devbox-1 +4%: EMPERORS 76 + ADMINER-SWARM ~250 + GOWEB 151 offset by absent WP-FORM-BRUTE/OMEGA legs.

Result-tag spike attribution. All 16 spikes have causes: ai-devbox-1 phpmyadmin-login 261 (5.0×) = GOWEB 200.4.96.35 (151) + 23.234.78.109 (20) + EMPERORS (11) + swarm singles; adminer-credential-post 31 (4.1×) + adminer-login 32 (4.3×) = ADMINER-SWARM (3 per IP) + 23.234.78.109 (6+6); env-production-error 86 (inf) = EMPERORS (76) + swarm singles; phpinfo-error 26 (6.5×) + webapp-config-bundle-js-error 54 (inf) = distributed singles (swarm + l9scan + WebSiphon), no owner above 6. canary-farm-1 fake-git-miss 264 (inf) = Techoff .159; phpinfo-error 24 (4.0×) and yii2-debug-view-error 21 (3.7×) + webapp-config-bundle-js-error 40 (inf) = distributed singles. control-1 app-config-yaml-error 39 (9.8×) = WebSiphon .37 (31) + .154 (8); config-json-error 38 (4.8×) = WebSiphon .37 (27) + .154 (8); fake-git-miss 264 (3.1×) = Techoff .159; webapp-config-bundle-js-error 64 (16×) = WebSiphon (44) + swarm singles. sponge-01-ts phpmyadmin-login 154 (5.1×) = GOWEB 152.136.33.217 (151); phpunit-eval-stdin 432 (7.9×) = BUCKLOG .50 (284) + LIBREDTAIL 37-per-IP singles.

control-1 discovery velocity. Day 37 (first event 2026-09-12 07:59 UTC): 4,882 events from 167 unique IPs — a record unique-IP count, above the 84–157 band that held for 29 windows. The record is runner-driven, not a discovery wave: the census arrivals (WebSiphon ×3, Techoff .159, ADMINER-SWARM control legs, EMPERORS) plus the standing Pfcloud loop account for the move. Watch next window for a genuine discovery pattern (steady small-IP ramp without census bursts).

Digest quirks. First-seen timestamps cluster at sync arrival (03:15:21) across sensors — inventory, not timeline; control's cloud-specific env paths (/.env.exoscale, /.env.coreweave, /.env.gmicloud, /config/azure.yaml, /.aws-sam/build/template.yaml) belong to the census runners hours earlier. The fleet-24h histogram hour labels stay EDT-labeled under the hour_utc header (№49 quirk). Spot totals run above digest cells (aligned-window drift; frantech 14,568 vs 14,474). Top-talker totals exclude tarpit-disconnect pairing rows.

Fleet-side changes this cycle. flux-visuals.py CHAINS: AI-EXEC-HUNT, ADMINER-SWARM, SES-QUOTA-PROBE added; WEBSIPHON, BUCKLOG-KIT, LIBREDTAIL-KIT, MEGA-DICT, REGISTRY-HUNT, CREDENTIAL-DRAIN, EMPERORS-KIT, GOWEB-PENTEST, SS-NET TOOLING notes updated; CVENGINE-KIT, CENSUS-284, WP-FORM-BRUTE → idle. TALKER_CAMPAIGNS gained 22 mappings (the three new campaigns' actors, the WEBSIPHON six, Techoff trio, GOWEB pair, returning l9scan runners, SS-Net siblings). Visuals written once after the CHAINS edits: flux-fleet-visuals-2026-10-20.html. recon-names.tsv unchanged — all three flagged fingerprints were already registered; no new network-layer campaign crossed a threshold.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 485 sources sent credentials → 343 got a shell (71%) → 303 ran a command (88% of shell-getters, 62% of sources). Event level: 28,019 credential attempts → 5,070 accepted logins → 9,725 commands (192% of accepted logins go on to run something). Telnet (commodity IoT botnets): 929 attempts.

Thirtieth static command window. New commands: 0 of 51 distinct. The recurring set holds: the .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 1,140 events / 246 IPs, and the key-replace chain cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAA…" — 1,006 events / 227 IPs) and the hardware-survey battery (uname, lspci | grep VGA, nvidia-smi -q — 168.144.62.63's class). One volume shift: commands rose 6,723 → 9,725 (+45%) while the per-pair sprayers quieted — the replant chains now spread across 227–246 IPs running each command once or twice, versus one source looping in №56. Recurring commands are context, not news.

Credential concentration collapsed. 18,430 distinct pairs offered, 2 NEW: ubuntu/Mannu@123 and ubuntu/Bhardwaj@123 (1 attempt each — human-name pairs against a fixed username, a targeted-candidate shape worth watching for a repeat). The fixed-pair sprayers that held the funnel for eleven windows (345gs5662d34 at 861 attempts in №56) did not appear — the top pair this window is 1 attempt.

Gaps / Next Collection

1. AI-EXEC-HUNT's 41 credentials. Pull the Tracebit window past the cutoff next cycle: any AWS use, and how fast. Fingerprints: debug-trigger- marker paths, r2s926xynu59lcd multipart boundary, langflow @exec( body.
2. SES-QUOTA-PROBE's next move. GetSendQuota ×72 is staging behavior — watch for a second use IP, a success beyond GetCallerIdentity, or SES-shaped mints targeting /.aws/credentials + SES config paths.
3. WEBSIPHON rotation. The template's №55 credentials were used in-window; the №57 three were not (yet). Track the six IPs for return, the twin-pair org question, and use-side alerts on the 3 new mints.
4. ADMINER-SWARM coordination. Two /24s, one path set: a shared host, a shared mint, or a captured credential body links them. The 23.234.78.109 heavy leg is the most likely to slip a body.
5. BUCKLOG RCE follow-through. .50's 284 phpunit events produced no captured verify echo; a <?php echo body, a webshell-command POST, or a second node marks escalation.
6. MEGA-DICTIONARY adoption. A second host fetching the +64 grown list; per-replay anti-join stays the tracker.
7. control-1 record 167 unique IPs. Check next window whether census runners explain it again or a discovery ramp is underway.
8. Arkime tag repair. bahrain-sponge-01-ts / contabo-sponge-01-ts labels still drift from their namesakes' IPs — an ops-repo fix, not a briefing action.

Digest: /data/flux-logs/reports/flux-digest-2026-10-20.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-20.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-20.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-20.md

Watch next cycle: (1) AI-EXEC-HUNT — AWS use of the 41-canary hoard and any second IP/node for the langflow/ICEcoder exec kit; (2) SES-QUOTA-PROBE — whether the GetSendQuota ×72 denial loop returns or escalates; (3) WEBSIPHON's next rotation and BUCKLOG's RCE arm — both templates are one captured body away from an escalation verdict.