FLUX FLEET — INTEL BRIEFING №58

Period: 2026-10-20 07:33 – 2026-10-21 07:34 UTC (24h, day 56 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 56-day baseline, use side verified against Tracebit alert logs; hostile POST bodies are quote-level facts)

BLUF

A new AWS-side actor, 156.225.26.90, worked two older canary credentials with a Bedrock/IAM inventory battery — ListFoundationModels ×10 denied, GetAccountSummary, DescribeRegions, ListBuckets, ListCustomModels, one GetCallerIdentity success — and the same IP ran the METADATA-HUNT /@fs marker probes on both EU canary nodes the same night: the first direct link between a use-side operator and the marker stage. WEBSIPHON rotated to four fresh Oracle-US IPs at a uniform 669 events each across 4 sensors and grew its wordlist by 35 GPU-cloud paths (crusoe, cudo, runpod, koyeb, paperspace, vultr, replicate, akamai env variants). A new census kit (CONFIGBUNDLE-KIT) hit 4 egress blocks in one window — two operators first-ever-today, 217.60.198.111 with 629 events / 4 sensors / 6 mints in 19 minutes — and LIBREDTAIL's honest-UA arm went distributed with four libredtail-http runners on ai-devbox-1. AI-EXEC-HUNT's 41-credential hoard from №57 drew zero AWS use through this window's pull. The fleet logged its first XFF single-entry forgery since the counter shipped: socketPeer 169.40.142.202 claimed to be 223.184.193.141.

Key Judgements

1. The marker stage and the AWS side now share infrastructure. 156.225.26.90 probed /@fs/proc/self/environ ×4 and /@fs/app/.env on canary-farm-1 and ai-devbox-1 at 02:18–02:22 UTC-4 under a bare Mozilla/5.0 UA, and Tracebit saw the same IP run 17 AWS events across 2 older credentials (Bedrock/IAM battery, 14 denied / 3 GetCallerIdentity successes). The credentials predate the 6-day Tracebit history window, so the mint side is unattributed. (High confidence on co-occurrence — one IP, both surfaces, same window. Moderate on operator intent: one window, and the mint-to-use gap is unmeasured.)
2. Collected credentials are inventory, not spend. 63 credentials went to 36 collectors; 2 were used, both old, both by one IP. The two largest new hoards stayed silent: AI-EXEC-HUNT's 41 credentials (zero use at +24 h) and 217.60.198.111's 6 first-day mints. (High confidence on the counts — Tracebit alert log. Moderate on the trend: the pull window can hide use that lands after the cutoff.)
3. Census kits now travel across hosting organizations inside one window. The config-bundle family mix (webapp-config-bundle-js ± error/json, tomcat-path-bypass-env, phpinfo, symfony-profiler, wp-batch, whm-login, ds-store) ran on 217.60.198.111 (first ever), 146.70.211.38 (first ever, M247), 208.84.100.218 (on record since 10-02), and 23.234.78.109 (tzulo — ADMINER-SWARM's heavy leg). One kit with rotating hosting is the leading read. (Moderate confidence — the family mix is the fingerprint; no shared IP, password, or body links the four yet.)
4. Every volume move attributes to a named cause. netcup-ts +38% is 74.4% Bochum research crawler (5,534 of 7,440 events); ai-devbox-1 +39% is WebSiphon (669) + the l9scan legs + four LIBREDTAIL runners + Techoff .159 (384); control-1 −23% is the lapse of №57's record census day; frantech-ts stayed flat with one dictionary replay at 91% of the node. (High confidence — per-IP attribution complete.)

Active Campaigns (day 56 status)

CONFIGBUNDLE-KIT (config-bundle + tomcat-bypass census, multi-hosting) ⚠ NEW (Hostile, active)

• Actors: 217.60.198.111 — FIRST EVER 03:44 UTC-4, 629 events / 4 sensors (canary-farm-1, ai-devbox-1, control-1, ru-edge-1) in 19 minutes, 6 mints, UA rotation Chrome/105–107 + Firefox/105–106 + Safari/16 + python-requests/2.32.5. 146.70.211.38 — FIRST EVER 04:23 UTC-4 (M247), 600 events / 3 sensors (aidev 229, control 69, farm 302), 2 mints, Chrome/106. 208.84.100.218 — on record since 10-02 (135 events all-time), 36 events / 3 sensors, 1 mint, Chrome/39 forgery. 23.234.78.109 (tzulo) — the ADMINER-SWARM heavy leg, same families, 4 mints, plus a lauterbourg Kiteworks walk under python-requests/2.32.5.
• TTPs: the shared family set — webapp-config-bundle-js (217.60.198.111: 60 + 100 error; 23.234.78.109: 40; WebSiphon overlap separate), webapp-config-bundle-json(-error) (146.70.211.38: 20 error + 10), tomcat-path-bypass-env (/..;/ env — 15 + 10 + 10 across the quad), phpinfo-error, symfony-profiler-phpinfo(-error), wp-batch multiplex, whm-login, ds-store, fake-git stages. 13 mints across the quad. No captured POST bodies this window.
• Assessment: a config-bundle census kit circulating across at least four egress blocks; the two first-ever operators ran it within 40 minutes of each other on overlapping sensors. Wants credential-bearing config bundles; the decoys answered with error and tarpit results at scale (217.60.198.111: 297 of its 629 events were tarpit rows). The 217.60.x block is LIBREDTAIL's staging /16 — an unproven hosting-level note, not an attribution. The second window answers kit vs coincidence.

WEBSIPHON (honest-UA config census) ⟳ — 4 FRESH OPERATORS, TEMPLATE +35 PATHS (Hostile, active)

• Actors: all Oracle US, four IPs at exactly 669 events / 669 paths each, ~5-second bursts: 164.152.24.126 (ru-edge-1 19:25 UTC-4, minted 1), 170.9.228.116 (netcup-ts 20:24), 163.192.198.182 (frantech-ts 21:52), 147.224.178.252 (ai-devbox-1 22:02, minted 1). control-1 was not hit. Eleventh all-time operator IP across three windows (№55: 1, №57: 6, №58: 4).
• TTPs: the registered census under the honest WebSiphon/next-0.1 UA, now with a 35-path GPU-cloud generation: /runpod-volume/.env.local, /opt/runpod/.env.local, /config/crusoe.yaml, /config/cudo.yaml, /config/paperspace.env, /config/vultr.yaml, /config/koyeb.yaml, /.env.replicate, /.env.akamai, /home/ubuntu/.env.production, plus settings/config-json/build-artifact paths — the ru-edge first-seen table is this wordlist. Owns aidev's app-config-yaml 6.2× spike (31 of 31) and ru-edge's config-json 4.6× spike (27 of 30).
• Assessment: the template is under active development — a wordlist generation aimed at GPU-cloud and alternate-provider hosting joined the census the same window four new operators ran it. The №55 credentials were worked in AWS in-window; the №57 three were not; these 2 mints are now the use-side watch.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — NEW USE ACTOR WITH A MARKER FACE (Hostile, active)

• Actors: mint side 72 digest issued rows → 63 Tracebit credentials to 36 collector IPs. Use side: 156.225.26.90 only — 17 AWS events across 2 credentials that predate the 6-day history window (no flux mints in history window). SES-QUOTA-PROBE (137.23.38.53) went silent.
• TTPs: denied ListFoundationModels ×10, GetAccountSummary, DescribeRegions, ListBuckets, ListCustomModels; 3 GetCallerIdentity successes. The Bedrock model-inventory shape is new to the funnel; the denial mix moved from SES/IAM probing to Bedrock/IAM enumeration. Same-IP /@fs marker probes at 02:18–02:22 UTC-4 (see METADATA-HUNT).
• Assessment: hoards keep aging without AWS consumption — top persistent collectors with zero observed use: 34.58.160.181 (41), 45.148.10.171 (35/6d, twenty-sixth consecutive minting window), 213.209.159.175 (24/6d, 6 this window), 37.60.226.187 (14/6d, 7 rows this window), 80.94.92.126 (9/6d) + 80.94.92.65 (6/6d), 140.245.97.208 (7/6d, 3 this window + a symfony census leg on farm), 45.138.12.51 (7/6d). The 156.225.26.90 case says the use side can surface long after mint, from infrastructure that also runs marker-stage probes. DenyAll and per-canary principals held: no success beyond GetCallerIdentity.

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — HONEST-UA ARM WENT DISTRIBUTED (Hostile, active)

• Actors: four libredtail-http runners, all on ai-devbox-1: 169.58.137.184 (10:57 UTC-4), 168.222.180.62 (14:06), 190.171.189.85 (17:22), 144.91.124.251 (19:48) — 46–49 events each, 37 phpunit-eval-stdin apiece, owning the node's 3.7× phpunit spike (148). Forge-UA cluster 7e61a9500d8b continues: 11 IPs / 539 events / 6 sensors at the uniform per-IP volume.
• TTPs: unchanged per-IP chain — cgi-traversal-rce-command on /bin/sh → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce. Dropper body uncaptured for a tenth consecutive cycle.
• Assessment: the honest-UA arm previously ran one background runner (103.160.205.37); four same-day runners on one node is a new posture — scheduled or queued, not opportunistic. A captured shell_exec(base64_decode(...)) body or a second node marks escalation.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — MINTS ACROSS 14 RUNNERS (Borderline, active)

• Actors: 15 mints to 14 runners — one mint per runner shape intact: 138.68.82.23, 138.68.86.32, 142.93.129.190, 157.245.105.107, 157.245.113.227, 164.92.244.132, 167.71.81.114, 167.99.182.39, 167.99.210.137, 68.183.9.16, 46.101.1.225, 206.81.24.74 (first mint), 206.189.233.36 (2 — control + ru-edge), plus l9explore runner 45.138.12.51 (1, ai-devbox-1 22:16). Farm cluster 850993125b15: 6 IPs / 246 events. 157.230.19.140 present without a mint.
• TTPs: unchanged 25-family journey (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum), ~1 mint per runner, graphql stages standard.
• Assessment: the brand's economics hold — mint per visit, AWS-side draws after the window closes (per №56–№57). Borderline brand, hostile economics.

MEGA-DICTIONARY (shared IoT dropper-URL wordlist replay) ⟳ — NEW HOST, +4 PATHS (Hostile, active)

• Actors: 146.70.200.195 (M247, AU-geolocated) — frantech-ts 13,747 events / 13,747 distinct paths, 01:54–01:55 UTC-4 (91% of the node's window), 0 POSTs, 0 mints, a 25-strong IoT-router UA rotation (D-Link, TP-Link, MikroTik, Ubiquiti, Totolink, Netgear, Cudy, Phicomm, boa, ecos classes). Third replay host in three windows (№56: Datacamp SG 138.199.60.3, №57: same, №58: M247).
• TTPs: anti-join against all-time frantech history: 13,743 of 13,747 paths seen before — 4 new: /s7cn4.x86, /eclipse.ppc, /jireyrsdnf/mips, /jireyrsdnf/x86 (a new jireyrsdnf/ family pair).
• Assessment: the artifact keeps circulating between hosting operators and keeps growing, slowly. A second host fetching the jireyrsdnf/ family is the adoption signal.

BUCKLOG-KIT (census + phpunit RCE arms) ⟳ — CENSUS UNDER A NEW HOST (Hostile, active)

• Actors: census arm 185.177.72.69 — canary-farm-1, 30 trap families (gravitysmtp-mock-data + the aws/s3 credential tree + aws-config-file), 0 mints. Collector 185.177.72.64 — 2 mints on canary-farm-1 (6/6d). Light legs: 185.177.72.7 (Kiteworks walk, truncated Chrome/58 forgery), 185.177.72.29 (curl/8.7.1). RCE arm silent.
• TTPs: census unchanged — GravitySMTP probe first, then bucket/config/credential walks; the .64 collector took its mints at /.env under Firefox/3.6.9 forgery.
• Assessment: the /24 keeps rotating per-window roles — census, collector, RCE. A captured <?php echo verify body or a second-node RCE run remains the escalation signal.

TECHOFF / PHPSWEEP kit (Techoff Srv BG /24) ⟳ (Hostile, active)

• Actors: 195.178.110.159 — ai-devbox-1, 384 events, all 264 of the node's fake-git-miss inf spike (the third window this signature moved nodes: control+farm in №57, aidev in №58). 195.178.110.217 — the frantech ssh-honeypot hardware-survey battery (445 events × 2 commands; see the honeypot section). 195.178.110.22 absent.
• TTPs: .159 ran a git-internals wordlist under ipsum:1-listed egress; .217 ran the standard export PATH=… uname survey post-auth.
• Assessment: one hosting org, rotating single-purpose runners per window. The /24 remains the identity.

Light watchers this window

• WP-ENUM class (bare stripped-Chrome/123 UA) — 45.156.128.156/.157/.158 (lauterbourg-01-ts) + 45.156.129.160 (netcup-ts, 18 events) ran 9-event / + /favicon.ico tarpit walks, 0 mints; lookalikes 185.226.197.7 (farm) and 109.105.209.13 (ru-edge). New digest signature 2747058d6260 (3 IPs / 84 events, aidev + control + sponge) is the same shallow walk under Edg/120: 152.32.176.68, 165.154.182.179, 118.194.228.239. Second-generation scale-up watch stands.
• Kiteworks decoy traffic (signature b1754af1a4e8, 3 IPs / 15 events) — lauterbourg-01-ts's first routine third-party walks: TOKEN-CRAWLER pool regulars 45.198.224.124/.125 (their daily 8-sensor pass), InternetMeasurement pair 87.236.176.219 + 45.55.151.3 (census-brand scanner), 23.234.78.109, 45.156.128.158, plus benign-listed singles (osint-scanner, visionheight, GenomeCrawlerd). No new campaign; the Kiteworks surface is now on standard rotation.
• 85.155.14.16 (SolidCore Hosting DE) — watch, escalating. Third window since 10-18: a 356-event / 47-family credential census on control-1 (aws-credentials-file, gcp-credentials-json, firebase-json, kubeconfig, docker-compose, rails-database-yml, s3cfg, boto families, 272 not-handled) plus 1 mint under Firefox/126. Also touched 2 GPU-cloud paths under Chrome/124/Edg forgeries. 3 mints / 6d. Promotion trigger: a fourth window or another mint.
• 150.228.105.248 — UA Mozilla/5.0 (compatible; WebMap/1.0; research scanner), 3 mints on ai-devbox-1 in 4 minutes (17:58–18:02 UTC-4). Self-labeled research, but mints are inventory. Borderline: report, watch for a repeat.
• New single-mint collectors: 192.34.57.175 (Go-http-client/1.1, control 09:31), 194.32.120.210 (Chrome/86, farm 22:11), 45.131.195.68 (Firefox/106, farm 07:26), 172.93.215.8 (Safari/4.0.4 forgery, aidev, 3 sensors), 162.254.24.228 (UCBrowser Android forgery, aidev + netcup), 185.241.208.252 (Chrome/85, ru-edge 03:33 — also owns ru-edge's fake-git-miss 16.5× spike, 33 events), 77.90.185.243 + 77.90.185.244 (2+2 mints on ru-edge under Firefox/3.0.13 and Android Chrome/37 antique forgeries — a new /24 pair, watch).

Standing actors (persistence check)

• 45.148.10.171 — twenty-sixth consecutive minting window: 3 in-window rows (aidev ×2, control), 35/6d, antique-UA forgeries. The fleet's longest-running collector.
• 204.76.203.18 (Pfcloud UG NL) — day 30+ of the MALWARE-DICT loop on control-1: 1,359 events, ipsum:2. Sibling 204.76.203.219 ran its 8-sensor light walk (1 event each) again.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose + .168 winston) — ninth window, benign-listed: netcup-ts 5,534 of 7,440 events (74%), sponge-01-ts 4,947 of 6,105 (81%).
• TOKEN-CRAWLER pool 45.198.224.x — .124 (105 events) and .125 (63) touched all 8 sensors again, incl. the Kiteworks walk; 0 mints.
• Feo Prest 213.209.159.175 — 6 mints on control-1 (24/6d) under the antique Safari/Chrome/iPhone forgery set.
• 37.60.226.187 — 7 mint rows across farm/aidev/control/ru-edge (14/6d), one under honest-brand P3P Validator.
• Benign fixed-cadence probers — 89.248.172.33 (387 events, 7 sensors), 80.82.77.202 (378, 7), 34.140.3.155 (28, 7), Censys-class 71.6.155.70 (8 sensors), 3.129.187.38 (visionheight.com/scan, 4 sensors), tarpit-only walkers 194.26.192.12, 43.161.251.162, 150.107.36.82, 46.151.178.14.

Absent or paused

AI-EXEC-HUNT (second window — one-off on current evidence; hoard pull continues), SES-QUOTA-PROBE (use side silent), ADMINER-SWARM's 99-IP pools (first miss; heavy leg continued solo under CONFIGBUNDLE-KIT behavior), METADATA-HUNT named runners (fifth idle window — marker stage active via 156.225.26.90), WP-FORM-BRUTE, CVENGINE-KIT, CENSUS-284, OMEGA-SWEEP, GOWEB-PENTEST, EMPERORS-KIT, XMLRPC-BRUTE, NIGHTAGENT, CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, KEYDROP-SCANS, INFOCREST-KIT, CONFIG-SWEEP, CF-FRONTED CREDSWEEP, SONICWALL-VPN-PROBE, PROTON-CENSUS, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS, ENVRC-SWEEP, ATLASSIAN-REST-PROBE, KITEWORKS-CRAWL's Google BE pair, KEYHUNT, WP-ENUM's 129.x generation.

Network-layer recon (Arkime)

Fingerprint field ssh.hassh, destination port 22 · 115,743 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 89,213, bahrain-sponge-01-ts 51,239, sensor:bahrain-sponge-01-ts 51,239, sensor:ru-vps-01-ts 12,356, frantech-ts 11,855, sensor:frantech-ts 11,855

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 7,610 sessions from 391 source IPs across 200 networks in 58 countries, port 22, avg 4,894 B/session. Networks: AS8075 Microsoft Corporation, AS16276 OVH SAS, AS132203 Tencent Building, Kejizhongyi Avenue, AS4766 Korea Telecom, AS31898 Oracle Corporation. Busiest sources: 103.172.20.218, 43.155.134.4, 117.6.44.221, 189.143.66.6, 164.152.250.192. Last 7 days: 10-15 352 IPs, 10-16 281 IPs, 10-17 257 IPs, 10-18 324 IPs, 10-19 418 IPs, 10-20 402 IPs, 10-21 99 IPs.
• 16443846184eafde36765c9bab2f4397 — client banner ssh-2.0-go, 15,651 sessions from 66 source IPs across 23 networks in 15 countries, port 22, avg 5,558 B/session. Networks: AS205089 Alfahost LLC, AS12876 Scaleway S.a.s., AS24961 WIIT AG, AS7552 Viettel Group, AS14061 DigitalOcean, LLC. Busiest sources: 77.239.124.41, 77.239.124.47, 77.239.124.201, 77.239.124.50, 163.172.71.202. Last 7 days: 10-15 32 IPs, 10-16 64 IPs, 10-17 46 IPs, 10-18 54 IPs, 10-19 32 IPs, 10-20 64 IPs, 10-21 28 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. All flagged sweeps are registered campaigns; nothing new to register, and no new fingerprints entered the top table. LIBSSH-MASSSWEEP (f555226d…) held its dispersed shape at 391 IPs / 200 networks (−30 day-over-day). GO-SCATTER-SWEEP (16443846…) re-crossed the threshold — 66 IPs (+36) / 23 networks / 15,651 sessions, pool led by Scaleway-class 77.239.124.x; it alternates single-source and dispersed windows (№54, №57, №58). GO-SSH-SWEEP (0a07365c…) contracted hard: 26,085 sessions (−10,648) from 42 IPs (−24) in single-source shape — the session record of №57 reversed within one window. GO-SPRAY-SWEEP (06ff3615…) collapsed to 5 IPs, the day's largest spread move; its on/off cadence continues. Unnamed standing fingerprint 4e066189c3bb… set the per-node pace on control-1 (25,666 sessions, +2,836, 11 IPs). Tag drift (bahrain-sponge-01-ts, contabo-sponge-01-ts, ru-vps-01-ts) persists — ops-repo item, not a briefing action.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (17 use events across 2 credentials). Fleet sensors minted 63 credentials to 36 collector IPs; 2 credential(s) reached AWS. Use outcomes: 14 failure, 3 success. Denied operations: ListFoundationModels×10, ListCustomModels×1, DescribeRegions×1, GetAccountSummary×1, ListBuckets×1. 3 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 45.148.10.171: 35 mints, 2026-10-14 12:14 → 2026-10-20 07:27
• 213.209.159.175: 24 mints, 2026-10-15 03:07 → 2026-10-21 05:59
• 37.60.226.187: 14 mints, 2026-10-14 07:08 → 2026-10-21 01:24
• 80.94.92.126: 9 mints, 2026-10-17 10:09 → 2026-10-20 10:36
• 194.59.31.39: 8 mints, 2026-10-14 13:54 → 2026-10-14 19:54
• 140.245.97.208: 7 mints, 2026-10-16 16:38 → 2026-10-21 05:57
• 45.138.12.51: 7 mints, 2026-10-14 09:18 → 2026-10-20 22:16
• 185.177.72.64: 6 mints, 2026-10-14 22:52 → 2026-10-20 08:44
• 213.209.159.154: 6 mints, 2026-10-15 09:15 → 2026-10-19 06:24
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 23.234.78.109: 6 mints, 2026-10-17 20:53 → 2026-10-20 14:00
• 80.94.92.65: 6 mints, 2026-10-16 07:17 → 2026-10-20 20:52
• 64.23.218.208: 5 mints, 2026-10-14 20:03 → 2026-10-17 20:42
• 79.124.58.82: 5 mints, 2026-10-14 18:50 → 2026-10-18 09:52
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 103.214.20.135: 4 mints, 2026-10-14 04:18 → 2026-10-14 05:45
• 109.205.176.10: 4 mints, 2026-10-14 20:10 → 2026-10-18 04:42
• 157.245.105.107: 4 mints, 2026-10-14 20:11 → 2026-10-20 20:23
• 165.22.34.189: 4 mints, 2026-10-14 20:11 → 2026-10-17 20:29
• 104.251.180.112: 3 mints, 2026-10-17 14:48 → 2026-10-19 04:27
• 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
• 134.122.28.88: 3 mints, 2026-10-14 20:03 → 2026-10-18 20:27
• 137.23.38.53: 3 mints, 2026-10-17 20:22 → 2026-10-19 01:31
• 138.68.86.32: 3 mints, 2026-10-14 20:11 → 2026-10-20 19:54
• 146.190.63.248: 3 mints, 2026-10-15 17:50 → 2026-10-18 20:39
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 157.230.19.140: 3 mints, 2026-10-17 19:58 → 2026-10-19 20:25
• 159.223.132.86: 3 mints, 2026-10-14 20:28 → 2026-10-17 19:58
• 167.99.210.137: 3 mints, 2026-10-14 20:01 → 2026-10-20 20:38
• 172.239.158.26: 3 mints, 2026-10-14 06:36 → 2026-10-14 11:53
• 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
• 206.81.24.227: 3 mints, 2026-10-16 19:01 → 2026-10-18 20:38
• 209.38.208.202: 3 mints, 2026-10-16 20:15 → 2026-10-17 02:37
• 209.38.248.17: 3 mints, 2026-10-15 19:01 → 2026-10-16 21:02
• 209.99.189.217: 3 mints, 2026-10-16 03:02 → 2026-10-16 11:19
• 46.101.1.225: 3 mints, 2026-10-15 17:46 → 2026-10-20 20:02
• 64.227.70.2: 3 mints, 2026-10-17 19:57 → 2026-10-18 20:10
• 85.155.14.16: 3 mints, 2026-10-18 03:19 → 2026-10-20 17:27
• 92.38.172.10: 3 mints, 2026-10-16 23:16 → 2026-10-17 07:55

Attribution notes. The window's only use actor, 156.225.26.90, joins two surfaces: its 2 used credentials carry no mints in the 6-day Tracebit history (older inventory), and its flux presence is the /@fs marker stage on both EU canary nodes — the first use-side operator observed running the marker probes itself. The largest new hoard (34.58.160.181, 41) stayed at zero use through +24 h; Tracebit is the only witness after the cutoff, and the pull-window caveat applies to every zero in this table.

Fleet Observations

Canary economics. 72 digest issued rows; 63 credentials to 36 collectors after Tracebit dedupe; 2 credentials reached AWS (3 GetCallerIdentity successes, 14 denied operations — denial leaders ListFoundationModels ×10, then one each GetCustomModels-class call). Mint failures 18 (aidev 5, farm 6, control 2, ru-edge 4, plus 1 ru-edge row with an empty error detail); 17 of 18 are "400 Bad Request" — the burst-pacing rejection class, no 401s. Per-node mints: canary-farm-1 24 / 15 IPs, ai-devbox-1 23 / 16, control-1 16 / 8, ru-edge-1 9 / 7, lauterbourg-01-ts 0. All mint labels "aws". All-time issued-row counter: 2,706 (visuals run).

Attribution and TLS posture. XFF counters: any-XFF 1,325 / multi-entry 0 / ignored-internal 456 / single-entry mismatch 1 — the counter's first non-zero since it shipped 2026-09-15. The row: canary-farm-1, 17:53:58 UTC, socketPeer 169.40.142.202 claimed X-Forwarded-For: 223.184.193.141, UA metabase-cve-2026-72898-detect/1.0 (benign detection probes only), path /api/session/properties, result not-handled. The peer has 4 all-time events since 09-26; the self-labeled "benign" UA is forgery-class on its face, and the /16 is ZKILLU-GITWALK's home range (169.40.142.2) — a hosting-level note, not an attribution. Single event, no follow-on this window; pivot on the socketPeer if it returns. TLS split held: ai-devbox-1 337 HTTPS events with 683 on inference.fapthropic.com, canary-farm-1 351 with 677 on sso.rightabouteverything.show, lauterbourg-01-ts 180 HTTPS under the raw IP. Host census stays IP-dominated.

Volume moves and causes. ai-devbox-1 +39% (2,572): WebSiphon .252 (669) + Techoff .159 (384) + l9scan legs + LIBREDTAIL quad (~190) + CONFIGBUNDLE actors (~280). netcup-ts +38% (7,440): Bochum trio 5,534 (74%, benign) + WebSiphon .116 (669). frantech-ts +5% (15,076): the MEGA-DICT replay (13,747, 91%) — the node is one replay with a fringe. control-1 −23% (2,892): №57's census arrivals (WebSiphon trio 1,335, record runner day) did not repeat; the Pfcloud loop (1,359) is now the node's base load. canary-farm-1 +2%, ru-edge-1 +7%, sponge-01-ts +7%, lauterbourg-01-ts +9% — no census waves replaced №57's legs.

Result-tag spike attribution. All 11 spikes have causes: ai-devbox-1 app-config-yaml 31 (6.2×) = WebSiphon .252; fake-git-miss 264 (inf) = Techoff .159; phpunit-eval-stdin 148 (3.7×) = LIBREDTAIL honest-UA quad (37 each); webapp-config-bundle-js 154 (5.2×) = 217.60.198.111 (60) + 23.234.78.109 (40) + WebSiphon (34) + 146.70.211.38 (20+20 error). canary-farm-1 phpinfo-error 40 (3.8×) = 146.70.211.38 (16) + 217.60.198.111 (12) + 208.84.100.218 (4) + ADMINER singles; symfony-profiler-phpinfo-error 21 (5.2×) = 217.60.198.111, 208.84.100.218, 146.70.211.38 (6 each) + 140.245.97.208 (6 issued-class) + singles; tomcat-path-bypass-env 40 (3.2×) = 217.60.198.111 (15) + 146.70.211.38 (10) + 23.234.78.109 (10); webapp-config-bundle-json-error 20 (inf) = 146.70.211.38. ru-edge-1 config-json 30 (4.6×) = WebSiphon .126 (27); fake-git-miss 33 (16.5×) = 185.241.208.252; webapp-config-bundle-js-error 20 (inf) = 217.60.198.111.

control-1 discovery velocity. Day 38 (first event 2026-09-12 07:59 UTC): 2,892 events from 104 unique IPs — back inside the 84–157 band after №57's census-inflated record of 167. The ramp dataset stays clean: no discovery-shaped day yet.

Digest quirks. First-seen timestamps cluster at the 03:15:37 sync arrival across sensors — inventory, not timeline; the GPU-cloud paths entered through WebSiphon's runs hours earlier. The fleet-24h histogram hour labels stay EDT-labeled under the hour_utc header (№49 quirk). Spot totals run above digest cells (aligned-window drift: aidev 2,716 vs 2,572, frantech 15,140 vs 15,076). Top-talker totals exclude tarpit-disconnect pairing rows. ru-edge logged one mint-failure row with an empty error detail alongside its 4×400.

Fleet-side changes this cycle. flux-visuals.py CHAINS: CONFIGBUNDLE-KIT added; AI-EXEC-HUNT, SES-QUOTA-PROBE, ADMINER-SWARM → idle; WEBSIPHON, CREDENTIAL-DRAIN, REGISTRY-HUNT, LIBREDTAIL-KIT, MEGA-DICT, BUCKLOG-KIT, METADATA-HUNT notes updated. TALKER_CAMPAIGNS gained 17 mappings (the CONFIGBUNDLE quad, WebSiphon four, LIBREDTAIL honest-UA quad, MEGA-DICT's new host, 156.225.26.90, the two watch singles). recon-names.tsv unchanged — no new flagged fingerprints. Visuals written once after the edits: flux-fleet-visuals-2026-10-21.html.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 436 sources sent credentials → 303 got a shell (69%) → 243 ran a command (80% of shell-getters, 56% of sources). Event level: 22,319 credential attempts → 16,860 accepted logins (3.3× №57's 5,070) → 18,638 commands (+92%). Telnet (commodity IoT botnets): 1,220 attempts.

Thirty-first static command window — but the volume shifted shape. New commands: 0 of 50 distinct. The move is one source looping: 84.42.45.253 ran echo -e "\x6F\x6B" 11,929 times (64% of all commands), an automated liveness loop against accepted logins — that single loop drove the accepted-login and command counts. The recurring set holds: the .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 1,177 events / 219 IPs; key-replace chain — 1,031 / 198 IPs) and the hardware-survey battery. Two cross-layer notes: 109.160.32.151 (+1 sibling IP) ran the uname -s -v -n -r -m + uname -m | awk survey at 1,285 commands each — the same 109.160.32.x range GO-SSH-SWEEP's banner-sweep pool uses; a pool host moved from banner reads to authenticated survey on the honeypot this window. And 195.178.110.217 (Techoff Srv BG) ran the standard export PATH=… uname survey at 445 events × 2 commands.

Credential concentration returned. 15,970 distinct pairs offered, 0 new. The №56 fixed-pair sprayer family is back: 345gs5662d34/345gs5662d34 leads at 1,152 attempts, root/3245gs5662d34 at 818, with admin/ubuntu/user variants of 3245gs5662d34 behind (60/52/43). Per-pair spraying replaced №57's one-attempt-per-pair spread.

Gaps / Next Collection

1. 156.225.26.90's credential age. Pull Tracebit history past the 6-day window next cycle: which credentials it used, when minted, on which sensor. Fingerprints: bare Mozilla/5.0 UA, /@fs/proc/self/environ, /@fs/app/.env. Watch for a return with a full census stage.
2. CONFIGBUNDLE-KIT's second window. Two first-ever operators 40 minutes apart says kit, not coincidence — but the link needs a shared IP, body, or password. Capture a wp-batch body; watch 217.60.198.111's 6 held credentials for AWS use.
3. AI-EXEC-HUNT's 41 credentials. This pull showed zero use at +24 h. Keep pulling; fingerprints: debug-trigger- marker paths, r2s926xynu59lcd multipart boundary, langflow @exec( body.
4. WEBSIPHON's 2 new mints (164.152.24.126, 147.224.178.252). The №55 generation was used in-window; track these for AWS alerts and a fifth-window operator count.
5. XFF forger 169.40.142.202. One event, forged attribution, "benign" self-label. A repeat with volume promotes it; the socketPeer is the identity, never the claimed 223.184.193.141.
6. 77.90.185.x pair. 4 mints on ru-edge-1 under antique forgeries, first appearance — resolve the /24's operator on a second window.
7. Arkime tag repair. bahrain-sponge-01-ts / contabo-sponge-01-ts / ru-vps-01-ts labels still drift from their namesakes' IPs — an ops-repo fix, not a briefing action.

Digest: /data/flux-logs/reports/flux-digest-2026-10-21.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-21.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-21.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-21.md

Watch next cycle: (1) 156.225.26.90 — pull the credential age past the 6-day window, and check whether the /@fs marker actor returns with a census stage; (2) CONFIGBUNDLE-KIT — second window for the four-egress kit, plus AWS use of 217.60.198.111's 6 fresh credentials; (3) WEBSIPHON — use-side alerts on the 2 new mints and the operator count's trajectory.