FLUX FLEET — INTEL BRIEFING №62

Period: 2026-10-24 07:33 – 2026-10-25 07:33 UTC (24h, day 60 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 60-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

The AWS use side escalated from identity calls to infrastructure probing. Two canary credentials ran 672 AWS events from one use IP: 660 denied operations, including SSM GetParameter ×390 and 4 denied ec2:RunInstances — the fleet's second provisioning-shaped denial and its largest denial volume on record. A new campaign, AI-CLI-VAULT, mapped AI-code-assistant credential stores (kimi-code, Grok, Muse, Goose, HuggingFace, Fabric, Codeium, Claude, Gemini, Continue) across all 8 sensors in one window with 0 mints. MEGA-DICTIONARY left frantech-ts for the first time in 21 replays: two hosts ran byte-identical 13,776-path copies against control-1 (xTom HK) and ru-edge-1 (Datacamp DE) in the same window, and the manifest did not grow. XMLRPC-BRUTE returned as the third kit to work the rebuilt lauterbourg surface within about 29 hours. Mint hygiene was perfect: 100 issued rows, 44 Tracebit credentials to 27 collectors, zero failures.

Key Judgements

1. The use-side actor tested provisioning as well as identity. 660 denied operations include ssm:GetParameter ×390 (parameter-store harvesting attempts), ec2:DescribeVpcs/DescribeImages ×130 each, and ec2:RunInstances ×4 — only WEBSIPHON №55's user previously attempted launches. The 12 successes are all sts:GetCallerIdentity. (High confidence on the events — Tracebit alert outcomes; Moderate on intent — outcome lists do not carry the actor's plan.)
2. AI-CLI-VAULT prices AI-assistant local stores as a credential class. 919 of its 1,067 canary-sensor paths target AI-CLI and dev-tool stores, and its kimi-code/Grok/Muse/Goose/HuggingFace/Fabric/Codeium paths were fleet first-seens. The shape is a GET-only existence map with 0 mints — a shopping list, not yet a collection. (High confidence on events — spot queries attribute every path; Moderate on follow-through — no second sighting yet.)
3. MEGA-DICTIONARY tested new placement, not a new version. Anti-join against №59's host set keeps 13,776/13,776 paths with 0 new, and both replays carried the same 5 artifact-carried decoy singles. The change is targeting: first control-1 and first ru-edge-1 hits in 21 replays. (High confidence — full-path anti-join.)
4. The rebuilt lauterbourg surface draws one kit per day. XMLRPC-BRUTE (13:23 10-24) follows BUCKLOG-KIT's RCE arm (13:53 10-23) and ANDROXGH0ST-KIT (18:26 10-24) — three kits in about 29 stored-digit hours. Stale target lists circulate; the node's decoys answered every stage. (Moderate confidence — three events make a rate, not a schedule.)

Active Campaigns (day 60 status)

MEGA-DICTIONARY (shared IoT dropper-URL dictionary replay) ⟳ — NEW PLACEMENT — Hostile, active

• Actors: 103.125.233.17 (xTom HK — new host class) on control-1, 09:18:30–09:22:03 stored (3.5 min); 169.150.211.193 (Datacamp Limited DE — the campaign's fifth Datacamp host) on ru-edge-1, 11:04:54–11:05:52 stored (58 s). All 19 prior replays hit frantech-ts; neither host is a prior replay host.
• TTPs: byte-identical 13,776-path GET sets (anti-join vs №59's host 23.234.116.20: 13,776/13,776 kept, 0 new — the manifest is unchanged since №59's +29 growth). The control leg rotated 209 router/IoT UA forgeries (Comfast CF-WR625AC, Linksys EA7500, ZTE F670L GPON, Baifu H118/5.6.1, Roku/DVP-4.1, D-Link DIR-820L); 13,772 of 13,777 events were not-handled on control and 13,771 of 13,776 on ru-edge. Each copy carried the same 5 decoy singles the artifact has traveled with since №47 (gravitysmtp-miss, llm-endpoint-ollama-ps, llm-endpoint-models-list, observability-profiler-index, exchange-powershell-pre-auth). 0 mints, 0 POSTs.
• Assessment: a distribution test against the fresh-IP baseline node and the Russia node. The decoys held. Watch a third host or node, any authentication-shaped payload, and whether a manifest bump now travels the new operator base.

AI-CLI-VAULT (AI-CLI/dev-credential-store census) ⚠ NEW — Hostile, active

• Actors: 195.182.16.183 (Amarutu Technology Ltd DE, first-ever sighting; same /24 as the standing fixed-cadence prober 195.182.16.23, which ran its light pass alongside).
• TTPs: all 8 sensors in one window (stored 07:07–10:13): 1,067 paths / 42 families on each canary sensor (aidev, control, ru-edge 1,720 events; farm 1,501) plus a 162-path / 5-family list on each deception node. 919 of the 1,067 canary paths target AI-CLI local stores: /root/.kimi-code/credentials/kimi-code.json + config.toml, /proc/self/cwd/.grok/auth.json, .muse-code/credentials.json, .config/goose/config.yaml, .cache/huggingface/token, .config/fabric/.env, .codeium/windsurf/mcp_config.json, plus the claude-settings, gemini-oauth-creds, continue-config, gh-hosts-yml, and huggingface-token families at 28 events each per sensor. The list also walks /root dotfiles (.bash_history, .zsh_history, .ssh/id_rsa, .ssh/id_ed25519, .docker/config.json, .git-credentials, .npmrc, .kube/config) and /var/www/app (.netrc, .env.development, hotfix/INFRA-198). UAs: honest Go-http-client/1.1 + forged Firefox/146. GET-only, 0 mints, 0 POSTs. The census drove the docker-compose spikes (4.5× aidev, 6.5× farm, 5.4× control, 5.0× ru-edge).
• Assessment: an existence map of developer AI-tool credential stores. Every decoy held and nothing minted. The kimi-code/Grok/Muse/Goose/HuggingFace/Fabric/Codeium paths are fleet first-seens — the target set extends CLAUDE-CRED-HUNT's Claude-store walk to the whole AI-CLI ecosystem. A mint, an AWS-side draw, or a second operator IP escalates it.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — USE WINDOW, ESCALATED — Hostile, active

• Actors: mint side 44 Tracebit credentials to 27 collector IPs (100 digest issued rows: farm 62/17 IPs, aidev 17/14, control 13/9, ru-edge 8/7). Use side: 95.111.225.106, sole use IP, 672 events across 2 credentials.
• TTPs: 660 denied + 12 success. Denied: ssm:GetParameter ×390, ec2:DescribeVpcs ×130, ec2:DescribeImages ×130, ec2:ListRegions ×4, and ec2:RunInstances ×4 — the fleet's second provisioning-shaped denial after WEBSIPHON №55. Successes: sts:GetCallerIdentity ×12 (identity only). The pull ties the mint side to the same IP: 1 canary-farm-1 mint at 07:37 10-24, a same-window mint→use arc; the second used credential's mint row is absent from the pull.
• Assessment: the actor moved from identity checks to inventory (SSM parameters, AMIs, VPCs, regions) and tested capacity launches. All launches denied. The mint→use arc inside one window matches the №20 and №36 pattern: mint-side discipline, fast consumption.

XMLRPC-BRUTE (system.multicall flood) ⟳ RETURNED — SEVENTH OPERATOR — Hostile, active

• Actors: 194.26.192.113 (1337 Services GmbH NL — the ANDROXGH0ST-KIT lead's ASN) on lauterbourg-01-ts, 13:23:57–13:24:12 stored.
• TTPs: 1,007 events / 5 paths. Preflight wp-wlwmanifest + wp-user-enum-rest-list, then 1,000 wp-xmlrpc-post in 15 seconds. Bodies 400 B: <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>\n<value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>admi (capture truncates the username; the shape matches №35's fixed admin). Forged Chrome/78; plus 4 php2shell-root touches. 0 mints.
• Assessment: the №35 batch shape at about 6× the pace — a single-account dictionary against the fresh node's fake WordPress. Third kit on the rebuilt node in about 29 stored-digit hours.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ FLEET-WIDE — Hostile, active

• Actors: the unchanged ~25-family walk (tarpit → WebLogic → Confluence → WHM/cPanel → docker-registry enum) ran across 7 sensors. Kill-chain runners this window: 138.68.82.23, 139.59.132.8, 164.92.107.174, 167.99.181.249, 206.189.19.19, 206.81.24.227 (DE/GB), 147.182.149.75 (CA), 157.245.113.227 (US) — all DigitalOcean.
• TTPs: unchanged; two l9scan UA variants.
• Assessment: about 12 of the window's 44 credentials went to DigitalOcean runners per the canary table. AWS-side draws after the window close remain the pattern to beat.

Light watchers

• 130.12.180.117 (Omegatech NL, ipsum:1) — second consecutive window: lauterbourg 279 events 03:39–03:48 stored (868 all-time, 4 result tags, all tarpit/not-handled, 0 mints). The block's synchronized mint pair (.163/.170) did not repeat.
• 45.148.10.238 (CREDSWEEP canonical, ipsum:3 + firehol2) — 909 events / 392 paths / 8 POSTs on netcup-ts 19:51–19:57. Not a fresh return: the netcup leg totals 3,964 events since 10-11 (tarpit-module 3,761, env-production 326, webshell-probe 121 all-time). The canonical aidev/control legs stayed absent.
• 185.158.148.234 — 151 phpmyadmin-login POSTs on one path in 0.9 seconds (16:54:05–06 stored) — the entire lauterbourg 17.2× spike. Unattributed; watch a repeat.
• WP-LOGIN crowd on control-1 — 32 credential + 33 probe POSTs from at least 5 IPs, low-and-slow over 00:07–06:10 stored (187.237.178.130 11+11, 103.47.145.26 9+9, 49.235.161.59 5+5, 103.47.145.27 4+4, 120.48.142.55 3+3). No mints; the 200-pair growth alarm stays armed.
• 45.138.12.35 (Tc Datacenter LT) — second consecutive window and now two nodes: ru-edge-1 384 events at 03:46 (all 264 of ru-edge's fake-git-miss spike) + canary-farm-1 384 at 16:47. A real-hash git walk the decoys did not serve.
• New mint collectors — 193.32.162.164 (aidev + ru-edge 1+1 at 09:12; /24 of the frantech honeypot's 193.32.162.84 uname-survey actor — cross-layer note, not a merge), 217.60.76.167 (LIBREDTAIL staging /16: aidev + control 2+2 at 07:47), 169.150.196.6 (Datacamp: farm + aidev 3+3 at 03:05–03:29 — third Datacamp-side mint source this cycle), 74.0.42.54 (2+2), 146.70.98.138 (1+1), 91.92.41.32 (2 control), 140.245.97.208 (4 across 3 sensors, 7/6d), 80.87.206.148, 207.154.212.47, 68.183.9.16, 142.93.129.190 (1 each).
• KrebsOnSecurity UA (94.154.43.12) — 1 event × 6 sensors at 16:53–17:35: the OMEGA-SWEEP probe pool with a vanity UA. Pool-probes-only; not a new operator.

Standing actors (persistence check)

• 213.209.159.154 (Feo Prest SRL DE) — minted in every recent window: 2+2 this window (18/6d), 600+ events across 4 sensors including the sponge top-talker leg (340). Sibling 213.209.159.175 (34/6d) was absent — its first miss in the streak.
• 45.148.10.238 netcup leg — continuous since 10-11 (see Light watchers).
• 195.182.16.23 (Amarutu) — light fixed-cadence pass across 8 sensors alongside the new .183 census.
• 94.154.43.x pool (OMEGA-SWEEP probe pool) — probes only, plus the KrebsOnSecurity vanity UA.
• Benign fixed-cadence probers — Censys 71.6.155.70 (8 nodes, 8 events), 195.182.16.23, 89.248.172.33.
• Bochum softsec crawler (185.73.23.161/.162/.168) — absent a second consecutive window; its absence keeps netcup-ts (−63%) and sponge-01-ts (−69%) below baseline.

Absent or paused

AI-EXEC-HUNT (its 649-event talker row is the №61 overlap duplicate, not a new burst), BUCKLOG-KIT, ANDROXGH0ST-KIT, 213.209.159.175, ADMINER-SWARM, CENSUS-284, CONFIGBUNDLE-KIT, CLAUDE-CRED-HUNT, METADATA-HUNT named runners, OMEGA-SWEEP census operators, NIGHTAGENT, MALWARE-DICT (.18 loop, fourth window), EXCHANGE-DICT, JNDI-FIELD-INJECT, WEBSIPHON, KEYDROP-SCANS, GO-SPRAY-SWEEP (network layer).

Network-layer recon (Arkime) — 2026-10-24 07:33:00 → 2026-10-25 07:33:44 UTC

Fingerprint field ssh.hassh, destination port 22 · 110,977 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 73,630, bahrain-sponge-01-ts 44,211, sensor:bahrain-sponge-01-ts 44,211, contabo-sponge-02-ts 23,203, proxy 23,203, sensor:contabo-sponge-02-ts 23,203

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 3,486 sessions from 611 source IPs across 268 networks in 69 countries, port 22, avg 4,920 B/session. Networks: AS8075 Microsoft Corporation, AS132203 Tencent Building, Kejizhongyi Avenue, AS31898 Oracle Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS4766 Korea Telecom. Busiest sources: 94.20.62.126, 41.111.183.207, 52.172.177.191, 81.10.31.125, 150.109.11.158. Last 7 days: 10-19 418 IPs, 10-20 402 IPs, 10-21 327 IPs, 10-22 314 IPs, 10-23 443 IPs, 10-24 617 IPs, 10-25 244 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 33,642 sessions from 61 source IPs across 21 networks in 17 countries, port 22, avg 5,256 B/session. Networks: AS209854 Cyberzone S.A., AS208137 Feo Prest SRL, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS25184 Afranet. Busiest sources: 109.160.32.114, 109.160.32.150, 109.160.32.40, 109.160.32.49, 109.160.32.32. Last 7 days: 10-19 71 IPs, 10-20 42 IPs, 10-21 41 IPs, 10-22 48 IPs, 10-23 53 IPs, 10-24 57 IPs, 10-25 34 IPs.
• 03a80b21afa810682a776a7d42e5e6fb — client banner ssh-2.0-libssh_0.11.1, 265 sessions from 50 source IPs across 34 networks in 17 countries, port 22, avg 5,022 B/session. Networks: AS4134 Chinanet, AS3320 Deutsche Telekom AG, AS8151 UNINET, AS133676 Precious netcom pvt ltd, AS24955 JSC Ufanet. Busiest sources: 91.40.152.60, 46.191.141.152, 103.248.120.6, 95.188.91.101, 129.222.203.42. Last 7 days: 10-18 23 IPs, 10-19 30 IPs, 10-20 28 IPs, 10-21 28 IPs, 10-22 24 IPs, 10-23 40 IPs, 10-25 20 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. LIBSSH-MASSSWEEP keeps widening its pool: 611 source IPs / 268 networks (+104 / +28 day-over-day) while sessions fell to 3,486 (−622) — more addresses, fewer sessions each. GO-SSH-SWEEP re-crossed the dispersed threshold: 61 IPs / 21 networks, 33,642 sessions (+12,753), busiest sources 109.160.32.x (Afranet) again — the same /24 ran the frantech honeypot uname survey this window (1,853 events each, 3 IPs led by 109.160.32.49), so the sweep and the shell stage remain one operation. NEW FLAG: 03a80b21afa8… (ssh-2.0-libssh_0.11.1) crossed at 50 IPs / 34 networks / 265 sessions on day 15 of its record — named LIBSSH-011-SWEEP and registered (distinct fingerprint and banner from LIBSSH-MASSSWEEP). GO-SCATTER-SWEEP held single-source (37 IPs, 21,788 sessions). GO-SPRAY-SWEEP missed again. No new fingerprints. Unflagged heavy 4e066189c3bb… held control-1's top spot (24,378 sessions / 11 IPs, below the spread floor). The contabo-sponge-02-ts/proxy tag drift (23,203 sessions) continues — ops-repo fix, open since №59.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (672 use events across 2 credentials). Fleet sensors minted 44 credentials to 27 collector IPs; 2 credential(s) reached AWS. Use outcomes: 660 failure, 12 success. Denied operations: GetParameter×390, DescribeVpcs×130, DescribeImages×130, ListRegions×4, RunInstances×4. 12 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 213.209.159.175: 34 mints, 2026-10-18 08:41 → 2026-10-23 15:04
• 45.148.10.171: 19 mints, 2026-10-18 06:25 → 2026-10-22 00:53
• 213.209.159.154: 18 mints, 2026-10-19 06:24 → 2026-10-25 02:52
• 37.60.226.187: 17 mints, 2026-10-20 02:15 → 2026-10-21 21:45
• 143.244.165.105: 9 mints, 2026-10-21 18:02 → 2026-10-23 21:39
• 80.94.92.126: 8 mints, 2026-10-19 11:21 → 2026-10-20 10:36
• 140.245.97.208: 7 mints, 2026-10-20 23:51 → 2026-10-24 16:12
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 45.138.12.51: 6 mints, 2026-10-18 13:12 → 2026-10-24 18:42
• 80.94.92.65: 6 mints, 2026-10-19 06:23 → 2026-10-21 09:39
• 165.227.102.187: 5 mints, 2026-10-21 16:37 → 2026-10-25 04:14
• 138.68.144.227: 4 mints, 2026-10-18 20:21 → 2026-10-24 20:54
• 157.245.113.227: 4 mints, 2026-10-20 20:04 → 2026-10-24 20:05
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 185.177.72.64: 4 mints, 2026-10-20 01:57 → 2026-10-20 08:44
• 206.81.24.227: 4 mints, 2026-10-18 20:01 → 2026-10-24 20:54
• 206.81.24.74: 4 mints, 2026-10-20 20:43 → 2026-10-23 21:05
• 23.234.78.109: 4 mints, 2026-10-20 05:35 → 2026-10-20 14:00
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 104.251.180.112: 3 mints, 2026-10-18 16:27 → 2026-10-21 12:15
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 157.245.36.108: 3 mints, 2026-10-18 19:57 → 2026-10-23 21:05
• 185.177.72.17: 3 mints, 2026-10-18 22:42 → 2026-10-18 22:42
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 45.148.10.5: 3 mints, 2026-10-22 00:28 → 2026-10-25 02:19
• 64.227.70.2: 3 mints, 2026-10-18 20:10 → 2026-10-24 20:54
• 64.89.163.14: 3 mints, 2026-10-21 08:34 → 2026-10-21 10:53
• 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25
• 93.152.209.6: 3 mints, 2026-10-22 02:01 → 2026-10-24 19:57
• 93.152.221.96: 3 mints, 2026-10-21 23:57 → 2026-10-22 04:22

Attribution notes. The window's use-side fact belongs to 95.111.225.106: 2 of its credentials produced 672 events from that one IP, and the pull also lists it as a canary-farm-1 mint collector at 07:37 10-24 — a same-window mint→use arc. The second used credential's mint row is not in this pull; say "unresolved" rather than "not stolen". The silent zero is clean at the pull time; Tracebit remains the only witness after the cutoff.

Fleet Observations

Canary economics. 100 digest issued rows across the 4 canary sensors (canary-farm-1 62, ai-devbox-1 17, control-1 13, ru-edge-1 8) — 44 Tracebit credentials to 27 collectors after dedupe, 2 used. Zero mint failures — no 400s, no 401s, no tracebit-error rows; a clean window after №61's 22-failure mix. All mint labels "aws". All-time issued-row counter: 2,980 (visuals run). lauterbourg-01-ts minted 0 (no key — by design).

Attribution and TLS posture. XFF counters: any 1,799 / multi-entry 0 / present-but-ignored 242 / single-entry mismatch 4. All 4 name 1.2.3.4 (RFC 5737 documentation range) over socketPeer 162.243.83.227 (DigitalOcean): 2 on control-1 at 22:20:29 10-24 and 2 on ai-devbox-1 at 00:43:34/36 10-25, all on / as tarpit-module, UA Mozilla/5.0. The documentation-IP class returned at 4× its №35 volume on one fixed peer — pivot on the peer, not the header. TLS split: canary-farm-1 1,085 HTTPS / 3,375 HTTP; ai-devbox-1 201 / 2,471; lauterbourg-01-ts 268 / 3,040; control-1, netcup-ts, ru-edge-1, sponge-01-ts, frantech-ts all-HTTP (control 1 stray HTTPS). Top Host headers: the nodes' own IPs plus cloud.wafflehouseindex.us 1,370 (near-parity with lauterbourg's node-IP 1,525) and sso.rightabouteverything.show 1,255.

control-1 discovery velocity. Day 42 (first event 2026-09-12 07:59 UTC): 16,293 events from 114 unique IPs. The event count is the xTom replay (13,777); unique IPs sit in the standing 104–178 band, 13th window in band. No discovery-shaped day.

Volume moves and causes. control-1 +464% (16,293) = MEGA-DICT's 13,777. ru-edge-1 +48% (16,371) = MEGA-DICT's 13,776. canary-farm-1 +80% (4,460) = AI-CLI-VAULT's 1,501, the REGISTRY-HUNT legs, and 62 mints. ai-devbox-1 +48% (2,672) = AI-CLI-VAULT's 1,720. lauterbourg-01-ts +117% (3,308) = XMLRPC-BRUTE's 1,007, the tarpit surface, and 130.12.180.117's 279. The three drops are absence: frantech-ts −94% (no MEGA-DICT replay), netcup-ts −63% and sponge-01-ts −69% (Bochum crawler absent a second window).

Result-tag spike attribution. Every spike has a named source. docker-compose ×4 sensors = AI-CLI-VAULT's /root/docker-compose.yml. not-handled (control 10.8×, ru-edge 4.3×, farm 4.3×, aidev 5.7×) = the 13,776-path replays + AI-CLI-VAULT. wp-xmlrpc-post 1,000 (16.7×) = 194.26.192.113. phpmyadmin-login 162 (17.2×) = 185.158.148.234's 0.9-second burst. control-1 wp-login-credentials/wp-login-probe (32×/33×) = the new low-and-slow crowd. ru-edge-1 fake-git-miss 264 (4.0×) = 45.138.12.35.

Digest quirks. The window-start overlap duplicated №61's tail into this digest — AI-EXEC-HUNT's 649-event talker row and its 05:03 mint burst are the previous briefing's events, not new ones. First-seen timestamps again cluster at sync arrival (03:16): inventories, not timelines; the kimi-code/Grok/Muse first-seens belong to AI-CLI-VAULT's stored-07:07+ walk. The UA first-seen table shows 10 of the window's list.

Fleet-side changes this cycle. Registry: №62 notes on XMLRPC-BRUTE, CREDENTIAL-DRAIN, MEGA-DICTIONARY, GO-SSH-SWEEP; new rows AI-CLI-VAULT and LIBSSH-011-SWEEP; №62 footer paragraph. flux-visuals.py: CHAINS entry AI-CLI-VAULT added, XMLRPC-BRUTE idle → active, MEGA-DICT and CREDENTIAL-DRAIN notes prepended, MEGA-DICT mermaid count corrected to 13,776; TALKER_CAMPAIGNS +4 (both replay hosts, 194.26.192.113, 195.182.16.183). recon-names.tsv +1 (LIBSSH-011-SWEEP). style-editing skill unavailable on this host; the technical-prose skill and its banned-phrase check stand in. Visuals rewritten after the CHAINS edits.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

Funnel: 681 sources sent credentials → 525 got a shell (77 percent) → 460 ran a command (88 percent of shell-getters, 68 percent of sources). Event level: 13,011 credential attempts → 3,896 accepted logins → 7,776 commands (200 percent of accepted logins). Telnet (commodity IoT botnets): 924 attempts.

New commands: 0 of 1,481 distinct — command diversity jumped about 20× over №61's 75 distinct with nothing first-seen. Treat as a volume note, not a finding, until a repeat.

Recurring set moved in volume: the uname -s -v -n -r -m + uname -m | awk survey pair ran 1,853 events each from 3 IPs led by 109.160.32.49 — the GO-SSH-SWEEP /24, so the network sweep and the post-shell hardware survey remain one operation. The .ssh replant pair held (cd ~; chattr -ia .ssh; lockr -ia .ssh 546 events / 422 IPs; key-replace chain 463 / 365). A lspci/nvidia-smi GPU survey ran 175 events × 4 queries from 45.148.10.61 (Techoff Srv — the CREDSWEEP /24). Credential concentration: 7,295 distinct pairs offered, 0 new; top pairs 345gs5662d34/345gs5662d34 522, root/3245gs5662d34 468, pi/raspberry 63.

Gaps / Next Collection

1. Tracebit alert detail for the 2 used credentials. The pull prints outcomes, not the calls' sequence — pull per-alert logs for 95.111.225.106's 2 credentials, resolve the second credential's mint side, and check for any call beyond GetCallerIdentity.
2. AI-CLI-VAULT follow-through. A mint, an AWS-side draw against the kimi-code/Grok/Muse/Goose/HuggingFace store paths, or a second operator IP promotes it; also test whether 195.182.16.23's prober shares tooling.
3. MEGA-DICTIONARY placement test. A third host or node, a return to frantech, or any authentication-shaped payload separates a distribution change from one-off targeting.
4. The 1.2.3.4 XFF peer. 162.243.83.227 produced all 4 mismatches on 2 sensors — pivot on the peer; promote if it persists a second window or the count grows.
5. lauterbourg kit tempo. A captured upload or execution POST answered with command output remains the escalation signal; watch for a fourth kit inside the day rate.
6. Arkime tag drift. contabo-sponge-02-ts/proxy labels (23,203 sessions) — an ops-repo fix, open since №59.

Digest: /data/flux-logs/reports/flux-digest-2026-10-25.md
Recon digest: /data/flux-logs/reports/flux-recon-digest-2026-10-25.md
Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-25-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-25.md

Watch next cycle: (1) the AWS side — what followed the 660 denied operations on 95.111.225.106's 2 credentials, and whether RunInstances ever succeeds; (2) AI-CLI-VAULT — a mint, an AWS use, or a second operator IP on the AI-CLI store census; (3) MEGA-DICTIONARY — a third host/node or a frantech return, which separates a distribution change from one-off targeting.