FLUX FLEET — INTEL BRIEFING №63

Period: 2026-10-25 07:33 – 2026-10-26 07:33 UTC (24h, day 61 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 61-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

lauterbourg-01-ts took the fleet's heaviest XMLRPC flood on record: two operators posted 11,807 system.multicall bodies at the fake WordPress in one window, and the new operator (136.70.193.85, Google LLC US) rotated 7,861 distinct username/password pairs — XMLRPC-BRUTE's first multi-account dictionary. MEGA-DICTIONARY returned to frantech-ts under a tzulo host with the full 13,776-path manifest in 55 seconds, while a second host ran the campaign's first partial replay, a 3,074-path strict subset of the same wordlist. WP-FORM-BRUTE set a fleet record of 494 distinct credential pairs and blew its 200-pair growth alarm. Two new campaigns entered the registry: AI-ADMIN-SWEEP, a census of self-hosted AI-app admin endpoints synchronized to the same second across 7 sensors, and CLOUDCONF-CENSUS, a cloud-credential and VPN-config census that owns netcup's first-seen VPN paths. The canary funnel went quiet: 50 credentials minted to 28 collectors, zero AWS use, and the standing hoards grew.

Key Judgements

1. The rebuilt lauterbourg surface now draws volume attacks, not only exploit kits. The node logged 11,807 wp-xmlrpc-post events (22.3× baseline) from two operators, on top of BUCKLOG-KIT's RCE arm (10-23), ANDROXGH0ST-KIT (10-24), and XMLRPC-BRUTE's seventh-operator run (10-24). Stale target lists and brute tools reach the node within hours of each appearance. (High confidence on the events — digest and journeys; Moderate on the trend — four days is a rate, not a schedule.)
2. MEGA-DICTIONARY behaves as a shared artifact moving between operators, and it now travels in parts. 23.234.118.146 (tzulo US) ran 13,776 unique paths in 55 s; 176.119.150.252 (Owl Limited DE) ran 3,074 paths in 18 s, every one of them inside tzulo's set, under the same 208-UA router/IoT rotation, and both legs carried the artifact's 5 traveling decoy singles. The first partial replay suggests staged or bandwidth-limited distribution rather than a new wordlist. (High confidence on the artifact link — strict subset plus shared decoys; Moderate on operator relation — no direct handoff observed.)
3. WP-FORM-BRUTE is a resourced distributed grid, and it grew past its alarm. 494 distinct log=admin credential pairs across 5 sensors in one window (prior record 363), 103 IPs on canary-farm-1 alone, forged browser UA rotation, valid _wpnonce+testcookie handling on every POST. (High confidence on counts — spot query; Moderate on intent — decoy WordPress cannot confirm what a success would have fetched.)
4. The credential economy paused while inventory grew. Zero of the window's 50 minted credentials reached AWS (Tracebit pull), one cycle after №62's 672-event use window. Named hoards now hold 182+ credentials: AI-EXEC-HUNT's two 41-credential piles, Feo Prest's 48, CONFIGBUNDLE's 17, and the census collectors' growing shares. (High confidence on the zero — the pull covers the window; Moderate on interpretation — hold-for-resale and slow consumption look identical from outside.)

Active Campaigns (day 61 status)

MEGA-DICTIONARY (shared IoT dropper-URL dictionary replay) ⟳ — RETURN TO FRANTECH + FIRST PARTIAL REPLAY — Hostile, active

• Actors: 23.234.118.146 (tzulo inc. US, ipsum:1 — the ADMINER-SWARM heavy leg's ASN; №34's replay host 23.234.117.146 is its /24 sibling), full replay 03:29:10–03:30:05 stored (55 s); 176.119.150.252 (Owl Limited DE), partial replay 23:36:06–23:36:24 stored 10-25 (18 s). Both hosts new to the campaign.
• TTPs: GET-only, every path not-handled. tzulo: 13,776 events / 13,776 distinct paths / 208 rotating router-IoT UA forgeries (TP-LINK WR940N 4.18.19, MikroTik WinBox 3.18, ZTE MC801A 5G, aiohttp/3.8.6). Owl: 3,074 events / 3,074 paths, a strict subset of tzulo's set (0 paths outside it), same 208-UA rotation. Both legs carried the artifact's 5 decoy singles (gravitysmtp-miss, llm-endpoint-ollama-ps, llm-endpoint-models-list, exchange-powershell-pre-auth, observability-profiler-index). 0 mints, 0 POSTs. Manifest check: path count and decoys match the frozen 13,776; a path-level anti-join against pre-window hosts is not possible this cycle — v_full's frantech history holds no pre-window replay-host rows (see Gaps).
• Assessment: the manifest is intact and continues to pass between operator hosts; the partial leg is new behavior. frantech-ts served nothing and minted nothing. Watch a third host, any manifest growth, and whether partials become the default replay mode.

XMLRPC-BRUTE (system.multicall flood) ⟳ — RECORD BURST, EIGHTH OPERATOR — Hostile, active

• Actors: 136.70.193.85 (Google LLC US, new operator, GCP egress), 9,807 POSTs 05:42:12–05:59:17 stored (17 min); 194.26.192.113 (1337 Services GmbH NL, seventh operator, second consecutive window, 3,021 all-time), 2,000 POSTs spread 08:44–21:07 stored 10-25 (12.4 h).
• TTPs: both preflighted the fake WordPress and got live decoy answers: GET / (php2shell-root 302), /wp-includes/wlwmanifest.xml 200, /wp-json/wp/v2/users/ 200, /wp-json/oembed/1.0/embed 404. Then POST /xmlrpc.php, every response 200. The GCP operator's bodies are 480–1,496 B with 7,861 distinct values — the campaign's first multi-account dictionary. Captured body (truncated by capture, quoted verbatim): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>\n<value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>leslyg</string></value><value><string> شى شى1811</string></value></data></array> — usernames rotate and passwords carry non-Latin script. The 1337 Services operator kept the old shape: fixed admin, 1,000 distinct 479–497 B bodies, forged Chrome/89 and Chrome/78 respectively.
• Assessment: pace record for the campaign (~577 POSTs/min vs №28's ~46/min sustained record volume of 18,063 over 6.5 h). A multi-account dictionary changes the tool's value: it maps which usernames a target's WordPress exposes before committing to a password run. The fake xmlrpc endpoint answered every attempt and leaked nothing. Watch the multi-account shape's return, a second GCP IP, and any coordination with the WP-FORM-BRUTE pools.

WP-FORM-BRUTE (distributed wp-login form brute, signature df15d0ee3ccf) ⟳ — RECORD 494 PAIRS, GROWTH ALARM BLOWN — Hostile, active

• Actors: canary-farm-1 224 pairs from 103 IPs; control-1 125 pairs / 5 IPs; netcup-ts 56 / 2; sponge-01-ts 44 / 2; lauterbourg-01-ts 46 pairs from 1 IP under a bare Mozilla/5.0 (separate single-IP leg). The digest's 7-IP probe→credentials cluster carried 594 events fleet-wide.
• TTPs: POST /wp-login.php with valid nonce handling. Captured bodies (quoted verbatim): _wpnonce=cbcce48f2e&log=admin&pwd=381234%21&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In and _wpnonce=01f33b8b6d&log=admin&pwd=admin123&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In. Forged Chrome/130–151, Firefox/133, Safari/18.1 class rotation. 494 distinct pairs fleet-wide; prior record 363.
• Assessment: the form-level shape stays single-account (log=admin fixed) while the xmlrpc stage went multi-account — the two stages may be different crews working the same fake WordPress. The 200-pair alarm stood since №14 and is now blown. Volume, not novelty, is the signal; watch whether the residential pool re-adds the WP-REST-ENUM sibling shape.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ FLEET-WIDE — FIRST LAUTERBOURG LEGS — Hostile, active

• Actors: 11 DigitalOcean runners carried the full 27-family walk this window — canary-farm-1: 159.223.132.86, 143.110.213.72, 147.182.149.75, 209.38.208.202, 159.89.174.87, 64.23.218.208; ai-devbox-1: 134.209.25.199, 157.230.19.140, 167.172.232.142; ru-edge-1: 207.154.212.47, 46.101.1.225 — and three of them reached lauterbourg-01-ts for the first time (46.101.1.225, 207.154.212.47, 209.38.208.202, each on 2 sensors). Control legs 206.189.233.36 and 206.81.24.74 minted without a full walk. Four l9scan UA variants in use.
• TTPs: unchanged 12-step walk: tarpit → /console/ weblogic → /server-status → /login.action confluence → ___proxy_subdomain_whm/cpanel → /v2/_catalog + /v2/internal/*/tags/list + /manifests/latest docker-registry enum. 27 trap families per runner.
• Assessment: 13 of the window's 50 canary mints went to l9scan runners between 20:55 and 21:45 stored — LeakIX's scanner keeps collecting on this fleet. AWS-side draws after the window close remain the pattern to beat. The lauterbourg extension says the template's target list refreshed after the rebuild.

SI-CENSUS / CREDSWEEP census pair (directory-fanout .env census) ⟳ — NEW /24 AND A TECHTIES RETURN — Hostile, active

• Actors: 102.220.163.241 (VPS Dedicated LLC SI — the SI-CENSUS family's first 163.x operator; the registered block is 161.x) on ru-edge-1 (2,658 ev / 859 paths / 39 families) and ai-devbox-1 (517 ev / 511 paths / 34 families); 93.152.221.96 (TechTies Inc. DE — the CONFIG-SWEEP day-4 operator's org, SS-NET TOOLING's kin) on 7 sensors, 525 ev, 34 families on farm.
• TTPs: identical journey from both IPs: /.env [issued] → /vendor/.env, /lib/.env, /lab/.env, /cronlab/.env, /cron/.env, /core/.env, /core/app/.env, /core/Datavase/.env, /database/.env, plus a pscan-<hash>-nonexistent.txt marker. Forged Chrome/126. The pair drove the phpinfo (8.3×/6.1×) and webshell-probe (17.0×/8.5×) spikes with 122 events each — one shared wordlist, two unrelated hosts. Mint haul: 5 mints to the SI block IP, 8 to TechTies (12 over 6 days, a growing hoard).
• Assessment: the marketplace model again — one wordlist, multiple operators, both collecting. 13 mints left the fleet to these two IPs this window. Watch AWS-side use from either; SI-CENSUS re-activates on this second window.

CLOUDCONF-CENSUS (cloud-credential + VPN-config census) ⚠ NEW (first seen 10-18, named this cycle) — Hostile, active

• Actors: 85.155.14.14 (canary-farm-1 + netcup-ts) and 85.155.14.15 (frantech-ts) — SolidCore Hosting LTD DE. Three IPs and 2,015 events all-time since 2026-10-18; not previously named.
• TTPs: GET-only, 356 events / 356 paths per sensor leg, 47 trap families on farm. Cloud arm: /.aws/credentials + .old/.bak, /.aws/sso/cache, /.azure/accessTokens.json, azureProfile.json, clouds.config, /.config/gcloud/application_default_credentials.json, access_tokens.db, /.aliyun, /.boto, /.cloudflare, /.config/doctl/config.yaml, /*.tfvars, passwd-s3fs, s3cfg. VPN arm (netcup fleet first-seens): /wg0.conf, /globalprotect.conf, /watchguard.conf, /paloalto, /checkpoint, /mullvad, /strongvpn, /vyprvpn, /cisco-vpn, /proxy.yaml, plus cloud-state files /.netlify/state.json, /.scaleway, /scaleway.json, /.openstack, /.softlayer.json, /hetzner.json. Forged Chrome/124–125 + Firefox/125. 0 mints.
• Assessment: the widest cloud-provider coverage of any census this fleet has recorded, and the first to price VPN tunnel configs and provider CLI state as a credential class. The 10-18 first sighting sat unregistered for two cycles; the wordlist is now on record. Watch a mint, a fourth sensor, or the 8-day return gap closing.

AI-ADMIN-SWEEP (synchronized AI-app admin-endpoint census) ⚠ NEW — Hostile, active

• Actors: 91.99.220.233 — first-ever sighting, hosting not yet attributed.
• TTPs: 6 legs launched within 0.15 s of each other (20:10:29.57–.71 stored across control-1, ru-edge-1, netcup-ts, sponge-01-ts, canary-farm-1, ai-devbox-1), frantech leg at 00:10:57. 865 events, 20 paths, bare Mozilla/5.0, GET-only, 0 mints, 0 POSTs. Paths: /api/user/self, /api/v1/admin/workspaces, /console/api/setup, /api/v1/chatflows, /rest/settings, /api/config, /model/info, /v1/models, /v1/chat/completions, /system_stats, /health/readiness — the admin/setup surfaces of LiteLLM, Flowise, Dify, n8n, and ComfyUI-class self-hosted AI apps. Digest tags: litellm-admin-unauthenticated, llm-endpoint-ollama-version, docker-daemon-info, observability-health, app-config-json.
• Assessment: one controller ran per-sensor legs in the same second — orchestrated, not a scanner passing by. The target set maps unauthenticated admin and setup endpoints whose exposure is takeover-adjacent; a 200 on /console/api/setup or /api/v1/admin/workspaces would be the escalation signal. Fleet decoys answered; nothing minted. Watch a second operator IP, any POST, and follow-up traffic from the block.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — ZERO-USE WINDOW — Hostile, active

• Actors: mint side 50 credentials to 28 collector IPs (digest issued semantics count 51 mint rows). Use side: none observed in the window.
• TTPs: no AWS activity tied to fleet canaries this window. Standing inventory: 136.66.182.42 holds 41, 34.58.160.181 holds 41 (together AI-EXEC-HUNT's 82), 213.209.159.175 holds 30, 213.209.159.154 holds 18, 37.60.226.187 holds 17, 45.148.10.171 holds 11, 143.244.165.105 holds 9, 93.152.221.96 grew to 12 since 10-21, 208.84.100.218 holds 6 since 10-21.
• Assessment: №62's use window did not repeat; the hoards grew instead. The Feo Prest pair's mint streak ended (both IPs absent this window after 48 combined holds). Either the consumption cycle runs longer than a day or these credentials sit unsold. The 50 new credentials are hostile-held inventory until they expire.

Light watchers

• GOWEB-PENTEST first same-window pair — 36.99.60.192 + 191.102.244.103, each 151 phpmyadmin-login POSTs on 1 path on sponge-01-ts under the honest Go Web Pentest Tool UA; both first-time operator IPs (24th and 25th); the pair is the node's entire 7.3× spike. First dual-operator window for the campaign.
• ADMINER-SWARM return — ~40 of the 173.239.214.x pool worked lauterbourg + ru-edge pairs at 5–32 events per IP after missing №62; 173.239.214.87 minted 1 on ru-edge (Firefox/106). First lauterbourg pairing for the pool.
• KEYDROP-SCANS return — 172.235.210.84 minted 1 on ai-devbox-1 (00:50 stored) with the same 2-event walk; third IP rotation on record.
• 208.84.100.218 (CONFIGBUNDLE-KIT operator, since 10-02) — 5 mints across 4 sensors this window under the Chrome/39 forgery; 6 over 6 days. Standing collector.
• 45.138.12.x loiterers (Tc Datacenter LT) — second consecutive window: 45.138.12.19 looped / against tarpit + php2shell decoys on 5 sensors (805 ev), 45.138.12.35 re-ran its aidev leg (384 ev). Its 185 php2shell-root events are tarpit loop traffic, not trap interaction — the catch-all tag quirk.
• 130.12.180.x (Omegatech NL) — third window; .170 and .176 minted 1 each (Chrome/147), extending the block from watcher to collector.
• 217.60.76.167 (LIBREDTAIL staging /16) — second consecutive mint window (1 on farm). 146.70.98.138 (env-dl/1.0) minted again — second window. 91.92.240.86 (fasthttp) minted on 4 sensors — first collection window; watch it join the TechTies/SS-Net collector set.
• 183.134.40.84 — 28 events on frantech-ts; unattributed, light.
• ANDROXGH0ST-KIT — third window on lauterbourg (cluster 2d3e95b722b5, 4 IPs, 164 ev). Still census-and-probe; no POSTs captured this window.
• Benign fixed-cadence probers — 89.248.172.33 (7 sensors, 351 ev), 75.127.6.2 (zmap-proxy-probe/1.0, honest UA, 7 sensors, 67 ev), 45.198.224.125 (8 sensors, 65 ev). Honest UAs, shallow journeys; research class.

Standing actors (persistence check)

• 194.26.192.113 (1337 Services GmbH NL) — second consecutive window on lauterbourg, volume up 1,007 → 2,000, mode shifted burst → low-and-slow. The ASN also fielded ANDROXGH0ST-KIT's lead; two kits, one hoster.
• 208.84.100.218 — minting on 4 sensors since 10-02; the fleet's longest-lived standing collector.
• 45.138.12.x (Tc Datacenter LT) — second window of loitering loops; CVENGINE-KIT's block keeps warm.
• 130.12.180.x (Omegatech NL) — third window, now minting; synchronized mint pair behavior from №62 did not repeat.
• 93.152.221.96 (TechTies) — mint collector since 10-21 (12/6d) and now a 7-sensor census operator; promoted to a named campaign actor this cycle.
• Bochum softsec crawler (185.73.23.x) — absent a third consecutive window. Its absence keeps netcup-ts (−69%) and sponge-01-ts (−77%) below baseline along with AI-CLI-VAULT's missing legs.

Absent or paused

AI-EXEC-HUNT, AI-CLI-VAULT, BUCKLOG-KIT, METADATA-HUNT named runners, OMEGA-SWEEP census operators, NIGHTAGENT, MALWARE-DICT (.18 loop, fifth window), MALWARE-DICT-2, EXCHANGE-DICT (second window), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, SES-QUOTA-PROBE (fifth window), CF-FRONTED CREDSWEEP, GO-SPRAY-SWEEP (network layer), Feo Prest 213.209.159.x minting.

Network-layer recon (Arkime) — 2026-10-25 07:33:00 → 2026-10-26 07:33:59 UTC

Fingerprint field ssh.hassh, destination port 22 · 126,730 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 88,524, bahrain-sponge-01-ts 56,846, sensor:bahrain-sponge-01-ts 56,846, contabo-sponge-02-ts 19,816, proxy 19,816, sensor:contabo-sponge-02-ts 19,816

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 4,138 sessions from 560 source IPs across 242 networks in 63 countries, port 22, avg 4,942 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS132203 Tencent Building, Kejizhongyi Avenue, AS8075 Microsoft Corporation, AS4766 Korea Telecom, AS16276 OVH SAS. Busiest sources: 103.63.108.25, 103.154.77.48, 43.135.135.212, 43.156.136.47, 51.75.27.218. Last 7 days: 10-20 402 IPs, 10-21 327 IPs, 10-22 314 IPs, 10-23 443 IPs, 10-24 617 IPs, 10-25 579 IPs, 10-26 200 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 24,113 sessions from 75 source IPs across 30 networks in 24 countries, port 22, avg 5,119 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS48090 Techoff Srv Limited, AS208137 Feo Prest SRL, AS213790 Limited Network LTD. Busiest sources: 109.160.32.166, 109.160.32.159, 109.160.32.175, 77.239.124.149, 109.160.32.125. Last 7 days: 10-20 42 IPs, 10-21 41 IPs, 10-22 48 IPs, 10-23 53 IPs, 10-24 57 IPs, 10-25 78 IPs, 10-26 27 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. LIBSSH-MASSSWEEP kept its pool wide: 560 source IPs / 242 networks while sessions rose to 4,138 (+652 day-over-day). GO-SSH-SWEEP spent heavily from a narrow base: 24,113 sessions from 75 IPs / 30 networks, and its busiest sources again include 77.239.124.x — the same /24 whose 77.239.124.2 and 77.239.124.161 ran this window's frantech uname survey (2,119+2,119+832 commands). The sweep and the shell stage remain one operation. LIBSSH-011-SWEEP (03a80b21…) stayed single-source on day 16 of its run, below the 50-IP threshold. GO-SCATTER-SWEEP (1644384618…) held single-source at 33 IPs / 22,819 sessions. No new flags this cycle; the flagged pair stays at two.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 50 credentials to 28 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 34.58.160.181: 41 mints, 2026-10-19 16:03 → 2026-10-19 16:03
• 213.209.159.175: 30 mints, 2026-10-19 16:42 → 2026-10-23 15:04
• 213.209.159.154: 18 mints, 2026-10-19 06:24 → 2026-10-25 02:52
• 37.60.226.187: 17 mints, 2026-10-20 02:15 → 2026-10-21 21:45
• 93.152.221.96: 12 mints, 2026-10-21 23:57 → 2026-10-26 05:46
• 45.148.10.171: 11 mints, 2026-10-19 04:59 → 2026-10-22 00:53
• 143.244.165.105: 9 mints, 2026-10-21 18:02 → 2026-10-23 21:39
• 80.94.92.126: 8 mints, 2026-10-19 11:21 → 2026-10-20 10:36
• 140.245.97.208: 7 mints, 2026-10-20 23:51 → 2026-10-24 16:12
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 208.84.100.218: 6 mints, 2026-10-21 03:34 → 2026-10-26 03:41
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 80.94.92.65: 6 mints, 2026-10-19 06:23 → 2026-10-21 09:39
• 102.220.163.241: 5 mints, 2026-10-25 09:28 → 2026-10-25 10:13
• 165.227.102.187: 5 mints, 2026-10-21 16:37 → 2026-10-25 04:14
• 206.81.24.74: 5 mints, 2026-10-20 20:43 → 2026-10-25 21:04
• 157.245.113.227: 4 mints, 2026-10-20 20:04 → 2026-10-24 20:05
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 185.177.72.64: 4 mints, 2026-10-20 01:57 → 2026-10-20 08:44
• 23.234.78.109: 4 mints, 2026-10-20 05:35 → 2026-10-20 14:00
• 45.138.12.51: 4 mints, 2026-10-20 22:16 → 2026-10-24 18:42
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 46.151.178.15: 4 mints, 2026-10-25 17:05 → 2026-10-25 21:14
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 134.209.25.199: 3 mints, 2026-10-23 18:47 → 2026-10-25 21:41
• 138.68.144.227: 3 mints, 2026-10-22 21:03 → 2026-10-24 20:54
• 146.70.98.138: 3 mints, 2026-10-24 20:46 → 2026-10-25 20:51
• 150.228.105.248: 3 mints, 2026-10-20 17:58 → 2026-10-20 18:02
• 157.230.19.140: 3 mints, 2026-10-19 20:25 → 2026-10-25 21:41
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 206.189.233.36: 3 mints, 2026-10-20 19:58 → 2026-10-25 20:58
• 217.60.76.167: 3 mints, 2026-10-24 07:47 → 2026-10-26 05:25
• 45.148.10.5: 3 mints, 2026-10-22 00:28 → 2026-10-25 02:19
• 46.101.1.225: 3 mints, 2026-10-20 20:02 → 2026-10-25 21:06
• 64.89.163.14: 3 mints, 2026-10-21 08:34 → 2026-10-21 10:53
• 72.167.41.202: 3 mints, 2026-10-21 17:58 → 2026-10-21 18:02
• 93.152.209.6: 3 mints, 2026-10-22 02:01 → 2026-10-24 19:57

Fleet Observations

• Fleet volumes and causes. frantech-ts +99% (17,368 ev / 21 uniq): the MEGA-DICTIONARY pair alone contributed 16,850. lauterbourg-01-ts +696% (14,491 / 191): XMLRPC-BRUTE contributed 11,807. The four drops have named causes: ru-edge-1 −69% (EXCHANGE-DICT's 69,601-event crawl ended), control-1 −79% (№62's MEGA-DICT control leg, 13,777 ev, plus AI-CLI-VAULT's 1,720 did not repeat), netcup-ts −69% and sponge-01-ts −77% (Bochum crawler absent a third window, AI-CLI-VAULT legs absent). canary-farm-1 −22% and ai-devbox-1 −15% are within normal spread.
• Canary economics. 51 digest issued rows (farm 18, aidev 14, ru-edge 11, control 8) against the funnel's 50 minted credentials to 28 collectors — the standing count-semantics gap between digest issued and funnel dedup, unchanged. Failures: 3 × 400 Bad Request, all on /.env (farm 22:35:57 and 07:31:59, control 01:33:07 stored) — scattered upstream rejections, no burst, no key errors. All mints were aws type.
• Attribution posture. XFF single-entry forgery: 0. Any-XFF 3,500 requests, 2,156 of them legitimate peer-agreed or internal. No identity-field manipulation this window; the JNDI-FIELD-INJECT class did not return. TLS split: lauterbourg 1,022 of 14,491 events on https (7.0%), farm 221, aidev 101 — the certless deception nodes take almost everything on plain http, as designed.
• Control discovery velocity. Day 43 of the fresh-IP baseline: 983 events / 109 unique IPs — the quietest event day since 09-14, with unique-IP discovery steady (7-day avg 135). The ramp metric to track stays unique IPs/day; it held while volume collapsed, which supports the named-cause reading of the −79%.
• Digest quirks in play this cycle. The first-seen table showed netcup's entire VPN-config block under one sync-arrival timestamp (03:15:43 stored) — the known arrival-time quirk; the true per-IP first-evers spread across the window. The php2shell-root/php2shell-login catch-all quirk re-confirmed: 45.138.12.19's 185 tagged events are tarpit loop traffic on /.
• Fleet-side fixes. None this cycle. No node, config, or pipeline changes; the visuals dashboard gained the two new campaign chains (AI-ADMIN-SWEEP, CLOUDCONF-CENSUS) and №63 status updates on ten existing chains.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

• Funnel. 683 sources sent credentials → 512 got a shell (75%) → 473 ran a command (92% of shell-getters, 69% of sources). Event level: 28,758 credential attempts → 5,517 accepted logins → 16,651 commands (302% of accepted logins led to commands). Telnet took 1,537 attempts. The per-login conversion held at last cycle's level — operators keep working the box after entry.
• New commands. None — 0 of 9,111 distinct commands were first-seens this window. The command inventory is mature; a first-seen here remains the single post-compromise signal to watch.
• Recurring (context, not news). The uname/CPU/IPv4 survey ran again from 77.239.124.2 and 77.239.124.161 (2,119 + 2,119 + 832 command events) — the same /24 that sits in GO-SSH-SWEEP's busiest sources this window (77.239.124.149). The sweep and the shell stage remain one operation. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh then an authorized_keys append) ran from 418 and 372 IPs respectively — commodity botnet baseline.
• Credentials. 19,614 distinct pairs offered, 0 new. Concentration, not the list, is the signal: the 345gs5662d34 family took 1,408 of 28,758 attempts (723 as user 345gs5662d34 + 685 as root against 3245gs5662d34).

Gaps / Next Collection

1. AWS side of the inventory. Zero use this window against 50 new credentials and 182+ held in named hoards. Pull Tracebit alerts past the window close before №64; any use after 07:33 UTC lands there first.
2. AI-ADMIN-SWEEP follow-through. Second operator IP, any POST, or an unauthenticated-200 follow-up from 91.99.220.233's block. Attribute the host; the block is not in the registry yet.
3. MEGA-DICTIONARY manifest verification. v_full's frantech history holds no pre-window replay-host rows, so path-level anti-joins are impossible; frantech sink retention needs measuring (see 5). Watch a third host and whether partial replays repeat.
4. WP-FORM-BRUTE growth. The alarm threshold (200 pairs) is blown at 494. Track pair count and IP count separately; a merge with the xmlrpc multi-account dictionary would mark shared tooling.
5. frantech sink retention. Quantify per-node JSONL retention so campaign anti-joins know their lookback; frantech's flux :80 trap history is effectively invisible beyond the retention window.
6. l9scan mint disposition. The 13 credentials minted to DigitalOcean l9scan runners between 20:55 and 21:45 stored are the highest-likelihood next-use candidates.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-26.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-26.md