FLUX FLEET — INTEL BRIEFING №66

Period: 2026-10-28 07:34 – 2026-10-29 07:34 UTC (24h, day 64 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 64-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

XMLRPC-BRUTE's canary-farm-1 operator switched legs mid-run: the system.multicall flood froze at exactly №65's 14,438 POSTs, and the same IP (8.137.104.136, Hangzhou Alibaba CN, forged Chrome/78) opened a /wp-login.php form-brute leg that fired 6,706 credential POSTs through 12:55 stored. A lighter Chrome/88 twin (180.93.254.108, VN) ran the same two-leg shape on canary-farm-1 and sponge-01-ts. AI-EXEC-HUNT returned from two idle windows with a fourth operator IP (34.95.21.228, Google LLC CA) and minted 41 canary credentials in a 5-second burst — a pile that ties the fleet's largest single-IP hoards. TECHTIES-KIT missed its first window in five and JNDI-FIELD-INJECT went silent with it; ru-edge-1 (−94%) and control-1 (−56%) fell to baseline as a result. MEGA-DICTIONARY returned on frantech-ts under two new operators (Datacamp DE, M247), each replaying a ~13,800-unique-path IoT dropper dictionary in about two minutes. No canary reached AWS: 101 credentials to 38 collectors, the fifth zero-use cycle in six.

Key Judgements

1. XMLRPC-BRUTE runs as a staged credential pipeline, not a single flood. The xmlrpc count froze at 14,438 while a new wp-login leg on the same IP grew to 6,706 POSTs, and the Chrome/88 twin repeated both stages on two sensors with byte-identical counts (255+255 each). (High confidence on the two-stage sequence — timestamps and frozen counts; Moderate on intent — one IP proves sequencing, not the operator's plan.)
2. The shared CREDSWEEP wordlist circulated to a new revision. The walk's marker prefix changed from pscan-<hash> to /kmonbase<hex>, under two unrelated operators (176.65.144.71 Dedik CH and 93.152.209.6 Omniline BG, both forged Googlebot/2.1), while SI-CENSUS extended the existing walk to a fifth sensor (netcup-ts, first time). (High confidence on the co-occurrence — same marker style, same window, different hosts; Moderate on revision-vs-variant — two sightings only.)
3. AI-EXEC-HUNT is a recurring mass-mint operation with rotating egress, not opportunistic scanning. Four operator IPs in four appearances (34.58.160.181, 136.66.182.42, 136.65.203.248, now 34.95.21.228), each a sub-minute burst with the React-Flight RCE battery and 41–48 mints, piles never used. (High confidence on the pattern — four runs on record; Moderate on cadence — runs at №57, №61, №64, №66 do not yet fix a schedule.)
4. Credential supply grew again, and demand stayed at zero. 101 new credentials went to 38 collectors this window, the fifth zero-use cycle in six; the TechTies hoard sits static at 1,089/6d while three 41-credential piles idle. (High confidence on the zero — the alert pull covers the window; Moderate on the interpretation — hoard-for-resale and slow consumption look identical from outside.)

Active Campaigns (day 64 status)

XMLRPC-BRUTE (system.multicall POST floods to /xmlrpc.php, now with a wp-login form-brute stage) ⟳ — STAGED LEGS — Hostile, active

• Actors: 8.137.104.136 (Hangzhou Alibaba Advertising CN) on canary-farm-1; 180.93.254.108 (Sai gon Postel Corporation VN) mirrored on canary-farm-1 + sponge-01-ts. Small legs: 188.166.105.69 (DigitalOcean, 48 POSTs, bare Mozilla/5.0), 185.148.240.80 (16, Firefox/133), 157.90.153.23 (11, Chrome/131), and the 217.60.x trio 196.2/.184.50/.184.25 (24 combined, Firefox/133 + Chrome/131). 34.67.167.4's 9,815 top-talker rows on ai-devbox-1 are №65's window-overlap re-show (last event 05:23 stored, inside №65's window) — no new POSTs.
• TTPs: 8.137.104.136's xmlrpc leg stopped at exactly 14,438 POSTs (№65's close count) with 14,712 distinct bodies; the same IP then fired 6,706 wp-login-credentials POSTs at /wp-login.php under Chrome/78.0.3904.108, running through 12:55 stored — 6,706 of the spike's 7,131 events. 180.93.254.108 ran 255 xmlrpc multicalls + 255 wp-login POSTs on each of two sensors in the same hours (Chrome/88.0.4240.193), byte-identical counts per leg. Bodies (quoted verbatim, head): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>\n<value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></v… — the same credential-checking multicall as №63/№65. The fake WordPress answered everything.
• Assessment: the campaign now shows enumerate-stuff (multicall) then brute (form POST) on one target in one session. The fleet's fake surfaces fed both stages at full flood and leaked nothing. Digest spikes explained: farm wp-login-credentials 28.6×, farm wp-xmlrpc-post 5.1×, sponge wp-xmlrpc-post 69.2× (277 ev), sponge wp-login-credentials 10.8×, ru-edge wp-xmlrpc-post 7.0×, control wp-xmlrpc-post 20 ev (inf). Watch the twin's next run (does it scale like 8.137?), a third operator IP, and whether the wp-login leg grows a distributed layer.

AI-EXEC-HUNT (AI-crawler-forged census + React-Flight RCE probes + mass minting) ⟳ — RETURNED, FOURTH OPERATOR — Hostile, active

• Actors: 34.95.21.228 (Google LLC CA), single burst on canary-farm-1 18:17 stored; the IP opened its run with REGISTRY-HUNT's 27-family walk before the AI-crawler stage.
• TTPs: 623 events / 276 paths / 51 trap families in one burst (18:17 stored), 21 POSTs, 41 mints at /.env in 5 seconds (18:17:53–18:17:58) under the forged AI-crawler set (DeepSeekBot, cohere-ai, Meta-ExternalAgent, CCBot, Applebot ×4 variants, PerplexityBot/Perplexity-User, Kimi/Moonshot/KimiBot, ClaudeBot/Claude-User/Claude-SearchBot, bingbot, Bytespider, GrokBot, Hunyuan, GPTBot/ChatGPT-User/OAI-AdsBot, Baiduspider, Amazonbot). React-Flight RCE bodies (quoted verbatim, head): {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('ch… with NEW boundary r2s1acmxpsphaq8w on /login, /admin, /dashboard, /settings, /api/auth; marker path unchanged (/z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show); gcp/firebase legs (google-services.json, gc-service.json → 400s).
• Assessment: same template, fourth egress IP, same 41-mint pile size as the two standing AI-EXEC hoards (136.65.203.248, 136.66.182.42). The boundary string rotates per run (r2s3km489nw4b6k №64 → r2s1acmxpsphaq8w №66) and stays a per-run fingerprint. The node's fake surfaces answered every stage; nothing executed. Watch the fifth operator IP and any AWS use from the three 41-piles.

CALC-ORACLE-KIT (multi-family RCE-verify loop with an arithmetic oracle) ⟳ — RUN ENDED — Hostile, dormant

• Actors: 152.236.14.113 (Latitude.sh CA), single IP, lauterbourg-01-ts only this window.
• TTPs: the run continued past №65's close and ended 11:29 stored 10-28 (≈19 h total). This window's 3,550 events: phpunit eval-stdin ×892, php2shell-root ×892, Drupalgeddon2 ×455, wp-file-manager upload ×442, webapp-form-profile ×435, php2shell-index ×434 (1,789 POSTs). New per-run markers: oracle arithmetic 51630*37099 (was 40836*49255), upload boundary wf12y9tsoy4vc61 (was wf100fthlq341ie). Probe bodies (verbatim, heads): <?= system('uname -m; echo $((51630*37099))');?> and the connector.minimal.php multipart (name="cmd" / upload[]). These six results drove lauterbourg's phpunit-eval-stdin 894 (3.9×) and php2shell-index 436 (3.5×) spikes.
• Assessment: the kit finished its ~19-hour verification loop and left. No payload drop appeared in the flux view; no second IP joined; the four light legs from №65 did not repeat. The run's outcome (whether any oracle ever returned true) is still unobserved — the decisive check remains a post-loop payload from this IP, which would mean the decoy answered true. Node held through the whole engagement.

MEGA-DICTIONARY (shared IoT dropper-URL dictionary, host rotates per replay) ⟳ — RETURNED, TWO NEW OPERATORS — Hostile, active, single sensor

• Actors: 169.150.201.41 (Datacamp Limited DE) and 146.70.200.3 (M247 Europe SRL), both on frantech-ts only. Not a fleet number: one host.
• TTPs: 169.150.201.41 fired 13,776 GETs at 13,776 unique paths 11:17:30–11:19:24 stored 10-28 (~2 min); 146.70.200.3 fired 13,775 GETs at 13,775 unique paths 05:24:09–05:25:52 stored 10-29 (~2 min). Near-zero path reuse; hundreds of forged IoT device UAs per run (D-Link DIR/TP-LINK Archer/ZTE/Synology DSM/MikroTik RouterOS/UniFi/Wavlink/Tenda/Netgear classes plus curl, wget, python-requests, OkHttp). Sample paths show the dropper-dictionary shape: /ntp, /no_killer/arm, /6ndte2.ps1, /71.exe, /.Sassy.sh4, /a2work_arm, /TSFJ, /cloud/form_01577.pdf.ps1. No POSTs, no mints; 6 trap families each.
• Assessment: the marketplace dictionary found two new buyers in one window, ~18 h apart, each running the same ~2-minute replay pattern. The deception-only host absorbed 27,551 of its 28,203 events. Watch the next replay (host rotation is the constant) and whether any replay shifts from GET census to a download attempt against the node's fake surfaces.

TECHTIES-KIT (census-to-kit on the shared .env wordlist) ⟳ — FIRST MISS IN FIVE WINDOWS — Hostile, idle

• Actors: 93.152.221.96 absent — zero rows in v_full this window.
• TTPs: none observed. JNDI-FIELD-INJECT went silent with it: the XFF single-entry forgery counter returned to 0 after two mass-sighting windows (455, then 425).
• Assessment: four consecutive daily kit windows (№62→№65) ended. The hoard (1,089/6d) is intact and idle. A return re-opens the fleet's heaviest volume source; a second consecutive miss supports reading the run as a campaign with an end, not a standing presence. No inference either way yet.

REGISTRY-HUNT / LeakIX (l9scan template + 27-family walkers) ⟳ — WAVE RETURNED — Hostile, active

• Actors: the 27-family walk re-ran on canary-farm-1 from 157.230.19.140, 206.81.24.74, 64.225.75.246, 164.92.107.174 (DigitalOcean) and 34.95.21.228 (Google CA, whose AI-EXEC-HUNT run opened with the same walk); 206.81.24.74 also walked ai-devbox-1.
• TTPs: the evening l9scan mint wave returned: 11 mints 20:58–21:50 stored across farm/aidev/control/ru-edge (206.81.12.187, 143.110.217.244, 139.59.143.102, 206.81.24.227, 138.68.144.227, 206.81.24.74 ×2, 164.92.107.174, 147.182.149.75, 64.225.75.246, 157.245.113.227, 64.23.218.208, 157.230.19.140) under l9scan/2.0.* UAs. 45.138.12.51 minted under its honest l9explore/1.2.2 UA on control (5/6d).
• Assessment: the runner wave and the evening mint schedule both repeated after №65's lull; the pool now holds 13 fresh l9scan-sourced credentials as next-use candidates. Walk shape unchanged (tarpit → WebLogic console → server-status → Confluence → WHM/cPanel proxy → docker-registry enum).

CREDSWEEP class (exhaustive .env-variant + credential-file census) ⟳ — MARKER REVISION + FIFTH-SENSOR REACH — Hostile, active

• Actors: SI-CENSUS 102.220.163.241 (VPS Dedicated LLC SI) — 2,058 events on 5 sensors (control, ai-devbox, netcup, canary-farm, ru-edge; netcup-ts first time), 10:19–22:06 stored, 4 mints at /.env, forged Chrome/126 (70/6d). 194.180.49.41 (MEVSPACE sp. z o.o. BG) — lighter return, 48 events on 6 sensors. 45.138.12.16 (Tc Datacenter LT) — 631 events on 3 sensors (12:55–18:26 stored), 1 mint under Chrome/124. Marker-revision walkers: 176.65.144.71 (Dedik Services CH, 40 families, 1 mint under forged Googlebot/2.1) and 93.152.209.6 (Omniline Investment BG, 35 families) — both probed /kmonbase<hex> marker paths.
• TTPs: the SI-CENSUS walk is the full 511-path directory-fanout (.env [issued] → vendor/.env → lib/.env → cron/.env → core/.env → database/.env → phpMyAdmin), the same sequence on every sensor with per-sensor pscan-<hash> markers. The kmonbase probes (/kmonbasezdf31effb5, /kmonbaseqt596f2232 on farm; two each from the two IPs) are the same marker pattern as pscan-<hash> under a new prefix — evidence the wordlist's self-identification changed while the walk stayed shared.
• Assessment: the wordlist still circulates, and it now mutates. Five organizations ran it across four windows. SI-CENSUS is the fastest-escalating census operator on record (13 ev → 2,208 → 2,058 on 5 sensors). Watch a third kmonbase adopter (confirms the revision), and mint use from the SI-CENSUS pile (70/6d).

WP-XRPC-WALK (alternating xmlrpc multicall + REST user enumeration, distributed) ⚠ NEW — Hostile, watch

• Actors: 33 IPs / 108 events across all 7 canary-bearing sensors (digest cluster 362522228887, first seen 10-29) plus 6 IPs / 37 events on 5 sensors (0a08798abff5).
• TTPs: 1–2 events per IP: POST /xmlrpc.php (wp.getUsersBlogs multicall) alternating with GET /wp-json/wp/v2/users (REST user list). Each IP carries a fresh, honest-looking modern UA (Safari/17.5, Chrome/138, Firefox/140, Edge/138 — 11 IPs on the Safari/17.5 string alone). 0 mints, 0 POST bodies beyond the multicalls.
• Assessment: a new distributed enumeration layer with residential-proxy economics — many IPs, one or two requests each, per-IP fresh UAs. Distinct from №65's Chrome/127 enum pool (that pool reused one forged string). Watch IP-count growth (the WP-LOGIN-BRUTE 200-pair alarm applies here too), a first mint, and any coordination with the xmlrpc floods on the same sensors.

VPN-CONF-HUNT (VPN/tunnel config-store census) ⚠ NEW — Hostile, watch

• Actors: 85.155.14.14 (SolidCore Hosting LTD DE), single IP, lauterbourg-01-ts only, 01:38–01:42 stored 10-29.
• TTPs: 355 events at 355 unique paths in 4 minutes under 3 rotating browser forgeries (Chrome/124 on macOS 14.4.1, Safari/17.5, Firefox/126). Owns the node's first-seen paths this window: /.ovpn, /zerotier.conf, /ikev2.conf, /xray.json, /ss.conf, /nordvpn, /windscribe.conf, /forticlient, /sophos, /barracuda, /array-vpn, /rsa-securid, /rsa.conf, /bastion.yml, /proxy.yml, /.svn/auth, /config.php.save. 0 mints.
• Assessment: a new wordlist theme — VPN-client, zero-trust, and secure-remote-access credential stores — aimed at the freshest node's PHP surface. Single run so far. Watch a second node or IP (promotes to standing) and any mint on these paths.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — FIFTH ZERO-USE CYCLE IN SIX — Hostile, active

• Actors: mint side 101 credentials to 38 collector IPs (funnel semantics; digest issued rows 105: farm 72 from 21 IPs, aidev 15 from 14, ru-edge 10 from 8, control 8 from 8). Use side: none observed.
• TTPs: no AWS activity tied to fleet canaries. Standing piles per the Tracebit pull: TechTies 1,089 (6d, static), the new 34.95.21.228 pile 41, 136.65.203.248 and 136.66.182.42 at 41 each, SI-CENSUS 70 (6d), 46.151.178.15 12 (6d), 140.245.97.208 8. Mint failures 6 total: 5×400 tracebit-http-error (45.148.10.125 fired 3 in 24 s across farm/ru-edge/aidev at 22:36 — pacing burst; 34.19.191.99 and 91.92.41.32 singles) plus 1 untagged row on ai-devbox-1; no 401s, no key errors.
• Assessment: five zero-use cycles in six windows. The four largest piles (1,089 + 41×3) have never touched AWS. Any alert against any of them is the story; the pull each cycle is the check.

Light watchers

• PATHSCAN-CENSUS — 176.123.5.6 (Alexhost S.r.l. MD): 854 events / 62 trap families / 282 paths in 6 minutes (02:21–02:27 stored) under the honest UA Mozilla/5.0 (compatible; pathscan/1.0); random-string marker probes, a webshell sweep, and 9 mints at /.env including /.ENV and /.Env case variants (mint-collector behavior, not census-only).
• BUCKLOG-KIT census arm — 185.177.72.29 (Bucklog SARL FR /24): gravitysmtp probe → env/aws-credentials walk → phpinfo, 3 mints under the kit's curl/8.7.1 UA at 19:50 stored. New arm IP; the family's №44 SES use remains its only use event.
• 45.148.10.x — 45.148.10.120 minted 2 (aidev, farm, stripped-Chrome UA); 45.148.10.125 owns the 3-in-24 s pacing failure burst (4/6d mints).
• 105.112.24.243 (NGN block) — python-requests/2.31.0, 5 mints across 4 sensors, 18 events on all 8 — light walker with collector behavior.
• ffuf sighting — 144.24.19.233 minted on control under Fuzz Faster U Fool v2.1.0-dev (first fleet sighting of the tool string).
• 46.151.178.15 — 7-sensor light walk, 3 mints this window (12/6d).
• Benign fixed-cadence probers — 93.174.93.12 (7 sensors, 334 ev), 89.248.172.33 (7, 369), 45.198.224.125 (8, 84), 34.140.3.155 (6, 28), 71.6.155.70 (8, 8 — Censys research range), 193.174.89.19 (6, 18). Honest UAs, shallow journeys; research class.
• New UA first-seens — fhms-its-research-scanner/1.0 (FH Münster research scanner, benign by identification), HeadlessChrome/122 (sponge), Python-urllib/3.10, and batch-forged Firefox/140 variants (x64 de suffix). Honest research UA classified benign; the forged set noted as tooling markers.

Standing actors (persistence check)

• SI-CENSUS (102.220.163.241) — fourth window: 13 ev / 3 mints (№64) → 2,208 / 57 (№65) → 2,058 / 4 on five sensors (№66). Volume holds at walk scale; sensor reach still widening.
• 45.138.12.x (Tc Datacenter LT) — fifth window; .16 walked 3 sensors with a mint, .6 and .51 minted singles, .125 pacing-failed 3 mints.
• REGISTRY-HUNT runners (DigitalOcean pool) — present every window on record; both the walk and the evening mint wave ran this cycle.
• 93.152.221.96 (TechTies) — fifth window on record but first idle one; the absence is the trend line to watch, not volume.
• 140.245.97.208 (Oracle US) — first miss after four windows (last mint 00:54 stored 10-28, inside №65's window).
• 8.217.152.4 (Alibaba) — second window, 1 mint (3/6d).

Absent or paused

TechTies-Kit + JNDI-FIELD-INJECT (first miss), 140.245.97.208, Bochum softsec crawler 185.73.23.x (sixth window), AI-CLI-VAULT (fourth), AI-ADMIN-SWEEP, EXCHANGE-DICT, KEYDROP-SCANS, METADATA-HUNT named runners, NIGHTAGENT, MALWARE-DICT (.18 loop), MALWARE-DICT-2, BUCKLOG-KIT RCE arm (census arm present), SES-QUOTA-PROBE (eighth), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP census operators, ANDROXGH0ST-KIT, CRUSADER-SWEEP, MEGA-DICTIONARY's №64 host 98.98.47.133 class (replaced by two new operators), lauterbourg numeric wp-login enum.

Network-layer recon (Arkime) — 2026-10-28 07:34:00 → 2026-10-29 07:34:53 UTC

Fingerprint field ssh.hassh, destination port 22 · 123,706 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 97,407, bahrain-sponge-01-ts 63,098, sensor:bahrain-sponge-01-ts 63,098, out-of-order-src 11,464, sensor:sponge-01-ts 9,936, sponge-01-ts 9,936

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 3,264 sessions from 606 source IPs across 259 networks in 70 countries, port 22, avg 4,893 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS19871 Network Solutions, LLC, AS4766 Korea Telecom, AS16276 OVH SAS. Busiest sources: 96.78.175.36, 164.68.123.246, 43.172.91.126, 203.128.6.159, 4.224.40.94. Last 7 days: 10-23 443 IPs, 10-24 617 IPs, 10-25 579 IPs, 10-26 599 IPs, 10-27 653 IPs, 10-28 615 IPs, 10-29 208 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 3,425 sessions from 93 source IPs across 42 networks in 21 countries, port 22, avg 5,366 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS137718 Beijing Volcano Engine Technology Co., Ltd., AS37110 moztel-as, AS133296 Web Werks India Pvt. Ltd.. Busiest sources: 175.196.78.7, 8.148.5.235, 8.148.183.39, 101.126.144.212, 47.108.207.234. Last 7 days: 10-19 165 IPs, 10-20 8 IPs, 10-21 70 IPs, 10-26 41 IPs, 10-27 183 IPs, 10-28 119 IPs, 10-29 21 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon reading. GO-SPRAY-SWEEP contracted after №65's record day: 172 → 93 source IPs, −17,442 sessions — the expansion did not hold. LIBSSH-MASSSWEEP eased 661 → 606 IPs on day 41 of the record. GO-SSH-SWEEP held steady (28,359 sessions / 48 IPs) and remains the top inbound fingerprint on 6 of 8 nodes. GO-SCATTER-SWEEP fell below the dispersed threshold (45 IPs, 15,315 sessions) and was not flagged this window. Control-1's dominant inbound is the now-named CTL-MASS-SSH (4e066189c3bbeec38c99b1855113733a): 27,146 sessions from 14 IPs across 7 networks — its third consecutive ≥27k-session window and the fleet's largest single-fingerprint load, promoted from №65's gap list and registered. Sponge-01-ts's top fingerprint 98f63c4d9c87edbd97ed4747fa031019 (+1,401 sessions, 10 IPs) stays a watch single. No new fingerprints; 42 standing at ≥14 days. Arkime session tags drifted again: control-1's 63,098 inbound sessions carry the bahrain-sponge-01-ts tag — node attribution by tag is unreliable, the recon aggregates on destination IP.

Canary credentials

Summary

No canary credentials were used in AWS during the window. Fleet sensors minted 101 credentials to 38 collector IPs; none reached AWS.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 1089 mints, 2026-10-22 04:22 → 2026-10-27 21:29
• 102.220.163.241: 70 mints, 2026-10-25 09:28 → 2026-10-28 09:12
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 34.95.21.228: 41 mints, 2026-10-28 18:17 → 2026-10-28 18:17
• 213.209.159.154: 16 mints, 2026-10-23 02:40 → 2026-10-27 11:08
• 213.209.159.175: 16 mints, 2026-10-22 05:08 → 2026-10-23 15:04
• 46.151.178.15: 12 mints, 2026-10-25 17:05 → 2026-10-29 00:56
• 176.123.5.6: 9 mints, 2026-10-29 02:21 → 2026-10-29 02:21
• 140.245.97.208: 8 mints, 2026-10-24 13:00 → 2026-10-28 00:54
• 143.244.165.105: 6 mints, 2026-10-22 08:59 → 2026-10-23 21:39
• 165.227.102.187: 6 mints, 2026-10-22 07:21 → 2026-10-27 03:24
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 105.112.24.243: 5 mints, 2026-10-28 09:46 → 2026-10-28 10:41
• 138.68.144.227: 5 mints, 2026-10-22 21:03 → 2026-10-28 21:10
• 206.81.24.74: 5 mints, 2026-10-22 21:01 → 2026-10-28 21:36
• 208.84.100.218: 5 mints, 2026-10-26 01:31 → 2026-10-26 03:41
• 217.60.76.167: 5 mints, 2026-10-24 07:47 → 2026-10-26 20:44
• 45.138.12.51: 5 mints, 2026-10-22 07:02 → 2026-10-28 17:36
• 134.209.25.199: 4 mints, 2026-10-23 18:47 → 2026-10-26 21:06
• 157.245.113.227: 4 mints, 2026-10-23 18:48 → 2026-10-28 21:41
• 159.26.101.138: 4 mints, 2026-10-23 16:04 → 2026-10-23 16:21
• 45.148.10.125: 4 mints, 2026-10-23 01:44 → 2026-10-23 04:39
• 64.225.75.246: 4 mints, 2026-10-23 18:48 → 2026-10-29 04:44
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 93.152.209.6: 4 mints, 2026-10-23 13:53 → 2026-10-27 11:26
• 130.12.180.77: 3 mints, 2026-10-27 06:26 → 2026-10-27 06:29
• 146.70.98.138: 3 mints, 2026-10-24 20:46 → 2026-10-25 20:51
• 147.182.149.75: 3 mints, 2026-10-24 04:32 → 2026-10-28 21:30
• 157.230.19.140: 3 mints, 2026-10-24 21:01 → 2026-10-29 04:44
• 185.177.72.29: 3 mints, 2026-10-28 19:50 → 2026-10-28 19:50
• 185.177.72.9: 3 mints, 2026-10-23 13:14 → 2026-10-23 13:14
• 206.81.24.227: 3 mints, 2026-10-24 04:32 → 2026-10-28 21:09
• 23.239.27.128: 3 mints, 2026-10-27 11:54 → 2026-10-27 17:27
• 45.138.12.16: 3 mints, 2026-10-24 03:33 → 2026-10-28 09:10
• 46.101.1.225: 3 mints, 2026-10-24 04:32 → 2026-10-26 21:46
• 64.23.218.208: 3 mints, 2026-10-25 21:41 → 2026-10-28 21:50
• 8.217.152.4: 3 mints, 2026-10-27 17:04 → 2026-10-28 07:36
• 91.92.41.32: 3 mints, 2026-10-24 14:15 → 2026-10-28 23:36

Reading. The funnel's largest single-burst pile is 34.95.21.228's 41 — minted in 5 seconds and idle since 18:17 stored. Supply grew by 101 while demand stayed at zero for the fifth time in six windows. The l9scan runners and PATHSCAN-CENSUS added singles; SI-CENSUS took 1 per sensor across 4. lauterbourg-01-ts minted nothing by design (TRACEBIT_API_KEY empty — a 404 there is not a trap failure).

Fleet Observations

• Fleet volumes and causes. canary-farm-1 +111% (26,066 ev / 348 uniq): the 8.137.104.136 wp-login leg (6,706) + AI-EXEC-HUNT's burst (623) + the REGISTRY-HUNT walker legs + SI-CENSUS's 515. frantech-ts +293% (28,203 / 84): the two MEGA-DICTIONARY replays are 27,551 of 28,203 events. ai-devbox-1 +244% (12,127 / 200) is nominal only — 9,815 rows are №65's 34.67.167.4 xmlrpc run re-shown by window overlap; the node's real new volume is ~2,300 events. ru-edge-1 −94% (1,101 / 112): TechTies's 14,771-event daily walk absent. control-1 −56% (2,048 / 153): TechTies's 3,370-event control leg absent. lauterbourg-01-ts −44% (5,020 / 181): CALC-ORACLE-KIT's tail (3,550) replaced №65's larger stack. netcup-ts −73% (742) and sponge-01-ts −36% (1,320): quiet baselines, minus SI-CENSUS's first netcup walk.
• Canary economics. 105 digest issued rows (farm 72 from 21 IPs, aidev 15 from 14, ru-edge 10 from 8, control 8 from 8) against the funnel's 101 minted credentials to 38 collectors — the standing count-semantics gap, unchanged. Failures 6: 5×400 tracebit-http-error root-caused as pacing (45.148.10.125 ×3 in 24 s; two other singles) + 1 untagged row on ai-devbox-1; no 401s, no key errors, no bursts from any other actor. Mint types: farm 42 ssh + 27 aws + 3 aws+ssh; the other sensors all aws.
• Attribution posture. XFF: any-header 2,637, multi-entry chains 0, present-but-ignored 486, single-entry forgery 0 — the counter returned to baseline with JNDI-FIELD-INJECT idle. TLS split stays http-dominant: farm 1,243 of 26,066 on https (4.8%), lauterbourg 133 of 5,020 (2.6%), aidev 775 of 12,127. Host census: raw-IP vhosts dominate (frantech 209.141.62.110 28,182; farm 109.123.246.142 24,487; lauterbourg 89.116.25.211 4,763); sso.rightabouteverything.show took 1,570 on farm; inference.fapthropic.com 10,785 on aidev.
• Control discovery velocity. Day 46 of the fresh-IP baseline: 2,048 events / 153 unique IPs — unique-IP discovery back above the 7-day average (128) after two under-average days (130 → 112). Volume fell 56% on TechTies's absent control leg. The metric to track stays unique IPs/day; one above-average day after two below-average ones is a swing, not a trend.
• Digest quirks in play. The window-overlap quirk re-listed №65's aidev xmlrpc run (34.67.167.4, 9,815 rows, last ts 05:23 stored — entirely inside №65's window); cross-checked before counting, no new POSTs occurred. The first-seen table again stamped whole sync batches with one arrival time (03:16:26 and 03:31:29 stored) — arrival times, not observation times. The UA column held at its 320-char preview: no collapse this cycle.
• Arkime session tags. Control-1's 63,098 inbound sessions carry the bahrain-sponge-01-ts tag (drift first noted №64). Recon aggregation uses destination IP, so counts and campaign attribution stand; do not use session tags for node attribution.
• Fleet-side fixes. None this cycle — no node, config, or pipeline changes. Dashboard maintenance: CHAINS updated for 7 campaigns (XMLRPC-BRUTE, AI-EXEC-HUNT, CALC-ORACLE-KIT → dormant, MEGA-DICTIONARY, TECHTIES-KIT → idle, REGISTRY-HUNT, SI-CENSUS, CREDENTIAL-DRAIN), 4 chains added (MEGA-DICTIONARY, WP-XRPC-WALK, VPN-CONF-HUNT, PATHSCAN-CENSUS), TALKER_CAMPAIGNS +8, CTL-MASS-SSH added to recon-names.tsv.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

• Funnel. 735 sources sent credentials → 552 got a shell (75%) → 476 ran a command (86% of shell-getters, 65% of sources). Event level: 11,944 credential attempts → 6,153 accepted logins → 17,460 commands (284% of accepted logins led to commands). Telnet took 765 attempts. The per-login conversion held at the last two cycles' level — operators keep working the box after entry.
• New commands. None — 0 of 6,125 distinct commands were first-seens this window. Twenty-first consecutive mature-inventory window; a first-seen here remains the single post-compromise signal to watch.
• Recurring (context, not news). The uname/CPU hardware survey ran from 109.160.32.110 and 5 siblings (7,718 command events across its two command shapes) — the GO-SSH-SWEEP-linked 109.160.32.x pool. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then an authorized_keys append) ran from 438 and 371 IPs — commodity botnet baseline. A GPU-inventory quartet (lspci | grep VGA…, uptime -p, uname variants) ran from 179.43.153.10 and 5 siblings (1,364 events) — crypto-targeting reconnaissance from a third source block (№64's: 209.99.190.186; №65's: 103.159.2.113); the survey crews keep rotating.
• Credentials. 2,659 distinct pairs offered, 0 new. Concentration: the 345gs5662d34 family took 1,081 of 11,944 attempts (585 as user 345gs5662d34 + 496 as root against 3245gs5662d34).

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 71 endpoints on 20 hosts, 2421 command references and 602 download attempts since 2026-09-18T10:45
• served payloads: 20 distinct artifacts over HTTP 2xx from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128)
• this window: 0 endpoints first seen, 5 active; 27 endpoints seen in the last 7 days remain current
• inventory generated 2026-10-29T07:21:51Z

New this window

No endpoint first seen this window.

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Reading. No new endpoints and no new served payloads this window. The №65 generation held its shape: 176.65.139.40's wget/curl pair stays the workhorse (218 2xx deliveries, 235 source IPs), the 152.42.195.115 4-arch ELF set last served 10-26, and 146.190.102.83's t2r_compat.sh stands at 8 distinct sha256 drops from one endpoint. https://217.60.102.5/sh drew 10 command events from 5 source IPs and still returns 0 2xx — two windows, body uncaptured, family unnamed; the host sits in the LIBREDTAIL-adjacent 217.60.x /16, adjacency noted, lineage unproven. 147.79.62.90 went quiet.

Gaps / Next Collection

1. AWS side of the piles. TechTies's 1,089 and the three 41-credential piles (34.95.21.228, 136.65.203.248, 136.66.182.42) have never touched AWS. Pull Tracebit alerts early next cycle — the first use is the fleet's largest pending theft-to-use event.
2. TECHTIES-KIT disposition. First miss after four daily windows. A second consecutive miss supports reading the run as ended; a return re-opens the fleet's heaviest volume source. Check ru-edge and control volumes first next cycle.
3. WP-XRPC-WALK growth. 33 IPs on the first walk. Count IPs next cycle, watch for a first mint, and check whether the per-IP fresh UA set rotates strings.
4. CTL-MASS-SSH shape. The fleet's largest fingerprint (27,146 sessions on control-1, third ≥27k window) is named but uncharacterized beyond session counts — pull banner and authentication fields for 4e066189c3bbeec38c99b1855113733a from Arkime when the recon script next runs with a wider field, and check whether it also targets other nodes.
5. kmonbase revision spread. Two operators probed /kmonbase<hex> markers this window. Diff kmonbase-bearing walks against the pscan- inventory to map the revision, and watch for a third adopter to confirm the circulated update.
6. CALC-ORACLE-KIT outcome. The 19-hour loop asked "did system() run?" and left. A post-loop payload from 152.236.14.113 would mean the decoy answered true; lauterbourg's sink response bodies for the php2shell and upload surfaces remain the decisive check.
7. Staging-host follow-ups. https://217.60.102.5/sh (0 2xx across two windows, 10 command events) and flux-side 193.32.162.163 (/bins/kla.sh URL, №65): any 2xx from either names a family. Correlate by payload sha256, not IP.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-29-r2.html (regenerated after the №66 CHAINS/registration updates; the earlier same-day render at flux-fleet-visuals-2026-10-29.html predates them)
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-29.md