FLUX FLEET — INTEL BRIEFING №67

Period: 2026-10-29 07:33 – 2026-10-30 07:33 UTC (24h, day 65 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 65-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

REGISTRY-HUNT crossed the line every prior window waited for: its DigitalOcean walkers used 8 stolen canary credentials in AWS from 5 use IPs this window. Two of them (64.225.75.246, 157.230.19.140) ran a 14-operation SES and Bedrock enumeration, and AWS answered the rest with 22 denied InvokeModel and 22 denied GetSendQuota calls. XMLRPC-BRUTE set its volume record under a new operator: 10,000 system.multicall POSTs to /xmlrpc.php on canary-farm-1 in 24 minutes. Two new single-operator toolings appeared: an OpenAPI/swagger spec census (193.47.62.29, 3 sensors) and by-digest container-registry pulls under an honest docker/24.0.7 UA (147.90.255.64, 4 sensors). Fleet volume fell 14–92% below the 7-day baseline on every node because four one-off mega-crawlers from №64–№66 went quiet; underlying scan noise held steady and all four XFF forgery counters stayed at 0.

Key Judgements

1. REGISTRY-HUNT is an operate-then-use pipeline, not a census. 35 walker IPs ran the 27-family walk across all 8 sensors this window, and by window close walkers used 8 of their minted credentials from 5 DigitalOcean use IPs: two full 14-operation SES/Bedrock enumerations, four GetCallerIdentity-only checks. (High confidence on the sequence — the walk shape, the mint rows, and the Tracebit use alerts all carry the same IPs; Moderate on intent — a GetCallerIdentity-only check may be a validity test rather than exploitation, and the fleet cannot see inside the AWS account.)
2. Credential demand now exists; supply still dwarfs it. 51 credentials went to 30 collector IPs this window and 8 were used; 43 sit unused. The large idle hoards did not move: TechTies 1,088 (6d, static), 102.220.163.241 70, and three 41-credential AI-EXEC piles. (High confidence on the counts — the alert pull covers the window; Moderate on the interpretation — hoard-for-resale and slow consumption still look identical from outside.)
3. XMLRPC-BRUTE is a kit with rotating operators, and it has volume headroom. The №65–№66 operators (8.137.104.136, 180.93.254.108) fired nothing this window, while a fresh Google LLC US address (136.80.17.156, forged Chrome/89) ran 10,000 multicall POSTs — roughly 10× the kit's registered 1,000-POST batch shape. (High confidence on the volumes and the absence; Moderate on the kit-operator model — shared template proves lineage, not the same crew.)
4. Scanning themes keep moving toward cloud-native surfaces. This window added OpenAPI/swagger spec discovery and Docker-registry pulls by digest; №66 added VPN configs and Claude Code stores. (Moderate confidence — both new sightings are single-operator, single-window; a repeat promotes the trend to High.)

Active Campaigns (day 65 status)

REGISTRY-HUNT / LeakIX (l9scan template + 27-family walkers) ⟳ — FIRST CREDENTIAL USE — Hostile, active

• Actors: 34 distinct IPs hit the WebLogic console step and 35 ran the docker-registry catalog step, spread across all 8 sensors. The digest's kill-chain rows name DigitalOcean LLC for every walker listed (examples: 206.81.24.74, 147.182.149.75, 167.99.210.137, 142.93.0.66, 178.128.207.138, 167.71.81.114, 157.230.19.140, 206.189.95.232, 206.189.19.19, 46.101.111.185, 157.245.113.227, 68.183.9.16). Pool size keeps growing: 4 walkers (№66) → 15 (№64) → 34–35 (№67).
• TTPs: the walk is unchanged — tarpit → WebLogic console → server-status → Confluence login → WHM/cPanel proxy subdomains → /v2/_catalog → registry tags/list → manifests. The use side is new: 8 credentials used from 6 walker addresses. 64.225.75.246 (mint from canary-farm-1) and 157.230.19.140 (minted 10-24, outside this window — Tracebit is the only witness) each ran the same 14-operation enumeration: GetAccount, GetAccountSendingEnabled, GetAccountSummary, GetCallerIdentity, GetSendQuota, GetSendStatistics, InvokeModel, ListBuckets, ListEmailIdentities, ListFoundationModels, ListIdentities, ListPolicies, ListRoles, ListUsers. 206.81.24.74 (2 creds), 68.183.9.16 (2 creds), 206.189.19.19, and 46.101.111.185 stopped at GetCallerIdentity. AWS denied GetSendQuota×22, InvokeModel×22, GetAccount×18, ListFoundationModels×12, ListEmailIdentities×6; 8 calls succeeded, all sts:GetCallerIdentity (identity leak at most).
• Assessment: the walkers now check what they harvest and hand it to AWS-side operators in the same window. The denied-operation mix reads as bulk-sender staging (ses:GetSendQuota/ses:SendEmail-shaped) plus Bedrock model inventory, followed by IAM account mapping (ListRoles/ListPolicies/ListUsers). Every use ties back to a specific mint within hours — the canary design turned a silent theft into a full attribution chain. Watch: persistence attempts after the IAM mapping, any second-stage use IP, and whether the walkers re-touch the same sensors.

XMLRPC-BRUTE (system.multicall POST floods to /xmlrpc.php) ⟳ — RECORD FLOOD, NEW OPERATOR — Hostile, active

• Actors: 136.80.17.156 (Google LLC US), canary-farm-1 only, 11:28–11:52 stored — 10,008 events on 5 paths, 10,000 of them wp-xmlrpc-post, under forged Chrome/89.0.4389.114. Distributed wp-login legs on ru-edge-1: 163.172.46.59 (Scaleway FR, 27 probes + 27 credential POSTs), 108.174.147.120 (24 + 24), 103.47.145.13 (8 + 8), 103.47.145.17 (6 + 6). The №65–№66 operators (8.137.104.136, 180.93.254.108) did not fire.
• TTPs: a short preamble (/, /wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed) then continuous system.multicall POSTs at ~5/s for 24 minutes, ~508-byte bodies, all answered 200 by the fake WordPress. Captured body (verbatim, head; preview truncates at 120 chars): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><param — the same wp.getUsersBlogs credential-checking multicall as №63–№66.
• Assessment: largest single-IP flood on record (prior shape: 1,000-POST batches; №65's record run reached 14,438 over 1 h 44 m). The kit's flood-then-form-brute staging (№66) makes a second leg from 136.80.17.156 the immediate watch item. The fleet's fake surfaces absorbed the full volume and leaked nothing; xmlrpc is not a trap family, so no mints were possible.

WP-XRPC-WALK (distributed xmlrpc + REST user enumeration) ⟳ — IDENTICAL REPLAY, WIDER FOOTPRINT — Hostile, watch

• Actors: the two digest clusters replayed with byte-identical shape: 362522228887 (33 IPs / 108 events, 7 sensors) and 0a08798abff5 (6 IPs / 37 events, 5 sensors) — same ordered-path signatures and same counts as №66. In total 64 distinct IPs touched /wp-json/wp/v2/users this window (2,876 events including their other results); the largest single-IP REST-enum count is 11 (104.131.3.242).
• TTPs: unchanged — 1–2 events per IP, POST /xmlrpc.php (wp.getUsersBlogs multicall) alternating with GET /wp-json/wp/v2/users, fresh modern per-IP UAs, 0 mints.
• Assessment: a fixed script replayed on a fixed schedule, now two windows old, with the wider 64-IP population suggesting a growing worker pool behind it. Watch IP-count growth against the WP-LOGIN-BRUTE 200-pair alarm, the first mint, and any merge with the xmlrpc floods.

CREDSWEEP class (exhaustive .env-variant + credential-file census) ⟳ — SIXTH WINDOW, ALL-8 WALK WITH MINTS — Hostile, active

• Actors: 45.138.12.16 (Tc Datacenter LT) walked all 8 sensors (417 events) and minted at /.env on canary-farm-1 (02:59:35 stored) and ru-edge-1 (04:57:24 stored) — 5/6d per side, 0 use. 45.138.12.35 ran 768 events on ai-devbox-1 + control-1 and owns control's fake-git spike (264 fake-git-miss + 120 fake-git). 45.138.12.51 ran netcup-ts + sponge-01-ts (264 events). 45.138.12.6 (260 events, aidev + farm). Marker-revision operator 176.65.144.71 (Dedik Services CH) returned on canary-farm-1: 188 events, 70 families, /kmonbase<hex> probes plus a config-hunt journey (/.git/HEAD, /.ssh/id_ecdsa, /.htpasswd, /config/secrets.yml, /docker-compose.yml, /.env.dist). 194.180.49.41 (MEVSPACE sp. z o.o. BG) ran 62 events on 5 sensors.
• TTPs: unchanged census shapes; the Tc Datacenter IPs continue rotating per-sensor roles from one /24. The /kmonbase<hex> marker revision (first seen №66) held under its known holder.
• Assessment: sixth consecutive window, still zero use from this class. Watch: AWS use from the two fresh /.env mints, and a third /kmonbase adopter (a third sighting would establish that the revision circulates).

OPENAPI-CENSUS (API-documentation spec discovery) ⚠ NEW — Hostile, watch

• Actors: 193.47.62.29 (BestDC Limited BG), forged Chrome/123.0.0.0 Windows 10, 18:42–00:10 stored. 489 events / 150 paths / 20 families across canary-farm-1, netcup-ts, ru-edge-1.
• TTPs: an OpenAPI/swagger spec-path census — owns the openapi-spec-json-skeleton spikes on all three sensors (22 hits each; 23.0× / 8.2× / 22.0× the 7-day average) and the spec-path first-seens (/api/swagger-ui/swagger.json, /api-docs/swagger.json, /docs/swagger.json, /api/openapi.json, /swagger/v1/swagger.json, 6 hits per path per sensor). The fake surfaces answered 200 with spec skeletons. 0 mints, 0 POSTs.
• Assessment: spec discovery maps a real API surface before attacking it — the fleet's skeleton answers deny the map. Single IP, single window: a second IP or node promotes it to standing.

DOCKER-DIGEST-PULL (container-registry pull by digest) ⚠ NEW — Hostile, watch

• Actors: 147.90.255.64, on canary-farm-1, ai-devbox-1, netcup-ts, ru-edge-1 (81 events total).
• TTPs: speaks the Docker registry v2 protocol under an honest client UA — docker/24.0.7 go/go1.21.5 git-commit/311b9ff kernel/6.6.0 os/linux arch/amd64. On canary-farm-1 it pulled 10 manifests by digest for internal-named repositories: /v2/backup/db-migrator/manifests/sha256:5fdcf5302180…, /v2/internal/auth-service/manifests/sha256:faebf99bbd46…, /v2/staging/web-app/manifests/sha256:b741d0c00147…. Distinct from REGISTRY-HUNT's browser-UA catalog/tags enumeration — this is a real docker client.
• Assessment: wants images, not configs — digest pulls imply a prior catalog or wordlist stage that names internal repos. Watch: token-endpoint probes, any blob GET (a blob GET would establish the full pull flow), a second IP.

CREDENTIAL-DRAIN (mint → use pipeline) ⟳ — FIRST USE IN SIX WINDOWS — Hostile, active

• Actors: mint side 51 credentials to 30 collector IPs (funnel semantics; digest issued rows 60: canary-farm-1 27 from 22 IPs, control-1 13 from 9, ru-edge-1 13 from 10, ai-devbox-1 7 from 6). Use side: 8 credentials from 5 use IPs, all REGISTRY-HUNT walkers (details under that campaign). 43 credentials stolen with no observed AWS use.
• TTPs: standing piles per the Tracebit pull: TechTies 93.152.221.96 1,088 (6d, static; second consecutive idle window in flux logs), 102.220.163.241 70, 136.65.203.248 / 136.66.182.42 / 34.95.21.228 at 41 each. Mint failures 25×400 upstream rejections at /.env, spread as pacing singles over 12 IPs on 4 sensors (max 2 per IP-sensor, 19:17–05:59 stored; heaviest single 150.241.66.127 with 2+2 on control-1/ai-devbox-1). No 401s, no key errors.
• Assessment: the sixth-cycle streak of zero-use windows is broken, and the demand came from the REGISTRY-HUNT side while every large hoard stayed cold. Use-vs-hoard behavior is now separable per operator — the alert pull each cycle remains the check.

Light watchers

• 104.199.180.57 (Google LLC TW) — lauterbourg-01-ts 350 events / 223 paths / 20 families in 2 minutes (01:45–01:46 stored), forged Chrome/153.0.0.0 macOS: webapp-form-profile census (8) + form-login (7) + form-signup (2), graphql-introspection ×3, telescope-shell ×2 (Laravel Telescope probe), 3 POSTs, 0 mints.
• 34.177.96.228 (Google LLC SG) — ai-devbox-1 283 events / 272 paths / 18 families in 1 minute (19:34–19:35 stored): env-variant census (env-production-error 184, phpinfo-error 37, firebase-json-error 9, gcp-credentials-json-error 4); 1 tracebit 400.
• 9.205.248.165 (Microsoft DK) — sponge-01-ts 239 events / 222 paths under honest-looking ExposureScanner/1.0 (internal-security-audit): webshell-probe ×10, openapi skeletons ×4, webshell-sweep-observed ×2. The self-declared audit UA is unverified — not classified benign.
• 204.76.203.237 (Pfcloud UG NL) — 261 events on all 8 sensors; the lauterbourg leg hammers 4 paths (/index.php5 ×59, /index.php ×64 incl. 44 php2shell-index, / ×59, /login ×2). The MALWARE-DICT /24's sibling rotation continues in a php-probe loop shape.
• Distributed pools — 82.197.193.x (~30 IPs, 4 sensors, ≤25 events each; two carried tracebit 400 singles) and 185.132.187.x (~30 IPs, 4 sensors; several minted 1 each on ru-edge-1/canary-farm-1). Low-and-slow, no shared UA string.
• Benign research class — 71.6.155.70 (8 sensors, 8 events, empty UA; Censys research range per №66), 75.127.6.2 (8 sensors, 74 events, honest zmap-proxy-probe/1.0), 93.174.93.12 (7 sensors, 322), 89.248.172.33 (7, 416). 45.198.224.125 (8 sensors, 73 events) runs a forged Firefox/71 and stays in the hostile-light class.

Standing actors (persistence check)

• REGISTRY-HUNT DigitalOcean pool — present every window on record; escalated from walk to use this cycle.
• 45.138.12.x (Tc Datacenter LT) — sixth window; the /24 re-ran its all-8 walk with fresh per-sensor mints.
• 176.65.144.71 (Dedik CH) — second window as the /kmonbase marker-revision holder.
• 194.180.49.41 (MEVSPACE) — recurring light census arm, 5 sensors.
• WP-XRPC-WALK population — second window; REST-enum touchers grew 39 → 64 IPs.

Absent or paused

TechTies-KIT + JNDI-FIELD-INJECT (second consecutive idle window; XFF forgery counters back to 0), SI-CENSUS 102.220.163.241 (first miss after four windows), MEGA-DICTIONARY (all three 13,776-event baseline replays idle), CALC-ORACLE-KIT (152.236.14.113 idle), 121.40.140.50 and 136.70.193.85 (lauterbourg baseline heavyweights, idle), XMLRPC №65–№66 operators (8.137.104.136, 180.93.254.108), 34.67.167.4 (№65 flood overlap, absent), PATHSCAN-CENSUS, VPN-CONF-HUNT (watch single missed), 8.217.152.4, 140.245.97.208 (second miss), AI-EXEC-HUNT (no run at the №57/№61/№64/№66 cadence), EXCHANGE-DICT, NIGHTAGENT, BUCKLOG-KIT, METADATA-HUNT named runners, KEYDROP-SCANS, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP, ANDROXGH0ST-KIT, CRUSADER-SWEEP, AI-CLI-VAULT (fifth), GCP-ACONF, WEBSIPHON, SES-QUOTA-PROBE (ninth), GIT-VAULT, LIBREDTAIL-KIT, ADMINER-SWARM, CONFIGBUNDLE-KIT, CVENGINE-KIT, MEVSPACE-GITWALK, SS-NET TOOLING, WP-ENUM, INFOCREST-KIT, MALWARE-DICT-2, Bochum softsec crawler 185.73.23.x (seventh window). Absence here reads from this window's tables; a low-volume one-off below table floors would not show.

Network-layer recon (Arkime) — 2026-10-29 07:33:00 → 2026-10-30 07:33:57 UTC

Fingerprint field ssh.hassh, destination port 22 · 142,456 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 106,480, bahrain-sponge-01-ts 49,325, sensor:bahrain-sponge-01-ts 49,325, contabo-sponge-01-ts 18,494, sensor:contabo-sponge-01-ts 18,494, sensor:lauterbourg-01-ts 15,655

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 3,926 sessions from 629 source IPs across 256 networks in 70 countries, port 22, avg 4,896 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS31898 Oracle Corporation, AS19871 Network Solutions, LLC. Busiest sources: 123.58.215.196, 41.128.181.199, 85.95.166.40, 217.182.253.249, 96.78.175.45. Last 7 days: 10-24 617 IPs, 10-25 579 IPs, 10-26 599 IPs, 10-27 653 IPs, 10-28 615 IPs, 10-29 657 IPs, 10-30 177 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 3,103 sessions from 164 source IPs across 67 networks in 36 countries, port 22, avg 5,166 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS51167 Contabo GmbH, AS37110 moztel-as, AS7552 Viettel Group. Busiest sources: 175.196.78.7, 8.148.5.235, 8.130.97.165, 8.148.183.39, 8.138.210.122. Last 7 days: 10-20 8 IPs, 10-21 70 IPs, 10-26 41 IPs, 10-27 183 IPs, 10-28 119 IPs, 10-29 164 IPs, 10-30 12 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: LIBSSH-MASSSWEEP holds its ~600-650-IP daily band. GO-SPRAY-SWEEP posted the biggest spread move (93 → 164 IPs) and sits at half its 192-IP peak on its 13th day. GO-SCATTER-SWEEP shed 1,799 sessions day-over-day. CTL-MASS-SSH (4e066189c3bb…) again owns control-1's inbound (26,619 sessions of 49,325). Two new fingerprints appeared below sweep thresholds (efc4646cf1f6…, 30 sessions / 8 IPs, ssh-2.0-go; aae6b9604f6f…, 26 sessions / 2 IPs, openssh_9.6p1 ubuntu banner) — both get their second window before any naming. Both flagged sweeps are already named in assets/recon-names.tsv and the campaign registry; no new network-layer names this cycle.

Fleet Observations

• Volume shift, explained. Every node fell below its 7-day baseline (ai-devbox-1 −52%, canary-farm-1 −17%, control-1 −57%, frantech-ts −92%, lauterbourg-01-ts −84%, netcup-ts −34%, ru-edge-1 −92%, sponge-01-ts −14%). Spot queries attribute the gap to four one-off crawler families from №64–№66 that did not repeat: 34.67.167.4 (9,815 events on ai-devbox-1), 93.152.221.96 (30,543) plus 169.150.211.193 (13,776) on ru-edge-1, a 13,776-event trio on frantech-ts (169.150.201.41, 155.2.191.115, 23.234.118.146), and 121.40.140.50 (20,289) / 136.70.193.85 (9,815) / 152.236.14.113 (6,101) on lauterbourg-01-ts. Underlying noise (tarpit loops, census walkers) held steady. Window overlap applies as always: events between digest runs appear in two digests.
• Canary economics. Digest issued rows: 60 mints (canary-farm-1 27 from 22 IPs, control-1 13, ru-edge-1 13, ai-devbox-1 7). All 25 failures are 400 upstream rejections at /.env in pacing singles across 12 IPs on 4 sensors — no 401s, no burst, no key errors; the rejection share this window is 25 of 85 mint attempts, worth watching one more window. netcup-ts, sponge-01-ts, and frantech-ts mint 0 by design (certless); lauterbourg-01-ts ships TRACEBIT_API_KEY= empty, so its absence is config, not failure.
• Attribution/TLS posture. All four XFF counters at 0 (2,328 requests carried X-Forwarded-For; none forged, none mismatched to the socket peer). The counter's two mass-sighting windows were JNDI-FIELD-INJECT, now idle. TLS split: canary-farm-1 12,227 http / 707 https; ai-devbox-1 is the only node where https leads (1,266 vs 1,108) — the Cloudflare-fronted surface; all other nodes are http-dominant. Top Host header: sso.rightabouteverything.show 11,005.
• Control-1 discovery velocity. 47 days live. Most recent full day in the window (10-29): 2,048 events / 153 unique IPs. The 7-day band runs 892–16,293 events per day with unique IPs holding 102–178 — the ramp is intact, and the network layer shows the node still draws the fleet's heaviest SSH mass-scan (4e066189c3bb…, 26,619 sessions).
• First-seen caveats. All first-seen rows in this digest share one sync-batch timestamp (03:15 stored); they are an inventory, not a timeline. The spec-path and by-digest first-seens are attributed above by direct journey queries, not by the table's timestamps.
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 647 sources sent credentials → 489 got a shell (76%) → 449 ran a command (92% of shell-getters, 69% of sources). Event level: 26,860 credential attempts → 22,543 accepted logins → 31,149 commands. Telnet (commodity IoT botnets): 1,424 attempts.

New commands — 91 of 6,709 distinct — and all 91 belong to one source. 92.118.39.50 ran a shell-capability probe script: quoted verbatim (head): "sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d916a01fd28b3dd0c4b2e9b55012b88_small_control'"'"' '"'"'check_3d916a01fd28b3dd0c4 — with sibling probes tagged _small_math ($((807*381+48))), _small_pid ($$), _small_done, and _arg1/_arg2 function-definition checks, one hash-tagged token per probe. This is an automated verification pass over shell arithmetic, variable expansion, and function support — a botnet QA script, not an operator session. A follow-on payload from this IP would establish staging intent.

Recurring commands are context: the echo -e "\x6F\x6B" keepalive loop from 13.140.229.150 (18,931 events), uname/lspci GPU-discovery strings (77.239.124.2, 195.178.110.218), and the chattr -ia .ssh + SSH-key-plant pair (411 and 360 sources) all held steady. Credentials: 21,511 distinct pairs offered, 0 new; concentration unchanged — 345gs5662d34/345gs5662d34 658 attempts and root/3245gs5662d34 525 (the same family, 1,183 combined), then commodity pairs.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 71 endpoints on 20 hosts, 2421 command references and 602 download attempts since 2026-09-18T10:45
• served payloads: 20 distinct artifacts over HTTP 2xx from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128)
• this window: 0 endpoints first seen, 0 active; 27 endpoints seen in the last 7 days remain current
• inventory generated 2026-10-30T07:33:11Z

New this window

No endpoint first seen this window.

Endpoints active this window

No command or download referenced an endpoint this window.

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

C2 read: a fully quiet window — no new dropper endpoints and no downloads attempted against the standing set. The inventory (71 endpoints / 20 hosts) and the 20 served artifacts stand as last recorded; the 92.118.39.50 probe script above sent no fetch this window, so its staging intent stays unestablished.

Gaps / Next Collection

1. REGISTRY-HUNT use side. Pull Tracebit alerts at least daily for the 43 unused walker-held credentials; check for persistence-shaped calls after the ListRoles/ListUsers IAM mapping.
2. DOCKER-DIGEST-PULL flow. Check whether the fake /v2/ surfaces saw token-endpoint (/v2/auth, /v2/token) probes or blob GETs from 147.90.255.64; a blob GET would establish the full pull flow. A registry-auth decoy is a fleet-owner decision, not a briefing change.
3. XMLRPC-BRUTE second leg. Watch 136.80.17.156 for the №66 pattern (flood → /wp-login.php form-brute) and alert if any multicall count passes ~15,000.
4. New-census promotion checks. OPENAPI-CENSUS (193.47.62.29) and DOCKER-DIGEST-PULL (147.90.255.64): second IP or second node promotes either to standing; also check WP-XRPC-WALK against its 64-IP footprint for a first mint.
5. Mint-failure rate. The 400-rejection share rose to 25 of 85 attempts; re-run mint-health next cycle and, if it holds or grows, capture one full failure response body from the node side (read-only sink read) to name the rejection.
6. TechTies hoard. 1,088 credentials idle across two windows — keep the alert pull on it; the first use from that pile is still the single highest-value alert the fleet can fire.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-30-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-30.md