FLUX FLEET — INTEL BRIEFING №68

Period: 2026-10-30 07:33 – 2026-10-31 07:34 UTC (24h, day 66 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 66-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

REGISTRY-HUNT walkers used stolen canary credentials for a second consecutive window, and the use side widened: walker 165.227.84.14 used a minted SSH canary in a login attempt — the pipeline's first SSH-side use — while 52.161.59.96 ran a successful sts:GetCallerIdentity with no mint row in the flux history, so Tracebit is the only witness. A new MEGA-DICT operator set the campaign's replay record: 135.136.19.27 (M247 Europe SRL DE) fired 14,154 unique-path GETs at frantech-ts in 91 seconds, which alone explains frantech-ts's +65% volume while every other node ran 12–88% below baseline. Two watch singles promoted on schedule: OPENAPI-CENSUS returned with a second operator IP and a wider config census, and DOCKER-DIGEST-PULL fetched its first registry blobs, completing the catalog → tags → manifest → blob pull flow. A distributed wp-login stuffing pass hit ai-devbox-1 from 201 distinct IPs at one credential POST each — record width for a single sensor and past the fleet's registered 200-pair growth alarm. The XFF single-entry forgery counter left zero for the first time since the JNDI-FIELD-INJECT windows: 2 events, both from a scanner that calls itself benign and forges its source.

Key Judgements

1. The walkers now work stolen credentials on non-AWS surfaces, not only in AWS. 165.227.84.14 minted an SSH canary on canary-farm-1 at 21:17 stored and used it in a login attempt in the same window, and 52.161.59.96 ran a successful sts:GetCallerIdentity against a credential with no flux mint in the history window. (High confidence on the two facts — the Tracebit pull carries both rows; Moderate on intent — one SSH attempt may be a validity test, and the fleet cannot see where 52.161.59.96's credential was minted.)
2. Credential stuffing reached record width on one sensor. 201 distinct IPs each sent one wp-login.php credential POST to ai-devbox-1 with default user=pass pairs and per-IP forged modern UAs — the 200-pair growth alarm registered at №14 is tripped in single-sensor form. (High confidence on the counts — direct query, 201 events from 201 IPs; Moderate on campaign linkage — the UA set differs from the registered Chrome/151 family, so this is a new operator in the WP-LOGIN class, not a proven member.)
3. DOCKER-DIGEST-PULL is a working image-theft client, not a metadata enumerator. 147.90.255.64 added 12 blob GETs this window (netcup-ts 10, canary-farm-1 2) to its catalog/tags/manifest walks, so the full registry v2 pull flow is now observed against the fleet's fake surfaces. (High confidence — the result tags carry the flow stages; the fake registry served what it serves and no image content left the fleet.)
4. Commodity census templates keep circulating to new operators. The MEGA-DICT dropper-URL dictionary ran under a third operator at record volume (135.136.19.27, 14,154 paths), and the OPENAPI-CENSUS spec/config census widened from 3 to 7 sensors under two IPs from one /24. (Moderate confidence — operator counts are direct observations; "circulating" infers a shared source that the fleet cannot observe.)

Active Campaigns (day 66 status)

REGISTRY-HUNT / LeakIX (l9scan template + docker-registry walkers) ⟳ — SECOND USE WINDOW, FIRST SSH-SIDE USE — Hostile, active

• Actors: 11 DigitalOcean walker IPs filled the digest's kill-chain rows with the walk (165.227.84.14, 64.23.218.208, 46.101.111.185, 138.68.144.227, 164.90.228.79, 159.89.127.165, 206.81.24.227, 206.81.12.187, 165.22.34.189, 64.226.65.160, 143.110.217.244), plus 142.93.129.190 in the mint rows. Walkers minted with wrapped l9scan/2.0.… (+https://leakix.net) UAs on canary-farm-1 and ru-edge-1 between 20:57 and 21:21 stored — the same mint-wave shape as №66. 46.101.111.185, a №67 use IP, minted again.
• TTPs: the walk is unchanged (digest cluster 76d212a95300, 4 IPs / 156 events on ai-devbox-1): tarpit → /console/ WebLogic login → /server-status → Confluence login → WHM/cPanel proxy subdomains → /v2/_catalog → registry tags/list → manifests/latest. The use side carried the news: 165.227.84.14 used its 21:17 SSH mint in a login attempt (Tracebit: "SSH credentials used to attempt login"), and 52.161.59.96 ran sts:GetCallerIdentity successfully against a credential with no flux mints in the history window.
• Assessment: operate-then-use now spans two consecutive windows and two credential types. The SSH attempt is the first observed use of a non-AWS canary, which extends the funnel beyond AWS and suggests the operators validate whatever they harvest. Watch: a second SSH-side attempt, AWS operations from the 20:57–21:21 mint wave, and a second outside-window use IP.

WIDE-CONFIG-CENSUS (breadth config/credential census) ⚠ NEW — Hostile, watch

• Actors: 50.19.185.106 (Amazon.com, Inc., US), canary-farm-1 only, 12:25–12:46 stored.
• TTPs: 324 events over 302 paths and 75 trap families in 21 minutes under a forged truncated Chrome/124.0 UA, 0 POSTs, 1 mint at /.env (12:25:11 stored). Family spread: env-production 47, firebase-json 13, app-config-yaml 8, wp-config 7, generic-ci-config 6, docker-compose 5, app-config-php 5, appsettings-json 5 — one pass over nearly every config family the fleet baits.
• Assessment: a breadth census from cloud-provider address space that took a credential on its first pass. The mint makes its AWS side the immediate check. A second IP or node promotes it to standing.

OPENAPI-CENSUS (API-spec + app-config census) ⟳ — PROMOTED TO STANDING — Hostile, active

• Actors: 193.47.62.29 (BestDC Limited BG, forged Chrome/123.0.0.0 Win10) ran 922 events on 5 sensors (canary-farm-1, ai-devbox-1, control-1, frantech-ts, lauterbourg-01-ts). NEW operator 193.47.62.32, same /24, ran 223 events on 7 sensors under an honest-looking Go-http-client/1.1. Techoff BG addresses 195.178.110.159 and 195.178.110.22 ran lighter spec legs (11 openapi-spec-json-issued events each on canary-farm-1 and ru-edge-1).
• TTPs: the census widened beyond spec paths into .NET/Node config families — it owns the config-json spikes (ai-devbox-1 93 events, 11.6×; control-1 84 events, 12.0×), the appsettings-json/webapp-config-bundle-json tags, and openapi-spec-json-issued/-skeleton spikes on 7 sensors (the digest lists 7 of the 8 in its spike table). Fake surfaces answered 200 with skeletons. 0 mints, 0 POSTs.
• Assessment: the second IP from one /24 and the widened wordlist meet the promotion triggers set at №67. The fleet's skeletons deny the map, and the census keeps paying nothing. Watch: a first mint from this class, and whether the Techoff legs converge on the same wordlist.

DOCKER-DIGEST-PULL (registry v2 client) ⟳ — FULL PULL FLOW — Hostile, active

• Actors: 147.90.255.64, on canary-farm-1, ru-edge-1, and netcup-ts this window (68 events). ai-devbox-1 saw nothing from it this window.
• TTPs: under the same honest UA docker/24.0.7 go/go1.21.5 git-commit/311b9ff kernel/6.6.0 os/linux arch/amd64 it walked docker-registry-catalog → docker-registry-tags → docker-registry-manifest and added docker-registry-blob GETs (netcup-ts 10, canary-farm-1 2) plus 2 docker-registry-version touches. Manifest pulls remain by digest for internal-named repositories (/v2/backup/db-migrator/manifests/sha256:…, /v2/internal/auth-service/…, №67).
• Assessment: the blob GETs answer №67's watch item — the client completes the pull flow, so it wants image content, not only a catalog. The fake registry served decoys throughout. Watch: a second IP, token-endpoint probes, and whether the digests it requests repeat across windows (that would name a fixed target list).

MEGA-DICTIONARY (dropper-URL dictionary replay) ⟳ — RECORD REPLAY, THIRD OPERATOR — Hostile, active

• Actors: 135.136.19.27 (M247 Europe SRL DE, ipsum:1), frantech-ts only. The three prior replay operators (169.150.201.41, 155.2.191.115, 23.234.118.146) stayed idle.
• TTPs: 14,154 GETs of 14,154 unique paths in 91 seconds (04:13:40–04:15:11 stored), one method, mixed UA set from 360 Router P2 v2 to libwww-perl/6.68, 14,149 events not-handled plus 5 single trap-tag touches (llm-endpoint-models-list, gravitysmtp-miss, exchange-powershell-pre-auth, observability-profiler-index, llm-endpoint-ollama-ps). Dropper-URL dictionary shape: /zatoempire.sh, /bins/bot.mipsel, /cnc, /dns, /ambatukam/rizzx.ppc, /ENCRYPTED.ps1.ps1. frantech-ts first-seens include /morte.x86_64, /deathstarm68k, /donkeypussy/deathstar.x86_64, /fvbig/zerobot.arc, /h2.arm64, /krmine-ppc64, /fuckmeh.sh. 0 POSTs, 0 mints.
• Assessment: the campaign's largest single-IP replay on record (prior high 13,776) under a third operator confirms the wordlist circulates as a commodity. The fake surfaces answered 404-class to 99.96% of it. Watch: a repeat from this IP, returns of the prior operators, and wordlist overlap between the three.

WP-LOGIN-BRUTE class (distributed wp-login credential stuffing) ⟳ — ALARM TRIPPED, NEW OPERATOR SHAPE — Hostile, active

• Actors: 201 distinct IPs, one credential POST each, on ai-devbox-1 (the digest's wp-login-credentials spike: 201 events, 4.0×). A separate small cluster (1dd16c0704a9, first seen 10-31) ran probe/POST alternation on canary-farm-1, netcup-ts, and sponge-01-ts: 8.210.191.157 (18 events), 49.232.230.213 (16), the 103.47.145.x pool (.13, .14, .23, .32 at 8–10 each), 40.81.235.173. The №65–№67 operators (8.137.104.136, 180.93.254.108, 136.80.17.156) did not fire.
• TTPs: single POST /wp-login.php per IP with default user=pass pairs — captured bodies (verbatim, head): log=editor&pwd=editor&wp-submit=Log+In&redirect_to=https%3A%2F%2Finference.fapthropic.com%2Fwp-admin%2F&testcookie=1 and log=webmaster&pwd=webmaster&… — under per-IP forged modern UAs (Version/18.0 Safari ×34 IPs, Chrome/155 Mobile ×30, Firefox/148 ×28, Chrome/155 ×28; future version numbers mark the forgery). 0 mints — login forms are not trap families.
• Assessment: width replaced depth: 201 one-shot sources defeat per-IP rate views, and the registered 200-pair growth alarm is tripped in single-sensor form. The UA set differs from the registered Chrome/151 family, so this is a new operator in the class. Watch: the spray spreading to canary-farm-1 or ru-edge-1, and any pair that reaches a minting surface.

CREDSWEEP class (exhaustive .env-variant + credential-file census) ⟳ — SEVENTH WINDOW — Hostile, active

• Actors: 45.138.12.16 (Tc Datacenter Limited LT) walked 7 sensors for 1,290 events and minted at /.env on ai-devbox-1 (14:36 stored) and control-1 (18:07 stored) under forged Chrome/124.0; 45.138.12.35 ran canary-farm-1 (389) + ru-edge-1 (384); 45.138.12.51 ran netcup-ts + sponge-01-ts and minted on canary-farm-1 (08:25 stored) under l9explore/1.2.2; 45.138.12.6 minted on canary-farm-1 (14:19 stored); 194.180.49.41 (MEVSPACE) ran 37 events on 5 sensors. 176.65.144.71 was not among this window's top talkers.
• TTPs: unchanged per-sensor census walks from one /24; the digest's kill-chain rows show the standard shape (tarpit → fake-git → fake-svn → /.env mint → env-variant battery → git-credentials-error). Mint count for the /24 this window: 4 (one per listed IP).
• Assessment: seventh consecutive window with fresh per-sensor mints and still zero observed use from this class. The l9explore/1.2.2 UA on 45.138.12.51 is the tooling REGISTRY-HUNT's runners use — a second point of template sharing between the two campaigns. Watch: AWS use from the four fresh mints.

CLAUDE-CRED-HUNT ⟳ — TOOLING SWITCH — Hostile, active

• Actors: 87.192.41.180, all 8 sensors, 15:39–22:00 stored, 402 events (№59: 176).
• TTPs: the same forged Chrome/136.0.0.0 UA, but a different wordlist — a .env-variant census at ~50 paths × 8 hits per sensor (/.env, /.env.local, /.env.backup, /.env.test, /.env.dev, /.env~, /.env.tmp, /.env.old, /.env.bak, /config). It minted 1 credential on each canary sensor (canary-farm-1 21:12, control-1 16:36, ru-edge-1 15:51 stored). No /.claude path appeared this window.
• Assessment: the Claude Code store walk was its signature. The operator switched to a generic .env census and took 3 credentials. Whether the Claude walk returns decides whether this is rotation or a reassignment. Watch: /.claude* paths, and AWS use of the 3 mints.

ADMINER-SWARM ⟳ — POOL RETURN ON canary-farm-1 — Hostile, watch

• Actors: 136.144.42.x and 172.98.32.x pools, ≤6 events per IP (adminer spikes: adminer-credential-post 25, adminer-login 25 — 6.2× and 4.5×). Pool members 136.144.42.239 and 172.98.32.33 minted 1 each at 15:52 stored.
• TTPs: adminer/phpMyAdmin login-surface enumeration then 3 credential POSTs per IP, as registered. 0 further use.
• Assessment: the low-and-slow pool model holds, and two more credentials entered the drain. Watch the Tracebit pull for their use.

Light watchers

• 45.148.10.120 (Techoff Srv Limited NL; ipsum:1, firehol2) — canary-farm-1 05:55 → 04:23 stored (22.5 h presence), 356 events / 204 paths / 23 families, 9 mints at /.env (12 per the 6-day Tracebit history since 10-28). fake-git 152, firebase-json 31, config-json 17, gcp-credentials-json 10. UA rotation spans Safari 13.1.2, a stripped Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, and a forged Chrome/138.0.0.0 (ZZ; Linux i686). The /24 family also produced the №59–№67 hoarder 45.148.10.171. Self-identification stays hostile.
• 91.92.40.12 — new, all 8 sensors, 606 events: 596 × GET / plus 10 × /login, tarpit-dominated, one stripped Chrome Win10 UA. A /-tarpit looper at fleet scale.
• 93.123.109.247 — TLM-Audit-Scanner/2.0, 3 canary-farm-1 mints within one second (20:20 stored). The audit self-description is unverified, so it stays hostile-light.
• 74.0.42.13 — 3 mints across ai-devbox-1, canary-farm-1, control-1 (00:12–00:13 stored) under a forged Android 4.4 UCBrowser UA.
• 185.177.72.64 (Bucklog SARL FR /24) — 2 control-1 mints (01:36 stored) under an iPad Safari forgery; none of the BUCKLOG-KIT POST stages ran.
• Benign research class — 71.6.155.70 (8 sensors, 8 events, empty UA; Censys range). 45.198.224.125 (8 sensors, 63 events, forged Firefox/71) stays in the hostile-light class.

Standing actors (persistence check)

• REGISTRY-HUNT DigitalOcean pool — present every window on record. Use side active two windows running.
• 45.138.12.x (Tc Datacenter LT) — seventh window. The /24 re-ran its walks with 4 fresh mints.
• Techoff blocks (45.148.10.x NL, 195.178.110.x BG) — census and mint arms active. 45.148.10.120 leads fleet mints this window (9).
• 194.180.49.41 (MEVSPACE) — recurring light census arm, 5 sensors.
• 23.132.164.201 — 7 mints per 6-day history, 2 this window; 162.35.242.53 — 6 mints, 2 this window. Both idle-hoard candidates.

Absent or paused

XMLRPC-BRUTE (all three recent operators idle — 8.137.104.136, 180.93.254.108, 136.80.17.156), WP-XRPC-WALK (first missed window — neither cluster signature from №66–№67 reappeared), TechTies-KIT + JNDI-FIELD-INJECT (pile 1,088 per 6-day history, static; third idle window), SI-CENSUS 102.220.163.241 (second miss), METADATA-HUNT named runners, AI-EXEC-HUNT, CALC-ORACLE-KIT (152.236.14.113), 121.40.140.50 and 136.70.193.85 (lauterbourg-01-ts baseline heavyweights), VPN-CONF-HUNT, EXCHANGE-DICT, NIGHTAGENT, BUCKLOG-KIT POST stages, PATHSCAN-CENSUS, CF-FRONTED CREDSWEEP, OMEGA-SWEEP, CENSUS-284, ANDROXGH0ST-KIT, CRUSADER-SWEEP, KEYDROP-SCANS, 8.217.152.4, 140.245.97.208.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (3 use events across 2 credentials). Fleet sensors minted 45 credentials to 26 collector IPs; 2 credential(s) reached AWS. Use outcomes: 2 unknown, 1 success. 1 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 1088 mints, 2026-10-25 15:18 → 2026-10-27 21:29
• 102.220.163.241: 70 mints, 2026-10-25 09:28 → 2026-10-28 09:12
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 136.66.182.42: 41 mints, 2026-10-24 05:03 → 2026-10-24 05:03
• 34.95.21.228: 41 mints, 2026-10-28 18:17 → 2026-10-28 18:17
• 45.148.10.120: 12 mints, 2026-10-28 13:34 → 2026-10-31 04:23
• 46.151.178.15: 12 mints, 2026-10-25 17:05 → 2026-10-29 00:56
• 213.209.159.154: 10 mints, 2026-10-24 06:37 → 2026-10-27 11:08
• 176.123.5.6: 9 mints, 2026-10-29 02:21 → 2026-10-29 02:21
• 140.245.97.208: 8 mints, 2026-10-24 13:00 → 2026-10-28 00:54
• 23.132.164.201: 7 mints, 2026-10-28 17:55 → 2026-10-30 16:10
• 45.138.12.16: 7 mints, 2026-10-24 03:33 → 2026-10-30 18:07
• 162.35.242.53: 6 mints, 2026-10-29 15:00 → 2026-10-30 09:33
• 169.150.196.6: 6 mints, 2026-10-25 03:05 → 2026-10-25 03:29
• 195.178.110.22: 6 mints, 2026-10-24 06:41 → 2026-10-24 06:53
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 105.112.24.243: 5 mints, 2026-10-28 09:46 → 2026-10-28 10:41
• 147.182.149.75: 5 mints, 2026-10-24 04:32 → 2026-10-29 19:21
• 202.65.238.233: 5 mints, 2026-10-29 07:43 → 2026-10-29 07:48
• 206.81.24.74: 5 mints, 2026-10-25 21:04 → 2026-10-29 20:56
• 208.84.100.218: 5 mints, 2026-10-26 01:31 → 2026-10-26 03:41
• 217.60.76.167: 5 mints, 2026-10-24 07:47 → 2026-10-26 20:44
• 45.138.12.51: 5 mints, 2026-10-24 18:42 → 2026-10-30 08:25
• 157.245.113.227: 4 mints, 2026-10-24 19:57 → 2026-10-29 18:30
• 165.227.102.187: 4 mints, 2026-10-24 03:52 → 2026-10-27 03:24
• 193.32.248.165: 4 mints, 2026-10-29 22:37 → 2026-10-29 22:53
• 206.81.24.227: 4 mints, 2026-10-24 04:32 → 2026-10-29 21:05
• 45.138.12.6: 4 mints, 2026-10-28 16:49 → 2026-10-30 14:19
• 64.225.75.246: 4 mints, 2026-10-24 04:32 → 2026-10-29 18:29
• 64.23.218.208: 4 mints, 2026-10-25 21:41 → 2026-10-30 21:03
• 91.92.240.86: 4 mints, 2026-10-25 13:52 → 2026-10-25 21:58
• 91.92.41.32: 4 mints, 2026-10-24 14:15 → 2026-10-30 20:25
• 93.123.109.107: 4 mints, 2026-10-29 17:03 → 2026-10-29 22:21
• 130.12.180.77: 3 mints, 2026-10-27 06:26 → 2026-10-27 06:29
• 138.68.144.227: 3 mints, 2026-10-24 20:54 → 2026-10-28 21:10
• 143.110.217.244: 3 mints, 2026-10-26 21:51 → 2026-10-30 21:12
• 146.70.98.138: 3 mints, 2026-10-24 20:46 → 2026-10-25 20:51
• 157.230.19.140: 3 mints, 2026-10-24 21:01 → 2026-10-29 04:44
• 164.92.107.174: 3 mints, 2026-10-24 20:08 → 2026-10-29 19:17
• 185.177.72.29: 3 mints, 2026-10-28 19:50 → 2026-10-28 19:50
• 23.239.27.128: 3 mints, 2026-10-27 11:54 → 2026-10-27 17:27
• 46.101.1.225: 3 mints, 2026-10-24 04:32 → 2026-10-26 21:46
• 68.183.9.16: 3 mints, 2026-10-24 20:53 → 2026-10-29 21:08
• 74.0.42.13: 3 mints, 2026-10-31 00:12 → 2026-10-31 00:13
• 8.217.152.4: 3 mints, 2026-10-27 17:04 → 2026-10-28 07:36
• 87.192.41.180: 3 mints, 2026-10-30 15:51 → 2026-10-30 21:12
• 93.123.109.247: 3 mints, 2026-10-30 20:20 → 2026-10-30 20:20
• 93.152.209.6: 3 mints, 2026-10-24 19:57 → 2026-10-27 11:26

Network-layer recon (Arkime) — 2026-10-30 07:33:00 → 2026-10-31 07:34:00 UTC

Fingerprint field ssh.hassh, destination port 22 · 138,354 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 101,635, bahrain-sponge-01-ts 54,540, sensor:bahrain-sponge-01-ts 54,540, contabo-sponge-01-ts 21,573, sensor:contabo-sponge-01-ts 21,573, sensor:ru-vps-01-ts 14,975

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,590 sessions from 616 source IPs across 260 networks in 71 countries, port 22, avg 4,968 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS16276 OVH SAS, AS4766 Korea Telecom, AS31898 Oracle Corporation. Busiest sources: 141.94.121.165, 136.248.121.226, 45.169.200.254, 143.202.104.29, 112.219.151.50. Last 7 days: 10-25 579 IPs, 10-26 599 IPs, 10-27 653 IPs, 10-28 615 IPs, 10-29 657 IPs, 10-30 583 IPs, 10-31 214 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 29,778 sessions from 83 source IPs across 31 networks in 24 countries, port 22, avg 5,189 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS48090 Techoff Srv Limited, AS7552 Viettel Group. Busiest sources: 109.160.32.161, 109.160.32.165, 109.160.32.122, 77.239.124.147, 109.160.32.31. Last 7 days: 10-25 78 IPs, 10-26 38 IPs, 10-27 53 IPs, 10-28 48 IPs, 10-29 58 IPs, 10-30 83 IPs, 10-31 36 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: GO-SSH-SWEEP (0a07365cc01f…) crossed the dispersed threshold this window (83 source IPs across 31 networks, 29,778 sessions) and is now the top inbound fingerprint on 5 of 8 nodes (ru-edge-1, canary-farm-1, sponge-01-ts, lauterbourg-01-ts, frantech-ts). Its top networks include AS48090 Techoff Srv Limited, and its busiest sources sit in 109.160.32.x — the same addresses that run the uname/lspci discovery loops on the frantech-ts honeypot below, so the sweep infrastructure and the post-auth shell operators share hosts. GO-SPRAY-SWEEP collapsed 164 → 20 source IPs. GO-SCATTER-SWEEP shed 1,487 sessions day-over-day but still owns netcup-ts inbound. CTL-MASS-SSH (4e066189c3bb…) again owns control-1 (32,352 sessions of 54,540, +5,733 day-over-day). LIBSSH-MASSSWEEP holds its ~600-IP band (616). No new fingerprints; nothing to add to the registry or recon-names.tsv.

Fleet Observations

• Volume shift, explained. frantech-ts ran +65% above its 7-day baseline on the strength of one 91-second dictionary replay (14,154 of its 15,134 events). Every other node ran below baseline (ai-devbox-1 −64%, canary-farm-1 −82%, control-1 −66%, lauterbourg-01-ts −88%, netcup-ts −39%, ru-edge-1 −88%, sponge-01-ts −12%) because the №64–№66 mega-crawlers stayed idle and no replacement arrived on those nodes. Window overlap applies as always: events between digest runs appear in two digests.
• Canary economics. Digest issued rows: 48 mints (canary-farm-1 31 from 21 IPs, ai-devbox-1 7, control-1 7, ru-edge-1 3). Failures: 13×400 upstream rejections in pacing singles (ai-devbox-1 7, control-1 5, canary-farm-1 1) — no 401s, no key errors. The rejection share fell to 13 of 61 attempts (21%) from 25 of 85 (29%) last window. netcup-ts, sponge-01-ts, and frantech-ts mint 0 by design (certless); lauterbourg-01-ts ships TRACEBIT_API_KEY= empty, so its absence is config, not failure.
• Attribution/TLS posture. 1,864 requests carried X-Forwarded-For; multi-entry chains 0; XFF-ignored 0; single-entry forgery 2 — both from UA metabase-cve-2026-72898-detect/1.0 (benign detection probes only) on GET /api/session/properties: canary-farm-1 claimed source 120.23.123.198 over socket peer 165.227.3.36, ai-devbox-1 claimed 201.157.181.77 over peer 169.40.142.172. A scanner that announces benign intent and forges its source stays untrusted; the peer IPs are the only reliable attribution it offers. TLS ran http-led on every node this window; ai-devbox-1 measured 1,252 http vs 605 https (last cycle https led there). Top Host header: 209.141.62.110 15,127 (the replay), then sso.rightabouteverything.show 1,517.
• Control-1 discovery velocity. 48 days live. Most recent full day in the window (10-30): 1,959 events / 146 unique IPs. The 7-day band runs 892–16,293 events per day with unique IPs at 102–178 — the ramp is intact, and the network layer shows the node still draws the fleet's heaviest single-fingerprint SSH load (4e066189c3bb…, 32,352 sessions).
• First-seen caveats. All first-seen rows in this digest share one sync-batch timestamp (03:15 stored), so they are an inventory, not a timeline. The replay-path and config-path first-seens above are attributed by direct journey queries, not by the table's timestamps.
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 646 sources sent credentials → 496 got a shell (77%) → 432 ran a command (87% of shell-getters, 67% of sources). Event level: 11,764 credential attempts → 4,903 accepted logins → 15,257 commands (311% of accepted logins go on to run something). Telnet (commodity IoT botnets): 1,050 attempts.

New commands: zero. No command ran for the first time in this window (0 of 6,185 distinct) — a second consecutive quiet window after №67's 91-command QA probe from 92.118.39.50. New credential pairs: 0 of 4,417 offered. Concentration is unchanged and belongs to one family: 345gs5662d34/345gs5662d34 842 attempts plus root/3245gs5662d34 612 (1,454 combined), then commodity pairs.

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (1,918 + 1,916 events from 3 IPs, example source 109.160.32.161 — the same address that leads GO-SSH-SWEEP's source list above), the lspci | grep VGA/nvidia-smi -q GPU-discovery strings from 195.178.110.218 and siblings, and the chattr -ia .ssh + SSH-key-plant pair (375 and 337 sources) all held steady.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 73 endpoints on 21 hosts, 2429 command references and 602 download attempts since 2026-09-18T10:45
• served payloads: 20 distinct artifacts over HTTP 2xx from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128)
• this window: 2 endpoints first seen, 3 active; 29 endpoints seen in the last 7 days remain current
• inventory generated 2026-10-31T07:29:11Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

C2 read: two new dropper endpoints appeared under one host, 64.177.33.68 — :8000/ngrok_installer? and /cat.sh — and neither served content (0 HTTP 2xx), so the droppers fired but the staging host gave nothing this window. The standing LIBREDTAIL-range dropper https://217.60.102.5/sh stayed active (14 command events from 7 sources). No new served payloads: the 20 captured artifacts stand as last recorded.

Gaps / Next Collection

1. REGISTRY-HUNT use side. Pull Tracebit alerts at least daily for the 43 unused walker-held credentials. Establish whether the 165.227.84.14 SSH login attempt recurs and which account surface it targeted. Watch for AWS operations from the 20:57–21:21 l9scan mint wave and for a second outside-window use IP like 52.161.59.96.
2. WP-LOGIN-BRUTE width. The 200-pair alarm tripped on ai-devbox-1 (201 IPs × 1 POST). Next cycle: check canary-farm-1 and ru-edge-1 for the same one-shot spray, and capture whether any pair reaches a minting surface.
3. DOCKER-DIGEST-PULL. Watch for a second IP, token-endpoint probes, and repeated requested digests across windows — a fixed digest list would name the operator's target set. A registry-auth decoy remains a fleet-owner decision, not a briefing change.
4. WIDE-CONFIG-CENSUS. 50.19.185.106's mint is the check: watch the Tracebit pull for AWS use, and a second IP or node for promotion to standing.
5. MEGA-DICTIONARY operator set. Record replay from 135.136.19.27. Check for a repeat, the prior operators' return, and path-list overlap across the three operators to size the shared wordlist.
6. CLAUDE-CRED-HUNT pivot. Watch for /.claude* paths from 87.192.41.180 or a new operator — that decides rotation versus reassignment — and for AWS use of its 3 mints.
7. Metabase XFF forger. The two events forge their source. Pivot on socket peers 165.227.3.36 and 169.40.142.172 if the UA reappears, and treat any "benign" self-description from it as unverified.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-10-31.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-10-31.md