Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №48 — PLAIN LANGUAGE

Period: 2026-10-10 07:34 – 2026-10-11 07:34 UTC (24h, day 46 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-11.md

What happened (plain)

An old campaign came back with new tools. Five machines on Oracle Cloud — one per honeypot node, on five of our eight nodes — each pulled the same list of 239 files from our decoy servers within about a minute, using a tool that honestly names itself WebSiphon/next-0.1. Three of them picked up fake AWS credentials we plant for exactly this purpose.

For the first time in three days, someone tried to use those fake credentials. Two visitors tested the credentials they had just taken, from the same addresses they took them from. All three attempts were sts:GetCallerIdentity calls, which only reveals the account's identity. Our deny-all policy blocked nothing else because they tried nothing else.

A brand-new scanner appeared and hit seven of our eight nodes on its first day. It asks Confluence servers to identify themselves, and one operator, 87.120.204.145, sent 1,388 of those requests at our two EU nodes.

Also back: a git-repository scanner we last saw on 09-16 (briefing №23). It hit both EU nodes with 2,765 requests and walked away with 12 fake credentials — more than any git-scanner has ever taken here.

And the usual: the shared list of 13,502 malware download addresses got replayed at our frantech node (13 new addresses added), the two EU nodes ran 132% and 138% above their weekly average because of all this, and control-1 had a quiet day (down 52%).

What it means (plain)

  1. The Oracle Cloud scanner crowd is back, and its toolbox grew. Five Oracle-range IPs (146.235.16.170, 146.235.22.78, 161.118.198.110, 161.118.211.119 — all Oracle Corporation SG — plus 134.185.95.195) each swept one node in 37–66 seconds. The registered wordlist for this campaign was about 94 paths; today it was 239, and it now includes CI/CD files, cloud-credential stores, AI/LLM configs, and Oracle Cloud–specific paths like /oracle/oci_api_key.pem. They also stopped faking a Chrome browser and now use a tool that announces itself. (High confidence — the shape, pacing, and .env-census core match the registered ORACLE-SWEEP profile. One caveat: the sponge node only got a 64-path short pass, so there may be more than five machines in this crew.)
  2. The stolen-credential pipeline works again, and this time the thieves tested their own loot. Two alerts fired: 3 successful sts:GetCallerIdentity calls from 209.97.180.8 (which took its credential from ru-edge this same day) and 128.199.182.55 (which took one from canary-farm-1 on 10-08). Taking and testing from the same address is the pattern we saw in №44 from REGISTRY-HUNT runners. (High confidence for this window — Tracebit alerts are direct evidence. A use outside our pull window would look the same as no use, so the usual caveat applies.)
  3. A new Confluence-hunting campaign reached 7 nodes in one day. The request set (/rest/api/2/serverInfo and friends) reads back a Confluence server's version — that is fingerprinting before choosing an exploit. The lead operator, 87.120.204.145 (G-Core Labs), rotated 8 modern browser identities and also pulled an 8-level archive traversal into Confluence's plugin files. The Jira traversal REGISTRY-HUNT used in №47 went 5 levels deep; this one goes 8. (Moderate confidence — first day of sightings; we don't yet know how many operators are behind it.)
  4. The git-scanner template keeps picking up new operators, and the newest one steals at scale. 209.159.155.142 (Interserver, US) ran both EU nodes with 396 paths and 44 trap families each, in five stages under five different user identities — including git/2.39.0, a bare Mozilla/5.0, Firefox/109, node, and a first-seen git/2.47.3. It enumerated every git hook we fake and took 12 credentials (6 per node). (Moderate confidence — one window; a second one settles whether this is a fourth standing operator class.)

Campaigns (who / what / what it means)

ORACLE-SWEEP — cloud-config census, returned after 14 quiet windows

  • Who: 146.235.16.170 (control-1, 02:50 UTC), 161.118.211.119 (lauterbourg, 03:13), 134.185.95.195 (sponge, 03:16 — short 64-path pass, hosting unverified), 146.235.22.78 (canary-farm-1, 04:53), 161.118.198.110 (ru-edge, 06:10). One IP per node; no IP visited two nodes.
  • What they did: each ran WebSiphon/next-0.1, GET-only, and pulled 239 paths in 37–66 seconds: .env files and their variants, config bundles, CI/CD files (.gitlab-ci.yml, Jenkinsfile, GitHub workflow files, Azure/AWS pipeline configs), cloud credentials (.aws/credentials, Google/Azure/Oracle Cloud files, /oracle/oci_api_key.pem), infrastructure files (terraform, docker-compose, Kubernetes), and AI/LLM configs (/litellm_config.yaml, /.cursor/mcp.json, /.mcp.json, /flowise/.env, /dify/.env, and more). Three nodes handed over one fake credential each at /.env (control, farm, ru-edge). No POSTs.
  • What it means: they want cloud and AI credentials, and the Oracle-specific paths suggest they run on Oracle Cloud themselves and look for the files they know. Dropping the fake-browser disguise for an honest label mirrors what METADATA-HUNT did in №47 before it started trying to run code. The 3 canaries are in hostile hands until they expire or trip.

ATLASSIAN-REST-PROBE — Confluence version scanner, new today, fleet-wide

  • Who: lead operator 87.120.204.145 (G-Core Labs): 694 requests on each EU node (1,388 total, 331 paths per node), 8 modern browser identities, zero credentials taken, plus single-digit touches on the other six sensors. Two smaller runners with the same browser set — 45.207.159.88 (14 requests) and 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb (9 requests) — worked at 14:24, seven minutes before .145's EU pass at 14:31. Single touches also came from 172.234.162.31 (lauterbourg) and 139.162.33.108 (aidev). In total the digest ties 9 IPs across 7 sensors to this campaign (signature 9609f17ada17, 216 events).
  • What they did: asked for /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, and /status — the endpoints where a Confluence server states its version — then pulled an 8-level archive traversal like /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::META-INF/MANIFEST.MF, plus 19 companion paths that read build files (pom.properties, context.xml, spring.xml, log4j2.xml, and others). Everything was GET; no hostile request bodies were captured.
  • What it means: version numbers and build identifiers are what an attacker needs to pick the right Confluence exploit. Nothing was stolen yet — this looks like preparation. If a second operator or node shows up, the picture firms up.

GIT-VAULT — git-repository scanner, fourth operator class, now steals

  • Who: 209.159.155.142 (Interserver, US). It hit canary-farm-1 (1,400 requests, 01:40–02:13) and then ai-devbox-1 (1,365, 02:12–02:15). We last saw this IP on №23 (09-16), when it was a small one-node visitor.
  • What they did: 396 paths and 44 trap families per node, in stages: a git walk under git/2.39.0 (804 + 772 requests) that enumerated every fake git hook (pre-commit, post-commit, pre-push, post-checkout, post-merge, pre-rebase, post-update, pre-auto-gc — 1,310 fake-git-miss results); a config census under Firefox/109 (4 credentials taken per node) and a bare Mozilla/5.0 (32 SQL-dump paths, 16 backup-archive, 28 application-properties per pair of nodes); a node-identity leg (2 credentials per node); and a short git/2.47.3 stage (first-seen identity). Totals: 12 credentials, plus 60 env-file hits, 24 phpinfo, 24 webshell probes, and 20 wp-config hits.
  • What it means: the same walk shape keeps getting adopted by new hosting operators, and this one came with a credential-stealing stage the campaign never had before (earlier classes took 0–1 per window). The 12 canaries are hostile-held inventory.

REGISTRY-HUNT / LeakIX — the long-running scanner fleet, smaller wave, but it used what it took

  • Who: 11 runner IPs took one fake credential each — farm 5 (138.197.191.87, 165.227.39.235, 206.189.233.36, 209.38.208.202, 128.199.182.55†), aidev 3 (142.93.129.190, 165.227.173.41, 167.99.210.137), control 1 (157.245.36.108), ru-edge 2 (164.90.228.79, 209.97.180.8). All are DigitalOcean-class addresses († = a /24 neighbor of the mapped runner 128.199.182.152; the campaign link is unproven). The l9explore side-tool (45.138.12.51) dropped to a single touch on lauterbourg.
  • What they did: the same 27-step journey as always — tarpit, WebLogic console, Confluence, WHM/cPanel, then docker-registry enumeration — at 1 mint per IP. The deeper Jira traversal from №47 did not run this window.
  • What it means: the wave shrank from about 49 IPs to about 11, but two of its runners went straight to AWS and tested their own canaries. This campaign remains the funnel's main supplier.

CREDENTIAL-DRAIN — the take-and-use pipeline, first use window after two empty ones

  • Who: 30 collector addresses hold this window's 53 credentials. The users were the takers: 209.97.180.8 and 128.199.182.55.
  • What they did: 3 sts:GetCallerIdentity calls, all successful — that call only reveals the account's identity. No other calls were attempted, so nothing was denied.
  • What it means: 53 fresh credentials are in hostile hands, with zero mint failures this window (the first clean window since №45). Across the campaign's history, 11 of 13 use events were same-address take-and-test — the read stays: operators validating their own loot, not a resale market. The big hoards stand: 45.148.10.171 now holds 45 over 6 days (its 16th straight minting window, 8 this window), 34.124.231.201 holds 40, 209.159.155.142 took 12 today, 80.94.92.65 holds 21 (absent), 87.120.104.29 holds 12 (absent).

MEGA-DICTIONARY — the shared malware-address list, replay #15, still growing

  • Who: 23.234.118.20 (tzulo, inc., US, on the ipsum blocklist) at frantech — the third tzulo address in this campaign's ledger (after 23.234.119.20 in №23 and 23.234.117.146 in №34).
  • What they did: fired 13,502 requests for 13,502 distinct malware download paths in 54 seconds, GET-only, under 200+ router and IoT device identities (Tenda, TP-LINK, Xiaomi, MikroTik, UniFi, Synology, ZTE, Huawei HG532e, Roku, Chromecast/Dalvik, and more). Compared with №47's copy: 13 paths added, 0 removed (13,489 → 13,502 — the tenth straight growth). The new paths are a GitLab installer set — /mogh739/metrics-agents/-/raw/main/* and its /mogh739/static-assets/ twin (11 paths: agent-install.sh, agentd-linux-arm64, agentd-linux-x64, collector-legacy-linux-x64, collector-linux-arm64, collector-linux-x64) — plus /d/432936b3a0439572/o/nnnnnede/init.sh2 and /payload/1ay0eknhal4o/6lpiz8.sh.
  • What it means: one shared address list keeps passing between operator groups and keeps growing; the new GitLab paths name where today's droppers actually live. Our decoy server absorbed all 13,502 requests at zero cost.

GOWEB-PENTEST — the phpMyAdmin hammer, third window, third node

  • Who: 109.123.251.103 at lauterbourg. (Its /16 neighbors canary-farm-1's public IP — that is a hosting coincidence, not a link.) Earlier operators: 158.178.159.133 (Oracle NL, №46) and 167.86.124.4 (Contabo FR, №47).
  • What they did: 181 phpmyadmin-login GETs on one path in 1.1 seconds, no POSTs — same volume as every previous run, same self-described tool name Go Web Pentest Tool.
  • What it means: three windows, three operators, three nodes, three hosting companies, one commodity tool at ~181 requests per pass. It is exactly what it says it is, and it keeps showing up.

WP-FORM-BRUTE — slow WordPress password guessing, steady background

  • Who: the 75df0dbb0841 class from №47: 5 residential IPs, 30 events on the EU nodes (each IP: probe, 3 password POSTs, probe). The wider wp-login/xmlrpc background clusters ed66cc967251 (21 IPs, 84 events) and 2bdde2df2cf6 (6 IPs, 48) carried the rest, including farm's xmlrpc 3.1× spike (20 single-event POSTs from rotating addresses).
  • What they did / what it means: the same low-and-slow guessing as last window, no changes in targets or payloads. Background noise with a steady rhythm.

Watch list (single visitors we are tracking, not yet campaigns)

  • 172.234.162.31 (Akamai Connected Cloud, FR, blocklisted): lauterbourg, 239 events in a 21-second pass under an Android phone identity, 1 POST — Kiteworks decoy walk, Citrix probe, ColdFusion probe. Third Akamai-class scanner of this node (after 172.104.241.92 and 172.105.76.7) from a new address range.
  • 79.124.58.82 (Tamatiya, BG): frantech, 300 requests in one minute — owns the node's webshell-probe spike (34 vs a 7.2 average).
  • 185.177.72.75 (Bucklog, FR): frantech, 1,819 requests / 644 paths in 5 minutes under a 10-identity browser rotation that included the Mozlila/5.0 typo forgery, plus 4 POSTs (bodies not pulled this cycle). First visit of this address to frantech at this size.
  • 23.94.145.124: canary-farm-1, 11 form-profile probes under 3 identities — new, watching.
  • 206.209.210.3: new credential collector, 3 mints on canary-farm-1 across two straight days (10-10 and 10-11) — the first new collector to come back for seconds.
  • 129.213.151.234 (research-scan/1.0, Oracle — a borderline "honest scanner" in our registry): returned, took 4 backup-archive looks on farm and 1 credential. Honest-labeled tools that take credentials stay on the report list.

Who kept coming back (standing actors)

  • 45.148.10.171 — 16th straight window with mints (8 this window: aidev 4, farm 2, control 2). Holds 45 credentials over 6 days. Still has never used one in AWS.
  • The Feo Prest pair (213.209.159.154 and .175) — both ran control's backup-file census (20 requests each, one under a Chrome/4.0 identity, one under MSIE/4.01 Windows CE). .154 also hit netcup (326 paths in 6 seconds) and took 2 credentials on control. Together: 4 credentials over 6 days.
  • 80.94.95.211 (SS-Net) — back on aidev after two misses: 20 backup-archive requests under an old Android Chrome identity, plus 2 mints (8 over 6 days).
  • REGISTRY-HUNT repeat minters — 142.93.129.190, 165.227.173.41, 167.99.210.137, 206.81.24.227, 209.38.208.202, 138.197.191.87 have each minted in 2+ windows.
  • The tarpit pools — 3e1c5eb879e7 (80 IPs, 559 events, 7 sensors), 4b4cc0ece037 (23 IPs, 161 events, 4 sensors), and the php-cgi probe cluster 7e61a9500d8b (5 IPs, 245 events, 4 sensors) — these own frantech's tarpit 5.3× spike (1,414).
  • 204.76.203.18 (Pfcloud, NL) — its malware-list loop on control-1 continues (413 events).
  • Gone quiet this window: METADATA-HUNT (its №47 runner stayed home; today's digest shows that old pass again only because of the 4-hour clock skew in our ingest — 40 credentials still held), CONFIG-SWEEP (first miss in six windows), NIGHTAGENT, EMPERORS-KIT, KEYHUNT (each third absence), SI-CENSUS (fourth idle), OMEGA-SWEEP (eighth miss), ENVRC-SWEEP, the Cloudflare-fronted census (eighth), the dedicated Kiteworks crawlers (fourth), LEAKIX-SSH at the network layer, and SS-Net's sibling 80.94.92.65 (second miss).

Network sweeps (Arkime) — the traffic that never knocks on a web door

Our pcap sensors see connection attempts that never request a web page, so the web traps never record them. This window: 110,019 inbound SSH sessions against our 8 public addresses.

The two big sweeps both stayed:

  • LIBSSH-MASSSWEEP (fingerprint f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 5,568 sessions from 309 source IPs across 144 networks in 55 countries. Day 22 of daily sightings (daily IP counts: 10-05 360, 10-06 297, 10-07 350, 10-08 309, 10-09 317, 10-10 344, 10-11 91).
  • GO-SSH-SWEEP (fingerprint 0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 28,758 sessions (+4,466) from 120 IPs (+36) across 49 networks in 30 countries. Its busiest addresses (109.160.32.x, 77.239.124.x) are the same ones whose "uname" hardware survey ran on the frantech shell honeypot this window — the sweep and the shell work are one operation (daily IP counts: 10-05 112, 10-06 98, 10-07 100, 10-08 66, 10-09 88, 10-10 116, 10-11 35).

Quieter regulars: 16443846184e… 6,286 sessions from 28 IPs; 03a80b21afa8… 549 from 28; 084386fa7ae5… 83 from 58; dd9bcf093c35… 32 from 29 (one network); acaa53e0a7d7… 25 from 25.

Two to watch:

  • 4e066189c3bb… hit control-1 with 18,151 sessions (+5,152) from 22 IPs. It has now appeared 15 days straight, is still unnamed, and sits under our 50-IP threshold for calling a sweep "dispersed."
  • 98f63c4d9c87… was the day's biggest mover: 5,007 sessions (+4,653) from 17 IPs, making it ai-devbox-1's top fingerprint today (12 days on record, once peaked at 97 IPs).

control-1 took the most inbound traffic again (36,464 sessions from 225 sources); frantech took 22,274 from 2,801 sources. No new fingerprints appeared, so the network-layer name list is unchanged.

Canaries (minted and used) — fake credentials: who took them, who used them

Canaries are fake AWS credentials. "Minted" means a honeypot handed one to a visitor. "Used" means someone tried it against AWS and Tracebit saw it. This window: 53 credentials went to 30 collector addresses; 2 were used, with 3 successful calls — all sts:GetCallerIdentity, which only reveals the account's identity. Nothing beyond identity was attempted, and minting had zero failures (first clean window since №45).

Who took what (address — node — mints this window — used? — 6-day history):

  • 209.159.155.142 — ai-devbox-1 — 6 — no — 12 since 2026-10-11 01:40
  • 209.159.155.142 — canary-farm-1 — 6 — no — 12 since 2026-10-11 01:40
  • 45.148.10.171 — ai-devbox-1 — 4 — no — 45 since 2026-10-04 07:23
  • 206.209.210.3 — canary-farm-1 — 3 — no — 3 since 2026-10-10 08:02
  • 213.209.159.154 — control-1 — 2 — no — 6 since 2026-10-04 18:15
  • 213.209.159.175 — control-1 — 2 — no — 6 since 2026-10-04 07:45
  • 45.148.10.171 — canary-farm-1 — 2 — no — 45 since 2026-10-04 07:23
  • 45.148.10.171 — control-1 — 2 — no — 45 since 2026-10-04 07:23
  • 80.94.95.211 — ai-devbox-1 — 2 — no — 8 since 2026-10-05 08:47
  • 109.205.176.10 — ru-edge-1 — 1 — no — 6 since 2026-10-04 19:28
  • 128.199.182.55 — canary-farm-1 — 1 — yes, 1 use IP, GetCallerIdentity — 4 since 2026-10-08 20:14
  • 129.213.151.234 — canary-farm-1 — 1 — no — 1 since 2026-10-11 06:49
  • 138.197.191.87 — canary-farm-1 — 1 — no — 2 since 2026-10-04 20:03
  • 142.93.129.190 — ai-devbox-1 — 1 — no — 1 since 2026-10-10 20:44
  • 146.235.16.170 — control-1 — 1 — no — 1 since 2026-10-10 22:50
  • 146.235.22.78 — canary-farm-1 — 1 — no — 1 since 2026-10-11 04:53
  • 157.245.36.108 — control-1 — 1 — no — 2 since 2026-10-09 20:02
  • 161.118.198.110 — ru-edge-1 — 1 — no — 1 since 2026-10-11 06:10
  • 164.90.228.79 — ru-edge-1 — 1 — no — 1 since 2026-10-10 20:05
  • 165.227.173.41 — ai-devbox-1 — 1 — no — 2 since 2026-10-04 20:28
  • 165.227.39.235 — canary-farm-1 — 1 — no — 1 since 2026-10-10 20:00
  • 167.172.232.142 — control-1 — 1 — no — 1 since 2026-10-10 19:58
  • 167.99.210.137 — ai-devbox-1 — 1 — no — 4 since 2026-10-07 20:25
  • 172.93.215.8 — canary-farm-1 — 1 — no — 3 since 2026-10-05 08:29
  • 178.128.0.112 — ai-devbox-1 — 1 — no — 1 since 2026-10-10 23:36
  • 178.128.207.138 — canary-farm-1 — 1 — no — 3 since 2026-10-06 20:09
  • 206.189.233.36 — canary-farm-1 — 1 — no — 2 since 2026-10-09 23:12
  • 206.81.24.227 — ai-devbox-1 — 1 — no — 3 since 2026-10-05 20:27
  • 209.38.208.202 — canary-farm-1 — 1 — no — 3 since 2026-10-08 19:33
  • 209.97.180.8 — ru-edge-1 — 1 — yes, 1 use IP, GetCallerIdentity — 3 since 2026-10-04 20:03
  • 45.138.12.51 — ai-devbox-1 — 1 — no — 4 since 2026-10-04 04:20
  • 45.43.62.50 — canary-farm-1 — 1 — no — 1 since 2026-10-11 06:24
  • 64.89.163.14 — control-1 — 1 — no — 2 since 2026-10-05 11:36

The digest counted 96 mint rows (farm 64 from 15 addresses, aidev 18 from 9, control 10 from 7, ru-edge 4 from 4); after Tracebit's de-duplication that is 53 credentials to 30 collectors. Both users were also takers — the same pattern as 11 of the 13 use events in this campaign's history. The hoards that just sit: 45.148.10.171 (45/6d), 34.124.231.201 (40, from №47), 209.159.155.142 (12, new), 80.94.92.65 (21, absent), 87.120.104.29 (12, absent).

How the fleet behaved — health, attribution, and volume

  • Canary economics: 96 mint rows / 53 credentials / 2 used. Zero mint failures — №46 had 11 and №47 had 17. The fleet's all-time mint counter passed 2,000 (2,001 issued rows).
  • Identity checks: the header-forgery counter fired for the first time in six windows: 4 requests claimed a forwarding address (X-Forwarded-For: 1.2.3.4) that doesn't match where the connection really came from. All 4 came from 162.243.83.227 — a known, shallow "HTTP method fingerprint" prober already in our registry — hitting control-1 and ai-devbox-1 twice each. The counter did its job: the real source address was captured on every row. This is noise from a known prober, not a laundering campaign. Multi-entry forged chains: 0. Host-header counts stay led by bare IP addresses on all 8 nodes.
  • control-1's discovery ramp: day 28 — 1,641 events from 111 unique IPs, inside the 84–157 band for the 20th straight window. The event count is the quietest in that band; new-address discovery is unaffected.
  • Volume moves with known causes: farm +132% and aidev +138% (ORACLE-SWEEP, the git scanner, the REGISTRY-HUNT wave, and .145's Confluence hammer); lauterbourg +50% (the phpMyAdmin hammer, WebSiphon, the Akamai scanner); frantech +14% (the dictionary replay and tarpit pools); control-1 −52%, netcup −43%, ru-edge −44%, sponge −60% (last window's big censuses aged out — quiet floors on the deception nodes).
  • Every alarm has an owner: all nine ≥3× result-tag spikes trace to named actors — the git scanner (fake-git, not-handled, backup-archive), WebSiphon (config-json, env-production), Feo Prest (control backup-archive), the tarpit pools (frantech tarpit-module), Tamatiya (webshell-probe), GOWEB-PENTEST (phpmyadmin-login 42×), and scattered single POSTs (xmlrpc).
  • Known quirks, no new ones: the 4-hour ingest clock skew re-showed №47's METADATA-HUNT pass in today's tables — it did not run again. First-seen timestamps again cluster at the 03:15/03:16 sync minutes (they are arrival times, not sighting times). The ai-devbox-1 rotated-file gap entered its tenth cycle. No fleet code changed this cycle; the visuals dashboard and its campaign chart got today's campaign updates.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is our fake Linux shell box. Of 541 addresses that tried passwords, 404 got a shell (75%) and 328 went on to type commands (81% of shell-getters). In events: 21,864 password attempts → 3,940 accepted logins → 5,899 commands. Telnet botnets: 866 attempts (up from 730).

No new commands for the 21st straight window (0 of 56 distinct). The regulars: the Go-sweep crew's hardware survey ran again (uname -m | awk '{printf $1}' and uname -s -v -n -r -m, 1,335 events each from 8 addresses, example 109.160.32.169 — the same crew Arkime flags as the sweep's busiest sources); the SSH-key replacement pair stays dominant (994 events from 227 addresses, and the key-swap chain at 858 from 204); the SS-Net crowd showed up at the shell too (80.94.92.55's PATH-setup loop, 146 events, 6 addresses); and the Techoff host 62.171.133.1 kept surveying (95 events).

Passwords: 14,430 distinct pairs tried, 0 new. The same two fixed pairs lead again — 345gs5662d34 (942 tries) and root/3245gs5662d34 (715). No new pairs to report.

Open questions

  1. Will the Confluence scanner move from asking versions to trying exploits? The 8-level archive traversal already reads build files. A second operator address or node would confirm the crew's size.
  2. Will the Oracle Cloud wave's 3 canaries — or any of the 53 credentials taken this window — show up in AWS? And does the sponge node's 64-path short pass grow into the full 239-path census? One more window tells us how many machines are really in this crew.
  3. Will the two self-testing collectors (209.97.180.8, 128.199.182.55) go further than GetCallerIdentity? Escalating to denied enumeration, as the №44 runners did, would be the finding.
  4. Is the git scanner's new crew here to stay? A second window confirms the fourth operator class, and shows whether git/2.47.3 replaces git/2.39.0 as the main stage.
  5. What is 4e066189c3bb…? 18,151 sessions against control-1, growing +5,152 per day, 15 days on record, still unnamed — it stays under our 50-address threshold for "dispersed sweep," so we keep watching rather than naming.
  6. What did Bucklog .75's 4 POST requests contain? The census arm has only ever sent GETs. We will pull the request bodies next time it appears.
  7. When do we fix the ai-devbox-1 log rotation? Its older log file (268 MB) still sits outside the pipeline, tenth cycle running.
  8. When will the shell box see a new command again? Twenty-one windows without one; the same two fixed password pairs still own the attempt counts. A new command is our only window into what attackers do after a shell.

Plain language version of: flux-fleet-intel-briefing-2026-10-11.md