Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №50 — PLAIN LANGUAGE

Period: 2026-10-12 07:33 – 2026-10-13 07:33 UTC (24h, day 48 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-13.md

What happened (plain)

Attackers picked up 80 of our planted credentials in this window and actually tried 5 of them in Amazon Web Services — 28 calls in one day, the busiest use day this pipeline has recorded. The sharpest part: two computers at the hosting company Contabo, one on a normal IPv4 address (169.58.180.111) and one on IPv6 (2a02:c207:2350:9697::1), started collecting our planted keys at the same minute (08:22 EDT on 10-12), then tested their own stolen keys against AWS. A fifth key was used from 131.193.125.163, an address owned by the University of Illinois at Chicago — that address never touched our traps, so we do not know how the key reached it. The Oracle-based scanning crew ORACLE-SWEEP returned for a third straight window with fresh addresses and a shopping list that grew by roughly 60%. Two bait nodes got much busier, but the cause is harmless: a research crawler from Ruhr-Universität Bochum that names itself honestly in its user-agent. The shared malware menu MEGA-DICTIONARY replayed for the seventeenth time and grew by 19 paths to 13,554.

What it means (plain)

  1. Credential thieves now split into two groups: hoarders and same-day users. The Contabo pair collected 20 planted keys and tested 4 of them right away from one address each, using AWS calls that list EC2 instances, regions, and quotas (the calls succeeded only for identity checks; the rest were denied by our policy). This is the first time an IPv6 address appears anywhere in the mint-to-use funnel. (High confidence — the Tracebit alert logs tie each use to its exact credential, and the two collectors started minting at the same minute with the same call patterns.)
  2. ORACLE-SWEEP runs on a schedule and maintains its tool. Third window in a row, a completely fresh set of Oracle Singapore addresses each time, one fast pass per sensor, same honest WebSiphon/next-0.1 label — and the list grew from 239 paths to 235–384, adding Kubernetes, Terraform, Firebase, and AI-config files. (High confidence — the pacing, the user-agent, and the result mix match the two earlier windows exactly.)
  3. This cycle's biggest traffic jumps were friendly research, not attack pressure. Two Ruhr-Universität Bochum hosts labeled Software Security Research/1.0 produced 2,425 of sponge-01-ts's 3,324 events and 2,092 of netcup-ts's 3,676 — all aimed at / and language pages, all soaked up by tarpits, zero credentials taken. (High confidence — honest self-identifying user-agents, only 10–14 paths each, no POSTs, no mints.)
  4. SI-CENSUS came back and restocked the largest single-block hoard we track. Address 102.220.161.139 returned after five quiet windows, ran its census on 4 sensors (1,518 events), and minted 6 new keys — on top of the 27 it already holds from ru-edge. That is 33 held keys from one network block, with no observed AWS use so far. (Moderate confidence — the mints and census are observed; the block has gone quiet twice before, and use is still unseen.)

Campaigns (who / what / what it means)

CREDENTIAL-DRAIN — thieves testing our planted keys in AWS (record use window)

  • Who: 80 keys went to 32 collector addresses. The users: 169.58.180.111 (Contabo, France) held 2 used keys, 2a02:c207:2350:9697::1 (Contabo, IPv6) held 2, and 131.193.125.163 (University of Illinois at Chicago) held 1.
  • What they did: 28 AWS calls — 6 identity checks (sts:GetCallerIdentity) succeeded; 22 calls were denied: GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2. Both Contabo addresses began minting at 08:22 EDT 10-12 across ai-devbox-1 and canary-farm-1 (9 + 11 keys) and each tested 2 of its own keys from 1 address. The IPv6 key also tried ListBuckets. Nothing beyond identity checks succeeded. No mint failures for the third window running.
  • What it means: the funnel now shows three behaviors — use-your-own-key (Contabo, and LeakIX runners before), hand the key to someone else (the 4-egress Bucklog key from №49), and one unexplained single use (the university address). The 75 unused keys stay stolen property until they expire. Standing hoards: 45.148.10.171 holds 45 keys over 6 days (18th minting window), 34.124.231.201 40, 102.220.161.102 27, 80.94.92.65 15, 208.84.100.218 10.

ORACLE-SWEEP — fast, tidy config theft from Oracle Singapore addresses (third window)

  • Who: 168.107.90.53 on control-1 (235 events / 235 paths in 107 s, 09:48 EDT, 1 key taken), 161.118.208.28 on lauterbourg-01-ts (320 / 320, 15:46 EDT), 161.118.206.143 on canary-farm-1 (384 events / 384 paths / 84 file families in 86 s, 18:50 EDT, 1 key taken). All fresh addresses, all Oracle Singapore, no overlap with the two earlier rosters.
  • What they did: one GET-only sweep per sensor under the honest WebSiphon/next-0.1 label. New file families this time: k8s-secret-manifest, kubeconfig, terraform-tfstate/terraform-tfvars, firebase-json, litellm-config, openai-config-flat, doctl-config, streamlit-secrets, vercel-json, aws-amplify-exports, plus SSH private-key and authorized-keys probes. The walk pattern stayed the same: tarpit and robots files, sitemap, then the .env ladder ending at a real /.env hit.
  • What it means: three windows, three rosters, one kept-up-to-date tool — the schedule read from №49 holds. The list now reaches for infrastructure-as-code state, Kubernetes secrets, and AI stacks. The 2 new keys bring the campaign's stolen total to 5 across two windows; none used yet.

REGISTRY-HUNT / LeakIX — a public leak-scanning service, widest spread since №46

GOWEB-PENTEST — one shared phpMyAdmin hammer, rented addresses (windows seven to nine)

  • Who: 103.242.78.199 (Universitas Muhammadiyah Jember, Indonesia) on canary-farm-1 — 151 GETs on 1 path in 39 s (09:32 EDT); 188.166.218.48 (DigitalOcean Singapore) on control-1 — 151 / 1 in 22 s (13:54 EDT); 172.104.173.62 (Linode, Akamai Connected Cloud Singapore) on lauterbourg-01-ts — 151 / 1 in 49 s (04:52 EDT). All three nodes were first-time targets.
  • What they did: the same self-labeled Go Web Pentest Tool, hammering one phpMyAdmin login path, GET requests only, no POSTs, no keys taken.
  • What it means: nine windows, nine operators, nine nodes, nine networks. It is a shared tool run from rented addresses, and our phpMyAdmin decoys are on its target list. We still have never captured a credential body from it, so intent stays at login-surface probing.

MEGA-DICTIONARY — a shared list of 13,554 malware download paths, replayed again

  • Who: 23.234.118.20 (tzulo, Inc., US) on frantech-ts — the tzulo network's third replay host (№23 used 23.234.119.20, №34 used 23.234.117.146).
  • What they did: 13,554 requests / 13,554 distinct paths in 54 seconds (23:56:24–23:57:18 EDT), GET-only, no side probes, under 200+ router and IoT device names (Tenda, TP-Link, D-Link, Wavlink, Synology, MikroTik, Ubiquiti, Huawei, Xiaomi, Phicomm, Ruijie, FAST, Mercury, WD My Cloud, plus Python-requests and OkHttp). Compared with №49's copy: 19 paths added, 1 dropped (13,536 → 13,554 as measured). New: /bins/dvr/akuma_* in 13 builds and /bins/telnet/akuma_x64 (the akuma malware grows), /armv7-l7 and /x64s-l7 (L7-filter names), /enroll.sh, /nezha-agent, /in, /ront. No keys taken.
  • What it means: the shared list keeps growing and keeps naming current malware families. Our decoy server absorbed all 13,554 requests for free.

SI-CENSUS — one network block doing census, git walking, and key collection

  • Who: 102.220.161.139 (VPS Dedicated LLC, Slovenia) on 4 sensors — control-1 845 events / 41 families / 559 paths, ai-devbox-1 348, ru-edge-1 321, canary-farm-1 lightly; 09:24–09:59 EDT; 1,518 events total.
  • What they did: the registered recipe — .env directory fanout, a fake-git walk (264+ fake-git hits on control), config-file checks, and a set of about 10 user-agents that now includes forged ClaudeBot, GPTBot, and Googlebot labels alongside Chrome 125/126 and Firefox 127. 6 keys minted: control-1 3, ru-edge-1 2, ai-devbox-1 1.
  • What it means: the block's own promotion rule ("any census or mint run") is met twice. The /24 now holds 33 of our keys (27 ru-edge keys from №44 plus these 6) — the largest single-block hoard we track — with no AWS use seen.

INFOCREST-KIT — a well-traveled attack kit, seventh operator, first keys taken

  • Who: 173.249.253.116 (tzulo, Inc., US) on lauterbourg-01-ts, ai-devbox-1, and canary-farm-1 — 765 events, 30 POSTs, 23:05–00:04 EDT; 6 keys minted (ai-devbox-1 3, canary-farm-1 3).
  • What they did: the registered composite anatomy — tarpit cycling → 60 phpMyAdmin login hits → adminer login POSTs as user prod_rw with a fresh 22-character password each time (y6BURr5uveZT_CgBSbVP7w, t60rl7Ls-JPLsVBDfD1S3Q; body verbatim: auth%5Bdriver%5D=server&auth%5Bserver%5D=&auth%5Busername%5D=prod_rw&auth%5Bpassword%5D=…&auth%5Bdb%5D=) → 120 config-bundle checks → wp-batch multiplex requests (207 responses nesting {"requests": [{"method": "POST", "path": "///"}, {"method": "POST", "path": "/wp/v2/posts", …) plus 30 Tomcat ..;/ path-bypass probes. New this run: 6 form logins with user=root&pass=wrong (NightAgent's login body) and kiteworks-vhost legs on lauterbourg. No phpunit check or dropper download was captured.
  • What it means: a seventh operator runs this kit on three nodes at once, takes the kit's largest key haul so far, and the same tzulo network hosted two different campaigns in one window (this and MEGA-DICT). Watch those 6 keys for AWS use.

MEVSPACE-GITWALK — git-history hunting returns with a longer wordlist

  • Who: 159.223.234.149 (DigitalOcean, Netherlands) on ru-edge-1 — 143 fake-git hits in 2.5 s (17:48 EDT); 178.62.42.21 (DigitalOcean, UK) on control-1 — 143 in 3 s (00:56 EDT 10-13). Third and fourth operators under this template, both new.
  • What they did: the old stale Firefox/78 user-agent, now walking git refs named after environments — first-seen paths this window: /.git/refs/heads/{stg,sandbox,nightly,stage,demo,canary}, /.git/refs/remotes/origin/{stable,beta}, /.git/logs/refs/heads/{stage,demo,bugfix}, /.git/logs/refs/remotes/origin/testing. No keys taken.
  • What it means: the fake-git spikes (ru-edge 20.3× its average, control 5.7×; the miss tags 41.5× and 16.6×) belong entirely to this pair plus SI-CENSUS's walk. The wordlist keeps drifting, and our fake git server keeps feeding it.

LIBREDTAIL-KIT — code-execution hunters, densest day on one node

  • Who: six fresh addresses, every run on ai-devbox-1, 37 events each: 103.183.69.112 (08:40 EDT), 107.150.123.48 (14:39), 104.234.186.154 (20:11), 107.173.53.218 (22:27), 124.158.13.141 (23:38 — this one also hit frantech-ts), 103.79.184.145 (02:18 EDT 10-13).
  • What they did: the honest libredtail-http label, phpunit eval-stdin probes, and command-injection stages on three runs. No download stage seen — no POST bodies captured. No keys taken. This kit caused ai-devbox-1's whole phpunit-eval-stdin spike (226 events, 4.4×).
  • What it means: the kit that wants code execution, not credentials, concentrated six passes on our AI/dev node in one window. The fake webshells and tarpits held. The download stage remains the thing we have never seen.

CONFIGBUNDLE-SWARM — config-file census, new operator, biggest key haul

  • Who: 167.99.79.44 (DigitalOcean Singapore) under a forged Chrome/81, on control-1, ru-edge-1, canary-farm-1, and ai-devbox-1 — 137 events / 20 paths in 19 minutes (17:35–17:55 EDT).
  • What they did: the registered 20-path webapp-config-bundle-js census plus 7 /.env key mints (canary-farm-1 3, ai-devbox-1 2, control-1 1, ru-edge-1 1) — the swarm's largest single-address haul, against 1–3 per address in earlier classes.
  • What it means: a third operator block joins (after 45.154.138.x and Linode 45.79.200.28) and the mint rate jumped. The 7 keys are stolen inventory; check the 6-day window before claiming any were never used.

EMPERORS-KIT — the original operator is back after four quiet windows

  • Who: 150.241.66.127 (Kyonix Networks, US) on control-1 (22 phpMyAdmin login hits, 04:24–05:47 EDT) and canary-farm-1 (22, 04:00–04:16), under a forged Chrome/91.
  • What they did: login-surface pressure only; no keys taken; the kit's phpunit check and its GitHub download step did not reappear.
  • What it means: the operator is alive and back on cadence. The execution steps stay the watch item.

BUCKLOG-KIT — census arm reaches frantech, a sibling takes a key

  • Who: 185.177.72.75 (Bucklog SARL, France) on frantech-ts — 999 events / 264 paths / 5 families in 6 minutes (21:35 EDT), the arm's first run on this node, 15 POSTs; sibling 185.177.72.49 minted 1 key on control-1 (19:06 EDT).
  • What they did: 11 modern user-agents (Chrome 131 on four platforms, Firefox 134, Safari 18.2, Edge 131, iPhone 18.2, Android 14) — including the CREDSWEEP Mozlila/5.0 (…Bulid/NRD90M…Moblie…) typo forgery (79 events). The /24 now carries that typo too.
  • What it means: the block keeps spreading (.64's 4-address key use in №49, .49's key, .75's census). The shared typo user-agent points to shared tooling, not yet proven shared operators.

CREDSWEEP — the standing census crew; a first key for .238

  • Who: 45.148.10.238 (Techoff Srv Limited, Netherlands, blocklisted) — second window in a row: netcup-ts 902 events / 355 paths / 14 POSTs (19:30 EDT) plus control-1 370 / 169 / 16 POSTs, and its first recorded key on control-1 at 04:39 EDT. 45.148.10.5 touched sponge-01-ts and frantech-ts (112 events, new nodes for it, no keys).
  • What they did: the standing .env-variant census with the Mozlila typo forgery intact. 45.148.10.171 ran its 18th straight minting window — 6 key rows across 4 sensors, 45 keys over 6 days, zero use.
  • What it means: the census-to-key conversion finally happened for .238, and .171 stays the fleet's longest-running collector.

WP-FORM-BRUTE — background WordPress login guessing (eleventh window)

  • Who / what: the ed66 leg — 18 addresses / 72 events (farm + aidev); the df15 leg — 3 addresses / 168 events on farm, netcup, and ru-edge (netcup and ru-edge are new nodes for df15). Same probe → password POST → probe shape, below the 200-pair growth alarm.
  • What it means: the roster rotates again; background noise for now.

KITEWORKS-CRAWL — the Kiteworks decoy keeps drawing the same three crowds

  • Who / what: 104.199.36.53 (Google Cloud) ran the crawl on lauterbourg's kiteworks vhost — 117 events under the bare stripped-Chrome label plus 25 under Chrome/128. REGISTRY-HUNT's three l9scan legs rode the same vhost. The Tc Datacenter and AWS classes sat out.
  • What it means: the decoy now has three recurring operator classes (Google, AWS, Tc Datacenter LT) at zero cost to us. Credential paths or a mint would promote it.

Watch-class singles (no campaign yet)

  • Friendly research: the Ruhr-Universität Bochum softsec crawler — 185.73.23.161 (finn) and 185.73.23.162 (goose), user-agent Software Security Research/1.0 with finn.softsec.ruhr-uni-bochum.de / goose.softsec.ruhr-uni-bochum.de links: 4,517 events on netcup-ts + sponge-01-ts over 14 hours, / plus language pages (/en/, /de/home.html, /it/, /pl), 10–14 paths, 0 POSTs, 0 keys. It caused the sponge and netcup volume jumps. One more window puts it on the benign list.
  • 64.89.161.172 (Netiface LLC, Luxembourg): new user-agent Mozilla/5.0 vpnfinder, ai-devbox-1 / only, tarpit answers. Register on a second run.
  • First-time key collectors: 180.93.238.65 (Saigon Postel, Vietnam — ru-edge 02:14 EDT), 77.90.185.125 (Limited Network LTD, Germany — an AS213790 network inside GO-SSH-SWEEP's set — control-1 22:18 EDT), 185.93.89.112 (canary-farm-1 19:33 EDT).
  • 206.209.210.3 — fourth minting window in a row (2 keys on farm, 7 over 6 days, 6 nodes): still the only collector that keeps returning past three windows. 208.84.100.218 — 5 key rows over 4 sensors, 10 over 6 days.
  • 204.76.203.18 (Pfcloud, Netherlands) — the MALWARE-DICT loop, day 21+ on control-1, 2,141 events / 579 paths; sibling .219 touched all 8 sensors (27 events).
  • TOKEN-CRAWLER pool — 45.198.224.124 and .125 touched all 8 sensors again (~85 events each), same /24 rotation, no keys.
  • Tarpit pools — 3e1c5eb879e7 94 addresses / 649 events fleet-wide; 218630667b2c 9 addresses / 378 events on 5 sensors.
  • Friendly fixed-cadence probers — 89.248.172.33 (324 events, 7 sensors), 80.82.77.202 (315, 7 sensors), 93.174.93.12, 3.129.187.38, 18.116.101.220, 54.211.5.80 (getdomaindata/1.0 on lauterbourg): same shapes as before.

Absent or paused

AKAMAI-VHOST-SCAN (first absence — 172.234.162.31 out; the kiteworks vhost carried REGISTRY-HUNT legs instead), ATLASSIAN-REST-PROBE (second), METADATA-HUNT (third), CONFIG-SWEEP (third), NIGHTAGENT (fifth), KEYHUNT (fifth), OMEGA-SWEEP /46 census (tenth — and its pool stayed quiet too), CF-FRONTED CREDSWEEP (tenth), ENVRC-SWEEP, GIT-VAULT (second), LEAKIX-SSH (the network-layer fingerprint had 0 sessions), SS-Net .211 and sibling .92.65, ZKILLU-GITWALK, LLM-ENDPOINT-PROBE, EMPERORS-KIT's GitHub download step, 185.177.72.64 (№49's multi-address user), 31.56.53.82 (Snowcore dev-repo census).

Standing actors (who keeps coming back)

  • 45.148.10.171 — eighteenth straight minting window, 6 key rows over 4 sensors, 45 keys over 6 days, still no AWS use. Our longest-running collector.
  • 204.76.203.18 (Pfcloud) — the MALWARE-DICT loop, day 21+ on control-1, 2,141 events this window; sibling .219 probed all 8 sensors.
  • 206.209.210.3 — fourth straight minting window (2 keys, 7/6d): the only collector that repeats past three.
  • 45.148.10.238 — second window in a row, and it turned a census into its first key.
  • REGISTRY-HUNT repeat minters — 147.182.200.94 (3/6d), 139.59.231.238 (5/6d), 167.99.182.39 (3/6d), 157.245.105.107 (3/6d), 159.89.12.166 (3/6d), 64.227.70.2 (4/6d), 167.71.81.114 (6/6d): a steady collector base behind the rotating addresses.
  • TOKEN-CRAWLER /24 and the tarpit pools — constant background; TOKEN-CRAWLER touched all 8 sensors again.

Network sweeps (Arkime) — port 22 sweeps that never touch the web traps

These are SSH connection patterns seen by the fleet's own traffic sensors. They request no web page, so the web traps never see them. We track them by the client's SSH fingerprint, never by source address, because the addresses rotate and the tool stays.

  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 27,067 sessions — its highest count on record (+5,429) — but from its narrowest set yet: 72 addresses (down from 97) across 20 networks (down from 37) in 16 countries. Five of its five busiest sources sit in one /24: 109.160.32.47, .152, .159, .162, .157. Its 7-day address counts: 10-07 100, 10-08 66, 10-09 88, 10-10 116, 10-11 90, 10-12 81, 10-13 37. That same /24 has run a hardware survey (uname) on our frantech honeypot before; this window the survey did not appear in the shell-command record — the first time the sweep and the survey decoupled.
  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 6,047 sessions from 313 addresses across 157 networks in 54 countries — the same ~310-address plateau, now on day 24. Its 7-day address counts: 10-07 350, 10-08 309, 10-09 317, 10-10 344, 10-11 303, 10-12 319, 10-13 101. Busiest sources: 40.74.68.248, 41.173.43.34, 129.121.97.74, 94.180.139.162, 165.231.143.109.
  • 16443846184eafde36765c9bab2f4397 (still unnamed, netcup's top fingerprint): 10,271 sessions from 29 addresses / 19 networks — down from 16,506 / 49 — on day 16, still under the 50-address line where we name things.
  • Smaller classes: 084386fa7ae5… 83 sessions / 61 addresses / 11 networks (turned distributed); 03a80b21afa8… 638 / 31 / 21; acaa53e0a7d7… 40 / 38 / 32; dd9bcf093c35… 28 sessions from 27 addresses on 1 network; e54ef3ec27fe… 36 / 25 / 8.
  • LEAKIX-SSH (fd65145f481d…): absent, 0 sessions.
  • Fleet inbound SSH totaled 131,309 sessions, up 13,538 from №49. No fingerprint crossed a naming threshold; the names file is unchanged.

Canaries (minted and used) — what the planted keys did

The fleet minted 80 credentials to 32 collector addresses. 5 keys were used in AWS: 28 calls, 6 identity checks succeeded, 22 calls denied (GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2). Mint failures: 0, the third clean window in a row. All-time issued keys: 2,122. This was a use window, and the largest one on record.

Every collector this window, with keys taken and history: 2a02:c207:2350:9697::1 took 6 on ai-devbox-1 and 5 on canary-farm-1 (11 over 6 days, since 2026-10-12 08:22; used 2, one address, EC2 calls plus ListBuckets); 169.58.180.111 took 5 on ai-devbox-1 and 4 on canary-farm-1 (9 over 6 days, since 08:22; used 2, one address, EC2 calls); 131.193.125.163 used 1 key for an identity check from outside our logs — Tracebit is the only witness, and we never saw the address that minted it. Then the unused: 102.220.161.139 took 3 on control-1, 2 on ru-edge-1, 1 on ai-devbox-1 (6/6d); 167.71.81.114 took 3 on canary-farm-1 (5/6d); 167.99.79.44 took 3 on canary-farm-1, 2 on ai-devbox-1, 1 on control-1, 1 on ru-edge-1 (7/6d); 173.249.253.116 took 3 on ai-devbox-1 and 3 on canary-farm-1 (6/6d); 206.209.210.3 took 2 on canary-farm-1 (7/6d); 208.84.100.218 took 2 each on ai-devbox-1 and canary-farm-1, 1 each on control-1 and ru-edge-1 (10/6d); 213.209.159.175 took 2 on control-1 (6/6d); 45.148.10.171 took 2 each on ai-devbox-1 and canary-farm-1, 1 each on control-1 and ru-edge-1 (45/6d); and 1 key each to 109.205.176.10 (ru-edge-1, 6/6d), 138.68.144.227 (canary-farm-1), 139.59.231.238 (control-1, 4/6d), 147.182.200.94 (ru-edge-1, 2/6d), 157.245.105.107 (ai-devbox-1, 2/6d), 159.89.12.166 (ai-devbox-1, 2/6d), 161.118.206.143 (canary-farm-1), 165.227.84.14 (control-1, 2/6d), 167.172.158.128 (ai-devbox-1), 167.172.232.142 (canary-farm-1, 2/6d), 167.99.182.39 (ai-devbox-1, 2/6d), 168.107.90.53 (control-1), 172.93.215.8 (canary-farm-1, 3/6d), 180.93.238.65 (ru-edge-1), 185.177.72.49 (control-1), 185.93.89.112 (canary-farm-1), 217.60.76.167 (control-1, 3/6d), 45.138.12.51 (ai-devbox-1, 6/6d), 45.148.10.238 (control-1 — its first ever), 46.101.111.185 (ru-edge-1), 64.227.70.2 (canary-farm-1, 3/6d), 77.90.185.125 (control-1). The digest counted 81 mint rows (canary-farm-1 30 from 14 addresses, ai-devbox-1 27 from 13, control-1 15 from 12, ru-edge-1 9 from 8); after Tracebit's de-duplication that is 80 credentials to 32 collectors. The 75 unused keys stay stolen property until they expire.

How the fleet behaved — the traps held, and one honest crawler moved the numbers

  • Keys: 80 minted, 32 collectors, 5 used, 0 mint failures (third clean window), 2,122 all-time.
  • Attribution: the forged-header checks read: any X-Forwarded-For 1,711; multi-entry chains 0; header-present-but-internal 403 (up from №49's 2, riding the window's volume; all entries were internal or matched the connection); header-disagrees-with-connection 0 — the number that would mean someone chose their own attribution stayed zero. Traffic still leads with bare IP addresses rather than our TLS site names; the TLS decoys took 541 HTTPS events on canary-farm-1, 415 on ai-devbox-1, 352 on lauterbourg.
  • Traffic moves, with causes: sponge-01-ts +179% (3,324 events) — the Bochum crawler (2,425). netcup-ts +130% (3,676) — the same crawler (2,092). control-1 +55% (4,659) — the Pfcloud replay loop (2,141, about 46% of the node) plus SI-CENSUS (845) and ORACLE-SWEEP (235). frantech-ts +6% (15,347) — MEGA-DICT's replay (13,554). ai-devbox-1 +15% (1,995) — LIBREDTAIL (222), SI-CENSUS (348), the REGISTRY wave. canary-farm-1 +10% (2,384). lauterbourg-01-ts +1% (1,583). ru-edge-1 −41% (1,042 against a 1,770 seven-day average) — none of the week's big census passes repeated there; its one spike is explained.
  • Spikes: all 13 result-tag spikes have owners — the phpMyAdmin spikes (farm 203, control 175, lauterbourg 151) belong to GOWEB-PENTEST plus INFOCREST (30) and EMPERORS (22); the phpunit spike (226) is all LIBREDTAIL; the fake-git spikes are the MEVSPACE pair plus SI-CENSUS; the tarpit spikes are the Bochum crawler; the env/config spikes are SI-CENSUS and ORACLE-SWEEP. Nothing unexplained.
  • control-1's discovery ramp: day 30 — 4,659 events from 109 unique addresses. The address count sits inside the usual 84–157 band (22nd window in a row); the event total is the node's second-highest because of the replay loop and the day's censuses, not because new finders showed up.
  • Known data quirks: first-seen timestamps again cluster at the 03:16 log-sync minute — they are arrival times, not sighting times. The hourly histogram buckets use local EDT times under a UTC header (known issue). The +4-hour ingest cast can place late events in two digests — we checked №49 before calling anything new (the Contabo mints at 08:22 EDT are genuinely new; №49's window ended 03:32 EDT). ai-devbox-1's rotated-file gap enters its twelfth cycle.
  • Changes we made: the visuals dashboard's campaign list now shows SI-CENSUS and MEVSPACE-GITWALK active, EMPERORS-KIT recurring, AKAMAI-VHOST-SCAN idle, plus fresh notes on 11 other campaigns; 11 new address labels for the top-talker panel. The campaign registry got the same updates.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

518 addresses sent passwords → 344 got a shell (66%) → 259 ran a command (75% of shell-holders, 50% of all senders). Event level: 10,684 password attempts → 3,007 accepted logins → 4,742 commands (158% of accepted logins went on to run something). Telnet (IoT botnets): 1,274 attempts, up from 1,216.

Twenty-third window in a row with no new command. 0 of 82 distinct commands were new. The .ssh replant pair still leads (cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,020 events from 203 addresses; the key-replace chain at 902 from 191). 92.118.39.71's class ran its PATH-export + uname loops (312 + 312 events from 8 addresses). 45.148.10.240 ran the hardware survey (uname -s -v -n -r -m, uptime -p, lspci | grep VGA — 209 events each from 3 addresses). The GO-SSH-SWEEP /24's uname survey stayed out of the command record this window — the first time it and the network sweep decoupled.

Passwords: 6,501 distinct pairs offered, 0 new. Concentration holds for a fifth window: 345gs5662d34/345gs5662d34 at 963 attempts and root/3245gs5662d34 at 754.

Open questions

  1. The Contabo pair. Will their 20 held keys draw more AWS calls, or a console login, before they expire? What tool links the IPv4 and IPv6 collectors (same-minute mint start, same call types)? Will either come back for a second run?
  2. 131.193.125.163 (University of Illinois at Chicago). How did a university address use one of our keys when it never touched our traps — a hacked campus machine, a campus research scan, or a resale? We only have Tracebit's word, and we never saw who minted that key.
  3. ORACLE-SWEEP's fourth window. Is the widened 235–384-path census the new normal? Will any of the campaign's 5 held keys reach AWS?
  4. 16443846184e…. 10,271 sessions from 29 addresses over 16 days, still netcup's top fingerprint and still unnamed. It gets a name if it spreads again or crosses 50 addresses; reading its SSH banner would tell us whether it belongs to the GO-BANNER-SWEEP family.
  5. INFOCREST-KIT's new operator. The kit's phpunit and download steps were missing this window — will a return capture them? And is one hosting network (tzulo) carrying two campaigns in one window a coincidence or shared infrastructure?
  6. The Bochum crawler. A second window puts it on the benign list, so fleet traffic baselines can subtract it.
  7. ai-devbox-1 history. The rotated log file (268 MB) is still outside the digest — twelfth cycle of this gap.
  8. The shell honeypot streak. Twenty-three windows without a new post-login command. New commands are the only window we have into what attackers do after a shell — the streak is good news, but it is also a hole in what we can see.

Plain language version of: flux-fleet-intel-briefing-2026-10-13.md