Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №52 — PLAIN LANGUAGE

Period: 2026-10-14 07:34 – 2026-10-15 07:34 UTC (24h, day 50 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-15.md

What happened (plain)

A known census tool called OMEGA-SWEEP showed up under a new operator for the second time. The operator, 79.124.58.82 (Tamatiya EOOD, a Bulgarian hosting network), ran huge config-file sweeps against two of our trap nodes and picked up 3 of our fake credentials. For the second day in a row, none of our fake credentials were used in AWS — 49 new ones went out to 25 different collectors, and all 49 are still unused. A shared list of 13,583 malware-download links got replayed at our frantech node by a new host (176.119.150.64, Owl Limited DE) in 91 seconds; 12,995 of those paths match the copy of the list we saved on 2026-09-19, so the list itself keeps growing. Most of the day's big traffic changes came from a benign university research crawler (Ruhr-Universität Bochum), not attackers: it pushed netcup up 117% and sponge up 175%. At the network layer, one SSH scanning tool set a record — 30,946 connection attempts in the window — and another fielded its widest spread of source addresses so far (358 IPs across 177 networks).

What it means (plain)

  1. The OMEGA-SWEEP census tool is shared property, not one gang's tool. A brand-new operator (79.124.58.82, Tamatiya EOOD, BG) reproduced the exact registered sweep — forged Googlebot user agent, 104–106 trap families, 9–11-second passes — with no overlap with the original 94.154.46.x operators, and converted 3 canary mints on its first run. This is the second documented escape of the template (№15 was the first). (High confidence — the user agent, the family breadth, and the journey match the registered template; the operator is new.)
  2. Two quiet windows on the use side means the pile of stolen credentials is growing, not that attackers stopped. 49 fresh credentials went to 25 collectors; the longest-running collector (45.148.10.171) grew its hoard to 50 credentials over 6 days on its 20th consecutive minting window, and 14 LeakIX-class runners took 1 canary each. The three biggest untraced hoards (50, 41, and 40 credentials) sit unused until they expire. (High confidence — Tracebit alerts are the only witness for use; none fired.)
  3. The git-folder-walk tooling is consolidating into one family. The exact same walk shape returned under fresh sibling IPs (104.207.37.126 and 65.111.4.237): 144 events over 142 paths on each of two nodes, using the honest git/2.40.0 user agent. №51 credited that user agent to MEVSPACE-GITWALK; №40–№42 registered the same shape as GIT-VAULT. Two registry names now describe what looks like one walk. (Moderate confidence — the shape and UA match is observed; a true operator link is unproven.)
  4. Our fake LLM endpoints are on circulating tooling lists. A second operator — 52.250.210.67 (Microsoft Azure), with an honest Python/3.12 aiohttp/3.14.5 user agent — hit sponge-01-ts: 6 model-list probes (only /v1/models answered 200), then 90 POSTs to /v1/chat/completions in 11 seconds, all 200. That follows №43's AutoGenX client on lauterbourg. (Moderate confidence — two independent operators observed; what they want beyond an answer is unknown because request bodies were not captured.)

Campaigns (who / what / what it means)

OMEGA-SWEEP — a huge config-file sweep, back under a new boss

  • Who: 79.124.58.82, a hosting network in Bulgaria (Tamatiya EOOD). It hit ai-devbox-1 at 18:50 EDT (466 events, 403 paths, 104 trap families in 11 seconds) and control-1 at 02:22 EDT 10-15 (450 events, 450 paths, 106 families in 9 seconds). The original 94.154.46.x operators ran nothing; their block has now been silent for 12 windows.
  • What they did: pretended to be Googlebot, requested only with GET, and walked the full config-file wordlist: env-production 108+101 hits, ssh-private-key-error 22+27, wp-config, fake-git, app-config-python, terraform-tfvars, docker-compose, application-yml. They hit /.env-class trap paths and minted 3 real canary credentials — 2 on ai-devbox-1, 1 on control-1. No mint failures anywhere in the window.
  • What it means: the fleet's widest census template now has a second independent operator, and this one converts to credentials on the first try. Those 3 canaries join the use-side watch. The 106-family pass shows the tool's wordlist is still growing somewhere upstream.

CREDENTIAL-DRAIN — the fake-credential pipeline

  • Who: mint side: 49 credentials to 25 collector IPs. Use side: nobody — 0 alerts, 0 AWS events.
  • What they did: the window's funnel was 49 minted / 25 collectors / 0 used, with 0 mint failures (the cleanest failure window since №16). The new top collector is 194.59.31.39, which took 8 canaries off ai-devbox-1 between 13:54 and 19:54 EDT behind a slow 6-hour config census (240 events, 105 paths, 0 POSTs). Other takers: 45.148.10.171 with 9 across 4 sensors (50 over 6 days, 20th window in a row), 79.124.58.82 with 3, 37.60.226.187 with 3 on control-1, 80.94.95.211 with 2, 213.209.159.175 with 2, 185.177.72.64 with 2, 180.93.236.215 with 2 (new collector), 172.239.158.26 with 1+1, 45.148.10.5 with 1 (a CREDSWEEP family address), and 14 LeakIX runners with 1 each.
  • What it means: after №50's record use window, the use side has now watched nothing for two windows. The untracked pile grew by 49, and the three biggest hoards (50, 41, 40 credentials) age toward expiry with no validation calls. Whether they are parked for resale or used somewhere we cannot see is an open question — Tracebit is the only witness.

REGISTRY-HUNT / LeakIX — a public leak-scanning service

MEGA-DICTIONARY — a shared list of malware-download links, replayed

  • Who: 176.119.150.64, hosted by Owl Limited in Germany, hit frantech-ts only.
  • What they did: replayed 13,583 paths in 91 seconds starting 01:26 EDT 10-15, pretending to be routers and IoT devices (ASUS RT-AC55U, TP-LINK Archer C80, Tenda AC1200, plus curl/8.2.1). 13,579 paths got our not-handled answer; 4 brushed single decoys. The list grew by 18 paths since №51 (13,565), and 12,995 of its paths match the 13,000-path copy we saved on 09-19.
  • What it means: the same shared list keeps passing between operators and keeps absorbing new malware links. The host's company name (Owl Limited) matches the name behind SS-PROBE's Owl Limited JP — tracked as a coincidence until a real link shows up. The replay was 94% of frantech's day and hides the node's true baseline; our deception surface absorbed it at zero cost.

GIT-VAULT — a thief walking a fake .git folder

  • Who: two fresh addresses in the same hosting classes as №40–№42's pair: 104.207.37.126 (canary-farm-1, 14:11 EDT) and 65.111.4.237 (ai-devbox-1, 15:45 EDT). Two single-event git/2.40.0 touches came from 45.3.48.30 and 45.3.37.79.
  • What they did: the exact registered walk — /.git/HEAD then 142 internal paths in 6–10 seconds — 144 events each, byte-identical counts, using an honest git/2.40.0 client. 0 mints.
  • What it means: same shape, same user agent, new addresses — one walk template keeps circulating. See Key Judgement 3: two registry names (GIT-VAULT, MEVSPACE-GITWALK) may describe one tool.

GOWEB-PENTEST — a self-announcing phpMyAdmin hammer

  • Who: three new operators in one day, each with the honest self-label Go Web Pentest Tool: 34.211.136.159 (AWS US) and 185.205.222.77 (PT Industri Kreatif Digital, Indonesia) on lauterbourg; 185.47.64.239 (Nowatel, Poland) on ai-devbox-1. That makes 16th–18th operator addresses across 13th–15th windows.
  • What they did: each ran 151 GET requests against one phpMyAdmin login path in 28–49 seconds. GET-only, 0 POSTs, 0 mints. The two lauterbourg operators produced that node's 306-event phpmyadmin-login spike; .239 produced 151 of ai-devbox's 164.
  • What it means: our phpMyAdmin decoys sit on a shared target list that keeps circulating, and the list now includes ai-devbox. Nobody has ever sent us a credential body through this tool, so its intent is still unproven.

XMLRPC-BRUTE — WordPress xmlrpc password guessing

  • Who: 85.204.70.116, Hydra Communications Ltd, Great Britain (AS25369) — the sixth operator on record — on lauterbourg at 01:16 EDT 10-15, pretending to be Chrome/78.
  • What they did: the registered preflight (/wp-includes/wlwmanifest.xml and /wp-json/wp/v2/users/, both 200) then 60 POSTs to /xmlrpc.php in 1.5 seconds, each a 480–491-byte system.multicall XML body, all answered 200.
  • What it means: the campaign came back after a long pause under yet another operator, same multicall shape. The captured body head does not show the username, so the account-targeting question stays open.

LLM-ENDPOINT-PROBE — someone using our fake AI endpoints

  • Who: 52.250.210.67, a Microsoft Azure address, honest user agent Python/3.12 aiohttp/3.14.5, on sponge-01-ts at 09:47 EDT. №43's AutoGenX operator stayed away.
  • What they did: fired 6 model-list probes within 5 milliseconds (only /v1/models got a 200), then about 90 POSTs to /v1/chat/completions in 11 seconds — every one answered 200, with 142–234-byte bodies we did not capture.
  • What it means: our fake OpenAI-compatible endpoint now has two independent automated clients on two nodes. The decoy answered everything; what the clients do with the answers is unknown until we capture a body.

LIBREDTAIL-KIT — a phpunit remote-code-execution kit

  • Who: 186.182.105.49 with the honest libredtail-http user agent on ru-edge-1 (49 events, 44 paths). The wider signature cluster 7e61a9500d8b ran fleet-wide: 13 addresses, 637 events, 6 sensors.
  • What they did: the registered chain — md5 probe → php-cgi code-execution that prints an SSH key as a success signal → /bin/sh dropper POST. The dropper host was not captured this window. 0 mints.
  • What it means: the kit's runners keep rotating, and 13 addresses in one window is the widest single-day footprint on record for this signature. Our fake webshells and tarpits held.

INFOCREST-KIT — a composite adminer/WordPress toolkit

  • Who: 103.214.20.135 (Host Universal Pty, Australia) on 4 sensors (533 events, 04:15–05:25 EDT). №51's sixth-sensor operator 173.249.253.116 stayed away.
  • What they did: census legs (config-bundle paths, 5 config-backup paths on sponge) plus 10 phpMyAdmin logins on ai-devbox-1. No adminer password POSTs captured this window, 0 mints.
  • What it means: the toolkit's operators keep rotating; this pass looks like a census, not the full break-in anatomy.

CREDSWEEP — the .env file census crew

  • Who: 45.148.10.238 (Techoff Srv, Netherlands) ran netcup-ts for the first time — 836 events, 373 paths, 13 POSTs in 5 minutes (21:14 EDT), 16 rotating modern user agents including the campaign's Mozlila/5.0 typo forgery. A same-company address, 93.123.109.226 (Techoff Srv, Bulgaria), swept sponge-01-ts in under a minute: 514 events, 510 paths, including 84 webshell-probe hits (a 16.8× spike) and the config-backup census behind sponge's first-seen list. 45.148.10.5 took 1 canary on control-1.
  • What they did: walked env and config wordlists across two nodes that carry no canaries, so no credentials were at risk there; the netcup POST bodies were not captured.
  • What it means: two operators from one company worked two nodes in the same window — the /24's toolset now spans config census, webshell probing, and git walks.

METADATA-HUNT — the cloud-credential hunting campaign

  • Who: only a minimal probe this window: 144.172.64.99 with a bare Mozilla/5.0 user agent, touching both EU nodes. №51's record runner 35.253.66.111 and the whole named-runner roster stayed away.
  • What they did: just the campaign's @fs file-read marker pair — /@fs/proc/self/environ and /@fs/etc/passwd, twice each. No __aws_leak_probe, no census, no mints.
  • What it means: the campaign's signature survives on a tiny probe, and its 41 fresh canaries from №51 are still unwatched inventory. Whether the full runner returns, or the template has decayed to single checks, is the next-window question.

Standing actors (who keeps coming back)

  • 45.148.10.171 took canaries for the 20th window in a row: 9 mints across 4 sensors, hoard at 50 over 6 days, still zero observed AWS use. The fleet's longest-running collector.
  • 204.76.203.18 (Pfcloud) kept replaying its malware dictionary on control-1, day 24 or later: 1,944 events, 579 paths (58% of the node). Sibling .219 touched all 8 sensors.
  • The LeakIX repeat minters keep coming back at 1 canary per runner per window; the collector base persists behind the rotating addresses.
  • The Bochum softsec crawler (185.73.23.161 finn + .162 goose) ran its third window and is on our benign list: 2,960 of netcup's 4,391 events (67%) and 3,312 of sponge's 4,674 (71%).
  • The TOKEN-CRAWLER pool (45.198.224.x) touched all 8 sensors again (.124 with 88 events, .125 with 72) — 0 mints.
  • Tarpit pools stayed constant: 94 IPs / 654 events in the largest pool.
  • Benign fixed-cadence probers (80.82.77.202, 89.248.172.33, 34.140.3.155, 130.12.180.32, 71.6.155.70) ran unchanged shapes.
  • The SI-CENSUS block left only 5 events from 1 address — a touch, not a census; its 33 held credentials stand.

Network sweeps (Arkime) — SSH scanning that never touches the web traps

Two sweep tools crossed the "dispersed" line (one fingerprint, many networks, one port, no login attempts):

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 6,463 sessions from 358 source IPs across 177 networks in 54 countries on port 22 — day 26, and its widest source spread yet (its usual band was 280–310 IPs). Top networks included Microsoft, UCloud HK, Byteplus, Tencent, and Korea Telecom. Daily IP counts: 10-09 317, 10-10 344, 10-11 303, 10-12 319, 10-13 283, 10-14 336, 10-15 143 (partial day).
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 30,946 sessions — a record, up 14% from №51 — from 108 IPs across 42 networks in 24 countries. Top sources sit in 192.253.248.216, 109.160.32.x, and 77.239.124.x; Techoff Srv Limited stays in its network list, and that same company worked two of our web nodes this window. Daily IP counts: 10-09 88, 10-10 116, 10-11 90, 10-12 81, 10-13 97, 10-14 95, 10-15 61 (partial day).

Also on the board: 16443846184eafde36765c9bab2f4397 grew 22% again to 15,098 sessions at 40 IPs — day 18, still unnamed, still under the 50-IP naming line. A new below-threshold fingerprint e54ef3ec27fe1fea7ab64d3fa05359fd appeared (33 sessions, 19 IPs). The ninth sensor, contabo-sponge-02-ts, logged 9,765 sessions in Arkime with no flux logs yet. These sweeps request no web path, so the web traps and canaries cannot see them — this Arkime view is the fleet's only sight of them.

Canaries (minted and used) — fake credentials, and whether anyone bites

No canary credentials were used in AWS during the window. Fleet sensors minted 49 credentials to 25 collector IPs; none reached AWS. Use outcomes: 0 success, 0 failure. Mint failures: 0.

Every collector this window, with what they took (theft IP — sensor, mints, AWS uses — mint history):

  • 194.59.31.39 — ai-devbox-1, 8 mints, 0 used — 8 mints since 2026-10-14 13:54
  • 45.148.10.171 — canary-farm-1, 4 mints, 0 used; ai-devbox-1, 2; ru-edge-1, 2; control-1, 1 — 50 mints since 2026-10-08 09:56
  • 37.60.226.187 — control-1, 3 mints, 0 used — 5 mints since 2026-10-10 00:57
  • 79.124.58.82 — ai-devbox-1, 2; control-1, 1; 0 used — 3 mints since 2026-10-14 18:50
  • 80.94.95.211 — ai-devbox-1, 2 mints, 0 used — 6 mints since 2026-10-10 20:25
  • 213.209.159.175 — control-1, 2 mints, 0 used — 6 mints since 2026-10-10 23:11
  • 185.177.72.64 — ai-devbox-1, 2 mints, 0 used — 4 mints since 2026-10-11 23:36
  • 180.93.236.215 — control-1, 2 mints, 0 used — 2 mints since 2026-10-14 21:54
  • 172.239.158.26 — canary-farm-1, 1 + control-1, 1; 0 used — 3 mints since 2026-10-14 06:36
  • 45.148.10.5 — control-1, 1 mint, 0 used — 2 mints since 2026-10-11 13:11
  • 109.205.176.10 — ru-edge-1, 1 mint, 0 used — 7 mints since 2026-10-08 03:34
  • 45.138.12.51 — ai-devbox-1, 1 mint, 0 used — 7 mints since 2026-10-10 18:27
  • 128.199.182.55 — control-1, 1 mint, 0 used — 6 mints since 2026-10-08 20:14
  • 139.59.231.238 — control-1, 1 mint, 0 used — 4 mints since 2026-10-09 19:46
  • 138.68.86.32 — ai-devbox-1, 1 mint, 0 used — 2 mints since 2026-10-08 18:42
  • 64.23.218.208 — ru-edge-1, 1 mint, 0 used — 2 mints since 2026-10-08 19:36
  • Single-mint collectors, 0 used: 157.245.105.107 (canary-farm-1, 3/6d), 159.223.132.86 (canary-farm-1), 164.92.107.174 (canary-farm-1), 165.22.34.189 (canary-farm-1, 2/6d), 167.99.210.137 (canary-farm-1, 4/6d), 128.199.182.152 (ai-devbox-1), 167.172.232.142 (ai-devbox-1, 4/6d), 206.189.19.19 (ai-devbox-1), 134.122.28.88 (ru-edge-1)

Long-standing collectors with hoards but no observed AWS use (the biggest, with their 6-day totals): 45.148.10.171 50 mints (2026-10-08 09:56 → 2026-10-15 05:24); 35.253.66.111 41 (10-13); 34.124.231.201 40 (10-10); 87.120.104.29 18 (10-09 → 10-13); 209.159.155.142 12; 2a02:c207:2350:9697::1 11; 206.209.210.3 10; 208.84.100.218 10; 80.94.92.65 10; 169.58.180.111 9; 173.249.253.116 8; 194.59.31.39 8; 103.214.20.135 7; 109.205.176.10 7; 167.99.79.44 7; 45.138.12.51 7; 102.220.161.139 6; 128.199.182.55 6; 150.241.66.127 6; 213.209.159.175 6; 80.94.95.211 6; 140.245.97.208 5; 160.177.245.67 5; 167.71.81.114 5; 37.60.226.187 5. Smaller holders (3–4 mints over 6 days): 105.115.6.147, 139.59.231.238, 146.190.103.103, 157.245.204.205, 167.172.232.142, 167.99.210.137, 185.177.72.64, 213.209.159.154, 64.227.32.66, 68.183.9.16, 146.190.63.248, 157.245.105.107, 157.245.113.227, 167.99.182.39, 172.239.158.26, 172.93.215.8, 206.189.225.181, 206.189.233.36, 209.38.208.202, 209.99.188.170, 217.60.76.167, 64.227.70.2, 79.124.58.82.

Who the collectors are: 194.59.31.39 is the new top collector — the slow 6-hour census described above; nobody has ever minted from a slow census like this before. 79.124.58.82 is the OMEGA-SWEEP escapee. The 14 single-mint rows map one-to-one to LeakIX runners. 45.148.10.5 belongs to the CREDSWEEP family. 37.60.226.187, 180.93.236.215, and 172.239.158.26 are not yet attributed to a campaign.

How the fleet behaved (Fleet Observations)

Canary economics. 55 digest mint rows became 49 real credentials to 25 collectors (the digest counts rows, Tracebit counts credentials). Nobody used any of them: 0 alerts, 0 AWS events. Zero mint failures — the cleanest window since №16. All-time issued-row counter: 2,297. Per node: ai-devbox-1 22, control-1 14, canary-farm-1 12, ru-edge-1 7.

Attribution and TLS posture. No one forged their forwarding headers this window: 1,088 requests carried any X-Forwarded-For, 0 had multi-entry chains, 8 were internal-only, and the key number — single-entry mismatches, where a sender invents its own origin — was 0. Every sensor was addressed by bare IP more than by its fake TLS hostname: ai-devbox's inference.fapthropic.com got 937 hits versus 1,512 bare-IP, canary-farm's sso.rightabouteverything.show got 360 versus 1,059.

control-1's discovery ramp. Day 32 of the deliberately fresh node: 3,148 events from 110 unique IPs. The unique-IP count sits inside the usual 84–157 band for a 24th consecutive window. The volume is the third-highest ever for the node, driven by the Pfcloud replay loop and the OMEGA pass, not by new finders.

Volume moves and their causes. netcup +117% (4,391 events): two-thirds is the benign Bochum crawler (2,960), plus CREDSWEEP's first netcup run (836). sponge +175% (4,674): 71% is Bochum (3,312), plus the Techoff sweep (514). ai-devbox +37% (2,475): the OMEGA escapee (466), the new slow collector (240), LeakIX runners, and the WordPress pool. canary-farm −43% (1,435): №51's big METADATA-HUNT burst (650 events) did not repeat. lauterbourg −26% (1,260): ORACLE-SWEEP's 873-event pass did not repeat; two GOWEB hammers (302) and the Bucklog census (258) replaced it. frantech −2% (14,386) hides the 13,583-event dictionary replay (94% of the node). ru-edge −20% (1,337): CONFIG-SWEEP's 3,000-event return did not repeat. control −8% (3,148): the Pfcloud loop continues at 1,944.

Every spike has a cause. All 10 result-tag spikes of 3× or more trace to named actors: ai-devbox env-production 229 = the OMEGA escapee (108) + the slow collector (64) + l9explore (36) + Bucklog (20); ai-devbox phpmyadmin-login 164 = GOWEB's 151 + INFOCREST's 10; ai-devbox and control ssh-private-key-error 22+27 = the OMEGA escapee; ai-devbox wp-config 20 = OMEGA (14) + the slow collector (3); lauterbourg phpmyadmin-login 306 = two GOWEB operators (151 + 151); lauterbourg wp-xmlrpc-post 60 = XMLRPC-BRUTE; sponge llm-endpoint-openai-chat 90 = the LLM endpoint client; sponge tarpit-module 3,718 = the Bochum crawler; sponge webshell-probe 84 = the Techoff sweep.

Known quirks, unchanged. First-seen timestamps again cluster at the 03:15:39–40 sync-arrival minute — they are arrival times, not attack times. The hourly histogram buckets still show local EDT times under an hour_utc header. The 4-hour ingest offset means late-window actors can appear in two digests; every run cited here starts after №51's window end. The ai-devbox rotated-file gap enters its fourteenth cycle. No new quirk this cycle.

Fleet-side changes. The visuals dashboard's campaign statuses were updated: OMEGA-SWEEP, GIT-VAULT, and LLM-ENDPOINT-PROBE moved to active; CONFIG-SWEEP, ORACLE-SWEEP, SS-PROBE, MEVSPACE-GITWALK, PROTON-CENSUS, EMPERORS-KIT, NIGHTAGENT, KITEWORKS-CRAWL, and CONFIGBUNDLE-SWARM moved to idle. No new network-layer campaign names. Infrastructure note: the ninth sensor, contabo-sponge-02-ts, now logs 9,765 Arkime sessions per window and still has no flux logs.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host ran the SSH/telnet honeypots, so these numbers describe that host only. The funnel: 543 addresses sent passwords → 410 got a shell (76%) → 328 ran a command (80% of shell-getters, 60% of senders). By events: 19,362 password attempts → 3,180 accepted logins → 3,656 commands. Telnet attempts fell to 717 from 2,628.

No new commands for the 25th window in a row. All 81 distinct commands were seen before. The dominant pair is still the .ssh folder lock-and-replant (cd ~; chattr -ia .ssh; lockr -ia .ssh — 1,200 events from 242 addresses) and the key-replacement chain (1,054 events from 215). Hardware surveys continue: the 2.57.122.168 class ran the uname battery (172 events, 7 addresses), 62.171.133.1 ran it solo (113), and — notably — 109.160.32.122, from the same /24 as the GO-SSH-SWEEP scanner, is back in the command table (uname -s -v -n -r -m plus uname -m | awk, 152 events, 12 addresses). The network sweep and the post-login hardware survey are coupled again after №51's split.

Passwords: same short list, nothing new. 14,314 distinct pairs offered, 0 new. The top pair 345gs5662d34/345gs5662d34 took 1,153 attempts and root/3245gs5662d34 took 865 — the fixed-pair sprayers have owned the funnel for a seventh window.

Open questions

  1. 194.59.31.39's 8 canaries. The first collector ever to mint from a slow, 6-hour census. Will it come back to ai-devbox-1, spread to other nodes, or try the credentials in AWS? The 13:54–19:54 EDT cadence is its fingerprint.
  2. The OMEGA-SWEEP escapee's 3 canaries. Does 79.124.58.82 repeat on a third node? A repeat would show a standing second crew behind the template; a one-off would look like passing trade.
  3. One git walk or two? The 144-event/142-path git/2.40.0 shape now exists under two registry names. A third sibling address should merge the rows; capturing the walk's wordlist would settle it.
  4. The 1C favicon census on ru-edge. 141.255.162.237 ran a Russian-1C-flavored directory list (537 paths in a minute) against our Russia node. We do not know who ran it or why that target; a second run earns it a name.
  5. The zero-use streak. Two windows, 151 credentials deep. Do hoards expire unused, or get validated somewhere we cannot see? Tracebit's alert feed is the only witness; the three 40+ hoards are the ones to check.
  6. 16443846184e…, the unnamed SSH scanner. Day 18, 15,098 sessions, 40 IPs, growing 22% per window. It gets a name if it spreads past 50 IPs; a banner read would tell us whether it belongs to the GO-BANNER-SWEEP family.
  7. The ninth sensor. contabo-sponge-02-ts keeps logging Arkime sessions (9,765 this window) but has no flux logs yet. When do its traps come online?
  8. The quiet SSH honeypot. Twenty-five windows with no new commands, and the same two password pairs own the funnel. Telnet fell to 717 attempts. New commands remain the only post-compromise tripwire we have.

Plain language version of: flux-fleet-intel-briefing-2026-10-15.md