Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №53 — PLAIN LANGUAGE

Period: 2026-10-15 07:33 – 2026-10-16 07:33 UTC (24h, day 51 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-16.md

What happened (plain)

A widely shared census tool that hunts for .env files showed up under a new operator: 102.220.163.155, from the same Slovak hosting company (VPS Dedicated LLC) that runs the known SI-CENSUS block. It ran the same scan on three of our nodes — ai-devbox-1, canary-farm-1, and control-1 — with identical request counts on each (514 events / 511 paths / 34 trap families), and it picked up one fake AWS credential on every node. The operator behind the OMEGA-SWEEP census escape, 79.124.58.82, hit control-1 twice in one day; that repeat behavior points to a standing crew, not a one-off visitor. For the third day in a row, none of the stolen canary credentials were used in AWS — 38 more credentials went to 27 collector addresses, and the unused pile over three windows now stands at 189. The shared IoT malware dictionary ran its twentieth replay (13,606 paths in about a minute), and research scanning from Ruhr-Universität Bochum again accounted for most of the traffic on two nodes.

What it means (plain)

  1. The .env fanout census is shared tooling, and the newest crew is effective on day one. 102.220.163.155 copied the known scan path-for-path against three nodes at different hours, and got a credential at /.env on each. The same company also runs the older SI-CENSUS block (102.220.161.x, holding 33 unused credentials), and two Techoff Srv operators scanned control-1 the same day. (High confidence — the scan journeys match byte for byte apart from a random marker; the mint records are direct observation.)
  2. The OMEGA-SWEEP escape operator looks like a permanent fixture. 79.124.58.82 (Tamatiya EOOD, Bulgaria) scanned ai-devbox-1 at 18:50 EDT on 10-14, control-1 at 02:22 EDT on 10-15, and control-1 again at 11:00:55 EDT the same day — 450 events / 106 trap families in under a second, with /jenkins/.env and /strapi/.env answering 200. It now holds 4 of our credentials. Scheduled repeat work at different hours is crew behavior. (High confidence — the passes are timestamped; "standing crew" is our reading of the pattern, and a pass on a third node would settle it.)
  3. Unused stolen credentials keep piling up. Three windows in a row with zero AWS use: 189 credentials in total. The biggest hoards keep growing — 45.148.10.171 minted for its 21st straight window and now holds 48 credentials in 6 days. Until they expire, those credentials are hostile-held inventory. (High confidence — Tracebit alerts are the only witness for AWS use, and none fired.)
  4. The biggest SSH sweep is hitting harder from fewer places. The ssh-2.0-go fingerprint set a session record (31,271) but from only 65 source addresses across 13 networks — down from 108 addresses / 42 networks — so it concentrated instead of spreading. (Moderate confidence — the counts are direct; whether this is one crew consolidating or several sharing one tool is unmeasured.)

Campaigns (who / what / what it means)

CREDSWEEP — an .env-file hunting census that collects fake credentials

  • Who: a new operator, 102.220.163.155 (VPS Dedicated LLC, Slovakia — the same company behind SI-CENSUS), plus two Techoff Srv operators: 93.123.109.226 (Bulgaria) and 45.148.10.238 (Netherlands), and the returning Feo Prest address 213.209.159.154.
  • What they did: 102.220.163.155 ran the identical 514-event / 511-path / 34-family scan on ai-devbox-1 (10:21–12:10 EDT), canary-farm-1 (12:37–12:45 EDT), and control-1 (13:10–13:21 EDT) on 10-15, under a single forged Chrome/126.0.0.0 browser identity. It asked for the same files everywhere: /vendor/.env, /lib/.env, /lab/.env, /cronlab/.env, /core/.env, /core/Datavase/.env, /database/.env, and left a marker file request (pscan-<random>-nonexistent.txt) at the start of each pass. It got a credential at /.env on all three nodes. 93.123.109.226 ran a 514-event error-census walk on control-1 (22:07–22:09 EDT) and took 2 credentials at /.env. 45.148.10.238 ran 757 events / 370 paths / 26 families with 5 POSTs on control-1 in two minutes. 213.209.159.154 took 2 credentials on canary-farm-1 (4 in 6 days).
  • What it means: the census tool circulates between operators and keeps working. The new block got credentials on its first run, so its 3 canaries are now on the use-side watch. control-1's +61% traffic day came from these scans plus the standing Pfcloud loop — not from genuinely new finders.

OMEGA-SWEEP — the fleet's widest config census, disguised as Google's crawler

  • Who: 79.124.58.82 (Tamatiya EOOD, Bulgaria). The original 94.154.46.x operator block stayed silent for a 13th window.
  • What they did: third pass in 26 hours — control-1 at 11:00:55–56 EDT on 10-15, 450 events / 450 paths / 106 trap families in under a second, under a forged Googlebot/2.1 identity. The census hit SSH key paths (/.ssh/id_rsa variants), web.config files, Spring Boot actuators, and mints at /jenkins/.env and /strapi/.env (both answered 200). One new credential; 4 total in 6 days.
  • What it means: repeat passes at different hours on the same node is scheduled work by a crew, and the census's family list is still growing (106 families is the largest we have logged).

REGISTRY-HUNT / LeakIX — a public leak-scanning service working our decoys

  • Who: a rotating pool of DigitalOcean addresses; 8 of them ran the farm-side cluster (312 events). Ten runners collected credentials this window: 165.22.34.189 (2, canary-farm-1, 4 in 6 days), 46.101.111.185 (2, control-1, 3 in 6 days), and eight at 1 each — 146.190.63.248 (3/6d), 146.190.103.103 (2/6d), 209.38.248.17, 46.101.1.225, 64.225.75.246, 64.23.218.208 (2/6d), 157.245.113.227 (3/6d), 134.122.28.88 (2/6d).
  • What they did: the usual 27-step journey (tarpit, WebLogic console, Confluence, WHM/cPanel, then the fake Docker registry at /v2/_catalog and /v2/internal/api-gateway/...). The Docker-registry stage caused the week's spikes on four sensors: 45+45 events on control-1 and ru-edge-1 (3.0× their averages), 25+25 on frantech-ts and sponge-01-ts (3.2×).
  • What it means: LeakIX is a known public scanning service (we list it as borderline, not criminal), and its collector base holds steady at about one credential per runner per window. The decoys keep absorbing the work.

CREDENTIAL-DRAIN — the pipeline from stolen canary to attempted AWS use

MEGA-DICTIONARY — the shared malware-URL dictionary, replayed again

  • Who: 23.234.116.20 (tzulo, inc., US) — the same provider block that hosted the №34 replays.
  • What they did: twentieth replay: 13,606 requests / 13,606 distinct paths in about a minute (00:12–00:13 EDT on 10-16) against frantech-ts, using router and IoT device identities. That single replay was 94% of the node's day. No credentials touched.
  • What it means: the dictionary keeps passing between small hosting providers. The deception surface absorbs it at no cost, but it drowns out frantech's real baseline traffic.

GOWEB-PENTEST — a Go-based phpMyAdmin login hammer

  • Who: a new operator, 169.58.99.248 (Contabo GmbH, France). Last window's three operators stayed away.
  • What they did: 151 requests to /phpMyAdmin-5.2/index.php on canary-farm-1 in about a minute (01:05 EDT on 10-16), plus one probe at /admin/sysadmin/index.php. GET-only, no login attempts captured, no credentials.
  • What it means: sixteenth window, nineteenth operator address, fifth network provider — the phpMyAdmin decoys sit on a shared target list that keeps circulating. What the tool wants beyond the login page is still unknown because no request body has been captured.

WP-FORM-BRUTE — distributed WordPress login guessing

  • Who: a pool of 14 addresses on ai-devbox-1, plus the /wp-admin walk leg (7 addresses / 56 events) that returned after missing a window.
  • What they did: probe → password POST → probe cycles against /wp-login.php, with /wp-admin/profile.php and /wp-admin/ checks in between. Forged modern Chrome identities. No credentials taken; volumes stay far below the 200-pair alarm.
  • What it means: steady background guessing with a persistent second stage. No change in intent.

LIBREDTAIL-KIT — a phpunit remote-execution chain

  • Who: a 6-address cluster (7e61a9500d8b) across 5 sensors, down from last window's 13 addresses / 637 events.
  • What they did: the known chain — phpunit probe, a request that would print an SSH private key as a success signal, then a /bin/sh dropper request. The dropper host was not captured this window. No credentials.
  • What it means: the kit keeps rotating low-volume runners. The fake webshells and tarpits held every time.

MALWARE-DICT — the Pfcloud dropper-URL loop

  • Who: 204.76.203.18 (Pfcloud UG, Netherlands), day 25+ on control-1.
  • What they did: the continuous loop ran 2,066 events / 578 paths — 38% of the node's traffic.
  • What it means: a standing operator that never leaves; volume moves with whatever else hits the node.

Standing actors (who keeps coming back)

  • 45.148.10.171 — 21st straight window collecting credentials: 5 credentials / 8 mint rows across canary-farm-1 (3), ai-devbox-1 (2), ru-edge-1 (2), control-1 (1); 48 in 6 days; never used one in AWS; touched all 8 sensors (17 events). Our longest-running collector.
  • 204.76.203.18 (Pfcloud) — day 25+ on control-1 (see MALWARE-DICT).
  • REGISTRY-HUNT repeat collectors — 165.22.34.189 (4/6d), 46.101.111.185 (3/6d), 157.245.113.227 (3/6d), 146.190.63.248 (3/6d), 45.138.12.51 (8/6d, 1 on control-1 this window), 109.205.176.10 (7/6d), 64.23.218.208, 134.122.28.88, 146.190.103.103.
  • Bochum softsec crawler (185.73.23.161 "finn" + 185.73.23.162 "goose") — fourth window, on our benign list: 3,719 of netcup-ts's 4,548 events (82%) and 3,260 of sponge-01-ts's 4,121 (79%). Without it, both nodes run a few hundred events a day.
  • TOKEN-CRAWLER pool 45.198.224.x — .124 (87 events) and .125 (72 events) touched all 8 sensors again; no credentials.
  • Tarpit pools — 3e1c5eb879e7 (93 addresses / 643 events fleet-wide), ef1ab74f3d57 (7 / 343), 218630667b2c (7 / 299), 4b4cc0ece037 (7 / 48). Constant background.
  • Benign fixed-cadence probers — 89.248.172.33 (441 events, 7 sensors), 80.82.77.202 (387, 7), 34.140.3.155 (42, all 8), 130.12.180.32 (42, all 8), 71.6.155.70 (8, all 8). Same shapes as before.

Who went quiet: XMLRPC-BRUTE (silent again after one window back), LLM-ENDPOINT-PROBE (no third operator), the GIT-VAULT pair, CONFIG-SWEEP (2nd absence), PROTON-CENSUS (2nd), ORACLE-SWEEP, EMPERORS-KIT (3rd), NIGHTAGENT (8th), KEYHUNT, SS-PROBE, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, ATLASSIAN-REST-PROBE (5th), AKAMAI-VHOST-SCAN (4th), KITEWORKS-CRAWL's registered operators, CONFIGBUNDLE-SWARM, CF-FRONTED CREDSWEEP (13th), the OMEGA /46 block (13th), SI-CENSUS's 102.220.161.x, INFOCREST-KIT's 103.214.20.135, METADATA-HUNT (the 8 marker events in this window are yesterday's 05:57–06:00 EDT run re-counted at the window edge — checked by timestamp, not a repeat), 194.59.31.39, 80.94.95.211.

Network sweeps (Arkime) — the traffic that never asks for a web page

These are SSH connection sweeps against the fleet's public IPs, seen by the packet pipeline on spark. 107,054 inbound sessions this window (+1.8%), 57 client fingerprints. The HTTP traps see none of this.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — the one flagged sweep, day 27: 6,155 sessions from 320 addresses across 167 networks in 61 countries, all port 22, no authentication ever attempted. Its daily address counts: 10-10: 344, 10-11: 303, 10-12: 319, 10-13: 283, 10-14: 336, 10-15: 352, 10-16: 109 (partial day). Busiest sources: 134.122.93.100, 43.153.121.250, 145.239.85.118, 147.90.234.13, 50.6.241.208. Networks include Microsoft (AS8075), Byteplus (AS150436), DigitalOcean (AS14061), OVH (AS16276), Tencent (AS132203).
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go) — the record holder: 31,271 sessions, but from only 65 addresses / 13 networks / 9 countries (down from 108 / 42 / 24). Fewer sources, same volume — each source is doing more. Addresses on its /24 (109.160.32.163) also ran command surveys on the frantech honeypot this window.
  • 16443846184eafde36765c9bab2f4397 — day 19, still unnamed: 9,853 sessions (down 35%), 32 addresses / 23 networks / 18 countries, single-source shape, still under the 50-address naming floor.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc) — back in the table after its pause: 355 sessions from 39 addresses / 34 networks / 21 countries in a 48-minute burst (12:50–13:38). Below the 50-address flag line, so unflagged.
  • New: 2ec37a7cc8daf20b10e1ad6221061ca5 — 2,018 sessions from just 18 addresses on 3 networks / 4 countries, running all day. Unnamed. The narrow source set with steady volume is what makes it worth watching.
  • Also in the table: 084386fa7ae5039bcf6f07298a05a227 (78 sessions / 53 addresses), 03a80b21afa810682a776a7d42e5e6fb (644 / 34), dd9bcf093c355da7000132131cb36fd0 (30 / 28, one network).
  • contabo-sponge-02-ts — the ninth sensor's session tag (9,765 yesterday) is missing today. Either provisioning stalled or the tag dropped; we check next cycle.

Canaries (minted and used) — fake credentials as tripwires

No canary credential was used in AWS this window. The fleet minted 38 credentials (41 raw mint rows) for 27 collector addresses. Use outcomes: 0 successes, 0 failures. Mint failures on our side: 28 rejected mints (upstream rejections when requests come in bursts) — canary-farm-1 10, control-1 7, ru-edge-1 7, ai-devbox-1 4; 4 of those belong to 155.117.232.31. No key errors. Running total of mint rows: 2,336.

Who took credentials this window (address — sensor, count, history):

Long-standing collectors still holding unused credentials (the full 6-day standing list): 45.148.10.171 — 48 (2026-10-09 04:49 → 2026-10-15 17:42); 35.253.66.111 — 41 (2026-10-13 10:37, one burst); 34.124.231.201 — 40 (2026-10-10 04:05, one burst); 87.120.104.29 — 18 (2026-10-09 06:12 → 2026-10-13 19:31); 209.159.155.142 — 12 (2026-10-11 01:40 → 02:15); 206.209.210.3 — 11 (2026-10-10 08:02 → 2026-10-15 11:17); 2a02:c207:2350:9697::1 — 11 (2026-10-12 08:22 → 17:08); 208.84.100.218 — 10 (2026-10-09 04:22 → 2026-10-12 17:51); 80.94.92.65 — 10 (2026-10-09 11:59 → 2026-10-11 17:52); 169.58.180.111 — 9 (2026-10-12 08:22 → 17:08); 173.249.253.116 — 8 (2026-10-12 23:08 → 2026-10-13 07:24); 194.59.31.39 — 8 (2026-10-14 13:54 → 19:54); 45.138.12.51 — 8 (2026-10-10 18:27 → 2026-10-16 01:31); 103.214.20.135 — 7 (2026-10-14 01:15 → 05:45); 109.205.176.10 — 7 (2026-10-09 05:41 → 2026-10-15 21:41); 167.99.79.44 — 7 (2026-10-12 17:35 → 17:54); 102.220.161.139 — 6 (2026-10-12 09:24 → 09:59); 213.209.159.175 — 6 (2026-10-10 23:11 → 2026-10-15 03:07); 80.94.95.211 — 6 (2026-10-10 20:25 → 2026-10-15 03:19); 140.245.97.208 — 5 (2026-10-13 15:46 → 15:51); 37.60.226.187 — 5 (2026-10-10 00:57 → 2026-10-14 16:42); 128.199.182.55 — 4 (2026-10-09 19:48 → 2026-10-14 20:07); 139.59.231.238 — 4 (2026-10-09 19:46 → 2026-10-14 19:58); 165.22.34.189 — 4 (2026-10-11 19:58 → 2026-10-15 21:06); 167.172.232.142 — 4 (2026-10-10 19:58 → 2026-10-14 20:10); 167.71.81.114 — 4 (2026-10-09 19:48 → 2026-10-12 20:41); 185.177.72.64 — 4 (2026-10-11 23:36 → 2026-10-14 22:52); 213.209.159.154 — 4 (2026-10-11 01:02 → 2026-10-15 09:15); 79.124.58.82 — 4 (2026-10-14 18:50 → 2026-10-15 11:00); 102.220.163.155 — 3 (2026-10-15 10:21 → 13:10); 146.190.63.248 — 3 (2026-10-09 19:59 → 2026-10-15 17:50); 157.245.105.107 — 3 (2026-10-09 21:03 → 2026-10-14 20:11); 157.245.113.227 — 3 (2026-10-11 19:59 → 2026-10-15 18:39); 167.99.182.39 — 3 (2026-10-09 19:48 → 2026-10-13 20:47); 172.239.158.26 — 3 (2026-10-14 06:36 → 11:53); 172.93.215.8 — 3 (2026-10-11 00:27 → 2026-10-12 16:55); 206.189.233.36 — 3 (2026-10-09 23:12 → 2026-10-13 20:47); 209.99.188.170 — 3 (2026-10-09 03:48 → 18:35); 217.60.76.167 — 3 (2026-10-10 03:42 → 2026-10-12 10:00); 46.101.111.185 — 3 (2026-10-12 20:06 → 2026-10-15 20:32); 64.227.70.2 — 3 (2026-10-09 19:46 → 2026-10-12 20:30); 68.183.9.16 — 3 (2026-10-09 20:07 → 2026-10-10 02:21).

How the fleet behaved (Fleet Observations) — volume, attribution, and what moved

  • Traffic by node (events, change vs 7-day average): ai-devbox-1 1,822 (−7%), canary-farm-1 2,453 (+6%), control-1 5,453 (+61%), frantech-ts 14,423 (−2%), lauterbourg-01-ts 1,111 (−34%), netcup-ts 4,548 (+90%), ru-edge-1 1,438 (−17%), sponge-01-ts 4,121 (+94%). Every big move has a cause: netcup and sponge moved because of the Bochum research crawler; control-1 because three census operators plus the Pfcloud loop landed on it; lauterbourg fell because last window's big scans did not repeat.
  • All 20 of this window's alarm-level tag spikes are attributed. The webshell-probe spikes (68 on ai-devbox-1, 68 on canary-farm-1, 146 on control-1 = 26.5×) belong to the 102.220.163.155 scan and Techoff's 93.123.109.226; the phpinfo spikes (57, 60, 74) come from the same scans; the docker-registry spikes on four sensors come from REGISTRY-HUNT; ru-edge-1's env-production-error 38 comes from 155.117.232.31; frantech's phpmyadmin-login 155 comes from the GOWEB/REGISTRY-HUNT phpMyAdmin passes.
  • Canary economics: 41 mint rows → 38 credentials → 27 collectors → 0 used. 28 rejected mints, all burst-related (see Canaries above). Running total: 2,336 mint rows. Per node: canary-farm-1 13, control-1 12, ru-edge-1 9, ai-devbox-1 7.
  • Attribution: forged forwarding headers stay under control — 822 requests carried any X-Forwarded-For, 26 carried internal-only values, 25 carried forged multi-hop chains (the first non-zero count in the recent record; none were accepted as the source, so attribution held), and 0 requests on direct connections named a different source than the one they came from. The 25 forged chains are new behavior; we characterize them next cycle.
  • TLS decoys: visitors still hit the bare IP addresses far more than the fake hostnames — ai-devbox's inference.fapthropic.com took 747 events against 1,179 bare-IP, canary-farm's sso.rightabouteverything.show 189 against 2,342, lauterbourg 42 HTTPS against 1,069 bare-IP.
  • control-1 ramp (day 33): 5,453 events from 133 unique addresses — the node's highest volume ever, but the address count sits inside the usual 84–157 band for a 25th straight window. The volume record is census traffic, not new discoverers.
  • Watch-class singles (one run so far, no campaign): 155.117.232.31 — a mixed toolkit scan (stale Firefox/77 and Chrome/91 identities) across 4 sensors, 182 events, including 22 phpMyAdmin logins, 4 phpunit probes, and 4 failed credential mints; 176.123.5.6 (Alexhost Srl, Moldova) — a 9-identity census on lauterbourg with 14 Kiteworks bundle fetches (305 events / 252 paths / 19 families, first-seen /mifs/user/login.jsp, /actuator/env, .js.map source maps) plus 15 events on canary-farm-1; 74.208.99.178 (IONOS) — light phpinfo probes and 1 credential on ai-devbox-1 (2 sensors, 38 events). 141.255.162.237 did not run again — its 537-event row in this digest is yesterday's run re-counted at the window edge (checked by timestamp).

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is a single real honeypot host (SSH on port 2222, telnet on 2323) — one machine, so these are not fleet numbers.

  • The funnel: 444 addresses tried passwords → 340 got a shell (77%) → 268 ran a command (79% of shell-getters, 60% of addresses). In raw events: 26,822 password attempts → 3,819 accepted logins → 4,791 commands.
  • Telnet (botnet noise): 5,292 attempts, back up from last window's 717.
  • No new commands. For the 26th straight window, every command an operator ran was already in our library (0 of 53 distinct). The most common stay the .ssh folder replant (cd ~; chattr -ia .ssh; lockr -ia .ssh, 1,173 events / 224 addresses) and the key-replace chain (1,055 / 204). Hardware surveys continue: 109.160.32.163's group (the GO-SSH-SWEEP /24) ran uname checks 777+777 times from 13 addresses, 62.171.133.1 solo (122+122), and 193.32.162.84's group 256 events / 7 addresses. A new command would be real news — it would mean an operator doing something we have not seen.
  • Passwords: 17,002 distinct pairs tried, 0 new. The same two pairs dominate for an eighth window: 345gs5662d34/345gs5662d34 (1,126 attempts) and root/3245gs5662d34 (865).

Open questions

  1. Will 102.220.163.155 spread to more nodes, and will any of its 3 credentials get used? Its scan pacing (ai-devbox-1 10:21, canary-farm-1 12:37, control-1 13:10 EDT) is the fingerprint to match.
  2. Will 79.124.58.82 run a fourth pass or reach a third node? Either would confirm the standing-crew read.
  3. When does the 189-credential zero-use streak break — by expiry or by use? The three big hoards (45.148.10.171 with 48, 35.253.66.111 with 41, 34.124.231.201 with 40) age toward expiry; Tracebit's alert feed is the only witness.
  4. Why did GO-SSH-SWEEP concentrate to 65 addresses / 13 networks while setting a session record? One more window — or a comparison of connection settings across old and new sources — tells us if one crew took over the tool.
  5. What is 2ec37a7cc8daf20b10e1ad6221061ca5? 2,018 sessions from 18 addresses on 3 networks, all day, unnamed. We name it if it spreads or crosses the 50-address line.
  6. Who sent the 25 requests with forged multi-hop forwarding chains, and is it one actor or several? None were accepted as the source, so nothing was misattributed.
  7. Did contabo-sponge-02-ts's provisioning stall, or did its session tag drop? Its 9,765 sessions from yesterday are absent today.
  8. When does the honeypot's 26-window command drought end? New commands are the only post-compromise signal this pipeline has.

Plain language version of: flux-fleet-intel-briefing-2026-10-16.md