Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №54 — PLAIN LANGUAGE

Period: 2026-10-16 07:33 – 2026-10-17 07:33 UTC (24h, day 52 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-17.md

What happened (plain)

Someone finally used a stolen canary credential. A canary planted at /.aws/credentials on ai-devbox-1, picked up by 209.99.188.170 at 06:25:15Z, was tested in AWS at 08:55:32Z from that same IP with a sts:GetCallerIdentity call, and the call succeeded. The tool that tested it calls itself kingfisher-scanner/1.2.0 — we had not seen that name before. This ended three quiet windows in a row (189 credentials with no use). Separately, a kit we track as BUCKLOG-KIT showed its full attack stage on sponge-01-ts: 185.177.72.50 sent 22 phpunit code-execution requests in 4 seconds, and we captured the payload text. On the counting side, a benign research crawler from Ruhr-Universität Bochum pushed netcup-ts up 63% and sponge-01-ts up 89%, the MEGA-DICTIONARY replay skipped frantech-ts for the first time in 20 windows (the node fell 97%), and OMEGA-SWEEP went completely quiet. In the network data, one scanner fingerprint crossed the "dispersed sweep" line for the first time and is now registered as GO-SCATTER-SWEEP.

What it means (plain)

  1. The stolen password was checked, not used for anything real. The only AWS call was sts:GetCallerIdentity — a "who am I" test. It worked, it came from the same IP that took the credential, 2 hours 30 minutes after the theft, and the tool signed its own name. The credential also came from an AWS-credentials file path (/.aws/credentials), not /.env — the first time a use event traces to that path. (High confidence — the alert log shows all of this directly. Whether the thief was checking stolen goods for resale or for its own use, we do not know.)
  2. BUCKLOG-KIT is a full break-in kit, not just a scanner. The captured requests try to confirm code execution with an md5 check, then read .env files, Laravel config, logs, and an SQLite database through 8-level path escapes, then hunt for .ssh/id_rsa, .ssh/id_ed25519, .aws/credentials, and .git-credentials, then try to run id; hostname; uname -a. The honeypot answered every request with its fake webshell, so the kit got nothing real. (High confidence — we hold the payload text. Whether the kit read any real bytes back is not visible to us.)
  3. Copy-paste census tools keep arriving under new names while stolen credentials pile up unused. This window added four operators: .155 came back for a second pass (4 canaries taken in total), Feo Prest 213.209.159.154 hit three nodes in one day, a new stripped-UA operator 191.217.250.172 took 2 canaries, and GIT-VAULT returned under a fourth 3xK Tech IP. Against all that, the only AWS activity was the single test call. The big hoards (45.148.10.171 with 48 in 6 days, 35.253.66.111 with 41, 34.124.231.201 with 40) still sit unused. (High confidence on the counts; what the hoarders are waiting for is an open question — Tracebit alerts are our only witness for use.)
  4. GO-SCATTER-SWEEP grew by spreading out, not by hitting harder. Sessions rose 35% (9,853 → 13,277) while source addresses doubled (32 → 64 IPs) and networks held at 22–23. Per address, volume actually fell (308 → 207 sessions each). It announces itself as ssh-2.0-go, the same banner family as GO-SSH-SWEEP, but the fingerprint is different, and it never tries a password. (Moderate confidence — the numbers are direct; whether one crew runs both fingerprints is unknown.)

Campaigns (who / what / what it means)

CREDENTIAL-DRAIN — the pipeline from stolen canary to AWS use

  • Who: 55 credentials went to 37 collector IPs this window. The user was 209.99.188.170, testing its own theft. Its neighbor 209.99.189.217 took 2 more; the pair has 287 events in our logs since 10-06.
  • What they did: the canary ai-devbox-1-217.15.163.226-20261016T062515Z-c602f128 was minted 06:25:15Z at /.aws/credentials (fake Chrome/124 Windows browser, plain HTTP) and tested at 08:55:32Z with sts:GetCallerIdentity — success — signed kingfisher-scanner/1.2.0 over a Chrome/140 disguise. One success, zero denied calls. Mint failures: 14×400 (aidev 7, farm 5, ru-edge 2). The standing hoards: 45.148.10.171 48/6d (its 22nd straight minting window — farm 2 + ru-edge 1 this window), 35.253.66.111 41, 34.124.231.201 40, 213.209.159.175 10/6d, 140.245.97.208 9/6d on three sensors, 45.138.12.51 10/6d.
  • What it means: collectors test what they steal before (or instead of) using it. The alarm bell for next cycle is any AWS call from this IP beyond the "who am I" test.

CREDSWEEP — the .env directory-fanout census

  • Who: 102.220.163.155 (VPS Dedicated LLC SI — the same org as SI-CENSUS) on canary-farm-1 only, 514 events between 22:57 and 00:46 EDT, 1 canary taken at 22:57:50 EDT (4 in total). Feo Prest 213.209.159.154 on three nodes: netcup-ts 171 events in 4 seconds (18:18 EDT), sponge-01-ts 171 events in 11 seconds (23:42 EDT, same 167 paths), control-1 46 events (20:49 EDT) plus 2 canaries. Its partner 213.209.159.175 took 4 on control-1 (10/6d). New operator 191.217.250.172 ("Samuel Dierich", US) on ai-devbox-1: 178 events in 5 minutes (08:12–08:17 EDT), 2 canaries at the start and end of the walk.
  • What they did: the same pscan-<random> directory fanout as before. Feo Prest wore three antique browser disguises (Safari/7.1.8 on macOS 10.9, Android/4.1.2, Chrome/11 on Windows XP). The newcomer used a bare, stripped Chrome string and also probed /@fs/.env and /@fs/.env.local — the Vite marker from METADATA-HUNT, showing that template circulating inside other people's censuses.
  • What it means: the fanout census is shared tooling that now runs under at least four organizations. A new operator converting canaries on its first run makes it a use-side watch item.

BUCKLOG-KIT — the phpunit break-in kit

  • Who: 185.177.72.50 (Bucklog SARL FR, on blocklists ipsum:3 and firehol2) on sponge-01-ts, 05:30–05:31 EDT, 277 events / 191 paths / 22 POSTs in 4 seconds. The census arm 185.177.72.64 worked the same node at 12:53–12:55 EDT (258 events).
  • What they did: nine tries at /_ignition/execute-solution (404) mixed with 13 posts to the phpunit eval-stdin.php path (the fake webshell answered 200), in this order: an md5 hand-shake (<?php echo md5("6b3804159d5abceb"); ?>); a ---PATHSCAN_ENV_BEGIN--- reader that walks .env files at five relative depths; config readers (config/database.php, config/app.php, config/mail.php, bootstrap/cache/config.php) limited to $maxfiles=48; $budget=524288 with 8 levels of ../; readers for storage/logs/laravel.log, storage/framework, composer.lock, and database/database.sqlite; a secrets sweep naming .ssh/id_rsa, .ssh/id_ed25519, .aws/credentials, .git-credentials, .npmrc, and more; and a command test: $nonce="d11531bc79e6ccb7"; $cmd="id; hostname; uname -a 2>/dev/null". No dropper and no reverse shell this run.
  • What it means: this family wants code execution and local secrets, not web logins. The decoys fed it fake success at zero cost to us. Whether it read any real bytes back is an open question (see Open questions).

REGISTRY-HUNT / LeakIX — the l9scan template

GOWEB-PENTEST — the phpMyAdmin hammer

  • Who: 190.93.152.243 (Colombia) on canary-farm-1 — the 20th operator IP from a 6th country. №53's operator stayed away.
  • What they did: 151 GET requests on /db/webdb/index.php in about a minute (18:50 EDT) plus 2 side paths (/phppma, /sql/myadmin). The tool signs itself Go Web Pentest Tool. GET-only, 0 POSTs, 0 canaries.
  • What it means: our phpMyAdmin decoys are on a shared target list. We still have never captured a credential body from this tool, so its true intent is unproven.

ATLASSIAN-REST-PROBE — Confluence/JIRA version scans — back after five quiet windows

  • Who: 7 IPs / 280 events on lauterbourg-01-ts (cluster b3c6048a4870, signature first seen 10-10). Four of its runners overlap with REGISTRY-HUNT: 159.89.174.87, 147.182.200.94, 167.172.158.128, 128.199.182.55.
  • What they did: hit the fake Kiteworks root (kiteworks-root-redirect), then the WebLogic console path, then pulled the Jira archive path /download/resources/jira.webresources:color-picker-popup/images/..::×5::META-INF::maven::com.atlassian.jira::atlassian-ji… to read build metadata. The /rest/api/2/serverInfo step from the original registration did not appear.
  • What it means: moderate confidence this is the same family — the shape matches, but the missing REST step and the single-node spread leave room for doubt. One more window settles it.

GIT-VAULT — the git-internals walker

  • Who: 104.167.19.205 (3xK Tech GmbH, US) on canary-farm-1, 06:34:29–32 EDT. The three earlier 3xK IPs and №52's pair all stayed home.
  • What they did: the exact registered shape — 144 events / 142 paths in 3 seconds under the honest git/2.40.0 client, 143 fake-git hits plus 1 .gitignore hit, 0 canaries.
  • What it means: one hosting company keeps circulating this walker across four block IPs. The registry now treats 3xK as the standing operator class.

WP-FORM-BRUTE — the distributed WordPress login brute

  • Who: pool e6e6f15a77e8 with 47 IPs / 141 events; 54 distinct IPs / 165 wp-login events on ai-devbox-1. The wp-admin leg 09d3f351065c ran with 5 IPs / 40 events.
  • What they did: probe → login POST → probe cycles with forged modern Chrome strings. 0 canaries. Far below the 200-pair alarm line.
  • What it means: steady background noise; no change in intent.

MALWARE-DICT — the Pfcloud dropper-URL loop

  • Who: 204.76.203.18 (Pfcloud UG, NL) on control-1, 2,017 events / 569 paths — 74% of the node, and it sits on blocklist ipsum:2.
  • What they did: the same continuous replay of known malware download URLs, day 26 and counting.
  • What it means: a standing multi-host operator; its loop now sets control-1's baseline.

Standing actors (who keeps coming back)

Missing this window: MEGA-DICTIONARY (first miss after 20 replays — the whole reason frantech-ts fell 97%), OMEGA-SWEEP (both 79.124.58.82 and the /46 block — .82's promised fourth pass never came), LIBREDTAIL-KIT, XMLRPC-BRUTE (6 stray events, second quiet window), LLM-ENDPOINT-PROBE (10 stray events), METADATA-HUNT's named runners (only the 4 @fs rows from .172), CONFIG-SWEEP (third absence), NIGHTAGENT (ninth), KEYHUNT, SS-PROBE, ZKILLU-GITWALK, MEVSPACE-GITWALK, SONICWALL-VPN-PROBE, EMPERORS-KIT (fourth), PROTON-CENSUS (third), ORACLE-SWEEP standalone, CF-FRONTED CREDSWEEP (fourteenth), CONFIGBUNDLE-SWARM, SI-CENSUS 102.220.161.x, AKAMAI-VHOST-SCAN (fifth), KITEWORKS-CRAWL's 176.123.5.6, and the older watch singles 155.117.232.31, 194.59.31.39, and 80.94.95.211.

Network sweeps (Arkime) — port-22 scanners we only see in packet data

These sweeps never request a web page, so the honeypots log nothing; only the fleet's own pcap sensors on spark see them. Window 2026-10-16 07:33 → 2026-10-17 07:33 UTC, 108,124 inbound sessions across the 8 fleet public IPs (+1.0%). lauterbourg-01-ts now carries its own tag (12,853 sessions); the contabo-sponge-02-ts tag is missing for a second day.

  • 16443846184eafde36765c9bab2f4397 — now named GO-SCATTER-SWEEP. It crossed the dispersed-sweep line for the first time: 13,277 sessions from 64 source IPs in 22 networks across 17 countries, banner ssh-2.0-go, average 5,655 bytes per session, top sources 89.163.140.136, 77.239.124.34, 77.239.124.80, 77.239.124.33, 51.15.21.35 (networks include Alfahost, Scaleway, WIIT, DigitalOcean, Techoff). Daily source counts: 10-11 49, 10-12 31, 10-13 36, 10-14 41, 10-15 32, 10-16 64, 10-17 24.
  • 0a07365cc01fa9fc82608ba4019af499 — GO-SSH-SWEEP. 26,376 sessions from 75 IPs in 26 networks, 16 countries, banner ssh-2.0-go, average 5,035 B/session; busiest sources 77.239.124.152, 77.239.124.148, 109.160.32.143, 77.239.124.144, 109.160.32.141. Daily IP counts: 10-11 90, 10-12 81, 10-13 97, 10-14 95, 10-15 94, 10-16 80, 10-17 25.
  • f555226df1963d1d3c09daf865abdc9a — LIBSSH-MASSSWEEP, day 28. 4,309 sessions from 241 IPs in 129 networks, 51 countries, banner ssh-2.0-libssh_0.9.6, average 4,918 B/session; busiest sources 118.39.219.45, 129.121.74.52, 43.245.248.2, 129.121.117.162, 50.6.241.208. Daily IP counts: 10-11 303, 10-12 319, 10-13 283, 10-14 336, 10-15 352, 10-16 281, 10-17 62 — inside its usual ~280–360 band.
  • 06ff3615a51b2af343ec22abc8e30bbc — GO-SPRAY-SWEEP stayed off the table; its pause continues.
  • 2ec37a7cc8daf20b10e1ad6221061ca5 — unchanged and unnamed: 2,437 sessions / 18 IPs / 3 networks, below every threshold, day 20.
  • Smaller rows: 084386fa7ae5… 71 sessions / 54 IPs / 5 networks; 03a80b21afa8… 374 / 27 / 18; dd9bcf093c35… 28 / 27 / 1; new to the table e54ef3ec27fe… at 25 sessions / 15 IPs / 7 networks — watch only.

Thresholds: dispersed = 50+ source IPs and 20+ networks on one port; mass = 200+ source IPs. We track the tool fingerprint, never the source IP, because operators rotate addresses and keep the tool.

Canaries (minted and used) — fake AWS keys and where they went

Fleet sensors minted 55 credentials to 37 collector IPs this window (57 raw issued rows: canary-farm-1 21, ai-devbox-1 20, control-1 10, ru-edge-1 6; the four no-canary nodes minted nothing, as designed). One credential was used in AWS — the sts:GetCallerIdentity success described above; 54 were stolen with no observed use. Mint failures: 14×400 (aidev 7, farm 5, ru-edge 2), the usual burst-speed rejections; no 401s. All-time issued-row count: 2,409.

Every collector this window (IP — sensor — mints — used in AWS — history):

  • 213.209.159.175 — control-1 — 4 — 0 — 10 mints since 2026-10-10 23:11
  • 140.245.97.208 — canary-farm-1 — 2 — 0 — 9 mints since 2026-10-13 15:46; also ai-devbox-1 — 1 and ru-edge-1 — 1 (same 9-mint history)
  • 191.217.250.172 — ai-devbox-1 — 2 — 0 — 2 mints since 2026-10-16 08:12
  • 209.38.208.202 — ai-devbox-1 — 2 — 0 — 4 mints since 2026-10-10 20:44; also control-1 — 1 (same history)
  • 209.38.248.17 — canary-farm-1 — 2 — 0 — 4 mints since 2026-10-11 20:32
  • 213.209.159.154 — control-1 — 2 — 0 — 6 mints since 2026-10-11 01:02
  • 45.138.12.51 — ai-devbox-1 — 2 — 0 — 10 mints since 2026-10-10 18:27
  • 45.148.10.171 — canary-farm-1 — 2 — 0 — 48 mints since 2026-10-10 07:09; also ru-edge-1 — 1 (same history)
  • 64.23.218.208 — ai-devbox-1 — 2 — 0 — 4 mints since 2026-10-14 20:03
  • 102.220.163.155 — canary-farm-1 — 1 — 0 — 4 mints since 2026-10-15 10:21
  • 109.205.176.10 — ru-edge-1 — 1 — 0 — 7 mints since 2026-10-10 08:05
  • 128.199.182.55 — ai-devbox-1 — 1 — 0 — 4 mints since 2026-10-10 19:57
  • 129.213.151.234 — ru-edge-1 — 1 — 0 — 2 mints since 2026-10-11 06:49
  • 136.0.82.85 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-16 17:51
  • 138.68.86.32 — ai-devbox-1 — 1 — 0 — 2 mints since 2026-10-14 20:11
  • 142.93.129.190 — ai-devbox-1 — 1 — 0 — 2 mints since 2026-10-10 20:44
  • 143.110.213.72 — ai-devbox-1 — 1 and canary-farm-1 — 1 — 0 — 3 mints since 2026-10-11 19:57
  • 143.110.217.244 — ru-edge-1 — 1 — 0 — 1 mint since 2026-10-16 19:59
  • 143.244.168.161 — canary-farm-1 — 1 — 0 — 3 mints since 2026-10-11 20:35
  • 146.190.63.248 — canary-farm-1 — 1 — 0 — 3 mints since 2026-10-13 20:08
  • 147.182.149.75 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-16 20:02
  • 147.182.200.94 — canary-farm-1 — 1 — 0 — 3 mints since 2026-10-11 20:15
  • 157.245.105.107 — canary-farm-1 — 1 — 0 — 3 mints since 2026-10-12 20:41
  • 159.223.132.86 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-14 20:28
  • 159.89.12.166 — canary-farm-1 — 1 — 0 — 3 mints since 2026-10-12 20:41
  • 159.89.174.87 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-10-16 21:04
  • 164.90.208.56 — control-1 — 1 — 0 — 1 mint since 2026-10-16 20:08
  • 164.90.228.79 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-10 20:05
  • 167.172.158.128 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-12 20:19
  • 167.99.182.39 — ai-devbox-1 — 1 — 0 — 3 mints since 2026-10-12 20:42
  • 206.81.24.227 — ai-devbox-1 — 1 — 0 — 3 mints since 2026-10-10 20:43
  • 206.81.24.74 — canary-farm-1 — 1 — 0 — 1 mint since 2026-10-16 20:03
  • 209.99.189.217 — ai-devbox-1 — 1 and control-1 — 1 — 0 — 3 mints since 2026-10-16 03:02
  • 46.101.1.225 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-15 17:46
  • 64.227.32.66 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-13 20:47
  • 68.183.9.16 — ru-edge-1 — 1 — 0 — 1 mint since 2026-10-16 21:17
  • 92.38.172.10 — ai-devbox-1 — 1 and control-1 — 1 — 0 — 2 mints since 2026-10-16 23:16
  • 209.99.188.170 — mint outside the flux window (Tracebit is the only witness) — 1 used — GetCallerIdentity — 1 mint since 2026-10-16 06:25

Biggest unused hoards (candidates for resale or use we cannot see): 45.148.10.171 48 mints (2026-10-10 07:09 → 2026-10-16 22:35), 35.253.66.111 41 (2026-10-13 10:37), 34.124.231.201 40 (2026-10-10 04:05), 209.159.155.142 12 (2026-10-11), 87.120.104.29 12 (2026-10-13 11:39 → 19:31), 206.209.210.3 11 (2026-10-10 → 10-15), 2a02:c207:2350:9697::1 11 (2026-10-12), 213.209.159.175 10 (2026-10-10 23:11 → 2026-10-16 23:44), 45.138.12.51 10 (2026-10-10 18:27 → 2026-10-17 01:36), 140.245.97.208 9 (2026-10-13 15:46 → 2026-10-16 19:43), 169.58.180.111 9 (2026-10-12), 173.249.253.116 8 (2026-10-12 23:08 → 10-13 07:24), 194.59.31.39 8 (2026-10-14 13:54 → 19:54), 103.214.20.135 7 (2026-10-14 01:15 → 05:45), 109.205.176.10 7 (2026-10-10 08:05 → 2026-10-17 01:38), 167.99.79.44 7 (2026-10-12 17:35 → 17:54), 102.220.161.139 6 (2026-10-12 09:24 → 09:59), 208.84.100.218 6 (2026-10-12 15:41 → 17:51), 213.209.159.154 6 (2026-10-11 01:02 → 2026-10-16 20:49), 80.94.95.211 6 (2026-10-10 20:25 → 2026-10-15 03:19), 80.94.92.65 5 (2026-10-11 13:35 → 2026-10-16 07:17), 102.220.163.155 4 (2026-10-15 10:21 → 2026-10-16 22:57), 128.199.182.55 4 (2026-10-10 19:57 → 2026-10-17 03:52), 165.22.34.189 4 (2026-10-11 19:58 → 2026-10-15 21:06), 167.172.232.142 4 (2026-10-10 19:58 → 10-14 20:10), 185.177.72.64 4 (2026-10-11 23:36 → 10-14 22:52), 209.38.208.202 4 (2026-10-10 20:44 → 2026-10-17 02:37), 209.38.248.17 4 (2026-10-11 20:32 → 2026-10-16 21:02), 37.60.226.187 4 (2026-10-14 07:08 → 16:42), 64.23.218.208 4 (2026-10-14 20:03 → 2026-10-17 04:08), 79.124.58.82 4 (2026-10-14 18:50 → 10-15 11:00), 139.59.231.238 3 (2026-10-11 20:35 → 10-14 19:58), 143.110.213.72 3 (2026-10-11 19:57 → 2026-10-16 19:01), 143.244.168.161 3 (2026-10-11 20:35 → 2026-10-16 21:05), 146.190.63.248 3 (2026-10-13 20:08 → 2026-10-16 21:05), 147.182.200.94 3 (2026-10-11 20:15 → 2026-10-16 18:47), 157.245.105.107 3 (2026-10-12 20:41 → 2026-10-16 18:47), 157.245.113.227 3 (2026-10-11 19:59 → 10-15 18:39), 159.89.12.166 3 (2026-10-12 20:41 → 2026-10-17 02:27), 167.71.81.114 3 (2026-10-12 20:03 → 20:41), 167.99.182.39 3 (2026-10-12 20:42 → 2026-10-17 04:08), 172.239.158.26 3 (2026-10-14 06:36 → 11:53), 172.93.215.8 3 (2026-10-11 00:27 → 10-12 16:55), 206.81.24.227 3 (2026-10-10 20:43 → 2026-10-16 19:01), 209.99.189.217 3 (2026-10-16 03:02 → 11:19), 217.60.76.167 3 (2026-10-10 03:42 → 10-12 10:00), 46.101.111.185 3 (2026-10-12 20:06 → 10-15 20:32).

How the fleet behaved — counts and what moved them

  • Sensors: ai-devbox-1 1,990 events / 178 IPs (−2%); canary-farm-1 2,132 / 133 (−10%); control-1 2,715 / 102 (−27%); frantech-ts 487 / 76 (−97%); lauterbourg-01-ts 1,441 / 124 (−11%); netcup-ts 4,770 / 89 (+63%); ru-edge-1 889 / 104 (−48%); sponge-01-ts 4,894 / 107 (+89%).
  • Why the big moves: netcup-ts and sponge-01-ts rose on the benign Bochum crawler (84% and 72% of each node). frantech-ts collapsed because the MEGA-DICTIONARY replay (13,606 events last window) did not come. control-1 fell 27% because three census operators from №53 left the window; the Pfcloud loop (2,017 events) is now most of its traffic. ru-edge-1 lost CONFIG-SWEEP and OMEGA.
  • Both result-tag spikes explained: canary-farm-1 phpinfo 73 vs a 20.3 average (3.6×) came from 102.220.163.155 (54 of them); lauterbourg-01-ts webshell-probe 42 vs 7.6 (5.5×) came from 45.67.216.15 (28) and 93.152.221.158 (11).
  • Attribution health: XFF headers appeared on 1,711 requests; 6 carried forged multi-hop chains (down from 25 — №53's burst did not continue); 7 were ignored as source; 0 single-entry forgeries. Nobody successfully lied about where they came from.
  • TLS: lauterbourg-01-ts flipped to mostly HTTPS — the fake Kiteworks site kiteworks.rightabouteverything.show took 830 events vs 576 bare-IP (last window: 42 vs 1,069), driven by the Atlassian cluster and Kiteworks-class walkers. ai-devbox-1's fake inference.fapthropic.com led its node at 1,235; canary-farm-1's sso.rightabouteverything.show took 744 vs 1,379 bare-IP.
  • control-1 discovery ramp, day 34: 2,715 events from 102 unique IPs. The IP count has stayed inside the 84–157 band for 26 straight windows — the traffic swings come from a few busy scanners, not new discoverers.
  • Watch singles (no campaign yet): 45.67.216.15 (Contabo FR) — 161 events on lauterbourg-01-ts in one minute (17:15–17:16 EDT) with a forged Chrome/126, mostly webshell-probe (28) and not-handled (93), plus Kiteworks legs and 2 empty POST /; promote it if it returns. 93.152.221.158 — 46 events in 19 seconds (09:19 EDT) across 6 rotating browser strings, 11 webshell-probe; it sits in the same /24 as CONFIG-SWEEP's old operator — note only. 104.64.127.170 and 172.105.54.41 — a Keydrop.io/1.0(onlyscans.com/about) banner scanner, 2 events each on netcup-ts, lauterbourg-01-ts, and frantech-ts in ~1-second bursts (04:30–05:47 EDT).
  • Fleet-side changes: the visuals dashboard's campaign table now marks OMEGA-SWEEP, MEGA-DICT, and LIBREDTAIL-KIT idle and ATLASSIAN-REST-PROBE and GIT-VAULT active; GO-SCATTER-SWEEP joined the recon name map; the visuals page was rebuilt as flux-fleet-visuals-2026-10-17-r2.html.
  • Known quirks, unchanged: "first-seen" timestamps still cluster at the 03:15 log-sync minute (they show when logs arrived, not when scans happened); the hourly histogram prints EDT times under a hour_utc header; the 4-hour ingest offset put one row on the window seam (the validator's mint row; Tracebit's clock wins); ai-devbox-1's rotated-file gap is in its 16th cycle.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host runs separate SSH (:2222) and telnet (:2323) honeypots. This is a single machine's view, never a fleet number. Funnel: 411 sources tried passwords → 324 got a shell (79%) → 265 ran a command (82% of shell-getters, 64% of sources). In events: 19,441 password attempts → 3,765 accepted logins → 6,429 commands (171% of accepted logins led to commands). Telnet attempts: 857, down from 5,292 last window.

No new command appeared — 0 of 54 distinct commands were new, the 27th straight static window. The usual .ssh re-plant stays on top: cd ~; chattr -ia .ssh; lockr -ia .ssh at 1,006 events from 201 IPs, and the key-replace chain at 913 from 191. A hardware-survey battery (142.93.43.28's class, 6 IPs, 342 events each command) keeps running uptime -p, lspci, /bin/./uname -s -v -n -r -m, and nvidia-smi -q product-name lookups; 8.134.58.87 ran 625 echo probes solo. Credentials: 14,371 distinct password pairs offered, 0 new. The same fixed pairs dominate for a ninth window: 345gs5662d34/345gs5662d34 at 951 attempts and root/3245gs5662d34 at 714.

Open questions

  1. What is kingfisher-scanner/1.2.0, and will 209.99.188.170 make any AWS call beyond the "who am I" test? The tested credential is valid until 18:25:16Z, and the same IP holds three canaries from 10-09.
  2. Did BUCKLOG-KIT's 185.177.72.50 actually read anything? The fake webshell answered 200, so the kit saw success; whether real bytes went back needs a response-size check against its test nonce (d11531bc79e6ccb7). A second RCE-stage IP would make this stage standing.
  3. Will GO-SCATTER-SWEEP stay dispersed in a second window, and does one crew run both ssh-2.0-go fingerprints? A KEX/banner comparison against GO-SSH-SWEEP's current sources would tell us.
  4. Is MEGA-DICTIONARY paused or gone? A second straight miss retires its replay schedule; the wordlist stands at 13,606 paths.
  5. Will 102.220.163.155 spread past canary-farm-1? Its second pass was single-node; a third node or an AWS test would confirm the SI org as a multi-template operator.
  6. What happened to the contabo-sponge-02-ts sensor tag in Arkime? It carried 9,765 sessions in №52 and has been absent two days — provisioning stall or a dropped tag, we do not know which.
  7. Will the lauterbourg walkers 45.67.216.15 and 93.152.221.158 return? Either coming back with a canary or a POST body promotes them to campaigns.

Plain language version of: flux-fleet-intel-briefing-2026-10-17.md