Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №55 — PLAIN LANGUAGE

Period: 2026-10-17 07:33 – 2026-10-18 07:33 UTC (24h, day 53 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-18.md

What happened (plain)

Attackers took 45 of our fake AWS keys from the honeypots during the day and really used 11 of them — 2,227 calls inside Amazon's cloud. One computer, 168.222.244.156, checked the keys from seven different LeakIX scanners against 23 Amazon services in a fixed loop, about 289 calls per key. Another computer, 185.209.196.169, used the keys from a new scanner we named WebSiphon and tried to rent Amazon servers with them; Amazon refused both attempts. Every call that succeeded (1,051 of them) was only an identity check (sts:GetCallerIdentity); the policy called legacyOwnerAccess-DenyAll refused the other 1,176 calls. Separately, the MEGA-DICTIONARY replay came back after one quiet day: two new hosts ran the same 13,612-address list against frantech-ts and caused almost all of that node's traffic jump to 28,291 events (+121%).

What it means (plain)

  1. The stolen keys feed an automated checking tool, not random curiosity. Seven keys from seven different LeakIX scanner computers were tested by the same routine from the same address, 168.222.244.156, minutes after they were stolen. (High confidence — the Tracebit alert logs show this directly. We do not know whether that address belongs to LeakIX or to someone who bought the keys.)
  2. For the first time, someone tried to rent servers with a stolen canary key. The calls were ec2:RunInstances and ec2:PurchaseCapacityBlock, both refused. (High confidence that the calls happened; Moderate on what the attacker wanted — a test of what the key allows and a real launch attempt look the same from outside.)
  3. The MEGA-DICTIONARY wordlist is a shared tool, not one gang. Two new hosts on unrelated providers (Datacamp Singapore, M247 Europe) fetched the same list, and 13,606 of the 13,612 paths (99.96%) were already in our records from 20 earlier replays by at least six other hosts. (High confidence — the path comparison is exact. How operators pass the list around is unknown.)
  4. The Cloudflare address in front of ai-devbox-1 is being used to fake origins. A burst at 13:04 UTC claimed source addresses that cannot exist — two of them are multicast addresses (225.237.161.35, 233.90.58.220) — and two stolen canaries carry those impossible labels. The real visitor is hidden behind Cloudflare edge 104.28.250.135. (High confidence on how the trick works; the real source is unknown.)

Campaigns (who / what / what it means)

CREDENTIAL-DRAIN — the steal-it-then-use-it pipeline for fake AWS keys

  • Who: mint side: 45 keys to 33 collector addresses (53 issued log rows before dedupe). Use side: 168.222.244.156 (the 23-service sweep), 185.209.196.169 (WebSiphon's keys — that network also hosted MEGA-DICTIONARY replays in the past, an unproven link), and 137.23.38.53, which tested two keys it stole itself.
  • What they did: the sweep walked EC2 (12 Describe calls), RDS, KMS, Secrets Manager, SSM, DynamoDB, Lambda, EKS, CodeBuild, CodePipeline, and CloudFormation, plus GetCallerIdentity, using the tool fingerprint Boto3/1.43.114 on Linux. The most-refused calls were DescribeParameters (119 times), ListSecrets (91), ListKeys (91), DescribeDBInstances (84), ListTables (84). Outcome: 1,051 identity checks succeeded; 1,176 calls were refused. WebSiphon's keys drew SSM GetParameter, EC2 DescribeVpcs/DescribeImages/DescribeCapacityBlockOfferings, Service Quotas reads, and the two refused server-rental calls.
  • What it means: collectors now screen stolen keys service-by-service before using them, and one actor probed for compute-launch power. The deny-all policy held. Any success beyond GetCallerIdentity is the alarm.

WEBSIPHON — a new scanner that reads 292 config and secret files in 7 seconds

  • Who: 147.224.147.131, an Oracle US address, on ru-edge-1 only. It announces itself honestly as WebSiphon/next-0.1.
  • What they did: at 12:36:43 UTC it hit 380 events across 292 paths and 71 trap families in 7.3 seconds — the second-highest family count we have ever recorded. It took a fake key at /.env first, then swept every .env variant, cloud configs (Terraform state ×8, Kubernetes secrets ×5, AWS credential files ×5, Firebase, serverless, Streamlit).
  • What it means: this is purpose-built cloud-secret hunting, and its operator went straight to AWS with the take. Watch for a second node or address; the user-agent is the fingerprint.

REGISTRY-HUNT / LeakIX — the leak-scanner fleet that keeps taking keys

  • Who: about 18 keys went to 16 l9scan addresses in the 19:58–20:42 UTC wave (64.23.218.208 took three, 157.230.19.140 two, the rest one each). A 36-address tarpit-only sibling cluster also ran.
  • What they did: the same 27-step journey as always — WebLogic console, Confluence, WHM/cPanel, then the fake Docker registry — and now, for the first time we can see, their keys were checked in AWS by 168.222.244.156.
  • What it means: the "public leak scanner" label no longer means harmless; its take gets inventory-swept within minutes.

BUCKLOG-KIT — an attacker kit that tries to run code on the fake web server

  • Who: 185.177.72.50 (Bucklog SARL, France, on two blocklists) on sponge-01-ts, 304 events and 40 POSTs to the fake phpunit webshell, in three passes (05:31, 10:53, 23:11–23:17 UTC).
  • What they did: passes 1 and 2 repeated the known kit — an md5 check-in, readers for .env, Laravel configs, logs, and an SQLite database, a sweep for .ssh/id_rsa, .ssh/id_ed25519, and .aws/credentials, and a command probe (id; hostname; uname -a). Pass 3 was new: a battery that tests which PHP tricks work on the target — AUDITOK| version dump, a shell_exec availability check, ID: and ENV: probes, four different execution tests including <?php system("id"); ?>, and a dump of every environment variable name. The fake server answered 200 to everything.
  • What it means: the operator is mapping what it can run, not just what it can read. Whether any answer contained real bytes is still unmeasured — second cycle with that gap.

MEGA-DICTIONARY — a shared shopping list of malware download links

  • Who: 138.199.60.3 (Datacamp Singapore, 13,669 events, 07:21–07:25 UTC) and 146.70.200.3 (M247 Europe, 13,612 events, 00:31–00:32 UTC), both on frantech-ts. Sixth and seventh hosting provider on this list.
  • What they did: both fetched the same 13,612 dropper-URL paths; 13,606 of them (99.96%) match earlier replays, 6 are new. They used hundreds of fake router and gadget user-agents, sent no forms, took no keys. The two replays were 96% of the node's traffic.
  • What it means: the list circulates among unrelated customers; the hosts are disposable, the list is the thing to track.

INFOCREST-KIT — a recycled break-in kit with fresh passwords

  • Who: 37.19.200.138 (Datacamp US) hit three nodes in one session — canary-farm-1 (106 events), lauterbourg-01-ts (180), ai-devbox-1 (115) — and took 2 keys.
  • What they did: posted database-login forms to three adminer paths as user prod_rw with password ZbtXxWNnjb15U0CjE1zYTw, pushed WordPress batch requests, tried a form login (user=root&pass=wrong), and on lauterbourg also probed the Kiteworks decoy (8 POSTs, a 401 login attempt). User-agents rotated (Firefox/105, python-requests/2.32.5, Chrome/106, Chrome/107).
  • What it means: a commodity kit that now rides the Kiteworks decoy too. Operator and password change every run, as the registry predicts.

GOWEB-PENTEST — one tool hammering one fake phpMyAdmin login page

  • Who: 198.100.154.28 (OVH Canada), the twenty-first operator address, first time on frantech-ts.
  • What they did: 151 visits to /mysql/webdb/index.php in 13 seconds under the honest name Go Web Pentest Tool; GET only, no forms, no keys. It caused frantech's phpmyadmin-login spike (152 events, 6.3× normal).
  • What it means: the decoy login pages are on a widely circulated target list. We still have never captured a real password attempt from this tool.

OMEGA-SWEEP — the registered 150-path census crew is back

  • Who: 79.124.58.82 (Tamatiya EOOD, Bulgaria) on sponge-01-ts. The 94.154.46.x block stayed away a 15th day.
  • What they did: the familiar 150-path pass — 150 visits, 150 paths, 5 families, about a minute, at 22:30 UTC.
  • What it means: the crew read from №52–№53 resumed; watch whether the old three-passes-per-26-hours rhythm returns.

KEYDROP-SCANS — a banner scanner that turned out to collect keys (promoted from watch)

  • Who: 104.64.127.170 and 172.105.54.41, announcing Keydrop.io/1.0(onlyscans.com/about). Between them they touched all 8 sensors.
  • What they did: a tiny two-request check per node — /.env plus /.git/config — and it took a key on every canary node it could: ru-edge 07:08, control 09:19, canary-farm 11:29, ai-devbox 13:04 UTC. Four keys.
  • What it means: exactly the promotion condition we set in №54. A "banner scanner" that collects credentials is a collector; the four keys are stolen inventory.

ATLASSIAN-REST-PROBE — Jira and Confluence probing on the Kiteworks decoy

  • Who: the same 7-address cluster (b3c6048a4870) on lauterbourg-01-ts, 280 events, second window in a row; four of its addresses also took keys elsewhere this window.
  • What they did: the Kiteworks redirect, a WebLogic console probe, then a Jira archive walk. The registered version-check stage (/rest/api/2/serverInfo) did not appear — zero hits.
  • What it means: we keep the moderate-confidence link to the registered campaign. A third window with the version check present would settle it.

WP-FORM-BRUTE — slow password guessing at fake WordPress logins

  • Who: a pool of 53 addresses (up from 47) plus a separate wp-admin leg that grew from 5 to 15 addresses (120 events).
  • What they did: probe, one password guess, probe again, with forged Chrome user-agents; no keys taken; far below the 200-pair alarm.
  • What it means: steady background noise, but the wp-admin leg's 3× address growth is worth watching.

Standing actors (who keeps coming back)

  • 45.148.10.171 collected keys for the 23rd day in a row (3 this window, 43 in six days) and has never used one.
  • 204.76.203.18 (Pfcloud) replayed its malware-link loop on control-1 for a 27th day — 2,047 of the node's 3,050 events.
  • The Bochum university research crawler (185.73.23.161 finn, 185.73.23.162 goose) returned for a sixth window; it is on our benign list and made up 83% of netcup-ts (4,175 of 5,050) and 78% of sponge-01-ts (4,170 of 5,346). Without it both nodes are quiet.
  • TOKEN-CRAWLER (45.198.224.124/.125) touched all 8 sensors again; no keys.
  • Repeat collectors to watch: 92.38.172.10 (3 keys in six days), 23.234.78.109 and 192.253.248.173 (2 each, across two sensors each), the python-requests pair 213.254.175.25/.244, and two new addresses in an otherwise-friendly network — 130.12.180.168/.171 took keys at 16:49 UTC; friendly-by-association does not apply, so we watch them.
  • Benign fixed-cadence probers unchanged: 89.248.172.33 and 80.82.77.202 (378 events each, 7 sensors), 34.140.3.155, 130.12.180.32.

Network sweeps (Arkime) — what hit the fleet's doors before anyone logged in

Four banner sweeps hit the fleet's SSH doors (port 22) from rotating addresses; the pcap sensor sees them because the HTTP traps cannot — a banner sweep never requests a page.

  • GO-SPRAY-SWEEP (06ff3615a51b…) crossed the "dispersed" line again: 255 sessions from 54 addresses in 33 networks. Its pattern is bursty re-crossings (№28, №32, now №55).
  • GO-SSH-SWEEP (0a07365cc01f…) set a record spread: 29,216 sessions from 124 addresses (+49 in a day) across 54 networks in 23 countries. Its busiest single address, 192.253.248.216, sits in the same /24 as an HTTP-side key collector (192.253.248.173) — noted, not merged.
  • GO-SCATTER-SWEEP (16443846184e…) confirmed its second dispersed window: 13,044 sessions, 55 addresses, 22 networks. It still never logs in.
  • LIBSSH-MASSSWEEP (f555226df196…) held its month-long plateau on day 29: 4,816 sessions from 268 addresses across 138 networks in 53 countries.
  • Below the flag line but rising: fingerprint 98ddc5604ef6… (3,475 sessions, +2,455, 20 addresses, 15 days on record) — watch. Fingerprint 4e066189c3bb… carried 16,595 sessions on 11 addresses, mostly against control-1.
  • One housekeeping note: Arkime's sensor labels drifted (bahrain-sponge-01-ts, ru-vps-01-ts, contabo-sponge-02-ts no longer label their own nodes' traffic). The per-node numbers are keyed by IP and unaffected.

Canaries (minted and used) — this was a heavy-use window

The fleet minted 45 fake credentials to 33 collector addresses (53 issued log rows before dedupe). Eleven credentials were used in AWS: 1,051 identity-check calls succeeded, 1,176 other calls were refused. Eight mint attempts failed with upstream 400 errors (ai-devbox-1 4, canary-farm-1 3, ru-edge-1 1) — burst speed, the known cause; no key-format failures. All-time issued counter: 2,469.

Every collector this window, with key counts and six-day history (0 AWS use unless marked):

  • 137.23.38.53 — canary-farm-1, 2 mints — 2 used: identity check only, from itself — first mint 2026-10-17 20:22
  • 147.224.147.131 (WebSiphon) — ru-edge-1, 1 mint — 2 used: the inventory + server-rental attempt — mint 2026-10-17 12:36
  • 138.68.82.23 — canary-farm-1, 1 mint — 1 used: the 23-service sweep — mint 2026-10-17 20:23
  • 147.182.200.94 — canary-farm-1, 1 mint — 1 used (same sweep) — 4 mints since 2026-10-11 20:15
  • 157.230.19.140 — ai-devbox-1 + control-1, 1 each — both used (same sweep) — 2 mints since 2026-10-17 19:58
  • 159.223.132.86 — ru-edge-1, 1 mint — 1 used (same sweep) — 3 mints since 2026-10-14 20:28
  • 164.90.228.79 — ai-devbox-1, 1 mint — 1 used (same sweep) — 2 mints since 2026-10-16 20:15
  • 167.71.175.236 — control-1, 1 mint — 1 used (same sweep) — mint 2026-10-17 20:09
  • 64.23.218.208 — canary-farm-1, 1 mint — 1 used (same sweep) — 5 mints since 2026-10-14 20:03
  • 213.209.159.175 — control-1, 4 mints, 0 used — 12 mints since 2026-10-12 19:47
  • 45.148.10.171 — canary-farm-1 2 + ru-edge-1 1, 0 used — 43 mints since 2026-10-11 04:19
  • 104.251.180.112 — ai-devbox-1, 1, 0 used — since 2026-10-17 14:48
  • 104.64.127.170 — canary-farm-1 + control-1, 1 each, 0 used — 3 mints since 2026-10-17 07:08
  • 109.205.176.10 — ru-edge-1, 1, 0 used — 7 mints since 2026-10-11 11:37
  • 130.12.180.168 — ai-devbox-1, 1, 0 used — since 2026-10-17 16:49
  • 130.12.180.171 — canary-farm-1, 1, 0 used — since 2026-10-17 16:49
  • 159.89.12.166 — canary-farm-1, 1, 0 used — 4 mints since 2026-10-12 20:41
  • 165.22.34.189 — canary-farm-1, 1, 0 used — 5 mints since 2026-10-11 19:58
  • 167.172.232.142 — ai-devbox-1, 1, 0 used — 4 mints since 2026-10-12 19:55
  • 167.99.210.137 — ai-devbox-1, 1, 0 used — 2 mints since 2026-10-14 20:01
  • 172.105.54.41 — ai-devbox-1, 1, 0 used — since 2026-10-17 13:04
  • 192.253.248.173 — canary-farm-1 + control-1, 1 each, 0 used — 2 mints since 2026-10-17 08:43
  • 204.184.134.5 — ai-devbox-1, 1, 0 used (source label forged — see What it means #4) — since 2026-10-17 13:04
  • 213.254.175.244 — ai-devbox-1, 1, 0 used — since 2026-10-17 16:39
  • 213.254.175.25 — ai-devbox-1, 1, 0 used — since 2026-10-17 13:02
  • 23.234.78.109 — ai-devbox-1 + canary-farm-1, 1 each, 0 used — 2 mints since 2026-10-17 20:53
  • 233.90.58.220 — ai-devbox-1, 1, 0 used (multicast source label — forged) — since 2026-10-17 13:04
  • 37.19.200.138 — ai-devbox-1 + canary-farm-1, 1 each, 0 used — 2 mints since 2026-10-17 17:24
  • 64.227.70.2 — canary-farm-1 + ru-edge-1, 1 each, 0 used — 3 mints since 2026-10-12 20:30
  • 64.89.163.14 — ai-devbox-1, 1, 0 used — since 2026-10-17 22:50
  • 80.94.92.126 — canary-farm-1, 1, 0 used — since 2026-10-17 10:09
  • 85.155.14.16 — control-1, 1, 0 used — since 2026-10-18 03:19
  • 92.38.172.10 — canary-farm-1, 1, 0 used — 3 mints since 2026-10-16 23:16

Long-haul hoards with no observed use (all times from the six-day Tracebit window): 45.148.10.171 (43), 35.253.66.111 (41), 213.209.159.175 (12), 87.120.104.29 (12), 2a02:c207:2350:9697::1 (11), 140.245.97.208 (9), 169.58.180.111 (9), 206.209.210.3 (9), 45.138.12.51 (9), 173.249.253.116 (8), 194.59.31.39 (8), 103.214.20.135 (7), 109.205.176.10 (7), 167.99.79.44 (7). Whether these keys are hoarded, resold, or used where Tracebit cannot see is an open question.

How the fleet behaved (Fleet Observations) — volume moves and what caused them

  • frantech-ts +121% (28,291 events): the two MEGA-DICTIONARY replays, 96% of the node.
  • sponge-01-ts +67% (5,346): the Bochum crawler (4,170) plus Bucklog's three runs (304) plus OMEGA's 150-path pass.
  • netcup-ts +42% (5,050): the Bochum crawler again (4,175, 83%).
  • control-1 −12% (3,050): the Pfcloud loop (2,047) is the base load; no census bursts. Its unique-IP count (106) sat in the usual 84–157 band for a 27th straight day.
  • ru-edge-1 −36% (981): no census bursts; WebSiphon's 380 events were the largest share.
  • canary-farm-1 −19% (1,943): CREDSWEEP's .155 stayed away; the LeakIX farm cluster (246) was the biggest block.
  • ai-devbox-1 −12% (1,763).
  • lauterbourg-01-ts −23% (1,247): watch-single 45.67.216.15 stayed away; the Atlassian cluster (280) and INFOCREST (180) partly filled the gap.
  • Every result-tag spike has a cause: frantech phpmyadmin-login 152 (6.3×) = GOWEB-PENTEST's 151; ai-devbox wp-admin-redirect 42 (4.8×) and wp-login-credentials 95 (3.1×) = WP-FORM-BRUTE's legs; lauterbourg method-not-allowed 22 (3.9×) = OPTIONS/PROPFIND probes led by 45.79.190.96 (13).
  • Attribution: the multi-entry forged-header count returned to 0 (watch closed). The single-entry mismatch count was 21: 20 came from the Cloudflare-fronted burst with impossible source labels, 4 rows were X-Forwarded-For: 1.2.3.4 tests from the benign-listed prober 162.243.83.227, and 1 was a genuine forged header on lauterbourg — a self-described "benign detection probe" tool claiming source 136.107.40.111 over a Brazilian connection (177.136.231.47).
  • The "first-seen" file lists cluster at the 03:15 sync minute across 7 sensors — that is when logs arrive, not when the scans happened.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

474 addresses tried passwords; 350 got a shell (74%); 277 ran a command (79% of those who got in). In events: 19,539 password attempts → 3,586 accepted logins → 6,970 commands. Telnet bots: 868 attempts.

No command appeared for the first time — the 28th straight window with zero new commands. The usual set repeats: .ssh folder replanting, hardware surveys (uname, lspci), and path-export recon. Password pairs offered: 13,850 distinct, 0 new. Two fixed pairs dominate: 345gs5662d34/345gs5662d34 (797 attempts) and root/3245gs5662d34 (586) — the same sprayers for a tenth window.

Open questions

  1. Will 185.209.196.169 get past the deny policy and actually rent servers, and will WebSiphon/next-0.1 show up on a second node? We do not know, and the /24 link to old MEGA-DICTIONARY hosts is unproven.
  2. Is 168.222.244.156 LeakIX's own key-checker, or a buyer's? Any AWS call beyond GetCallerIdentity from the seven swept keys (they expired ~07:58–08:42 UTC on 10-18) is the signal.
  3. Did Bucklog's probes get real bytes back from the fake webshell? Our logs record request sizes only, so this stays unmeasured for a third cycle unless a dropper upload appears.
  4. How fast is the MEGA-DICTIONARY wordlist growing? Six new paths this window; a bigger jump or a third operator would say the marketplace is active.
  5. Who are 130.12.180.168/.171? New key-collecting hosts in the /24 of a benign-listed prober — friendly network, unfriendly behavior, so we watch.
  6. When will Arkime's sensor labels be repaired, and did anything else drift with them? That is an ops fix, not something the briefing can change.
  7. Will KEYDROP-SCANS come back for a second minting window? If it does, it becomes a standing collector.