Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №56 — PLAIN LANGUAGE

Period: 2026-10-18 07:35 – 2026-10-19 07:35 UTC (24h, day 54 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-19.md

What happened (plain)

A wave of scanning tools hit the decoy servers. Two unrelated hosts ran the exact same 284-path checklist of AI and cloud credential files. Bucklog's scanning crew used three fresh IP addresses in one day. A group of five machines from Tc Datacenter (45.138.12.x) went further than scanning: they tried real attacks, and we captured the attack code. A known attack kit (LIBREDTAIL-KIT) ran from 12 different IP addresses across 6 servers — its widest run on record. The shared IoT dropper-URL list (MEGA-DICTIONARY) came back and grew by 66 new paths, its biggest growth on record. Stolen canary credentials were used 10 times against AWS, but every successful call was only GetCallerIdentity (an identity check). One login-password spray pool tripled to 233 IP addresses and crossed its 200-pair alarm line.

What it means (plain)

  1. Scanning tools are shared property, not gangs. Two hosts on unrelated networks fetched byte-identical 284-path wordlists; Bucklog rotated three fresh IPs; the Tc Datacenter /24 fielded five machines in a relay; MEGA-DICTIONARY's shared list grew and still found users. The machines change every day; the lists and kits keep circulating. (High confidence — the path comparisons are exact. Who hands the lists between operators is unknown.)
  2. The Tc Datacenter group moved from scanning to attacking. 45.138.12.22 and 45.138.12.27 sent working exploit code: a WordPress SQL injection, PHP webshell uploads (<?php if(isset($_GET['c'])){system($_GET['c']);}…), and a webshell command. (High confidence on what they sent — we captured it. Moderate on what they wanted: every stage landed on our fake responses, so we cannot see what they believed.)
  3. Stolen canary keys are mostly checked, not used. 10 of 46 stolen credentials touched AWS; every success was GetCallerIdentity only. One collector checked its own theft again (137.23.38.53, third day running), one new address (85.121.176.200) made a single call, and last cycle's big AWS sweep kept running on seven old hoards after our log window closed. The odd one out: 185.209.196.169 — the AWS-side address that used WebSiphon's keys last cycle — came to our ru-edge server itself and picked up a fresh canary. (High on the facts. Moderate on the meaning: one mint cannot tell staging from a coincidence.)
  4. The WordPress password-spray pool tripled and crossed its alarm. 233 ai-devbox-1 credential POSTs came from 233 different IP addresses, one POST each, 223 different bodies. The 200-pair alarm set in briefing №14 fired for the first time. (High confidence — direct counts. A repeat, not this window, sets the alarm state.)

Campaigns (who / what / what it means)

CVENGINE-KIT — a scanning kit that also attacks — ⚠ NEW

  • Who: 45.138.12.22 and 45.138.12.27 (Tc Datacenter Limited, Lithuania), with small passes from 45.138.12.24 (26 events, sponge) and 45.138.12.65 (91 events, netcup). The /24's known l9explore runner 45.138.12.51 (264 events, 3 sensors) worked the same day. The two main machines took turns: .22 ran sponge-01-ts 16:23–00:28 EDT (1,024 events, 419 paths), .27 ran sponge 21:24–00:08 (672 events, 419 paths) and then netcup-ts 23:14–23:30 (653 events, 419 paths).
  • What they did: a 419–513-path scan under a fake Chrome/137 browser identity, plus real attacks we captured word for word: a WordPress SQL injection using md5('wp2shell1337') as a success marker; uploads of PHP webshells named cv9c7408e038.php, cve52617292e.php, and cv5dd4d82e74.php that run system($_GET['c']); and a webshell command action=download_backup. They also hammered WordPress login pages (42–72 redirects and 44 login probes each), which caused both nodes' WordPress spikes (sponge 84/88, netcup 42/44).
  • What it means: the only kit this cycle whose messages try to run code, not just read files. Our decoys answered everything with harmless fakes at zero cost. We do not know whether the operator believed any stage worked. The CVEngineBoundary upload marker and the wp2shell1337 string are the fingerprints; a second server or a return visit promotes this to a standing threat.

CENSUS-284 — one checklist, two unrelated buyers — ⚠ NEW

  • Who: 85.239.151.82 (Interserver, Inc, US) and 93.123.109.228 (Techoff Srv Limited, Bulgaria). The first made 1,239 requests on sponge-01-ts; the second 1,220 there plus 915 on netcup-ts.
  • What they did: both fetched the same 284 paths (284 of 284 overlap) under the same fake Chrome/137 Windows identity, GET-only, no credentials taken. They hit our fake API documentation pages (/api/docs/, /docs/, /v3/api-docs answered with openapi-spec-json-skeleton 200, 16 hits each — the cause of sponge's 25× spike) and looked for AI and cloud credential files we had never seen requested before: /openai.yml, /google-ai.yml, /vertex-ai-credentials.json, /mcp.yaml, /config/secrets.js, /config/hubspot.yml, /hr/, /webroot/.env, /.config/gcloud/configurations/config_default.
  • What it means: the same sharing pattern as the MEGA-DICTIONARY dropper list, applied to config files. One checklist, unrelated users. A third host fetching the same paths, or a stolen canary, would show the artifact is alive and spreading.

BUCKLOG-KIT — the census crew with fresh addresses each day — ⟳

  • Who: three new IPs, one per server: 185.177.72.70 (sponge-01-ts, 1,430 events, 1,006 paths, 31 trap families, curl/8.7.1), 185.177.72.69 (lauterbourg-01-ts, 203 events, 11 families), 185.177.72.17 (canary-farm-1, 34 families). The old census host .64 stayed away, and the attack arm (.50) was idle.
  • What they did: .17 poked a WordPress plugin test route, then took 3 canary credentials at /.env. .70 walked git, devops, and AI-credential paths (/gcp-credentials.json, /gcp-keys.json, /openrouter-config.ini, /fireworks_config.yml) past our fake API docs.
  • What it means: this crew rotates its scan machines daily and collects credentials on every touch. The 3 canaries .17 took are now in hostile hands, with no AWS use seen yet. Watching single IPs is useless here; the /24 and the scan shape are the trackers.

LIBREDTAIL-KIT — the PHP remote-code kit at record width — ⟳

  • Who: 12 IP addresses, 532 events, 6 servers: control-1 (102.244.97.185), netcup-ts (213.165.53.216, 194.87.216.201, 124.158.13.141, 103.159.51.70), ru-edge-1 (180.181.122.134, 188.246.240.3, 152.32.225.117), frantech-ts (107.150.123.48), canary-farm-1 (120.46.47.16, plus 173.183.178.122 briefly), sponge-01-ts (139.198.123.80).
  • What they did: the same chain as always — path-traversal commands on /bin/sh, then an Apache CGI shell, then 5 PHP-CGI code-execution POSTs per IP, each carrying the same base64 payload that tries to make the target print an OpenSSH private key. No canaries taken. The download stage (/bin/sh dropper) again produced no captured body — the eighth cycle in a row.
  • What it means: a common attack kit at its largest known spread. Our fake webshells keep feeding it. Where it downloads its next stage from is still unmeasured.

CREDENTIAL-DRAIN — stolen canaries meeting AWS — ⟳

  • Who (mint side): 46 credentials went to 30 collector addresses. Who (use side): 137.23.38.53 checked its own theft again (third window running); 85.121.176.200 made one GetCallerIdentity call with a fresh ai-devbox-1 key; and last cycle's 23-operation AWS sweep (168.222.244.156) kept working 7 LeakIX hoards after our log window closed — for those seven, Tracebit is the only witness. 185.209.196.169 picked up 1 canary from ru-edge at 05:00 UTC — a use-side address now collecting keys itself.
  • What they did: 81 use events; 42 calls succeeded — all of them GetCallerIdentity — and 39 were denied (mostly ListTables ×6, DescribeDBInstances ×5, DescribeAddresses ×5, ListApplications ×5, ListSecrets ×4). No attempt to create anything this window. The big hoarders restocked: 45.148.10.171 took 6 credentials on 4 sensors (47 in six days, 24th window), 213.209.159.175 took 4 on control-1 (16/6d), 213.209.159.154 took 2 on farm (6/6d), 45.138.12.51 took 2 (8/6d), 185.252.234.32 took 2 on control-1, 195.178.110.137 took 2 on farm.
  • What it means: the thieves mostly check that their stolen keys work, then stop. Our deny-all policy held again at zero real permissions. The number to watch is 185.209.196.169's fresh canary: if it draws AWS calls, that operator is now harvesting directly.

REGISTRY-HUNT / LeakIX — the l9scan wave, smaller but still collecting — ⟳

  • Who: the standard 27-step scan ran from 11 addresses across canary-farm-1 (5 IPs / 205 events), ai-devbox-1 (4 IPs / 164), control-1 (206.81.24.227, 64.227.70.2), and ru-edge-1 (64.226.65.160, 157.245.36.108). A tarpit-only sibling ran from 16 addresses (112 events). The l9explore runner 45.138.12.51 made 264 events and took 2 canaries (8 in six days). About 12 runners took one canary each.
  • What they did: the same tour (WebLogic, Confluence, cPanel, docker registry checks), about one canary per runner — and their older hoards kept drawing AWS calls after the window closed.
  • What it means: the wave shrank by about half but the base still mints, and the mints still get checked in AWS. The brand reads "research scanner"; the economics are not harmless.

MEGA-DICTIONARY — the shared IoT dropper list, updated — ⟳

  • Who: 193.32.248.130 (31173 Services AB, Germany — the third host from this provider on the list).
  • What they did: 13,678 requests in 1 minute 22 seconds (04:18–04:20 UTC 10-19) on frantech-ts — 94% of everything that server saw. 13,612 of the paths (99.89%) were already on record. 66 were new — the biggest growth on record (the last growth burst was +6): a new /l_*.sh dropper family (/l_telnet.sh, /l_thinkphp.sh, /l_wifiweb.sh, /l_xwiki.sh, /l_spark.sh, /l_ssh.sh, /l_videoflow.sh, /l_weaver.sh, /l_wifi.sh) plus /str_x86_64, /vb.sh, /samsung, /systemd-ntpd, /ttyd.sh, /vc.sh and more (we sampled 15 of the 66). All requests were GETs from hundreds of fake router and camera identities; nothing was taken.
  • What it means: someone maintains this list — it is a living product, not a leftover file. When a second operator fetches the grown list, that tells us the update is spreading.

WP-FORM-BRUTE — the distributed WordPress password sprayer — ⟳

  • Who: 233 different IP addresses on ai-devbox-1, one POST each, 223 different bodies. The wp-admin side leg shrank to 1 IP. (The WordPress hits on netcup and sponge belonged to CVENGINE-KIT, not this pool.)
  • What they did: one login attempt per address, fake modern Chrome identities, no canaries taken.
  • What it means: one attempt per address looks like residential-address rotation built to slip under rate limits. If the 233-address pool comes back, the alarm stands; if not, it was a one-off.

OMEGA-SWEEP — the standing census crew at record scale — ⟳

  • Who: 79.124.58.82 (Tamatiya EOOD, Bulgaria) on ai-devbox-1; pool address 94.154.43.99 touched all 8 sensors (18 events, empty and bare Mozilla/5.0 identities).
  • What they did: 450 requests, 450 paths, 106 trap families in one minute (09:52 UTC) under a fake Googlebot identity, and took 1 canary (5 in six days) — one family short of the fleet record. The aidev ssh-private-key-error spike (31, 3.3×) is mostly theirs (27).
  • What it means: the crew is back at near-record scale and collecting again. Watch for the original /46 address block to return, and for any use of their hoard.

GOWEB-PENTEST — the honest-label phpMyAdmin hammer — ⟳

  • Who: two operators in one day, both on control-1: 133.18.142.12 (151 login-page GETs on /db/index.php) and 177.124.93.52 (151 on /mysql-admin/index.php). They are the nineteenth and twentieth operator addresses.
  • What they did: the usual — Go Web Pentest Tool identity, one login path, GETs only, nothing taken.
  • What it means: the decoy login pages keep drawing new users. Twelve windows on, nobody has sent us a real password guess body.

EMPERORS-KIT — back after two quiet windows — ⟳

  • Who: 150.241.66.127 (Kyonix Networks, US — the registered operator), 80 events across canary-farm-1, ai-devbox-1, and control-1.
  • What they did: 22 phpMyAdmin login-page GETs across 11 admin paths on control-1 (the rest of that node's 3.0× spike), under 5 identities including python-requests/2.28.1. The kit's webshell stages did not fire.
  • What it means: the operator is alive. The open question is whether its public-repo download stage ever gets attempted — we still have not seen it.

WP-ENUM — the plugin-list checkers, third generation — ⟳

  • Who: 45.156.129.133 and 45.156.129.46 (the same 45.156.129.x block as before) on ru-edge-1 and frantech-ts, 152 events combined.
  • What they did: fetched WordPress plugin readme.txt files (elementor, wp-fastest-cache, code-snippets, kirki…) under a stripped Chrome/123 identity with no platform token, plus harmless front-page passes. Nothing taken.
  • What it means: cheap inventory work against decoy plugin pages. A second window in a row makes this a standing cluster.

Standing actors (who keeps coming back)

  • 45.148.10.171 — 24th straight collecting window: 6 credentials on 4 sensors, 47 in six days, no AWS use ever, 18 events across all 8 sensors under antique fake browser identities. Our longest-running collector.
  • 204.76.203.18 (Pfcloud) — day 28+ on control-1: 1,988 of the node's 3,563 events (56%). Its /24 also sent a new light walker, 204.76.203.219, across all 8 sensors (23 events, fake Edg/90 identity).
  • Bochum softsec crawler (185.73.23.161 and .162) — seventh window, on the benign list: 62% of netcup-ts (4,002 of 6,486) and 40% of sponge-01-ts (4,177 of 10,373).
  • TOKEN-CRAWLER pool 45.198.224.x — .124 (104 events) and .125 (72 events) touched all 8 sensors again; nothing taken.
  • 45.138.12.51 (Tc Datacenter) — the l9explore runner, now 8 canaries in six days; its /24 ran the CVENGINE-KIT relay the same day. One block, two kits.
  • Feo Prest pair — 213.209.159.175 (4 on control-1, 16/6d) and 213.209.159.154 (2 on farm, 6/6d) both collected.
  • 137.23.38.53 — second window, now bigger: 808 events across frantech-ts (173), netcup-ts (367), and canary-farm-1 (268) — an API/panel census, 1 canary taken, and it checked its own theft again. A third collecting window makes it a named campaign.
  • Other repeat collectors: 104.251.180.112 (2 canaries, 3 sensors), 206.81.24.227 (a LeakIX runner, 3/6d), 79.124.58.82 (5/6d), 209.99.188.170 (back on lauterbourg, 36 events), 93.152.221.52 (5 sensors, one Chrome/131 identity).
  • Benign regulars — 89.248.172.33 (441 events, 7 sensors), 80.82.77.202 (423, 7), 34.140.3.155 (27, 7), the Censys-class 71.6.x addresses, 195.182.16.23, 3.129.187.38 — and new: 75.127.6.2, which self-identifies as zmap-proxy-probe/1.0 and made about 8 shallow requests on each of all 8 sensors. Benign-looking; we report it and keep watching.

Who went quiet

METADATA-HUNT's named runners (third quiet window), CF-FRONTED CREDSWEEP, CONFIG-SWEEP (fifth absence), the WebSiphon scanner itself (no second sighting), INFOCREST-KIT, KEYDROP-SCANS (first miss after its promotion), Bucklog's attack arm (.50), ATLASSIAN-REST-PROBE, XMLRPC-BRUTE, NIGHTAGENT (eleventh window), CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, PROTON-CENSUS, ORACLE-SWEEP, CONFIGBUNDLE-SWARM, KITEWORKS-CRAWL's Google pair, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS, MEGA-DICTIONARY's two hosts from №55, and network-layer GO-SPRAY-SWEEP (no sessions at all this window).

Network sweeps (Arkime) — the port-22 picture the web traps cannot see

These are SSH connections to the servers' public addresses. They never request a web page, so the web traps log nothing — only the packet sensor sees them.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 6,088 sessions from 329 addresses in 153 networks across 52 countries. Its widest spread in weeks (the record is 422 addresses); day-over-day it added 61 addresses. Daily address counts: 10-13: 283, 10-14: 336, 10-15: 352, 10-16: 281, 10-17: 257, 10-18: 324, 10-19: 98 (partial day).
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go) — 25,906 sessions from 92 addresses in 33 networks, down from its record 124 addresses the day before. Daily: 10-13: 97, 10-14: 95, 10-15: 94, 10-16: 80, 10-17: 129, 10-18: 95, 10-19: 24 (partial day).
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397, banner ssh-2.0-go) — fell back under the sweep line: 36 addresses, 23 networks, 9,173 sessions, after two wide days.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc) — no row at all this window; its first miss since it re-crossed the line in №55. This tool has always come and gone in bursts.
  • Unnamed regulars: 4e066189c3bb… (control-1's top fingerprint, 17,087 sessions from 14 addresses, 15th day), e37f354a101a… (frantech's top, 24,813 sessions from 6 addresses, +8,130), 2ec37a7cc8da… (2,341 sessions, 19 addresses), 084386fa7ae5… (45 addresses, 5 networks; its spread has run 50→57→72→45). No new fingerprints; 40 standing.
  • Bookkeeping: the Arkime tag labels for the sponge sensors still do not match their current names — an ops-repo fix, not something this briefing can change.

Canaries (minted and used) — credentials handed to thieves, and what they did with them

The sensors minted 46 fresh canary credentials; 30 different collector addresses took at least one; 10 credentials were used against AWS. Of 81 use events, 42 succeeded — every single one just GetCallerIdentity, an identity check that leaks nothing useful — and 39 were denied. Minting worked cleanly: zero failures this window. Per node: canary-farm-1 16 credentials to 11 addresses, ai-devbox-1 14 to 11, control-1 14 to 9, ru-edge-1 6 to 6.

Who took what (address — sensor, mints, AWS use, six-day history):

  • 213.209.159.175 — control-1, 4 mints, no use; 16 mints since 2026-10-12 19:47
  • 185.177.72.17 — canary-farm-1, 3 mints, no use; 3 mints since 2026-10-18 22:42
  • 185.252.234.32 — control-1, 2 mints, no use; 2 mints since 2026-10-18 15:32
  • 195.178.110.137 — canary-farm-1, 2 mints, no use; 2 mints since 2026-10-18 10:20
  • 213.209.159.154 — canary-farm-1, 2 mints, no use; 6 mints since 2026-10-15 09:15
  • 45.148.10.171 — ai-devbox-1 2 + canary-farm-1 2 + control-1 1 + ru-edge-1 1, no use; 47 mints since 2026-10-12 15:01
  • 104.251.180.112 — ai-devbox-1 1 + control-1 1, no use; 3 mints since 2026-10-17 14:48
  • 134.122.28.88 — canary-farm-1, 1, no use; 3 mints since 2026-10-14 20:03
  • 137.23.38.53 — canary-farm-1, 1 mint, used 2 credentials from 1 address (GetCallerIdentity); 3 mints since 2026-10-17 20:22
  • 138.68.144.227 — ai-devbox-1, 1, no use; 2 mints since 2026-10-12 20:41
  • 146.190.242.161 — canary-farm-1, 1, no use; 2 mints since 2026-10-13 19:57
  • 146.190.63.248 — ai-devbox-1, 1, no use; 4 mints since 2026-10-13 20:08
  • 146.190.63.48 — ai-devbox-1, 1, no use; 2 mints since 2026-10-15 21:08
  • 157.245.105.107 — canary-farm-1, 1, no use; 4 mints since 2026-10-12 20:41
  • 157.245.250.244 — control-1, 1, no use; 1 mint since 2026-10-18 13:52
  • 157.245.36.108 — ru-edge-1, 1, no use; 1 mint since 2026-10-18 19:57
  • 162.254.24.228 — control-1, 1, no use; 1 mint since 2026-10-18 19:09
  • 167.71.81.114 — canary-farm-1, 1, no use; 4 mints since 2026-10-12 20:03
  • 172.93.215.8 — ru-edge-1, 1, no use; 2 mints since 2026-10-12 16:55
  • 185.209.196.169 — ru-edge-1, 1, no use yet; 1 mint since 2026-10-19 05:00
  • 206.81.24.227 — ai-devbox-1 1 + control-1 1, no use; 3 mints since 2026-10-16 19:01
  • 207.154.197.113 — canary-farm-1, 1, no use; 1 mint since 2026-10-18 20:03
  • 209.160.115.1 — control-1, 1, no use; 1 mint since 2026-10-18 13:33
  • 212.56.54.232 — ai-devbox-1, 1, no use; 1 mint since 2026-10-18 11:15
  • 45.138.12.51 — ai-devbox-1 1 + canary-farm-1 1, no use; 8 mints since 2026-10-12 12:58
  • 5.59.248.234 — ai-devbox-1, 1, no use; 1 mint since 2026-10-18 20:27
  • 64.226.65.160 — ru-edge-1, 1, no use; 1 mint since 2026-10-18 19:59
  • 64.227.70.2 — control-1, 1, no use; 4 mints since 2026-10-12 20:30
  • 79.124.58.82 — ai-devbox-1, 1, no use; 5 mints since 2026-10-14 18:50
  • 85.121.176.200 — ai-devbox-1, 1 mint, used 1 credential from 1 address (GetCallerIdentity only); 1 mint since 2026-10-18 19:04

Used after our log window closed (Tracebit is the only witness — these are last cycle's LeakIX hoards still being worked): 138.68.82.23 (7 operations), 147.182.200.94 (4), 157.230.19.140 (7), 159.223.132.86 (5), 164.90.228.79 (7), 167.71.175.236 (3), 64.23.218.208 (12) — each used 1 credential from 1 address; all calls were GetCallerIdentity or denied inventory reads.

Hoarders with no observed AWS use (the full six-day list): 45.148.10.171 (47 mints, 2026-10-12 15:01 → 2026-10-19 04:59), 35.253.66.111 (41, 2026-10-13 10:37), 213.209.159.175 (16, 2026-10-12 19:47 → 2026-10-18 15:22), 87.120.104.29 (12, 2026-10-13 11:39 → 19:31), 2a02:c207:2350:9697::1 (11, 2026-10-12 08:22 → 17:08), 140.245.97.208 (9, 2026-10-13 15:46 → 2026-10-16 19:43), 169.58.180.111 (9, 2026-10-12 08:22 → 17:08), 173.249.253.116 (8, 2026-10-12 23:08 → 2026-10-13 07:24), 194.59.31.39 (8, 2026-10-14 13:54 → 19:54), 45.138.12.51 (8, 2026-10-12 12:58 → 2026-10-19 00:13), 103.214.20.135 (7, 2026-10-14 01:15 → 05:45), 167.99.79.44 (7, 2026-10-12 17:35 → 17:54), 102.220.161.139 (6, 2026-10-12 09:24 → 09:59), 109.205.176.10 (6, 2026-10-12 15:06 → 2026-10-18 04:42), 206.209.210.3 (6, 2026-10-12 16:58 → 2026-10-15 11:17), 208.84.100.218 (6, 2026-10-12 15:41 → 17:51), 213.209.159.154 (6, 2026-10-15 09:15 → 2026-10-19 06:24), 79.124.58.82 (5, 2026-10-14 18:50 → 2026-10-18 09:52), and 4-mint collectors 102.220.163.155, 146.190.63.248, 157.245.105.107, 159.89.12.166, 165.22.34.189, 167.172.232.142, 167.71.81.114, 37.60.226.187, 64.227.70.2, 80.94.95.211, plus 3-mint collectors 104.251.180.112, 104.64.127.170, 134.122.28.88, 167.99.182.39, 172.239.158.26, 185.177.72.17, 206.81.24.227, 209.38.208.202, 209.38.248.17, 209.99.189.217, 46.101.111.185, 92.38.172.10.

What this means: the thieves mostly verify their take and stop. Nothing got past GetCallerIdentity. The one change to watch is 185.209.196.169 collecting a canary directly.

How the fleet behaved (Fleet Observations) — volumes, causes, and housekeeping

  • sponge-01-ts +167% (10,373 events): the census wave — 85.239.151.82 (1,239) + 93.123.109.228 (1,220) + Bucklog .70 (1,430) + 45.138.12.22 (970) + .27 (672) = 5,531 events (53%) — plus the Bochum research crawler (4,177, 40%).
  • netcup-ts +57% (6,486): Bochum 4,002 (62%) + Techoff .228 (915) + CVENGINE .27 (653).
  • frantech-ts flat (14,612): one MEGA-DICTIONARY replay (13,678 events, 94% of the node) instead of last cycle's two.
  • control-1 −3% (3,563): the Pfcloud loop (1,988) is the floor; the phpMyAdmin spike (324) replaced last cycle's census bursts.
  • canary-farm-1 −35% (1,367): INFOCREST-KIT (106 events), the KEYDROP pair, and much of last cycle's LeakIX farm wave were absent or smaller.
  • ru-edge-1 −41% vs its weekly average (896): no census wave, and WebSiphon's 380-event burst from last cycle did not repeat.
  • ai-devbox-1 −6% (1,666). lauterbourg-01-ts −32% (1,028): the Atlassian cluster (280) and INFOCREST (180) gone, partly replaced by Bucklog .69 (203) and two unattributed Google Cloud walkers, 34.78.64.142 (142) and 34.34.160.116 (119).
  • Every result-tag spike has a cause — the WordPress spikes are WP-FORM-BRUTE (233 addresses) and CVENGINE-KIT; control-1's phpMyAdmin spike is the two GOWEB operators (151+151) plus EMPERORS-KIT (22); the not-handled surges on sponge and netcup are the census wave; the openapi spike is CENSUS-284 plus Bucklog; the tarpit counters rode the same wave.
  • Attribution stayed clean: zero forged forwarding-header chains and zero direct-connection header forgeries this window — last cycle's Cloudflare-edge spoofing burst did not come back.
  • control-1 discovery, day 36: 3,563 events from 119 unique addresses — the 28th straight window inside the usual 84–157 band. No new discoverers.
  • Known data quirks: first-seen timestamps land at the log-sync minute (03:16), so they are an inventory, not a clock; the hourly histogram prints local (EDT) times under a UTC header; spot-query totals run a little above digest cells because the query window starts slightly later than the digest's. None of these changed any conclusion.
  • Fleet-side changes this cycle: the visuals dashboard gained the two new campaigns (CVENGINE-KIT, CENSUS-284), status changes (LIBREDTAIL-KIT and EMPERORS-KIT back to active/recurring, KEYDROP-SCANS to idle), and 16 new address-to-campaign labels; the dashboard re-rendered three times, final file flux-fleet-visuals-2026-10-19-r3.html. The campaign registry now carries both new campaigns and the network-layer status changes.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

410 addresses sent passwords → 280 got a shell (68%) → 235 ran a command (84% of shell-getters, 57% of sources). In raw events: 34,481 password attempts → 5,006 accepted logins → 6,723 commands. Telnet bots: 1,036 attempts.

Twenty-ninth window with no new commands — 0 of the 50 distinct commands were first-seen. The old set holds: the .ssh re-plant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, 905 events from 169 addresses; the key-replace chain 796 from 151), the hardware-survey battery, and the PATH-export recon pairs. One volume note: 118.142.17.190 ran echo -e "\x6F\x6B" 2,370 times — 35% of all commands this window came from that one address. We cannot tell a deliberate operator from a stuck script.

Passwords: 26,004 distinct pairs offered, 0 new. The same fixed pairs dominate as for eleven windows: 345gs5662d34/345gs5662d34 (861 attempts) and root/3245gs5662d34 (658).

Open questions

  1. Did CVENGINE-KIT's attack stages fool anyone — including its own operator? We check the status codes the kit saw for anything it could read as success. A return visit with a follow-on stage, or a third server, settles whether the decoys convinced it.
  2. Is CENSUS-284 a living artifact? A third host fetching the same 284 paths, any stolen canary, or a changed wordlist would show it is spreading. Today's two known users sit on unrelated hosting (Interserver US, Techoff BG).
  3. Where does LIBREDTAIL-KIT download its next stage from? Twelve windows of key-stealing POSTs, and the download stage has produced no captured traffic since №51's single capture.
  4. What does 185.209.196.169 do with its fresh canary? Watch for AWS use of the key it took at 05:00 UTC on ru-edge, a second WebSiphon address or server, and whether last cycle's 23-operation AWS sweep returns inside a window.
  5. Who adopts MEGA-DICTIONARY's 66 new paths? Tracking the new-path count per replay; a second operator fetching the grown list is the signal that the update is circulating.
  6. Is the 233-address WordPress spray a one-off? Whether the pool returns, and whether the pair count keeps climbing past the 200 alarm.
  7. When does 137.23.38.53 earn a campaign name? A third collecting window, or a second server where it takes canaries, promotes this census-plus-self-check collector.
  8. The Arkime tag labels for the sponge sensors still lag their current names — that fix lives in the ops repo, not here.

Plain language version of: flux-fleet-intel-briefing-2026-10-19.md