Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №57 — PLAIN LANGUAGE

Period: 2026-10-19 07:33 – 2026-10-20 07:34 UTC (24h, day 55 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-20.md

What happened (plain)

One computer at Google Cloud hit our canary-farm honeypot harder than any single address we have recorded: in 18 seconds it collected 48 fake login files (41 working decoy credentials) while pretending to be 33 different AI web crawlers, and it also tried real break-in code against two fake app panels. The WebSiphon census crew grew from one operator to six in one day, all renting machines from Oracle's US cloud. A collector we have watched for three days — 137.23.38.53 — tried 84 things in Amazon Web Services with stolen decoy keys; 72 of them were attempts to check bulk-email sending limits, which is new and looks like preparation for sending spam at scale. A fresh pool of 99 computers tried admin-panel password tricks across five of our sensors. Our fake answers held everywhere; nothing the attackers tried gave them a real foothold.

What it means (plain)

  1. Scanning kits now try to break in, not just look. AI-EXEC-HUNT ran working remote-code tricks against fake langflow and ICEcoder panels, BUCKLOG's break-in arm woke up after eight quiet days (284 events), and the LIBREDTAIL kit spread to 14 computers across all seven trap sensors. (High confidence on what they did — we captured the payloads. Moderate on whether they believed it worked — every answer they saw was a decoy.)
  2. "Honest" self-labeling scanners became a crowd. WebSiphon went from 1 operator to 6 addresses on 4 sensors in one window, and EMPERORS-KIT collected credentials for the first time. The self-chosen name in the browser string is our best way to track them. (High on the counts. Moderate on whether the six are one group — they share a template, and we cannot prove a shared boss.)
  3. Stolen decoy keys are piling up in hoards, not being spent. 75 new decoy credentials went to 19 collector computers; only 2 were used in AWS, both by the same collector we already knew. The biggest new hoard — 41 keys from AI-EXEC-HUNT — sat unused when the window closed. (High — Tracebit's alert log is our witness for AWS use. A use shortly after the window could still appear.)
  4. The big traffic increases all have named causes. Four sensors grew 30–56%, and every spike traces to a named scanner crew. control-1 set a record with 167 unique visitor addresses, but the record came from scanner crews arriving, not from new internet-wide discovery. (High — we attributed all 16 result-tag spikes by hand.)

Campaigns (who / what / what it means)

AI-EXEC-HUNT — a fake-AI-crawler swarm that also tried to break in — ⚠ NEW

  • Who: one address, 34.58.160.181, a Google Cloud machine in the US. First time we have seen it.
  • What they did: on canary-farm-1, 20:03:42–20:04:00 UTC, they sent 648 requests covering 300 paths and 59 trap families in 18 seconds, using 33 forged crawler identities (Googlebot/2.1, GPTBot/1.4, OAI-SearchBot, Claude-User, PerplexityBot, Bytespider, GrokBot, and more). They took 48 fake-credential files (41 Tracebit decoy keys — our record for one address). They POSTed working break-in code: at /api/v1/validate/code (a langflow panel, answered 200) the body was {"code":"@exec('raise Exception(__import__("subprocess").check_output("env 2> — an attempt to dump environment variables; at /lib/terminal-xhr.php and /icecoder/lib/terminal-xhr.php (answered 200) the body was command=env&password=bypass&csrf=x; at flowise panels node-load-method/customMCP and node-custom-function (404); multipart JSON-action probes shaped {"then":"$1:_ at /login, /admin, /dashboard, /settings, /api/auth; GraphQL introspection at /graphql, /api/graphql, /v1/graphql (200); /.env and /@fs/.env and /@fs/root/.env decoy pulls; and a marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show.
  • What it means: they want stored secrets and code execution on AI infrastructure, not just files. Every stage landed on a decoy at zero cost to us. The 41 keys are now hostile-held inventory — whether they get used in AWS is our number-one question.

WEBSIPHON — a self-labeling config scanner that multiplied — ⟳

  • Who: six addresses in one window, all Oracle's US cloud, all using the honest browser string WebSiphon/next-0.1: 163.192.195.37 (control-1, 800 events / 669 paths in 12 s), 64.181.210.1 (lauterbourg-01-ts, 564 events / 463 paths in 1.4 s), 147.224.164.154 (control-1, 378 events / 290 paths), 149.130.220.90 (control-1) and 147.224.209.232 (canary-farm-1) — an identical twin pair at 157 events / 69 paths each — and 163.192.221.136 (sponge-01-ts, 151 events).
  • What they did: the same config-and-secrets sweep as before, now deep enough to own control-1's config-file spikes (31 of 39 app-config-yaml-error events, 27 of 38 config-json-error, 34 of its config-bundle hits). They took 3 decoy credentials, one per touch.
  • What it means: either several crews adopted one crew's tool, or one crew rented more machines. The credentials they took have not been used in AWS yet — the №55 batch was used within its own window, so silence here is worth watching.

SES-QUOTA-PROBE — a key thief that started probing Amazon's email service — ⚠ PROMOTED from watch

  • Who: 137.23.38.53 on the AWS side (it has never appeared in our web logs); the keys it used were 3 decoys taken from canary-farm-1 on 2026-10-17/18.
  • What they did: 84 AWS calls across 2 keys from one address: 72 attempts to read ses:GetSendQuota (all denied), 6 attempts on iam:GetUser (all denied), and 6 sts:GetCallerIdentity calls that succeeded.
  • What it means: checking bulk-email quota 72 times looks like preparation for mass mailing, not curiosity. Our deny-all policy held, but the thief's intent changed from "check what I stole" to "map what this identity can do." Day 1 was minting, day 2 was self-checking, day 3 was SES/IAM probing.

ADMINER-SWARM — a 99-computer pool trying admin-panel passwords — ⚠ NEW

  • Who: 99 addresses in two blocks — 173.239.214.x (70 addresses, 969 events) and 185.198.240.x (29 addresses, 767 events) — touching 5 sensors, about 14 requests each. The busiest single was 23.234.78.109 (tzulo, US).
  • What they did: each address looked for adminer and phpMyAdmin login pages (/admin/adminer.php, /adminer.php, /PMA/index.php, /php-myadmin/index.php, /phpmyadmin2/index.php), then sent 3 credential POSTs. Forged Chrome 105–107 and Firefox 105–106 identities. They took 3 decoy keys (173.239.214.253, 173.239.214.238, 185.198.240.22) and own ai-devbox-1's adminer spikes (31 credential POSTs, 4.1×; 32 logins, 4.3×). 23.234.78.109 alone sent 6+6 POSTs and took 2 keys.
  • What it means: password attempts spread one-per-computer to slip under rate limits. Whether the two blocks are one crew is open. We have never captured one of their credential bodies.

BUCKLOG-KIT — census crew whose break-in arm woke up — ⟳

  • Who: all on sponge-01-ts: census host 185.177.72.70 (639 events, second window), break-in host 185.177.72.50 (284 events — first break-in volume since day 7), key collector 185.177.72.64 (2 decoy keys from ru-edge-1 at 01:57 UTC).
  • What they did: the census swept git, airflow, ansible, actuator, and cloud-credential paths. The break-in arm hammered a phpunit test endpoint (CVE-2017-9841) 284 times.
  • What it means: the crew kept both tools warm and rotates computers daily. The break-in arm's return after eight quiet days is the crew's biggest move we have recorded; a captured test-echo body or a second sensor would confirm escalation.

LIBREDTAIL-KIT — a break-in test kit at near-record spread — ⟳

  • Who: about 14 addresses, each making exactly 37 requests, across 7 sensors — including lauterbourg-01-ts for the first time (92.5.155.195). A self-labeling helper, 103.160.205.37 (libredtail-http), worked farm and frantech.
  • What they did: the same chain as always — a traversal command on /bin/sh, then two command-injection stages. The key-stealing POST body was not captured again (ninth window running). The helper added a docker container listing to its chain.
  • What it means: a cheap, shared kit that one new sensor per window is normal for it. The uniform 37-request volume is how we recognize it. Its dropper server is still unknown.

TECHOFF / PHPSWEEP kit — one hosting org, three behaviors, one day — ⟳

  • Who: 195.178.110.22 touched all 8 sensors (182 events); 195.178.110.159 ran 528 fake-git lookups split 264/264 across control-1 and canary-farm-1; 195.178.110.137 (yesterday's collector) was absent.
  • What they did: .22 swept actuator, backup, id_rsa, and database-dump paths, and — new — probed /@fs/etc/passwd, /@fs/etc/hosts, and /@fs/C:/Windows/win.ini on 4 sensors (a marker first seen on the no-canary nodes today). .159 walked a git-internals wordlist on both EU nodes.
  • What it means: one hosting org ran a census, a marker probe, and a git walk in the same window. The /@fs marker shows the METADATA-HUNT toolkit traveling beyond its original owners. The /24 is how we track them.

MEGA-DICTIONARY — a shared break-in-URL wordlist, still growing — ⟳

  • Who: 138.199.60.3 (Datacamp, Singapore — the №55 host) replayed it on frantech-ts.
  • What they did: 13,744 requests in about 2 minutes (04:31–04:33 UTC), 13,742 distinct paths, 94.9% of the whole node. Against all our frantech history, 64 paths were new: a /0c0et52nq5kb/assets/js/* family plus /beacon.arm, /beacon.x86, six /cegg_* builds, /gb.arm, /gb.x86, and five /hydra-* builds.
  • What it means: the shared wordlist grew for the second day running (+66 yesterday, +64 today) under two different operators. If another host fetches the grown list, that is the adoption signal.

REGISTRY-HUNT / LeakIX — the l9scan crews came back on-screen — ⟳ (borderline brand, hostile economics)

  • Who: 10+ DigitalOcean addresses ran the 25-family journey across 4 sensors — including three that worked stolen keys in AWS after yesterday's window closed: 138.68.82.23, 157.230.19.140 (took 1 new decoy key at 20:25 UTC), and 164.90.228.79, plus 157.245.36.108, 206.189.19.19, 139.59.132.8, 68.183.9.16, 146.190.242.161, 206.189.225.181, 209.38.208.202. A new runner, 138.68.86.32 (l9scan/2.0.930323), made 78 events / 25 families.
  • What they did: the usual tour — WebLogic console, Confluence, WHM/cPanel, docker registry — with about one decoy key taken per runner.
  • What it means: these crews are not one-time visitors; they return, mint again, and their older keys keep drawing AWS calls after our log window ends. That repeat behavior is the point.

CREDENTIAL-DRAIN — the mint-to-use pipeline — ⟳

  • Who: mint side: 82 decoy-key files issued, 75 real credentials after deduplication, to 19 collector computers. Use side: 137.23.38.53 only (see SES-QUOTA-PROBE). Hoards: 34.58.160.181 holds 41 keys (0 used), 45.148.10.171 holds 44 over 6 days across 4 sensors (25th window running), 213.209.159.175 holds 18/6d, 80.94.92.126 holds 8/6d on 4 sensors, 37.60.226.187 holds 7/6d, 213.209.159.154 holds 6/6d — and reached a 4th sensor, 45.138.12.51 holds 7/6d.
  • What they did: 78 denied AWS calls, 6 successful GetCallerIdentity calls, and a new denial shape: GetSendQuota ×72 and GetUser ×6 replaced the old database-and-server inventory calls. 36 mint attempts failed with 400 errors (12 on ai-devbox-1, 13 on canary-farm-1, 7 on control-1, 4 on ru-edge-1) — burst-speed rejections, no key problems.
  • What it means: no bulk spending this window; what changed is what the thieves ask AWS about (email quota and identity, not servers). Deny-all and per-key isolation held at zero real permission.

EMPERORS-KIT — admin-panel kit that started collecting keys — ⟳

  • Who: 150.241.66.127 (Kyonix, US), second window running, on ai-devbox-1, canary-farm-1, and control-1.
  • What they did: swept env files (76 events on ai-devbox-1 — that node's whole spike — plus 38 on farm), probed config-json, phpinfo, and yii2 panels, made 11 phpMyAdmin login GETs, and took its first 2 decoy keys from control-1 (22:44 and 00:22 UTC, forged Firefox/77).
  • What it means: it moved from looking at admin panels to collecting credentials. Its installer pulls from a public code repository — if that "liveness check" echo ever appears, we will know its repo stage ran.

GOWEB-PENTEST — the self-labeled phpMyAdmin hammer found two new operators — ⟳

  • Who: 152.136.33.217 (sponge-01-ts) and 200.4.96.35 (ai-devbox-1) — operators number 21 and 22 in 13 windows.
  • What they did: 151 phpMyAdmin login-page GETs each, one path each, GET-only, nothing stolen.
  • What it means: the decoy admin list keeps circulating to new hands. We have still never captured a credential body from it.

SS-NET TOOLING — the collector block rotates its faces — ⟳

  • Who: registered operator 80.94.95.211 absent again; siblings 80.94.92.126 (5 decoy keys across 4 sensors, 8/6d) and 80.94.92.65 (3 keys, 4/6d) did the collecting, under antique forged browser strings (POLARIS/6.01, Opera 7.51, Chrome/14).
  • What they did: single /.env fetches, one key at a time, no sweeping.
  • What it means: the 80.94.9x.x block runs key collection as a standing service. The block, not any one address, is the identity. 12 keys over 6 days, none observed in use.

Standing actors (who keeps coming back)

  • 45.148.10.171 — 25th straight collecting window: 3 more keys on farm/aidev/control (44 over 6 days), never once used in AWS, antique forged browser strings. Our longest-running collector.
  • 204.76.203.18 (Pfcloud, NL) — day 29+ of the malware-URL loop on control-1: 2,047 of the node's 5,025 events (41%). Its neighbor 204.76.203.219 did its usual light walk on all 8 sensors (23 events).
  • Bochum university research crawler (185.73.23.161 finn, .162 goose, and a NEW third host .168 winston) — eighth window, on our benign list: 6,492 of netcup-ts's 7,441 events (87%) and 4,910 of sponge-01-ts's 6,790 (72%). The new host's browser string matches the same research project.
  • TOKEN-CRAWLER pool 45.198.224.x — .124 (108 events) and .125 (66 events) touched all 8 sensors again; no keys.
  • Feo Prest pair — 213.209.159.175 holds 18 keys over 6 days; 213.209.159.154 now works 4 sensors (6/6d).
  • Benign fixed-cadence probers — 89.248.172.33 (441 events, 7 sensors), 80.82.77.202 (387, 7), 34.140.3.155 (31, 7), the Censys 71.6.x trio, 3.129.187.38 (visionheight.com/scan, back on 3 sensors), 45.77.61.56 (CyberConvoyScout/1.0, 6 sensors, tarpit only), plus tarpit-only walkers 194.26.192.12, 156.225.1.106, 43.161.251.162, 150.107.36.82, 46.151.178.14.
  • New one-key collectors to watch: 130.12.180.164 and .168 (two sensors, 8 seconds apart, forged Chrome/147), 85.155.14.16, 209.87.169.179 (light 4-sensor census).

Absent this window

METADATA-HUNT's named runners (4th quiet window, but its toolkit traveled — see AI-EXEC-HUNT and TECHOFF), WP-FORM-BRUTE's 233-computer pool (first absence after its alarm fired), CVENGINE-KIT, CENSUS-284, OMEGA-SWEEP, INFOCREST-KIT, CONFIG-SWEEP (6th absence), CF-FRONTED CREDSWEEP, KEYDROP-SCANS, XMLRPC-BRUTE, NIGHTAGENT (12th), CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, SONICWALL-VPN-PROBE, PROTON-CENSUS, ORACLE-SWEEP, CONFIGBUNDLE-SWARM, KITEWORKS-CRAWL, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS, ENVRC-SWEEP, ATLASSIAN-REST-PROBE, WP-ENUM, KEYHUNT, and WebSiphon's original operator 147.224.147.131.

Network sweeps (Arkime) — the port-22 picture our web traps cannot see

Three sweeping tools hit our 8 public addresses on port 22 (SSH); all three are already-registered campaigns, so nothing new to name. Our pcap layer saw 137,603 inbound sessions in the window.

  • LIBSSH-MASSSWEEP (fingerprint f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 7,766 sessions from 421 addresses across 203 networks in 57 countries — one address short of its all-time peak of 422. Daily address counts: 10-14: 336, 10-15: 352, 10-16: 281, 10-17: 257, 10-18: 324, 10-19: 418, 10-20: 116.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go): 4,730 sessions from 165 addresses across 119 networks in 46 countries — it crossed the "dispersed sweep" line again one day after missing it (10-15: 39 addresses, 10-19: 165, 10-20: 7). On-off bursts are now this tool's signature.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): a session record, 36,733, from a shrinking pool — 66 addresses (down 26) across 27 networks in 17 countries. Same addresses, more sessions each. Daily: 10-14: 95, 10-15: 94, 10-16: 80, 10-17: 129, 10-18: 95, 10-19: 71, 10-20: 23.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397): below the sweep line, single-source shape — 17,422 sessions (up 8,249) but only 30 addresses / 19 networks.
  • Worth watching: 03a80b21afa8… (600 sessions, 28 addresses, 22 networks, 15 days on record) and a591c4ddccc9… (26 addresses, up 14, 12 days) both sit just under the sweep line. Two new sub-threshold fingerprints appeared: an openssh-keyscan banner (8 sessions, 2 addresses) and libssh_0.10.4 (330 sessions from 1 address — a newer libssh than MASSSWEEP's 0.9.6).

A sweep like this requests no web page, so our honeypot logs show nothing — this section is our only view of it. None of the sweeps attempted a login.

Canaries (minted and used) — who took our decoy keys, and who used them

Sensors minted 75 real decoy credentials (82 issue events before deduplication) to 19 collector addresses. Only 2 credentials reached AWS — both used by 137.23.38.53 (84 calls, described above). Outcomes: 78 denied, 6 successful GetCallerIdentity (which leaks only our own account identity), nothing beyond that succeeded. So this was a heavy minting window with almost no observed use.

Who collected, with how many keys and their 6-day history:

  • 34.58.160.181 — canary-farm-1 — 41 keys (a single burst at 16:03; no AWS use by window close; 41 since 2026-10-19 16:03)
  • 213.209.159.175 — control-1 — 4 (18 since 2026-10-15 03:07)
  • 80.94.92.126 — canary-farm-1 — 3 (8 since 2026-10-17 10:09; also 2 on control-1, 1 on ai-devbox-1, 1 on ru-edge-1)
  • 150.241.66.127 — control-1 — 2 (2 since 2026-10-19 22:44)
  • 185.177.72.64 — ru-edge-1 — 2 (4 since 2026-10-14 22:52)
  • 23.234.78.109 — ai-devbox-1 — 2 (4 since 2026-10-17 20:53)
  • 37.60.226.187 — canary-farm-1 — 2, plus 1 on control-1 (7 since 2026-10-14 07:08)
  • 45.148.10.171 — canary-farm-1 — 2, plus 1 on ai-devbox-1 (44 since 2026-10-13 08:58)
  • 130.12.180.164 — ai-devbox-1 — 1 (first ever, 2026-10-19 14:21)
  • 130.12.180.168 — canary-farm-1 — 1 (2 since 2026-10-17 16:49)
  • 147.224.209.232 — canary-farm-1 — 1 (2026-10-19 12:26, WebSiphon)
  • 149.130.220.90 — control-1 — 1 (2026-10-19 10:07, WebSiphon)
  • 157.230.19.140 — ai-devbox-1 — 1 (3 since 2026-10-17 19:58, l9scan)
  • 163.192.195.37 — control-1 — 1 (2026-10-19 23:04, WebSiphon)
  • 173.239.214.238 — ai-devbox-1 — 1 (2026-10-19 19:37, ADMINER-SWARM)
  • 173.239.214.253 — ru-edge-1 — 1 (2026-10-19 18:44, ADMINER-SWARM)
  • 185.198.240.22 — canary-farm-1 — 1 (2026-10-19 18:39, ADMINER-SWARM)
  • 80.94.92.65 — control-1 — 1 (4 since 2026-10-16 07:17)
  • 85.155.14.16 — ru-edge-1 — 1 (2 since 2026-10-18 03:19)
  • 137.23.38.53 — (outside our log window) — its 3 older farm keys: 2 used in AWS (GetCallerIdentity, GetSendQuota, GetUser)

Older hoards still sitting unused (candidates for resale or untraced use): 45.148.10.171 44, 34.58.160.181 41, 35.253.66.111 41, 213.209.159.175 18, 87.120.104.29 12, 140.245.97.208 9, 194.59.31.39 8, 80.94.92.126 8, 103.214.20.135 7, 37.60.226.187 7, 45.138.12.51 7, 213.209.159.154 6, 109.205.176.10 5, 206.209.210.3 5, 64.23.218.208 5, 79.124.58.82 5, 102.220.163.155 4, 146.190.63.248 4, 165.22.34.189 4, 185.177.72.64 4, 23.234.78.109 4, 80.94.92.65 4, 80.94.95.211 4. Whether any of these get used after our window closes is something only the Tracebit alert feed can tell us later.

How the fleet behaved (Fleet Observations) — the fleet's own numbers

  • Canary economics. 75 credentials to 19 collectors; 2 used in AWS (6 identity successes, 78 denials — denial leaders GetSendQuota ×72, GetUser ×6). 36 of 118 mint attempts failed with 400 errors — all burst-speed rejections (13 on canary-farm-1, 12 on ai-devbox-1, 7 on control-1, 4 on ru-edge-1), no bad-key errors. All-time issued counter: 2,633. Per node: canary-farm-1 minted 53 to 8 addresses, control-1 14 to 9, ai-devbox-1 9 to 7, ru-edge-1 6 to 5.
  • Attribution posture. Nobody forged their forwarding header this window: 0 forged chains, 0 mismatches between claimed and real origin (2,139 requests carried a forwarding header, 487 legitimately ignored). The TLS decoys split traffic as designed: canary-farm-1 served 963 HTTPS events across its IP and sso.rightabouteverything.show (1,246), ai-devbox-1 506 across its IP and inference.fapthropic.com (908).
  • Volume moves, all explained. canary-farm-1 +56% (3,202 events): AI-EXEC-HUNT 648, Techoff .159 384, the l9scan farm cluster 234, WebSiphon 157, the adminer pool about 80, EMPERORS 38. netcup-ts +53% (7,441): the benign Bochum crawler is 6,492 of them (87%). sponge-01-ts +30% (6,790): Bochum 4,910 (72%), Bucklog 923, GOWEB 151, WebSiphon 151. control-1 +31% (4,882): WebSiphon's three addresses 1,335, the standing Pfcloud loop 2,047, Techoff .159 384. frantech-ts flat at 14,474: one dictionary replay is 94.9% of the node. ru-edge-1 −28% (1,105): yesterday's census legs did not come back.
  • Every spike has an owner. All 16 result-tag spikes trace to named actors: ai-devbox-1's phpMyAdmin spike (261, 5.0×) = GOWEB's 200.4.96.35 (151) + 23.234.78.109 (20) + EMPERORS (11) + pool singles; its adminer spikes = the 99-address pool plus 23.234.78.109; its env-file spike (86, first-ever) = EMPERORS (76) + singles. canary-farm-1's fake-git spike (264) = Techoff .159. control-1's config spikes = WebSiphon (31+27 and 8+8); its fake-git spike (264) = Techoff .159; its config-bundle spike (64, 16×) = WebSiphon (44) + singles. sponge-01-ts's phpMyAdmin spike (154) = GOWEB's 152.136.33.217 (151); its phpunit spike (432, 7.9×) = Bucklog's .50 (284) + LIBREDTAIL singles (37 each).
  • control-1's ramp. Day 37: 4,882 events from 167 unique addresses — a record count, above the 84–157 band of the previous 29 windows. Scanner crews caused it, not fresh internet-wide discovery. Whether a real discovery ramp is underway is next window's check.
  • Fleet-side changes. The dashboard's campaign map gained AI-EXEC-HUNT, ADMINER-SWARM, and SES-QUOTA-PROBE and refreshed nine existing entries; 22 new address-to-campaign labels were added. No sensor or trap configuration changed. Network-layer name map unchanged — all three flagged sweeps were already registered.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is one machine running fake SSH (port 2222) and telnet (port 2323); do not read these numbers as fleet-wide. 485 addresses sent passwords; 343 got a fake shell (71%); 303 ran a command (88% of shell-holders, 62% of all sources). Event level: 28,019 password attempts → 5,070 accepted logins → 9,725 commands. Telnet (IoT botnets): 929 attempts.

  • No new commands — the 30th straight window: all 51 distinct commands were seen before. The usual set ran: the .ssh tamper pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 1,140 events from 246 addresses) and its key-replacement follow-up (1,006 events from 227 addresses), plus the hardware-survey battery (uname, lspci, nvidia-smi). Commands rose 45% (6,723 → 9,725) and spread across more addresses, one or two runs each.
  • Credentials: 18,430 distinct pairs offered, 2 new: ubuntu/Mannu@123 and ubuntu/Bhardwaj@123 (1 attempt each — human-name passwords against one username; worth watching for a repeat). The password-sprayer pairs that dominated for eleven windows (top pair: 861 attempts yesterday) did not show — the top pair this window had 1 attempt.

Open questions

  1. Will the 41 keys AI-EXEC-HUNT took at 16:03 UTC show up in AWS? That check, plus whether a second address or sensor runs the langflow/ICEcoder kit, is next cycle's first pull.
  2. Will 137.23.38.53's bulk-email probing (GetSendQuota ×72, all denied) come back, bring a second AWS address, or ever get past a denial?
  3. Which of WebSiphon's six addresses return, and will its 3 new keys be used in AWS the way the №55 batch was?
  4. Are the ADMINER-SWARM blocks (173.239.214.x, 185.198.240.x) one crew? A shared key, a shared host, or one captured credential body would answer it.
  5. Did Bucklog's break-in arm (.50, 284 phpunit events) get anything it believed? A captured test-echo body or a second node would tell us.
  6. Will another operator fetch MEGA-DICTIONARY's grown list (the +64 paths from today)?
  7. Was control-1's record 167 unique addresses a one-day scanner surge or the start of wider discovery?
  8. The Arkime sensor labels bahrain-sponge-01-ts and contabo-sponge-01-ts still do not match their sensors' addresses — an ops fix outside this briefing's scope.

Plain language version of: flux-fleet-intel-briefing-2026-10-20.md