Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №58 — PLAIN LANGUAGE

Period: 2026-10-20 07:33 – 2026-10-21 07:34 UTC (24h, day 56 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-21.md

What happened (plain)

One computer on the internet, 156.225.26.90, did two things in the same night. It poked the fleet's AWS canary passwords and tried to list what our fake AWS account can do (10 of those tries were blocked). It also ran a known probe pattern (the /@fs file-path trick) against our two EU sensor nodes. We had never before caught the same address doing both. Meanwhile, the WebSiphon scanner tool came back with four new computers (all Oracle, US) that each sent exactly 669 requests to four of our sensors, and its request list grew by 35 new paths aimed at GPU-cloud providers (crusoe, cudo, runpod, koyeb, paperspace, vultr, replicate, akamai). A new census kit we named CONFIGBUNDLE-KIT ran on four unrelated hosting blocks in one day — two of the four computers had never been seen before, and one of them (217.60.198.111) hit 4 sensors in 19 minutes and collected 6 canary passwords. The 41 canary passwords taken by AI-EXEC-HUNT on 2026-10-19 still show no use in AWS. And for the first time since the forgery counter shipped on 2026-09-15, one request lied about its own source address: the real connection came from 169.40.142.202, but the request claimed to be from 223.184.193.141.

What it means (plain)

  1. The AWS-side thief and the file-path prober are the same address. 156.225.26.90 ran /@fs/proc/self/environ four times and /@fs/app/.env on canary-farm-1 and ai-devbox-1 at 02:18–02:22 UTC-4 with a bare Mozilla/5.0 browser label, and Tracebit saw the same IP make 17 AWS calls on 2 older canary passwords (14 blocked, 3 GetCallerIdentity allowed). The passwords are older than our 6-day Tracebit history, so we do not know who first stole them. (High confidence that one IP did both — we saw it on both surfaces in one window. Moderate on what it means — one window, and the gap between stealing and using is unmeasured.)
  2. Stolen canary passwords are being stored, not spent. 63 passwords went to 36 collecting addresses this window; only 2 were used, both old, both by that one address. The two biggest new piles stayed quiet: AI-EXEC-HUNT's 41 (no use at +24 h) and 217.60.198.111's 6 first-day passwords. (High confidence on the counts — they come from the Tracebit alert log. Moderate on the trend: a password could be used after our data window closes.)
  3. Census tools now jump between hosting companies within a single day. The same mix of requests (config-bundle files, Tomcat path bypass, phpinfo, Symfony profiler, WordPress batch, WHM login, .DS_Store) came from 217.60.198.111 (first ever), 146.70.211.38 (first ever, M247), 208.84.100.218 (seen since 10-02), and 23.234.78.109 (tzulo). The simplest explanation is one tool circulating among several renters. (Moderate confidence — the request mix is the fingerprint; nothing else yet links the four.)
  4. Every traffic jump has a named cause. netcup-ts grew 38% and 74.4% of it is the Bochum university research crawler (5,534 of 7,440 events). ai-devbox-1 grew 39% from WebSiphon (669), the LeakIX legs, four LIBREDTAIL runners, and Techoff .159 (384). control-1 fell 23% because the previous day's record census did not repeat. frantech-ts stayed flat with one dictionary replay filling 91% of the node. (High confidence — every IP is accounted for.)

Campaigns (who / what / what it means)

CONFIGBUNDLE-KIT — a new config-file census kit shared across hosting renters

  • Who: 217.60.198.111 — first ever sighting, 03:44 UTC-4, 629 events across 4 sensors (canary-farm-1, ai-devbox-1, control-1, ru-edge-1) in 19 minutes, 6 canary passwords, fake browser labels Chrome/105–107, Firefox/105–106, Safari/16, and python-requests/2.32.5. 146.70.211.38 — first ever, 04:23 UTC-4, M247 hosting, 600 events on 3 sensors, 2 passwords, Chrome/106. 208.84.100.218 — known since 10-02, 36 events on 3 sensors, 1 password, fake Chrome/39. 23.234.78.109 (tzulo) — yesterday's ADMINER-SWARM heavy hitter, same request families, 4 passwords, plus a walk of our fake Kiteworks server.
  • What they did: they asked for configuration-bundle files, tried the Tomcat /..;/ path trick against env files, hit phpinfo and Symfony profiler pages, sent WordPress batch requests, and probed WHM logins. Together they took 13 canary passwords. No request bodies were captured this window. 297 of 217.60.198.111's 629 events hit our tarpit (the slow-down trap).
  • What it means: someone rents whichever server is cheap and runs the same kit everywhere. They want credential-bearing config files. The decoys answered with errors and tarpits, so they paid time for nothing. The 217.60.x block once hosted LIBREDTAIL's dropper — a hosting coincidence, not proof of a link. The next window tells us whether this is one kit or four lookalikes.

WEBSIPHON — a scanner that honestly names itself, now on its fourth wave of operators

  • Who: four new Oracle US addresses, each sending exactly 669 requests to one sensor in about 5 seconds: 164.152.24.126 (ru-edge-1 at 19:25 UTC-4, took 1 password), 170.9.228.116 (netcup-ts 20:24), 163.192.198.182 (frantech-ts 21:52), 147.224.178.252 (ai-devbox-1 22:02, took 1 password). That makes 11 operator addresses over three windows (1 in №55, 6 in №57, 4 in №58). control-1 was skipped this time.
  • What they did: they ran the usual WebSiphon census under the honest WebSiphon/next-0.1 label, plus a brand-new 35-path list aimed at GPU-cloud and alternate providers: /runpod-volume/.env.local, /opt/runpod/.env.local, /config/crusoe.yaml, /config/cudo.yaml, /config/paperspace.env, /config/vultr.yaml, /config/koyeb.yaml, /.env.replicate, /.env.akamai, /home/ubuntu/.env.production, and build/config-json files. This list is our ru-edge first-seen table.
  • What it means: the tool is still in development — someone added a GPU-cloud wordlist and four fresh servers in the same window. The №55 passwords were used in AWS within hours; these 2 new ones are the ones to watch.

CREDENTIAL-DRAIN — the steal-now, use-later pipeline

  • Who: 63 passwords minted to 36 collector addresses. The only AWS user this window: 156.225.26.90, working 2 passwords older than our 6-day history. SES-QUOTA-PROBE (137.23.38.53) did nothing.
  • What they did: 10 blocked ListFoundationModels calls, plus blocked GetAccountSummary, DescribeRegions, ListBuckets, ListCustomModels, and 3 allowed GetCallerIdentity calls. Nothing beyond identity leak succeeded. The same address ran the /@fs probes described above.
  • What it means: the big password piles keep aging without being spent — the largest quiet piles are 34.58.160.181 (41), 45.148.10.171 (35 in 6 days, its 26th straight window), 213.209.159.175 (24 in 6 days, 6 now), 37.60.226.187 (14 in 6 days), 80.94.92.126 (9) and 80.94.92.65 (6), 140.245.97.208 (7), 45.138.12.51 (7). The 156.225.26.90 case shows use can come long after the theft, from servers that also run our attackers' favorite probes. Our deny-all policy held.

LIBREDTAIL-KIT — the PHP-CGI attack chain, honest-label arm now runs on four servers

  • Who: four runners all using the honest libredtail-http label, all on ai-devbox-1: 169.58.137.184 (10:57 UTC-4), 168.222.180.62 (14:06), 190.171.189.85 (17:22), 144.91.124.251 (19:48). Each sent 46–49 events, 37 of them the phpunit test. The fake-browser cluster 7e61a9500d8b continues on 6 sensors (11 IPs, 539 events).
  • What they did: the usual chain — command-injection probes against /bin/sh, Apache CGI, and PHP-CGI endpoints. For the tenth window in a row, no dropper body was captured.
  • What it means: last window this honest-label arm used one server; now four ran on one node in one day. That looks scheduled, not random.

REGISTRY-HUNT / LeakIX — the self-named leak scanner that keeps minting

MEGA-DICTIONARY — the shared malware-URL wordlist, new host again

  • Who: 146.70.200.195 (M247, geolocated AU) — a new host. It sent 13,747 requests with 13,747 different paths to frantech-ts in about 2 minutes (01:54–01:55 UTC-4), 91% of the node's traffic, under 25 fake router labels (D-Link, TP-Link, MikroTik, Ubiquiti, Totolink, Netgear, and others). Third host in three windows.
  • What they did: we compared its path list against everything frantech-ts has ever recorded: 13,743 of 13,747 paths were known — only 4 were new (/s7cn4.x86, /eclipse.ppc, /jireyrsdnf/mips, /jireyrsdnf/x86).
  • What it means: the same list keeps passing between hosting renters and keeps growing slowly. If a second host fetches the new jireyrsdnf/ paths, the list is spreading.

BUCKLOG-KIT — census continues on a new host, attack arm quiet

  • Who: census runner 185.177.72.69 on canary-farm-1 (30 trap families — GravitySMTP probe first, then a long AWS/S3 credential walk). Collector 185.177.72.64 took 2 passwords on canary-farm-1 (6 in 6 days). Light legs: 185.177.72.7 (fake Kiteworks walk), 185.177.72.29 (curl).
  • What they did: the census walked bucket, config, and credential paths; the collector took its passwords at /.env under a fake Firefox/3.6.9 label. The phpunit attack arm did nothing.
  • What it means: the 185.177.72.x block keeps rotating jobs between its servers — census one day, password collector another, attack arm when it feels like it.

TECHOFF / PHPSWEEP — one hosting company, one job per server per day

  • Who: 195.178.110.159 on ai-devbox-1 (384 events, all 264 of the node's fake-git-miss spike — the third node in three windows). 195.178.110.217 in the frantech ssh honeypot (see below). 195.178.110.22 absent.
  • What they did: a git-internals wordlist walk, and post-login hardware surveys in the honeypot.
  • What it means: one hosting block, rotating single-purpose servers. The block, not any single address, is the thing to track.

Smaller watchers

  • WP-ENUM class — 45.156.128.156, .157, .158 (lauterbourg-01-ts) and 45.156.129.160 (netcup-ts, 18 events) ran 9-event walks of / and /favicon.ico under the bare Chrome/123 label; lookalikes 185.226.197.7 (farm) and 109.105.209.13 (ru-edge). A new digest signature 2747058d6260 is the same shallow walk under Edg/120 from 152.32.176.68, 165.154.182.179, and 118.194.228.239 (3 sensors, 84 events).
  • Fake Kiteworks server traffic — lauterbourg-01-ts drew its first routine visitors: TOKEN-CRAWLER regulars 45.198.224.124 and .125, the InternetMeasurement scanner pair 87.236.176.219 and 45.55.151.3, 23.234.78.109, 45.156.128.158, and known benign crawlers. Nothing new to register.
  • 85.155.14.16 (SolidCore Hosting, DE) — escalating watch. Third window since 10-18: a 356-event, 47-family credential census on control-1 (AWS, GCP, firebase, kubeconfig, docker-compose, rails, s3cfg, boto paths) plus 1 password under a fake Firefox/126 label; 3 passwords in 6 days.
  • 150.228.105.248 — labels itself WebMap/1.0; research scanner and took 3 canary passwords in 4 minutes (17:58–18:02 UTC-4). Research tools do not usually keep the passwords; we watch for a repeat.
  • First-time single-password collectors: 192.34.57.175 (Go-http label, control 09:31), 194.32.120.210 (Chrome/86, farm 22:11), 45.131.195.68 (Firefox/106, farm 07:26), 172.93.215.8 (fake Safari/4.0.4, aidev, 3 sensors), 162.254.24.228 (fake Android UCBrowser, aidev and netcup), 185.241.208.252 (fake Chrome/85, ru-edge 03:33 — also owns ru-edge's 33-event fake-git spike), and a new pair 77.90.185.243 + 77.90.185.244 (2 + 2 passwords on ru-edge under fake Firefox/3.0.13 and Android Chrome/37 — new block, watch).

Standing actors (who keeps coming back)

  • 45.148.10.171 — 26th straight window collecting passwords (3 now, 35 in 6 days, fake antique browser labels). Our longest-running collector.
  • 204.76.203.18 (Pfcloud, NL) — day 30+ of the malware-URL loop on control-1: 1,359 events. Sibling 204.76.203.219 did its 8-sensor light walk again.
  • Bochum softsec crawler (185.73.23.161, .162, .168) — ninth window, confirmed benign: 74% of netcup-ts and 81% of sponge-01-ts traffic.
  • TOKEN-CRAWLER pool 45.198.224.x — .124 (105 events) and .125 (63) touched all 8 sensors again, no passwords taken.
  • 213.209.159.175 (Feo Prest) — 6 passwords on control-1, 24 in 6 days, fake old-browser labels.
  • 37.60.226.187 — 7 mint rows across four sensors, 14 in 6 days, one under the odd honest label P3P Validator.
  • Benign fixed-cadence probers — 89.248.172.33 (387 events, 7 sensors), 80.82.77.202 (378, 7), 34.140.3.155 (28, 7), Censys-class 71.6.155.70 (8 sensors), 3.129.187.38 (4 sensors), and tarpit-only walkers 194.26.192.12, 43.161.251.162, 150.107.36.82, 46.151.178.14.

Who went quiet

AI-EXEC-HUNT (second quiet window — its 41-password pile still unused), SES-QUOTA-PROBE, ADMINER-SWARM's 99-IP pools (first miss; its heavy hitter 23.234.78.109 kept going under the new kit's behavior), METADATA-HUNT's named runners (fifth quiet window, though the marker probe now has an AWS face), WP-FORM-BRUTE, CVENGINE-KIT, CENSUS-284, OMEGA-SWEEP, GOWEB-PENTEST, EMPERORS-KIT, XMLRPC-BRUTE, NIGHTAGENT, CRUSADER-SWEEP, MEVSPACE-GITWALK, ZKILLU-GITWALK, KEYDROP-SCANS, INFOCREST-KIT, CONFIG-SWEEP, CF-FRONTED CREDSWEEP, SONICWALL-VPN-PROBE, PROTON-CENSUS, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, SI-CENSUS, ENVRC-SWEEP, ATLASSIAN-REST-PROBE, KITEWORKS-CRAWL's Google pair, KEYHUNT, WP-ENUM's older 129.x generation.

Network sweeps (Arkime) — attacks our web traps cannot see

The fleet's traffic sensors recorded 115,743 inbound SSH sessions on port 22. Sweep identity is the client fingerprint, never the address.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 7,610 sessions from 391 addresses across 200 networks in 58 countries. Day-by-day IP counts: 10-15: 352, 10-16: 281, 10-17: 257, 10-18: 324, 10-19: 418, 10-20: 402, 10-21: 99 (the day was still running at window close). It reads our banner and leaves; no login attempts.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397, banner ssh-2.0-go) — back over the sweep threshold: 15,651 sessions from 66 addresses across 23 networks in 15 countries (daily IPs: 32, 64, 46, 54, 32, 64, 28). Its biggest talkers sit in 77.239.124.x.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499) — shrank hard: 26,085 sessions (down 10,648) from 42 addresses (down 24), back to single-source shape after the record window.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc) — collapsed to 5 addresses, the biggest spread change of the day; it keeps switching on and off.
  • No new fingerprints appeared. Standing sub-threshold clients include 2ec37a7cc8da… (2,484 sessions, 19 addresses) and 4e066189c3bb… (25,666 sessions, 11 addresses — the busiest client on control-1).

What it means: banner sweeps stay background noise, and the pool sizes swing day to day. One honeypot note below shows a sweep-range address moving from banner reads to real logins.

Canaries (minted and used) — the trap-password funnel

Fleet sensors minted 63 canary passwords to 36 collector addresses. 2 passwords were used in AWS, both old, both by 156.225.26.90. AWS blocked 14 calls and allowed 3 GetCallerIdentity calls (those leak only our account ID). 61 passwords sit unused. Mint attempts failed 18 times (ai-devbox-1 5, canary-farm-1 6, control-1 2, ru-edge-1 4, plus 1 ru-edge row with no error text) — 17 were the known "400 Bad Request" burst-pacing rejection, none were key errors. Per node: canary-farm-1 24 passwords from 15 addresses, ai-devbox-1 23 from 16, control-1 16 from 8, ru-edge-1 9 from 7, lauterbourg-01-ts 0.

Who took passwords this window (address — sensor, count, history): 213.209.159.175 — control-1, 6 now, 24 since 2026-10-15 03:07 · 150.228.105.248 — ai-devbox-1, 3 now, 3 since 2026-10-20 17:58 · 217.60.198.111 — ai-devbox-1, 3, and canary-farm-1, 3 (6 total since 2026-10-21 03:45) · 140.245.97.208 — canary-farm-1, 2, and ai-devbox-1, 1 (7 since 2026-10-16 16:38) · 185.177.72.64 — canary-farm-1, 2, 6 since 2026-10-14 22:52 · 23.234.78.109 — canary-farm-1, 2, 6 since 2026-10-17 20:53 · 37.60.226.187 — ai-devbox-1, 2, canary-farm-1, 2, control-1, 2, ru-edge-1, 1 (14 since 2026-10-14 07:08) · 77.90.185.243 — ru-edge-1, 2, since 2026-10-20 20:26 · 77.90.185.244 — ru-edge-1, 2, since 2026-10-20 23:48 · 80.94.92.65 — canary-farm-1, 2, 6 since 2026-10-16 07:17 · 138.68.82.23 — control-1, 1, 2 since 2026-10-17 20:23 · 138.68.86.32 — canary-farm-1, 1, 3 since 2026-10-14 20:11 · 142.93.129.190 — canary-farm-1, 1, 2 since 2026-10-16 19:10 · 146.70.211.38 — ai-devbox-1, 1, and control-1, 1 (2 since 2026-10-21 05:29) · 147.224.178.252 — ai-devbox-1, 1, since 2026-10-20 22:02 · 157.245.105.107 — canary-farm-1, 1, 4 since 2026-10-14 20:11 · 157.245.113.227 — canary-farm-1, 1, 2 since 2026-10-15 18:39 · 162.254.24.228 — ai-devbox-1, 1, 2 since 2026-10-18 19:09 · 164.152.24.126 — ru-edge-1, 1, since 2026-10-20 19:25 · 164.92.244.132 — ai-devbox-1, 1, since 2026-10-20 20:23 · 167.71.81.114 — canary-farm-1, 1, 2 since 2026-10-18 20:27 · 167.99.182.39 — ai-devbox-1, 1, 2 since 2026-10-17 04:08 · 167.99.210.137 — canary-farm-1, 1, 3 since 2026-10-14 20:01 · 172.93.215.8 — ai-devbox-1, 1, 2 since 2026-10-18 21:00 · 185.241.208.252 — ru-edge-1, 1, since 2026-10-21 03:33 · 192.34.57.175 — control-1, 1, since 2026-10-20 09:31 · 194.32.120.210 — canary-farm-1, 1, since 2026-10-20 22:11 · 206.189.233.36 — control-1, 1, and ru-edge-1, 1 (2 since 2026-10-20 19:58) · 206.81.24.74 — ai-devbox-1, 1, 2 since 2026-10-16 20:03 · 208.84.100.218 — ai-devbox-1, 1, since 2026-10-21 03:34 · 45.131.195.68 — canary-farm-1, 1, since 2026-10-21 07:26 · 45.138.12.51 — ai-devbox-1, 1, 7 since 2026-10-14 09:18 · 46.101.1.225 — ru-edge-1, 1, 3 since 2026-10-15 17:46 · 68.183.9.16 — ai-devbox-1, 1, 2 since 2026-10-16 21:17 · 80.94.92.126 — canary-farm-1, 1, 9 since 2026-10-17 10:09 · 85.155.14.16 — control-1, 1, 3 since 2026-10-18 03:19 · and the user: 156.225.26.90 — 2 older passwords, 17 AWS calls, no mints in the 6-day history window.

Largest quiet piles with no observed AWS use: 34.58.160.181 (41, taken 2026-10-19 16:03), 45.148.10.171 (35, 2026-10-14 12:14 → 2026-10-20 07:27), 213.209.159.175 (24, since 2026-10-15 03:07), 37.60.226.187 (14, since 2026-10-14 07:08), 80.94.92.126 (9), 194.59.31.39 (8, 2026-10-14), 140.245.97.208 (7), 45.138.12.51 (7), 185.177.72.64 (6), 213.209.159.154 (6), 217.60.198.111 (6, first day), 23.234.78.109 (6), 80.94.92.65 (6), 64.23.218.208 (5), 79.124.58.82 (5), 102.220.163.155 (4), 103.214.20.135 (4), 109.205.176.10 (4), 157.245.105.107 (4), 165.22.34.189 (4), and 3-mint singles: 104.251.180.112, 104.64.127.170, 134.122.28.88, 137.23.38.53, 138.68.86.32, 146.190.63.248, 150.228.105.248, 157.230.19.140, 159.223.132.86, 167.99.210.137, 172.239.158.26, 185.177.72.17, 206.81.24.227, 209.38.208.202, 209.38.248.17, 209.99.189.217, 46.101.1.225, 64.227.70.2, 85.155.14.16, 92.38.172.10.

How the fleet behaved (Fleet Observations)

  • Volume moves, all explained. ai-devbox-1 +39% (WebSiphon 669, Techoff 384, LeakIX legs, the four LIBREDTAIL runners about 190, CONFIGBUNDLE actors about 280). netcup-ts +38% (74.4% Bochum research crawler plus WebSiphon's 669). frantech-ts +5% (one replay is 91% of the node). control-1 −23% (the previous day's census record did not repeat; the Pfcloud loop at 1,359 is now its base load). The other four nodes moved 9% or less.
  • The address-forgery counter fired for the first time. On 2026-10-20 at 17:53:58 UTC, one request reached canary-farm-1 claiming X-Forwarded-For: 223.184.193.141 while the real connection came from 169.40.142.202. It called itself metabase-cve-2026-72898-detect/1.0 (benign detection probes only) and asked for /api/session/properties. That peer has 4 events since 09-26. The "benign" label is part of the disguise; the /16 is the same range as the ZKILLU git-walker's address (a hosting note, not proof). One event so far — if it returns with volume, it gets a name. Total XFF counters: 1,325 requests carried the header, 0 multi-entry chains, 456 ignored-internal, 1 mismatch.
  • TLS and host headers stay boring (good). ai-devbox-1 served 337 HTTPS events (683 on the fake inference.fapthropic.com host), canary-farm-1 351 (677 on sso.rightabouteverything.show), lauterbourg-01-ts 180 under the raw IP.
  • control-1's discovery count is back to normal. 104 unique addresses after last window's census-inflated record of 167. Day 38 of the node.
  • Known data quirks held. First-seen timestamps cluster at the 03:15:37 log-sync arrival (they show when logs landed, not when the request happened — the GPU-cloud paths actually came from WebSiphon hours earlier). Spot-query totals run slightly above digest cells because the windows drift a little.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

436 addresses tried passwords → 303 got a shell (69%) → 243 ran a command. Counted by events: 22,319 password tries → 16,860 accepted logins (3.3× last window's 5,070) → 18,638 commands. Telnet bots: 1,220 tries.

For the 31st window, no command appeared for the first time (0 of 50 distinct). But the volume moved: one address, 84.42.45.253, ran echo -e "\x6F\x6B" 11,929 times — an automated "are you alive" loop that inflated the login and command counts by itself. The usual post-login set continues: the .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 1,177 events from 219 addresses; the key-replace chain — 1,031 from 198) and hardware surveys. Two notes worth flagging: 109.160.32.151 (plus one sibling) ran the uname hardware survey 1,285 times each — that is the same 109.160.32.x range the GO-SSH banner-sweep pool uses, so a sweep-range address moved from reading banners to real logins on the honeypot. And 195.178.110.217 (Techoff hosting) ran the standard survey 445 times per command.

Passwords: 15,970 distinct pairs offered, 0 new. The fixed-pair sprayer from №56 is back: 345gs5662d34/345gs5662d34 leads with 1,152 tries, root/3245gs5662d34 with 818, plus admin/ubuntu/user variants of 3245gs5662d34.

Open questions

  1. How old are the passwords 156.225.26.90 used? They fall outside our 6-day Tracebit history. Next cycle we pull further back to learn which sensor minted them and when. Will the /@fs probe come back with a full census behind it?
  2. Is CONFIGBUNDLE-KIT one tool or four lookalikes? Two first-ever operators ran the same request mix 40 minutes apart. We need a second window, a captured WordPress-batch body, or AWS use of 217.60.198.111's 6 passwords to call it.
  3. Will AI-EXEC-HUNT's 41 passwords ever be spent? Zero use at +24 h. We keep pulling.
  4. Will WEBSIPHON's 2 new passwords be worked like the №55 batch was? And does the operator count keep climbing past 11 addresses in 3 windows?
  5. Who is behind 169.40.142.202, the address that lied about its own? One forged request so far. A repeat with volume gets it named — we track the socket address, never the claimed 223.184.193.141.
  6. What is the 77.90.185.x pair? 4 passwords on ru-edge-1 under fake antique browsers, first appearance. One more window should tell us.

Plain language version of: flux-fleet-intel-briefing-2026-10-21.md