Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №63 — PLAIN LANGUAGE

Period: 2026-10-25 07:33 – 2026-10-26 07:33 UTC (24h, day 61 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-26.md

What happened (plain)

Attackers hammered the fake WordPress site on the lauterbourg honeypot harder than ever before. Two different groups posted 11,807 password-guessing requests at its XMLRPC login door in one day. The biggest group, from a Google cloud address (136.70.193.85), fired 9,807 requests in 17 minutes and tried 7,861 different username-and-password combinations — the first time this campaign has guessed many accounts instead of one. An old attacker's dictionary of 13,776 malicious download links came back to the frantech honeypot, delivered by two different servers within five hours; one carried the full list, the other carried a 3,074-link slice of it. A password-guessing crowd set a new record against our fake WordPress login forms: 494 different username/password pairs across 5 sensors, passing the alarm line we set at 200 pairs. Two new attack playbooks got names today, and not one of the 50 fake credentials the attackers stole this window was actually used in Amazon Web Services.

What it means (plain)

  1. The freshly rebuilt lauterbourg honeypot is now a magnet for volume attacks, not just exploit tests. It logged 11,807 XMLRPC password-guessing events (22.3 times its normal level) from two groups, right after an exploit kit on 10-23, another kit on 10-24, and a seventh XMLRPC operator on 10-24. Attackers' target lists update fast. (High confidence on the events — they are in the digest and the request histories; Moderate confidence on the trend — four days is a rate, not a schedule.)
  2. The 13,776-link dictionary is one shared tool that moves between attacker servers, and it now travels in pieces. One server (23.234.118.146, hosted by tzulo in the US) requested all 13,776 links in 55 seconds; another (176.119.150.252, Owl Limited in Germany) requested 3,074 of them in 18 seconds, and every one of those 3,074 was inside the first server's list. Both used the same 208 fake router usernames and carried the same 5 marker links the list has traveled with for weeks. (High confidence the two runs used the same list — the subset match proves it; Moderate confidence the operators are connected — we never saw a direct handoff.)
  3. The WordPress form-guessing crowd is big, organized, and growing. 494 distinct password pairs across 5 sensors in one day (the old record was 363), with 103 different addresses attacking canary-farm-1 alone, and every request carried valid anti-bot tokens. (High confidence on the counts — verified by direct query; Moderate confidence on intent — a fake site cannot show what a successful login would have fetched.)
  4. Credential theft paused this window, but the stolen pile keeps growing. Zero of the 50 credentials minted this window were used in AWS (checked against Tracebit alerts), one cycle after a stolen credential ran 672 AWS events. Named attacker stockpiles now hold 182+ unused credentials. (High confidence on the zero — the alert pull covers the window; Moderate confidence on what it means — a slow user and a reseller look the same from outside.)

Campaigns (who / what / what it means)

MEGA-DICTIONARY — a shared list of malware download links, replayed by whatever server holds it

  • Who: 23.234.118.146 (tzulo inc., US — the same company as an earlier replay host, 23.234.117.146, and as the ADMINER-SWARM operator) ran the full list 03:29:10–03:30:05 stored; 176.119.150.252 (Owl Limited, Germany) ran a 3,074-link slice 23:36:06–23:36:24 stored on 10-25. Both are new host servers for this campaign.
  • What they did: they only sent GET requests, and every link 404'd. The full run: 13,776 requests, 13,776 different paths, 55 seconds, 208 fake router/IoT browser identities (TP-LINK WR940N, MikroTik WinBox 3.18, ZTE MC801A, aiohttp/3.8.6). The partial run: 3,074 requests in 18 seconds, all inside the first list, same 208 fake identities. Both carried the list's 5 marker links (gravitysmtp-miss, llm-endpoint-ollama-ps, llm-endpoint-models-list, exchange-powershell-pre-auth, observability-profiler-index). No credentials stolen, no data posted. The list is unchanged at 13,776 paths — we verified this by size and markers, because frantech's local log history is too short for a path-by-path comparison (see Open questions).
  • What it means: the list is being handed around or re-hosted between attacker servers, and this is the first time it arrived in pieces. Our honeypots served nothing and gave up nothing. Worth watching: a third server, any growth in the list, and whether partial deliveries become normal.

XMLRPC-BRUTE — password guessing through WordPress's machine-to-machine login door

  • Who: 136.70.193.85 (Google Cloud, US — a new operator, the campaign's eighth) sent 9,807 requests in 17 minutes. 194.26.192.113 (1337 Services GmbH, Germany — the seventh operator, back for a second day in a row, 3,021 requests all-time) sent 2,000 requests spread over 12.4 hours.
  • What they did: both first checked the fake site was alive (the fake root page, /wp-includes/wlwmanifest.xml answered 200, /wp-json/wp/v2/users/ answered 200, /wp-json/oembed/1.0/embed answered 404), then posted password guesses to /xmlrpc.php. Every guess got a 200 answer from our decoy. The new operator's requests carried 7,861 different username/password pairs, between 480 and 1,496 bytes each. One captured request (truncated by the capture, quoted exactly): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>\n<value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>leslyg</string></value><value><string> شى شى1811</string></value></data></array> — the usernames change per request, and some passwords mix in non-Latin characters. The German operator kept the old habit: one fixed username (admin), 1,000 distinct guesses of 479–497 bytes each.
  • What it means: this is the campaign's fastest run ever (about 577 guesses per minute; the old sustained record was 18,063 guesses over 6.5 hours, about 46 per minute). Guessing many usernames, not one, makes the tool more dangerous against real sites. Our fake WordPress answered everything and revealed nothing. Worth watching: a repeat of the many-username style, a second Google Cloud address, and any sign the form-guessing crowd and this crowd share tooling.

WP-FORM-BRUTE — a crowd of addresses guessing the fake WordPress login form (signature df15d0ee3ccf)

  • Who: canary-farm-1 took 224 password pairs from 103 addresses; control-1 took 125 pairs from 5 addresses; netcup-ts 56 pairs from 2; sponge-01-ts 44 pairs from 2; lauterbourg-01-ts 46 pairs from 1 address using a bare Mozilla/5.0 label (a separate single-address effort). The digest's 7-address probe-then-guess cluster carried 594 requests across the fleet.
  • What they did: they posted to /wp-login.php with correctly formed anti-bot tokens. Two captured bodies (quoted exactly): _wpnonce=cbcce48f2e&log=admin&pwd=381234%21&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In and _wpnonce=01f33b8b6d&log=admin&pwd=admin123&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In. They rotated fake Chrome/130–151, Firefox/133, and Safari/18.1 browser identities. Fleet total: 494 distinct pairs; the old record was 363.
  • What it means: the form crowd still guesses one username (admin) while the XMLRPC crowd moved to many — they may be different groups hitting the same decoy. Our alarm level was 200 pairs; this window passed it. The volume itself is the signal. Worth watching: whether the crowd re-adds the session-checking sibling behavior (WP-REST-ENUM) seen before.

REGISTRY-HUNT / LeakIX — LeakIX's public scanner walking a 12-step checklist of admin panels and container registries

  • Who: 11 DigitalOcean servers ran the full 27-family walk this window — canary-farm-1: 159.223.132.86, 143.110.213.72, 147.182.149.75, 209.38.208.202, 159.89.174.87, 64.23.218.208; ai-devbox-1: 134.209.25.199, 157.230.19.140, 167.172.232.142; ru-edge-1: 207.154.212.47, 46.101.1.225. Three of them reached lauterbourg-01-ts for the first time (46.101.1.225, 207.154.212.47, 209.38.208.202, each seen on 2 sensors). Two more took credentials on control-1 without a full walk (206.189.233.36, 206.81.24.74).
  • What they did: the same walk as always — fake WebLogic console, server status page, Confluence login, WHM/cPanel proxies, then docker registry listing requests (/v2/_catalog, /v2/internal/*/tags/list, /manifests/latest). They identify themselves honestly with l9scan browser strings (4 variants in use). 13 of the window's 50 stolen credentials went to these runners between 20:55 and 21:45 stored.
  • What it means: LeakIX keeps scanning us and keeps collecting our decoy credentials — 13 more this window. Their pattern has been to try stolen keys in AWS after the daily window closes, so the next pull matters. The lauterbourg legs say their target list picked up the rebuilt node.

SI-CENSUS / CREDSWEEP census pair — two unrelated groups running the same .env file checklist

  • Who: 102.220.163.241 (VPS Dedicated LLC, Slovenia — a new address range for this family; the known one is 102.220.161.x) hit ru-edge-1 (2,658 requests, 859 paths, 39 trap families) and ai-devbox-1 (517 requests, 511 paths, 34 families). 93.152.221.96 (TechTies Inc., Germany) hit all 7 sensors it could, 525 requests, 34 families on farm.
  • What they did: both ran the identical checklist in the same order: /.env (which minted a credential) then /vendor/.env, /lib/.env, /lab/.env, /cronlab/.env, /cron/.env, /core/.env, /core/app/.env, /core/Datavase/.env, /database/.env, plus a marker file named pscan-<hash>-nonexistent.txt. Both faked Chrome/126. Their shared wordlist drove the phpinfo spikes (8.3× and 6.1×) and webshell-probe spikes (17.0× and 8.5×), with 122 events each. They collected credentials: 5 to the Slovenia address, 8 to TechTies (12 over 6 days and counting).
  • What it means: one checklist, multiple buyers — the same marketplace pattern we have seen before. 13 credentials left the fleet to these two addresses this window. Worth watching: any AWS use from either, and the Slovenia family now has a second window so it counts as active again.

CLOUDCONF-CENSUS — a checklist for cloud-login files and VPN tunnel configs (new name; first seen 10-18)

  • Who: 85.155.14.14 (hit canary-farm-1 and netcup-ts) and 85.155.14.15 (hit frantech-ts), both hosted by SolidCore Hosting in Germany. Three addresses, 2,015 requests all-time since 2026-10-18, never named until today.
  • What they did: GET-only, 356 requests on each of 3 sensors, 47 trap families on farm. Cloud files: /.aws/credentials plus .old and .bak copies, /.aws/sso/cache, /.azure/accessTokens.json, azureProfile.json, clouds.config, /.config/gcloud/application_default_credentials.json, access_tokens.db, /.aliyun, /.boto, /.cloudflare, /.config/doctl/config.yaml, /*.tfvars, passwd-s3fs, s3cfg. VPN configs (all first-seen on netcup): /wg0.conf, /globalprotect.conf, /watchguard.conf, /paloalto, /checkpoint, /mullvad, /strongvpn, /vyprvpn, /cisco-vpn, /proxy.yaml, plus provider state files /.netlify/state.json, /.scaleway, /scaleway.json, /.openstack, /.softlayer.json, /hetzner.json. Faked Chrome/124–125 and Firefox/125. No credentials minted.
  • What it means: this is the widest cloud-provider checklist we have recorded, and the first to treat VPN tunnel configs as loot. The 10-18 sighting sat unnamed for two cycles; it is on the books now. Worth watching: a stolen credential, a fourth sensor, or a return that closes the 8-day gap.

AI-ADMIN-SWEEP — one controller checking AI-server admin doors on 7 honeypots in the same second (new)

  • Who: 91.99.220.233 — seen for the first time ever; hosting not yet attributed.
  • What they did: 6 of its runs started within 0.15 seconds of each other (20:10:29.57–.71 stored, across control-1, ru-edge-1, netcup-ts, sponge-01-ts, canary-farm-1, ai-devbox-1); the frantech run came at 00:10:57. 865 requests total, 20 paths, a bare Mozilla/5.0 label, GET-only, no credentials minted, no data posted. The paths are the admin and setup doors of self-hosted AI apps: /api/user/self, /api/v1/admin/workspaces, /console/api/setup, /api/v1/chatflows, /rest/settings, /api/config, /model/info, /v1/models, /v1/chat/completions, /system_stats, /health/readiness — LiteLLM, Flowise, Dify, n8n, and ComfyUI style surfaces. Our tags read litellm-admin-unauthenticated, llm-endpoint-ollama-version, docker-daemon-info, observability-health, app-config-json.
  • What it means: one operator ran this against all sensors at once — organized, not incidental. If someone can reach a setup page unauthenticated, that is one step from takeover on a real server. Our decoys answered and gave up nothing. Worth watching: a second address, any POST request, or a follow-up from the same network range.

CREDENTIAL-DRAIN — the steal-then-spend pipeline, checked every window

  • Who: mint side: 50 credentials to 28 collector addresses this window. Use side: nobody.
  • What they did: nothing new this window — no AWS activity tied to our decoy keys. The stockpile: 136.66.182.42 holds 41, 34.58.160.181 holds 41 (those two are AI-EXEC-HUNT's takings, 82 together), 213.209.159.175 holds 30, 213.209.159.154 holds 18, 37.60.226.187 holds 17, 45.148.10.171 holds 11, 143.244.165.105 holds 9, 93.152.221.96 grew to 12 since 10-21, 208.84.100.218 holds 6 since 10-21.
  • What it means: the spending spree from №62 did not repeat, and the stockpile grew. The Feo Prest pair stopped minting — both addresses were absent after holding 48 between them. Either the buyers work on a longer cycle, or the keys sit unsold. Treat all 50 new credentials as held by hostile hands until they expire.

Smaller watchers this window

  • GOWEB-PENTEST: for the first time, two operator addresses ran in the same window — 36.99.60.192 and 191.102.244.103, each 151 phpMyAdmin login attempts on 1 path on sponge-01-ts, under their honest Go Web Pentest Tool label. They are the whole 7.3× spike on that node.
  • ADMINER-SWARM: about 40 addresses from the 173.239.214.x pool worked lauterbourg and ru-edge in pairs, 5–32 requests each, after missing №62; 173.239.214.87 minted 1 on ru-edge.
  • KEYDROP-SCANS: back again — 172.235.210.84 minted 1 on ai-devbox-1 (00:50 stored) with the same 2-request walk.
  • 208.84.100.218: 5 minted credentials across 4 sensors this window under the old Chrome/39 fake; 6 over 6 days. Our longest-lived standing collector (since 10-02).
  • 45.138.12.x (Tc Datacenter, Lithuania): second window of idle looping (45.138.12.19, 805 requests across 5 sensors; 45.138.12.35, 384 on aidev). Their 185 php2shell-root events are tarpit loop traffic, not real trap use.
  • 130.12.180.x (Omegatech, Netherlands): third window, now collecting — .170 and .176 minted 1 each.
  • 217.60.76.167 (LIBREDTAIL staging range) minted again — second window. 146.70.98.138 (env-dl/1.0) minted again — second window. 91.92.240.86 (fasthttp) minted on 4 sensors — its first collecting window.
  • ANDROXGH0ST-KIT: third window on lauterbourg (4 addresses, 164 requests), still probing only.
  • Benign regulars: 89.248.172.33 (7 sensors, 351 requests), 75.127.6.2 (zmap-proxy-probe/1.0, honest label, 7 sensors, 67 requests), 45.198.224.125 (8 sensors, 65 requests). Honest labels, shallow visits — research scanners, not hostile.

Standing actors (who keeps coming back)

  • 194.26.192.113 (1337 Services GmbH, Germany): second day in a row on lauterbourg, volume up from 1,007 to 2,000, pace slowed from burst to all-day. The same hoster also runs ANDROXGH0ST-KIT's lead address — two kits, one company.
  • 208.84.100.218: collecting on 4 sensors since 10-02. Longest-lived collector on the fleet.
  • 45.138.12.x (Tc Datacenter): second window of loitering; this block ran CVENGINE-KIT before.
  • 130.12.180.x (Omegatech): third window, now minting.
  • 93.152.221.96 (TechTies): collecting since 10-21 (12 credentials in 6 days), now also a 7-sensor census operator. Named as a campaign actor today.
  • Bochum softsec crawler (185.73.23.x): absent a third window in a row. Its absence, plus AI-CLI-VAULT's missing legs, is why netcup-ts (−69%) and sponge-01-ts (−77%) sit below their normal level.

Network sweeps (Arkime) — the port-22 scanners that never touch our web traps

These sweeps ask for no web page, so the web traps never see them; the pcap sensor on spark is the only witness. 126,730 inbound sessions hit the fleet's 8 public IPs on port 22.

  • LIBSSH-MASSSWEEP (fingerprint f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 4,138 sessions from 560 addresses across 242 networks in 63 countries. Daily address counts: 10-20: 402, 10-21: 327, 10-22: 314, 10-23: 443, 10-24: 617, 10-25: 579, 10-26: 200. Many addresses, few sessions each — a wide, shallow net.
  • GO-SSH-SWEEP (fingerprint 0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 24,113 sessions from 75 addresses across 30 networks in 24 countries. Daily counts: 10-20: 42, 10-21: 41, 10-22: 48, 10-23: 53, 10-24: 57, 10-25: 78, 10-26: 27. Its busiest addresses again include 77.239.124.x — the same address range that ran this window's command survey on the frantech shell honeypot (77.239.124.2 and 77.239.124.161). The sweep and the shell work remain one operation.
  • LIBSSH-011-SWEEP (03a80b21afa810682a776a7d42e5e6fb, banner ssh-2.0-libssh_0.11.1): stayed below the flag line — 43 addresses / 29 networks on day 16 of its run.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397): single-source shape, 33 addresses / 22,819 sessions.
  • Two sweeps stayed flagged this cycle (the same two as №62); no new fingerprints crossed the line.

Canaries (minted and used) — fake credentials and where they went

No decoy credential was used in AWS this window. The sensors minted 50 credentials, taken by 28 collector addresses. None reached AWS.

Funnel: 50 minted · 28 collectors · 0 used in AWS · 50 stolen with no observed use. (The digest's per-sensor table counts 51 mint rows — farm 18, aidev 14, ru-edge 11, control 8; that is a known counting difference, not a discrepancy in the facts.)

Who took credentials this window (address · sensor · count this window · history): 102.220.163.241 · ru-edge-1 · 4 · 5 since 10-25 09:28 · 93.152.221.96 · ai-devbox-1 · 3 · 12 since 10-21 23:57 · 208.84.100.218 · ai-devbox-1 · 2 · 6 since 10-21 03:34 · 208.84.100.218 · canary-farm-1 · 2 · 6 since 10-21 03:34 · 46.151.178.15 · canary-farm-1 · 2 · 4 since 10-25 17:05 · 93.152.221.96 · canary-farm-1 · 2 · 12 since 10-21 23:57 · 93.152.221.96 · control-1 · 2 · 12 since 10-21 23:57 · 93.152.221.96 · ru-edge-1 · 2 · 12 since 10-21 23:57 · 102.220.163.241 · ai-devbox-1 · 1 · 5 since 10-25 09:28 · 105.112.190.152 · canary-farm-1 · 1 · 1 since 10-26 07:03 · 130.12.180.170 · ai-devbox-1 · 1 · 2 since 10-23 14:39 · 130.12.180.176 · canary-farm-1 · 1 · 1 since 10-25 13:18 · 134.209.25.199 · ai-devbox-1 · 1 · 3 since 10-23 18:47 · 143.110.213.72 · canary-farm-1 · 1 · 1 since 10-25 21:41 · 146.70.98.138 · control-1 · 1 · 3 since 10-24 20:46 · 147.182.149.75 · canary-farm-1 · 1 · 2 since 10-24 04:32 · 157.230.19.140 · ai-devbox-1 · 1 · 3 since 10-19 20:25 · 159.223.132.86 · canary-farm-1 · 1 · 1 since 10-25 21:28 · 159.89.174.87 · canary-farm-1 · 1 · 1 since 10-25 21:00 · 163.61.91.104 · canary-farm-1 · 1 · 1 since 10-25 12:52 · 167.172.232.142 · ai-devbox-1 · 1 · 2 since 10-22 20:29 · 172.235.210.84 · ai-devbox-1 · 1 · 1 since 10-26 00:50 · 173.239.214.87 · ru-edge-1 · 1 · 1 since 10-25 21:06 · 180.93.244.150 · canary-farm-1 · 1 · 1 since 10-26 04:04 · 206.189.233.36 · control-1 · 1 · 3 since 10-20 19:58 · 206.81.24.74 · control-1 · 1 · 5 since 10-20 20:43 · 207.154.212.47 · ru-edge-1 · 1 · 2 since 10-24 20:03 · 208.84.100.218 · ru-edge-1 · 1 · 6 since 10-21 03:34 · 209.38.208.202 · canary-farm-1 · 1 · 2 since 10-22 19:21 · 217.60.76.167 · canary-farm-1 · 1 · 3 since 10-24 07:47 · 46.101.1.225 · ru-edge-1 · 1 · 3 since 10-20 20:02 · 46.151.178.15 · ai-devbox-1 · 1 · 4 since 10-25 17:05 · 46.151.178.15 · control-1 · 1 · 4 since 10-25 17:05 · 64.23.218.208 · canary-farm-1 · 1 · 1 since 10-25 21:41 · 91.92.240.86 · ai-devbox-1 · 1 · 4 since 10-25 13:52 · 91.92.240.86 · canary-farm-1 · 1 · 4 since 10-25 13:52 · 91.92.240.86 · control-1 · 1 · 4 since 10-25 13:52 · 91.92.240.86 · ru-edge-1 · 1 · 4 since 10-25 13:52 · 91.92.243.184 · ai-devbox-1 · 1 · 1 since 10-25 22:34.

Hoarders — collector addresses holding credentials with no observed AWS use (address: count, first-to-last mint): 136.66.182.42: 41, 10-24 05:03 → 10-24 05:03 · 34.58.160.181: 41, 10-19 16:03 → 10-19 16:03 · 213.209.159.175: 30, 10-19 16:42 → 10-23 15:04 · 213.209.159.154: 18, 10-19 06:24 → 10-25 02:52 · 37.60.226.187: 17, 10-20 02:15 → 10-21 21:45 · 93.152.221.96: 12, 10-21 23:57 → 10-26 05:46 · 45.148.10.171: 11, 10-19 04:59 → 10-22 00:53 · 143.244.165.105: 9, 10-21 18:02 → 10-23 21:39 · 80.94.92.126: 8, 10-19 11:21 → 10-20 10:36 · 140.245.97.208: 7, 10-20 23:51 → 10-24 16:12 · 169.150.196.6: 6, 10-25 03:05 → 10-25 03:29 · 195.178.110.22: 6, 10-24 06:41 → 10-24 06:53 · 208.84.100.218: 6, 10-21 03:34 → 10-26 03:41 · 217.60.198.111: 6, 10-21 03:45 → 10-21 03:54 · 80.94.92.65: 6, 10-19 06:23 → 10-21 09:39 · 102.220.163.241: 5, 10-25 09:28 → 10-25 10:13 · 165.227.102.187: 5, 10-21 16:37 → 10-25 04:14 · 206.81.24.74: 5, 10-20 20:43 → 10-25 21:04 · 157.245.113.227: 4, 10-20 20:04 → 10-24 20:05 · 159.26.101.138: 4, 10-23 16:04 → 10-23 16:21 · 185.177.72.64: 4, 10-20 01:57 → 10-20 08:44 · 23.234.78.109: 4, 10-20 05:35 → 10-20 14:00 · 45.138.12.51: 4, 10-20 22:16 → 10-24 18:42 · 45.148.10.125: 4, 10-23 01:44 → 10-23 04:39 · 46.151.178.15: 4, 10-25 17:05 → 10-25 21:14 · 91.92.240.86: 4, 10-25 13:52 → 10-25 21:58 · 134.209.25.199: 3, 10-23 18:47 → 10-25 21:41 · 138.68.144.227: 3, 10-22 21:03 → 10-24 20:54 · 146.70.98.138: 3, 10-24 20:46 → 10-25 20:51 · 150.228.105.248: 3, 10-20 17:58 → 10-20 18:02 · 157.230.19.140: 3, 10-19 20:25 → 10-25 21:41 · 185.177.72.9: 3, 10-23 13:14 → 10-23 13:14 · 206.189.233.36: 3, 10-20 19:58 → 10-25 20:58 · 217.60.76.167: 3, 10-24 07:47 → 10-26 05:25 · 45.148.10.5: 3, 10-22 00:28 → 10-25 02:19 · 46.101.1.225: 3, 10-20 20:02 → 10-25 21:06 · 64.89.163.14: 3, 10-21 08:34 → 10-21 10:53 · 72.167.41.202: 3, 10-21 17:58 → 10-21 18:02 · 93.152.209.6: 3, 10-22 02:01 → 10-24 19:57.

This was a zero-use window. Every credential listed above sits in hostile hands until it expires.

How the fleet behaved (Fleet Observations) — the numbers behind the day

  • Volumes and causes. frantech-ts +99% (17,368 requests from only 21 addresses): the two dictionary runs alone brought 16,850. lauterbourg-01-ts +696% (14,491 requests from 191 addresses): XMLRPC guessing brought 11,807 of them. The four drops all have known causes: ru-edge-1 −69% (the 69,601-request Exchange dictionary crawl from №60 ended), control-1 −79% (№62's 13,777-request dictionary leg and AI-CLI-VAULT's 1,720 did not repeat), netcup-ts −69% and sponge-01-ts −77% (the Bochum research crawler stayed away a third window, and AI-CLI-VAULT's legs were missing). canary-farm-1 −22% and ai-devbox-1 −15% are normal spread.
  • Credential minting. 51 mint rows in the digest (farm 18, aidev 14, ru-edge 11, control 8) versus 50 in the funnel — a known counting difference. Three mints failed with 400 Bad Request, all on /.env (farm at 22:35:57 and 07:31:59, control at 01:33:07 stored) — one-off upstream rejections, no pattern, no key problems. All minted credentials were AWS-type.
  • Identity tricks. Zero forged forwarding-header tricks this window. 3,500 requests carried an X-Forwarded-For header; 2,156 of those matched the real connection. The JNDI injection trick from №60 did not return. lauterbourg took 1,022 of its 14,491 requests over https (7.0%), farm 221, aidev 101 — the certless decoys take plain http, as designed.
  • control-1 discovery ramp. Day 43 of the deliberately fresh node: 983 requests from 109 unique addresses — the quietest day by volume since 09-14, but new-address discovery held near its average (7-day average 135). Volume fell because named one-off campaigns ended; stranger discovery did not.
  • Known quirks seen today. The first-seen table stamped netcup's whole VPN-config block with one log-arrival time (03:15:43 stored); arrival times are not observation times. The php2shell-root/php2shell-login tags caught 185 tarpit loop events from 45.138.12.19 — those tags are catch-alls, not trap hits.
  • Changes on our side. None. No node, config, or pipeline changes this cycle. The visuals dashboard gained the two new campaign chains and №63 status updates on ten existing chains.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is a single Linux box pretending to be an easy target. Numbers from one host never describe the fleet.

  • Funnel: 683 addresses tried passwords → 512 got a shell (75%) → 473 ran a command (92% of shell-getters, 69% of all addresses). In raw events: 28,758 password attempts → 5,517 accepted logins → 16,651 commands (302% of accepted logins led to commands). Telnet took 1,537 attempts. Operators keep working the box after entry, at the same rate as last window.
  • New commands: none. All 9,111 distinct commands on record were seen before this window. A brand-new command remains the one true post-break-in signal this sensor can give, and it stayed silent.
  • Recurring (context, not news): the system-survey commands ran again from 77.239.124.2 and 77.239.124.161 (2,119 + 2,119 + 832 command events) — the same address range that shows up in GO-SSH-SWEEP's busiest sources (77.239.124.149). The commodity SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then adding an attacker key to authorized_keys) came from 418 and 372 addresses — routine botnet behavior.
  • Passwords tried: 19,614 distinct pairs, 0 new. The 345gs5662d34 pair family took 1,408 of the 28,758 attempts (723 as the username itself, 685 as root with 3245gs5662d34). Concentration, not the list, is the story.

Open questions

  1. Will any of the 50 stolen credentials — or the 182+ in known stockpiles — show up in AWS before the next window? Zero use this window; the last use window was №62. The next Tracebit pull answers it.
  2. Is AI-ADMIN-SWEEP a one-shot probe or the start of a campaign? We have one address (91.99.220.233), one window, no POSTs. A second address, a POST, or a follow-up would tell us. We do not know who hosts it yet.
  3. Did the 13,776-link dictionary really stay unchanged, and will partial deliveries become the norm? We verified by size and marker links, not by a full path-by-path comparison — frantech's local log history does not reach back to the older replay hosts. Measuring that retention is on the list.
  4. How much bigger can the WordPress form-guessing crowd get? It passed the 200-pair alarm at 494 pairs from 103+ addresses. If the XMLRPC many-username style and this crowd merge, that is one tool, not two.
  5. How far back does each node's log sink actually reach? frantech's history holds no rows from the older dictionary hosts, which broke our usual verification method. We need per-node retention numbers.
  6. Will the 13 credentials taken by the LeakIX runners (20:55–21:45 stored) be the next ones used in AWS? Their pattern has been use after the window closes.