Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №66 — PLAIN LANGUAGE

Period: 2026-10-28 07:34 – 2026-10-29 07:34 UTC (24h, day 64 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-29.md

What happened (plain)

The attackers who flood the fake WordPress login kept the same target but changed tools halfway through. One operator (8.137.104.136, a Chinese hosting address) stopped its 14,438-post flood — the count froze at exactly where the last report ended — and switched to 6,706 password guesses at /wp-login.php. A smaller copycat (180.93.254.108, Vietnam) ran the same two-step on two of our fake sites at once. A known credential-stealing crew (AI-EXEC-HUNT) came back after two quiet days under a fourth new address and grabbed 41 fake credentials in 5 seconds. Our busiest single source of fake passwords, TechTies, skipped a day for the first time in five days, which is why two sensors looked much quieter. Two new hosts replayed a huge list of malware download links against frantech-ts, about 13,800 unique links each, in about two minutes apiece. No fake credential was ever used: 101 new ones went to 38 collector addresses, and none touched AWS — the fifth empty-hand cycle in the last six.

What it means (plain)

  1. The WordPress flood is a pipeline, not one burst. The same address ran stage one (check stolen passwords over xmlrpc) and then stage two (guess passwords at the login form). The counts prove the order: xmlrpc froze at 14,438, then wp-login grew to 6,706. (High confidence on the order — timestamps and the frozen count. Moderate on intent — one address proves sequence, not the operator's plan.)
  2. The shared target list got a new edition. Our fake-site walks carry a marker so operators recognize their own scans; that marker changed from pscan-<hash> to /kmonbase<hex>, and two unrelated operators used the new marker in the same window. Meanwhile SI-CENSUS carried the older list to a fifth sensor (netcup-ts) for the first time. (High confidence on the co-occurrence — same marker style, same window, different hosts. Moderate on "new edition" — two sightings only.)
  3. AI-EXEC-HUNT is a repeat operation, not a one-off scan. Four different Google-hosted addresses have run the same recipe — a fast census under fake AI-crawler names, then exploit attempts, then mass fake-credential theft (41–48 per run) — and none of the stolen credentials was ever used. (High confidence on the pattern — four runs on record. Moderate on timing — four runs do not yet prove a schedule.)
  4. The stockpile grows; the spending stays at zero. 101 fresh fake credentials went to 38 collector addresses this window. The largest pile (TechTies, 1,089 over 6 days) and three 41-credential piles have never been used. (High confidence on the zero — the alert pull covers the window. Moderate on what it means — hoarding for resale and slow use look the same from outside.)

Campaigns (who / what / what it means)

XMLRPC-BRUTE — WordPress password attacks in two stages

  • Who: 8.137.104.136 (Hangzhou Alibaba, China) on canary-farm-1; 180.93.254.108 (Sai gon Postel, Vietnam) on canary-farm-1 and sponge-01-ts. Small side attacks: 188.166.105.69 (DigitalOcean, 48 posts), 185.148.240.80 (16), 157.90.153.23 (11), and three addresses in the 217.60.x block (196.2, 184.50, 184.25 — 24 posts combined). The 34.67.167.4 rows in the top-talker table are yesterday's run showing up twice (window overlap), not new activity.
  • What they did: 8.137.104.136 sent 14,438 xmlrpc "check these passwords" batches (14,712 different request bodies), then fired 6,706 password guesses at /wp-login.php pretending to be Chrome/78, continuing to 12:55 stored. 180.93.254.108 sent 255 xmlrpc batches plus 255 login guesses to each of two sensors, pretending to be Chrome/88 — identical counts on both. The request bodies are xmlrpc password checks: <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…wp.getUsersBlogs…. Our fake WordPress answered everything.
  • What it means: the crew checks stolen passwords first, then guesses. The decoys fed both stages and leaked nothing. Next report should watch whether the Vietnam copycat scales up like the Chinese address did.

AI-EXEC-HUNT — fake AI-crawler census plus exploit attempts plus credential theft

  • Who: 34.95.21.228 (Google LLC, Canada), one fast burst on canary-farm-1 at 18:17 stored. It is the fourth address to run this recipe (before: 34.58.160.181, 136.66.182.42, 136.65.203.248). It started with REGISTRY-HUNT's 27-family walk, then switched to its own act.
  • What they did: 623 events across 276 paths and 51 trap families in one burst, 41 fake credentials minted at /.env in 5 seconds (18:17:53–18:17:58), all under fake AI-crawler names (DeepSeekBot, cohere-ai, Meta-ExternalAgent, CCBot, Applebot, PerplexityBot, Kimi/MoonshotBot, ClaudeBot/Claude-User/Claude-SearchBot, bingbot, Bytespider, GrokBot, Hunyuan, GPTBot/ChatGPT-User/OAI-AdsBot, Baiduspider, Amazonbot). It posted React-Flight exploit attempts — {"then":"$1:__proto__:then","status":"resolved_model",…,"_prefix":"process.mainModule.require('ch… — at /login, /admin, /dashboard, /settings, /api/auth, this time with boundary string r2s1acmxpsphaq8w. The marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show is unchanged.
  • What it means: same recipe, new rented address, same size of haul. The boundary string changes each run and identifies each run. Nothing executed; the decoys answered every step. Watch for a fifth address and for any use of the three 41-credential piles.

CALC-ORACLE-KIT — a 19-hour "does this run code?" test loop, now ended

  • Who: 152.236.14.113 (Latitude.sh, Canada), alone, against lauterbourg-01-ts.
  • What they did: the loop that started in the last window kept going to 11:29 stored (about 19 hours total). This window held 3,550 events: phpunit eval-stdin 892, php2shell-root 892, Drupalgeddon2 455, wp-file-manager upload 442, webapp-form-profile 435, php2shell-index 434 (1,789 posts). The math question inside the exploits changed (51630*37099), and so did the upload boundary (wf12y9tsoy4vc61) — both are per-run identifiers. Sample probe: <?= system('uname -m; echo $((51630*37099))');?>.
  • What it means: the operator wanted to know whether its code could run on our fake PHP surface, got its answers, and left. We still cannot see what answer the decoy gave; if a payload shows up later from this address, the decoy said "yes" at least once. The node held through the whole engagement.

MEGA-DICTIONARY — a huge malware-link dictionary, replayed by two new buyers

  • Who: 169.150.201.41 (Datacamp, Germany) and 146.70.200.3 (M247, Europe), both against frantech-ts only. One host — not a fleet-wide number.
  • What they did: 169.150.201.41 requested 13,776 different paths in about two minutes (11:17:30–11:19:24 stored on 10-28); 146.70.200.3 requested 13,775 different paths in about two minutes (05:24:09–05:25:52 stored on 10-29). Each run carried hundreds of fake router and NAS identities (D-Link, TP-LINK, ZTE, Synology, MikroTik, UniFi, Wavlink, Tenda, Netgear, plus curl, wget, python-requests). The paths are known malware download links: /ntp, /no_killer/arm, /6ndte2.ps1, /71.exe, /.Sassy.sh4, /a2work_arm, /TSFJ, /cloud/form_01577.pdf.ps1. No logins, no downloads.
  • What it means: the same shopping list found two new buyers about 18 hours apart. The deception-only host absorbed 27,551 of its 28,203 events. Watch the next replay — the buyer address always rotates — and whether any run tries an actual download.

TECHTIES-KIT — our heaviest daily visitor, now absent

  • Who: 93.152.221.96 — zero events this window.
  • What they did: nothing. Its side campaign (JNDI-FIELD-INJECT, the fake "log4j" text injection) went quiet too; the forged-header counter returned to 0 after two heavy windows (455, then 425).
  • What it means: four straight daily kit runs ended. Its 1,089-credential pile (6 days) sits untouched. A return re-opens our heaviest traffic source; a second quiet day would suggest the run simply ended. We do not know which it is yet.

REGISTRY-HUNT / LeakIX — the professional scanner crew, back in force

CREDSWEEP class — the shared "list of config files to steal," revised and spreading

  • Who: SI-CENSUS (102.220.163.241, VPS Dedicated, Slovenia) walked 5 sensors — control-1, ai-devbox-1, netcup-ts (first time), canary-farm-1, ru-edge-1 — 2,058 events, 10:19–22:06 stored, 4 fake credentials taken, fake Chrome/126. 194.180.49.41 (MEVSPACE, Bulgaria) made a lighter return: 48 events on 6 sensors. 45.138.12.16 (Tc Datacenter, Lithuania) walked 3 sensors (631 events, 12:55–18:26 stored) and took 1 credential. The marker-revision walkers: 176.65.144.71 (Dedik Services, Switzerland, 40 trap families, 1 credential) and 93.152.209.6 (Omniline Investment, Bulgaria, 35 families), both pretending to be Googlebot/2.1.
  • What they did: the same 511-path walk everywhere (fake .env files, vendor/.env, lib/.env, cron/.env, core/.env, database/.env, then phpMyAdmin). The new /kmonbase<hex> marker paths (for example /kmonbasezdf31effb5, /kmonbaseqt596f2232 on canary-farm-1) are the old pscan-<hash> marker under a new name — the shared list now carries a new self-identification.
  • What it means: the list circulates and now mutates; five organizations have run it across four windows. SI-CENSUS is the fastest-growing census operator we track (13 events → 2,208 → 2,058 on five sensors). A third kmonbase user would confirm the new edition is spreading.

WP-XRPC-WALK — new, slow, spread across many addresses

  • Who: 33 addresses / 108 events across all 7 canary-bearing sensors (digest cluster 362522228887, first seen 10-29), plus 6 addresses / 37 events on 5 sensors (0a08798abff5). One or two requests each.
  • What they did: each address posted one xmlrpc password-check batch (/xmlrpc.php, wp.getUsersBlogs) and read the user list at /wp-json/wp/v2/users, alternating. Every address used a fresh, realistic browser name (Safari/17.5, Chrome/138, Firefox/140, Edge/138 — 11 addresses on the Safari/17.5 string alone). No credentials taken.
  • What it means: a new low-and-slow enumeration layer — many addresses, one or two requests each, fresh disguises each time. Different from the older Chrome/127 pool, which reused one fake name. Watch the address count, a first credential theft, and whether it coordinates with the big xmlrpc floods.

VPN-CONF-HUNT — new, hunting VPN and tunnel configuration files

  • Who: 85.155.14.14 (SolidCore Hosting, Germany), alone, against lauterbourg-01-ts, 01:38–01:42 stored on 10-29.
  • What they did: 355 events at 355 different paths in 4 minutes, under three rotating fake browser names (Chrome/124 on macOS, Safari/17.5, Firefox/126). It owns the node's new-path list this window: /.ovpn, /zerotier.conf, /ikev2.conf, /xray.json, /ss.conf, /nordvpn, /windscribe.conf, /forticlient, /sophos, /barracuda, /array-vpn, /rsa-securid, /rsa.conf, /bastion.yml, /proxy.yml, /.svn/auth, /config.php.save. No credentials taken.
  • What it means: a new target theme — VPN clients and remote-access stores — pointed at our newest node. One run so far. A second node or address would make it a standing campaign.

CREDENTIAL-DRAIN — the mint-to-use pipeline, fifth empty cycle in six

  • Who: 101 fake credentials went to 38 collector addresses (digest issued count 105: canary-farm-1 72 from 21 addresses, ai-devbox-1 15 from 14, ru-edge-1 10 from 8, control-1 8 from 8). No one used any of them.
  • What they did: nothing on the AWS side. The standing piles: TechTies 1,089 (6 days, unchanged), the new 34.95.21.228 pile 41, plus 136.65.203.248 and 136.66.182.42 at 41 each, SI-CENSUS 70 (6 days), 46.151.178.15 12, 140.245.97.208 8. Six mint attempts failed: five "400 Bad Request" errors (45.148.10.125 caused 3 within 24 seconds — pacing; plus singles from 34.19.191.99 and 91.92.41.32) and one untagged row on ai-devbox-1. No key problems.
  • What it means: five of the last six windows ended with zero use. The four biggest piles have never touched AWS. Any alert against any of them is the story; the alert pull each cycle is how we check.

Light watchers (smaller but tracked)

  • PATHSCAN-CENSUS — 176.123.5.6 (Alexhost, Moldova): 854 events, 62 trap families, 282 paths in 6 minutes (02:21–02:27 stored), honest tool name Mozilla/5.0 (compatible; pathscan/1.0), 9 fake credentials taken at /.env including the /.ENV and /.Env spellings.
  • BUCKLOG-KIT census arm — 185.177.72.29 (Bucklog, France): gravitysmtp probe, config walk, phpinfo, 3 credentials under the kit's curl/8.7.1 name at 19:50 stored. New address in the family; the family's one AWS use event (№44) still stands alone.
  • 45.148.10.x — .120 took 2 credentials (ai-devbox-1, canary-farm-1); .125 caused the 3-failures-in-24-seconds pacing burst.
  • 105.112.24.243 — python-requests, 5 credentials across 4 sensors, seen on all 8.
  • ffuf first sighting — 144.24.19.233 took 1 credential on control-1 under the tool name Fuzz Faster U Fool v2.1.0-dev.
  • 46.151.178.15 — light walk on 7 sensors, 3 credentials this window (12 over 6 days).
  • Benign research scanners — 93.174.93.12 (7 sensors, 334 events), 89.248.172.33 (7, 369), 45.198.224.125 (8, 84), 34.140.3.155 (6, 28), 71.6.155.70 (8, 8 — a Censys research range), 193.174.89.19 (6, 18). Honest names, shallow visits — research, not attack.
  • New tool names this window — fhms-its-research-scanner/1.0 (a university research scanner — benign by identification), HeadlessChrome/122 (sponge), Python-urllib/3.10, and batch-forged Firefox/140 names with an x64 de suffix.

Standing actors (who keeps coming back)

  • SI-CENSUS — fourth window, each bigger in reach: 13 events (№64) → 2,208 (№65) → 2,058 on five sensors (№66).
  • 45.138.12.x (Tc Datacenter, Lithuania) — fifth window; four addresses of the block were active this window.
  • REGISTRY-HUNT runners — present every window on record; the walk and the evening collection both ran.
  • TechTies — fifth window on record but the first quiet one. The quiet is the thing to watch now.
  • 140.245.97.208 (Oracle US) — first miss after four windows.
  • 8.217.152.4 (Alibaba) — second window, 1 credential (3 over 6 days).

Missing this window: TechTies-Kit + JNDI-FIELD-INJECT, 140.245.97.208, the Bochum student crawler (sixth window), AI-CLI-VAULT (fourth), AI-ADMIN-SWEEP, EXCHANGE-DICT, KEYDROP-SCANS, METADATA-HUNT's named runners, NIGHTAGENT, MALWARE-DICT, MALWARE-DICT-2, the BUCKLOG RCE arm, SES-QUOTA-PROBE (eighth), WEBSIPHON, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, the OMEGA-SWEEP census operators, ANDROXGH0ST-KIT, CRUSADER-SWEEP, and lauterbourg's old numeric login flood.

Network sweeps (Arkime) — port-22 scans that never touch the fake websites

These sweeps ask for an SSH connection only, so the fake sites never see them; this section is the fleet's only view of them. Identity is the client's fingerprint, never its address.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 3,264 sessions from 606 addresses across 259 networks in 70 countries. Day 41 on record; it eased from 661 addresses last window. Daily address counts: 10-23: 443, 10-24: 617, 10-25: 579, 10-26: 599, 10-27: 653, 10-28: 615, 10-29: 208.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go) — 3,425 sessions from 93 addresses across 42 networks in 21 countries. It shrank hard after its record day (172 → 93 addresses, −17,442 sessions). Daily: 10-19: 165, 10-20: 8, 10-21: 70, 10-26: 41, 10-27: 183, 10-28: 119, 10-29: 21.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499) — 28,359 sessions from 48 addresses, steady; it is the top scanner against 6 of our 8 addresses.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397) — 15,315 sessions from 45 addresses, 18 networks; it fell below the "dispersed sweep" line this window.
  • Smaller standing fingerprints: 084386fa7ae5039bcf6f07298a05a227 (32 sessions, 30 addresses), 03a80b21afa810682a776a7d42e5e6fb / LIBSSH-011-SWEEP (162, 27), dd9bcf093c355da7000132131cb36fd0 (27, 25 — all from one network), a591c4ddccc960a2da8099958270fc92 (185, 23).
  • CTL-MASS-SSH (4e066189c3bbeec38c99b1855113733a) — 27,146 sessions against control-1 from 14 addresses across 7 networks. This is its third window in a row above 27,000 sessions, and it is the fleet's single biggest scanner load. We promoted it from the watch list and named it this cycle; we still do not know what it is beyond SSH session counts.
  • Watch single — 98f63c4d9c87edbd97ed4747fa031019 on sponge-01-ts: 5,728 sessions (+1,401) from 10 addresses.
  • No new fingerprints appeared; 42 fingerprints have 14+ days of history.
  • One bookkeeping note: Arkime's session tags mislabel control-1's traffic (its 63,098 inbound sessions carry a sponge tag). The section counts by destination address, so the numbers above stand; do not trust the tags for "which sensor."

Canaries (minted and used) — bait credentials: made, stolen, never spent

No fake credential was used in AWS this window. Sensors minted 101 credentials to 38 collector addresses; none reached AWS.

Funnel numbers: credentials minted 101; distinct collector addresses 38; used in AWS 0; stolen with no observed use 101.

Where each stolen batch went (address — sensor — count this window — history):

  • 34.95.21.228 — canary-farm-1 — 41 — first theft 2026-10-28 18:17
  • 176.123.5.6 — canary-farm-1 — 9 — since 2026-10-29 02:21
  • 185.177.72.29 — canary-farm-1 — 3 — since 2026-10-28 19:50
  • 105.112.24.243 — ai-devbox-1 — 2; canary-farm-1, control-1, ru-edge-1 — 1 each — 5 since 2026-10-28 09:46
  • 46.151.178.15 — ru-edge-1 — 2; ai-devbox-1, canary-farm-1 — 1 each — 12 since 2026-10-25 17:05
  • 64.225.75.246 — canary-farm-1 — 2 — 4 since 2026-10-23 18:48
  • 102.220.163.241 — canary-farm-1, control-1, ru-edge-1 — 1 each — 70 since 2026-10-25 09:28
  • 103.215.74.112 — control-1 — 1 — since 2026-10-28 21:43
  • 105.112.20.127 — ai-devbox-1 — 1 — since 2026-10-28 08:49
  • 138.68.144.227 — ru-edge-1 — 1 — 5 since 2026-10-22 21:03
  • 139.59.143.102 — canary-farm-1 — 1 — since 2026-10-28 20:59
  • 143.110.217.244 — canary-farm-1 — 1 — 2 since 2026-10-26 21:51
  • 144.24.19.233 — control-1 — 1 — since 2026-10-28 09:44
  • 147.182.149.75 — canary-farm-1 — 1 — 3 since 2026-10-24 04:32
  • 150.241.66.127 — ai-devbox-1 — 1 — since 2026-10-28 10:00
  • 157.230.19.140 — canary-farm-1 — 1 — 3 since 2026-10-24 21:01
  • 157.245.113.227 — ai-devbox-1 — 1 — 4 since 2026-10-23 18:48
  • 164.92.107.174 — canary-farm-1 — 1 — 2 since 2026-10-24 20:08
  • 176.65.144.71 — canary-farm-1 — 1 — since 2026-10-29 06:16
  • 206.81.12.187 — control-1 — 1 — since 2026-10-28 20:58
  • 206.81.24.227 — ru-edge-1 — 1 — 3 since 2026-10-24 04:32
  • 206.81.24.74 — ai-devbox-1, canary-farm-1 — 1 each — 5 since 2026-10-22 21:01
  • 209.87.169.162 — control-1 — 1 — since 2026-10-28 09:06
  • 217.216.82.136 — ai-devbox-1 — 1 — since 2026-10-29 01:24
  • 23.132.164.201 — canary-farm-1, ru-edge-1 — 1 each — 2 since 2026-10-28 17:55
  • 34.174.248.106 — ai-devbox-1 — 1 — since 2026-10-29 03:56
  • 34.186.67.242 — ai-devbox-1 — 1 — since 2026-10-28 16:37
  • 34.65.8.9 — canary-farm-1 — 1 — since 2026-10-29 03:43
  • 45.138.12.16 — control-1 — 1 — 3 since 2026-10-24 03:33
  • 45.138.12.51 — control-1 — 1 — 5 since 2026-10-22 07:02
  • 45.138.12.6 — ai-devbox-1 — 1 — since 2026-10-28 16:49
  • 45.148.10.120 — ai-devbox-1, canary-farm-1 — 1 each — 2 since 2026-10-28 13:34
  • 64.23.218.208 — ai-devbox-1 — 1 — 3 since 2026-10-25 21:41
  • 8.217.152.4 — ai-devbox-1 — 1 — 3 since 2026-10-27 17:04
  • 81.171.74.60 — canary-farm-1 — 1 — since 2026-10-28 10:02
  • 82.165.10.79 — canary-farm-1 — 1 — 2 since 2026-10-27 08:32
  • 91.148.245.81 — canary-farm-1 — 1 — since 2026-10-29 04:44
  • 91.92.41.32 — canary-farm-1 — 1 — 3 since 2026-10-24 14:15

Persistent collectors with no AWS use (the piles to watch): 93.152.221.96 — 1,089 (2026-10-22 04:22 → 2026-10-27 21:29); 102.220.163.241 — 70 (2026-10-25 09:28 → 2026-10-28 09:12); 136.65.203.248 — 41 (2026-10-26 19:00); 136.66.182.42 — 41 (2026-10-24 05:03); 34.95.21.228 — 41 (2026-10-28 18:17); 213.209.159.154 — 16 (2026-10-23 02:40 → 2026-10-27 11:08); 213.209.159.175 — 16 (2026-10-22 05:08 → 2026-10-23 15:04); 46.151.178.15 — 12 (2026-10-25 17:05 → 2026-10-29 00:56); 176.123.5.6 — 9 (2026-10-29 02:21); 140.245.97.208 — 8 (2026-10-24 13:00 → 2026-10-28 00:54); 143.244.165.105 — 6 (2026-10-22 08:59 → 2026-10-23 21:39); 165.227.102.187 — 6 (2026-10-22 07:21 → 2026-10-27 03:24); 169.150.196.6 — 6 (2026-10-25 03:05 → 2026-10-25 03:29); 195.178.110.22 — 6 (2026-10-24 06:41 → 2026-10-24 06:53); 105.112.190.152 — 5 (2026-10-26 06:26 → 2026-10-26 07:47); 105.112.24.243 — 5 (2026-10-28 09:46 → 2026-10-28 10:41); 138.68.144.227 — 5 (2026-10-22 21:03 → 2026-10-28 21:10); 206.81.24.74 — 5 (2026-10-22 21:01 → 2026-10-28 21:36); 208.84.100.218 — 5 (2026-10-26 01:31 → 2026-10-26 03:41); 217.60.76.167 — 5 (2026-10-24 07:47 → 2026-10-26 20:44); 45.138.12.51 — 5 (2026-10-22 07:02 → 2026-10-28 17:36); 134.209.25.199 — 4 (2026-10-23 18:47 → 2026-10-26 21:06); 157.245.113.227 — 4 (2026-10-23 18:48 → 2026-10-28 21:41); 159.26.101.138 — 4 (2026-10-23 16:04 → 2026-10-23 16:21); 45.148.10.125 — 4 (2026-10-23 01:44 → 2026-10-23 04:39); 64.225.75.246 — 4 (2026-10-23 18:48 → 2026-10-29 04:44); 91.92.240.86 — 4 (2026-10-25 13:52 → 2026-10-25 21:58); 93.152.209.6 — 4 (2026-10-23 13:53 → 2026-10-27 11:26); 130.12.180.77 — 3 (2026-10-27 06:26 → 2026-10-27 06:29); 146.70.98.138 — 3 (2026-10-24 20:46 → 2026-10-25 20:51); 147.182.149.75 — 3 (2026-10-24 04:32 → 2026-10-28 21:30); 157.230.19.140 — 3 (2026-10-24 21:01 → 2026-10-29 04:44); 185.177.72.29 — 3 (2026-10-28 19:50); 185.177.72.9 — 3 (2026-10-23 13:14); 206.81.24.227 — 3 (2026-10-24 04:32 → 2026-10-28 21:09); 23.239.27.128 — 3 (2026-10-27 11:54 → 2026-10-27 17:27); 45.138.12.16 — 3 (2026-10-24 03:33 → 2026-10-28 09:10); 46.101.1.225 — 3 (2026-10-24 04:32 → 2026-10-26 21:46); 64.23.218.208 — 3 (2026-10-25 21:41 → 2026-10-28 21:50); 8.217.152.4 — 3 (2026-10-27 17:04 → 2026-10-28 07:36); 91.92.41.32 — 3 (2026-10-24 14:15 → 2026-10-28 23:36).

What this means: the biggest single-burst pile ever tied a record — 41 credentials in 5 seconds — and then sat idle. Supply rose by 101 while spending stayed at zero for the fifth time in six windows. lauterbourg-01-ts mints nothing on purpose (its canary key is empty), so a 404 there is not a failure.

How the fleet behaved — the numbers behind the noise

  • Why the big counts moved. canary-farm-1 +111% (26,066 events / 348 addresses): the new login-guess leg (6,706), the AI-EXEC-HUNT burst (623), the REGISTRY-HUNT walkers, and SI-CENSUS. frantech-ts +293% (28,203 / 84): the two dictionary replays alone are 27,551 events. ai-devbox-1's +244% (12,127 / 200) is an illusion of the overlapping report windows — 9,815 rows are yesterday's xmlrpc run shown twice; the real new volume is about 2,300 events. ru-edge-1 −94% (1,101) and control-1 −56% (2,048): TechTies's daily walks (14,771 and 3,370 events) did not happen. lauterbourg-01-ts −44% (5,020): the CALC-ORACLE-KIT tail (3,550) replaced a bigger stack. netcup-ts −73% (742) and sponge-01-ts −36% (1,320): quiet days.
  • Canary health. 105 digest "issued" rows against the funnel's 101 minted credentials — the standing counting difference, unchanged. Six failures, all explained: five 400 rejections from fast pacing, one untagged row. No key problems anywhere.
  • Honesty of the traffic. Forged "forwarded-for" headers: 2,637 requests carried any, 0 carried multi-entry chains, 486 carried one the fleet ignored, and 0 single-entry forgeries — that counter returned to zero because the log4j injection crew was absent. Almost all traffic is plain http; https stays small (canary-farm-1 1,243 of 26,066; lauterbourg 133 of 5,020; ai-devbox-1 775 of 12,127). Most visitors address the servers by raw IP, not by the fake domain names.
  • control-1's discovery ramp. Day 46 of the fresh-IP experiment: 2,048 events / 153 unique addresses. Address discovery moved back above the 7-day average (128) after two below-average days (130, then 112). One swing is not a trend.
  • Report quirks to remember. Yesterday's xmlrpc run re-appeared in today's top talkers because the 24-hour windows overlap; we checked timestamps before counting it as new. The "first seen" table stamps whole sync batches with one arrival time — those are arrival times, not attack times.
  • Fleet changes. None this cycle — no node, config, or pipeline changes.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

  • The funnel. 735 addresses tried passwords → 552 got a shell (75%) → 476 ran a command (86% of those who got in). In raw events: 11,944 password attempts → 6,153 accepted logins → 17,460 commands. Telnet took 765 attempts. The share of intruders who work after entry stayed at recent levels.
  • New commands. None — 0 of 6,125 distinct commands appeared for the first time. That is 21 windows in a row with a mature command list. A brand-new command here would be our one true post-break-in signal, so we keep watching for it.
  • Recurring activity (context, not news). The hardware-survey crew (109.160.32.110 and 5 siblings) ran its uname questions 7,718 times. The SSH-persistence pair (cd ~; chattr -ia .ssh; lockr -ia .ssh, then an authorized-keys append) came from 438 and 371 addresses — commodity botnet behavior. A GPU-inventory quartet (lspci | grep VGA…, uptime -p, uname variants) ran from 179.43.153.10 and 5 siblings (1,364 events) — crypto-mining reconnaissance from a third source block in three windows; those crews rotate.
  • Passwords. 2,659 distinct pairs offered, 0 new. The 345gs5662d34 family dominated: 585 attempts as user 345gs5662d34 plus 496 as root with 3245gs5662d34 — 1,081 of 11,944 attempts.

Download addresses (C2) on that same host — one host, not a fleet number. No new download addresses this window and no new captured files. The five active addresses: http://176.65.139.40/wget.sh (238 command references, 218 successful deliveries, 235 source addresses, payload 7b8cd695424f), http://176.65.139.40/curl.sh (same reach, payload b965f772177c), tftp://176.65.139.40 and ftp://176.65.139.40/ftpget.sh (238 attempts each, 0 delivered), and https://217.60.102.5/sh (10 command references from 5 addresses, 0 delivered — two windows now, so its payload and family are still unknown; the address sits near the LIBREDTAIL staging range, which is a note, not proof).

Captured payloads, in plain terms (hash — size — what it is — where it came from):

  • 7b8cd695424f — 1,487 bytes — script — http://176.65.139.40/wget.sh
  • b965f772177c — 1,488 bytes — script — http://176.65.139.40/curl.sh
  • 62e3e86a7586 — 201,396 bytes — Linux program (ELF) — http://152.42.195.115/main_arm7
  • ec69d3e0d4d9 — 194,400 bytes — ELF — http://152.42.195.115/main_mips
  • 1913ed2ad175 — 194,400 bytes — ELF — http://152.42.195.115/main_mpsl
  • e27e963b2b49 — 157,468 bytes — ELF — http://152.42.195.115/main_arm6
  • ba9c9d9d361d — 1,615 bytes — script — http://176.65.139.157/telnet2.sh
  • 2165fae6c486 — 6,738 bytes — script — http://146.190.102.83/t2r/t2r_compat.sh
  • 2d6b9901a480 — 14,042 bytes — script — same address
  • 2a7af0bb942a — 14,506 bytes — script — same address
  • a8769ddc8139 — 16,170 bytes — script — same address
  • f8d4dafd6b96 — 16,506 bytes — script — same address
  • 8a8189c0c67b — 5,150 bytes — script — same address
  • c871a756510b — 5,276 bytes — script — same address
  • 0cac28cc7f78 — 4,404 bytes — script — http://146.190.102.83/t2r/w1_compat.sh
  • e06be431a8d4 — 1,498 bytes — script — http://185.228.72.128/wget.sh
  • 72d835f767c8 — 1,499 bytes — script — http://185.228.72.128/curl.sh
  • 0583d9e18684 — 1,987 bytes — script — http://176.65.132.7:8889/lv.sh
  • b16e15764b8b — 19 bytes — text — same address
  • 709009e02c8e — 10 bytes — text — http://oper.atlas101.us.kg/dl.sh

One caution we repeat every cycle: a hosting address is not the attacker. The same host can serve malware and also be the operator's own login point (176.65.139.40 logged in 1,224 times). We match payloads by hash and script text, never by address alone.

Open questions

  1. Will any stolen canary ever be used? The piles (TechTies 1,089; three piles of 41) have never touched AWS. We pull alerts each cycle; the first alert is the event we are waiting for.
  2. Is TechTies gone or just resting? One quiet window after four daily ones. A second would point to "ended"; a return re-opens our heaviest traffic source. We do not know which yet.
  3. Will WP-XRPC-WALK grow? It started with 33 addresses, one or two requests each. We will count addresses, watch for a first stolen credential, and check whether the fake browser names rotate.
  4. What is CTL-MASS-SSH? The fleet's biggest scanner fingerprint (27,146 sessions against control-1, third big window in a row) is now named but still uncharacterized — we have session counts, not its purpose.
  5. Is the kmonbase list edition spreading? Two operators used the new marker this window. A third would confirm; we also want to diff the new walk against the old pscan- inventory to see what changed.
  6. Did CALC-ORACLE-KIT's 19-hour test ever hear "yes"? If a payload appears from 152.236.14.113 after the loop, our decoy answered true at least once. The lauterbourg sink's response bodies hold the answer; we have not read a "yes" yet.
  7. Will the staging hosts ever serve anything? https://217.60.102.5/sh has drawn command attempts across two windows and delivered nothing; the flux-side 193.32.162.163 link (from №65) is the same story. One successful delivery from either names a malware family.

Plain language version of: flux-fleet-intel-briefing-2026-10-29.md