Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №67 — PLAIN LANGUAGE

Period: 2026-10-29 07:33 – 2026-10-30 07:33 UTC (24h, day 65 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-30.md

What happened (plain)

For the first time, the REGISTRY-HUNT group used what it stole. Its DigitalOcean walkers took 8 fake credentials that our honeypots minted for them, and then tried those credentials inside Amazon Web Services from 5 different computers. Two of them listed what the AWS account holds: email-sending settings, AI-model access, storage buckets, and user lists. AWS blocked most of it. Separately, one new attacker sent 10,000 fake-login batches at the WordPress trap on canary-farm-1 in 24 minutes — a record for this attack type. Two new tools appeared: one that hunts API documentation files, and one that speaks the Docker image protocol. Overall attack volume dropped on every sensor, because four very loud scanners from earlier in the week stayed quiet.

What it means (plain)

  1. REGISTRY-HUNT is not just collecting — it is using. 35 walker IPs ran the same 27-step walk across all 8 sensors this window. By the end of the window, 8 credentials minted by those walkers had been used from 5 DigitalOcean use IPs. Two use IPs (64.225.75.246, 157.230.19.140) ran the same 14-operation check: email-sending quota, Bedrock AI models, buckets, IAM roles, policies, and users. Four others (206.81.24.74 with 2 credentials, 68.183.9.16 with 2, 206.189.19.19, 46.101.111.185) only checked that the credentials work (sts:GetCallerIdentity). AWS denied GetSendQuota 22 times, InvokeModel 22 times, GetAccount 18 times, ListFoundationModels 12 times, and ListEmailIdentities 6 times. Only 8 calls succeeded, all sts:GetCallerIdentity. (High confidence that the theft and the use are the same group — the walk, the mints, and the AWS use carry the same IPs. Moderate confidence about intent — a work-only check may just be a validity test, and we cannot see inside the AWS account.)
  2. Someone finally wants the credentials, but stockpiles still sit untouched. The fleet minted 51 credentials to 30 collector IPs this window. 8 were used; 43 sit unused. The big piles did not move: TechTies holds 1,088 (6-day count, unchanged), 102.220.163.241 holds 70, and three AI-EXEC piles hold 41 each. (High confidence on the counts — the Tracebit alert pull covers the window. Moderate confidence on what the piles mean — a resale warehouse and a slow customer look the same from outside.)
  3. The WordPress flood tool is shared, and operators can scale it hard. The operators from the last two windows (8.137.104.136, 180.93.254.108) sent nothing. A new one, 136.80.17.156 (Google LLC US, forged Chrome/89), ran 10,000 system.multicall POSTs — about 10× the tool's known 1,000-POST batch size. (High confidence on the volumes and the absence. Moderate confidence that one crew runs all of it — a shared template proves shared tooling, not the same people.)
  4. Attacker wordlists keep drifting toward cloud services. This window added API-doc spec paths and Docker registry pulls. Last window added VPN configs and Claude Code credential stores. (Moderate confidence — both new sightings are one operator, one window. A repeat would raise this to high.)

Campaigns (who / what / what it means)

REGISTRY-HUNT — fake-site walkers that now use what they harvest

  • Who: 34 IPs hit the WebLogic console step and 35 ran the Docker-registry step, across all 8 sensors. The digest's kill-chain rows name DigitalOcean LLC for every walker listed (examples: 206.81.24.74, 147.182.149.75, 167.99.210.137, 142.93.0.66, 178.128.207.138, 167.71.81.114, 157.230.19.140, 206.189.95.232, 206.189.19.19, 46.101.111.185, 157.245.113.227, 68.183.9.16). The pool keeps growing: 4 walkers in the last window, 15 before that, 34–35 now.
  • What they did: the walk itself is unchanged — fake tarpit, WebLogic console, server-status, Confluence login, WHM/cPanel proxy paths, then /v2/_catalog and registry tags/list and manifests. The new part is the use: 64.225.75.246 (credential minted by canary-farm-1) and 157.230.19.140 (minted 10-24, before this window — Tracebit is the only witness for that pairing) each ran the same 14 calls: GetAccount, GetAccountSendingEnabled, GetAccountSummary, GetCallerIdentity, GetSendQuota, GetSendStatistics, InvokeModel, ListBuckets, ListEmailIdentities, ListFoundationModels, ListIdentities, ListPolicies, ListRoles, ListUsers. 206.81.24.74 (2 credentials), 68.183.9.16 (2), 206.189.19.19, and 46.101.111.185 stopped at GetCallerIdentity. AWS denied the rest; 8 calls succeeded, all sts:GetCallerIdentity.
  • What it means: the group checks its stolen keys and uses them within hours. The denied calls point at bulk email sending and AI model inventory, then IAM listing to map the account. Every use traces back to a specific fake credential within hours — the canary design turned a silent theft into a full trace. Still open: whether they try to create persistence after the IAM mapping, and whether a second-stage use IP appears.

XMLRPC-BRUTE — WordPress fake-login floods

  • Who: 136.80.17.156 (Google LLC US), on canary-farm-1 only, 11:28–11:52 stored. It faked the browser string Chrome/89.0.4389.114. Smaller WordPress password attempts hit ru-edge-1 from 163.172.46.59 (Scaleway FR, 27 probes + 27 credential POSTs), 108.174.147.120 (24 + 24), 103.47.145.13 (8 + 8), and 103.47.145.17 (6 + 6). The previous operators (8.137.104.136, 180.93.254.108) sent nothing.
  • What they did: a short warm-up (/, /wp-includes/wlwmanifest.xml, /wp-json/wp/v2/users/, /wp-json/oembed/1.0/embed), then 10,000 POSTs to /xmlrpc.php at about 5 per second for 24 minutes, each about 508 bytes. The fake WordPress answered 200 to every one. The captured body (verbatim, head; the preview cuts at 120 characters): <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><param — the same credential-checking call as previous windows.
  • What it means: this is the largest single flood on record (the tool's known batch was 1,000 POSTs; the last record run was 14,438 over nearly two hours). The tool showed last window that a flood can turn into a password-guessing leg on the same target, so a second leg from 136.80.17.156 is the immediate thing to watch. The trap absorbed the full volume and gave up nothing.

WP-XRPC-WALK — a slow, spread-out WordPress enumeration sweep

  • Who: the same two clusters as last window replayed exactly: 362522228887 (33 IPs, 108 events, 7 sensors) and 0a08798abff5 (6 IPs, 37 events, 5 sensors) — same path signatures, same counts. In total 64 different IPs touched /wp-json/wp/v2/users this window (2,876 events including their other requests). The busiest single IP made 11 of those REST calls (104.131.3.242).
  • What they did: one or two requests per IP — a POST to /xmlrpc.php (the wp.getUsersBlogs call) alternating with a GET to /wp-json/wp/v2/users. Each IP used a fresh, ordinary-looking browser string. 0 credential mints.
  • What it means: a fixed script on a fixed schedule, now two windows old. The jump from 39 to 64 IPs suggests a growing worker pool. The 200-IP alarm borrowed from the older WordPress brute campaign applies here too.

CREDSWEEP — the shared config-and-credential file hunt

  • Who: 45.138.12.16 (Tc Datacenter LT) walked all 8 sensors (417 events) and minted credentials at /.env on canary-farm-1 (02:59:35 stored) and ru-edge-1 (04:57:24 stored). 45.138.12.35 ran 768 events on ai-devbox-1 and control-1. 45.138.12.51 ran netcup-ts and sponge-01-ts (264 events). 45.138.12.6 ran 260 events on ai-devbox-1 and canary-farm-1. 176.65.144.71 (Dedik Services CH) came back to canary-farm-1 with 188 events, 70 families, and the /kmonbase<hex> marker paths, plus a config hunt (/.git/HEAD, /.ssh/id_ecdsa, /.htpasswd, /config/secrets.yml, /docker-compose.yml, /.env.dist). 194.180.49.41 (MEVSPACE, BG) ran 62 events on 5 sensors.
  • What they did: the same file-hunting walks as before. The Tc Datacenter /24 keeps rotating roles between sensors. The /kmonbase marker revision stayed with its known holder.
  • What it means: sixth window in a row for this class, and still zero credential use from it. Two fresh credentials from 45.138.12.16 are now in hostile hands. A third /kmonbase adopter would show the revised wordlist is spreading.

OPENAPI-CENSUS — new this window; API documentation hunter

  • Who: 193.47.62.29 (BestDC Limited BG), faking Chrome/123.0.0.0 on Windows 10, 18:42–00:10 stored.
  • What they did: 489 events against 150 paths and 20 trap families on canary-farm-1, netcup-ts, and ru-edge-1. It asked for API specification files (/api/swagger-ui/swagger.json, /api-docs/swagger.json, /docs/swagger.json, /api/openapi.json, /swagger/v1/swagger.json, 6 tries per path per sensor) and drove the openapi-spec-json-skeleton spikes on all three sensors (22 hits each; 23.0×, 8.2×, and 22.0× the weekly average). Our fake sites answered 200 with skeleton specs. 0 mints, 0 POSTs.
  • What it means: whoever finds a real spec file learns every API endpoint on the host. Our skeletons give them nothing real. One IP, one window so far — a second IP or node makes it a standing threat.

DOCKER-DIGEST-PULL — new this window; speaks the Docker image protocol

  • Who: 147.90.255.64, seen on canary-farm-1, ai-devbox-1, netcup-ts, and ru-edge-1 (81 events total).
  • What they did: used an honest Docker client string — docker/24.0.7 go/go1.21.5 git-commit/311b9ff kernel/6.6.0 os/linux arch/amd64 — and pulled 10 container image manifests by digest from canary-farm-1, asking for internal-sounding repositories: /v2/backup/db-migrator/manifests/sha256:5fdcf5302180…, /v2/internal/auth-service/manifests/sha256:faebf99bbd46…, /v2/staging/web-app/manifests/sha256:b741d0c00147….
  • What it means: this one wants container images, not config files, and it already knows repository names to ask for. It is a different tool from REGISTRY-HUNT's walk (that one uses browser strings; this is a real Docker client). Watch for login-token probes, image-layer downloads, or a second IP.

CREDENTIAL-DRAIN — the mint-to-use pipeline

  • Who: mint side: 51 credentials to 30 collector IPs (the digest counts 60 minted rows: canary-farm-1 27 from 22 IPs, control-1 13 from 9, ru-edge-1 13 from 10, ai-devbox-1 7 from 6). Use side: 8 credentials from 5 use IPs, all REGISTRY-HUNT walkers. 43 credentials stolen with no AWS use seen.
  • What they did: minting continued as usual. 25 mint attempts failed with 400 rejections at /.env — single, paced attempts across 12 IPs on 4 sensors (at most 2 per IP and sensor, 19:17–05:59 stored; the heaviest was 150.241.66.127 with 2 on control-1 and 2 on ai-devbox-1). No 401s, no key problems.
  • What it means: the six-window stretch with no credential use is over, and the demand came from REGISTRY-HUNT while every large stockpile stayed cold. We can now tell users and hoarders apart per operator. The Tracebit alert pull each window remains the check.

Light watchers (single, smaller sightings)

  • 104.199.180.57 (Google LLC TW) — lauterbourg-01-ts, 350 events on 223 paths and 20 families in 2 minutes (01:45–01:46 stored), fake Chrome/153.0.0.0 macOS: web-form checks (8 profile, 7 login, 2 signup), 3 GraphQL introspection probes, 2 Laravel Telescope probes, 3 POSTs, 0 mints.
  • 34.177.96.228 (Google LLC SG) — ai-devbox-1, 283 events on 272 paths and 18 families in 1 minute (19:34–19:35 stored): env-file hunting (env-production-error 184, phpinfo-error 37, firebase-json-error 9, gcp-credentials-json-error 4); 1 failed mint.
  • 9.205.248.165 (Microsoft DK) — sponge-01-ts, 239 events on 222 paths, calling itself ExposureScanner/1.0 (internal-security-audit): 10 webshell probes, 4 spec skeletons, 2 webshell sweeps. The name claims a security audit, but we cannot verify that, so we do not treat it as friendly.
  • 204.76.203.237 (Pfcloud UG NL) — 261 events across all 8 sensors; on lauterbourg it hammered 4 paths (/index.php5 59 times, /index.php 64 times including 44 php2shell hits, / 59 times, /login twice). This is the same /24 family as the MALWARE-DICT replay hosts, now running a repetitive PHP probe.
  • Distributed pools — 82.197.193.x (about 30 IPs, 4 sensors, at most 25 events each; two of them had failed mints) and 185.132.187.x (about 30 IPs, 4 sensors; several minted 1 credential each on ru-edge-1 and canary-farm-1).
  • Research-class scanners — 71.6.155.70 (8 sensors, 8 events, empty browser string; a Censys research range), 75.127.6.2 (8 sensors, 74 events, honest zmap-proxy-probe/1.0), 93.174.93.12 (7 sensors, 322 events), 89.248.172.33 (7 sensors, 416 events). 45.198.224.125 (8 sensors, 73 events) fakes Firefox/71 and stays in the hostile-light group.

Standing actors (who keeps coming back)

  • REGISTRY-HUNT's DigitalOcean pool — present every window on record, and now using credentials.
  • 45.138.12.x (Tc Datacenter LT) — sixth window; walked all 8 sensors again and minted twice.
  • 176.65.144.71 (Dedik CH) — second window as the /kmonbase marker holder.
  • 194.180.49.41 (MEVSPACE) — regular light census, 5 sensors.
  • The WP-XRPC-WALK pool — second window; the REST-enum population grew from 39 to 64 IPs.

Gone quiet this window

TechTies and its JNDI injection (second idle window; the fake-header forgery counters are back to 0), SI-CENSUS 102.220.163.241 (first miss after four windows), all three MEGA-DICTIONARY replay hosts (169.150.201.41, 155.2.191.115, 23.234.118.146), CALC-ORACLE-KIT (152.236.14.113), 121.40.140.50 and 136.70.193.85, the last two XMLRPC operators (8.137.104.136, 180.93.254.108), 34.67.167.4, PATHSCAN-CENSUS, VPN-CONF-HUNT, 8.217.152.4, 140.245.97.208 (second miss), AI-EXEC-HUNT (no run at its recent pace), EXCHANGE-DICT, NIGHTAGENT, BUCKLOG-KIT, METADATA-HUNT, KEYDROP-SCANS, CLAUDE-CRED-HUNT, CENSUS-284, CF-FRONTED CREDSWEEP, OMEGA-SWEEP, ANDROXGH0ST-KIT, CRUSADER-SWEEP, AI-CLI-VAULT (fifth window), GCP-ACONF, WEBSIPHON, SES-QUOTA-PROBE (ninth), GIT-VAULT, LIBREDTAIL-KIT, ADMINER-SWARM, CONFIGBUNDLE-KIT, CVENGINE-KIT, MEVSPACE-GITWALK, SS-NET TOOLING, WP-ENUM, INFOCREST-KIT, MALWARE-DICT-2, and the Bochum softsec crawler 185.73.23.x (seventh window). We read absence from this window's tables; a very small one-off below the table sizes would not show.

Network sweeps (Arkime) — port-22 scanning that never touches the web traps

The pcap sensors saw 142,456 inbound SSH sessions against the fleet's 8 public IPs, from 63 client fingerprints (47 with 5+ sessions). A banner sweep asks for nothing but the SSH version string, so the web traps never see it — this layer is the fleet's only view of it.

Two sweeps crossed the alert line:

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) — 3,926 sessions from 629 source IPs across 256 networks in 70 countries, port 22, about 4,896 bytes per session. Top networks: AS8075 Microsoft, AS135377 UCloud HK, AS16276 OVH, AS31898 Oracle, AS19871 Network Solutions. Busiest sources: 123.58.215.196, 41.128.181.199, 85.95.166.40, 217.182.253.249, 96.78.175.45. Its daily source-IP counts: 10-24 617, 10-25 579, 10-26 599, 10-27 653, 10-28 615, 10-29 657, 10-30 177. This is a steady ~600-IP daily band, 41 days on record, peak 673 IPs.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go) — 3,103 sessions from 164 source IPs across 67 networks in 36 countries, port 22, about 5,166 bytes per session. Top networks: AS37963 Hangzhou Alibaba, AS4766 Korea Telecom, AS51167 Contabo, AS37110 moztel, AS7552 Viettel. Busiest sources: 175.196.78.7, 8.148.5.235, 8.130.97.165, 8.148.183.39, 8.138.210.122. Daily source-IP counts: 10-20 8, 10-21 70, 10-26 41, 10-27 183, 10-28 119, 10-29 164, 10-30 12. This one doubled day-over-day (93 → 164 IPs) and is on day 13, with a 192-IP peak.

Other large fingerprints, unchanged in role: GO-SSH-SWEEP (0a07365cc01f…) 28,810 sessions from 56 IPs; GO-SCATTER-SWEEP (16443846184e…) 13,516 sessions from 33 IPs (down 1,799 sessions day-over-day); CTL-MASS-SSH (4e066189c3bb…) 26,619 sessions — most of control-1's 49,325 inbound. LIBSSH-011-SWEEP (03a80b21afa8…) 140 sessions from 24 IPs. An unnamed 98f63c4d9c87… carried 6,145 sessions from 25 IPs. Two new fingerprints appeared below the sweep thresholds: efc4646cf1f6… (30 sessions, 8 IPs, banner ssh-2.0-go) and aae6b9604f6f… (26 sessions, 2 IPs, banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20). Both wait for a second window before getting names. Both flagged sweeps already have names in the registry; nothing new to name.

Per-node inbound: control-1 49,325 sessions / 273 source IPs; ai-devbox-1 18,494 / 314; lauterbourg-01-ts 15,655 / 1,461; frantech-ts 14,768 / 1,274; sponge-01-ts 14,675 / 422; canary-farm-1 11,642 / 532; netcup-ts 9,218 / 341; ru-edge-1 8,679 / 320.

Canaries (minted and used) — the theft-to-use funnel

The story of the window: 8 fake credentials were used in AWS, and every use traces back to the REGISTRY-HUNT walkers.

The summary: fleet sensors minted 51 credentials to 30 collector IPs. 8 credentials reached AWS. 43 were stolen and not used. AWS-side events: 102 failures (denied) and 8 successes (all sts:GetCallerIdentity, which at most confirms the account exists). Denied operations: GetSendQuota×22, InvokeModel×22, GetAccount×18, ListFoundationModels×12, ListEmailIdentities×6.

The 8 used credentials, by the IP that took them:

  • 64.225.75.246 (took 1 canary from canary-farm-1; 5 mints since 2026-10-23 18:48) — used it for the full 14-call check: GetAccount, GetAccountSendingEnabled, GetAccountSummary, GetCallerIdentity, GetSendQuota, GetSendStatistics, InvokeModel, ListBuckets, ListEmailIdentities, ListFoundationModels, ListIdentities, ListPolicies, ListRoles, ListUsers, from 1 use IP.
  • 157.230.19.140 (minted before this window, on 2026-10-24 21:01; 3 mints on record) — ran the same full 14-call list from 1 use IP. The pairing is outside the flux window, so Tracebit is the only witness.
  • 206.81.24.74 (2 canaries from ru-edge-1; 6 mints since 2026-10-23 21:05) — both used, GetCallerIdentity only, 1 use IP.
  • 68.183.9.16 (2 canaries from control-1; 3 mints since 2026-10-24 20:53) — both used, GetCallerIdentity only, 1 use IP.
  • 206.189.19.19 (minted 2026-10-24 19:58; 1 mint on record) — used, GetCallerIdentity only. Outside the flux window; Tracebit is the only witness.
  • 46.101.111.185 (minted 2026-10-23 19:07; 1 mint on record) — used, GetCallerIdentity only. Outside the flux window; Tracebit is the only witness.

Collectors who minted nothing into AWS this window (theft IP — sensor, mints this window, history):

  • 147.182.149.75 — ru-edge-1, 2, 5 mints since 2026-10-24 04:32.
  • 162.35.242.53 — ai-devbox-1 and control-1, 2 each, 4 mints since 2026-10-29 15:00.
  • 185.132.187.236 — ru-edge-1, 2, 2 mints since 2026-10-29 09:42.
  • 193.32.248.165 — canary-farm-1 and control-1, 2 each, 4 mints since 2026-10-29 22:37.
  • 202.65.238.233 — canary-farm-1 2 plus 1 each on ai-devbox-1, control-1, ru-edge-1; 5 mints since 2026-10-29 07:43.
  • 93.123.109.107 — canary-farm-1 and control-1, 2 each, 4 mints since 2026-10-29 17:03.
  • 142.93.0.66 — ru-edge-1, 1, 1 mint since 2026-10-29 18:33.
  • 146.70.211.38 — control-1 and ru-edge-1, 1 each, 2 mints since 2026-10-29 07:53.
  • 151.241.122.42 — canary-farm-1, 1, 1 mint since 2026-10-29 07:59.
  • 157.245.113.227 — control-1, 1, 5 mints since 2026-10-23 18:48.
  • 164.92.107.174 — canary-farm-1, 1, 3 mints since 2026-10-24 20:08.
  • 167.71.81.114 — canary-farm-1, 1, 1 mint since 2026-10-29 19:16.
  • 167.99.210.137 — ru-edge-1, 1, 2 mints since 2026-10-26 21:34.
  • 176.65.144.71 — canary-farm-1, 1, 2 mints since 2026-10-29 06:16.
  • 178.128.207.138 — canary-farm-1, 1, 1 mint since 2026-10-29 18:30.
  • 185.132.187.218 — canary-farm-1, 1, 1 mint since 2026-10-30 05:47.
  • 185.132.187.235 — canary-farm-1, 1, 1 mint since 2026-10-30 00:37.
  • 20.25.26.107 — control-1, 1, 1 mint since 2026-10-29 18:11.
  • 206.189.95.232 — control-1, 1, 1 mint since 2026-10-29 18:30.
  • 206.81.24.227 — canary-farm-1, 1, 4 mints since 2026-10-24 04:32.
  • 23.132.164.201 — canary-farm-1 and ru-edge-1, 1 each, 4 mints since 2026-10-28 17:55.
  • 45.138.12.16 — canary-farm-1 and ru-edge-1, 1 each, 5 mints since 2026-10-24 03:33.
  • 45.138.12.6 — ai-devbox-1 and canary-farm-1, 1 each, 3 mints since 2026-10-28 16:49.
  • 45.148.10.5 — canary-farm-1, 1, 3 mints since 2026-10-23 09:45.
  • 45.79.122.239 — ai-devbox-1, 1, 1 mint since 2026-10-30 03:18.
  • 64.226.65.160 — canary-farm-1, 1, 2 mints since 2026-10-23 19:07.
  • 82.197.193.14 — ru-edge-1, 1, 1 mint since 2026-10-29 19:58.

Old stockpiles with no AWS use (candidates for hoarding or resale — still unproven either way):

How the fleet behaved (Fleet Observations) — what the sensors saw

  • Volume dropped everywhere, for a known reason. Every node fell below its 7-day average: ai-devbox-1 −52%, canary-farm-1 −17%, control-1 −57%, frantech-ts −92%, lauterbourg-01-ts −84%, netcup-ts −34%, ru-edge-1 −92%, sponge-01-ts −14. The gap is four very loud scanner groups from earlier windows that stayed home this time: 34.67.167.4 (9,815 events on ai-devbox-1), 93.152.221.96 (30,543) and 169.150.211.193 (13,776) on ru-edge-1, a 13,776-event trio on frantech-ts (169.150.201.41, 155.2.191.115, 23.234.118.146), and 121.40.140.50 (20,289), 136.70.193.85 (9,815), 152.236.14.113 (6,101) on lauterbourg-01-ts. The normal background noise did not change.
  • Credential minting. The digest counted 60 minted credentials (canary-farm-1 27, control-1 13, ru-edge-1 13, ai-devbox-1 7). 25 mint attempts failed with 400 rejections at /.env — paced single attempts from 12 IPs on 4 sensors, no 401s, no key problems. The failure share this window is 25 of 85 attempts, worth watching one more window. netcup-ts, sponge-01-ts, and frantech-ts mint nothing by design (no canary keys); lauterbourg-01-ts ships with an empty key, so its zero is configuration, not a fault.
  • Header forgery. All four fake-header counters stayed at 0 (2,328 requests carried X-Forwarded-For; none forged, none contradicting the connection). The two windows with mass forgeries were the TechTies JNDI injections, now idle.
  • Traffic split. canary-farm-1 took 12,227 plain-http events and 707 https. ai-devbox-1 is the only node where https leads (1,266 vs 1,108) because of its Cloudflare-fronted surface. The busiest hostname was sso.rightabouteverything.show with 11,005 events.
  • control-1, the deliberately fresh node. 47 days live. Its most recent full day in the window (10-29) saw 2,048 events from 153 unique IPs. The 7-day band runs 892–16,293 events per day with 102–178 unique IPs. It still draws the heaviest SSH mass-scan in the fleet (26,619 sessions of its 49,325 inbound).
  • No fleet changes. Nothing was changed, fixed, or redeployed this cycle.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is one machine running fake SSH (port 2222) and fake telnet (port 2323). Its numbers are its own, never a fleet total.

The funnel: 647 addresses sent login attempts → 489 got a fake shell (76%) → 449 typed a command (92% of shell-getters, 69% of all sources). In raw events: 26,860 login attempts → 22,543 accepted logins → 31,149 commands. Telnet took 1,424 attempts, the usual commodity IoT botnets.

New this window — and it all comes from one address. Of 6,709 distinct commands on record, 91 appeared for the first time, and 92.118.39.50 sent all 91. The commands are shell capability tests, one per try, each with its own hash-tagged label. Quoted verbatim (head): "sh -c 'printf '"'"'\n%s|%s\n'"'"' '"'"'check_3d916a01fd28b3dd0c4b2e9b55012b88_small_control'"'"' '"'"'check_3d916a01fd28b3dd0c4 — with sibling tests named _small_math (computing $((807*381+48))), _small_pid (asking for $$), _small_done, and _arg1/_arg2 function-definition checks. This looks like a botnet author's quality-assurance pass: it verifies that a shell can do arithmetic, variable expansion, and functions before deploying to it. If this address drops a payload next window, the read is confirmed.

Everything else was context, not news: the echo -e "\x6F\x6B" keepalive loop from 13.140.229.150 (18,931 events), uname and lspci hardware checks (77.239.124.2, 195.178.110.218), and the chattr -ia .ssh plus SSH-key-plant pair (411 and 360 sources). Passwords: 21,511 distinct pairs offered, 0 new. The concentration: 345gs5662d34/345gs5662d34 with 658 tries and root/3245gs5662d34 with 525 — the same family, 1,183 tries combined.

C2 download addresses (frantech-ts — one host)

The dropper-address inventory stood at 71 endpoints on 20 hosts (2,421 command references and 602 download attempts since 2026-09-18T10:45). This window was fully quiet: 0 new endpoints, 0 endpoints even touched. The 20 captured payloads (all served with HTTP 2xx in past windows) stay as recorded, from 6 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128):

  • 7b8cd695424f (1,487 B script) and b965f772177c (1,488 B script) from http://176.65.139.40/wget.sh and /curl.sh, first fetched 2026-10-20T08:57.
  • Four ELF binaries from http://152.42.195.115/: 62e3e86a7586 (main_arm7, 201,396 B), ec69d3e0d4d9 (main_mips, 194,400 B), 1913ed2ad175 (main_mpsl, 194,400 B), e27e963b2b49 (main_arm6, 157,468 B), all first fetched 2026-10-26T08:46.
  • ba9c9d9d361d (1,615 B script) from http://176.65.139.157/telnet2.sh, 2026-10-12T16:52.
  • Eight script versions from http://146.190.102.83/t2r/t2r_compat.sh (2165fae6c486 6,738 B, 2d6b9901a480 14,042 B, 2a7af0bb942a 14,506 B, a8769ddc8139 16,170 B, f8d4dafd6b96 16,506 B, 8a8189c0c67b 5,150 B, c871a756510b 5,276 B, fetched 2026-10-26 11:17 → 19:22) plus 0cac28cc7f78 (4,404 B) from /t2r/w1_compat.sh (2026-10-27T00:18).
  • e06be431a8d4 (1,498 B) and 72d835f767c8 (1,499 B) from http://185.228.72.128/wget.sh and /curl.sh, 2026-10-19T21:30.
  • 0583d9e18684 (1,987 B script) and b16e15764b8b (19 B text) from http://176.65.132.7:8889/lv.sh, 2026-10-24T10:16.
  • 709009e02c8e (10 B text) from http://oper.atlas101.us.kg/dl.sh, 2026-10-15T04:36.

One caution that always applies: a hosting IP is not the attacker — 176.65.139.40 both serves payloads and logs in as an operator (1,224 telnet authentications). Match on the payload hashes and script text, not the address.

Open questions

  1. Will REGISTRY-HUNT try to keep its access after listing the AWS account's roles and users? Watch the Tracebit alert pull for the 43 walker-held credentials still unused, and any new use IP.
  2. Does the Docker-registry tool go further? We do not know whether the fake /v2/ surfaces answered its login-token requests, or whether it will try to download an image layer. A layer download would confirm the full flow. Adding a fake registry login is a fleet-owner decision, not something this report does.
  3. Will 136.80.17.156 open a second, password-guessing leg against /wp-login.php the way the last operator did? Any multicall count past about 15,000 is the alarm line.
  4. Will OPENAPI-CENSUS, DOCKER-DIGEST-PULL, or the WP-XRPC-WALK pool add a second IP, node, or first credential mint? Any of those promotes a watcher to a standing threat.
  5. Why did 25 of 85 credential mints fail with 400 this window? One more window of data will show whether the upstream rejection rate is settling or growing.
  6. The TechTies stockpile — 1,088 credentials over two idle windows — has never touched AWS. When (or whether) it moves is still an open question, and the alert pull is how we will know.

Plain language version of: flux-fleet-intel-briefing-2026-10-30.md