Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №68 — PLAIN LANGUAGE

Period: 2026-10-30 07:33 – 2026-10-31 07:34 UTC (24h, day 66 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-10-31.md

What happened (plain)

Attackers who stole decoy credentials from the fleet last window came back and used more of them. One of them used a fake SSH password to try to log in somewhere — the first time the fleet has seen its decoy SSH credentials tried. A new attacker set a record for this campaign: one computer sent 14,154 requests for 14,154 different download addresses to frantech-ts in 91 seconds, and that one burst explains why frantech-ts was the only busy node — every other node was 12–88% quieter than its recent average. Two tools we were only watching got promoted because they did exactly what we said to watch for: the OpenAPI census scanner came back with a second computer and a longer target list, and the Docker image thief downloaded its first actual image files. One sensor (ai-devbox-1) was hit by a password-guessing wave from 201 different computers, each sending exactly one guess — the widest such wave recorded here, and past the fleet's 200-pair alarm line. For the first time in a while, two requests arrived with a fake "forwarded-for" address — both from a scanner that calls itself benign and lies about where it came from.

Background: this fleet runs fake services (honeypots). Some fake pages hand out "canary" credentials — real-looking passwords that do nothing except send an alert the moment someone tries them somewhere. That alert is how the fleet knows what thieves do with what they steal.

What it means (plain)

  1. The thieves do more than collect — they try what they take, and not only against Amazon. Walker 165.227.84.14 picked up a fake SSH password from canary-farm-1 at 21:17 stored and used it in a login attempt in the same window. A second address, 52.161.59.96, ran a successful sts:GetCallerIdentity (an AWS "who am I" call) with a credential that has no record of ever being handed out in the fleet's logs, so the Tracebit alert service is the only witness. (High confidence on both facts — the alert pull contains both rows; Moderate on intent — one SSH try may be just a validity test, and we cannot see where 52.161.59.96's credential came from.)
  2. Password guessing went wide, not deep. 201 different computers each sent one wp-login.php login POST to ai-devbox-1 with obvious default pairs like editor/editor and webmaster/webmaster. The fleet's registered alarm line was 200 pairs. (High confidence on the count — direct query, 201 events from 201 IPs; Moderate on which campaign this belongs to — the fake browser versions differ from the known family, so this is a new operator in the class.)
  3. The Docker client is here to steal images, not just look at menus. 147.90.255.64 added 12 blob downloads (netcup-ts 10, canary-farm-1 2) on top of its catalog, tag, and manifest requests. That is the complete download flow for a container image. (High confidence — the flow stages are in the result tags, and the fake registry served only decoys.)
  4. Attack toolkits keep getting passed around. The MEGA-DICT download-address list ran under a third operator at record size (135.136.19.27, 14,154 paths), and the OpenAPI/config census scanner spread from 3 to 7 sensors using two computers from one network block. (Moderate confidence — the operator count is observed; "passed around" is an inference the fleet cannot directly prove.)

Campaigns (who / what / what it means)

REGISTRY-HUNT — cloud-server thieves who walk the fleet and use what they steal (second use window, first SSH use)

  • Who: 11 DigitalOcean-hosted computers ran the walk this window (165.227.84.14, 64.23.218.208, 46.101.111.185, 138.68.144.227, 164.90.228.79, 159.89.127.165, 206.81.24.227, 206.81.12.187, 165.22.34.189, 64.226.65.160, 143.110.217.244), plus 142.93.129.190 in the mint records. Between 20:57 and 21:21 stored, walkers minted decoy credentials on canary-farm-1 and ru-edge-1 using the l9scan/2.0.… (+https://leakix.net) tool signature — the same mint wave shape as window №66. 46.101.111.185 used stolen credentials last window and minted again this window.
  • What they did: the walk is unchanged (tarpit → WebLogic console → server-status → Confluence login → WHM/cPanel addresses → /v2/_catalog → registry tags/list → manifests/latest). The new part is on the use side: 165.227.84.14 used its 21:17 SSH decoy in a login attempt (Tracebit logged "SSH credentials used to attempt login"), and 52.161.59.96 ran a successful sts:GetCallerIdentity with a credential that has no mint record in the fleet's logs.
  • What it means: this group takes credentials and works them within hours, two windows in a row, and the SSH attempt shows they test more than AWS keys. The decoy design turned both events into attribution. Watch: another SSH attempt, AWS activity from the 20:57–21:21 mints, and a second use address outside the log window.

WIDE-CONFIG-CENSUS — one computer checks almost every hiding place at once (new)

  • Who: 50.19.185.106, an Amazon US address, hit canary-farm-1 only, from 12:25 to 12:46 stored.
  • What they did: 324 requests across 302 paths and 75 trap families in 21 minutes, using a fake, cut-short Chrome/124.0 browser ID, with no POSTs. It took one decoy credential at /.env at 12:25:11 stored. Family counts: env-production 47, firebase-json 13, app-config-yaml 8, wp-config 7, generic-ci-config 6, docker-compose 5, app-config-php 5, appsettings-json 5.
  • What it means: one broad sweep touched nearly every bait the fleet sets, and it walked away with a credential on its first pass. Whether that credential shows up in AWS is the immediate check. A second computer or node makes this a standing campaign.

OPENAPI-CENSUS — API-document and app-config scanner (now standing)

  • Who: 193.47.62.29 (BestDC Limited BG, fake Chrome/123.0.0.0) ran 922 events on 5 sensors (canary-farm-1, ai-devbox-1, control-1, frantech-ts, lauterbourg-01-ts). A new address from the same block, 193.47.62.32, ran 223 events on 7 sensors using plain Go-http-client/1.1. Techoff BG addresses 195.178.110.159 and 195.178.110.22 ran smaller legs (11 openapi-spec-json-issued events each on canary-farm-1 and ru-edge-1).
  • What they did: the target list grew past API spec files into .NET/Node app config. It caused the config-json spikes (ai-devbox-1 93 events, 11.6× normal; control-1 84 events, 12.0×), the appsettings-json/webapp-config-bundle-json tags, and spec-file spikes on 7 sensors. The fake pages answered 200 with skeleton files. 0 credentials taken, 0 POSTs.
  • What it means: the promotion triggers set last window both fired — a second computer from one block, and a longer list. The fake answers mean the scan learned nothing useful. Watch: the first credential taken by this class, and whether the Techoff legs are running the same list.

DOCKER-DIGEST-PULL — a real Docker client asking for internal container images (full pull flow)

  • Who: 147.90.255.64, on canary-farm-1, ru-edge-1, and netcup-ts this window (68 events). ai-devbox-1 saw nothing from it this window.
  • What they did: using an honest Docker client ID (docker/24.0.7 go/go1.21.5 … arch/amd64), it walked the catalog, listed tags, requested manifests by digest for internal-sounding names, and — new this window — downloaded 12 blobs (netcup-ts 10, canary-farm-1 2), plus 2 docker-registry-version checks.
  • What it means: last window we said to watch for blob downloads; they happened, so this client completes the whole image-download flow. The fake registry served decoys throughout. Watch: a second computer, token endpoint probes, and whether the same digests come back (a fixed list would name their targets).

MEGA-DICTIONARY — a recorded list of malware download addresses, replayed (record replay, third operator)

  • Who: 135.136.19.27 (M247 Europe SRL DE, on a blocklist), against frantech-ts only. The three earlier replay operators (169.150.201.41, 155.2.191.115, 23.234.118.146) did nothing this window.
  • What they did: 14,154 requests for 14,154 different paths in 91 seconds (04:13:40–04:15:11 stored), one request type, mixed fake device IDs (360 Router P2 v2 through libwww-perl/6.68). 14,149 events got not-handled; 5 single tags fired (llm-endpoint-models-list, gravitysmtp-miss, exchange-powershell-pre-auth, observability-profiler-index, llm-endpoint-ollama-ps). Sample paths: /zatoempire.sh, /bins/bot.mipsel, /cnc, /dns, /ambatukam/rizzx.ppc, /ENCRYPTED.ps1.ps1. First-seen paths on frantech-ts include /morte.x86_64, /deathstarm68k, /donkeypussy/deathstar.x86_64, /fvbig/zerobot.arc, /h2.arm64, /krmine-ppc64, /fuckmeh.sh. 0 POSTs, 0 credentials.
  • What it means: the biggest single-computer replay this campaign has shown (previous high 13,776), under a third operator — the address list is clearly shared tooling. The fake surfaces refused 99.96% of it. Watch: a repeat from this address, the old operators returning, and overlap between the three lists.

WP-LOGIN-BRUTE class — password guessing from many computers, one guess each (alarm line passed, new operator shape)

  • Who: 201 different computers, one login POST each, against ai-devbox-1 (the wp-login-credentials spike: 201 events, 4.0× normal). A small separate cluster (1dd16c0704a9, first seen 10-31) probed and posted on canary-farm-1, netcup-ts, and sponge-01-ts: 8.210.191.157 (18 events), 49.232.230.213 (16), the 103.47.145.x group (.13, .14, .23, .32 at 8–10 each), 40.81.235.173. The last three windows' operators (8.137.104.136, 180.93.254.108, 136.80.17.156) stayed quiet.
  • What they did: one POST /wp-login.php per computer with default user=pass pairs — captured bodies read log=editor&pwd=editor&wp-submit=Log+In&redirect_to=https%3A%2F%2Finference.fapthropic.com%2Fwp-admin%2F&testcookie=1 and log=webmaster&pwd=webmaster&… — each computer wearing a different fake modern browser ID (Version/18.0 Safari ×34, Chrome/155 Mobile ×30, Firefox/148 ×28, Chrome/155 ×28; the version numbers do not exist yet, which shows the forgery). 0 credentials — login forms are not bait pages.
  • What it means: many one-shot computers beat per-address rate checks, and the registered 200-pair alarm line is crossed on a single sensor. The browser IDs differ from the known family, so this is a new operator. Watch: the same spray on canary-farm-1 or ru-edge-1, and any pair reaching a page that hands out decoys.

CREDSWEEP class — the .env file hunters (seventh window)

  • Who: 45.138.12.16 (Tc Datacenter Limited LT) covered 7 sensors with 1,290 events and took decoys at /.env on ai-devbox-1 (14:36 stored) and control-1 (18:07 stored) with a fake Chrome/124.0. 45.138.12.35 ran canary-farm-1 (389) and ru-edge-1 (384). 45.138.12.51 ran netcup-ts and sponge-01-ts and took one on canary-farm-1 (08:25 stored) using l9explore/1.2.2. 45.138.12.6 took one on canary-farm-1 (14:19 stored). 194.180.49.41 (MEVSPACE) ran 37 events on 5 sensors. 176.65.144.71 was not among this window's busiest addresses.
  • What they did: the same per-sensor walks as before (tarpit → fake git → fake svn → /.env mint → the .env-variant battery). The block took 4 credentials this window, one per listed computer.
  • What it means: seven windows running, fresh credentials each time, and still no observed use of any of them. The l9explore/1.2.2 tool name is the same one REGISTRY-HUNT's walkers use — a second link between the two campaigns. Watch: AWS use of the 4 fresh credentials.

CLAUDE-CRED-HUNT — the Claude-store hunter changed tools

  • Who: 87.192.41.180, all 8 sensors, 15:39–22:00 stored, 402 events (window №59: 176).
  • What they did: same fake Chrome/136.0.0.0 browser ID, but a different list — a .env-variant sweep at about 50 paths × 8 hits per sensor (/.env, /.env.local, /.env.backup, /.env.test, /.env.dev, /.env~, /.env.tmp, /.env.old, /.env.bak, /config). It took 1 decoy on each canary sensor (canary-farm-1 21:12, control-1 16:36, ru-edge-1 15:51 stored). It asked for no /.claude paths at all this window.
  • What it means: its signature move was hunting Claude Code credential stores. The switch to a generic .env sweep took 3 credentials, and whether the Claude walk comes back tells us if this is tool rotation or a new job for the same computer. Watch: /.claude* paths, and AWS use of the 3 credentials.

ADMINER-SWARM — the database-login page checkers are back on canary-farm-1

  • Who: two small pools, 136.144.42.x and 172.98.32.x, no more than 6 events each (spikes: adminer-credential-post 25, adminer-login 25 — 6.2× and 4.5× normal). Pool members 136.144.42.239 and 172.98.32.33 each took 1 decoy at 15:52 stored.
  • What they did: the registered pattern — find adminer/phpMyAdmin login pages, then 3 credential POSTs per computer. No further use seen.
  • What it means: the slow-pool model continues, and 2 more decoys entered circulation. Watch the alert pull for their use.

Other actors worth naming

  • 45.148.10.120 (Techoff Srv Limited NL; on two blocklists) — canary-farm-1 from 05:55 to 04:23 stored (22.5 h on the node), 356 events over 204 paths and 23 families, and 9 decoys taken at /.env (12 in the 6-day alert history since 10-28). Top results: fake-git 152, firebase-json 31, config-json 17, gcp-credentials-json 10. Browser IDs rotated through Safari 13.1.2, a stripped Windows Chrome string, and a fake Chrome/138.0.0.0 (ZZ; Linux i686). The same block produced the long-running hoarder 45.148.10.171.
  • 91.92.40.12 — new, all 8 sensors, 606 events: 596 requests for / and 10 for /login, mostly tarpit results, one stripped Windows Chrome ID.
  • 93.123.109.247 — announced itself as TLM-Audit-Scanner/2.0 and took 3 decoys on canary-farm-1 within one second (20:20 stored). The "audit" claim is unverified, so it stays in the hostile-light pile.
  • 74.0.42.13 — took 3 decoys across ai-devbox-1, canary-farm-1, control-1 (00:12–00:13 stored) with a fake old Android browser ID.
  • 185.177.72.64 (Bucklog SARL FR block) — took 2 decoys on control-1 (01:36 stored) with a fake iPad browser ID; none of the BUCKLOG-KIT exploit steps ran.
  • Known benign research: 71.6.155.70 (8 sensors, 8 events, empty browser ID; Censys range). 45.198.224.125 (8 sensors, 63 events, fake Firefox/71) stays hostile-light.

Standing actors (who keeps coming back)

  • REGISTRY-HUNT's DigitalOcean pool — every window on record, and now using stolen credentials two windows running.
  • 45.138.12.x (Tc Datacenter LT) — seventh window, 4 fresh decoys taken.
  • The Techoff blocks (45.148.10.x NL, 195.178.110.x BG) — scanning and decoy-taking on both; 45.148.10.120 led the fleet with 9 this window.
  • 194.180.49.41 (MEVSPACE) — small census runs, 5 sensors.
  • 23.132.164.201 (7 decoys in 6 days, 2 this window) and 162.35.242.53 (6 decoys, 2 this window) — both sitting on unusued piles.

Quiet this window: XMLRPC-BRUTE (all three recent operators idle: 8.137.104.136, 180.93.254.108, 136.80.17.156), WP-XRPC-WALK (first missed window), TechTies-KIT and JNDI-FIELD-INJECT (pile stuck at 1,088 over 6 days, third quiet window), SI-CENSUS 102.220.163.241 (second miss), the METADATA-HUNT named runners, AI-EXEC-HUNT, CALC-ORACLE-KIT (152.236.14.113), 121.40.140.50 and 136.70.193.85, VPN-CONF-HUNT, EXCHANGE-DICT, NIGHTAGENT, the BUCKLOG-KIT exploit steps, PATHSCAN-CENSUS, CF-FRONTED CREDSWEEP, OMEGA-SWEEP, CENSUS-284, ANDROXGH0ST-KIT, CRUSADER-SWEEP, KEYDROP-SCANS, 8.217.152.4, 140.245.97.208.

Network sweeps (Arkime) — port-22 SSH scanning seen only by the traffic sensor

The HTTP decoys cannot see a connection that never asks for a page. The network sensor can. This window it recorded 138,354 inbound SSH sessions to the fleet's 8 public addresses. Two fingerprints (a fingerprint identifies the SSH client software, not an address) crossed the "dispersed sweep" line — one client, many networks, one port, no login attempts:

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 5,590 sessions from 616 addresses in 260 networks across 71 countries, port 22, about 4,968 bytes per session. Top networks: Microsoft (AS8075), UCLOUD HK (AS135377), OVH (AS16276), Korea Telecom (AS4766), Oracle (AS31898). Busiest sources: 141.94.121.165, 136.248.121.226, 45.169.200.254, 143.202.104.29, 112.219.151.50. Daily address counts: 10-25 579, 10-26 599, 10-27 653, 10-28 615, 10-29 657, 10-30 583, 10-31 214 (partial day).
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 29,778 sessions from 83 addresses in 31 networks across 24 countries, port 22, about 5,189 bytes per session. Top networks include Techoff Srv Limited (AS48090). Busiest sources: 109.160.32.161, 109.160.32.165, 109.160.32.122, 77.239.124.147, 109.160.32.31. Daily address counts: 10-25 78, 10-26 38, 10-27 53, 10-28 48, 10-29 58, 10-30 83, 10-31 36. It crossed the sweep line this window (last window: 56 addresses) and is now the top scanner on 5 of the 8 nodes (ru-edge-1, canary-farm-1, sponge-01-ts, lauterbourg-01-ts, frantech-ts). Its busiest address, 109.160.32.161, is also one of the computers running discovery commands inside the frantech-ts honeypot — the scanner and the shell operators share machines.

Other named fingerprints: GO-SPRAY-SWEEP (06ff3615a51b…) shrank from 164 to 20 addresses (1,908 sessions). GO-SCATTER-SWEEP (16443846184e…) dropped 1,487 sessions day-over-day to 12,029 from 26 addresses, and still owns netcup-ts's inbound. CTL-MASS-SSH (4e066189c3bb…) again owns control-1: 32,352 of its 54,540 inbound sessions, up 5,733. LIBSSH-011-SWEEP (03a80b21afa8…) ran 180 sessions from 36 addresses. Unnamed regulars: a591c4ddccc9… (266 sessions, 26 addresses), 084386fa7ae5… (41, 33), dd9bcf093c35… (30, 30, one network, one country). No new fingerprints appeared, so nothing new goes into the name lists.

Canaries (minted and used) — what the decoys saw

The fleet handed out 45 decoy credentials to 26 collector addresses this window. 2 credentials were used in AWS-adjacent ways (3 use events). Outcomes: 2 unknown, 1 success — a single successful sts:GetCallerIdentity, which shows only the account identity. Anything beyond that call would be a real finding. 43 stolen credentials sat unused.

The two use facts:

  • 165.227.84.14 (a REGISTRY-HUNT walker) used its 21:17-stored SSH decoy from canary-farm-1 in a login attempt.
  • 52.161.59.96 ran sts:GetCallerIdentity successfully. It has no mint record anywhere in the fleet's history window, so Tracebit is the only witness.

Every collector this window, with its sensor, count, and history (from the per-collector table — plain list):

  • 45.148.10.120 — canary-farm-1 — 9 — 0 used — 12 mints since 2026-10-28 13:34
  • 93.123.109.247 — canary-farm-1 — 3 — 0 used — 3 mints since 2026-10-30 20:20
  • 185.177.72.64 — control-1 — 2 — 0 used — 2 mints since 2026-10-31 01:36
  • 23.132.164.201 — ai-devbox-1 — 2 — 0 used — 7 mints since 2026-10-28 17:55
  • 129.159.56.14 — ai-devbox-1 — 1 — 0 used — 1 mint since 2026-10-30 15:15
  • 134.209.109.26 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 19:45
  • 136.144.42.239 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 15:52
  • 142.93.129.190 — canary-farm-1 — 1 — 0 used — 2 mints since 2026-10-24 19:54
  • 143.110.217.244 — canary-farm-1 — 1 — 0 used — 3 mints since 2026-10-26 21:51
  • 162.35.242.53 — ai-devbox-1 — 1 — 0 used — 6 mints since 2026-10-29 15:00
  • 162.35.242.53 — control-1 — 1 — 0 used — 6 mints since 2026-10-29 15:00
  • 165.227.84.14 — canary-farm-1 — 1 — 1 used (SSH login attempt) — 1 mint since 2026-10-30 21:17
  • 172.98.32.33 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 15:52
  • 195.178.110.159 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 14:19
  • 217.60.76.38 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 19:20
  • 23.132.164.201 — control-1 — 1 — 0 used — 7 mints since 2026-10-28 17:55
  • 34.176.183.240 — ai-devbox-1 — 1 — 0 used — 1 mint since 2026-10-30 13:40
  • 34.65.175.57 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 11:31
  • 45.138.12.16 — ai-devbox-1 — 1 — 0 used — 7 mints since 2026-10-24 03:33
  • 45.138.12.16 — control-1 — 1 — 0 used — 7 mints since 2026-10-24 03:33
  • 45.138.12.51 — canary-farm-1 — 1 — 0 used — 5 mints since 2026-10-24 18:42
  • 45.138.12.6 — canary-farm-1 — 1 — 0 used — 4 mints since 2026-10-28 16:49
  • 46.101.111.185 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 20:57
  • 50.19.185.106 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-30 12:25
  • 64.23.218.208 — ru-edge-1 — 1 — 0 used — 4 mints since 2026-10-25 21:41
  • 73.105.185.55 — canary-farm-1 — 1 — 0 used — 1 mint since 2026-10-31 07:18
  • 74.0.42.13 — ai-devbox-1 — 1 — 0 used — 3 mints since 2026-10-31 00:12
  • 74.0.42.13 — canary-farm-1 — 1 — 0 used — 3 mints since 2026-10-31 00:12
  • 74.0.42.13 — control-1 — 1 — 0 used — 3 mints since 2026-10-31 00:12
  • 87.192.41.180 — canary-farm-1 — 1 — 0 used — 3 mints since 2026-10-30 15:51
  • 87.192.41.180 — control-1 — 1 — 0 used — 3 mints since 2026-10-30 15:51
  • 87.192.41.180 — ru-edge-1 — 1 — 0 used — 3 mints since 2026-10-30 15:51
  • 91.92.41.32 — canary-farm-1 — 1 — 0 used — 4 mints since 2026-10-24 14:15
  • 52.161.59.96 — (outside the flux log window) — 0 minted here — 1 used (GetCallerIdentity) — no flux mints in the history window

Collectors still holding unused piles (candidates for hoarding, resale, or use we cannot see):

93.152.221.96 1,088 mints (2026-10-25 15:18 → 2026-10-27 21:29); 102.220.163.241 70 (10-25 09:28 → 10-28 09:12); 136.65.203.248 41 (10-26 19:00); 136.66.182.42 41 (10-24 05:03); 34.95.21.228 41 (10-28 18:17); 45.148.10.120 12 (10-28 13:34 → 10-31 04:23); 46.151.178.15 12 (10-25 17:05 → 10-29 00:56); 213.209.159.154 10 (10-24 06:37 → 10-27 11:08); 176.123.5.6 9 (10-29 02:21); 140.245.97.208 8 (10-24 13:00 → 10-28 00:54); 23.132.164.201 7 (10-28 17:55 → 10-30 16:10); 45.138.12.16 7 (10-24 03:33 → 10-30 18:07); 162.35.242.53 6 (10-29 15:00 → 10-30 09:33); 169.150.196.6 6 (10-25 03:05 → 03:29); 195.178.110.22 6 (10-24 06:41 → 06:53); 105.112.190.152 5 (10-26 06:26 → 07:47); 105.112.24.243 5 (10-28 09:46 → 10:41); 147.182.149.75 5 (10-24 04:32 → 10-29 19:21); 202.65.238.233 5 (10-29 07:43 → 07:48); 206.81.24.74 5 (10-25 21:04 → 10-29 20:56); 208.84.100.218 5 (10-26 01:31 → 03:41); 217.60.76.167 5 (10-24 07:47 → 10-26 20:44); 45.138.12.51 5 (10-24 18:42 → 10-30 08:25); 157.245.113.227 4 (10-24 19:57 → 10-29 18:30); 165.227.102.187 4 (10-24 03:52 → 10-27 03:24); 193.32.248.165 4 (10-29 22:37 → 22:53); 206.81.24.227 4 (10-24 04:32 → 10-29 21:05); 45.138.12.6 4 (10-28 16:49 → 10-30 14:19); 64.225.75.246 4 (10-24 04:32 → 10-29 18:29); 64.23.218.208 4 (10-25 21:41 → 10-30 21:03); 91.92.240.86 4 (10-25 13:52 → 21:58); 91.92.41.32 4 (10-24 14:15 → 10-30 20:25); 93.123.109.107 4 (10-29 17:03 → 22:21); 130.12.180.77 3 (10-27 06:26 → 06:29); 138.68.144.227 3 (10-24 20:54 → 10-28 21:10); 143.110.217.244 3 (10-26 21:51 → 10-30 21:12); 146.70.98.138 3 (10-24 20:46 → 10-25 20:51); 157.230.19.140 3 (10-24 21:01 → 10-29 04:44); 164.92.107.174 3 (10-24 20:08 → 10-29 19:17); 185.177.72.29 3 (10-28 19:50); 23.239.27.128 3 (10-27 11:54 → 17:27); 46.101.1.225 3 (10-24 04:32 → 10-26 21:46); 68.183.9.16 3 (10-24 20:53 → 10-29 21:08); 74.0.42.13 3 (10-31 00:12 → 00:13); 8.217.152.4 3 (10-27 17:04 → 10-28 07:36); 87.192.41.180 3 (10-30 15:51 → 21:12); 93.123.109.247 3 (10-30 20:20); 93.152.209.6 3 (10-24 19:57 → 10-27 11:26).

How the fleet behaved (Fleet Observations) — volumes, decoys, and self-checks

  • Why the volumes moved. frantech-ts ran 65% above its 7-day average because of one 91-second replay (14,154 of its 15,134 events). Every other node ran below average: ai-devbox-1 −64%, canary-farm-1 −82%, control-1 −66%, lauterbourg-01-ts −88%, netcup-ts −39%, ru-edge-1 −88%, sponge-01-ts −12%. The huge crawler runs from windows №64–№66 did not repeat, and nothing replaced them on those nodes. Note on windows: an event between two daily runs shows up in two digests.
  • Decoy economics. The fleet handed out 48 decoys by the digest count (canary-farm-1 31 from 21 addresses, ai-devbox-1 7, control-1 7, ru-edge-1 3). Minting failed 13 times, all as 400 Bad Request pacing singles (ai-devbox-1 7, control-1 5, canary-farm-1 1) — no key errors. The failure share fell to 13 of 61 attempts (21%) from 25 of 85 (29%) last window. netcup-ts, sponge-01-ts, and frantech-ts hand out none by design (they run without TLS identities); lauterbourg-01-ts ships with its key empty on purpose, so its zero is configuration, not a fault.
  • Source-address honesty. 1,864 requests carried an X-Forwarded-For header. Chains with multiple entries: 0. Headers ignored as source: 0. Headers naming a source different from the real connection peer: 2 — both from metabase-cve-2026-72898-detect/1.0 (benign detection probes only) requesting GET /api/session/properties: on canary-farm-1 it claimed 120.23.123.198 while the real peer was 165.227.3.36, and on ai-devbox-1 it claimed 201.157.181.77 over peer 169.40.142.172. A scanner that says it is benign and lies about its origin gets no benefit of the doubt; the peer addresses are the only reliable trace it leaves. Otherwise: every node ran HTTP-led this window, and ai-devbox-1 measured 1,252 http vs 605 https (last window https led there). Busiest Host header: 209.141.62.110 with 15,127 (the replay), then sso.rightabouteverything.show with 1,517.
  • control-1's discovery ramp. 48 days live. Latest full day (10-30): 1,959 events from 146 unique addresses. The 7-day band runs 892–16,293 events per day with unique addresses between 102 and 178 — the ramp holds, and the traffic sensor still shows control-1 taking the fleet's heaviest single-fingerprint SSH load (32,352 sessions).
  • First-seen caveat. Every first-seen row in the digest shares one sync timestamp (03:15 stored), so the first-seen table is an inventory, not a timeline. The path attributions above come from direct journey queries instead.
  • Fleet-side fixes. None this cycle.

SSH/telnet honeypot (frantech-ts — one host, not a fleet number)

One computer's worth of data, never a fleet total. Of 646 addresses that tried passwords, 496 got a shell (77%) and 432 ran a command (87% of shell-getters, 67% of all sources). Event level: 11,764 password attempts → 4,903 accepted logins → 15,257 commands (311% of accepted logins ran something). Telnet (cheap IoT botnets): 1,050 attempts.

No command ran for the first time this window (0 of 6,185 known commands) — the second quiet window in a row. No new password pairs either (0 of 4,417 offered). The password concentration is unchanged and comes from one family: 345gs5662d34/345gs5662d34 842 tries plus root/3245gs5662d34 612 (1,454 together), then everyday pairs. The usual regulars held: uname hardware discovery (1,918 + 1,916 events from 3 addresses, example 109.160.32.161 — the same address leading GO-SSH-SWEEP above), GPU-discovery strings via lspci/nvidia-smi from 195.178.110.218 and siblings, and the chattr -ia .ssh plus SSH-key-plant pair (375 and 337 sources).

C2 download addresses (still one host, not a fleet number): two new dropper addresses appeared under one host, 64.177.33.68 — http://64.177.33.68:8000/ngrok_installer? (first seen 2026-10-30T19:28) and http://64.177.33.68/cat.sh (20:15) — and neither served any content (0 successful downloads). The standing dropper https://217.60.102.5/sh stayed active (14 command events from 7 sources). No new payloads were served, so the 20 captured artifacts stand (sha256 list in the technical version; the older entries include 7b8cd695424f from http://176.65.139.40/wget.sh and the four main_* ELF files from http://152.42.195.115).

Open questions

  1. What will the walkers do with the rest? 43 walker-held credentials are still unused. Does the 165.227.84.14 SSH login attempt repeat, and which account did it target? Will the 20:57–21:21 mints show up in AWS? Will a second outside-window use address appear like 52.161.59.96?
  2. Will the 201-computer password spray spread? It crossed the 200-pair alarm on ai-devbox-1. Did canary-farm-1 or ru-edge-1 get the same treatment, and did any guessed pair reach a page that hands out decoys?
  3. Who else pulls Docker images? A second computer, token-endpoint probes, or the same digests requested again would tell us whether 147.90.255.64 works from a fixed target list.
  4. Will 50.19.185.106's credential be used? Its single broad sweep took one decoy. AWS use makes it standing; a second computer or node does too.
  5. How big is the shared MEGA-DICT list? 135.136.19.27 set the record at 14,154 paths. Will it repeat, will the older operators return, and how much do the three operators' path lists overlap?
  6. Did 87.192.41.180 change jobs or just change tools? Its Claude-store walk vanished this window; /.claude* paths returning would answer that. Will its 3 fresh decoys be used?
  7. Who is behind the lying "benign" scanner? The Metabase-CVE scanner forges its source. The only solid traces are the real connection peers 165.227.3.36 and 169.40.142.172. We do not know more than that yet.

Plain language version of: flux-fleet-intel-briefing-2026-10-31.md