Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №70 — PLAIN LANGUAGE

Period: 2026-11-01 07:33 – 2026-11-02 07:33 UTC (24h, day 68 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-11-02.md

What happened (plain)

A collector called 137.23.38.53 picked up a fake credential (a "canary") from canary-farm-1 at 12:28 stored and tried it in AWS right away. That was the only AWS use this window: 2 calls, both successful sts:GetCallerIdentity — a call that reveals the account identity and nothing more. This is the third window in a row where a stolen canary was used in the same window it was stolen.

RECONX-L2S came back with a second operator. A new IP, 45.115.27.37 (Contrust Solutions S.R.L., Moldova), hit lauterbourg-01-ts, fetched the same /reconx-* marker paths, and POSTed a real exploit payload — a React-Flight body with process.mainModule.require in it — against the node's fake PHP runtime surface.

The MEGA-DICTIONARY replay (a huge list of malware download links, checked one by one) came back from a known host. 103.125.233.17 (xTom, Hong Kong) — the same address that ran the №62 replay on control-1 — hit frantech-ts with 14,197 different paths in 2 minutes 23 seconds, about 100 paths per second. That is the fastest and largest replay on record, and the list itself grew by 421 paths.

The stockpile of stolen fake credentials grew while actual use stayed thin. SI-CENSUS minted 35 more (104 held per 6-day history), REGISTRY-HUNT minted 9 in its fourth window in a row with no AWS use, and a new census called SWAGGER-SWEEP minted 5 in 17 seconds on ru-edge-1.

What it means (plain)

  1. Stealing a canary and testing it the same day is now normal behavior. 137.23.38.53 minted at 12:28:34 stored and ran 2 successful sts:GetCallerIdentity calls; 74 credentials went to 26 collectors, and nothing else showed up in AWS. (High confidence on the events — the Tracebit alert log carries both use rows. Moderate on intent — GetCallerIdentity leaks only the account identity, and this actor's earlier pattern was 72 denied ses:GetSendQuota calls, so bulk-sender probing is the next thing to watch for.)
  2. RECONX-L2S is a reusable kit passed between operators, and it now carries an exploit. Two different operators on two different nodes ran the same marker paths in two windows: mint-and-enumerate in №69, exploit delivery in №70. (High confidence on the sightings — the marker links them. Moderate on "one organization" — the two operators share only the marker.)
  3. The stolen-credential stockpile now sits in two known pools, and the gap between stolen and used widened. SI-CENSUS holds 104 canaries per 6-day history after a 33-mint burst on one sensor; REGISTRY-HUNT added 9 across 4 sensors. 74 credentials were minted this window and only 2 were used. (High confidence on the counts — direct queries and Tracebit. Moderate on the "saving them up" reading — use has lagged mint by about a day before.)
  4. The traps held every stage. GIT-HARVEST's git walk got 152 fake-git answers (a pretend git repository). The 14,197-path replay got 14,202 not-handled results. The 22 chat POSTs from AutoGenX hit a 200 answer from a trap with no AI model behind it. SWAGGER-SWEEP's 68-family run fed 5 canaries into a drain we watch. (High confidence — direct counts from the result tags.)

Campaigns (who / what / what it means)

CREDENTIAL-DRAIN — the pipeline from stolen canary to AWS use

  • Who: 26 collector IPs took 74 credentials this window (digest count 78: ai-devbox-1 42 from 8 IPs, ru-edge-1 17 from 14, canary-farm-1 10 from 8, control-1 9 from 7). Only one IP used any of them: 137.23.38.53.
  • What they did: the usual pattern — fetch /.env-style files, receive fake credentials, then try them in AWS. 46 mint attempts failed with 400 errors in slow singles (canary-farm-1 21, control-1 10, ru-edge-1 8, ai-devbox-1 6), plus 2 failures with no recorded error. No 401s, no key problems.
  • What it means: every issued credential is live within hours. The imbalance is the story: 74 minted, 2 used, and the two biggest stockpiles stayed silent in AWS.

SES-QUOTA-PROBE — the bulk-mailing prober, back after two quiet windows

  • Who: 137.23.38.53 (hosting not resolved; in fleet logs since 10-17 as a canary-farm-1 collector).
  • What they did: minted on canary-farm-1 at 12:28:34 stored using a fake Chrome/124.0.0.0 Windows user agent, then ran 2 use events — both successful sts:GetCallerIdentity. One call used the fresh mint; the other used a canary it already held from earlier farm mints (10-17/18, which sit outside the 6-day window).
  • What it means: in №57 this actor ran 72 denied ses:GetSendQuota calls. Identity success usually comes before quota work in its pattern. A return to GetSendQuota batches with the new mint is the expected next step; any success beyond identity would be a real finding.

RECONX-L2S — the recon kit, second operator, now with an exploit

  • Who: 45.115.27.37 (Contrust Solutions S.R.L., Moldova), on lauterbourg-01-ts only, 17:26:28–17:26:41 stored. The №69 operator (217.60.76.22) was absent.
  • What they did: 267 events in total. Eleven fetches of the /html/.git/reconx-3805bb28ac4c marker path class, using 5 rotating fake browser user agents. One POST / carrying a multipart body that begins {"_response":{"_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"},"_prefix":"function rq(m){try{return process.mainModule.require (boundary 89c8c87224abd4dedc911c2b90c6452ba12ffc1d092d645e732e80c64788; rest omitted) — a React-Flight / Next.js Server Actions exploit shape. The traps answered: php2shell-root, telescope-shell, php2shell-login-attempt, the rest tarpit and 404-class. Zero mints — the node ships with its canary key empty, and no canary sensor saw this IP.
  • What it means: the kit pairs credential theft (№69, a 15-operation AWS enumeration) with exploit delivery (№70). The same body class won 41 mints for AI-EXEC-HUNT on №64 through the /@fs surfaces. If this body shows up against a canary node, that is the escalation signal.

REGISTRY-HUNT / LeakIX — the LeakIX-style walkers, fourth mint window, still no use

  • Who: 37 IPs ran the docker-registry step of the walk fleet-wide. Seven minted under wrapped l9scan/2.0…(+https://leakix.net) user agents between 20:57 and 22:31 stored, plus one at 06:14 stored on 11-02: 139.59.143.102 ×2 (canary-farm-1), 209.38.248.17 ×2 (ru-edge-1), 209.97.180.8 ×2 (control-1 and canary-farm-1), 143.110.213.72 (control-1), 209.38.208.202 (ai-devbox-1), 68.183.180.73 (canary-farm-1).
  • What they did: the same 12-step walk (WebLogic console, server-status, Confluence, WHM/cPanel, then the docker-registry catalog, tags, and manifest reads). The registry steps caused the digest's docker-registry-tags and manifest spikes on control-1, frantech-ts, canary-farm-1, and netcup-ts.
  • What it means: four windows of minting against two windows of use (№66, №68). The 9 new canaries join the standing pool; late AWS calls and a second SSH-side use are the watch.

SI-CENSUS — the record hoarder, now minting in bursts

  • Who: 102.220.163.241 (VPS Dedicated LLC, Slovenia) — one IP, 2,931 events across 3 sensors over about 20 hours (ai-devbox-1 871 events/539 paths, control-1 1,032/511, canary-farm-1 1,028/511).
  • What they did: per-sensor walks over a 511-path directory list, marking each run with a pscan-<8-hex>-nonexistent.txt probe. Then a mint burst: 33 canaries from ai-devbox-1 between 09:54 and 10:39 stored under a fake Chrome/126 user agent — that is the digest's 3.7× issued spike — followed by one mint on each other sensor between 03:49 and 05:42 stored on 11-02 with a blank user agent. Its walk also caused most of control-1's phpinfo-error (54 of 63) and sftp-config-error (24 of 33) spikes.
  • What it means: the largest known hoard — 104 canaries per 6-day history, zero observed AWS use. One IP, one sensor, 45 minutes is now its mint signature.

MEGA-DICTIONARY — the 14k-path malware-link replay, a known host returns with a grown list

  • Who: 103.125.233.17 (xTom, Hong Kong) — the same host that ran the №62 replay on control-1, back after seven quiet windows — on frantech-ts only, 01:47:46–01:50:09 stored. 135.136.19.27 (the №68–№69 operator) was absent, so no schedule is known.
  • What they did: 14,207 GETs against 14,197 different paths in 2 minutes 23 seconds, using the Seagate Personal Cloud IoT user agent — about 100 paths per second, the fleet's fastest replay and its largest wordlist (the prior high was 14,154 in №68; this is +421 over the anti-joined 13,776-path manifest from №62). 14,202 results were not-handled; the same 5 single-decoy tag hits appeared that earlier replays carried (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth, llm-endpoint-models-list). 0 mints. No anti-join was run this window (frantech-ts keeps only a shallow log window).
  • What it means: a repeat host carrying a longer list — the shared wordlist is maintained, not just passed around. This one replay is the whole reason frantech-ts stayed at −2% while every other node dropped.

SWAGGER-SWEEP — new: a fast API-doc census that minted 5 canaries

  • Who: 34.96.41.148 (Google LLC, Belgium), on ru-edge-1 only, 12:58:16–13:00:58 stored.
  • What they did: 257 events against 202 paths covering 68 trap families in 2 minutes 42 seconds, using a bare, stripped Chrome user agent. Five mints in 17 seconds: /.env issued, plus OpenAPI-spec mints at /swagger.json, /api-docs, /openapi, and /api/swagger.json, with actuator, health, login, graphql, and wp-config steps behind them.
  • What it means: the second-highest family count ever for a run under 3 minutes (the OMEGA record is 107; WEBSIPHON hit 71 in 7.3 seconds). Five fresh canaries are now in hostile hands; whether they get used in AWS is the first thing to check.

GIT-HARVEST — new: a git-repository walker with an honest label

  • Who: 35.232.76.162 (Google LLC, US), on 7 sensors, 164 events.
  • What they did: used the honest user agent Mozilla/5.0 (compatible; harvest/1.0). Each leg ran 39 events against 28 paths in 17–19 seconds (ai-devbox-1 at 04:19 stored, control-1 at 03:08 stored); canary-farm-1 got 79 events between 12:11 and 23:39. Results: 152 fake-git, 7 not-handled, 4 fake-git-miss, 1 fake-git-error. 0 mints, 0 POSTs.
  • What it means: the git-internals walk template (the MEVSPACE-GITWALK family) under an honest self-label — the same pattern as GIT-VAULT's gitdump/1.0. The fake git surfaces caught every step. A mint or a second IP would promote it.

GOWEB-PENTEST — the phpMyAdmin hammer, a known operator returns on a new node

  • Who: 103.242.78.199 (hosting not resolved) — the same operator that ran the №50–№51 pass on canary-farm-1, back on lauterbourg-01-ts at 23:08:25–23:09:12 stored. It is the campaign's second repeat IP (after 172.104.173.62).
  • What they did: the registered 151-event phpmyadmin-login burst against 1 path in 47 seconds, under the honest Go Web Pentest Tool user agent. It owns the node's 7.0× phpMyAdmin spike.
  • What it means: the same 151-event unit the fleet has tracked for 22 windows, now on a fourth node type. The fake phpMyAdmin served its forms the whole time; nothing was captured.

AKAMAI-VHOST-SCAN — the decoy-fingerprinting census, back with two new operators

  • Who: 104.199.202.179 (Google LLC, Taiwan) at 20:28:35–48 stored; 139.162.184.146 (Akamai Connected Cloud, Germany) at 09:55:43–09:56:15. Both on lauterbourg-01-ts only.
  • What they did: the ~30-second census of admin surfaces (nmaplowercheck, /sdk, /cgi-mod/header_logo.cgi, applinks manifest, CFIDE, coldfusion). .179 used a fake Chrome/153 user agent — a version that does not exist yet, which dates the forgery — and sent 3 GraphQL introspection POSTs (/graphql, /api/graphql, /v1/graphql). .146 used a blank user agent and sent 1 POST /sdk. 0 mints, no captured bodies.
  • What it means: the same census under new cloud-provider addresses. The GraphQL probes are new for this class; the fleet answered 404-class.

LLM-ENDPOINT-PROBE — the AI-endpoint prober, its debut IP is back

  • Who: 104.168.115.214, on lauterbourg-01-ts only, honest user agent AutoGenX-Engine/9.1, from 06:57 stored on 11-01 to 06:11 stored on 11-02. One IP, one sensor.
  • What they did: 22 POST /api/chat calls (the digest's new llm-endpoint-ollama-chat tag; all answered 200; request bodies were not captured), /v1/models ×6, /api/tags ×5, /system_stats, /v2/health/ready, and a burst at 00:06:39 across generation endpoints: /v1/images/generations, /v1/videos, /v1/audio/speech, /v1/audio/transcriptions, /v1/audio/translations, /openai/v1/images/generations.
  • What it means: the client treats the fake AI endpoints as real and maps what they serve. The chat endpoint answers 200 with nothing behind it. More volume, a second IP, or a captured request body is the escalation to watch.

CREDSWEEP — the .env census, ninth window

  • Who: 45.138.12.16 (Tc Datacenter, Lithuania) on all 8 sensors — 919 events — plus a mint on ru-edge-1 at 12:49 stored under a fake Chrome/124 X11 user agent, its first mint since №68. 45.138.12.35 ran canary-farm-1 (387 events). 45.138.12.51's ai-devbox-1 mint at 04:24 belongs to №69's window (overlap). 194.180.49.41 (MEVSPACE) ran 9 events on 5 sensors.
  • What they did: the same per-sensor .env-variant walks from one /24.
  • What it means: ninth window, one new-window mint, still no observed use from this class.

CONFIGBUNDLE-SWARM — the config-bundle pools, quiet

  • Who: 194.5.53.x — about 30 IPs on 4 sensors, 3 mints (.186 on ru-edge-1 at 06:48 with python-requests/2.34.2, .177 on ru-edge-1 at 19:57 with a fake Safari/16, .190 on control-1 at 15:23 with Chrome/105). 163.5.241.x — 16 IPs on 4 sensors, 0 mints. 2–4 events per IP.
  • What they did: light config-bundle census passes.
  • What it means: the many-light-IPs-one-wordlist model at low intensity. Each mint is a drain candidate; AWS use is the check.

CONFIG-SWEEP — the same operator again

  • Who: 93.152.209.6 (Omniline Investment s.r.o., Bulgaria), on canary-farm-1.
  • What they did: a second window in a row — the kmonbase random-stem markers plus a 40-family config census in the kill-chain rows; /.env answered with a 400. Lighter than №69's 94-event pass.
  • What it means: the kmonbase template has held this operator for two windows now; a third would make it the template's standing holder.

Smaller actors worth naming

  • KEYDROP-SCANS: 172.237.7.18 minted on ru-edge-1 at 05:49 stored under the Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about); user agent — the fourth IP on record for this 2-event walk.
  • 69.197.186.50: 4 mints on 4 sensors between 11:38 and 14:10 stored, using a fake Chrome/39 macOS user agent (a 2014 build).
  • 37.19.197.153: 2 mints (ai-devbox-1 at 19:39, ru-edge-1 at 23:53 stored) using a fake Chrome/143 — a version that does not exist yet.
  • 150.241.66.127: 6 mints (ai-devbox-1 3, control-1 3) between 19:56 and 19:59 stored, bare truncated Windows user agent; 10 per 6-day history since 10-28.
  • One-mint collectors with old or forged user agents: 103.136.147.226 (UCBrowser on Android 4.4, ×2 on ru-edge-1), 185.231.102.30 (curl/7.88.1, ×2 on ru-edge-1), 109.107.229.169 (bare Mozilla/5.0), 121.121.152.6 and 168.110.205.237 (Chrome/81), 101.200.124.12 (iPhone 18.3 fake), 4.154.139.59 (blank user agent, present on 3 sensors), 136.144.42.3 (python-requests — the ADMINER-SWARM pool block), 195.177.94.77 (UCBrowser, control-1), 192.54.244.180 (Safari 17.4, control-1), 96.126.130.106 (bare truncated Windows).
  • Tarpit loopers: 89.248.172.33 (7 sensors, 375 events), 93.174.93.12 (6 sensors, 321), 91.92.40.12 (4 sensors, 35); 45.198.224.125 touched all 8 sensors (77 events — the TOKEN-CRAWLER /24).
  • frantech-ts FreeSWITCH probes: 212.28.186.169 and 189.206.12.25, 3 events each against /getstatus/reload_freeswitch/api status (a first-seen path for the node), bare Mozilla/5.0.
  • Benign/research: the Censys-class scanners 71.6.155.70 (8 sensors, 8 events) and 71.6.232.24 (3 sensors), plus 146.190.134.221 (8 sensors, 23 events), kept their shallow shapes. No benign-listed operator turned hostile.

Standing actors (who keeps coming back)

  • REGISTRY-HUNT DigitalOcean pool — in every window on record; minted in four consecutive windows.
  • 45.138.12.x (Tc Datacenter, Lithuania) — ninth window; .16 ran all 8 sensors and minted.
  • SI-CENSUS (102.220.163.241) — hoard at 104 per 6-day history, 35 new this window.
  • Techoff blocks (195.178.110.x, Bulgaria) — .159 ran 395 events on canary-farm-1 (blocklisted ipsum:1); .218 drove the honeypot's GPU-discovery commands.
  • 93.152.209.6 (Omniline, Bulgaria) — second window as the CONFIG-SWEEP/kmonbase holder.
  • The TechTies pile — 93.152.221.96 static at 1,080 mints per 6-day history; the injection side stayed idle.
  • 194.180.49.41 (MEVSPACE) — the usual light census arm across 5 sensors.

Network sweeps (Arkime) — SSH banner sweeps the web traps cannot see

Three known sweep tools hit the fleet's public IPs on port 22, identified by client fingerprint (the tool's identity — the source IPs rotate, the tool stays). No authentication was attempted in any of them.

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) rebound: 5,038 sessions from 627 source IPs across 272 networks in 73 countries (+205 IPs day-over-day). That is its second-widest day; its record is 673 IPs. Last 7 days by IP count: 10-27: 653, 10-28: 615, 10-29: 657, 10-30: 583, 10-31: 455, 11-01: 610, 11-02: 198. Top networks: Microsoft, UCloud HK, Korea Telecom, Oracle, OVH. Busiest sources: 103.151.60.214, 165.154.64.119, 43.132.150.89, 202.165.26.170, 180.93.172.213.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go) grew again: 2,874 sessions from 140 source IPs across 68 networks in 31 countries (101 → 140 IPs, the third rise in a row; its record is 192). Last 7 days: 10-27: 183, 10-28: 119, 10-29: 164, 10-30: 20, 10-31: 101, 11-01: 141, 11-02: 15. Top networks: Alibaba, Korea Telecom, IT Support Services Team, Contabo, Beijing Volcano Engine. Busiest sources: 175.196.78.7, 178.22.25.59, 8.130.97.165, 8.138.45.99, 8.138.210.122.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go) eased: 29,946 sessions (−3,702) from 74 source IPs across 28 networks in 20 countries, still the top fingerprint on 5 of 8 nodes. Last 7 days: 10-27: 53, 10-28: 48, 10-29: 58, 10-30: 83, 10-31: 79, 11-01: 73, 11-02: 46. Busiest sources again in 109.160.32.x (.179, .154, .108, .121) plus 77.239.124.150 — and 77.239.124.2 is the example source for the honeypot's uname commands below, so the sweep and the shell operators still share hosts.
  • CTL-MASS-SSH (4e066189c3bb…) held control-1 at 33,279 sessions — still the fleet's largest single-fingerprint load. GO-SCATTER-SWEEP (16443846184e…) moved +2,594 sessions to 12,913 at 29 IPs.
  • One new fingerprint appeared: 184781a96d49… (banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20), 38 sessions from 27 IPs across 23 networks in a one-hour burst 17:30–18:34 on 11-01. It is below the sweep thresholds and unnamed for now; a repeat would earn it a name.

Per-node inbound sessions: control-1 69,623 (304 IPs), sponge-01-ts 14,874 (275), ai-devbox-1 13,761 (302), lauterbourg-01-ts 12,425 (609), ru-edge-1 10,333 (349), canary-farm-1 9,593 (441), netcup-ts 5,135 (306), frantech-ts 3,577 (203).

Canaries (minted and used) — fake credentials: handed out, and tried in AWS

A canary is a fake credential. When a scanner fetches a bait file such as /.env, the fleet "mints" (hands out) a canary. If that canary later appears in AWS calls, the Tracebit alert log shows who used it. Two alerts fired this window: 2 use events across 2 credentials, both successful sts:GetCallerIdentity. The fleet minted 74 credentials to 26 collector IPs; 2 reached AWS; 72 were stolen with no observed use in the window.

Metric Count
Credentials minted (fleet, window) 74
Distinct collector IPs 26
Credentials used in AWS (alerts) 2
Credentials stolen, no observed AWS use in window 72

Per collector, this window (theft IP — sensor — mints — used in AWS — mint history):

  • 102.220.163.241 — ai-devbox-1, 33 mints; also 1 each on canary-farm-1 and control-1; 0 used; 104 mints since 2026-10-26 17:25 (the fleet's largest hoard).
  • 150.241.66.127 — ai-devbox-1, 3 mints and control-1, 3 mints; 0 used; 10 mints since 2026-10-28 10:00.
  • 103.136.147.226 — ru-edge-1, 2 mints; 0 used; 2 mints since 2026-11-01 08:46.
  • 139.59.143.102 — canary-farm-1, 2 mints; 0 used; 4 mints since 2026-10-28 20:59 (REGISTRY-HUNT).
  • 185.231.102.30 — ru-edge-1, 2 mints; 0 used; 2 mints since 2026-11-01 08:58.
  • 209.38.248.17 — ru-edge-1, 2 mints; 0 used; 3 mints since 2026-10-26 21:12 (REGISTRY-HUNT).
  • 69.197.186.50 — canary-farm-1, 2 mints; plus 1 each on ai-devbox-1 and ru-edge-1; 0 used; 4 mints since 2026-11-01 11:38.
  • 101.200.124.12 — ru-edge-1, 1 mint; 0 used; since 2026-11-01 14:31.
  • 109.107.229.169 — ai-devbox-1, 1 mint; 0 used; since 2026-11-01 18:39.
  • 121.121.152.6 — ru-edge-1, 1 mint; 0 used; since 2026-11-02 01:20.
  • 136.144.42.3 — ru-edge-1, 1 mint; 0 used; since 2026-11-02 02:25.
  • 137.23.38.53 — canary-farm-1, 1 mint; 2 used in AWS by 1 use IP, operations: GetCallerIdentity (SES-QUOTA-PROBE); 1 mint since 2026-11-01 12:28.
  • 143.110.213.72 — control-1, 1 mint; 0 used; since 2026-11-01 21:10 (REGISTRY-HUNT).
  • 168.110.205.237 — ru-edge-1, 1 mint; 0 used; since 2026-11-01 19:08.
  • 172.237.7.18 — ru-edge-1, 1 mint; 0 used; since 2026-11-02 05:49 (KEYDROP-SCANS).
  • 192.54.244.180 — control-1, 1 mint; 0 used; since 2026-11-02 01:46.
  • 194.5.53.177 — ru-edge-1, 1 mint; 0 used; since 2026-11-01 19:57 (CONFIGBUNDLE-SWARM).
  • 194.5.53.190 — control-1, 1 mint; 0 used; since 2026-11-01 15:23 (CONFIGBUNDLE-SWARM).
  • 195.177.94.77 — control-1, 1 mint; 0 used; since 2026-11-02 01:08.
  • 209.38.208.202 — ai-devbox-1, 1 mint; 0 used; since 2026-11-01 21:16 (REGISTRY-HUNT).
  • 209.97.180.8 — canary-farm-1, 1 mint and control-1, 1 mint; 0 used; 3 mints since 2026-10-31 20:55 (REGISTRY-HUNT).
  • 34.96.41.148 — ru-edge-1, 1 mint; 0 used; since 2026-11-01 12:58 (SWAGGER-SWEEP).
  • 37.19.197.153 — ai-devbox-1, 1 mint and ru-edge-1, 1 mint; 0 used; 2 mints since 2026-11-01 19:39.
  • 4.154.139.59 — canary-farm-1, 1 mint; 0 used; since 2026-11-02 00:21.
  • 45.138.12.16 — ru-edge-1, 1 mint; 0 used; 7 mints since 2026-10-28 03:14 (CREDSWEEP).
  • 68.183.180.73 — canary-farm-1, 1 mint; 0 used; since 2026-11-02 06:14 (REGISTRY-HUNT).

Persistent collectors with no observed AWS use (possible hoard, resale, or use we cannot trace — prior briefings name their campaigns):

This window was a use window, but a thin one: 2 use events, both GetCallerIdentity successes, all from SES-QUOTA-PROBE (137.23.38.53 — minted at 12:28 stored, validated right away, one call against a held canary). REGISTRY-HUNT's 9 l9scan mints, SI-CENSUS's 35, and SWAGGER-SWEEP's 5 all stayed unused — three pools the next windows must watch.

How the fleet behaved (Fleet Observations) — volumes, traps, and the discovery ramp

  • The window was quiet, and that is the attackers' doing, not a logging gap. Every canary sensor ran below its 7-day baseline: ai-devbox-1 −62%, canary-farm-1 −77%, lauterbourg-01-ts −78%, ru-edge-1 −76%, control-1 −13%, netcup-ts −43%, sponge-01-ts −30%. The heavy campaigns of the last two windows (the 199-IP XFF-SWARM, WIDE-CONFIG-CENSUS, METADATA-HUNT runners, the single-IP mega-censuses) all stayed home. frantech-ts held at −2% (15,053 events) for one reason: the MEGA-DICTIONARY replay, which put 14,254 events into the 01:00 UTC hour. Coverage is verified: every sensor's newest event in the database lands 11:02–12:26 stored on 11-02.
  • Canary economics. The digest counts 78 issued mints (ai-devbox-1 42 from 8 IPs — SI-CENSUS took 33 of them; ru-edge-1 17 from 14 IPs; canary-farm-1 10; control-1 9). Failures: 47 — 46×400 errors in slow singles (canary-farm-1 21, control-1 10, ru-edge-1 8, ai-devbox-1 6) plus 2 with no recorded error; no 401s, no key problems. canary-farm-1's 21×400 is its 3.1× tracebit-http-error spike — hostile /.env traffic (SI-CENSUS, 45.138.12.16, 93.152.209.6) hit the mint path faster than the upstream service's pacing allows. The digest says 78 and the Tracebit funnel says 74 because the two count the window slightly differently (as in earlier cycles). netcup-ts, sponge-01-ts, and frantech-ts mint 0 by design (no canary deployment); lauterbourg-01-ts ships with its canary key empty, so its absence is configuration, not failure.
  • Forged-headers check. 1,642 requests carried an X-Forwarded-For header; 0 had multi-entry chains; 6 were ignored; only 2 claimed a source different from the real connection — back to normal after №69's 593. Both came from 162.243.83.227 on ai-devbox-1 at 03:27 stored, claiming the header source 1.2.3.4. That IP is the benign-listed method-fingerprint scanner testing headers, not a new swarm.
  • control-1's discovery ramp (the deliberately fresh node). 51 days live (first event 2026-09-12 07:59 UTC). Its full day inside the window (11-01) ran 1,179 events / 104 unique IPs; the partial 11-02 day ran 2,098 / 155. The 7-day band: 1,179–5,138 events, 104–155 unique IPs. The network layer still aims the fleet's heaviest single-fingerprint SSH load at this node (CTL-MASS-SSH, 33,279 sessions).
  • Reading first-seen tables. Every first-seen row in this digest shares one sync timestamp (02:16:15 stored), so treat them as a list of new things, not a timeline.
  • Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is the fleet's only view of what operators do after they get a real-looking shell. One host, so never read it as a fleet number.

  • Funnel: 505 source IPs sent credentials → 378 got a shell (75%) → 319 ran a command (84% of the shell-getters, 63% of the sources). Event counts: 8,889 credential attempts → 4,487 accepted logins → 10,675 commands. Telnet (household-device botnets): 526 attempts.
  • New commands: zero (0 of 2,650 distinct) — a quiet window; operators re-ran known tooling only. New credential pairs: 0 of 3,052 offered.
  • Concentration: 345gs5662d34/345gs5662d34 585 attempts plus root/3245gs5662d34 443 (1,028 combined), then commodity pairs — root/123456 64, pi/raspberry 51, user/wasd 40.
  • Recurring commands held steady: the uname -s -v -n -r -m + uname -m | awk discovery loop (2,605 + 2,278 events; example source 77.239.124.2 — the same /24 as a GO-SSH-SWEEP source), the chattr -ia .ssh + SSH-key-plant pair (604 + 504 events), and the GPU-discovery strings (lspci | grep VGA, 276 events each from 4 IPs; example source 195.178.110.218, a Techoff BG address).

C2 download addresses and payloads (frantech-ts — one host)

The honeypot shells try to download malware from operator-run servers. This window: 0 new download addresses, 5 active. The full inventory holds 77 endpoints on 22 hosts (2,507 command references, 640 download attempts since 2026-09-18) and 22 captured payload artifacts (HTTP 2xx) from 7 hosts: 146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37.

Active this window:

  • http://45.90.163.37/wget.sh — 19 command events, 19 served, 19 source IPs, payload cf0b50b8b7a8 (1,476-byte script), seen 2026-10-31 11:22 → 2026-11-01 09:05.
  • http://45.90.163.37/curl.sh — 19 command events, 19 served, 19 source IPs, payload a8db671b58d0 (1,477-byte script), same window.
  • tftp://45.90.163.37 and ftp://45.90.163.37/ftpget.sh — 19 command events each, nothing served.
  • https://217.60.102.5/sh — 16 command events from 8 IPs, nothing served, seen 2026-10-28 06:54 → 2026-11-01 21:18.

Captured payloads (sha256, size, type, endpoint, first fetched):

  • 7b8cd695424f — 1487 B script — http://176.65.139.40/wget.sh — 2026-10-20 08:57
  • b965f772177c — 1488 B script — http://176.65.139.40/curl.sh — 2026-10-20 08:57
  • 62e3e86a7586 — 201396 B elf — http://152.42.195.115/main_arm7 — 2026-10-26 08:46
  • ec69d3e0d4d9 — 194400 B elf — http://152.42.195.115/main_mips — 2026-10-26 08:46
  • 1913ed2ad175 — 194400 B elf — http://152.42.195.115/main_mpsl — 2026-10-26 08:46
  • e27e963b2b49 — 157468 B elf — http://152.42.195.115/main_arm6 — 2026-10-26 08:46
  • ba9c9d9d361d — 1615 B script — http://176.65.139.157/telnet2.sh — 2026-10-12 16:52
  • cf0b50b8b7a8 — 1476 B script — http://45.90.163.37/wget.sh — 2026-10-31 11:22
  • a8db671b58d0 — 1477 B script — http://45.90.163.37/curl.sh — 2026-10-31 11:22
  • 2165fae6c486 — 6738 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 11:17
  • 2d6b9901a480 — 14042 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 12:21
  • 2a7af0bb942a — 14506 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 12:46
  • a8769ddc8139 — 16170 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 14:04
  • f8d4dafd6b96 — 16506 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 16:45
  • 8a8189c0c67b — 5150 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 17:37
  • c871a756510b — 5276 B script — http://146.190.102.83/t2r/t2r_compat.sh — 2026-10-26 19:22
  • 0cac28cc7f78 — 4404 B script — http://146.190.102.83/t2r/w1_compat.sh — 2026-10-27 00:18
  • e06be431a8d4 — 1498 B script — http://185.228.72.128/wget.sh — 2026-10-19 21:30
  • 72d835f767c8 — 1499 B script — http://185.228.72.128/curl.sh — 2026-10-19 21:30
  • 0583d9e18684 — 1987 B script — http://176.65.132.7:8889/lv.sh — 2026-10-24 10:16
  • b16e15764b8b — 19 B text — http://176.65.132.7:8889/lv.sh — 2026-10-24 10:16
  • 709009e02c8e — 10 B text — http://oper.atlas101.us.kg/dl.sh — 2026-10-15 04:36

What it means: no new download infrastructure. The jklarm staging host 45.90.163.37 keeps serving the same two fetcher scripts (each fetches 11 architecture variants of a Mirai-style self-replicating bot, then deletes itself; the bot binaries themselves are still not captured). https://217.60.102.5/sh keeps being requested and keeps serving nothing — the same /sh dropper-path pattern as the registered LIBREDTAIL dropper host 217.60.195.113, in the same /16. One caution: a server IP is not the actor — a staging host can also be the operator's login source (176.65.139.40 also authenticates 1,224 times on the telnet honeypot).

Open questions

  1. Will the three fresh stockpiles get used in AWS? SI-CENSUS holds 104 canaries per 6-day history (35 new), REGISTRY-HUNT added 9 in its fourth mint window, SWAGGER-SWEEP's 5 are hours old. Any Tracebit alert against them shows the operator's working hours. A write-shaped call (RunInstances class) is the escalation line.
  2. What will SES-QUOTA-PROBE do next? Its №57 shape was 72 denied ses:GetSendQuota calls; this window was 2 identity successes. Does it go back to quota probing with the fresh 12:28 mint? Does a second use IP appear? Any success beyond sts:GetCallerIdentity is a finding.
  3. Is there a third RECONX-L2S operator, and will the exploit body hit a canary node? The marker paths are cheap to search fleet-wide. The same body class won 41 mints for AI-EXEC-HUNT on №64 through the /@fs surfaces — we do not know whether this kit will try them.
  4. Is MEGA-DICTIONARY's grown list spreading, and does it have a schedule? The wordlist jumped from 13,776 to 14,197 paths under a repeat host. If another operator replays the longer list, the artifact circulates. If 103.125.233.17 runs it again, there is a schedule. We do not know which yet.
  5. How far will the SSH sweeps grow? GO-SPRAY-SWEEP is at 140 source IPs, 60 short of the 200-IP mass threshold — a crossing would make it the fleet's widest SSH sweep on record. LIBSSH-MASSSWEEP rebounded to 627; whether it passes its own 673 record is open.