Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №71 — PLAIN LANGUAGE

Period: 2026-11-02 07:32 – 2026-11-03 07:32 UTC (24h, day 69 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-11-03.md

What happened (plain)

Someone stole a canary credential from the ai-devbox-1 trap and then tried to do more with it than any thief before: at 10:58 stored time on 11-02, the IP 85.121.176.200 picked up a fresh canary and then tried to list cloud resources in three services — EC2, IAM, and S3. All six of those inventory calls were denied. Only one call succeeded, and it was the harmless kind that shows the account's own name. The fake dropper-file dictionary got bigger again and moved to a third host: 146.70.224.67 replayed 14,864 unique web paths against frantech-ts in about 2.5 minutes. Most sensors got quieter (ru-edge-1 down 85%, lauterbourg-01-ts down 68%, canary-farm-1 down 66%), but control-1 jumped 78% because one busy scanner (SI-CENSUS) worked four sensors at once. Two new attack patterns showed up this window, and the network layer flagged a brand-new SSH sweep fingerprint.

What it means (plain)

  1. Thieves are asking what a stolen key can do, not only who it belongs to. The 85.121.176.200 session made 7 AWS calls: 1 successful sts:GetCallerIdentity (shows account identity) and 6 denied reads aimed at EC2, IAM, and S3 (DescribeInstances ×2, GetUser ×2, ListBuckets ×2). This is the first time in 69 days of collection that a stolen canary was used to map cloud resources. (High confidence on what happened — the Tracebit alert log records each call and its result; Moderate on what it means — it is one session from one IP, and nothing left AWS except the account's own name.)
  2. The dropper-URL wordlist is a product someone keeps updating and sharing. Three different hosts have now replayed it, each under a different pretend device name, and the list grew in two windows in a row: 13,776 → 14,197 → 14,864 paths. (High confidence on the counts and the hosts — direct queries; Moderate on whether it is one group or several — hosts and labels change, and no file-level comparison was run this window.)
  3. One scanner is quietly collecting a large pile of keys that nobody has used. SI-CENSUS minted 16 of the window's 72 issued credentials and holds 114 over its 6-day history. Yet all 13 use events in this window came from 2 use IPs, and both worked fresh or nearly fresh keys, not the big pile. (High confidence on the counts; Moderate on the hoard reading — earlier windows showed thieves can wait a day or more before using a key.)
  4. Every fake surface did its job. The 12-second, 125-family AI-config scanner got error and tarpit answers and minted nothing. The phpMyAdmin hammer met its third repeat operator and kept serving fake forms. 1,987 WordPress system.multicall bodies hit the decoy endpoints. The paired .env walks produced about 1,700 tarpit-class results. (High confidence — these are direct counts from the digest.)

Campaigns (who / what / what it means)

CREDENTIAL-DRAIN — thieves picking up canary keys and testing them in AWS

  • Who: 34 collector IPs took 63 credentials this window. The digest's own count is 72 issued (canary-farm-1 27, ai-devbox-1 22, control-1 17, ru-edge-1 6). Two IPs actually used keys in AWS: 85.121.176.200 (new) and 137.23.38.53 (SES-QUOTA-PROBE).
  • What they did: the mint side is unchanged — scanners ask for /.env-type files and the traps hand over working canary keys. The use side moved: 13 use events across 4 credentials, 7 successful sts:GetCallerIdentity calls plus 6 denied inventory reads. 85.121.176.200 minted its key on ai-devbox-1 at 10:58 stored on 11-02 and then ran the 7-call session. Separately, the mint path rejected 16 requests (canary-farm-1 8×400, ai-devbox-1 3×400 plus 2 without detail, control-1 2×400, ru-edge-1 1×400). No 401s, no key errors.
  • What it means: every issued key works within hours of being stolen, and this window shows thieves probing what the key's role allows. If a thief ever gets a "success" beyond sts:GetCallerIdentity, or runs a write-type call like RunInstances, that is the escalation alarm.

SES-QUOTA-PROBE — the same thief, checking identity four windows in a row

  • Who: 137.23.38.53. It minted on ai-devbox-1 and control-1 this window (1 each; 3 credentials since 11-01 12:28) and used one use IP. It also showed up lightly on netcup-ts, sponge-01-ts, lauterbourg-01-ts, and canary-farm-1 (147 events across sensors).
  • What they did: 6 successful sts:GetCallerIdentity calls across its 3 held credentials. No quota calls this time.
  • What it means: four windows of identity checks with no follow-up. In window №57 this actor ran 72 denied ses:GetSendQuota calls, so a return to quota probing is the expected next step, and any success beyond identity would be a finding.

MEGA-DICTIONARY — a huge pretend-file list, replayed by a third host

  • Who: 146.70.224.67 (M247 Europe SRL, HK), hitting frantech-ts only, 01:58–02:01 stored. Last window's host, 103.125.233.17, did not return.
  • What they did: 14,874 GETs against 14,864 unique paths in about 2.5 minutes (about 97 paths per second; №70's pass was about 100), pretending to be a Synology RT2600ac Router — a third device label after Seagate Personal Cloud. The list grew from 14,197 to 14,864 paths (+667), the second growth pass in a row. Results: 14,868 not-handled answers plus the same 5 single decoy-tag hits earlier replays carried (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth, llm-endpoint-models-list). 0 mints. This one replay explains frantech-ts's +1% hold (7,978 + 6,956 events in the 01:00–03:00 UTC burst buckets) and produced the window's new dropper paths (/APO_2.exe, /CHAPO/CHAPO2.exe, /FAST/ttessttt.ps1, and the rest).
  • What it means: this list is shared infrastructure that at least three hosting providers have carried. Every replay makes it bigger. If a fourth host shows up with the grown list, that proves real circulation rather than one operator re-hosting its own copy.

XMLRPC-BRUTE — daily WordPress brute-force batches, doubled

  • Who: 45.94.31.16 (1337 Services GmbH, NL), ai-devbox-1 only. In the window: 2,014 events / 2,000 POSTs between 07:36 and 22:49 stored. The IP has run 3,000 /xmlrpc.php events since 11-01.
  • What they did: 1,987 of the POSTs carry system.multicall bodies (they start <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…), under the same forged Chrome/78.0.3904.108 label, plus the usual wlwmanifest and wp-user-enum side trips. The registered 1,000-POST batch shape, doubled.
  • What it means: a patient operator running the same fixed batch every day against the WordPress decoys. No captured credential success; the volume doubling is the only change.

SI-CENSUS — one scanner, four sensors, a growing key pile

  • Who: 102.220.163.241 (VPS Dedicated LLC, SI), working alone. 5,661 events across ai-devbox-1 (1,435), control-1 (2,687), canary-farm-1 (1,023), and ru-edge-1 (516). This is its ninth-plus window.
  • What they did: the same per-sensor .env fan-out walks, minting 16 credentials (ai-devbox-1 7, control-1 6, canary-farm-1 2, ru-edge-1 1) under forged Chrome/126. It caused control-1's +78% day and most of its spike bundle (phpinfo 162, tarpit 234, iis-web-config 21, the env-production fan-out), plus 125 of ai-devbox-1's 141 phpinfo events.
  • What it means: the largest key pile we track — 114 credentials over its 6-day history, none observed in AWS. If a Tracebit alert ever names this IP, that is the moment the pile moves.

ENV-FANOUT — a new paired .env scanner on lauterbourg-01-ts (NEW this window)

  • Who: 162.216.241.239 (Dynu Systems, US) ran it 12:43–13:08 stored on 11-02; 198.145.226.37 (M247 Europe SRL, US) ran it again 02:15–02:40 stored on 11-03. Same template, about 13 hours apart.
  • What they did: both used the same forged Chrome/143.0.0.0 label (143 does not exist yet, which dates the forgery) and the same 85-path list of <folder>/.env guesses (/wp-content/.env, /redmine/.env, /.env.testing, /protected/.env, /vendor/laravel/.env, and 79 more), repeating each path about 10 times — 327–330 events per pass on lauterbourg-01-ts. They also ran short tarpit loops on ai-devbox-1 (18) and canary-farm-1 (12). 0 mints, 0 POSTs. The pair caused 89 of the node's 113 tarpit events (an 11.3× spike).
  • What it means: one template, two rented hosts, running on a schedule. The tarpit caught every request. A third IP, any mint, or this Chrome/143 forgery reaching a canary node would turn this into a standing watch item.

AI-CLI-VAULT — a 12-second scan of 125 AI-config file locations

  • Who: 45.138.12.10 (Tc Datacenter Limited, LT) — the same /24 as the standing CREDSWEEP operators (.16, .35, .51). Mostly canary-farm-1, plus 13 events on ai-devbox-1 since 10-22.
  • What they did: one burst of 2,417 events against 1,438 paths covering 125 trap families in 12 seconds (11:47:18–30 stored) — the highest family count for a single run we have recorded. The list targets AI and LLM config files: /openai-proxy.yaml, /api/bedrock, /api/bedrock-runtime, /litellm_config.yaml, /gpt/config.json, /config/ai.json, /bedrock/config.yml, /config/llm.yaml, /ai/credentials. Forged Chrome/124. 0 mints.
  • What it means: the AI-credential census is back with a bigger list and a faster runner, from a network that already steals keys elsewhere. A mint or a second pass is the signal to promote it. The fleet's fake surfaces and error tags absorbed the whole pass.

GIT-HARVEST — a labeled git-file walker, back on schedule

  • Who: 35.232.76.162 (Google LLC, US), on 7 sensors, 200 events / 44 paths, from 11-02 03:08 to 11-03 05:17 raw digits.
  • What they did: the same honest label Mozilla/5.0 (compatible; harvest/1.0) and the same short walks into the fake git surfaces. 0 mints, 0 POSTs.
  • What it means: same IP, same label, same shape two windows running — this looks scheduled, not one-off. The fake git surfaces answered everything; a mint or a second IP promotes it.

GOWEB-PENTEST — the phpMyAdmin hammer, fourth operator IP

  • Who: 57.128.201.75 (OVH), on lauterbourg-01-ts. Third repeat IP after 103.242.78.199 and 172.104.173.62.
  • What they did: the registered 151-event phpmyadmin-login run on one path under the honest Go Web Pentest Tool label — 151 of the node's 158 phpmyadmin events (a 3.2× spike).
  • What it means: the same unit, another rented IP. The fake phpMyAdmin served forms the whole time; nothing was captured.

CONFIGBUNDLE-SWARM — the light config-pool swarm keeps minting

  • Who: the 185.92.25.x pool ran 2–4 events per IP across control-1, canary-farm-1, and lauterbourg-01-ts.
  • What they did: .52 minted on control-1 (09:27 stored) and .57 on canary-farm-1 (09:59 stored), 1 each.
  • What it means: the pool from №69 is still active. Each mint joins the standing pile of stolen keys; the check is whether any get used in AWS.

Light watchers (who else touched the traps)

  • The REGISTRY-HUNT DigitalOcean walker pool ran the same 27-family walk fleet-wide (164.90.208.56, 157.230.19.140, 142.93.0.66, 206.81.24.227, 209.97.180.8, 64.225.75.246, 206.189.233.36, plus 174.138.22.143's symfony/composer variant) and picked up about 8 single mints. The l9scan mint arm stayed idle.
  • 46.148.227.131 calls itself VantageResearchScanner/1.0 (+/scanner; non-intrusive) — 222 events / 28 paths on canary-farm-1 and lauterbourg-01-ts. The label says research, but it minted 7 canaries on canary-farm-1 (the window's largest single-IP mint count) and drew 14 actuator-env results. A companion label, Mozilla/5.0 (compatible; SecurityResearch/1.0; ), was seen for the first time on canary-farm-1.
  • Tarpit loopers — 89.248.172.33 (7 sensors, 321 events), 93.174.93.12 (6 sensors, 363), 45.198.224.125 (all 8 sensors, 80; the TOKEN-CRAWLER /24).
  • The 45.153.34.x pool — .249 used a forged Firefox/125 label across 6 sensors (174 events / 40 paths, 1 mint on ai-devbox-1); .178 minted on ai-devbox-1 and control-1 (2 each).
  • Single-mint collectors — 108.181.98.163 (Psychz US; 3 mints on canary-farm-1 plus 15 POSTs), 173.35.95.189 (2 on ai-devbox-1), the 212.30.33.x trio (.13 on ru-edge-1, .37 and .38 on canary-farm-1, minting within minutes of each other), 85.11.167.204 (control-1), 217.60.76.38 (canary-farm-1) and 217.60.76.167 (ru-edge-1) — that whole /16 is the LIBREDTAIL staging block and keeps touching the mint path — plus 34.81.140.39 (Google SG), 139.59.136.184 and 46.101.1.225 (DigitalOcean).
  • Benign and research traffic held its normal shapes: Censys-class 71.6.155.70 and 71.6.232.24 (8 sensors each), 91.224.92.45 (8 sensors, 8 events), and 94.183.174.99 (8 sensors, 29 events). No listed benign operator turned hostile.

Standing actors (who keeps coming back)

  • SI-CENSUS (102.220.163.241) — in every recent window; pile now 114 per 6-day history with 16 new this window; volume up (about 5,661 events across 4 sensors vs 2,931 across 3 last window).
  • 45.138.12.x (Tc Datacenter LT) — tenth-plus window; the usual three IPs were quiet while .10 debuted the AI-config arm.
  • The REGISTRY-HUNT DigitalOcean pool — present every window on record; walkers minted about 8 singles, the l9scan arm idle.
  • 137.23.38.53 (SES-QUOTA-PROBE) — fourth straight use window, identity checks only each time.
  • 194.180.49.41 (MEVSPACE) — 1,136 events and 4 mints on control-1, plus light touches on 2 more sensors.
  • Techoff (195.178.110.x, BG) — .159 ran 385 events on canary-farm-1 (blocklist hit ipsum:1); .68 touched 3 sensors (93 events).
  • 45.94.31.16 (1337 Services) — second straight xmlrpc window, volume doubled.
  • 35.232.76.162 (GIT-HARVEST) — second straight window, same shape.

Network sweeps (Arkime) — raw SSH banner sweeps, visible only here

These sweeps ask for an SSH connection and never request a web page, so the web traps cannot see them. The window carried 127,293 inbound SSH sessions across the fleet's 8 public IPs.

  • OPSSH-UBUNTU-SWEEP — new this window. Fingerprint 184781a96d49ee509a431028a8d5022a, banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20. First seen 11-02 09:40. On day one it hit 2,643 sessions from 185 source IPs across 97 networks in 39 countries; on 11-03 it dropped to 6 IPs. Top networks: PJSC MegaFon, JSC Kazakhtelecom, Shenzhen Tencent, Contabo GmbH, National Internet Backbone. Busiest sources: 80.68.76.181, 88.204.245.66, 117.247.81.45, 115.190.174.152, 122.51.204.140. No authentication attempted.
  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6) shrank to 2,644 sessions from 364 IPs across 186 networks in 59 countries — down 263 IPs from last window's 627, well short of its 673-IP record. Its day-by-day IP counts: 10-28: 615, 10-29: 657, 10-30: 583, 10-31: 455, 11-01: 610, 11-02: 496, 11-03: 32.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go) concentrated: 37,208 sessions (+7,262) from 52 IPs (−22) on 13 networks — fewer sources, more sessions each. It is still the largest sweep after control-1's own.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc) collapsed to 15 IPs (−125 from 140) and 1,560 sessions.
  • GO-SCATTER-SWEEP (16443846184eafde36765c9bab2f4397) held steady: 12,779 sessions from 27 IPs.
  • CTL-MASS-SSH (4e066189c3bbeec38c99b1855113733a) held control-1 at 33,329 sessions (+50) — still the fleet's biggest single-fingerprint load, and control-1 still takes the most inbound sessions overall (61,697).
  • LIBSSH-011-SWEEP (03a80b21afa810682a776a7d42e5e6fb) ran 168 sessions from 28 IPs. Three smaller standing fingerprints carried 32 sessions each from 42/32/24 IPs. One new below-threshold fingerprint appeared: 1bcedb0742d00117d5655f8a9729f9c7 (banner ssh-2.0-go, 29 sessions, 1 source).

The fleet tracks these by client fingerprint, never by source IP, because the addresses rotate while the tool stays the same.

Canaries (minted and used) — fake AWS keys: who took them, who used them

The traps handed out 63 credentials to 34 collector IPs this window (the digest's own count is 72 issued; the small difference is window bookkeeping, the same every cycle). 4 credentials were used in AWS, producing 13 use events: 7 successes (all sts:GetCallerIdentity, which shows only the account's own identity) and 6 denied calls (DescribeInstances ×2, GetUser ×2, ListBuckets ×2). 59 credentials were stolen with no observed AWS use. This was a use window — the fourth in a row.

Who took keys, and how many (IP — sensor — mints this window — use in AWS — total mints over the last 6 days):

  • 46.148.227.131 — canary-farm-1 — 7 — none — 7 since 11-02 23:09
  • 102.220.163.241 (SI-CENSUS) — ai-devbox-1 — 6 — none — 114 since 10-27 07:11
  • 102.220.163.241 — control-1 — 5 — none — same 114 pile
  • 194.180.49.41 (MEVSPACE) — control-1 — 4 — none — 6 since 10-27 23:22
  • 108.181.98.163 — canary-farm-1 — 3 — none — 3 since 11-02 08:39
  • 173.35.95.189 — ai-devbox-1 — 2 — none — 2 since 11-02 17:49
  • 213.209.159.175 — canary-farm-1 — 2 — none — 2 since 11-03 03:03
  • 68.183.180.73 — canary-farm-1 — 2 — none — 3 since 11-02 06:14
  • 102.220.163.241 — canary-farm-1 — 1 — none — same 114 pile
  • 102.220.163.241 — ru-edge-1 — 1 — none — same 114 pile
  • 137.23.38.53 (SES-QUOTA-PROBE) — ai-devbox-1 — 1 — 3 credentials used, 1 use IP, GetCallerIdentity — 3 since 11-01 12:28
  • 137.23.38.53 — control-1 — 1 — the same 3 used credentials — same history
  • 139.59.136.184 — control-1 — 1 — none — 1 since 11-02 21:07
  • 142.93.0.66 — canary-farm-1 — 1 — none — 2 since 10-29 18:33
  • 142.93.129.190 — canary-farm-1 — 1 — none — 2 since 10-30 21:21
  • 157.230.19.140 — canary-farm-1 — 1 — none — 2 since 10-29 04:44
  • 157.245.36.108 — ai-devbox-1 — 1 — none — 3 since 11-02 06:14
  • 157.245.36.108 — canary-farm-1 — 1 — none — same history
  • 164.90.208.56 — ru-edge-1 — 1 — none — 1 since 11-02 21:30
  • 172.233.16.50 — ai-devbox-1 — 1 — none — 1 since 11-03 02:55
  • 172.237.7.18 — control-1 — 1 — none — 2 since 11-02 05:49
  • 174.138.22.143 — canary-farm-1 — 1 — none — 1 since 11-02 10:22
  • 185.92.25.52 — control-1 — 1 — none — 1 since 11-02 09:27
  • 185.92.25.57 — canary-farm-1 — 1 — none — 1 since 11-02 09:59
  • 202.65.236.32 — ru-edge-1 — 1 — none — 1 since 11-02 15:20
  • 206.189.233.36 — control-1 — 1 — none — 1 since 11-02 21:30
  • 206.81.24.227 — ai-devbox-1 — 1 — none — 3 since 10-28 21:09
  • 209.97.180.8 — ai-devbox-1 — 1 — none — 4 since 10-31 20:55
  • 212.30.33.13 — ru-edge-1 — 1 — none — 1 since 11-03 03:19
  • 212.30.33.37 — canary-farm-1 — 1 — none — 1 since 11-03 03:19
  • 212.30.33.38 — canary-farm-1 — 1 — none — 1 since 11-03 03:31
  • 217.60.76.167 — ru-edge-1 — 1 — none — 1 since 11-03 05:48
  • 217.60.76.38 — canary-farm-1 — 1 — none — 2 since 10-30 19:20
  • 34.81.140.39 — canary-farm-1 — 1 — none — 1 since 11-02 16:23
  • 45.153.34.178 — ai-devbox-1 — 1 — none — 2 since 11-03 04:32
  • 45.153.34.178 — control-1 — 1 — none — same history
  • 45.153.34.249 — ai-devbox-1 — 1 — none — 1 since 11-02 09:58
  • 46.101.1.225 — ai-devbox-1 — 1 — none — 1 since 11-02 22:18
  • 85.11.167.204 — control-1 — 1 — none — 1 since 11-02 13:51
  • 85.121.176.200 — ai-devbox-1 — 1 — 1 credential used, 1 use IP: DescribeInstances, GetCallerIdentity, GetUser, ListBuckets — 1 since 11-02 10:58

Collectors holding larger piles with no AWS use so far include 93.152.221.96 (573 mints, 10-27 04:58 → 10-27 21:29), SI-CENSUS's 114 pile, 34.95.21.228 (41 mints on 10-28), 45.148.10.120 (12 mints, 10-28 → 10-31), 150.241.66.127 (10 mints since 10-28), 176.123.5.6 and 23.132.164.201 (9 mints each), and 45.138.12.16 (7 mints since 10-28).

How the fleet behaved — volume, keys, and posture

  • Volume moved between sensors, and we know why. The canary sensors ran far below their 7-day averages (ru-edge-1 −85%, lauterbourg-01-ts −68%, canary-farm-1 −66%, netcup-ts −59%, sponge-01-ts −43%, ai-devbox-1 −2%) because last window's heavy hitters — the XFF-SWARM, the wide config census, the metadata runners, SWAGGER-SWEEP — all stayed home. control-1 rose +78% on SI-CENSUS (2,687 events) plus 194.180.49.41 (1,136) plus the walker pool. frantech-ts held +1% on one cause: the 14,864-path replay. Log delivery is verified — every sensor's newest event in the database lands between 10:53 and 12:32 UTC on 11-03, so the drops are real, not missing data. Events between two digest runs show up in both digests, as always.
  • Canary economics. 72 mints issued (canary-farm-1 27, ai-devbox-1 22, control-1 17, ru-edge-1 6) with 16 failures — all 400 upstream rejections except 2 without captured detail; no 401s, no key problems. The Tracebit-side funnel counts 63 credentials to 34 collectors with 4 used in AWS.
  • Attribution and TLS posture. 3,763 requests carried an X-Forwarded-For header; forged single-entry headers numbered 0, the third quiet window in a row after №69's 593. HTTP still leads TLS everywhere, though canary-farm-1's HTTPS (2,849) almost matched its HTTP (2,942). The top hostnames attackers asked for: sso.rightabouteverything.show (3,449), inference.fapthropic.com (2,860), cloud.wafflehouseindex.us (795) — and the retired kiteworks.rightabouteverything.show still drew 706 hits, because old wordlists have not caught up with the rebuild.
  • control-1's discovery ramp. The deliberately fresh node is 51 days old (first event 2026-09-12 07:59 UTC). Its full day ran 4,625 events / 145 unique IPs — inside the 7-day band (1,179–5,138 events, 104–155 IPs). The heaviest SSH fingerprint still points at this node.
  • A note on the new-path list. Every "first seen" row in the digest shares one sync timestamp (02:15:35 stored), so it is an inventory, not a timeline. The new .exe/.ps1 paths belong to the MEGA-DICTIONARY replay — that link comes from tracing the IP, not from the table.
  • No fleet-side changes were made this cycle.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is one machine running fake SSH and telnet services. Never read its numbers as fleet-wide.

  • The funnel: 505 source IPs sent passwords → 387 got a shell (77%) → 326 ran at least one command (84% of the ones who got a shell). In raw events: 13,835 password attempts → 5,711 accepted logins → 14,542 commands. Telnet botnets tried 455 times.
  • New commands: zero. None of the 5,461 distinct commands was new this window — a second quiet window; operators replayed known tools. New password pairs: zero of 4,778 offered. The same one family dominates: 345gs5662d34/345gs5662d34 tried 599 times and root/3245gs5662d34 457 times (1,056 together), then commodity pairs (root/123456 80, pi/raspberry 77, user/wasd 71).
  • The recurring background: the uname hardware-discovery loop ran 3,686 + 3,682 times from 6 and 5 IPs (example source 109.160.32.47 — the same /24 as GO-SSH-SWEEP's busiest sweepers), the chattr -ia .ssh plus SSH-key-plant pair ran 622 + 518 times from 286 and 244 sources (example source 106.243.155.71), and the GPU-discovery strings ran 71 times each from 2 IPs (example source 2.57.122.238).

Download addresses and malware files on that same host (still one host, not a fleet number): no new download addresses appeared this window — a second quiet window in a row. Of the 77 tracked addresses, only 2 were active: http://160.119.66.206/bins/kla.sh (live since 2026-09-18, 522 command attempts this window from 1 source, still serves nothing) and https://217.60.102.5/sh (18 attempts from 9 IPs, serves nothing; that /16 is the LIBREDTAIL staging block). The malware file collection holds at 22 captured files from 7 hosts, unchanged — including the four main_* ELF binaries from 152.42.195.115 (62e3e86a7586 201,396 bytes for arm7, ec69d3e0d4d9 194,400 for mips, 1913ed2ad175 194,400 for mpsl, e27e963b2b49 157,468 for arm6) and the seven different t2r_compat.sh script versions from 146.190.102.83. One caution we repeat every cycle: a hosting IP is not the thief — 176.65.139.40 has authenticated 1,224 times as a login source too, so files are matched by their sha256 content, never by the address.

Open questions

  1. Will 85.121.176.200 come back, and will it get further? All six of its inventory calls were denied. Watch for a retry, a second use IP, or any success beyond sts:GetCallerIdentity. A write-type call like RunInstances would be the escalation alarm.
  2. Is the dropper-URL list really circulating? It grew by 667 paths under a third host. A fourth host carrying the grown list would prove circulation; a repeat by 146.70.224.67 would show a schedule. No file-level comparison was possible this window (frantech-ts keeps shallow history in the query view).
  3. Will ENV-FANOUT grow? The pair ran identical templates about 13 hours apart. We do not yet know if a third IP, a mint, or the forged Chrome/143 label reaching a canary node follows.
  4. What is 46.148.227.131 really? It calls itself a non-intrusive research scanner but minted 7 canary keys. If a Tracebit alert ever names it, its honest label becomes an identification anchor. Its future AWS side is the open question.
  5. Was OPSSH-UBUNTU-SWEEP a one-day burst? 185 IPs on day one, 6 on day two. If it returns to wide scale, it joins the standing sweep set; if not, it stays a one-off.
  6. When does SI-CENSUS's 114-key pile move? Sixteen new canaries this window, zero AWS use ever observed. Any alert against 102.220.163.241 would tell us the operator's working hours.

Plain language version of: flux-fleet-intel-briefing-2026-11-03.md