Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №73 — PLAIN LANGUAGE

Period: 2026-11-04 07:34 – 2026-11-05 07:34 UTC (24h, day 71 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-11-05.md

What happened (plain)

A scanner that replays malware download links (MEGA-DICTIONARY) came from a fourth different hosting company and set a new record. The address 23.234.119.146 (tzulo, inc., US) asked our control-1 decoy server for 14,922 different malware download addresses in about 2 minutes. That single run is why control-1 saw 788% more traffic than its weekly average. The attack list also grew: it now carries 14,922 paths, 58 more than last window, including new malware families named nyx_bot, krmine, and several disguised PowerShell scripts.

The fake-WordPress password guessing turned into a fleet-wide event. 244 different addresses together sent 2,070 password guesses to /wp-login.php on all 8 of our sensors, plus about 2,100 dry-run probes. The password list has changed too: instead of simple pairs like admin=admin, the guesses now combine a role with the current year, such as Admin2026@ and Webmaster2026@. Our fake WordPress answered every guess, so the attackers learned nothing.

For the first time in three windows, nobody used a stolen canary credential in AWS. Our sensors handed out 59 new canary credentials (a canary is a fake but working-looking AWS key that rings an alarm if anyone tries it); the Tracebit alert side counted 50 of them reaching 22 attacker addresses, and not one was used. Mint errors dropped to zero as well.

Two scanners deserve a mention. PATHSCAN-CENSUS came back from a second operator of the same Moldovan hosting company (Alexhost) and collected 9 canary credentials on canary-farm-1 — the largest single-address take this window. And the old WordPress-flood operator 45.94.31.16 returned to ai-devbox-1 and re-ran its registered 1,000-request batch.

What it means (plain)

  1. The WordPress password guessing is now a standing, fleet-wide operation, not a one-off. 244 addresses hit all 8 sensors in one window (canary-farm-1 130 addresses/407 guesses, lauterbourg-01-ts 34/290, netcup-ts 38/283, ai-devbox-1 41/282, frantech-ts 31/269, ru-edge-1 26/191, sponge-01-ts 29/180, control-1 27/168), and five new attack signatures appeared for the first time on 11-05. (High confidence on what happened — we counted the requests and read the message bodies directly. Moderate confidence that it stays this big — it is one window, and the previous record was briefing №68's 201 addresses that tried one guess each on a single node.)
  2. Credential collecting moved to small dedicated addresses while the big stockpiles rest. No AWS use at all this window. SI-CENSUS, the largest stockpiler (52 credentials over 6 days), collected nothing for a second window. The collectors that did take credentials are small loops that request one path over and over (85.11.167.204, 23.132.164.201, 202.65.239.148), a trio of new addresses sharing a fake Chrome/81 label, the REGISTRY-HUNT walker pool (14 credentials), and PATHSCAN's 9. (High confidence on the counts — the Tracebit alerts joined against our request logs. Moderate confidence on the reading — one window, and past briefings show attackers can wait a day or more before using a credential.)
  3. MEGA-DICTIONARY is a product that moves between hosting companies, and its shopping list is growing with live malware. The list grew from 14,864 to 14,922 paths on the fourth hosting provider, and the new paths are real dropper names (Go-built nyx_bot programs, krmine miner builds, uploaded .exe files, disguised PowerShell scripts), not filler. (High confidence — a request-by-request check ties every new path to the 23.234.119.146 replay.)
  4. The OPSSH-UBUNTU-SWEEP banner question is answered in favor of "fake or shared tools". One fingerprint now shows three different self-descriptions (ssh-2.0-russh_0.45.0, ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, ssh-2.0-openssh_10.0p2 debian-7). One connection style, three names: that is spoofing or a shared tool pool, not a tool upgrade. (Moderate confidence — the banner list comes from the recon tool's data; judging intent is inference.)

Campaigns (who / what / what it means)

WP-LOGIN-BRUTE — password guessing against the fake WordPress, now fleet-wide

  • Who: 244 addresses, 1–20 guesses each, spread over many hosting and home-internet providers (sample: 104.248.242.98 DigitalOcean, 51.195.6.20 OVH, 43.153.2.142 Tencent, 13.140.185.41 Microsoft Azure, 194.163.191.215, 169.62.7.24, 216.109.180.243, 103.118.17.13, 189.74.97.150). Addresses rotate; the attack pattern stays.
  • What they did: each address probed /wp-login.php, then posted password guesses, under fake modern browser labels (Firefox/133, Chrome/130–131, Safari 18.1, Edge/131, mobile Chrome/155). Each guess carried a fresh _wpnonce value, so the tool reads the login page first. The most-tried passwords: Admin123@ 20 tries from 9 addresses, admin2025@ 14/11, Admin123! 14/7, admin!2025 13/7, Admin2026@ 13/11, admin123! 12/9, Admin2026 11/10, Webmaster2026@ 10/10, and the date-shaped 1302026. The usernames tried were admin and webmaster. Result-tag spikes hit fleet-wide (wp-login-probe at infinite ratio on five sensors, wp-login-credentials 3.5–10.3× on six).
  • What it means: briefing №68's simple one-guess-per-address pass became a distributed guessing attack with a current-year password list. Our fake WordPress answered everything and gave up nothing — 0 credentials taken, no captured success. On lauterbourg-01-ts, part of this traffic is recorded under the internal gateway address (see "How the fleet behaved"), so that node's 34-address count is an under-count.

WP-XRPC-WALK — username harvesting at full width

  • Who: 18 addresses, 7 sensors, signature eee552d8955a (first seen 09-22).
  • What they did: 4,950 events this window: probe /wp-login.php, then pull user lists from /wp-json/wp/v2/users, then the /wp-sitemap-users-1.xml sitemap. The wp-user-enum-rest-single tag spiked at infinite ratio on five sensors.
  • What it means: this tool collects usernames first, and WP-LOGIN-BRUTE then guesses passwords for roles like admin and webmaster. The two attacks fit together. Our fake user lists are decoys.

MEGA-DICTIONARY — the malware-link dictionary, fourth host, record list

  • Who: 23.234.119.146 (tzulo, inc., US) — the sibling of №37's control-1 host 23.234.118.146. Fourth hosting company on this artifact (tzulo, xTom, M247, Datacamp).
  • What they did: 14,932 requests for 14,922 different paths in about 2 minutes (20:14–20:16 stored, about 124 paths per second) under 208 rotating fake router labels (TP-LINK, MikroTik RouterOS, D-Link, Synology, Wavlink, ZTE GPON, Huawei, Ubiquiti and more). Every request got a 404 from our decoy (that is control-1's 37.4× spike on the not-handled tag). 0 credentials taken, 0 POSTs. The shared list grew 14,864 → 14,922 (+58, the fourth growth on record). New paths this window: /nyx_bot_linux_amd64, /nyx_bot_linux_arm64_exec, /nyx_bot_linux_arm64_hkdf, /krmine, /krmine-mips, /krmine-mipsel, /iranbot-ultimate.sh4, /llx.mips, /mrraider-armv7, /rock.exe, /two.exe, /uploads/141935c46a5c4ff1b84b433e84f36e61.exe, /uploads/d0d605c01f71464ea16b25c92892dbe0.exe, /notmalware/9suckonmybinary78, and six disguised PowerShell scripts (/ppprincee6/secured_stub.ps1, /prince1/secured_stub.ps1, /princee255/Crypted.ps1, /tsk/red_stub.ps1, /web/JOHN21/5T5T/35434FGRT.ps1, /suzxwgr/afwugem/aimxfrz/DTsecured_stub.ps1). On the same node, Pfcloud's 204.76.203.18 looped its own 580-path dictionary alongside (2,190 events, 02:34 → 05:42 stored, no browser label, blocklist ipsum:2 — second window in a row on control-1).
  • What it means: the shared malware shopping list keeps growing with current botnet families, and the hosts rotate while the list persists. Control-1, our deliberately fresh baseline node, again absorbed a record replay and gave back nothing — the decoy design did its job.

PATHSCAN-CENSUS — the honest-labeled scanner that collects credentials, now with a second operator

  • Who: 176.123.8.213 (Alexhost S.r.l., Moldova) — same company as №66's 176.123.5.6, new address.
  • What they did: canary-farm-1: 324 requests / 175 paths / 63 trap families in 4 minutes (03:23–03:27 stored) under its honest label Mozilla/5.0 (compatible; pathscan/1.0), plus 12 requests under the undici label. Then lauterbourg-01-ts: 311 requests / 176 paths (04:23–04:26). It collected 9 /.env-style canary credentials on canary-farm-1, including the capital-letter variants /.Env and /.ENV — the largest single-address take this window. lauterbourg-01-ts gave 0 because that node ships no canaries by design. The path order: tarpit loops, a random-marker probe, /.env [issued], /.Env [issued], /.ENV [issued], then /.aws/config and /.aws/credentials (plus .bak copies), then Spring Boot actuator checks (env, health, configprops, threaddump), then rails, composer, jenkins, and netrc credential files.
  • What it means: two operators from one company, an identical 9-credential take two windows apart — the scanner works a fixed list until our trap wall, then harvests. Its 9 credentials now sit in attacker hands. The watch: any AWS use of this stockpile, or a third Alexhost address.

XMLRPC-BRUTE — the WordPress flood, old operator back

  • Who: 45.94.31.16 (1337 Services GmbH, Netherlands) on ai-devbox-1. Last window's record operator 34.78.138.84 (Google, Belgium) sat out.
  • What they did: 1,007 events, of them 1,000 POSTs to /xmlrpc.php in 3 minutes (15:44–15:47 stored), under the same fake Chrome/78.0.3904.108 label, plus the usual wlwmanifest and user-enumeration side probes. All-time this address now has 4,028 events and 4,000 flood POSTs across three windows — the registered 1,000-POST batch rhythm.
  • What it means: six operator classes have run the same flood kit so far; each rents an address, runs a batch, and leaves. Our fake WordPress held every request. 0 credentials taken.

REGISTRY-HUNT — the DigitalOcean walker pool minted wide

CREDENTIAL-DRAIN — a zero-use window, cleanest mint window in three cycles

  • Who: 22 collector addresses took 50 credentials per the Tracebit funnel (the digest counted 59 issued rows: canary-farm-1 26 from 16 addresses, ai-devbox-1 15 from 12, control-1 12 from 10, ru-edge-1 6 from 6; the difference is how each system trims the same 24 hours). None reached AWS.
  • What they did: mint side unchanged. Failures: 0 (last window had 8 pacing errors, the one before 16). The big stockpiles did not grow: SI-CENSUS holds 52 over 6 days with no mint since 2026-11-03 02:45, 45.148.10.120 holds 11, 23.132.164.201 holds 10 (it minted on 3 sensors this window), 150.241.66.127 holds 9, 176.123.8.213 holds 9 (new), 46.148.227.131 holds 7, 85.11.167.204 holds 7 (minted 2+2 this window). This window's collectors were small single-path loops: 85.11.167.204 (Go-http-client/1.1 label, 1 path, 5 sensors, 4 credentials), 23.132.164.201 (an ancient MSIE 4.01/Windows CE label, 1 path, 5 sensors, 3), 202.65.239.148 (fake Chrome/39 from 2014, 9 paths, 4 sensors, 5), and a fake-Chrome/81.0.4044.129 trio new today (98.97.76.10 3, 165.154.218.176 2, 180.93.226.114 1).
  • What it means: the inventory grew while the use side rested. Every issued credential stays live until it expires, and AWS's deny wall went untested this window. The line we watch stays the same: any success beyond "who are you", or any attempt to create resources.

ACTUATOR-BEDROCK-KIT — the steal-and-use actor refilled, but stayed out of AWS

  • Who: 152.89.244.89 (aurologic GmbH, Germany) — canary-farm-1 only.
  • What they did: minted 2 credentials this window (5 over its 6-day history); no AWS events from its stockpile, after last window's 14-call Bedrock-shaped session.
  • What it means: the actor keeps its credentials alive. A return to AWS is the watch, and last window's session is still the only Bedrock-shaped use we have seen.

Smaller watchers

  • 193.47.62.109 (BestDC Limited, Bulgaria) — 552 requests / 276 paths in 5 minutes on sponge-01-ts (05:38–05:43 stored) under 10 rotating labels, one of them a typo forgery (Mozlila/5.0 … Bulid/NRD90M … Moblie Safari). It swept for webshells and phpinfo files (i.php, info.php, phpinfo.php, host.php, host-info.php, php-info.php, phpversion.php, local-config.php, test.php, config.php, configuration.php), touched /_debug and /phpmyadmin/.env; 1 POST, 0 credentials. Same /24 as OPENAPI-CENSUS's 193.47.62.29, but a different trade — we keep them separate and will name it if it returns.
  • 45.144.212.192 — a new self-labeled tool, git-config-harvester/1.0: 4 requests for /.git/config on ru-edge-1 over 23 minutes. Our fake git served decoys. Watch for a second sighting.
  • 194.180.49.41 (CREDSWEEP operator, MEVSPACE Bulgaria) — its heaviest run on record: 327 requests / 288 paths / 29 families on control-1, sponge-01-ts, and frantech-ts under a Go-http-client label, with the pscan-04d22ab6 marker leg and 1 credential on control-1 (6 over 6 days).
  • GIT-HARVEST — fourth window running. 35.232.76.162, 203 requests / 7 sensors under its honest harvest/1.0 label. Scheduled, not a one-off; still 0 credentials.
  • Tarpit loopers (signature 3e1c5eb879e7, 128 addresses, 886 events, 7 sensors): 93.174.93.12 (7 sensors, 333 events), 89.248.172.33 (6, 324), 160.187.146.57 (4, 347), 123.253.14.241 (4, 308), 129.121.52.181 and 43.153.2.142 (4, 353 each), 103.118.17.13 (5, 295 — this one also carried wp-login guesses).
  • MALWARE-DICT (Pfcloud 204.76.203.18) — second window in a row looping control-1 (2,190 events / 580 paths, no browser label, 11-04 02:34 → 11-05 05:42 stored, 0 credentials) — a separate artifact from MEGA-DICTIONARY with its own list.
  • Benign, for contrast: 71.6.155.70 (8 sensors, handshake depth) and 94.183.174.99 (8 sensors) held their usual research shapes. No benign-listed operator crossed into hostile behavior.

Standing actors (who keeps coming back)

  • REGISTRY-HUNT's DigitalOcean pool — present every window on record; 14 walker credentials this window, no use.
  • SI-CENSUS (102.220.163.241) — idle a second window in a row; stockpile 52/6d untouched since 11-03 02:45; never observed using a credential.
  • MEGA-DICTIONARY hosts — the artifact now spans four hosting providers; Pfcloud's loop nested on control-1 for a second window.
  • XMLRPC-BRUTE operators — 45.94.31.16 back after one idle window; 4,000 all-time POSTs across three windows.
  • GIT-HARVEST (35.232.76.162) — fourth consecutive window, same shape.
  • 208.84.100.218 (CONFIGBUNDLE-KIT) — idle this window after last window's 5-credential run; on our records since 10-02.
  • 23.132.164.201 — 10/6d stockpile, minted on 3 sensors this window, loops 5 sensors, ancient-UA single-path shape.
  • 85.11.167.204 — 7/6d stockpile, Go-http-client single-path collector across 5 sensors.
  • 202.65.239.148 — 5/6d stockpile, minted on 4 sensors this window under a 2014-era fake Chrome/39.

Network sweeps (Arkime) — port-22 scans the web traps cannot see

These are SSH banner checks against our 8 public addresses. They ask for no web page, so the honeypot traps never log them; only the pcap layer (Arkime) sees them. This window: 109,767 inbound sessions, 47 fingerprints with 5+ sessions, 4 flagged as dispersed sweeps, 2 new fingerprints (both below the sweep thresholds).

The eight largest fingerprints (id, sessions, source addresses / networks / countries):

  • f555226df1963d1d3c09daf865abdc9a — LIBSSH-MASSSWEEP, banner ssh-2.0-libssh_0.9.6: 2,984 sessions from 275 addresses across 155 networks in 55 countries — back over the dispersed-sweep line (+92 addresses). Daily address counts: 10-30 583, 10-31 455, 11-01 610, 11-02 496, 11-03 149, 11-04 239, 11-05 98.
  • 06ff3615a51b2af343ec22abc8e30bbc — GO-SPRAY-SWEEP, banner ssh-2.0-go: 2,398 sessions from 102 addresses across 51 networks in 19 countries — also back over the line, after four quiet days (10 addresses → 102). Daily counts: 10-31 101, 11-01 141, 11-02 17, 11-03 13, 11-04 10, 11-05 100.
  • 0a07365cc01fa9fc82608ba4019af499 — GO-SSH-SWEEP, banner ssh-2.0-go: 22,983 sessions from 59 addresses across 31 networks in 19 countries (1,568 fewer sessions). Its busiest blocks (109.160.32.x, 77.239.124.x) are the same ones that run the login-honeypot hardware survey.
  • 184781a96d49ee509a431028a8d5022a — OPSSH-UBUNTU-SWEEP: 1,149 sessions from 52 addresses across 40 networks in 21 countries — contracting (118 → 52 addresses, 2 on the 11-05 tail), and now carrying three banners under the one fingerprint (russh_0.45.0, openssh_9.6p1 ubuntu, openssh_10.0p2 debian-7): fake names or a shared tool pool.
  • 16443846184eafde36765c9bab2f4397 — GO-SCATTER-SWEEP: 12,848 sessions from 33 addresses, 17 networks, 13 countries.
  • dd9bcf093c355da7000132131cb36fd0 — unnamed: 27 sessions, 26 addresses, 1 network, 1 country.
  • 084386fa7ae5039bcf6f07298a05a227 — unnamed: 25 sessions, 24 addresses, 3 networks, 5 countries.
  • 03a80b21afa810682a776a7d42e5e6fb — LIBSSH-011-SWEEP: 265 sessions, 23 addresses, 17 networks, 7 countries.

Also worth naming: CTL-MASS-SSH (4e066189c3bb…) ran 21,028 sessions (10,119 fewer) — still the fleet's heaviest single SSH load, on control-1, its fifth window in a row above 21,000. Two new fingerprints appeared below the thresholds, both ssh-2.0-go: 1c79d243d7cc… (35 sessions, 3 addresses, 1 network) and b63ae9a62fd8… (57 sessions, 1 address, 1 network).

None of these tried to log in. What it means: the sweeps map who runs SSH where; on their own they take nothing, but any login attempt from one of these fingerprints would change its class. Per node, the inbound load ranked: control-1 39,633 sessions from 268 addresses, lauterbourg-01-ts 15,718 from 2,818 (the widest address spread in the fleet — the fresh node draws the widest scanning), frantech-ts 13,142 from 2,635, ai-devbox-1 12,369 from 384, ru-edge-1 8,056, sponge-01-ts 7,843, canary-farm-1 7,344, netcup-ts 5,662.

Canaries (minted and used) — how the trap credentials moved

The window in one line: 50 credentials minted to 22 attacker addresses; 0 used in AWS; 50 sitting in attacker hands.

The digest's own mint table counted 59 issued rows (canary-farm-1 26 from 16 addresses, ai-devbox-1 15 from 12, control-1 12 from 10, ru-edge-1 6 from 6); the difference from 50 is how the two systems trim the same 24 hours. Mint failures: 0 — the first error-free mint window in three cycles (last window: 8 pacing errors; the one before: 16). No key errors.

Every collector this window (address, sensor, credentials taken, AWS use, mint history over 6 days): 176.123.8.213 canary-farm-1 9 (0 used, 9 since 2026-11-05 03:24); 152.89.244.89 canary-farm-1 2 (0, 5 since 2026-11-03 10:43); 165.154.218.176 ai-devbox-1 2 (0, 2 since 2026-11-04 17:44); 202.65.239.148 canary-farm-1 2 (0, 5 since 2026-11-04 17:58); 64.225.75.246 ai-devbox-1 2 (0, 6 since 2026-10-29 04:44); 85.11.167.204 ai-devbox-1 2 and control-1 2 (0, 7 since 2026-11-02 13:51); 98.97.76.10 control-1 2 (0, 3 since 2026-11-05 03:01); 138.68.144.227 canary-farm-1 1 and ru-edge-1 1 (0, 3 since 2026-11-04 05:23); 138.68.86.32 canary-farm-1 1 (0, 1 since 2026-11-04 22:08); 139.59.143.102 ru-edge-1 1 (0, 4 since 2026-10-31 21:27); 159.89.12.166 canary-farm-1 1 (0, 3 since 2026-10-31 21:19); 159.89.127.165 ai-devbox-1, canary-farm-1, and control-1 1 each (0, 4 since 2026-11-03 21:08); 164.92.244.132 canary-farm-1 1 (0, 1 since 2026-11-04 22:08); 167.99.181.249 ai-devbox-1 1 (0, 2 since 2026-11-03 21:01); 172.81.135.182 ai-devbox-1 1 (0, 1 since 2026-11-05 04:59); 180.93.226.114 canary-farm-1 1 (0, 1 since 2026-11-05 01:16); 180.93.232.115 ai-devbox-1, canary-farm-1, and ru-edge-1 1 each (0, 3 since 2026-11-04 14:26); 194.180.49.41 control-1 1 (0, 6 since 2026-10-31 23:24); 202.65.239.148 ai-devbox-1, control-1, and ru-edge-1 1 each (0, 5 since 2026-11-04 17:58); 209.38.208.202 canary-farm-1 1 (0, 3 since 2026-11-01 21:16); 23.132.164.201 ai-devbox-1, canary-farm-1, and ru-edge-1 1 each (0, 10 since 2026-10-30 01:07); 45.138.12.51 ai-devbox-1 and control-1 1 each (0, 4 since 2026-10-30 08:25); 64.23.218.208 control-1 1 (0, 2 since 2026-10-30 21:03); 98.97.76.10 canary-farm-1 1 (0, 3 since 2026-11-05 03:01).

Long-term stockpiles with no observed AWS use (the Tracebit 6-day view): 102.220.163.241 holds 52 (2026-10-31 11:01 → 2026-11-03 02:45); 45.148.10.120 holds 11 (10-29 07:15 → 10-31 04:23); 23.132.164.201 holds 10 (10-30 01:07 → 11-04 17:31); 150.241.66.127 holds 9 (11-01 01:45 → 11-01 19:59); 176.123.8.213 holds 9 (11-05 03:24); 46.148.227.131 holds 7 (11-02 23:09); 85.11.167.204 holds 7 (11-02 13:51 → 11-05 03:19); 102.22.219.226 holds 6 (11-03 14:34 → 15:56); 162.35.242.53 holds 6 (10-29 15:00 → 10-30 09:33); 185.177.72.64 holds 6 (10-31 01:36 → 11-03 15:41); 194.180.49.41 holds 6 (10-31 23:24 → 11-04 16:27); 64.225.75.246 holds 6 (10-29 04:44 → 11-04 22:10); 74.0.42.13 holds 6 (10-31 00:12 → 11-03 16:35); 152.89.244.89 holds 5 (11-03 10:43 → 11-04 15:25); 154.162.45.255 holds 5 (10-31 15:45 → 16:29); 202.65.238.233 holds 5 (10-29 07:43 → 07:48); 202.65.239.148 holds 5 (11-04 17:58 → 11-05 00:33); 208.84.100.218 holds 5 (11-04 00:55 → 03:23); 209.97.180.8 holds 5 (10-31 20:55 → 11-04 06:15); 45.138.12.16 holds 5 (10-30 02:59 → 11-01 12:49); 69.197.186.50 holds 5 (11-01 11:38 → 11-03 11:36); 108.181.98.163 holds 4 (11-02 08:39 → 11-04 01:47); 139.59.143.102 holds 4 (10-31 21:27 → 11-04 21:08); 159.89.127.165 holds 4 (11-03 21:08 → 11-04 21:43); 193.32.248.165 holds 4 (10-29 22:37 → 22:53); 193.47.62.29 holds 4 (10-31 10:44 → 10:51); 207.154.212.47 holds 4 (10-31 21:28 → 11-03 11:41); 45.138.12.51 holds 4 (10-30 08:25 → 11-04 23:52); 93.123.109.107 holds 4 (10-29 17:03 → 22:21); 137.23.38.53 holds 3 (11-01 12:28 → 11-03 04:47); 138.68.144.227 holds 3 (11-04 05:23 → 21:42); 155.117.232.31 holds 3 (11-03 18:19 → 18:28); 157.245.36.108 holds 3 (11-02 06:14 → 11-03 04:18); 158.140.191.104 holds 3 (11-03 19:23); 159.89.12.166 holds 3 (10-31 21:19 → 11-04 21:45); 167.99.210.137 holds 3 (10-29 18:30 → 11-03 11:40); 180.93.232.115 holds 3 (11-04 14:26 → 19:25); 206.81.24.74 holds 3 (10-29 18:29 → 11-03 14:35); 209.38.208.202 holds 3 (11-01 21:16 → 11-04 20:58); 45.138.12.6 holds 3 (10-29 13:18 → 10-30 14:19); 68.183.180.73 holds 3 (11-02 06:14 → 22:19); 87.192.41.180 holds 3 (10-30 15:51 → 21:12); 93.123.109.247 holds 3 (10-30 20:20); 98.97.76.10 holds 3 (11-05 03:01 → 05:41).

This was a zero-use window. Every one of these credentials is live until it expires. The full per-collector and per-operation evidence tables are in the technical version.

How the fleet behaved (Fleet Observations) — volumes, defenses, the fresh node

  • Traffic moves had clear causes. control-1 rose 788% (20,567 events vs a 2,315 weekly average) because of the tzulo dictionary replay (14,932) plus the Pfcloud loop (2,190); without those two, the node ran about 3,445 events, inside its normal band. frantech-ts fell 80% (3,055 vs 15,027) because no dictionary replay hit its web surface. ai-devbox-1 rose 52% (6,071) on the WordPress wave, the 1,000-POST flood, and a tarpit spike. netcup-ts rose 457% (5,226), sponge-01-ts 240% (3,301), and ru-edge-1 218% (3,446) on the WordPress wave plus tarpit spikes — these deception nodes normally run about 1,000 events. canary-farm-1 fell 45% (5,087) because the heavy scanners from the last three windows all stayed home; the wave added only about 640 events there. lauterbourg-01-ts rose 13% (4,327). We checked sync coverage: every sensor's newest event landed between 10:47 and 12:25 UTC on 11-05, so these moves are real, not missing logs. Remember: events near the boundary show up in two daily digests.
  • Canary economics. 59 mint rows, 0 failures, no key errors. Through the alert side: 50 credentials to 22 addresses, 0 used in AWS, 50 unused.
  • Attribution checks are clean. 1,353 requests carried an X-Forwarded-For header; 0 forged multi-entry chains; 0 headers ignored as source; 0 forgeries claiming a different source than the connection — the fifth quiet window in a row. Web traffic ran plain-HTTP-first on every node (canary-farm-1: 4,230 HTTP vs 857 HTTPS; lauterbourg-01-ts: 3,972 vs 355). Top fake hostnames: 38.54.2.209 20,558 requests (control-1, the replay), v2202603343434439947.megasrv.de 4,541 (netcup-ts), vmi3177282.contaboserver.net 4,199 (ai-devbox-1), inference.fapthropic.com 1,348 (ai-devbox-1's TLS bait), vmi3610064.contaboserver.net 2,436 (lauterbourg-01-ts). On the rebuilt lauterbourg node, scanners hit the bare server hostname more than the TLS bait name cloud.wafflehouseindex.us, which drew no top-2 volume (last window: 11,631, inflated by the flood). That drift toward bare hostnames is a wordlist-refresh signal to watch.
  • A new attribution quirk on lauterbourg-01-ts. 1,204 events this window name the internal docker gateway address 172.18.0.1 as the sender, with attack-shaped request patterns (316 fake-webshell login hits, 316 root hits, 180 user-enumeration calls, 230 wp-login calls). Past digests did not show this address as a top talker there. The practical effect: per-address counts on lauterbourg-01-ts under-count real attackers for that share of traffic, and the node's php2shell-login spike (746 events, 9.4×) is mostly this traffic plus generic scanners hitting the catch-all / and /login surfaces. We do not yet know whether these rows are forwarded inbound traffic or something local — that check is on the open-questions list. Until then we trust request patterns, not that address.
  • The fresh-IP baseline node (control-1) is 53 days old (first event 2026-09-12 07:59 UTC). Its window day ran 20,567 events from 136 addresses — the replay owns the number; strip the replay and the loop, and the node ran about 3,445 events, above its 2,315 weekly average but inside its historical range. The network layer still aims the fleet's biggest SSH load at it (CTL-MASS-SSH, 21,028 sessions).
  • First-seen lists need care. Every new path and browser label in the digest shares one sync timestamp (02:15 stored), so the list is an inventory, not a timeline. We matched them by hand: the 20 new control-1 paths belong to the tzulo replay, pathscan/1.0 belongs to 176.123.8.213, and git-config-harvester/1.0 belongs to 45.144.212.192.
  • Crypto honeypot (ch-sponge-01-ts), platform view: 12,142 records from 2,984 sessions and 362 addresses since 11-04 07:35 UTC. Busiest services: Telnet 8,728 records, HTTP 769, a Monero wallet RPC 554, Docker 441, LND 437. The busiest source by far is 94.183.174.99 with 7,342 records — about 60% of the node's volume; that address is already identified on our records as benign research, so we treat the share as a monitoring note, not a threat. The alerts include 16 wallet-open attempts, 8 transfer attempts, 7 exec attempts, 5 key-theft attempts, and 5 CVE attempts. The /.env bait requests: 45.148.10.5 pulled all four variants at 01:09Z (/.env, /.env.bak, /.env.local, /.env.production), and 176.65.144.71 pulled /.env.bak at 20:51Z. Docker dropper indicators came from 14.153.139.117 (12:05Z and 04:52Z) and 106.75.37.123 (20:44Z). The packet-level view stays in Arkime.
  • No fleet changes were made this cycle.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

One host, so never treat these as fleet numbers. This window: 369 addresses sent login attempts → 235 got a shell (64%) → 166 ran a command (71% of those who got a shell, 45% of senders). In raw events: 10,865 login attempts → 4,990 accepted logins → 14,689 commands. The telnet side (IoT botnets) saw 511 attempts.

No operator ran a command we had never seen before (0 of 4,973 distinct commands) — the fourth quiet window in a row. No new username/password pair appeared either (0 of 3,499 offered). What did move: the top password pair is still rootssssss23424123123/rootssssss23424123123 (285 tries, up from 175), the old gs5662d34 family holds three of the next four slots (root/root3245gs5662d34111111111 217 tries, 345gs5662d34 139, root/3245gs5662d34 105), and the everyday commodity pairs follow (root/123456 97, pi/raspberry 82, user/wasd 78, support/support 43).

The repeated commands stay the same: a hardware-check loop (uname -s -v -n -r -m and its awk helper, 2,951 and 2,950 runs from 5 addresses — the same 109.160.32.x block that runs the port-22 GO-SSH-SWEEP), an SSH key-planting routine (chattr -ia .ssh and lockr -ia .ssh, 445 runs from 120 addresses), and a GPU-discovery pass (nvidia-smi checks, an lspci check, /bin/./uname, uptime -p; 405 runs each from 3 addresses, example source 2.57.122.238 — a new address block for this pass, different from last window's Techoff operator 195.178.110.218).

Staging servers (the C2 view, same one host)

A quiet window on the malware-staging front: no download address drew a command or a download, and none is new. 13 addresses seen in the last 7 days remain on the books, and the captured-payload list is unchanged (23 artifacts). Last window's new staging host http://5.175.192.232/bot_mips — the 2.4 MB Go-built MIPS program, sha256 starting afdbab3c1c43 — drew no further fetches this window, and we still cannot name its family from the file. We will not guess.

Open questions

  1. Will the 244-address WordPress wave come back at this size, and will any guess ever succeed against the fake WordPress? The password list is indexed by year (Admin2026@, admin2025@), so expect 2027 versions when it rolls. A third batch of new signatures would show the tool circulates on its own, like the WordPress flood kit.
  2. Will anyone use PATHSCAN-CENSUS's 9 fresh credentials (176.123.8.213) in AWS? A use would extend the steal-and-work pattern from last window. Also open: will a third Alexhost address appear, and do the two operators share one wordlist?
  3. Where does the MEGA-DICTIONARY list go next? A fifth host or a repeat from the same address would prove the list still circulates. The 58 new paths name this cycle's additions (nyx_bot, krmine, PowerShell stubs, uploaded .exe files); a full comparison with №71's list would isolate them.
  4. Does OPSSH-UBUNTU-SWEEP's banner pool keep growing? Three banners share one fingerprint now. A fourth supports the fake-names reading; a return to one stable banner reverses it. The volume shrank to 2 addresses on the 11-05 tail — watch whether it spreads again.
  5. What is the 172.18.0.1 traffic on lauterbourg-01-ts? If those 1,204 events are forwarded inbound traffic, our per-address tables under-count attackers on that node. One read-only look at the sensor's own records will settle it.
  6. Is SI-CENSUS retired, or is it holding its 52-credential stockpile? It stayed idle for two windows. Any alert naming 102.220.163.241 answers the question.

Plain language version of: flux-fleet-intel-briefing-2026-11-05.md