FLUX FLEET — INTEL BRIEFING №71

Period: 2026-11-02 07:32 – 2026-11-03 07:32 UTC (24h, day 69 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 69-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the ingest cast applies (see Fleet Observations).

BLUF

The credential funnel's use side changed shape this window: 13 AWS use events against 4 stolen canaries, and for the first time in the fleet's 69-day history they included resource enumeration — a new use IP, 85.121.176.200 (RO), minted an ai-devbox-1 canary at 10:58 stored on 11-02 and then drew 6 denied calls across three services (DescribeInstances×2, GetUser×2, ListBuckets×2) plus 1 successful sts:GetCallerIdentity, while SES-QUOTA-PROBE's collector 137.23.38.53 added 6 more identity-only successes. MEGA-DICTIONARY's dropper-URL wordlist circulated to a third host: 146.70.224.67 (M247 Europe SRL, HK) replayed a record 14,864 unique paths against frantech-ts in ~2.5 minutes under a new IoT user agent (Synology RT2600ac Router), growing the manifest +667 after №70's +421. Volume rotated: ru-edge-1 (−85%), lauterbourg-01-ts (−68%), and canary-farm-1 (−66%) ran well under baseline while control-1 rose +78% under a four-sensor SI-CENSUS day. Two new HTTP-side campaigns appeared — ENV-FANOUT, a paired .env-variant census on lauterbourg-01-ts under forged Chrome/143, and a 12-second, 125-family AI/LLM-config census from 45.138.12.10 (Tc Datacenter LT, the CREDSWEEP /24) that minted nothing. The network layer flagged a new dispersed SSH sweep (ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, 185 source IPs across 97 networks in its first day) while LIBSSH-MASSSWEEP contracted from 627 to 364 source IPs.

Key Judgements

1. Stolen canary credentials are being worked for service inventory, not identity alone. 85.121.176.200's 7-call session paired the usual successful sts:GetCallerIdentity with 6 denied reads aimed at EC2, IAM, and S3 — the first enumeration-shaped use in funnel history. (High confidence on the events — the Tracebit pull carries the operations and outcomes; Moderate on trajectory — one session from one IP, and every inventory call was denied, so nothing beyond account identity left AWS.)
2. The dropper-URL dictionary is a maintained artifact that circulates between operators. Three distinct hosts have now replayed it (Datacamp DE, xTom HK, M247 HK), each pass carrying a different IoT user-agent label, and the manifest grew in two consecutive windows (13,776 → 14,197 → 14,864 paths). (High confidence on the counts and hosts — direct per-IP journey queries; Moderate on operator linkage — hosts and UA labels rotate, and no payload-level anti-join was run this window.)
3. The mint side concentrated while the use side broadened. SI-CENSUS alone minted 16 of the window's 72 digest-issued credentials and now holds 114 per its 6-day history, yet the window's 13 use events came from 2 use IPs — both working fresh or near-fresh mints rather than the big hoards. (High confidence on the counts — digest and Tracebit numbers; Moderate on the hoard reading — №67–№68 showed use can lag mint by a day.)
4. The deception surface absorbed every stage it was fed. The 12-second, 125-family AI/LLM-config census drew tarpit and error results with 0 mints; the phpMyAdmin hammer met a third repeat operator and served forms throughout; 1,987 system.multicall bodies hit the WordPress decoys; ENV-FANOUT's paired walks produced ~1,700 tarpit-class results. (High confidence — direct result-tag counts.)

Active Campaigns (day 69 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIRST ENUMERATION-SHAPED USE — Hostile, active

• Actors: 34 collector IPs took 63 credentials (digest issued rows: 72 — canary-farm-1 27 from 15 IPs, ai-devbox-1 22 from 14, control-1 17 from 9, ru-edge-1 6 from 6). Use IPs: 85.121.176.200 (new) and 137.23.38.53 (SES-QUOTA-PROBE).
• TTPs: unchanged mint side — /.env-class mints to hostile collectors. The use side moved: 13 use events across 4 credentials, 7 successful sts:GetCallerIdentity plus 6 denied inventory reads (DescribeInstances×2, GetUser×2, ListBuckets×2). 85.121.176.200 minted ai-devbox-1 at 10:58 stored 11-02 and ran the 7-call session. Failures on the mint side: 16 — canary-farm-1 8×400, ai-devbox-1 3×400 plus 2 without captured detail, control-1 2×400, ru-edge-1 1×400; no 401s, no key errors.
• Assessment: every issued row remains an operational credential within hours, and the deny pattern (identity succeeds, inventory denied) reads as an actor mapping what the canary's AWS role can reach. Any future success beyond sts:GetCallerIdentity, or a write-shaped call, is the escalation line.

SES-QUOTA-PROBE ⟳ — FOURTH CONSECUTIVE USE WINDOW, STILL IDENTITY-ONLY — Hostile, active

• Actors: 137.23.38.53 — minted ai-devbox-1 and control-1 (1 each this window; 3 credentials since 11-01 12:28), one use IP. Also present fleet-light on netcup-ts, sponge-01-ts, lauterbourg-01-ts, and canary-farm-1 (147 events crossnode).
• TTPs: 6 successful sts:GetCallerIdentity calls across its 3 held credentials. No quota calls, no denials.
• Assessment: four windows of identity validation with no quota follow-up. The №57 shape (72 denied ses:GetSendQuota calls) remains the actor's known escalation; watch for it, a second use IP, or any success beyond identity.

MEGA-DICTIONARY (dropper-URL dictionary replay) ⟳ — THIRD HOST, RECORD MANIFEST — Hostile, active

• Actors: 146.70.224.67 (M247 Europe SRL, HK) — frantech-ts only, 01:58:43–07:01:17 raw digits (01:58–02:01 stored). №70's host 103.125.233.17 absent; no same-IP repeat.
• TTPs: 14,874 GETs against 14,864 unique paths in ~2.5 minutes (≈97 paths/s, №70's pass was ≈100) under Synology RT2600ac Router — a third IoT label after Seagate Personal Cloud. Manifest 14,197 → 14,864 (+667), the second consecutive growth pass. Results: 14,868 not-handled plus the same 5 decoy-single tag hits earlier replays carried (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth, llm-endpoint-models-list); 0 mints. The replay produced the window's first-seen dropper-URL paths (/APO_2.exe, /CHAPO/CHAPO2.exe, /FAST/ttessttt.ps1, and the rest) and owns frantech-ts's +1% hold (7,978 + 6,956 events in the 01:00–03:00 UTC burst buckets).
• Assessment: a shared, actively-maintained wordlist circulating across at least three hosting providers. Each replay now grows the artifact; a fourth host replaying the grown list would establish active circulation versus one operator re-hosting.

XMLRPC-BRUTE ⟳ — SECOND CONSECUTIVE WINDOW, DOUBLED — Hostile, active

• Actors: 45.94.31.16 (1337 Services GmbH, NL) — ai-devbox-1 only. Window subset: 2,014 events / 2,000 POSTs, 07:36–22:49 stored; the IP has run 3,000 /xmlrpc.php events since 11-01 00:16 raw.
• TTPs: 1,987 of the POSTs carry system.multicall bodies (head: <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…), forged Chrome/78.0.3904.108 unchanged, plus the wlwmanifest and wp-user-enum legs. The registered 1,000-POST batch shape, doubled.
• Assessment: a patient operator repeating a fixed batch shape daily against the WordPress decoys. No captured credential success; volume doubling is the only movement.

SI-CENSUS ⟳ — FOUR-SENSOR DAY, HOARD AT 114 — Hostile, active

• Actors: 102.220.163.241 (VPS Dedicated LLC, SI) — 5,661 events across ai-devbox-1 (1,435), control-1 (2,687), canary-farm-1 (1,023), ru-edge-1 (516). Single-IP operation, ninth-plus window.
• TTPs: unchanged per-sensor .env-fanout walks; minted 16 (ai-devbox-1 7, control-1 6, canary-farm-1 2, ru-edge-1 1) under forged Chrome/126. Owns control-1's +78% day and most of its spike bundle (phpinfo 162, tarpit 234, iis-web-config 21, the env-production fanout) and ai-devbox-1's phpinfo spike (125 of 141).
• Assessment: the fleet's largest hoard — 114 per 6-day history, zero observed AWS use — keeps growing one sensor-day at a time. Any Tracebit alert naming this IP is the moment the pool moves.

ENV-FANOUT (paired .env-variant census) ⚠ NEW — Hostile, active

• Actors: 162.216.241.239 (Dynu Systems, US) ran lauterbourg-01-ts 12:43–13:08 stored 11-02; 198.145.226.37 (M247 Europe SRL, US) ran it again 02:15–02:40 stored 11-03. Identical template, ~13 hours apart.
• TTPs: identical forged Chrome/143.0.0.0 UA (a version that does not exist yet, which dates the forgery); identical 85-path <dir>/.env fanout (/wp-content/.env, /redmine/.env, /.env.testing, /protected/.env, /vendor/laravel/.env, and 79 more) with ~10 repeats per path — 327–330 events per pass on lauterbourg-01-ts — plus 1-path tarpit loops on ai-devbox-1 (18) and canary-farm-1 (12). 0 mints, 0 POSTs. Together the pair owns 89 of the node's 113-event tarpit spike (11.3×).
• Assessment: one template, two rented hosts, sequential scheduling. The tarpit absorbed every request. A third IP, any mint, or the Chrome/143 forgery appearing on a canary node promotes this to a standing watch.

AI-CLI-VAULT ⟳ — NEW ARM FROM THE CREDSWEEP /24 — Hostile, active

• Actors: 45.138.12.10 (Tc Datacenter Limited, LT) — canary-farm-1 primarily; 13 events on ai-devbox-1 since 10-22. Same /24 as CREDSWEEP's standing operators (.16/.35/.51).
• TTPs: a single 12-second burst — 2,417 events / 1,438 paths / 125 trap families (11:47:18–30 stored), the fleet's highest family count for a single run — over an AI/LLM-config wordlist (/openai-proxy.yaml, /api/bedrock, /api/bedrock-runtime, /litellm_config.yaml, /gpt/config.json, /config/ai.json, /bedrock/config.yml, /config/llm.yaml, /ai/credentials). Forged Chrome/124. 0 mints.
• Assessment: the AI-credential census class returns with a bigger list and a faster runner, from a /24 that already mints elsewhere. A mint or a second pass is the promotion signal; the fleet's fake surfaces and env-error tags absorbed the whole pass.

GIT-HARVEST (git-internals walker) ⟳ — SECOND CONSECUTIVE WINDOW — Hostile, watch

• Actors: 35.232.76.162 (Google LLC, US), 7 sensors, 200 events / 44 paths, 11-02 03:08 → 11-03 05:17 raw digits.
• TTPs: unchanged honest UA Mozilla/5.0 (compatible; harvest/1.0); short per-leg walks into the fake git surfaces. 0 mints, 0 POSTs.
• Assessment: scheduled rather than one-off — same IP, same UA, same shape two windows running. The fake git surfaces answered everything; a mint or a second IP promotes it.

GOWEB-PENTEST (phpMyAdmin login-surface hammer) ⟳ — THIRD REPEAT OPERATOR IP — Hostile, active

• Actors: 57.128.201.75 (OVH) — lauterbourg-01-ts. Third repeat IP after 103.242.78.199 (№50–№51, №70) and 172.104.173.62.
• TTPs: the registered 151-event phpmyadmin-login unit on 1 path under the honest Go Web Pentest Tool UA; owns 151 of the node's 158-event phpmyadmin spike (3.2×).
• Assessment: the same unit, a fourth operator IP. The fake phpMyAdmin served forms throughout; nothing captured.

CONFIGBUNDLE-SWARM (multi-pool config-bundle census) ⟳ — 185.92.25.x STILL MINTING — Hostile, active

• Actors: the 185.92.25.x pool ran 2–4 events per IP across control-1, canary-farm-1, and lauterbourg-01-ts; .52 minted on control-1 (09:27 stored), .57 on canary-farm-1 (09:59 stored).
• TTPs: unchanged light per-IP config-bundle touches; both mints are drain candidates.
• Assessment: the №69 pool holds; every mint joins the standing hoard pool. AWS use is the check.

Light watchers

• REGISTRY-HUNT walker pool — the 27-family DigitalOcean walkers ran again fleet-wide (164.90.208.56, 157.230.19.140, 142.93.0.66, 206.81.24.227, 209.97.180.8, 64.225.75.246, 206.189.233.36, plus 174.138.22.143's symfony/composer variant) and minted ~8 singles; the l9scan mint arm was idle.
• 46.148.227.131 — honest UA VantageResearchScanner/1.0 (+/scanner; non-intrusive); 222 events / 28 paths on canary-farm-1 + lauterbourg-01-ts; minted 7 on canary-farm-1 (the window's largest single-IP mint count) and drew 14 actuator-env results. The label says research; the minting is hoard behavior. Companion first-seen UA Mozilla/5.0 (compatible; SecurityResearch/1.0; ) on canary-farm-1.
• Tarpit loopers — 89.248.172.33 (7 sensors, 321 events), 93.174.93.12 (6 sensors, 363), 45.198.224.125 (all 8 sensors, 80 — the TOKEN-CRAWLER /24).
• 45.153.34.x pool — .249 forged Firefox/125 across 6 sensors (174 events / 40 paths, 1 mint on ai-devbox-1); .178 minted on ai-devbox-1 + control-1 (2 each).
• Miscellaneous single-mint collectors — 108.181.98.163 (Psychz US; 3 mints on canary-farm-1 + 15 POSTs), 173.35.95.189 (2 on ai-devbox-1), the 212.30.33.x trio (.13 ru-edge-1, .37/.38 canary-farm-1, minted within minutes of each other), 85.11.167.204 (control-1), 217.60.76.38 (canary-farm-1) + 217.60.76.167 (ru-edge-1) — the LIBREDTAIL staging /16 block keeps touching the mint path, 34.81.140.39 (Google SG), 139.59.136.184 and 46.101.1.225 (DigitalOcean).
• Benign/research — Censys-class 71.6.155.70 and 71.6.232.24 (8 sensors each, handshake-shaped), 91.224.92.45 (8 sensors, 8 events), 94.183.174.99 (8 sensors, 29 events) held benign shapes. No benign-listed operator crossed into hostile behavior.

Standing actors (persistence check)

• SI-CENSUS (102.220.163.241) — present every recent window; hoard 114 per 6-day history, 16 new this window; volume up (~5,661 events across 4 sensors vs 2,931 across 3 last window).
• 45.138.12.x (Tc Datacenter LT) — tenth-plus window; .16/.35/.51 silent this window while .10 debuted the AI/LLM arm.
• REGISTRY-HUNT DigitalOcean pool — present every window on record; walkers minted ~8 singles, l9scan arm idle.
• 137.23.38.53 (SES-QUOTA-PROBE) — fourth consecutive use window, identity-only each time.
• 194.180.49.41 (MEVSPACE) — recurring census arm (1,136 events on control-1, 4 mints) plus light presence on 2 more sensors.
• Techoff blocks (195.178.110.x BG) — .159 ran 385 events on canary-farm-1 (ipsum:1); .68 touched 3 sensors (93 events).
• 45.94.31.16 (1337 Services) — second consecutive xmlrpc window, doubled volume.
• 35.232.76.162 (GIT-HARVEST) — second consecutive window, same shape.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-11-02 07:32:00 → 2026-11-03 07:33:42 UTC

Fingerprint field ssh.hassh, destination port 22 · 127,293 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 96,064, bahrain-sponge-01-ts 61,697, sensor:bahrain-sponge-01-ts 61,697, frantech-ts 12,344, sensor:frantech-ts 12,344, sensor:ru-vps-01-ts 12,014

Flagged sweeps (2) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 2,644 sessions from 364 source IPs across 186 networks in 59 countries, port 22, avg 4,904 B/session. Networks: AS16276 OVH SAS, AS8075 Microsoft Corporation, AS7713 PT Telekomunikasi Indonesia, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS31898 Oracle Corporation. Busiest sources: 103.52.115.189, 102.223.92.101, 182.253.79.194, 112.123.228.180, 160.251.215.51. Last 7 days: 10-28 615 IPs, 10-29 657 IPs, 10-30 583 IPs, 10-31 455 IPs, 11-01 610 IPs, 11-02 496 IPs, 11-03 32 IPs.
• 184781a96d49ee509a431028a8d5022a — client banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, 2,643 sessions from 185 source IPs across 97 networks in 39 countries, port 22, avg 4,508 B/session. Networks: AS12714 PJSC MegaFon, AS9198 JSC Kazakhtelecom, AS45090 Shenzhen Tencent Computer Systems Company Limited, AS51167 Contabo GmbH, AS9829 National Internet Backbone. Busiest sources: 80.68.76.181, 88.204.245.66, 117.247.81.45, 115.190.174.152, 122.51.204.140. Last 7 days: 11-02 185 IPs, 11-03 6 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: OPSSH-UBUNTU-SWEEP is the cycle's new registration — banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, first seen 11-02 09:40, flagged dispersed at 185 IPs / 97 networks on day one, then 6 IPs on 11-03. LIBSSH-MASSSWEEP contracted to 364 IPs (−263) after №70's rebound. GO-SSH-SWEEP concentrated: 37,208 sessions (+7,262) from 52 IPs (−22) on 13 networks — fewer sources, more sessions per source, still the largest non-CTL fingerprint. GO-SPRAY-SWEEP collapsed to 15 IPs (−125) after №70's 140. GO-SCATTER-SWEEP held 12,779 sessions at 27 IPs. CTL-MASS-SSH held control-1 at 33,329 sessions — still the fleet's largest single-fingerprint load, and control-1 still takes the most inbound sessions (61,697). One new below-threshold fingerprint: 1bcedb0742d0… (banner ssh-2.0-go, 29 sessions, 1 source).

Fleet Observations

• Volume shift, explained. The canary sensors ran far under baseline because №70's heavies idled: XFF-SWARM contributed 0 forgeries, WIDE-CONFIG-CENSUS, METADATA-HUNT's runners, and SWAGGER-SWEEP were absent. ru-edge-1 −85%, lauterbourg-01-ts −68%, canary-farm-1 −66%, netcup-ts −59%, sponge-01-ts −43%, ai-devbox-1 −2%. control-1 rose +78% on SI-CENSUS (2,687) plus 194.180.49.41 (1,136) plus the walker pool. frantech-ts held +1% on one cause: MEGA-DICTIONARY's new host replayed 14,864 paths (7,978 + 6,956 events in the 01:00–03:00 UTC burst buckets). Coverage is verified: every sensor's latest event in v_full lands 10:53–12:32 UTC on 11-03, so the drops are real, not sync gaps. Window overlap applies as always: events between digest runs appear in two digests.
• Canary economics. Digest issued rows: 72 mints (canary-farm-1 27 from 15 IPs, ai-devbox-1 22 from 14, control-1 17 from 9, ru-edge-1 6 from 6). Failures: 16 — canary-farm-1 8×400, ai-devbox-1 3×400 plus 2 without captured error detail, control-1 2×400, ru-edge-1 1×400; no 401s, no key errors. The 400s remain upstream pacing rejections on hostile /.env volume. The Tracebit funnel (client-side window trim, as in prior cycles) counts 63 credentials to 34 collectors, 4 used in AWS, 13 use events: 7 sts:GetCallerIdentity successes and 6 denied enumeration calls. The digest's 72 and the funnel's 63 differ by window-trim semantics, as every cycle.
• Attribution/TLS posture. 3,763 requests carried X-Forwarded-For; multi-entry chains 0; XFF-ignored 1; single-entry forgery 0 — the third straight quiet window after №69's 593. TLS ran http-led on every node; canary-farm-1's HTTPS (2,849) nearly matched its HTTP (2,942). Top vhost Host headers: sso.rightabouteverything.show 3,449, inference.fapthropic.com 2,860, cloud.wafflehouseindex.us 795 — and kiteworks.rightabouteverything.show 706 on lauterbourg-01-ts: the retired Kiteworks TLS name still draws steady SNI traffic from stale wordlists.
• Control-1 discovery velocity. 51 days live (first event 2026-09-12 07:59 UTC). The window's full day (11-03) ran 4,625 events / 145 unique IPs — inside the 7-day band (1,179–5,138 events, 104–155 IPs) and +78% against the 7-day event average, on the two census operators. The network layer still points the fleet's heaviest single-fingerprint SSH load at this node (4e066189c3bb… CTL-MASS-SSH, 33,329 sessions).
• First-seen caveats. All first-seen rows in this digest share one sync-batch timestamp (02:15:35 stored), so they are an inventory, not a timeline. The first-seen .exe/.ps1 dropper paths belong to MEGA-DICTIONARY's replay, attributed by journey query, not by the table's timestamps.
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 505 sources sent credentials → 387 got a shell (77%) → 326 ran a command (84% of shell-getters, 65% of sources). Event level: 13,835 credential attempts → 5,711 accepted logins → 14,542 commands (255% of accepted logins go on to run something). Telnet (commodity IoT botnets): 455 attempts.

New commands: zero (0 of 5,461 distinct) — a second quiet window; operators re-ran known tooling only. New credential pairs: 0 of 4,778 offered. Concentration is unchanged and belongs to one family: 345gs5662d34/345gs5662d34 599 attempts plus root/3245gs5662d34 457 (1,056 combined), then commodity pairs (root/123456 80, pi/raspberry 77, user/wasd 71).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (3,686 + 3,682 events from 6 and 5 IPs, example source 109.160.32.47 — the same /24 as GO-SSH-SWEEP's busiest sweep sources), the chattr -ia .ssh + SSH-key-plant pair (622 + 518 events from 286 and 244 sources, example source 106.243.155.71), and the GPU-discovery strings (nvidia-smi/lspci legs, 71 events each from 2 IPs, example source 2.57.122.238) all held steady.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 77 endpoints on 22 hosts, 2515 command references and 640 download attempts since 2026-09-18T10:45
• served payloads: 22 distinct artifacts over HTTP 2xx from 7 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37)
• this window: 0 endpoints first seen, 2 active; 32 endpoints seen in the last 7 days remain current
• inventory generated 2026-11-03T07:20:34Z

New this window

No endpoint first seen this window.

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: no new endpoints this window, and no new served payloads — a second quiet window in a row for the staging infrastructure. The long-lived kla.sh fetcher endpoint (live since 2026-09-18, 522 command events this window, still 0 downloads served) and the LIBREDTAIL staging /16 dropper path https://217.60.102.5/sh (18 attempts from 9 IPs, serves nothing) were the only active endpoints.

Gaps / Next Collection

1. 85.121.176.200's next move. The enumeration attempts were denied; watch for a retry from this IP, a second use IP, and any success beyond sts:GetCallerIdentity. A write-shaped call (RunInstances class) is the escalation line.
2. MEGA-DICTIONARY circulation test. The manifest grew +667 under a third host. A fourth host replaying the grown list establishes active circulation; a repeat from 146.70.224.67 shows a schedule. No payload-level anti-join was run this window (frantech-ts v_full retention is shallow).
3. ENV-FANOUT's promotion signals. The pair ran identical templates ~13 h apart. A third IP, any mint, or the forged Chrome/143 UA reaching a canary node moves this from watch to standing.
4. 46.148.227.131's label versus behavior. The self-declared non-intrusive scanner minted 7 canaries. If a Tracebit alert ever names it, the honest UA becomes an attribution anchor — watch its future AWS side.
5. OPSSH-UBUNTU-SWEEP's trajectory. 185 IPs on day one, 6 on day two. Whether it returns to dispersed scale or was a one-day burst shows whether it joins the standing-sweep set.
6. SI-CENSUS's 114-credential hoard. Sixteen new canaries this window, zero AWS use ever observed. Any alert against 102.220.163.241 names the operator's work schedule.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-03.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-03.md