FLUX FLEET — INTEL BRIEFING №70

Period: 2026-11-01 07:33 – 2026-11-02 07:33 UTC (24h, day 68 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 68-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the +4 h ingest cast applies (see Fleet Observations).

BLUF

SES-QUOTA-PROBE's collector 137.23.38.53 minted a canary credential on canary-farm-1 at 12:28 stored and validated it in AWS within the same window. The window's whole use side is 2 calls, both successful sts:GetCallerIdentity — the third consecutive window with same-window mint→use. RECONX-L2S returned with a second operator (45.115.27.37, Contrust Solutions S.R.L. MD) on a second node (lauterbourg-01-ts) and POSTed a React-Flight RCE payload (process.mainModule.require) at the php2shell surface. MEGA-DICTIONARY's №62 replay host returned: 103.125.233.17 (xTom HK) replayed the largest wordlist on record — 14,197 unique paths in 2 m 23 s, ≈100 paths/s, +421 paths over the running manifest. The hoards grew while the use side stayed thin — SI-CENSUS minted 35 (104 per 6-day history), REGISTRY-HUNT minted 9 in its fourth consecutive window with zero AWS use, and new SWAGGER-SWEEP minted 5 in 17 seconds on ru-edge-1.

Key Judgements

1. Same-window validation is now routine hostile behavior, and this window's only use was pure identity checking. 137.23.38.53 minted on canary-farm-1 at 12:28:34 stored and ran 2 successful sts:GetCallerIdentity calls; the funnel moved 74 credentials to 26 collectors and nothing else surfaced in AWS. (High confidence on the events — the Tracebit pull carries both use rows; Moderate on intent — GetCallerIdentity leaks account identity at most, and SES-QUOTA-PROBE's earlier shape was 72 denied ses:GetSendQuota calls, so quota probing is the escalation to watch.)
2. RECONX-L2S is a rotating-operator kit with an exploitation arm, not a single-IP curiosity. The second operator (45.115.27.37, Contrust MD) ran the same /reconx-* marker class against a second node and POSTed the React-Flight body that pairs with the kit's census — mint-and-enumerate in №69, exploit delivery in №70. (High confidence on the two sightings — the marker is the template link; Moderate on organization — the two operators share only the marker.)
3. Credential hoarding now concentrates in two named pools, and the mint→use gap widened. SI-CENSUS holds 104 canaries per 6-day history after a 33-mint burst on one sensor, REGISTRY-HUNT added 9 across 4 sensors, and 74 new-window credentials produced 2 use events. (High confidence on the counts — direct query and Tracebit numbers; Moderate on the hoard reading — №67–№68 showed use can lag mint by a day.)
4. The deception surface held every stage it was fed. GIT-HARVEST's git walk drew 152 fake-git answers, MEGA-DICTIONARY's 14,197-path replay produced 14,202 not-handled results, LLM-ENDPOINT-PROBE's 22 chat POSTs met trap 200s with no model behind them, and SWAGGER-SWEEP's 68-family run fed 5 canaries into a watched drain. (High confidence — direct result-tag counts.)

Active Campaigns (day 68 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — SAME-WINDOW MINT→USE AGAIN — Hostile, active

• Actors: 26 collector IPs took 74 credentials (digest issued rows: 78 — ai-devbox-1 42 from 8 IPs, ru-edge-1 17 from 14, canary-farm-1 10 from 8, control-1 9 from 7). Use IP: 137.23.38.53 (SES-QUOTA-PROBE) only.
• TTPs: unchanged — /.env-class mints to hostile collectors, then AWS-side validation. Failures: 46×400 upstream rejections in pacing singles (canary-farm-1 21, control-1 10, ru-edge-1 8, ai-devbox-1 6) plus 2 without captured error detail; no 401s, no key errors.
• Assessment: every issued row is an operational credential within hours. The imbalance is the story this window: 74 minted, 2 used, and the two largest hoards stayed silent on the AWS side.

SES-QUOTA-PROBE ⟳ — RETURN AFTER TWO IDLE WINDOWS — Hostile, active

• Actors: 137.23.38.53 (hosting unresolved; fleet-visible since 10-17 as a canary-farm-1 collector — its 10-17/18 mints sit outside the 6-day window).
• TTPs: minted canary-farm-1 12:28:34 stored under forged Chrome/124.0.0.0 Win64, then ran 2 use events, both successful sts:GetCallerIdentity — one against the fresh mint, one against a held canary. No denial batches this window.
• Assessment: the №57 shape was 72 denied ses:GetSendQuota calls. Identity success precedes quota work in this actor's arc; a return to GetSendQuota batches on the fresh mint is the expected next step, and any success beyond identity is a finding.

RECONX-L2S ⟳ — SECOND OPERATOR, EXPLOIT ARM — Hostile, active

• Actors: 45.115.27.37 (Contrust Solutions S.R.L. MD), lauterbourg-01-ts only, 17:26:28–17:26:41 stored. №69's operator 217.60.76.22 was absent.
• TTPs: 267 events. Eleven fetches of the /html/.git/reconx-3805bb28ac4c marker class under 5 rotating browser UAs. One POST / with a multipart body whose payload head reads {"_response":{"_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"},"_prefix":"function rq(m){try{return process.mainModule.require (boundary 89c8c87224abd4dedc911c2b90c6452ba12ffc1d092d645e732e80c64788; remainder omitted) — the React-Flight / Next.js Server Actions RCE shape. Results: php2shell-root, telescope-shell, php2shell-login-attempt, the rest tarpit and 404-class. Zero mints: the node ships TRACEBIT_API_KEY= empty, and no canary sensor saw this IP.
• Assessment: the kit pairs mint-and-enumerate (№69, 15-op AWS enumeration) with exploit delivery (№70). The React-Flight body class is the same family AI-EXEC-HUNT rode to 41 mints on №64 via the vite-fs surfaces. The fleet's PHP/runtime traps answered with tarpit and 404-class results; the escalation signal is the same body against a canary node's /@fs surfaces.

REGISTRY-HUNT / LeakIX (l9scan template + docker-registry walkers) ⟳ — FOURTH MINT WINDOW, ZERO USE — Hostile, active

• Actors: 37 IPs ran the registry-catalog leg fleet-wide. Seven minted under wrapped l9scan/2.0…(+https://leakix.net) UAs 20:57–22:31 stored plus 06:14 stored 11-02: 139.59.143.102 ×2 (canary-farm-1), 209.38.248.17 ×2 (ru-edge-1), 209.97.180.8 ×2 (control-1 + canary-farm-1), 143.110.213.72 (control-1), 209.38.208.202 (ai-devbox-1), 68.183.180.73 (canary-farm-1).
• TTPs: the 12-step walk is unchanged; its docker-registry legs produced the digest's docker-registry-tags/manifest spikes on control-1, frantech-ts, canary-farm-1, and netcup-ts, and its whm/sftp-config legs fed control-1's minor spikes.
• Assessment: four consecutive mint windows against two use windows (№66, №68). The 9 fresh canaries join the standing pool; delayed AWS operations and a second SSH-side use remain the watch.

SI-CENSUS ⟳ — MINT ESCALATION — Hostile, active

• Actors: 102.220.163.241 (VPS Dedicated LLC, SI) — 2,931 events across 3 sensors over ~20 h (ai-devbox-1 871/539 paths, control-1 1,032/511, canary-farm-1 1,028/511). Single-IP operation.
• TTPs: per-sensor 511-path directory-fanout walks with pscan-<8-hex>-nonexistent.txt markers. Mint burst: 33 on ai-devbox-1 between 09:54 and 10:39 stored under forged Chrome/126 — the digest's 3.7× issued spike — then one mint per sensor 03:49–05:42 stored 11-02 under a blank UA. Its walk owns control-1's phpinfo-error (54 of 63) and sftp-config-error (24 of 33) spike mass.
• Assessment: the fleet's largest hoard — 104 per 6-day history, zero observed AWS use. One IP, one sensor, 45 minutes is now its mint signature; the pool is big enough that any future use will move the funnel.

MEGA-DICTIONARY (dropper-URL dictionary replay) ⟳ — №62 HOST RETURNS, WORDLIST GREW — Hostile, active

• Actors: 103.125.233.17 (xTom, HK) — the №62 replay host, back after seven idle windows — frantech-ts only, 01:47:46–01:50:09 stored; control-1 then, frantech-ts now. 135.136.19.27 (№68–№69) absent — no third pass, no schedule shown.
• TTPs: 14,207 GETs against 14,197 unique paths in 2 m 23 s under the Seagate Personal Cloud IoT user agent — ≈100 paths/s, the fleet's fastest replay and the largest wordlist on record (prior high 14,154, №68; +421 over №62's anti-joined 13,776 manifest). Results: 14,202 not-handled, plus the same 5 decoy-single tag hits earlier replays carried (gravitysmtp-miss, llm-endpoint-ollama-ps, observability-profiler-index, exchange-powershell-pre-auth, llm-endpoint-models-list); 0 mints. No anti-join was run this window (frantech-ts v_full retention is shallow).
• Assessment: a repeat host with a grown wordlist — the shared artifact is maintained, not just circulated. The replay alone explains frantech-ts's −2% hold against a fleet-wide drop.

SWAGGER-SWEEP (OpenAPI + env census) ⚠ NEW — Hostile, active

• Actors: 34.96.41.148 (Google LLC, BE), ru-edge-1 only, 12:58:16–13:00:58 stored.
• TTPs: 257 events / 202 paths / 68 trap families in 2 m 42 s under a bare stripped Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 UA. Five mints in 17 seconds: /.env issued plus openapi-spec-json-issued at /swagger.json, /api-docs, /openapi, /api/swagger.json, with actuator/health/login/graphql/wp-config legs behind them.
• Assessment: the second-highest family count for a sub-3-minute run (OMEGA's record is 107, WEBSIPHON hit 71 in 7.3 s). Five fresh canaries entered the drain; AWS use of them is the immediate check, and a second IP or node would promote the census to standing.

GIT-HARVEST (git-internals walker) ⚠ NEW — Hostile, watch

• Actors: 35.232.76.162 (Google LLC, US), 7 sensors, 164 events.
• TTPs: honest UA Mozilla/5.0 (compatible; harvest/1.0). Per-leg 39 events / 28 paths in 17–19 s (ai-devbox-1 04:19, control-1 03:08 stored), canary-farm-1 79 events 12:11→23:39. Results: 152 fake-git, 7 not-handled, 4 fake-git-miss, 1 fake-git-error. 0 mints, 0 POSTs.
• Assessment: the git-internals walk template (MEVSPACE-GITWALK class) under an honest self-label — the same honest-label pattern as GIT-VAULT's gitdump/1.0. The fake git surfaces absorbed every step; a mint or a second IP promotes it.

GOWEB-PENTEST (phpMyAdmin login-surface hammer) ⟳ — REPEAT OPERATOR, NEW NODE — Hostile, active

• Actors: 103.242.78.199 (hosting unresolved) — the №50–№51 operator returning (farm then, lauterbourg-01-ts now; the campaign's second repeat IP after 172.104.173.62), 23:08:25–23:09:12 stored.
• TTPs: the registered 151-event phpmyadmin-login unit on 1 path in 47 s under the honest Go Web Pentest Tool UA. Owns the node's 7.0× phpmyadmin-login spike.
• Assessment: the same 151-event unit the registry has tracked for 22 windows, now on a fourth node class and with a second returning IP. The fake phpMyAdmin served forms throughout; nothing captured.

AKAMAI-VHOST-SCAN (vhost + admin-surface census) ⟳ — RETURN, TWO NEW OPERATORS — Hostile, active

• Actors: 104.199.202.179 (Google LLC, TW) 20:28:35–48 stored; 139.162.184.146 (Akamai Connected Cloud, DE) 09:55:43–09:56:15. Both lauterbourg-01-ts only.
• TTPs: the ~30-second vhost/admin census (nmaplowercheck, /sdk, /cgi-mod/header_logo.cgi, applinks manifest, CFIDE, coldfusion). .179 ran forged Chrome/153 — a version that does not exist yet, which dates the forgery — plus 3 graphql-introspection POSTs (/graphql, /api/graphql, /v1/graphql). .146 ran a blank UA and 1 POST /sdk. 0 mints, no captured bodies.
• Assessment: the decoy-fingerprinting census continues under cloud-provider rotation. The GraphQL probes are new for the class; the fleet answered 404-class.

LLM-ENDPOINT-PROBE ⟳ — DEBUT IP RETURNS — Hostile, active

• Actors: 104.168.115.214, lauterbourg-01-ts only, honest UA AutoGenX-Engine/9.1, 06:57 stored 11-01 → 06:11 stored 11-02. Single IP, single sensor.
• TTPs: 22 POST /api/chat (the digest's new llm-endpoint-ollama-chat tag, all 200, bodies not captured), /v1/models ×6, /api/tags ×5, /system_stats, /v2/health/ready, and a 00:06:39 burst across generation endpoints (/v1/images/generations, /v1/videos, /v1/audio/speech, /v1/audio/transcriptions, /v1/audio/translations, /openai/v1/images/generations).
• Assessment: the client treats the LLM decoys as live endpoints and maps what they serve. The chat endpoint answers 200 with no backend; escalation to watch is volume, a second IP, or any captured request body.

CREDSWEEP (exhaustive .env-variant census) ⟳ — NINTH WINDOW — Hostile, active

• Actors: 45.138.12.16 (Tc Datacenter, LT) on all 8 sensors — 919 events — plus a ru-edge-1 mint at 12:49 stored under a Chrome/124 X11 forgery, its first mint since №68. 45.138.12.35 ran canary-farm-1 (387 events). 45.138.12.51's ai-devbox-1 mint at 04:24 stored is №69-window overlap. 194.180.49.41 (MEVSPACE) ran 9 events on 5 sensors.
• TTPs: unchanged per-sensor .env-variant walks from one /24.
• Assessment: ninth window, one new-window mint, still zero observed use from the class.

CONFIGBUNDLE-SWARM (multi-pool config-bundle census) ⟳ — POOLS LIGHT — Hostile, active

• Actors: 194.5.53.x — ≈30 IPs across 4 sensors, 3 mints (.186 ru-edge-1 06:48 python-requests/2.34.2, .177 ru-edge-1 19:57 Safari/16 forgery, .190 control-1 15:23 Chrome/105). 163.5.241.x — 16 IPs across 4 sensors, 0 mints. 2–4 events per IP.
• Assessment: the swarm model at low intensity. Every mint is a drain candidate; AWS use is the check.

CONFIG-SWEEP (single-minute config census) ⟳ — SAME OPERATOR REPEATS — Hostile, active

• Actors: 93.152.209.6 (Omniline Investment s.r.o., BG), canary-farm-1.
• TTPs: second consecutive window — kmonbase random-stem markers plus the 40-family config census in the kill-chain rows; /.env rejected 400. Lighter than №69's 94-event pass.
• Assessment: the kmonbase template holds this operator for now; a third window makes it the template's standing holder.

Light watchers

• KEYDROP-SCANS — 172.237.7.18 minted on ru-edge-1 at 05:49 stored under Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about); — the fourth IP on record for the 2-event walk.
• 69.197.186.50 — 4 mints on 4 sensors 11:38–14:10 stored under forged Chrome/39 macOS (a 2014 build).
• 37.19.197.153 — 2 mints (ai-devbox-1 19:39, ru-edge-1 23:53 stored) under forged Chrome/143 — a version that does not exist yet.
• 150.241.66.127 — 6 mints (ai-devbox-1 3, control-1 3) 19:56–19:59 stored under a bare truncated Win64 UA; 10 per 6-day history since 10-28.
• Single-mint collectors under antique or forged UAs: 103.136.147.226 (UCBrowser Android 4.4, ×2 ru-edge-1), 185.231.102.30 (curl/7.88.1, ×2 ru-edge-1), 109.107.229.169 (bare Mozilla/5.0), 121.121.152.6 and 168.110.205.237 (Chrome/81), 101.200.124.12 (iPhone 18.3 forgery), 4.154.139.59 (blank UA, present on 3 sensors), 136.144.42.3 (python-requests — the ADMINER-SWARM pool block), 195.177.94.77 (UCBrowser, control-1), 192.54.244.180 (Safari 17.4, control-1), 96.126.130.106 (bare truncated Win64).
• Tarpit loopers — 89.248.172.33 (7 sensors, 375), 93.174.93.12 (6 sensors, 321), 91.92.40.12 (4 sensors, 35); 45.198.224.125 touched all 8 sensors (77 events — the TOKEN-CRAWLER /24).
• frantech-ts FreeSWITCH probes — 212.28.186.169 and 189.206.12.25, 3 events each on /getstatus/reload_freeswitch/api status (the node's first-seen path) under bare Mozilla/5.0.
• Benign/research — Censys-class 71.6.155.70 (8 sensors, 8 events) and 71.6.232.24 (3 sensors), plus 146.190.134.221 (8 sensors, 23 events) held their /-handshake shapes. No benign-listed operator crossed into hostile behavior.

Standing actors (persistence check)

• REGISTRY-HUNT DigitalOcean pool — present every window on record; minted in four consecutive windows.
• 45.138.12.x (Tc Datacenter LT) — ninth window; .16 ran all 8 sensors and minted.
• SI-CENSUS (102.220.163.241) — hoard at 104 per 6-day history, 35 new this window.
• Techoff blocks (195.178.110.x BG) — .159 ran 395 events on canary-farm-1 (ipsum:1), .218 drove the honeypot's GPU-discovery legs.
• 93.152.209.6 (Omniline BG) — second window as the CONFIG-SWEEP/kmonbase holder.
• TechTies pile — 93.152.221.96 static at 1,080 per 6-day history; the injection side stayed idle.
• 194.180.49.41 (MEVSPACE) — recurring light census arm across 5 sensors.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-11-01 07:33:00 → 2026-11-02 07:34:05 UTC

Fingerprint field ssh.hassh, destination port 22 · 139,321 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 106,970, bahrain-sponge-01-ts 69,623, sensor:bahrain-sponge-01-ts 69,623, sensor:sponge-01-ts 14,874, sponge-01-ts 14,874, contabo-sponge-01-ts 13,761

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 5,038 sessions from 627 source IPs across 272 networks in 73 countries, port 22, avg 4,897 B/session. Networks: AS8075 Microsoft Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS4766 Korea Telecom, AS31898 Oracle Corporation, AS16276 OVH SAS. Busiest sources: 103.151.60.214, 165.154.64.119, 43.132.150.89, 202.165.26.170, 180.93.172.213. Last 7 days: 10-27 653 IPs, 10-28 615 IPs, 10-29 657 IPs, 10-30 583 IPs, 10-31 455 IPs, 11-01 610 IPs, 11-02 198 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 2,874 sessions from 140 source IPs across 68 networks in 31 countries, port 22, avg 4,941 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS43059 IT Support Services Team Limited, AS51167 Contabo GmbH, AS137718 Beijing Volcano Engine Technology Co., Ltd.. Busiest sources: 175.196.78.7, 178.22.25.59, 8.130.97.165, 8.138.45.99, 8.138.210.122. Last 7 days: 10-27 183 IPs, 10-28 119 IPs, 10-29 164 IPs, 10-30 20 IPs, 10-31 101 IPs, 11-01 141 IPs, 11-02 15 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 29,946 sessions from 74 source IPs across 28 networks in 20 countries, port 22, avg 5,224 B/session. Networks: AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS16276 OVH SAS, AS49635 Cloudi Nextgen Sl. Busiest sources: 109.160.32.179, 109.160.32.154, 77.239.124.150, 109.160.32.108, 109.160.32.121. Last 7 days: 10-27 53 IPs, 10-28 48 IPs, 10-29 58 IPs, 10-30 83 IPs, 10-31 79 IPs, 11-01 73 IPs, 11-02 46 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: LIBSSH-MASSSWEEP rebound to 627 source IPs across 272 networks (5,038 sessions, +1,525) — its second-widest day on record, short of the 673-IP peak. GO-SPRAY-SWEEP rose again (101→140 source IPs, third consecutive rise; its record is 192). GO-SSH-SWEEP shed 3,702 sessions to 29,946 at 74 IPs and stayed the top fingerprint on 5 of 8 nodes; its busiest sources again sit in 109.160.32.x, and the 77.239.124.x block again pairs with the frantech-ts uname operators (example source 77.239.124.2 below). CTL-MASS-SSH held control-1 at 33,279 sessions — still the fleet's largest single-fingerprint load. GO-SCATTER-SWEEP moved +2,594 sessions to 12,913 at 29 IPs. One new fingerprint: 184781a96d49… (banner ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20), 38 sessions from 27 IPs across 23 networks in a one-hour burst 17:30–18:34 on 11-01 — below sweep thresholds, unnamed, watch for a repeat.

Canary credentials

Summary

2 Tracebit alert(s) fired in the window (2 use events across 2 credentials). Fleet sensors minted 74 credentials to 26 collector IPs; 2 credential(s) reached AWS. Use outcomes: 2 success. 2 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 93.152.221.96: 1080 mints, 2026-10-26 05:46 → 2026-10-27 21:29
• 102.220.163.241: 104 mints, 2026-10-26 17:25 → 2026-11-02 05:42
• 136.65.203.248: 41 mints, 2026-10-26 19:00 → 2026-10-26 19:00
• 34.95.21.228: 41 mints, 2026-10-28 18:17 → 2026-10-28 18:17
• 45.148.10.120: 12 mints, 2026-10-28 13:34 → 2026-10-31 04:23
• 150.241.66.127: 10 mints, 2026-10-28 10:00 → 2026-11-01 19:59
• 176.123.5.6: 9 mints, 2026-10-29 02:21 → 2026-10-29 02:21
• 23.132.164.201: 9 mints, 2026-10-28 17:55 → 2026-10-31 21:25
• 46.151.178.15: 8 mints, 2026-10-27 00:19 → 2026-10-29 00:56
• 45.138.12.16: 7 mints, 2026-10-28 03:14 → 2026-11-01 12:49
• 162.35.242.53: 6 mints, 2026-10-29 15:00 → 2026-10-30 09:33
• 105.112.190.152: 5 mints, 2026-10-26 06:26 → 2026-10-26 07:47
• 105.112.24.243: 5 mints, 2026-10-28 09:46 → 2026-10-28 10:41
• 154.162.45.255: 5 mints, 2026-10-31 15:45 → 2026-10-31 16:29
• 202.65.238.233: 5 mints, 2026-10-29 07:43 → 2026-10-29 07:48
• 45.138.12.51: 5 mints, 2026-10-27 02:04 → 2026-11-01 04:24
• 139.59.143.102: 4 mints, 2026-10-28 20:59 → 2026-11-01 22:31
• 140.245.97.208: 4 mints, 2026-10-28 00:50 → 2026-10-28 00:54
• 143.110.217.244: 4 mints, 2026-10-26 21:51 → 2026-10-31 21:21
• 193.32.248.165: 4 mints, 2026-10-29 22:37 → 2026-10-29 22:53
• 193.47.62.29: 4 mints, 2026-10-31 10:44 → 2026-10-31 10:51
• 206.81.24.74: 4 mints, 2026-10-28 21:21 → 2026-10-29 20:56
• 213.209.159.154: 4 mints, 2026-10-26 22:00 → 2026-10-27 11:08
• 45.138.12.6: 4 mints, 2026-10-28 16:49 → 2026-10-30 14:19
• 64.225.75.246: 4 mints, 2026-10-28 21:37 → 2026-10-31 20:55
• 69.197.186.50: 4 mints, 2026-11-01 11:38 → 2026-11-01 14:10
• 93.123.109.107: 4 mints, 2026-10-29 17:03 → 2026-10-29 22:21
• 130.12.180.77: 3 mints, 2026-10-27 06:26 → 2026-10-27 06:29
• 147.182.149.75: 3 mints, 2026-10-28 21:30 → 2026-10-29 19:21
• 159.89.12.166: 3 mints, 2026-10-26 21:48 → 2026-10-31 21:19
• 185.177.72.29: 3 mints, 2026-10-28 19:50 → 2026-10-28 19:50
• 209.38.248.17: 3 mints, 2026-10-26 21:12 → 2026-11-01 21:42
• 209.97.180.8: 3 mints, 2026-10-31 20:55 → 2026-11-01 21:09
• 217.60.76.167: 3 mints, 2026-10-26 05:25 → 2026-10-26 20:44
• 23.239.27.128: 3 mints, 2026-10-27 11:54 → 2026-10-27 17:27
• 64.23.218.208: 3 mints, 2026-10-26 21:12 → 2026-10-30 21:03
• 74.0.42.13: 3 mints, 2026-10-31 00:12 → 2026-10-31 00:13
• 8.217.152.4: 3 mints, 2026-10-27 17:04 → 2026-10-28 07:36
• 87.192.41.180: 3 mints, 2026-10-30 15:51 → 2026-10-30 21:12
• 93.123.109.247: 3 mints, 2026-10-30 20:20 → 2026-10-30 20:20

Attribution notes: the window's only use side belongs to SES-QUOTA-PROBE (137.23.38.53 — minted at 12:28 stored, validated with 2 successful GetCallerIdentity calls, one against a held canary). REGISTRY-HUNT's 9 l9scan mints, SI-CENSUS's 35, and SWAGGER-SWEEP's 5 all stayed idle — three holding pools the next windows must watch.

Fleet Observations

• Volume shift, explained. The window was quiet by design of the adversaries, not by sync failure: every canary sensor ran below its 7-day baseline (ai-devbox-1 −62%, canary-farm-1 −77%, lauterbourg-01-ts −78%, ru-edge-1 −76%, control-1 −13%, netcup-ts −43%, sponge-01-ts −30%) because №68–№69's heavies — the 199-IP XFF-SWARM wave, WIDE-CONFIG-CENSUS, METADATA-HUNT's runners, and the single-IP mega-censuses — all stayed idle. frantech-ts held at −2% (15,053 events) on one cause: MEGA-DICTIONARY's new operator replayed 14,197 paths (14,254 events in the 01:00 UTC hour). Coverage is verified: every sensor's latest event in v_full lands 11:02–12:26 stored on 11-02, so the drops are real, not sync gaps. Window overlap applies as always: events between digest runs appear in two digests; the ai-devbox-1 issued spike's earliest rows (04:24, 04:30) are №69-window seam.
• Canary economics. Digest issued rows: 78 mints (ai-devbox-1 42 from 8 IPs — SI-CENSUS 33 of them; ru-edge-1 17 from 14; canary-farm-1 10; control-1 9). Failures: 47 — 46×400 upstream rejections in pacing singles (canary-farm-1 21, control-1 10, ru-edge-1 8, ai-devbox-1 6) plus 2 without captured error detail; no 401s, no key errors. canary-farm-1's 21×400 is its 3.1× tracebit-http-error spike — hostile /.env volume (SI-CENSUS, 45.138.12.16, 93.152.209.6) hit the mint path faster than upstream pacing accepts. The Tracebit funnel (client-side window trim) counts 74 credentials to 26 collectors, 2 used in AWS, 2 use events, both GetCallerIdentity successes; the digest's 78 and the funnel's 74 differ by window-trim semantics, as in prior cycles. netcup-ts, sponge-01-ts, and frantech-ts mint 0 by design (certless); lauterbourg-01-ts ships TRACEBIT_API_KEY= empty, so its absence is config, not failure.
• Attribution/TLS posture. 1,642 requests carried X-Forwarded-For; multi-entry chains 0; XFF-ignored 6; single-entry forgery 2 — back to baseline after №69's 593. Both forgeries trace to 162.243.83.227 on ai-devbox-1 at 03:27 stored, claiming header source 1.2.3.4 — the №11 benign-listed method-fingerprint scanner exercising headers, not a new swarm. Quote the socketPeer, never the claimed source, for anything in an XFF wave. TLS ran http-led on every node; lauterbourg-01-ts carried 678 HTTPS events; top vhost Host headers after the bare IPs: sso.rightabouteverything.show 1,044 and cloud.wafflehouseindex.us 862.
• Control-1 discovery velocity. 51 days live (first event 2026-09-12 07:59 UTC). The window's full day (11-01) ran 1,179 events / 104 unique IPs; the partial 11-02 day ran 2,098 / 155. The 7-day band runs 1,179–5,138 events with unique IPs at 104–155. The ramp holds, and the network layer still points the fleet's heaviest single-fingerprint SSH load at this node (4e066189c3bb… CTL-MASS-SSH, 33,279 sessions).
• First-seen caveats. All first-seen rows in this digest share one sync-batch timestamp (02:16:15 stored), so they are an inventory, not a timeline. The SI-CENSUS marker paths and the RECONX marker path above are attributed by direct journey queries, not by the table's timestamps.
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 505 sources sent credentials → 378 got a shell (75%) → 319 ran a command (84% of shell-getters, 63% of sources). Event level: 8,889 credential attempts → 4,487 accepted logins → 10,675 commands (238% of accepted logins go on to run something). Telnet (commodity IoT botnets): 526 attempts.

New commands: zero (0 of 2,650 distinct) — a quiet window; operators re-ran known tooling only. New credential pairs: 0 of 3,052 offered. Concentration is unchanged and belongs to one family: 345gs5662d34/345gs5662d34 585 attempts plus root/3245gs5662d34 443 (1,028 combined), then commodity pairs (root/123456 64, pi/raspberry 51, user/wasd 40).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (2,605 + 2,278 events from 6 and 5 IPs, example source 77.239.124.2 — the same /24 as GO-SSH-SWEEP's fourth-busiest sweep source), the chattr -ia .ssh + SSH-key-plant pair (604 + 504 events from 278 and 243 sources), and the GPU-discovery strings (lspci | grep VGA legs, 276 events each from 4 IPs, example source 195.178.110.218 — a Techoff BG address) all held steady.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 77 endpoints on 22 hosts, 2507 command references and 640 download attempts since 2026-09-18T10:45
• served payloads: 22 distinct artifacts over HTTP 2xx from 7 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37)
• this window: 0 endpoints first seen, 5 active; 32 endpoints seen in the last 7 days remain current
• inventory generated 2026-11-02T07:24:34Z

New this window

No endpoint first seen this window.

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: no new endpoints this window. The jklarm staging host 45.90.163.37 keeps serving its two fetcher scripts (cf0b50b8b7a8, a8db671b58d0) to 19 sources each — the third staging host for the Mirai-selfrep family, and the jkl* ELF binaries are still not captured. https://217.60.102.5/sh drew 16 attempts from 8 IPs and served nothing; the /sh dropper path in the LIBREDTAIL staging /16 repeats №43's pattern (the registered dropper host is 217.60.195.113), so the family's staging infrastructure persists even where the payload does not.

Gaps / Next Collection

1. AWS use of the three fresh hoards. SI-CENSUS holds 104 canaries per 6-day history (35 new), REGISTRY-HUNT added 9 in its fourth mint window, SWAGGER-SWEEP's 5 are hours old. Any Tracebit alert against them names the operator's work schedule; a write-shaped call (RunInstances class) is the escalation line.
2. SES-QUOTA-PROBE's next move. №57 was 72 denied ses:GetSendQuota calls; this window was 2 identity successes. Watch for a return to quota probing on the fresh 12:28 mint, a second use IP, or any success beyond sts:GetCallerIdentity.
3. RECONX-L2S's third operator. The markers (/reconx-<hash>, /__l2s_debug_probe__) are a cheap fleet-wide grep. The open question: does the React-Flight body appear on a canary node's /@fs surfaces — the same body class minted 41 credentials for AI-EXEC-HUNT on №64 — or does the kit stay on the keyless node?
4. MEGA-DICTIONARY's grown manifest. The wordlist jumped 13,776 → 14,197 under a repeat host. Whether the +421 paths propagate to other operators shows how live the artifact is; a replay of the grown list from a second host would show circulation, and a repeat from 103.125.233.17 would show a schedule.
5. Network-layer trajectory. GO-SPRAY-SWEEP at 140 source IPs is 60 short of the 200-IP mass threshold — a crossing would make it the fleet's widest SSH sweep on record. LIBSSH-MASSSWEEP rebounded to 627; watch whether it re-peaks past its 673 record.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-02-r4.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-02.md