FLUX FLEET — INTEL BRIEFING №72

Period: 2026-11-03 07:32 – 2026-11-04 07:33 UTC (24h, day 70 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 70-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the ingest cast applies (see Fleet Observations).

BLUF

The credential funnel produced its first Bedrock-shaped use: a new self-use actor, 152.89.244.89 (aurologic GmbH, DE), minted 3 canaries on canary-farm-1 and worked one in the same window — 4 successful sts:GetCallerIdentity calls plus 10 denied operations led by bedrock:InvokeModel×5 and ListFoundationModels, with SSM, EC2, and IAM reads denied as well; nothing beyond account identity succeeded. XMLRPC-BRUTE returned from a new operator under the exact №67 record shape: 34.78.138.84 (Google LLC, BE) fired 10,000 system.multicall wp.getUsersBlogs POSTs at lauterbourg-01-ts in 4 minutes and owns the node's +324% day, while the previous operator (45.94.31.16) idled. Techoff (BG) ran its widest census on record — 195.178.110.247 crawled 6,709 paths on canary-farm-1 in 33 minutes, including ~6,000 .js.map source-map HEADs, owning the node's not-handled 11.1× spike — with three sibling IPs running three more shapes, all 0 mints. Mints held steady (83 digest-issued rows; 67 credentials to 41 collectors per Tracebit; 8×400 failures, no 401s) while MEGA-DICTIONARY idled and frantech-ts fell −97%. The network layer saw LIBSSH-MASSSWEEP contract to 183 IPs, OPSSH-UBUNTU-SWEEP present a swapped russh_0.45.0 banner under the same fingerprint, and GO-SSH-SWEEP re-cross the dispersed threshold. No fleet-side changes this cycle.

Key Judgements

1. Stolen canary credentials are now being driven at LLM services, not just AWS inventory. The window's one use session paired 4 successful identity calls with 10 denied operations aimed at Bedrock (InvokeModel×5, ListFoundationModels), SSM (DescribeInstanceInformation), EC2 (DescribeInstances), and IAM (GetRole). (High confidence on the events — the Tracebit pull carries the operations and outcomes; Moderate on trajectory — one session from one IP, and Bedrock denials have №67 precedent via REGISTRY-HUNT; the new element is a census actor minting and working its own canaries in one window.)
2. XMLRPC-BRUTE is commodity tooling with rotating operators, and the record-flood template circulates as a package. 34.78.138.84 repeated №67's artifact exactly — 10,000 multicall POSTs, 5 paths, forged Chrome/89.0.4389.114 — on a node and from an IP never used by the campaign before. (High confidence — byte-shape and UA match verified by journey query; the actor link is tooling-level, not organizational.)
3. The census class keeps widening while the mint class absorbs none of it. Techoff's 6,709-path run is the widest config-census by path count in fleet history (prior census-class record: AI-CLI-VAULT's 1,438), yet it took 0 mints — every wide wordlist hit the tarpit/404 wall. (High confidence on the counts — direct per-IP queries; Moderate on the trend read — one window, one operator.)
4. Hoards stay idle while use concentrates in a single self-use actor. 66 of 67 window credentials drew no AWS events; SI-CENSUS (56 per its 6-day Tracebit history) minted nothing Tracebit-side this window; the only use was the actor that minted the credential. (High confidence on the counts; Moderate on the hoard reading — №67–№68 showed use can lag mint by a day.)

Active Campaigns (day 70 status)

CREDENTIAL-DRAIN (mint→use pipeline) ⟳ — FIRST BEDROCK-SHAPE USE, SELF-USE — Hostile, active

• Actors: 41 collector IPs took 67 credentials per the Tracebit funnel (digest issued rows: 83 — canary-farm-1 32 from 26 IPs, ai-devbox-1 28 from 23, control-1 12 from 10, ru-edge-1 11 from 10; the delta is the usual window-trim semantics). Use IP: 152.89.244.89 (new, self-use — see ACTUATOR-BEDROCK-KIT). Persistent hoards: SI-CENSUS 56/6d, 34.95.21.228 41, 45.148.10.120 12, 150.241.66.127 10, 46.148.227.131 7.
• TTPs: mint side unchanged — /.env-class mints to hostile collectors; failures 8×400 pacing singles (canary-farm-1 3, ai-devbox-1 3, control-1 1, ru-edge-1 1), no 401s, no key errors. Use side: 14 events on 1 credential — 4× sts:GetCallerIdentity SUCCESS + 10 denied (InvokeModel×5, ListFoundationModels, SSM DescribeInstanceInformation, EC2 DescribeInstances, IAM GetRole; ListBuckets in the operation set).
• Assessment: every issued row remains an operational credential within hours, and the deny wall held at identity-only. The escalation line is unchanged: any success beyond sts:GetCallerIdentity, or a write-shaped call, is the finding.

ACTUATOR-BEDROCK-KIT (mint-and-self-use kit) ⚠ NEW — Hostile, active

• Actors: 152.89.244.89 (aurologic GmbH, DE) — canary-farm-1 only.
• TTPs: a bare Mozilla/5.0 census of 151 events / 59 paths / 33 trap families: /@fs/etc/passwd Vite traversal, /containers/json docker daemon probe, and the full Spring actuator battery (env, configprops, heapdump, jolokia, mappings, beans) → 3 /.env mints → same-window AWS use of 1 minted canary (the 14-event session above).
• Assessment: mint-then-work inside one window — the WEBSIPHON pattern (№55) with a different census surface and a Bedrock-shaped target list. The actuator battery suggests the actor reads Spring Boot metadata before anything else. Watch a retry, any success beyond identity, a write-shaped call, or a second IP/node.

XMLRPC-BRUTE ⟳ — OPERATOR SWAP, RECORD SHAPE ON LAUTERBOURG — Hostile, active

• Actors: 34.78.138.84 (Google LLC, BE) — lauterbourg-01-ts only. №70–71's operator 45.94.31.16 (1337 Services GmbH, NL) idled: first miss after two consecutive windows.
• TTPs: 10,008 events, 10,000 POSTs to /xmlrpc.php, every captured body a system.multicall wrapping wp.getUsersBlogs (head: <?xml version="1.0"?><methodCall><methodName>system.multicall</methodName>…<string>wp.getUsersBlogs</string>…), forged Chrome/89.0.4389.114 — the №67 UA. 11:38–11:42 stored, ~42 POSTs/s for 4 minutes; plus php2shell-root×5, wlwmanifest, and wp-user-enum legs. Digest spike: wp-xmlrpc-post 10,000 vs 7-day avg 0 (inf) — the tag's first lauterbourg flood since the node's rebuild.
• Assessment: the ninth operator class on record repeats the exact №67 artifact from a fresh Google-hosted IP on a fresh node — the flood kit circulates independently of any operator's schedule. The fake WordPress served every request; 0 mints, no captured credential success.

TECHOFF / PHPSWEEP kit ⟳ — NEW CENSUS ARM, FOUR LEGS — Hostile, active

• Actors: 195.178.110.247, .22, .159 (all canary-farm-1) and .94 (lauterbourg-01-ts); all Techoff Srv Limited (BG), .247/.159 carry ipsum:1. Sibling .218 ran the GPU-discovery command pass on the frantech-ts honeypot (see SSH/telnet section).
• TTPs: .247 — 6,888 events / 6,709 paths in 33 min (11:45–12:18 stored) under a malformed forgery (Chrome/123.0.0.0 + Safari/123.0.0.0): HEAD+GET pairs on /env.js, /environment.js, /config*.js (webapp-config-bundle-js 200s; the tag's 10.1× spike), then a ~6,000-path HEAD-only .js.map source-map crawl (404s; the node's not-handled 11.1×). .22 — 555 events in 1.06 s under Chrome/120, including a 230-path /wp-config.* backup-variant fanout and wp-plugin exploit paths (wp-symposium, kaswara). .159 — 768 events / 376 paths over 11 h under honest curl/7.81.0. .94 — 296 events / 292 paths in 3 min under Chrome/133. 0 mints across all four legs.
• Assessment: the kit's census arm now spans config bundles, source maps, wp-config backups, plugin exploit paths, and slow honest-UA walks — the fleet's tarpit and 404 walls absorbed everything, and any future mint joins the drain. The .js.map class matters when it 200s: served source maps leak application structure.

CONFIGBUNDLE-KIT ⟳ — STANDING OPERATOR STILL MINTING — Hostile, active

• Actors: 208.84.100.218 (on record since 10-02) — 5 mints across 3 sensors (canary-farm-1 2, ai-devbox-1 2, ru-edge-1 1), 5 per its 6-day history.
• TTPs: family shape unchanged; the Techoff .247 run carried the same webapp-config-bundle-js family at record width (see TECHOFF above).
• Assessment: five more credentials into the drain from the standing operator. AWS use remains the check; none observed.

VPN-CONF-HUNT ⟳ — LEGS CONTINUE, FIRST .14 MINT — Hostile, active

• Actors: 85.155.14.15 (SolidCore Hosting LTD, DE) ran netcup-ts 356 events / 356 unique paths (Firefox/126 X11 forgery, 13:38–13:41 stored), then 85.155.14.14 ran ai-devbox-1 353 events / 353 paths / 47 families (Firefox/125 Win64 forgery, 21:10–21:14). Siblings .16/.32 absent.
• TTPs: the registered cloud/VPN config census — the ai-devbox-1 kill-chain walk ran /.aws/credentials → aws_credentials.json → .aws/* variants → /.boto → /.azure/config → /.s3cfg; .14 minted 1 canary on ai-devbox-1 (the operator's first mint on this node).
• Assessment: one wordlist, two nodes, ~7.5 h apart; the operator now collects, and its canary joins the drain with 0 observed use.

REGISTRY-HUNT ⟳ — L9SCAN MINT ARM RETURNED — Hostile, active

• Actors: 164.90.208.56 + 165.227.84.14 (both UA l9scan/2.0.234313e2634323e2332313e2930313), each 80 events / 36 paths on canary-farm-1, 1 mint each; the walker pool crossed the kill-chain on 8 DigitalOcean IPs (165.227.84.14, 164.90.208.56, 206.81.24.74, 167.172.232.142, 209.38.208.202, 165.22.34.189, 159.89.12.166, 128.199.182.55).
• TTPs: the registered 27/36-family walk (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum), 1 mint per runner.
• Assessment: the mint arm resumes after one idle window; both mints drew no AWS events this window. The №67 Bedrock/SES enumeration shape remains this pool's known escalation.

SI-CENSUS ⟳ — VOLUME COLLAPSED — Hostile, active

• Actors: 102.220.163.241 (VPS Dedicated LLC, SI) — 1,048 events across 3 sensors (control-1 514 + ru-edge-1 514 census passes plus ~20 light on ai-devbox-1), down from 5,661 across 4 last window.
• TTPs: the 511-path directory-fanout census, unchanged; 2 digest-issued mints (control-1, ru-edge-1, 1 each) — none inside the Tracebit per-collector window; the 6-day persistent view holds the hoard at 56 mints (last placed 2026-11-03 02:45).
• Assessment: the fleet's largest standing hoard with zero observed AWS use keeps its inventory; a second consecutive low-volume window would mark a shift in the operator's schedule rather than a one-off.

MALWARE-DICT ⟳ — .18 LOOP RETURNED — Hostile, active

• Actors: 204.76.203.18 (Pfcloud UG, NL, ipsum:2) — control-1 only.
• TTPs: 1,837 events / 579 paths under an EMPTY user agent, 07:43 11-03 → 06:09 11-04 stored — the №14 continuous-loop replay shape; 0 mints; /24 siblings .10/.7/.50 absent.
• Assessment: the Pfcloud replay loop is back on its original host and target node after a long idle stretch; same dictionary scale (~579 paths), same GET-only shape.

ENV-FANOUT ⟳ (watch) — LIGHT RETURN

• Actors: 198.145.226.37 (M247 Europe SRL, US) — 105 events across canary-farm-1 + lauterbourg-01-ts; 162.216.241.239 (Dynu Systems, US) absent.
• TTPs: light touches only; the registered 85-path <dir>/.env fanout did not re-run at №71 volume.
• Assessment: the Chrome/143-forgery pair's second IP returned at low volume. The promotion triggers stand: a third IP, any mint, or the forged UA reaching a canary node.

Light watchers

• SS-PROBE — sixth operator. 102.22.219.226 (8-sensor looper, python-requests/2.31.0 unchanged) ran the fresh-marker → /.env mint cycle across all 4 canary sensors: 6 mints (ai-devbox-1 3, control-1/ru-edge-1/canary-farm-1 1 each), 0 AWS use. The ledger is now 6 operators, one TTP.
• 158.140.191.104 (PT. Eka Mas Republik, ID; forged Chrome/124) — 525 events / 85 paths on control-1 with 3 /.env mints; journey: tarpit loops → /.env.local//.env.production errors → /.env issued. Third-largest mint count this window.
• 185.190.54.150 — honest self-label Authorized-Audit/1.0; 410 events / 262 paths across sponge-01-ts, lauterbourg-01-ts, canary-farm-1, and 2 mints on canary-farm-1. The №71 VantageResearch class: research label, mint behavior.
• GIT-HARVEST — third consecutive window: 35.232.76.162, 80 events / 4 sensors (netcup, lauterbourg, control, canary-farm) under the honest harvest/1.0 UA; 0 mints. Scheduled, not one-off.
• TOKEN-CRAWLER — 45.198.224.230/.235/.236 ran the /c/<96-char random-token> path class on ru-edge-1 (20+20+10 events, forged Chrome/114 per IP; the digest's ru-edge /c/ first-seens), plus .125's all-8 looper pass (82 events). 0 mints.
• Tarpit loopers — 89.248.172.33 (7 sensors, 394 events), 93.174.93.12 (6 sensors, 374), 91.92.40.12 (8 sensors, 348 over 2 paths), 45.198.224.125 (8 sensors, 82).
• BUCKLOG-KIT census arm — 185.177.72.64: 4 mints this window (canary-farm-1 2, ru-edge-1 2), 6 per its 6-day history; use side idle.
• 137.23.38.53 (SES-QUOTA-PROBE) — present light (98 events on ai-devbox-1 + control-1), no use events this window after four consecutive use windows.
• Benign/research — Censys-class 71.6.155.70 (8 sensors, handshake-shaped), 94.183.174.99 (8 sensors, 24 events), 91.224.92.45 (6 sensors) held benign shapes. On the HoneyDB layer, the /.env crypto-lure fetch from 70.8.208.88 is the operator's own validation client (benign by identification, per the registry); a loopback 127.0.0.1 hit is internal. No benign-listed operator crossed into hostile behavior.

Standing actors (persistence check)

• SI-CENSUS (102.220.163.241) — present every recent window; volume collapsed this window (1,048 vs 5,661); hoard 56/6d, zero use ever observed.
• Techoff blocks (195.178.110.x, BG) — tenth-plus window; the kit debuted a four-leg census arm and touched the honeypot layer via .218.
• REGISTRY-HUNT DigitalOcean pool — present every window on record; l9scan mint arm returned with 2 mints, use side idle.
• Pfcloud 204.76.203.18 (MALWARE-DICT) — loop returned to control-1 after idle windows; continuous shape.
• 208.84.100.218 (CONFIGBUNDLE-KIT) — standing since 10-02; 5 mints this window, 5/6d.
• 85.155.14.x (VPN-CONF-HUNT) — sixth-plus window; first .14 mint.
• 35.232.76.162 (GIT-HARVEST) — third consecutive window, same shape.
• 185.177.72.64 (BUCKLOG census) — minting across two sensors, 6/6d.
• 137.23.38.53 (SES-QUOTA-PROBE) — mint-side presence light; use side silent after four consecutive use windows.
• 45.198.224.x (TOKEN-CRAWLER) — /24 rotating; /c/ class back on ru-edge-1.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-11-03 07:32:00 → 2026-11-04 07:33:28 UTC

Fingerprint field ssh.hassh, destination port 22 · 108,812 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 80,309, bahrain-sponge-01-ts 57,854, sensor:bahrain-sponge-01-ts 57,854, contabo-sponge-02-ts 11,633, proxy 11,633, sensor:contabo-sponge-02-ts 11,633

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 1,553 sessions from 183 source IPs across 106 networks in 44 countries, port 22, avg 4,922 B/session. Networks: AS8075 Microsoft Corporation, AS24940 Hetzner Online GmbH, AS16276 OVH SAS, AS4766 Korea Telecom, AS31898 Oracle Corporation. Busiest sources: 163.227.161.160, 171.244.39.95, 203.160.52.177, 150.5.141.198, 189.165.23.212. Last 7 days: 10-29 657 IPs, 10-30 583 IPs, 10-31 455 IPs, 11-01 610 IPs, 11-02 496 IPs, 11-03 149 IPs, 11-04 66 IPs.
• 184781a96d49ee509a431028a8d5022a — client banner ssh-2.0-russh_0.45.0, 1,623 sessions from 118 source IPs across 78 networks in 37 countries, port 22, avg 4,503 B/session. Networks: AS12714 PJSC MegaFon, AS9198 JSC Kazakhtelecom, AS137718 Beijing Volcano Engine Technology Co., Ltd., AS51167 Contabo GmbH, AS16276 OVH SAS. Busiest sources: 80.68.76.181, 88.204.245.66, 115.190.174.152, 85.214.167.83, 176.235.120.48. Last 7 days: 11-02 185 IPs, 11-03 118 IPs, 11-04 4 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 24,551 sessions from 60 source IPs across 29 networks in 17 countries, port 22, avg 5,138 B/session. Networks: AS198364 Banatsync Srl, AS209854 Cyberzone S.A., AS205089 Alfahost LLC, AS213790 Limited Network LTD, AS211486 Alferov Aleksey Aleksandrovich. Busiest sources: 77.239.124.153, 77.239.124.155, 109.160.32.45, 109.160.32.108, 109.160.32.128. Last 7 days: 10-29 58 IPs, 10-30 83 IPs, 10-31 79 IPs, 11-01 73 IPs, 11-02 65 IPs, 11-03 62 IPs, 11-04 30 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: two registration-level changes this window. OPSSH-UBUNTU-SWEEP (184781a96d49…) presented banner ssh-2.0-russh_0.45.0 where №71 recorded openssh_9.6p1 ubuntu-3ubuntu13.20 — same fingerprint, new banner: tooling migration or spoofing on an identical KEX set — and contracted (118 IPs in-window, 4 on the 11-04 tail). GO-SSH-SWEEP (0a07365cc01f…) re-crossed the dispersed threshold at 60 IPs while its session count fell −12,657; sources concentrated (77.239.124.x, 109.160.32.x busiest — the same /24s as prior windows' frantech uname-survey). LIBSSH-MASSSWEEP contracted to 183 IPs (−181). GO-SCATTER-SWEEP held 14,284 sessions at 37 IPs. No new fingerprints; CTL-MASS-SSH (4e066189c3bb…) ran its fourth consecutive ≥27k window (31,147 sessions) and control-1 still takes the fleet's heaviest inbound load (57,854 sessions).

Fleet Observations

• Volume shifts, explained. lauterbourg-01-ts +324% (13,059 vs 3,077 7-day avg) on 34.78.138.84's 10,000-POST flood (10,008 of the node's events). frantech-ts −97% (517 vs 15,183) on MEGA-DICTIONARY's absence — no replay this window. ai-devbox-1 −56% (2,491): XMLRPC's 45.94.31.16 idle, SI-CENSUS down, MEGA-DICT absent. ru-edge-1 −67% (1,169): SI-CENSUS down, no heavy census. canary-farm-1 −23% (10,918) despite the Techoff arms adding ~8,200 events — №70–71's heavies (WIDE-CONFIG-CENSUS, METADATA-HUNT runners, XFF-SWARM) were all absent. control-1 +40% (3,715) on MALWARE-DICT's 1,837, 158.140.191.104's 525, and the walker pool. netcup-ts −23% / sponge-01-ts −16% are mild deception-node drift. Coverage verified: every sensor's latest event in v_full lands 11-04 10:51–12:22 UTC, so the drops are real, not sync gaps. Window overlap applies as always — events between digest runs appear in two digests.
• Canary economics. Digest issued rows: 83 (canary-farm-1 32 from 26 IPs, ai-devbox-1 28 from 23, control-1 12 from 10, ru-edge-1 11 from 10). Failures: 8×400 pacing singles (canary-farm-1 3, ai-devbox-1 3, control-1 1, ru-edge-1 1); no 401s, no key errors. The Tracebit funnel (client-side window trim, as every cycle) counts 67 credentials to 41 collectors, 1 credential used in AWS (14 events: 4× sts:GetCallerIdentity SUCCESS + 10 denied), 66 idle.
• Attribution/TLS posture. 2,563 requests carried X-Forwarded-For; multi-entry chains 0; XFF-ignored 7; single-entry forgery 0 — the fourth straight quiet window. TLS ran http-led on every node; canary-farm-1's HTTPS (865) ran far under its HTTP (10,053). Top vhost Host headers: cloud.wafflehouseindex.us 11,631 (lauterbourg-01-ts, inflated by the flood), sso.rightabouteverything.show 1,168, inference.fapthropic.com 867. The retired kiteworks.rightabouteverything.show name drew no top-10 volume this window (№71: 706) — stale-wordlist SNI traffic did not return.
• Control-1 discovery velocity. 52 days live (first event 2026-09-12 07:59 UTC). The window's full day (11-04) ran 3,715 events / 127 unique IPs — inside the 7-day band (1,179–5,138 events, 104–155 IPs) and +40% against the 7-day event average, on MALWARE-DICT, the 158.140.191.104 census, and the walkers. The network layer still points the fleet's heaviest single-fingerprint SSH load at this node (CTL-MASS-SSH, 31,147 sessions; 4th consecutive ≥27k window).
• First-seen caveats. All first-seen rows share one sync-batch timestamp (02:15 / 02:31 stored), so they are an inventory, not a timeline. Attribution by journey query: the /wp-config.* backup-variant fanout and wp-plugin exploit paths belong to Techoff .22's 1.06-second burst; the ru-edge /c/<96-char> random paths belong to TOKEN-CRAWLER's 45.198.224.230/.235/.236.
• HoneyDB layer (ch-sponge-01-ts — platform API, pcaps separate in Arkime). 2,817 records / 957 sessions / 183 sources since 2026-11-03T07:34Z. Top services: Telnet 907 records, HTTP 719, MoneroRPC.wallet 457. Top sources: 20.164.200.48 (368 records), 193.32.249.162 (326), 169.150.196.5 (226). Event classes include cve_attempt 21, key_exfil_attempt 5, transfer_attempt 8; 3 /.env crypto-lure requests (70.8.208.88 — the operator's own validation client, benign per the registry; one loopback; one 13.140.235.56); 1 Docker dropper_indicators event (220.181.1.163).
• Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 317 sources sent credentials → 204 got a shell (64%) → 151 ran a command (74% of shell-getters, 48% of sources). Event level: 8,188 credential attempts → 3,363 accepted logins → 10,050 commands (299% of accepted logins go on to run something). Telnet (commodity IoT botnets): 467 attempts.

New commands: zero (0 of 4,494 distinct) — a third quiet window; operators re-ran known tooling only. New credential pairs: 0 of 3,656 offered. Concentration moved: rootssssss23424123123/rootssssss23424123123 is the new top pair (175 attempts), and the gs5662d34 family rotated elongated variants (root/root3245gs5662d34111111111 149, 345gs5662d34/345gs5662d34 111, root/3245gs5662d34 87), then commodity pairs (root/123456 87, pi/raspberry 69, user/wasd 62).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (1,927 + 1,927 events from 3 IPs, example source 109.160.32.47 — the GO-SSH-SWEEP /24), the chattr -ia .ssh/lockr -ia .ssh + SSH-key-plant pair (297 + 241 events from 114 and 100 sources, example source 223.221.38.226), and a GPU-discovery pass from 195.178.110.218 (/bin/./uname, nvidia-smi -q | grep "Product Name", lspci | grep VGA legs, 157 events each) — the same Techoff org that ran this window's HTTP census arm, working the honeypot layer.

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 78 endpoints on 23 hosts, 2525 command references and 642 download attempts since 2026-09-18T10:45
• served payloads: 23 distinct artifacts over HTTP 2xx from 8 hosts (146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37, 5.175.192.232)
• this window: 1 endpoints first seen, 3 active; 25 endpoints seen in the last 7 days remain current
• inventory generated 2026-11-04T07:19:04Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: the window's one C2 change is a new staging host — http://5.175.192.232/bot_mips served a 2,425,015-byte payload (sha256 afdbab3c1c43aceaeb9117c725e8c6f5db89eafbda2ee18f958d02d2bde30e95) twice to 1 source at 2026-11-04T00:22Z. Read read-only on the node: ELF 32-bit MSB MIPS32, statically linked, Go 1.22.5 build ID, stripped; no plaintext URLs or repository paths were extractable from the binary, so the family is unresolved — the /bot_mips name and 2.4 MB size say IoT bot, the toolchain says Go rather than the usual C families. The long-lived kla.sh fetcher (live since 09-18, 528 command events this window, still 0 downloads served) and the LIBREDTAIL staging path https://217.60.102.5/sh (20 attempts from 10 IPs, serves nothing) were the only other active endpoints; no other new endpoints or served payloads.

Gaps / Next Collection

1. 152.89.244.89's next AWS session. The deny wall held at identity. Watch for a retry from this IP, any success beyond sts:GetCallerIdentity, and a write-shaped call — the line №71 drew. Its 2 unused mints expire on the normal clock.
2. The XMLRPC-BRUTE record kit's schedule. Will 34.78.138.84 repeat on a third node, and does 45.94.31.16 return? A third same-shape run confirms the flood kit as a circulating commodity with its own rotation.
3. Techoff .247's source-map class. All ~6,000 .js.map HEADs drew 404s; served maps would leak application structure. Watch for a second node, any 200, and any mint from the arm.
4. SS-PROBE's sixth operator. 102.22.219.226 holds 6 fresh canaries with 0 observed use. Any Tracebit alert naming it extends the operator ledger's use side.
5. OPSSH-UBUNTU-SWEEP's banner swap. Same fingerprint, new banner (russh_0.45.0). A third banner supports the spoofing read; a stable russh client supports the migration read. Any auth attempt reclassifies the sweep toward the spray class.
6. MEGA-DICTIONARY's circulation test. Idle this window. A fourth host replaying the 14,864-path manifest would establish active circulation; a second consecutive idle window opens the pause question.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-04-r2.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-04.md