Switch to plain language briefing

FLUX FLEET — INTEL BRIEFING №73

Period: 2026-11-04 07:34 – 2026-11-05 07:34 UTC (24h, day 71 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 71-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the ingest cast applies (see Fleet Observations).

BLUF

MEGA-DICTIONARY fielded a fourth host with a record manifest: 23.234.119.146 (tzulo, inc., US) replayed 14,932 GETs over 14,922 unique dropper paths against control-1 in ~2 minutes under 208 rotating IoT-router user agents, drove the node's +788% day, and added new dropper families (nyx_bot_*, /krmine*, PS1 stubs) to the shared wordlist. WP-LOGIN-BRUTE went fleet-wide: 244 source IPs fired 2,070 /wp-login.php credential POSTs plus ~2,100 probes at all 8 sensors under per-IP forged modern browser UAs, with the password list moved from №68's default pairs to role+year compositions (Admin123@, Admin2026@, Webmaster2026@) — the fake WordPress held every POST, 0 mints. The credential funnel recorded a zero-use window: sensors minted 59 canaries (50 per the Tracebit funnel to 22 collectors), no credential reached AWS, and mint failures fell to zero for the first time in three cycles. PATHSCAN-CENSUS returned under a second Alexhost (MD) operator — 176.123.8.213 ran both EU TLS nodes and minted 9 on canary-farm-1, the window's largest single-IP mint count — while ACTUATOR-BEDROCK-KIT's 152.89.244.89 re-minted 2 but stayed out of AWS. XMLRPC-BRUTE rotated back: 45.94.31.16 re-ran its registered 1,000-POST batch on ai-devbox-1.

Key Judgements

  1. The WordPress credential class graduated from a one-node alarm to a standing fleet-wide brute. 244 IPs delivered 2,070 credential POSTs on all 8 sensors in one window (canary-farm-1 130 IPs/407, lauterbourg-01-ts 34/290, netcup-ts 38/283, ai-devbox-1 41/282, frantech-ts 31/269, ru-edge-1 26/191, sponge-01-ts 29/180, control-1 27/168), with five new journey signatures first seen 11-05. (High confidence on the events — direct per-node counts and body previews; Moderate on staying power — one window at this width, and the prior record was №68's 201-IP, one-POST-per-IP pass on a single node.)
  2. The mint class is rotating among small dedicated collectors while the large hoards rest. Zero AWS use; SI-CENSUS (52/6d) minted nothing for a second window; the window's mints came from 1-path mint loops (85.11.167.204 Go-http-client/1.1, 23.132.164.201 MSIE/4.01, 202.65.239.148 Chrome/39), a Chrome/81 trio new today, the REGISTRY-HUNT walker pool (14 mints), and PATHSCAN's 9. (High confidence on the counts — Tracebit funnel joined to v_full journeys; Moderate on the read — one window, and №67–№68 showed use can lag mint by a day.)
  3. MEGA-DICTIONARY operates as a multi-host commodity with a growing payload menu, and control-1 is now a validated replay target. The manifest grew 14,864 → 14,922 (+58) on the fourth hosting provider, and the new paths are live dropper names (Go-based nyx_bot builds, krmine miner builds, uploaded .exe payloads, obfuscated PowerShell stubs) rather than filler. (High confidence — journey query ties every first-seen path to the 23.234.119.146 replay.)
  4. Three banners under one fingerprint resolve OPSSH-UBUNTU-SWEEP's banner question toward the tool-pool read. The fingerprint now carries ssh-2.0-russh_0.45.0, ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, and ssh-2.0-openssh_10.0p2 debian-7 — one KEX set, three self-descriptions, which is spoofing or a shared builder pool, not a migration. (Moderate confidence — banner set from the recon versions field; attribution of intent is inferential.)

Active Campaigns (day 71 status)

WP-LOGIN-BRUTE ⟳ ESCALATED — FLEET-WIDE DISTRIBUTED BRUTE — Hostile, active

  • Actors: 244 source IPs, 1–20 POSTs each, across hosting and residential ranges (sample: 104.248.242.98 DigitalOcean, 51.195.6.20 OVH, 43.153.2.142 Tencent, 13.140.185.41 Microsoft Azure, 194.163.191.215, 169.62.7.24, 216.109.180.243, 103.118.17.13, 189.74.97.150). IPs rotate; the journey signatures persist.
  • TTPs: alternating /wp-login.php probe → credential POST per IP; forged per-IP modern UAs (Firefox/133, Chrome/130–131, Safari 18.1, Edge/131, mobile Chrome/155); bodies of the form log=admin&pwd=Admin123%40&redirect_to=%2Fwp-admin%2F&testcookie=1&wp-submit=Log+In — each attempt carries a fresh _wpnonce, so the tool parses the login form first. Top passwords this window: Admin123@ ×20/9 IPs, admin2025@ ×14/11, Admin123! ×14/7, admin!2025 ×13/7, Admin2026@ ×13/11, admin123! ×12/9, Admin2026 ×11/10, Webmaster2026@ ×10/10, date-shaped 1302026; users admin and webmaster. Five new journey signatures (125fa0740adf 41 IPs, c040230cd7b0 25, 8c95f27cfabd 21, 95d313cbbacc 16, e44df586c709 16) share the probe→POST shape; result tags spiked fleet-wide (wp-login-probe inf on five sensors, wp-login-credentials 3.5–10.3× on six).
  • Assessment: the №68 default-pair pass (log=editor&pwd=editor, one POST per IP) became a distributed brute with a current-year password-mangling list against every node's fake WordPress. The trap answered every POST, so the POSTs tell the operator nothing about real credentials — 0 mints and no captured success. The lauterbourg-01-ts leg partially rides the docker-gateway peer attribution (see Fleet Observations), so that node's 34-IP count under-counts.

WP-XRPC-WALK ⟳ — USER-ENUMERATION WALKER AT WIDTH — Hostile, active

  • Actors: 18 IPs, 7 sensors, cluster eee552d8955a (first seen 09-22).
  • TTPs: 4,950 events this window: /wp-login.php probe → /wp-json/wp/v2/users REST enumeration → /wp-sitemap-users-1.xml sitemap pull (wp-user-enum-rest-single inf spikes on five sensors, core-sitemap 15.8–21× on three).
  • Assessment: the walker names usernames before WP-LOGIN-BRUTE's POSTs try role-based pairs; the two classes compose. The fake REST surface returns decoy users.

MEGA-DICTIONARY ⟳ — FOURTH HOST, RECORD MANIFEST, CONTROL-1 TARGET — Hostile, active

  • Actors: 23.234.119.146 (tzulo, inc., US) — the sibling of №37's control-1 host 23.234.118.146. Fourth hosting provider on the artifact (tzulo, xTom, M247, Datacamp).
  • TTPs: 14,932 GETs / 14,922 unique paths in ~2 minutes (20:14–20:16 stored, ≈124 paths/s) under 208 rotating IoT-router UAs (TP-LINK, MikroTik RouterOS, D-Link, Synology, Wavlink, ZTE GPON, Huawei, Ubiquiti…). Every request 404 not-handled (owns control-1's 37.4× spike), 0 mints, 0 POSTs. Manifest 14,864 → 14,922 (+58 — fourth growth on record: 13,776 → 14,197 → 14,864 → 14,922). New paths this window: /nyx_bot_linux_amd64, /nyx_bot_linux_arm64_exec, /nyx_bot_linux_arm64_hkdf, /krmine, /krmine-mips, /krmine-mipsel, /iranbot-ultimate.sh4, /llx.mips, /mrraider-armv7, /rock.exe, /two.exe, /uploads/141935c46a5c4ff1b84b433e84f36e61.exe, /uploads/d0d605c01f71464ea16b25c92892dbe0.exe, /notmalware/9suckonmybinary78, and six obfuscated PowerShell stub paths (/ppprincee6/secured_stub.ps1, /prince1/secured_stub.ps1, /princee255/Crypted.ps1, /tsk/red_stub.ps1, /web/JOHN21/5T5T/35434FGRT.ps1, /suzxwgr/afwugem/aimxfrz/DTsecured_stub.ps1). Pfcloud's 204.76.203.18 empty-UA loop rode the same node alongside (2,190 events / 580 paths, 02:34 → 05:42 stored, ipsum:2 — the MALWARE-DICT loop's second consecutive window on control-1).
  • Assessment: the dropper-URL dictionary keeps growing with current botnet families, and the hosts rotate while the manifest persists. Control-1's fresh-IP posture again absorbed a record replay with decoys only — the fleet design validates: nothing served, nothing minted.

PATHSCAN-CENSUS ⟳ PROMOTED — SECOND OPERATOR, MINT ARM REPEAT — Hostile, active

  • Actors: 176.123.8.213 (Alexhost S.r.l., MD) — same org as №66's 176.123.5.6, new IP.
  • TTPs: canary-farm-1 324 events / 175 paths / 63 trap families in 4 minutes (03:23–03:27 stored) under the honest Mozilla/5.0 (compatible; pathscan/1.0) UA plus 12 undici events, then lauterbourg-01-ts 311 events / 176 paths (04:23–04:26). Mint leg repeated №66 exactly: 9 /.env-class canaries on canary-farm-1, including the case variants /.Env and /.ENV (the window's largest single-IP mint count); lauterbourg-01-ts minted 0 — it ships no canaries, so absence there is design, not failure. Journey head: tarpit loops → random-marker probe → /.env [issued] → /.Env [issued] → /.ENV [issued] → /.aws/config + /.aws/credentials (+ .bak variants) → actuator/env/health/configprops/threaddump → rails/yml/composer/jenkins/netrc credential files.
  • Assessment: two operators, one org, identical 9-mint wordlist depth two windows apart — the census arm works a fixed list until the trap wall, then harvests. Its 9 credentials join the drain; the watch is AWS use of this hoard and a third Alexhost IP.

XMLRPC-BRUTE ⟳ — OPERATOR RETURNS TO ITS BATCH SHAPE — Hostile, active

  • Actors: 45.94.31.16 (1337 Services GmbH, NL) on ai-devbox-1; №72's record operator 34.78.138.84 (Google LLC, BE) idle.
  • TTPs: 1,007 events, 1,000 wp-xmlrpc-post to /xmlrpc.php in 3 minutes (15:44–15:47 stored), forged Chrome/78.0.3904.108 unchanged, plus wlwmanifest and wp-user-enum legs. The IP's all-time count in v_full now stands at 4,028 events / 4,000 multicall POSTs across three windows — the registered 1,000-POST batch cadence.
  • Assessment: operator rotation continues (six operator classes on record); each runs the same system.multicall wp.getUsersBlogs flood kit against the fake WordPress, which holds every request. 0 mints.

REGISTRY-HUNT ⟳ — WALKER MINT ARM WIDE, L9SCAN IDLE — Hostile, active

CREDENTIAL-DRAIN ⟳ — ZERO-USE WINDOW, CLEANEST MINT WINDOW IN THREE CYCLES — Hostile, active

  • Actors: 22 collector IPs took 50 credentials per the Tracebit funnel (digest issued rows: 59 — canary-farm-1 26 from 16 IPs, ai-devbox-1 15 from 12, control-1 12 from 10, ru-edge-1 6 from 6; the delta is the usual window-trim semantics). Zero credentials reached AWS.
  • TTPs: mint side unchanged; failures 0 (last cycle: 8×400 pacing singles; №71: 16). Hoards static: SI-CENSUS 52/6d (no mint since 2026-11-03 02:45 — second consecutive idle window), 45.148.10.120 11, 23.132.164.201 10 (minted 1×3 sensors this window), 150.241.66.127 9, 176.123.8.213 9 (new), 46.148.227.131 7, 85.11.167.204 7 (minted 2+2 this window). Mint-collector class this window: single-path loops — 85.11.167.204 (Go-http-client/1.1, 1 path, 5 sensors, 4 mints), 23.132.164.201 (antique MSIE 4.01/Windows CE UA, 1 path, 5 sensors, 3 mints), 202.65.239.148 (forged Chrome/39, 9 paths, 4 sensors, 5 mints), and a forged-Chrome/81.0.4044.129 trio new today (98.97.76.10 3 mints, 165.154.218.176 2, 180.93.226.114 1).
  • Assessment: inventory grew while the use side rested — every issued row remains an operational credential until expiry, and the deny wall went untested this window. The escalation line is unchanged: any success beyond sts:GetCallerIdentity, or a write-shaped call, is the finding.

ACTUATOR-BEDROCK-KIT ⟳ — MINT-SIDE RETRY, USE SIDE IDLE — Hostile, active

  • Actors: 152.89.244.89 (aurologic GmbH, DE) — canary-farm-1 only.
  • TTPs: minted 2 this window (5 per its 6-day Tracebit history); no AWS events from its hoard this window after №72's 14-event Bedrock-shaped session.
  • Assessment: the actor keeps its inventory alive; a return to AWS is the watch. Its №72 session remains the funnel's only Bedrock-shape use.

Light watchers

  • 193.47.62.109 (BestDC Limited, BG) — 552 events / 276 paths in 5 minutes on sponge-01-ts (05:38–05:43 stored) under 10 rotating UAs including the typo forgery Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M…Moblie Safari…); webshell sweep (i.php, info.php, phpinfo.php, host.php, host-info.php, php-info.php, phpversion.php, local-config.php, test.php, config.php), configuration.php probes, /_debug, /phpmyadmin/.env; 1 POST, 0 mints. Same /24 as OPENAPI-CENSUS's 193.47.62.29 but a different trade (webshell/phpinfo census, not OpenAPI) — do not merge; name on a second run.
  • 45.144.212.192 — new self-labeled git-config-harvester/1.0: 4× /.git/config [fake-git] on ru-edge-1 over 23 minutes. Watch a second sighting; the fake git served decoys.
  • 194.180.49.41 (CREDSWEEP operator, MEVSPACE BG) — heaviest run on record for this IP: 327 events / 288 paths / 29 families on control-1, sponge-01-ts, frantech-ts under Go-http-client/1.1, with the pscan-04d22ab6 marker leg and 1 control-1 mint (its 6-day hoard: 6).
  • GIT-HARVEST — fourth consecutive window: 35.232.76.162, 203 events / 7 sensors under the honest harvest/1.0 UA; 0 mints.
  • Tarpit looper class (cluster 3e1c5eb879e7 ⟳, 128 IPs, 886 events, 7 sensors): 93.174.93.12 (7 sensors, 333), 89.248.172.33 (6, 324), 160.187.146.57 (4, 347), 123.253.14.241 (4, 308), 129.121.52.181 and 43.153.2.142 (4, 353 each), 103.118.17.13 (5, 295 — also carries wp-login legs).
  • MALWARE-DICT (Pfcloud 204.76.203.18) — second consecutive window looping control-1 (2,190 events / 580 paths, empty UA, 11-04 02:34 → 11-05 05:42 stored; 0 mints) — counted under MEGA-DICTIONARY's node impact above; separate artifact, own dictionary.
  • Benign/research — 71.6.155.70 (8 sensors, handshake-shaped) and 94.183.174.99 (8 sensors) held benign shapes; 94.183.174.99 is also the HoneyDB layer's dominant source this window (7,342 records — see Fleet Observations), consistent with its registry identification. No benign-listed operator crossed into hostile behavior.

Standing actors (persistence check)

  • REGISTRY-HUNT DigitalOcean pool — present every window on record; 14 walker mints this window, use side idle.
  • SI-CENSUS (102.220.163.241) — idle a second consecutive window; hoard 52/6d static since 11-03 02:45; zero use ever observed.
  • MEGA-DICTIONARY hosts — artifact on its fourth hosting provider; Pfcloud's loop nested on control-1 for a second window.
  • XMLRPC-BRUTE operators — 45.94.31.16 back after one idle window; 4,000 all-time POSTs across three windows; №67/№72 Google-hosted record operators idle.
  • GIT-HARVEST (35.232.76.162) — fourth consecutive window, same shape.
  • 208.84.100.218 (CONFIGBUNDLE-KIT) — idle this window after №72's 5-mint run; standing since 10-02.
  • 23.132.164.201 — 10/6d hoard, minted on 3 sensors this window, 5-sensor looper, antique-UA single-path shape.
  • 85.11.167.204 — 7/6d hoard, Go-http-client single-path minter across 5 sensors.
  • 202.65.239.148 — 5/6d hoard, minted on 4 sensors this window under a 2014-era forged Chrome/39.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-11-04 07:34:00 → 2026-11-05 07:34:24 UTC

Fingerprint field ssh.hassh, destination port 22 · 109,767 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 78,649, bahrain-sponge-01-ts 39,633, sensor:bahrain-sponge-01-ts 39,633, sensor:lauterbourg-01-ts 15,718, frantech-ts 13,142, sensor:frantech-ts 13,142

client fingerprint sessions src IPs networks countries ports first → last shape
f555226df1963d1d3c09daf865abdc9a 2,984 275 155 55 22 2026-11-04 07:37 → 2026-11-05 07:19 dispersed sweep (one port, many networks)
06ff3615a51b2af343ec22abc8e30bbc 2,398 102 51 19 22 2026-11-04 07:34 → 2026-11-05 07:24 dispersed sweep (one port, many networks)
0a07365cc01fa9fc82608ba4019af499 22,983 59 31 19 22 2026-11-04 07:34 → 2026-11-05 07:20 dispersed sweep (one port, many networks)
184781a96d49ee509a431028a8d5022a 1,149 52 40 21 22 2026-11-04 07:34 → 2026-11-05 07:22 dispersed sweep (one port, many networks)
16443846184eafde36765c9bab2f4397 12,848 33 17 13 22 2026-11-04 07:34 → 2026-11-05 07:19 single-source
dd9bcf093c355da7000132131cb36fd0 27 26 1 1 22 2026-11-04 10:18 → 2026-11-05 05:06 single-source
084386fa7ae5039bcf6f07298a05a227 25 24 3 5 22 2026-11-04 07:49 → 2026-11-05 06:38 single-source
03a80b21afa810682a776a7d42e5e6fb 265 23 17 7 22 2026-11-04 07:35 → 2026-11-05 06:55 single-source

Flagged sweeps (4) — one fingerprint, many networks, single port, no authentication attempted:

  • f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 2,984 sessions from 275 source IPs across 155 networks in 55 countries, port 22, avg 4,932 B/session. Networks: AS31898 Oracle Corporation, AS16276 OVH SAS, AS8075 Microsoft Corporation, AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd., AS45899 VNPT Corp. Busiest sources: 88.147.30.59, 151.80.61.151, 129.121.77.168, 201.188.79.136, 2.189.128.6. Last 7 days: 10-30 583 IPs, 10-31 455 IPs, 11-01 610 IPs, 11-02 496 IPs, 11-03 149 IPs, 11-04 239 IPs, 11-05 98 IPs.
  • 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 2,398 sessions from 102 source IPs across 51 networks in 19 countries, port 22, avg 5,026 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS51167 Contabo GmbH, AS34984 Superonline Iletisim Hizmetleri A.S., AS138421 China Unicom. Busiest sources: 175.196.78.7, 8.138.45.99, 8.130.97.165, 8.138.210.122, 176.235.120.48. Last 7 days: 10-30 20 IPs, 10-31 101 IPs, 11-01 141 IPs, 11-02 17 IPs, 11-03 13 IPs, 11-04 10 IPs, 11-05 100 IPs.
  • 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 22,983 sessions from 59 source IPs across 31 networks in 19 countries, port 22, avg 5,360 B/session. Networks: AS198364 Banatsync Srl, AS213790 Limited Network LTD, AS211486 Alferov Aleksey Aleksandrovich, AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS210328 AO ALMAZ. Busiest sources: 109.160.32.112, 77.239.124.144, 77.239.124.150, 109.160.32.125, 109.160.32.128. Last 7 days: 10-30 83 IPs, 10-31 79 IPs, 11-01 73 IPs, 11-02 65 IPs, 11-03 62 IPs, 11-04 47 IPs, 11-05 35 IPs.
  • …and 1 more flagged fingerprint(s) in recon-2026-11-05-r3.json.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: three threshold re-crosses and one contraction. LIBSSH-MASSSWEEP (f555226df196…) re-crossed dispersed at 275 IPs/155 networks (+92 IPs, +1,431 sessions). GO-SPRAY-SWEEP (06ff3615a51b…) re-crossed at 102 IPs/51 networks after four sub-threshold days (10 → 102 IPs). OPSSH-UBUNTU-SWEEP (184781a96d49…) held the threshold at 52 IPs/40 networks while contracting (118 → 52 IPs; the 11-05 tail shows 2 IPs), and its banner set now carries three values under the one fingerprint — ssh-2.0-russh_0.45.0, ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.20, ssh-2.0-openssh_10.0p2 debian-7 — the tool-pool/spoofing read №72 set as the discriminator. GO-SSH-SWEEP (0a07365cc01f…) stayed dispersed at 59 IPs with 22,983 sessions (−1,568); its /24s (109.160.32.x, 77.239.124.x) still own the frantech-ts uname-survey legs on the flux layer. GO-SCATTER-SWEEP held 12,848 sessions at 33 IPs. CTL-MASS-SSH (4e066189c3bb…) ran 21,028 sessions (−10,119) on control-1 — still the fleet's heaviest single-fingerprint load, fifth consecutive ≥21k window. Two new fingerprints appeared below thresholds, both ssh-2.0-go: 1c79d243d7cc… (35 sessions, 3 IPs, 1 network) and b63ae9a62fd8… (57 sessions, 1 IP, 1 network) — unnamed, watch. Per-node inbound: control-1 39,633 sessions/268 IPs, lauterbourg-01-ts 15,718/2,818 (the fleet's widest per-node source spread — the fresh node draws the widest scan), frantech-ts 13,142/2,635, ai-devbox-1 12,369/384.

Fleet Observations

  • Volume shifts, explained. control-1 +788% (20,567 vs 2,315 7-day avg) — MEGA-DICTIONARY's 14,932-event replay plus Pfcloud's 2,190-event loop; ex-both, the node ran ≈3,445 events, inside its recent band. frantech-ts −80% (3,055 vs 15,027) — no dictionary replay on its flux surface this window. ai-devbox-1 +52% (6,071) — the wp-login wave, XMLRPC's 1,000-POST batch, and the tarpit 5.6× spike. netcup-ts +457% (5,226), sponge-01-ts +240% (3,301), ru-edge-1 +218% (3,446) — the wp-login wave plus tarpit spikes (9.4×/6.3×/7.2×) on deception nodes that normally run ~1,000 events. canary-farm-1 −45% (5,087) — №70–72's heavies (WIDE-CONFIG-CENSUS, Techoff arms, XFF-SWARM, XMLRPC record flood) all absent; the wave adds only ~640 events there. lauterbourg-01-ts +13% (4,327). Coverage verified: every sensor's latest event in v_full landed 2026-11-05 10:47–12:25 UTC, past the window end.
  • Canary economics. Digest issued rows: 59 (canary-farm-1 26 from 16 IPs, ai-devbox-1 15 from 12, control-1 12 from 10, ru-edge-1 6 from 6). Failures: none — the first failure-free mint window in three cycles (№71: 16, №72: 8). The Tracebit funnel (client-side window trim, as every cycle) counts 50 credentials to 22 collectors, 0 used in AWS, 50 silent.
  • Attribution/TLS posture. 1,353 requests carried X-Forwarded-For; multi-entry chains 0; XFF-ignored 0; single-entry forgery 0 — the fifth straight quiet window (№70's XFF-SWARM stays idle). TLS ran http-led on every node (canary-farm-1 HTTPS 857 vs HTTP 4,230; lauterbourg-01-ts 355 vs 3,972). Top vhost Host headers: 38.54.2.209 20,558 (control-1, the replay), v2202603343434439947.megasrv.de 4,541 (netcup-ts), vmi3177282.contaboserver.net 4,199 (ai-devbox-1), inference.fapthropic.com 1,348 (ai-devbox-1 TLS bait), vmi3610064.contaboserver.net 2,436 (lauterbourg-01-ts — the bare Contabo hostname led its node, and the TLS bait cloud.wafflehouseindex.us drew no top-2 volume this window, unlike №72's flood-inflated 11,631). SNI and Host drifted toward bare hostnames on the rebuilt node — a wordlist-refresh signal to watch.
  • New attribution artifact on lauterbourg-01-ts. 1,204 events this window carry socket peer 172.18.0.1 (the docker gateway) as clientIp, with wave-shaped journeys (php2shell-login 316, php2shell-root 316, wp-user-enum-rest-single 180, wp-login 230). Prior digests did not show this peer as a top talker on the node. The practical effect: per-IP counts on lauterbourg-01-ts under-count inbound actors for that share of traffic, and the node's php2shell-login 746-event spike (9.4×) is largely this traffic plus generic scanners — the tag claims / and /login as catch-all surfaces, per the standing quirk. Unresolved this cycle: whether these rows are NAT'd inbound (proxy-forwarded) or a local source; pivot on journeys, not the IP.
  • Control-1 discovery velocity. 53 days live (first event 2026-09-12 07:59 UTC). The window's day ran 20,567 events / 136 unique IPs — the tzulo replay owns the number; ex-replay-and-loop ≈3,445 events sits above the 7-day average (2,315) but inside the node's historical band. The network layer still points the fleet's heaviest single-fingerprint SSH load at this node (CTL-MASS-SSH, 21,028 sessions).
  • First-seen caveats. All first-seen rows share one sync-batch timestamp (02:15 stored), so they are an inventory, not a timeline. Journey attribution this window: the 20 new control-1 paths belong to 23.234.119.146's dictionary replay; pathscan/1.0 belongs to 176.123.8.213; git-config-harvester/1.0 to 45.144.212.192.
  • HoneyDB layer (ch-sponge-01-ts — platform API, pcaps separate in Arkime). 12,142 records / 2,984 sessions / 362 sources since 2026-11-04T07:35Z. Telnet dominates (8,728 records / 2,040 sessions / 105 sources); HTTP 769; MoneroRPC.wallet 554; Docker 441; LND 437. Top source 94.183.174.99 with 7,342 records — ~60% of node volume, consistent with the registry's benign research identification of this IP on the flux layer; treat the share as a monitoring caveat, not a threat. INFO classes: api_request 219, rpc_call 128, wallet_open_attempt 16, transfer_attempt 8, exec_create 7, key_exfil_attempt 5, cve_attempt 5. Lure fetches: 45.148.10.5 pulled all four .env variants at 01:09Z (/.env, /.env.bak, /.env.local, /.env.production), 176.65.144.71 pulled /.env.bak at 20:51Z. Docker dropper_indicators from 14.153.139.117 (12:05Z, 04:52Z) and 106.75.37.123 (20:44Z).
  • Fleet-side fixes. None this cycle — no service, config, or fleet changes were made.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 369 sources sent credentials → 235 got a shell (64%) → 166 ran a command (71% of shell-getters, 45% of sources). Event level: 10,865 credential attempts → 4,990 accepted logins → 14,689 commands (294% of accepted logins go on to run something). Telnet (commodity IoT botnets): 511 attempts.

New commands: zero (0 of 4,973 distinct) — a fourth quiet window; operators re-ran known tooling only. New credential pairs: 0 of 3,499 offered. Concentration: rootssssss23424123123/rootssssss23424123123 stays top (285 attempts, up from 175), the gs5662d34 family holds three of the next four slots (root/root3245gs5662d34111111111 217, 345gs5662d34/345gs5662d34 139, root/3245gs5662d34 105), then commodity pairs (root/123456 97, pi/raspberry 82, user/wasd 78, support/support 43).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (2,951 + 2,950 events from 5 IPs, example source 109.160.32.180 — the GO-SSH-SWEEP /24), the chattr -ia .ssh/lockr -ia .ssh + SSH-key-plant pair (445 events from 120 sources), and the GPU-discovery pass (nvidia-smi -q | grep "Product Name", lspci | grep "3D controller", /bin/./uname, uptime -p; 405 events each from 3 IPs, example source 2.57.122.238 — a new /24 for this pass, distinct from №72's Techoff 195.178.110.218 operator).

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

New this window

No endpoint first seen this window.

Endpoints active this window

No command or download referenced an endpoint this window.

Payload artifacts (HTTP 2xx, captured)

sha256 size type endpoint first fetched
7b8cd695424f 1487 script http://176.65.139.40/wget.sh 2026-10-20T08:57
b965f772177c 1488 script http://176.65.139.40/curl.sh 2026-10-20T08:57
62e3e86a7586 201396 elf http://152.42.195.115/main_arm7 2026-10-26T08:46
ec69d3e0d4d9 194400 elf http://152.42.195.115/main_mips 2026-10-26T08:46
1913ed2ad175 194400 elf http://152.42.195.115/main_mpsl 2026-10-26T08:46
e27e963b2b49 157468 elf http://152.42.195.115/main_arm6 2026-10-26T08:46
ba9c9d9d361d 1615 script http://176.65.139.157/telnet2.sh 2026-10-12T16:52
cf0b50b8b7a8 1476 script http://45.90.163.37/wget.sh 2026-10-31T11:22
a8db671b58d0 1477 script http://45.90.163.37/curl.sh 2026-10-31T11:22
2165fae6c486 6738 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T11:17
2d6b9901a480 14042 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T12:21
2a7af0bb942a 14506 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T12:46
a8769ddc8139 16170 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T14:04
f8d4dafd6b96 16506 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T16:45
8a8189c0c67b 5150 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T17:37
c871a756510b 5276 script http://146.190.102.83/t2r/t2r_compat.sh 2026-10-26T19:22
0cac28cc7f78 4404 script http://146.190.102.83/t2r/w1_compat.sh 2026-10-27T00:18
e06be431a8d4 1498 script http://185.228.72.128/wget.sh 2026-10-19T21:30
72d835f767c8 1499 script http://185.228.72.128/curl.sh 2026-10-19T21:30
0583d9e18684 1987 script http://176.65.132.7:8889/lv.sh 2026-10-24T10:16
b16e15764b8b 19 text http://176.65.132.7:8889/lv.sh 2026-10-24T10:16
afdbab3c1c43 2425015 elf http://5.175.192.232/bot_mips 2026-11-04T00:22
709009e02c8e 10 text http://oper.atlas101.us.kg/dl.sh 2026-10-15T04:36

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: a quiet window — no endpoint drew a command or download, and the payload inventory is unchanged. The №72 staging host http://5.175.192.232/bot_mips (2,425,015-byte Go 1.22.5 MIPS ELF, sha256 afdbab3c1c43…, family unresolved) drew no further fetches; the long-lived kla.sh fetcher (live since 09-18, 528 command events last window) and the LIBREDTAIL staging path https://217.60.102.5/sh went quiet with it.

Gaps / Next Collection

  1. WP-LOGIN-BRUTE's next window. Does the 244-IP wave repeat at width, and does any POST draw a success shape from the fake WordPress? The password list is year-indexed (Admin2026@, admin2025@) — expect 2027 compositions when it rolls; a third signature batch would establish that the tool circulates like the XMLRPC flood kit.
  2. PATHSCAN-CENSUS's 9 fresh canaries (176.123.8.213). First AWS use would extend the mint-and-work census pattern №72 saw from ACTUATOR-BEDROCK-KIT; also watch for a third Alexhost IP and whether the org's two operators share the wordlist revision.
  3. MEGA-DICTIONARY's manifest. A fifth host or a same-IP repeat answers the circulation question; the +58 growth names this cycle's dropper families (nyx_bot, krmine, PS1 stubs, uploaded .exe) — a manifest diff against №71's would isolate the additions.
  4. OPSSH-UBUNTU-SWEEP's banner pool. Three banners now share one fingerprint. A fourth supports the pool read; a stable single banner reverses it. Volume contracted to 2 IPs on the 11-05 tail — watch whether it re-widens.
  5. The lauterbourg-01-ts gateway attribution. Determine whether 172.18.0.1 peer rows are proxy-NAT'd inbound (then per-IP tables need a socketPeer caveat for that node) or a local source; one ssh root@lauterbourg-01-ts read of the sink's socket fields settles it — read-only, no sync.
  6. SI-CENSUS's schedule. Idle a second window with the 52-hoard static. Any Tracebit alert naming 102.220.163.241 answers whether the operator retired or the hoard changed hands.

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-05.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-05.md