Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№43: NINTH use window — 1 credential / 4 events (2× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 denied); use side SS-Net .211, which also returned to minting (2 on aidev under an Opera/5.02 forgery) after №42's miss. 56 creds to 41 collectors, 0 failures. Hoards: .175 89/6d, .171 24/6d. №42: EIGHTH consecutive use window — 1 credential used (Feo Prest .175: 2 sts:GetCallerIdentity successes + denied ListFoundationModels ×2 from 4 AWS IPs; mint side control-1). 35 mints to 24 collectors, 0 failures.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT active
NINTH RUN №43 — RETURNED after 15 idle days: 105.159.4.244 (ONP MA) posted the verbatim verify '<?php echo "NightAgent";?>' AND the UNCHANGED nightagents/nightshell dropper POST (same GHSAT token; repo 404 since 09-24, so the copy() cannot succeed), then form login user=root&pass=wrong + wp-batch SQLi + config-bundle census + 1 mint (farm). Second operator same day: 185.213.193.49 (Zenlayer US) ran the kit minus the phpunit stage — 3 passes across farm+aidev, 3 mints. №28: first mint; dropper URL is unchanged kit, not the registered 'return requires new dropper URL' case.
flowchart LR
V["phpunit verify<br/>NightAgent echo"] --> D["nightshell dropper POST<br/>unchanged URL + token<br/>(repo 404 — copy fails)"]
D --> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>author_exclude UNION"]
W --> C["config-bundle census<br/>+ /.env mint"]
METADATA-HUNT idle
Idle since №22 as a campaign; 7th marker-light window. №33: 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№43: THIRD consecutive miss — no /46 census; a NEW pool-singles pair 94.154.43.125 (farm) + .146 (aidev) minted 1 each under Chrome/147, and .100's bare-UA `/` passes repeated on 7 nodes (71 ev). №42: SECOND consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again (04:16 UTC, forged Chrome/147). №41: first miss after .250's second run. Block spans .242–.250; no observed AWS use.
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
№43: 18 l9scan IPs / 769 events / 14 mints (1/IP) across 6 sensors in one 19:53–20:43 EDT wave, all DigitalOcean; UA variants 2.0.930323 / 2.0.234313 / 2.0.6343 / 2.0.632323. l9explore 45.138.12.51: 87 ev on netcup, 0 mints (4/6d). LeakIX l9scan template. №42: contracted to 17 l9scan/l9explore IPs / 1,219 events after №41's 31-IP record; mints 1/IP across control, aidev, farm, ru-edge + lauterbourg (27-family kill-chains; 165.227.173.41 hit 2 nodes); zero burst rejections. 45.138.12.51 (Tc Datacenter LT) mints under l9explore/1.2.2 with a 20-family env census — exploit-grade sibling. LEAKIX-SSH absent this window. Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>17 IPs №42"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№43: .171 ELEVENTH consecutive mint window — 4 mints across farm/aidev×2/control (24/6d) from only 10 events on 7 sensors. The 45.154.138.x cluster returned for a SECOND mint window with 9 mints — promoted to its own row (CONFIGBUNDLE-SWARM). Feo .154 absent; .92.65 minted 4. №42: 45.148.10.171 TENTH consecutive minting window — 6 mints across 4 sensors, 0 rejections (20/6d). NEW /24 collector cluster 45.154.138.x on control: 3 IPs (.72/.88/.51), 1 mint each, Firefox/105 + Chrome/39 + Chrome/106 forgeries. Feo .175 minted 2 + used 1; .154 minted 2 (72/6d). SS-Net .92.65 minted 7 across 3 sensors (17/6d). №41: ninth window.
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE active
№37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
№43: 30th loop window — 2,198 ev / 571 paths on control (204.76.203.18); /24 siblings .237 and .219 ran 8-node light touches (72 / 16 ev) under the same Edg/90 UA as 91.92.40.236. №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
№43: FIRST MISS after three consecutive windows (3xK trio absent). Separate: 102.220.161.102 (CREDSWEEP block, VPS Dedicated SI) ran a 144-path fake-git walk on aidev — a new operator for the template; watch for a repeat. Git-internals walk + secrets files. №42: THIRD consecutive window — NEW third IP 216.26.239.111 (3xK Tech, cc BR) ran the identical 144-ev / 142-path walk on canary-farm-1 (14:48 UTC), 0 mints. №41: the .149/.141 pair repeated the same walk 1 h apart. Honest git UA is the family fingerprint (git/2.39.0 → git/2.40.0).
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["3xK Tech IPs ×3 across<br/>3 windows · 0 mints"]
LIBREDTAIL-KIT active
phpunit directory-permutation RCE, honest UA libredtail-http. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE merged
MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№43: 98.98.47.133 (Zenlayer MY, №40's host) returned — frantech 00:23–00:25 EDT, 13,414 ev / 13,414 paths in 2 min. Anti-join vs №42's set: +17 new / −1 dropped (13,398 → 13,414) — fifth straight growth (+6/+27/+34/+39/+17). New: /backup/winki.* ×10 archs, /nyx_bot_linux_{amd64,mipsle}_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, +3 /c/ token paths. №42: SAME-HOST RETURN — 185.213.155.227 (31173 Services AB, №30's host) replayed on frantech-ts 23:32–00:33 UTC: 13,398 events / 13,398 paths over ~1 h (slow pass vs the 2-min bursts), 0 mints. +209 paths vs its own 09-24 set; +39 vs №41's pooled 13,359 (4th straight growth: +6/+27/+34/+39). New families: /bins/aurora.* (Aurora), /bin/manta.* ×13 archs, /release/DS.*, /302/*, random-token paths. №41: 138.199.6.234 (Datacamp CH), +34 incl. first xmrig entries.
flowchart LR
F["13,398-path IoT dropper-URL<br/>dictionary (+209 vs host's 09-24)"] --> R1["Replay: 31173 AB host<br/>frantech-ts · ~1 h slow pass"]
R1 --- B["0 POSTs · 0 mints<br/>byte-shared artifact"]
F --- NEW["New families:<br/>aurora.* · manta.* ×13"]
WP-BATCH family recurring
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
№43: THIRD operator — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT) with marker /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 5 operators / 5 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP active
№43: 87.120.104.29 RETURNED with a changed kit — netcup 150 paths in 0.087 s under Googlebot/2.1, webshell-probe ×6 + dockerenv-marker (the Tamatiya shape), not the .env census; 0 mints. 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE recurring
№43 SIXTH window: enum stage absent a SECOND window (0 wp-user-enum-rest); 92 credential POSTs from 42 IPs + 123 probes / 41 IPs + 32 xmlrpc / 24 IPs; ed66 leg 21 IPs / 84 ev — the only registered signature in today's cluster table. ⟳ 5th window №42: roster grew to 46 runner IPs across the wp-login/xmlrpc/enum surfaces, but the wp-json ENUMERATION STAGE VANISHED (0 wp-user-enum-rest vs ~840 in №41) — a credential-only wave: df15d0ee3ccf 6 IPs/370 POSTs (3 sensors) + ed66cc967251 21 IPs/84 + NEW sig 2bdde2df2cf6 (4 IPs, aidev). NEW one-POST generation (Chrome/152 class) derives passwords from the target vhost: pwd=inference (fapthropic), pwd=sso (rightabouteverything), amen123. №41: ~25 runners, 840 enum + ~540 credential POSTs.
flowchart LR
Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING active
⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №42: collector .92.65 minted 7 across aidev/control/farm under rotating mobile+desktop forgeries (17/6d); primary .211 ABSENT — first miss in five windows. №41: .211 minted 2 and used 1 credential (5th use window).
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x. №42: FULL TEMPLATE RETURN — 9 fresh /c/<100-char token> paths on frantech-ts (first-seen) + .env directory variants on netcup (/queue/.env, /tokens/.env, /mail/.env); 0 mints. .124/.125 ran bare tarpit-module passes on 7-8 nodes. №39: scout shape; №38: 3 synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
BUCKLOG-KIT recurring
Bucklog SARL FR /24. №42: THIRD consecutive census window — 185.177.72.75 hit netcup (460 ev / 247 paths, 02:24–02:28 UTC) AND frantech-ts (115 ev / 59 paths, 00:44–00:49), 12 webshell-probe results on netcup; 0 mints. №41: control-1 1,022 ev. Original kit (phpunit verify + reverse shell) dormant since day 7; promote on any phpunit/RCE POST.
flowchart LR
C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]
KITEWORKS-CRAWL recurring
№43 SECOND window — recurring: repeat Google BE IP 35.205.254.119 (119 ev, 04:33 EDT) + NEW operator 45.138.12.27 (Tc Datacenter LT — the l9explore block; 141 ev, 09:35 EDT) with the same shape: root-redirect → /login → 23 kiteworks-asset bundles → webshell sweep+probe + a 103-path not-handled census; bare-Chrome + Chrome/128 UAs; 34.52.229.253 absent; 0 mints. ⚠ №42: FIRST third-party traffic on lauterbourg-01-ts's Kiteworks decoy — 2 Google LLC BE IPs (34.52.229.253, 35.205.254.119) ran ~1-min passes (144/119 ev): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep + webshell-probe + not-handled census. UAs: bare stripped Chrome (no platform token — the ZKILLU class) + Chrome/128. 0 mints. Watch for a second node or a return with credential paths.
flowchart LR
K["Google BE IPs ×2<br/>bare Chrome + Chrome/128"] --> R["kiteworks-root-redirect"]
R --> L["/login<br/>kiteworks-shell"]
L --> A["23 kiteworks-asset<br/>JS bundles"]
A --> W["webshell probes +<br/>census · 0 mints"]
CONFIGBUNDLE-SWARM recurring
⟳ 45.154.138.x /24 on control-1, PROMOTED №43 on a second mint window (9 mints vs №42's 3): .72/.51 Chrome/106 + .88 Chrome/39 config-bundle censuses, then a 61-s python-requests burst minting 1 each from 6 more IPs (.70/.78/.84/.95/.164/.165) at 11:30–11:31 EDT. Sibling shape: 45.79.200.28 (Akamai/Linode) ran the same 20-path webapp-config-bundle-js census on control + ru-edge and minted 1 each — same kit, second block. Promote the Linode IP on a third window.
⚠ NEW №43: distributed mobile-UA walker against tarpit-served env paths — sig d045b89fe96b /.envrc (14 IPs, 6 nodes) + e4cbfe2556fa /var/.env (7 IPs, 5 nodes), first seen 10-06, fleet-wide, ~9–13 events per IP. Rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile). 0 mints — the tarpit eats every walk; residential egress class like WP-LOGIN-BRUTE's pool.
flowchart LR
P["Residential mobile IPs<br/>Chrome/153-156 · FF/152-156"] --> E["/.envrc + /var/.env<br/>tarpit-module walks"]
E --> Z["0 mints · fleet-wide<br/>sigs d045b89f / e4cbfe25"]
LLM-ENDPOINT-PROBE recurring
⚠ NEW №43: 104.168.115.214, honest UA AutoGenX-Engine/9.1 — 48 POSTs against lauterbourg's LLM decoys over 18 h: /api/tags → 10× /api/chat (Ollama) 09:06–10:22 EDT, then 4× /v1/models + 33× /v1/chat/completions 13:17–03:01. All 200; request bodies not captured. This IP owns the llm-endpoint-openai-chat 16.5× spike.
flowchart LR
T["/api/tags<br/>ollama-tags 200"] --> C["10× /api/chat<br/>ollama-chat"]
C --> M["4× /v1/models + 33×<br/>/v1/chat/completions"]
M --- Z["AutoGenX-Engine/9.1<br/>1 IP · 18 h · all 200"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-06 07:32:00 → 2026-10-07 07:33:07 UTC · 106,397 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)