W1n LTD โ Bulletproof Hosting Network
๐ข Entity Profile
| Field | Value |
|---|---|
| Legal Name | W1n LTD |
| RIPE Org | ORG-WL303-RIPE |
| Registered Address | Dept 302, 43 Owston Road, Carcroft, Doncaster DN6 8DA, United Kingdom |
| Contact Role | "Anastasiia" AA39751-RIPE โ role object, not a named person |
| Phone | +380 502 309 318 โ ๐บ๐ฆ Ukraine (Vodafone UA mobile) |
| Abuse Email | abuse@w1n.nl โ Netherlands domain (.nl) for a UK company |
| Commercial Brand | swedendedicated.com โ "Sweden Dedicated Servers" |
| ASN | AS42237 (registered 2017-08-10, LIR since 2022) |
| Maintainer | lir-uk-win-1-MNT |
| RIPE Created | 2022-07-07 (company) / 2023-02-25 (attack subnet) |
| UK Companies House | Not found โ likely dissolved, dormant, or never properly registered |
๐ Network Infrastructure โ 18 Announced Prefixes
| ASN | Name | Owner | Country | Role |
|---|---|---|---|---|
AS42237 | w1n | W1n LTD | ๐ฌ๐ง | Primary ASN โ hosting, botnets |
AS47508 | RaBit_Link_Katmir | W1n LTD | ๐ฌ๐ง | Secondary ASN |
AS58062 | StarNetwork | W1n LTD | ๐ฌ๐ง | Additional capacity |
AS207713 | GIR-AS | Global Internet Solutions LLC | ๐ท๐บ | Russian partner โ plausible deniability |
All operate under the AS-ICME AS-SET. Upstream transit: AS3399 (355 routes, primary), AS6939 Hurricane Electric (97 routes), AS20473 Vultr.
๐บ๏ธ Infrastructure Map โ What's on Each Subnet
.200 โ
crocs-diskont.ru (fake Crocs store).50 โ
laendliapotheke.ch (Swiss pharmacy โ possible victim or cover).2, .25 โ Windows SMB boxes (bot fleet)
swedendedicated.com, w1n.nl, icmenet.com (company servers).20 โ 2nd honeypot attacker (brute-force, GreyNoise: MALICIOUS)
.133 โ 21 unpatched CVEs, FTP+telnet exposed
animalfreeporn.com (illegal content) ยท 5 CVEs.150 โ
hoka-official.ru (fake HOKA brand store) ยท 4 CVEs.200 โ
localmachineshops.com
Tagged as
vpn by Shodan
.100 โ Web + VMware (port 902)
.25 โ SSH only
Sparse activity โ possible staging/reserve
๐ฏ Primary Attacker: 185.246.128.133
| Metric | Value |
|---|---|
| Total Events | 23,938 (29 consecutive days) |
| Sessions | 1,444 SSH connections |
| Successful Logins | 1,399 (96.9% success rate) |
| Credential Used | admin:admin โ single credential, 100% of attempts |
| SSH Client Strings | 55 different fingerprints โ rotated per session |
| Tunnel Requests | 5,596 direct-tcpip forwards |
| Commands Executed | 0 (pure tunneling, no shell interaction) |
| Malware Downloads | 0 |
| First Seen | 2026-03-21 09:01 UTC |
| Last Seen | 2026-04-18 11:38 UTC (still active) |
| Exposed Ports | 135, 137, 139, 445, 5985 (SMB + WinRM = Windows server) |
| GreyNoise | Not in scanning database |
| MikroTik Status | โ
Blocked โ mikrotik-attack list (entire /24) |
๐ Activity Pattern โ 29 Days
Consistent ~1,100 events/day with perfectly uniform 24-hour distribution โ no human sleep cycle, fully automated.
โ๏ธ Apr 2-5 gap: operator maintenance / IP rotation / infrastructure change
๐ Hourly Distribution (UTC) โ No Human Pattern
Activity is virtually flat across all 24 hours โ average 997 events/hour, standard deviation <60. This is machine-driven, not human-operated.
๐ SSH Client Fingerprint Rotation โ 55 Unique Strings
The attacker cycles through 55 distinct SSH client strings per session to evade fingerprint-based detection. This is signature of commercial proxy validation software.
๐ Tunnel Analysis โ SSH Proxy Validation
After authenticating with admin:admin, the bot opens direct-tcpip SSH tunnels to test if the compromised host can be used as an HTTP proxy. All 5,596 tunnel requests target port 80 with identical HTTP/1.0 GET payloads.
๐ฏ Tunnel Destinations โ Proxy Validation Targets
| Destination IP | Requests | Target | Purpose |
|---|---|---|---|
2001:4998:24:120d::1:0 | 461 | Yahoo.com (IPv6) | HTTP proxy test |
2001:4998:124:1507::f000 | 446 | Yahoo.com (IPv6) | HTTP proxy test |
2001:4998:44:3507::8001 | 437 | Yahoo.com (IPv6) | HTTP proxy test |
98.137.11.163 | 405 | Yahoo Mail | HTTP proxy test |
74.6.143.25 | 397 | Yahoo CDN | HTTP proxy test |
74.6.231.21 | 387 | Yahoo CDN | HTTP proxy test |
5.255.255.77 | 159 | Yandex.ru | HTTP proxy test |
77.88.44.55 | 148 | Yandex DNS/Web | HTTP proxy test |
77.88.55.88 | 147 | Yandex DNS/Web | HTTP proxy test |
๐ด Criminal Activities Hosted on AS42237
| Activity | Evidence | Location | Severity |
|---|---|---|---|
| SSH Proxy Botnet | 24K events, 5,596 tunnels, 55 rotating SSH clients | 185.246.128.133 | โ Critical |
| Credential Stuffing | Brute-force with admin:admin + 0:0, GreyNoise: MALICIOUS | 185.246.130.20 | โ Critical |
| Counterfeit E-commerce | crocs-diskont.ru โ fake brand discount store | 185.246.128.200 | โ High |
| Counterfeit E-commerce | hoka-official.ru โ fake HOKA brand store | 185.217.0.150 | โ High |
| Illegal Content | animalfreeporn.com | 185.217.0.50 | โ Critical |
| Tor Exit Node | Port 9001, Shodan tag: tor | 193.105.134.150 | โ High |
| VPN/Proxy Farm | OpenVPN (1194) + Squid (3128), tagged vpn | 185.217.1.x | โ Medium |
| Vulnerable Infrastructure | 21 unpatched CVEs, FTP+telnet exposed | 185.246.130.133 | โ High |
๐ก๏ธ Our Defense Response
mikrotik-attack address list. Static ban, no timeout.๐ Final Assessment
Threat Classification: Organized Criminal Infrastructure
W1n LTD operates a bulletproof hosting network spanning 5 countries (UK registration, Ukrainian operator, Swedish hosting, Dutch abuse contact, Russian partner ASN). The infrastructure serves multiple criminal verticals simultaneously: proxy botnets for sale, counterfeit e-commerce fraud, illegal content hosting, and anonymization services.
The SSH proxy validation bot on 185.246.128.133 demonstrates commercial-grade tooling: 55 rotating SSH client fingerprints, perfectly uniform 24/7 operation, and Yahoo/Yandex as validation targets โ hallmarks of proxy-as-a-service infrastructure sold on underground markets.
The 4-day operational gap (Apr 2โ5) followed by continued activity suggests active operator maintenance, not abandoned infrastructure. This is a living, maintained criminal operation.
๐ Investigation Metadata
| Investigation ID | TI-2026-001 |
| Date Conducted | 2026-04-18 |
| Data Sources | Cowrie honeypot logs (190MB), RIPE WHOIS, Shodan InternetDB, GreyNoise Community, RIPE Stat BGP, ThreatFox, URLhaus |
| Analysis Tools | LSN SOC Dashboard, 25 MCP Tools, custom Python aggregation |
| Monitoring Period | 2026-03-21 โ 2026-04-18 (29 days) |
| Confidence Level | HIGH โ direct evidence from honeypot + multi-source OSINT corroboration |