TI-2026-014 โ "Phase Layer" โ The Swiss-Panamanian Bulletproof Hosting Empire and the 2,775-Session Burst
๐ Executive Summary
On 2026-05-23 between 18:00-20:00 UTC, a single IP (179.43.139.58) escalated from ~30 SSH attempts/day to 2,775 sessions in 120 minutes against our Cowrie honeypot. The IP belongs to Private Layer INC (AS51852), a 14-year-old bulletproof hosting provider incorporated in Panama but physically operating from Bellinzona and Manno, Ticino, Switzerland.
HASSH fingerprint analysis links this IP to a 4-node attack cluster spanning two autonomous systems. The second ASN โ Omegatech LTD (AS202412) โ is a 5-month-old Seychelles shell company sponsored by Daniel Mishayev (Israeli national, Bavarian resident) through Pfcloud UG. Both attack vectors converge on the same SSH client binary, the same credential (admin:admin), and crucially โ zero post-exploitation activity across 3,833 successful logins.
The escalation timing correlates with the publication of threat intelligence dossiers on this platform. We assess with MEDIUM-HIGH confidence that this represents deliberate retaliation or probing in response to public exposure of the actor's infrastructure.
The escalation event was sudden, deliberate, and single-source. 179.43.139.58 accounted for 99.0% of all sessions during the burst window. No other cluster IP participated in the burst โ this was a targeted volume escalation from one node.
| Metric | Value |
|---|---|
| Burst window | 2026-05-23 18:00โ19:59 UTC (21:00โ22:59 EEST) |
| Total sessions in window | 2,775 |
| 179.43.139.58 contribution | 2,747 sessions (99.0%) |
| Peak hour | 19:00 UTC โ 1,476 sessions (24.6/minute) |
| Unique IPs in window | 16 (15 are background noise) |
| Previous 30-day baseline | ~20-30 sessions/day from this IP |
| Escalation factor | ~100ร |
| Credential used | admin:admin (99.5%) + blank/null probing (0.5%) |
| Post-burst behavior | Switched to slow protocol fingerprinting (120s null sessions) |
The escalation onset correlates with the publication of threat intelligence dossiers on this platform (specifically TI-010 and TI-013 which document infrastructure controlled by the same WHITELABEL-MNT / Daniel Mishayev / Pfcloud ecosystem). The actor's infrastructure was partially exposed in those publications. This burst occurred within 24-48 hours of that exposure window.
All four IPs share HASSH fingerprint a7a87fbe86774c2e40cc4a7ea2ab1b3c โ a cryptographic hash of the SSH client's algorithm negotiation. This proves identical SSH tooling across both ASNs, ruling out coincidence and confirming a single operator.
| # | IP Address | ASN | Provider | Sessions | First Seen | Status |
|---|---|---|---|---|---|---|
| 1 | 179.43.139.58 | AS51852 | Private Layer INC | 3,461 | 2026-04-23 | ๐ด PRIMARY |
| 2 | 179.43.133.154 | AS51852 | Private Layer INC | 374 | 2026-04-24 | โ ๏ธ Quiet since May 18 |
| 3 | 178.16.54.226 | AS202412 | Omegatech LTD | 1 | 2026-05-21 | โก Probe only |
| 4 | 94.154.35.215 | AS202412 | Omegatech LTD | 0 | โ | ๐ก Intel-linked only |
Despite 3,833 successful honeypot authentications, the actor never executed a single command, never downloaded a payload, never attempted lateral movement. This is not a botnet deployer โ this is a credential harvesting service. The operator validates default credentials at scale and likely sells confirmed-working access to Initial Access Brokers (IABs) on darknet markets.
The infrastructure behind this cluster is deliberately architected to frustrate abuse reporting and law enforcement. Each link in the chain crosses a different legal jurisdiction, creating gaps where no single authority has complete visibility or enforcement power.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ JURISDICTIONAL OBFUSCATION CHAIN โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค โ โ โ ๐ต๐ฆ PANAMA โโโ Private Layer INC (reg# 711544) โ โ โ Kevin Ponce ยท Milciades Garcia ยท Torre De Las Americas โ โ โ Phone: +507 833 9167 / +507 836 5449 โ โ โ โ โ ๐จ๐ญ SWITZERLAND โโโ Physical Datacenter (Bellinzona/Manno, Ticino) โ โ โ AS43440 Digitale Suisse AG โ โ โ โ James McCreary (+41 78 330 1123) โ โ โ Via Cantonale 2c, 6928 Manno โ โ โ RADB maintainer for AS51852 โ โ โ โ โ ๐ฉ๐ช GERMANY โโโ Pfcloud UG (haftungsbeschrรคnkt) โ โ โ HRB 12249, District Court Passau โ โ โ Waning 1, 94136 Thyrnau, Bavaria โ โ โ โ Daniel Mishayev (ORG-DM262-RIPE) โ โ โ Phone: +49 176 4038 5000 โ โ โ LIR sponsor for Omegatech + transit upstream โ โ โ โ โ ๐ฎ๐ฑ ISRAEL โโโ Daniel Mishayev (nationality) โ โ โ Lilienstraรe 5, 94051 Hauzenberg (Bavarian address) โ โ โ โ โ ๐น๐ท TURKEY โโโ lir-tr-mgn-1-MNT (IP maintainer for Omegatech) โ โ โ Fenerbahce Mah., Igrip Sk. No:13, Kadikoy/Istanbul โ โ โ Created: 2025-02-26 (prepared infrastructure) โ โ โ โ โ ๐ธ๐จ SEYCHELLES โโโ Omegatech LTD (reg# 410583) โ โ โ House of Francis, Room 303, Ile du Port, Mahe โ โ โ abuse@omegatech.sc โ โ โ Created: 2026-01-05 (5 months old!) โ โ โ โ โ ๐ท๐ด ROMANIA โโโ DNS/Hosting for phaselayer.com โ โ โ Petru-Octavian Bunea (b. April 1988, Timiศoara) โ โ Bunea TELECOM SRL (RO #32205390) + UNMANAGED LTD (UK) โ โ ns1/ns2.servere.ro โ 185.232.66.180/181 โ โ AS47890 โ 9,472 IPs โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
A 14-year-old bulletproof hosting provider currently rebranding as "Phase Layer Global Networks" โ a textbook reputation-laundering exercise. Despite Panamanian incorporation, all physical infrastructure resides in Switzerland. The LACNIC IP registration creates a deliberate enforcement gap.
| Field | Value |
|---|---|
| ASN | AS51852 (PLI-AS) โ registered 2010-11-15 |
| Current brand | "Phase Layer Global Networks" (PeeringDB, July 2022) |
| Old brand | "Private Layer" (listed as "Also Known As") |
| Incorporation | Panama, reg# 711544 |
| Physical location | Bellinzona + Manno, Ticino, Switzerland |
| IP space | 92 IPv4 prefixes (~34,816 addresses) |
| Hosted domains | 18,694 |
| RPKI status | Only 18/92 prefixes ROA-valid (80% unauthenticated) |
| Transit | AS43440 Digitale Suisse AG (single upstream!) |
| Marketing | "We understand Offshore Hosting, we value privacy and stability" |
| Abuse responsiveness | Known unresponsive โ bulletproof by design |
| Threat intel presence | 50+ OTX pulses, CIArmy feed continuously since Nov 2023 |
The 179.43.128.0/18 block (containing our primary attacker) is registered with LACNIC (Latin American NIC, authoritative for Panama) but physically geolocated to Rรผmlang, Zรผrich, Switzerland (47.4505ยฐN, 8.5255ยฐE). This creates an intentional jurisdictional gap: LACNIC sees "not our physical territory," Swiss authorities see "not our registry." Result: nobody takes enforcement responsibility.
The individual with actual physical access to the infrastructure and BGP routing control. McCreary operates both the upstream (Digitale Suisse AG) and the attack-hosting network (Private Layer/Phase Layer) from Ticino, Switzerland.
| Field | Value |
|---|---|
| Full name | James McCreary |
| RIPE handle | JM21577-RIPE |
| Address | Via Cantonale 2c, 6928 Manno, Ticino, Switzerland |
| Phone | +41 78 330 1123 (Swiss mobile) |
| james@digitalesuisse.com | |
| Company | Digitale Suisse AG (AS43440) |
| Role | Admin/Tech for AS43440 + RADB maintainer for AS51852 |
| RIPE created | 2021-02-03 |
| Last active | 2025-07-08 (RIPE) / 2024-05-20 (RADB update for AS51852) |
๐ฉ Evidence linking Digitale Suisse = Private Layer: (1) Word-for-word identical marketing text on both websites, (2) Same services (Supermicro dedicated servers, Swiss colocation), (3) Direct BGP bilateral relationship, (4) AS51852 RADB entry uses mnt-by: MAINT-AS43440 (Digitale Suisse's maintainer), (5) james@digitalesuisse.com in RADB change records for AS51852, (6) Both ASNs in AS-DIGITALESUISSE macro, (7) Both in Ticino canton (Manno and Bellinzona, 35km apart).
A 5-month-old Seychelles shell registered at the most abused virtual office in the RIPE database. Created in the same week its ASN was provisioned. Sponsored and transited by Pfcloud UG โ the same entity from TI-013.
| Field | Value |
|---|---|
| ASN | AS202412 โ created 2026-01-12 |
| Registration | Seychelles, reg# 410583 โ House of Francis Room 303, Mahe |
| IP space | 20 prefixes (5,120 IPv4 addresses) |
| Hosted domains | 33,156 (~6.5/IP โ mass-hosting or phishing infra) |
| Geofeed locations | Frankfurt DE, Amsterdam NL, New York US |
| Transit upstream | AS51396 Pfcloud UG (same as LIR sponsor!) |
| LIR sponsor | ORG-DM262-RIPE (Daniel Mishayev) |
| IP maintainer | lir-tr-mgn-1-MNT (Istanbul, Turkey) |
| Attack nodes | Windows Server VPS: WIN-9RJP0JGF6B1 + WIN-3NSR3D65T98 |
| RPKI | All 20 prefixes ROA-valid (operator is ROA-aware) |
| Routing anomaly | 94.154.35.0/24 registered to Ukrainian entity, routed by Omegatech |
๐ฉ Red Flags: Seychelles registration (notorious shell jurisdiction), "House of Francis Room 303" virtual office (identical pattern to TI-013's WHITELABEL-MNT entities), German UG as LIR sponsor (โฌ1 minimum capital, trivial to register), Turkish IP maintainer created 10 months before ASN (prepared infrastructure), 33K domains on 5K IPs (mass abuse hosting), ASN modified 2026-05-21 โ 2 days before this attack burst.
| Field | Value |
|---|---|
| RIPE org | ORG-DM262-RIPE (LIR type) |
| Nationality | Israeli (IL) |
| Address | Lilienstraรe 5, 94051 Hauzenberg, Germany (Bavaria) |
| Phone | +49 176 4038 5000 |
| Company | Pfcloud UG (haftungsbeschrรคnkt) โ HRB 12249, Passau |
| Second address | Waning 1, 94136 Thyrnau, Germany (25km from Hauzenberg) |
| ASN | AS51396 (PFCLOUD) โ 24 downstream customer ASNs |
| Role | LIR sponsor + transit upstream for Omegatech (double control) |
| Related entity | WHITELABEL-MNT โ primox-llc-forward@pfcloud.network |
๐ Critical link: Phone +49 176 4038 5000 appears on BOTH ORG-DM262-RIPE (Daniel Mishayev, Omegatech's LIR sponsor) AND ORG-PU41-RIPE (Pfcloud UG, Omegatech's transit upstream). One person/entity provides both the legal basis AND the connectivity for Omegatech to exist on the Internet. This is the same WHITELABEL-MNT ecosystem documented in TI-013.
Private Layer's rebrand website phaselayer.com is hosted and DNS-served entirely through Romanian infrastructure controlled by Petru-Octavian Bunea.
| Field | Value |
|---|---|
| Name | Petru-Octavian Bunea |
| DOB | April 1988 |
| Location | Calea Stan Vidrighin 14A, 300571 Timiศoara, Romania |
| Romanian company | Bunea TELECOM SRL (reg# 32205390) |
| UK company | UNMANAGED LTD (Companies House #12461131) |
| ASN | AS47890 (UNMANAGED-DEDICATED-SERVERS) โ 9,472 IPs |
| Hosting brands | servere.ro, gazduire.us, host.ro, bunea.eu, unmanaged.uk |
| Self-description | "Wholesale provider of dedicated servers for resellers" |
| Phone | +40 752 481 282 |
| bunea.petru@yahoo.com / suport@bunea.eu |
Connection: phaselayer.com DNS: ns1.servere.ro / ns2.servere.ro โ 185.232.66.180/181 (Bunea's IP space). Website hosted at 185.232.64.48 (also Bunea/AS47890). The Romanian entity provides hosting infrastructure for PrivateLayer's rebranding effort. Whether Bunea is merely a reseller with an indifferent customer, or an active participant in the bulletproof ecosystem, requires further investigation.
| Date | Event |
|---|---|
| 2010-11-15 | AS51852 registered as "PLI-AS" (Private Layer INC) |
| 2016โ2023 | Extensive presence in abuse feeds, blocklists, CTI pulses |
| 2020-10-30 | phaselayer.com domain registered (rebrand begins) |
| 2022-07-27 | PeeringDB ASN name changed to "Phase Layer Global Networks" |
| 2024-05-20 | james@digitalesuisse.com updates AS51852 RADB entry |
| 2026-01-05 | Omegatech LTD created (fresh abuse vehicle) |
| 2026-04-15 | AS51852 RIPE record last changed (5 weeks before this attack) |
| 2026-05-21 | Omegatech RIPE record modified (2 days before burst!) |
The rebrand from "Private Layer" to "Phase Layer" is classic reputation laundering โ a technique where bulletproof hosters abandon heavily-flagged brand names while maintaining identical infrastructure and personnel. The operation continues unchanged; only the label differs.
| IP | Passive DNS | Shodan Ports | Service |
|---|---|---|---|
179.43.139.58 | romantic-wing.179-43-139-58.plesk.page (Oct 2024) | 112 open | Plesk-managed VPS |
179.43.133.154 | valcpno.com, sdcfr.salsaik.top, disarmu.xyz | 80 open | Multi-use hosting node |
94.154.35.215 | (none โ fresh) | 71 open | Windows Server (WIN-9RJP0JGF6B1) |
178.16.54.226 | (none โ fresh) | 132 open | Windows Server (WIN-3NSR3D65T98) |
The two attack ASNs use entirely different transit providers โ the operational linkage is at the customer level (same threat actor), not infrastructure level. This confirms the attacker deliberately diversifies hosting across unrelated providers for resilience.
| Upstream ASN | Name | AS51852 | AS202412 |
|---|---|---|---|
| AS43440 | Digitale Suisse AG (McCreary) | โ Direct upstream | โ |
| AS51396 | Pfcloud UG (Mishayev) | โ | โ Direct upstream |
| AS30823 | aurologic GmbH | โ | โ Secondary upstream |
| AS6939 | Hurricane Electric | โ (via Digitale Suisse) | โ |
| Source | IP | Finding |
|---|---|---|
| AlienVault OTX | All 4 IPs | 50+ pulses each (API cap), all SSH/Telnet honeypot feeds globally |
| ISC SANS CIArmy | 179.43.133.154 | Continuously listed Nov 30, 2023 โ May 11, 2026 (2.5 years) |
| AbuseIPDB | 179.43.139.58 | Score: 100/100, 901+ reports |
| Shodan InternetDB | 179.43.139.58 | 112 open ports โ scanning infrastructure, not a server |
| T-Pot Honeypot (AU) | All cluster | Active May 2026, conrat45 feed |
| Rimba Siber (MY) | All cluster | Active May 2026, Malaysian CERT feed |
| DoctorZl0 Cowrie Feed | All cluster | MISP, SSH Bruteforce tag, April 2026 |
CPU: 3% (9 cores)
Memory: 576MB free / 1024MB
RouterOS 7.22 stable
Infrastructure unaffected.
since 2026-03-25
(all traffic except SSH/honeypot)
CrowdSec: 54,528 active bans
Attack absorbed by design.
Cowrie SSH honeypot active
All sessions logged + attributed
STIX 2.1 + IOC export
Every attempt is intelligence.
For abuse reporting and law enforcement escalation:
| Entity | Contact | Type | Likelihood of Response |
|---|---|---|---|
| Private Layer / Phase Layer | abuse@privatelayer.com | Direct abuse | โ None (bulletproof) |
| Digitale Suisse AG (upstream) | james@digitalesuisse.com / +41 78 330 1123 | Transit provider | โ ๏ธ Low |
| Omegatech LTD | abuse@omegatech.sc | Direct abuse | โ Shell company |
| Pfcloud UG (LIR + transit) | abuse@pfcloud.io / noc@pfcloud.io | LIR escalation | โ ๏ธ Low (same ecosystem) |
| RIPE NCC | Via abuse-c + NCC ticket | Registry compliance | โ Formal process |
| Swiss NCSC | incidents@ncsc.ch | National CERT | โ Jurisdiction over datacenter |
# โโโ NETWORK INDICATORS โโโ # Attack Cluster (HASSH-linked) 179.43.139.58 # AS51852 โ PRIMARY ATTACKER (3,461 sessions) 179.43.133.154 # AS51852 โ Secondary node (374 sessions, 2.5yr history) 94.154.35.215 # AS202412 โ Omegatech Windows VPS 178.16.54.226 # AS202412 โ Omegatech Windows VPS # Recommended subnet blocks 179.43.128.0/18 # Full Private Layer allocation (34,816 IPs) 94.154.35.0/24 # Omegatech (Ukrainian RIPE block, routed via Omegatech) 178.16.52.0/22 # Omegatech NL allocation # โโโ SSH FINGERPRINT โโโ HASSH: a7a87fbe86774c2e40cc4a7ea2ab1b3c # โโโ ASSOCIATED ASNs โโโ AS51852 # Private Layer INC (Panama/Switzerland) โ bulletproof AS202412 # Omegatech LTD (Seychelles) โ 5 months old, bulletproof AS51396 # Pfcloud UG (Germany) โ Omegatech enabler AS43440 # Digitale Suisse AG (Switzerland) โ PrivateLayer upstream # โโโ INFRASTRUCTURE DOMAINS โโโ phaselayer.com # PrivateLayer rebrand website (Bunea DNS) privatelayer.com # Original brand omegatech.sc # Omegatech shell company site pfcloud.io # Pfcloud operations pfcloud.network # Pfcloud abuse forwarding domain