A sophisticated residential proxy botnet operates exclusively on Vietnam's Viettel telecommunications network, leveraging 102 compromised residential broadband devices as SSH tunnel proxies. Unlike traditional brute-force botnets that seek to install malware, this network's sole purpose is to verify SSH credentials and test proxy connectivity — the hallmark of a commercial residential proxy service operating on hacked home routers.

The smoking gun: AbuseIPDB reports from other honeypot operators capture post-authentication behavior — SSH direct-tcpip tunnel attempt. Destination: ip-who.com:80 — the botnet verifies each proxy's exit IP before adding it to the commercial pool. Our honeypot observes the credential verification phase: 100% authentication success rate (they only test known-good defaults), zero commands executed, zero malware downloads — just connect, authenticate, disconnect. The actual proxy traffic flows through other compromised servers.

Each IP is active for a maximum of 6 minutes (91 parallel connections in that window), then never seen again — consistent with CGNAT dynamic IP rotation on residential broadband. The malware persists on the physical device (likely a home router), continuing operation regardless of which public IP it receives. We estimate 15-25 physical devices generating 102 unique IPs over 58 days of observation, with the botnet actively growing at ~1.5 new IPs per day.

Every single connection from all 102 IPs presents the identical SSH client banner:

Banner:  SSH-2.0-AsyncSSH_2.1.0
HASSH:   fda360b1b4f4d3455cb75c6e7edb1d11

AsyncSSH 2.1.0 was released on November 30, 2019 — it is now 34 versions behind the current release (2.23.0, May 2026). The malware author embedded this library into their router implant in late 2019/early 2020 and never updated it. This is the permanent forensic fingerprint of frozen botnet firmware — updating router malware risks bricking the device or triggering detection, so operators leave the initial build running for years.

The HASSH algorithm string includes deprecated ciphers (arcfour, blowfish-cbc, 3des-cbc) and weak KEX (diffie-hellman-group1-sha1, rsa1024-sha1) — the exact default configuration of AsyncSSH 2.1.0 with zero customization. This means the malware is using the library straight out of the box with no attempt to disguise its fingerprint.

All 102 nodes map to exactly 5 dynamic IP allocation pools, confirming residential broadband subscribers receiving rotating CGNAT addresses:

Phase 1: Credential Spray (what our honeypot captures)

Phase 2: Tunnel Verification (captured by other honeypots via AbuseIPDB)

Phase 3: Commercial Proxy Usage (inferred from business model)

Once verified, the residential IP joins a proxy pool sold to customers needing: web scraping with residential IPs (bypass anti-bot), ad fraud (clicks from "real" IPs), account creation/credential stuffing (avoid bans), censorship circumvention (exit through residential IPs).

On other targets (extracted from AbuseIPDB report logs), the botnet uses an expanded 41-username dictionary including: oracle, ftp, nginx, squid, ubnt (Ubiquiti routers), belkinstyle (Belkin routers!), nikita, rebecca, config, installer, support. The presence of "belkinstyle" — a known Belkin home router default — confirms the botnet specifically targets consumer networking equipment.

IP Lifecycle: Maximum active time = 6 minutes (0.1 hours). Average = under 1 minute. Each IP is used exactly once then permanently discarded.

Daily Pattern: Exactly 2 IPs/day (64% of days), 3 IPs (14%), 4 IPs (20%). Never 0, 1, or 5+. This is automated scheduling, not random.

Day-of-Week: Wednesday peaks (124 sessions, 20 IPs), Sunday troughs (24 sessions, 4 IPs) — correlates with business-day proxy demand in UTC+7.

Growth: Linear +1.5 new IPs per day for 58 days. The botnet is actively expanding through ongoing exploitation of newly-deployed vulnerable routers.

A single visit from 27.79.44.126 on March 25, 2026 at 23:14 UTC:

Likely Actor Type: Commercial Residential Proxy Provider

• Motivation: Financial — selling proxy access ($2,000-$10,000/month estimated)
• Capability: Medium-high — custom AsyncSSH automation, persistent router malware
• Sophistication: High OpSec — no forensic traces, ephemeral IPs, zero noise
• Scale: 102+ nodes in single ISP, likely thousands across Vietnam
• Business model: Proxy-as-a-Service with "clean" Vietnamese residential IPs

Why Viettel? Massive subscriber base (80M+), CGNAT provides built-in IP rotation anonymity, poor home router security culture, and the ISP is military-owned — abuse reporting is bureaucratic and ineffective. VNNIC's WHOIS even self-flags its abuse contact as "invalid".

1. Residential proxy botnets are invisible to traditional security. With zero commands, zero malware downloads, and 100% authentication "success," these connections look benign to most IDS systems. The only indicator is the SSH tunnel request — which many honeypots don't even log.
2. CGNAT is both the vulnerability and the camouflage. Dynamic IP assignment means each node gets a "fresh" IP every 24-48 hours, making blacklisting futile. The same physical device appears as dozens of different IPs over time, while thousands of legitimate subscribers also use those same IPs later.
3. Frozen malware creates permanent forensic artifacts. AsyncSSH 2.1.0 from 2019 is a gift to defenders — its HASSH fingerprint will never change because the router malware cannot be safely updated. This single hash identifies the entire botnet forever.
4. The business model explains the behavior. Traditional botnets are noisy (malware downloads, command execution, lateral movement). This one is silent because it's not trying to compromise — it's verifying inventory for a proxy service. Silence IS the business model.
5. Military-owned ISPs create accountability gaps. Viettel is owned by Vietnam's Ministry of Defence. International abuse reports go to VNNIC contacts that WHOIS itself flags as invalid. There is no effective mechanism to compel remediation of 80 million subscribers' home routers.

Your home router might already be a node in a commercial proxy network. If you're on a major residential ISP, using default credentials, and your router hasn't had a firmware update in years — congratulations, someone might be selling your IP address for $0.05/request to people who need to look like "normal" internet users. The botnet operator doesn't want to hack you — they just want to route traffic through you. You'd never notice. The traffic is encrypted. Your internet works fine. And somewhere, a scraper, a fraudster, or worse is wearing your IP address like a mask.