LSN โ€” Local Sovereign Network

๐Ÿ”ด EXPANSION โ€” Operation Shadow Nexus Part F ยท AI Infrastructure Targeting ยท Bulletproof Hosting ยท The New Gold Rush

TI-2026-019F โ€” "Ghost in the Machine" โ€” 307 IPs Hunting AI Infrastructure, 79 Password Variants for "Claude", and the Bulletproof Hosting Ecosystem Enabling It All

TI-2026-019F ยท Published June 9, 2026 ยท Part F of Operation Shadow Nexus ยท Confidence: HIGH

๐Ÿ“‹ The AI Gold Rush

A new pattern has emerged in our honeypot data that has no precedent in traditional SSH attack databases: 307 unique IPs are systematically scanning for AI/ML infrastructure credentials. The username "claude" alone was attempted by 111 unique IPs using 79 distinct password variations โ€” including year-specific passwords like Claude2026! that prove active wordlist maintenance targeting current AI deployments.

This is not random credential stuffing. This is a deliberate, evolving campaign to locate and compromise AI inference servers, GPU clusters, and machine learning pipelines. The attackers know that AI infrastructure represents the highest-value compute available โ€” a single GPU node running an LLM is worth 10-100x a CPU node for both computational theft and data exfiltration.

๐Ÿค– AI/ML Credential Targeting Summary
307
Unique IPs targeting AI
111
IPs trying "claude"
79
Password variants
48
From Tencent alone

๐ŸŽฏ SEGMENT 1: The "Claude" Campaign โ€” Anatomy of AI Targeting

The systematic nature of the claude credential campaign reveals professional operations, not script-kiddie randomness:

PASSWORD ANALYSIS โ€” 79 variants for username "claude" CATEGORY 1: Default/obvious (111 IPs) claude:claude โ†’ Default deployment password CATEGORY 2: Year-specific (active maintenance) claude:claude2026 โ†’ Current year targeting claude:Claude2026! โ†’ 20 IPs using CURRENT YEAR + complexity claude:claude2025! โ†’ Previous year (still trying) CATEGORY 3: Numbered sequence (port/instance targeting) claude:claude03 through claude:claude30 claude:Claude03! through Claude30! โ†’ Suggests targeting numbered instances: claude-03, claude-04... claude-30 โ†’ Possibly API endpoint enumeration: /v3, /v4... /v30 CATEGORY 4: Complex passwords (insider knowledge?) claude:Claude1@ โ†’ Mix of patterns suggesting password policy awareness claude:Claude!@#$ โ†’ Testing common complexity patterns claude:Claude!123 โ†’ Reversed complexity CATEGORY 5: Cross-pollination leo:claude โ†’ Other usernames with "claude" as password claude:123456 โ†’ Testing universal defaults on AI user
๐Ÿงฎ WHY THIS MATTERS

"Claude2026!" โ€” This password was tried by 20 unique IPs. It reflects knowledge that:

  • Organizations deploy AI models with service accounts named after the model
  • Lazy deployments use the model name + year + complexity character as password
  • The wordlist is being ACTIVELY UPDATED for the current year (2026)
  • The campaign operator understands that AI deployment often happens quickly with minimal security review ("just get it running")

What a compromised Claude/AI deployment gives an attacker:

  • ๐Ÿ–ฅ๏ธ GPU access โ€” A100/H100 GPUs worth $30K+ each, perfect for crypto mining ($50-200/day per GPU vs. $0.50/day per CPU)
  • ๐Ÿ“Š Training data โ€” Fine-tuning datasets often contain proprietary/confidential information
  • ๐Ÿ”‘ API keys โ€” Environment variables with OpenAI, Anthropic, cloud provider credentials
  • ๐Ÿ’ฌ Conversation logs โ€” If running customer-facing AI, all user conversations are accessible
  • ๐Ÿง  Model weights โ€” Fine-tuned models represent millions in R&D investment

๐ŸŒ SEGMENT 2: Who's Hunting AI? โ€” The Tencent Dominance

ProviderCountryIPsSignificance
Tencent Cloud๐Ÿ‡จ๐Ÿ‡ณ CN/KR4843% of all claude-targeting IPs
UCloud (HK)๐Ÿ‡ญ๐Ÿ‡ฐ HK18Chinese cloud, HK jurisdiction
Microsoft Azure๐Ÿ‡บ๐Ÿ‡ธ US10Compromised Azure instances
Korea Telecom๐Ÿ‡ฐ๐Ÿ‡ท KR8Residential/business proxies
DigitalOcean๐Ÿ‡บ๐Ÿ‡ธ US8Cheap cloud attack infra
Linode/Akamai๐Ÿ‡บ๐Ÿ‡ธ US8Cloud attack infra
BytePlus (TikTok)๐Ÿ‡ธ๐Ÿ‡ฌ SG6Already Outlaw-compromised
OVH๐Ÿ‡ซ๐Ÿ‡ท FR/CA6European cloud
YISU Cloud๐Ÿ‡ญ๐Ÿ‡ฐ HK4Bulletproof hosting (see below)
Google Cloud๐Ÿ‡บ๐Ÿ‡ธ US4Compromised GCP instances
๐Ÿ“Š THE CHINA-CENTRIC PATTERN

66 of 111 IPs (59%) targeting the "claude" username originate from Chinese cloud infrastructure (Tencent: 48, UCloud: 18). This concentration is statistically anomalous and suggests:

  • Economic motivation: China restricts access to Western AI models (Claude, GPT-4). Compromising overseas Claude deployments provides access to capabilities unavailable domestically.
  • Competitive intelligence: Fine-tuned models and training datasets represent enormous commercial value. Chinese AI companies (Baidu, Alibaba, ByteDance) compete directly with Anthropic/OpenAI.
  • Government interest: Tencent operates under Chinese national security laws requiring cooperation with intelligence services. A large-scale campaign from Tencent infrastructure raises questions about state knowledge/direction.
  • GPU arbitrage: H100 GPUs are export-restricted to China. Compromised foreign GPU infrastructure provides computational resources China cannot legally purchase.

Country breakdown for claude targeting: Singapore (52 IPs), USA (44), Indonesia (19), Hong Kong (18), South Korea (16), Vietnam (13), India (12), Brazil (11), Germany (10). The Singapore dominance reflects Chinese cloud companies (Tencent, BytePlus) routing through Singapore data centers.

๐Ÿค– SEGMENT 3: The Full AI/ML Target Landscape

Beyond "claude", attackers systematically probe for every layer of the modern AI/ML stack:

TargetIPsWhat It IsWhat Compromise Yields
claude111Anthropic Claude deploymentsAPI keys, GPU access, conversation logs, model weights
elasticsearch71Search/vector DB (RAG systems)Indexed knowledge, embeddings, enterprise data
kafka67Data streaming (ML pipelines)Real-time data streams, training data in transit
jenkins61CI/CD (model deployment)Deployment credentials, model artifacts, build secrets
ansible56Infrastructure automationSSH keys to entire GPU clusters
github/gitlab83Code repositoriesProprietary code, model architectures, training scripts
docker21Container runtimeContainer escape โ†’ host GPU access
airflow11ML pipeline orchestrationDAG manipulation, data poisoning
jupyter8Interactive notebooksDirect code execution, credentials in cells
ollama7Local LLM runtimeModel files, system prompts, inference access
kubernetes/k8s10Container orchestrationCluster-wide access, all pods including GPU
nvidia6GPU management interfacesDirect GPU compute access
gpt5OpenAI GPT deploymentsAPI keys, fine-tuning data, token budgets
๐Ÿ’ฐ THE ECONOMICS OF AI THEFT
Cost of a single H100 GPU$30,000 โ€” $40,000
Cloud rental cost (H100, per hour)$3.50 โ€” $8.00
Revenue from stolen GPU mining (per day)$50 โ€” $200
Revenue from selling stolen API access$500 โ€” $5,000/month
Value of fine-tuned model weights$100K โ€” $10M+
Value of conversation logs (enterprise)Priceless (litigation risk)

A single compromised AI deployment is worth more than 1,000 compromised web servers to an attacker. This explains why 307 IPs are actively hunting for AI infrastructure โ€” the ROI is extraordinary.

๐Ÿดโ€โ˜ ๏ธ SEGMENT 4: The Bulletproof Hosting Ecosystem

Behind every persistent campaign is infrastructure that refuses to respond to abuse complaints. Our dataset identifies the key bulletproof hosting providers enabling global cybercrime:

ProviderIPsAvg ThreatMaxNotable
FranTech/BuyVM (US)12141.510010 Tor exit nodes, port 1337 backdoors
YISU Cloud (HK/SC)3554.2100HK + Seychelles, MySQL exposed
CognetCloud (US)942.6100Seychelles-registered IPs
IncogNet (US)729.130"Internet Speech and Privacy LLC"
Proton66 (RU)628.3100Russian bulletproof, no abuse response
XNNET (US)270.0100Anonymous registration
GlobalSat (MK)1100.0100North Macedonia shell company
๐Ÿดโ€โ˜ ๏ธ FRANTECH/BUYVM โ€” The American Pirate Haven

121 IPs from a single US-based hosting company that brands itself as "privacy-focused." What our data shows:

  • 10 confirmed Tor exit nodes (port 9001) โ€” enabling anonymous attacks that cannot be traced back
  • Port 1337 exposed โ€” the "leet" port, a well-known backdoor convention in hacker culture
  • Port 25000-25010 range โ€” custom C2 (Command & Control) infrastructure
  • Full mail server stacks (25, 110, 143, 465, 587, 993, 995) โ€” for phishing and spam campaigns
  • 21 IPs at threat score 100 โ€” maximum danger rating

FranTech operates under US jurisdiction but has been repeatedly reported to FBI IC3, CISA, and abuse contacts with zero enforcement action. The company hides behind privacy advocacy language while providing infrastructure for: SSH brute-force campaigns, Tor exit nodes used in attacks, mail servers for phishing, and C2 infrastructure for botnets.

๐Ÿ‡ญ๐Ÿ‡ฐ YISU CLOUD โ€” The Hong Kong-Seychelles Pipeline

35 IPs operating from Hong Kong and Seychelles โ€” a classic offshore structure:

  • 15 IPs at threat score 100 โ€” highest concentration of maximum-threat IPs
  • MySQL (3306) exposed on 103.146.159.173 โ€” database accessible from anywhere
  • Seychelles IPs (SC) โ€” tiny island nation with no cybercrime enforcement capacity
  • Registration: "YISU CLOUD LTD" โ€” a Hong Kong shell company with no public information about owners, staff, or physical office

The HK-Seychelles pattern: Register company in Hong Kong (legitimate jurisdiction, fast incorporation). Announce IP space through Seychelles (no enforcement). Route traffic through Singapore (neutral, fast connectivity). When abuse reports come: HK company says "not our IPs, ask Seychelles entity." Seychelles entity doesn't respond. Case closed.

โฐ SEGMENT 5: When Do They Attack? โ€” Temporal Intelligence

Attack timing reveals operational patterns that help identify whether campaigns are automated (constant) or human-operated (following work schedules):

๐Ÿ“Š Attack Volume by Hour (UTC) โ€” Last 30 Days
00:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘ 505 sessions (137 IPs) 03:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘ 845 sessions (245 IPs) โ† Peak unique IPs 07:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘ 826 sessions (196 IPs) 08:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘ 907 sessions (174 IPs) โ† Morning EU peak 11:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘ 966 sessions (215 IPs) โ† Midday peak 18:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ 1,805 sessions โ† VOLUME PEAK 19:00 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ 1,992 sessions โ† MAX VOLUME
18:00-19:00 UTC = 02:00-03:00 China/Singapore = End of business EU = Start of automated nightly scans
๐Ÿ“Š Attack Volume by Day of Week โ€” Last 30 Days
Monday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ 1,736 sessions (473 IPs) Tuesday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘ 1,090 sessions (213 IPs) Wednesday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘ 1,648 sessions (350 IPs) Thursday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ 3,513 sessions (570 IPs) โ† PEAK Friday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘ 2,518 sessions (460 IPs) Saturday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ 5,130 sessions (418 IPs) โ† MAX VOLUME Sunday โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘ 1,503 sessions (458 IPs)
๐Ÿงฎ TEMPORAL ANALYSIS

Saturday has 3x the session volume of Tuesday โ€” but fewer unique IPs (418 vs 570 on Thursday). This reveals:

  • Automated intensification: Botnet operators increase scan rates on weekends when Security Operations Centers have minimal staffing
  • Thursday peak IPs (570): Human operators are most active Thursday-Friday, possibly running weekly pentest/recon cycles
  • Saturday volume without proportional new IPs: Existing botnet nodes run hotter, not more nodes joining โ€” this is a CONFIGURATION change pushed to the botnet on Friday night
  • 18:00-19:00 UTC peak: This is 02:00-03:00 in China/Singapore (Tencent/BytePlus timezone) โ€” suggesting automated cron jobs scheduled for off-hours in the operator's timezone

๐Ÿ“Ž Sources (Part F)

๐Ÿ“„ Direct honeypot observation โ€” 307 IPs targeting AI/ML credentials, 111 specifically targeting "claude" user
๐Ÿ“„ Credential analysis โ€” 79 unique password variants demonstrate active wordlist maintenance
๐Ÿ“„ ASN registration data โ€” YISU CLOUD LTD (HK), FranTech Solutions (US), Proton66 OOO (RU) via RIPE/ARIN/APNIC
๐Ÿ“„ Shodan port intelligence โ€” Tor nodes (9001), C2 infrastructure (25000-25010), backdoor ports (1337)
๐Ÿ“„ Temporal analysis โ€” 30-day session data with hourly and daily aggregation
๐Ÿงญ Series Navigation: This is Part F of Operation Shadow Nexus. Part A (Core) ยท Part B (Ugly Machinery) ยท Part C (Follow The Money) ยท Part D (Open Doors) ยท Part E (The Web Between) ยท Part F (Ghost in the Machine)
Methodology: Passive SSH honeypot ยท Credential pattern analysis ยท ASN/registration research ยท Temporal correlation ยท Shodan port intelligence ยท No active scanning performed
โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous Operation Shadow Nexus โ€” 6 / 13 Next โ†’