๐ TI-2026-021B โ "The Key That Didn't Lie" โ SSH Fingerprint Attribution of an Anonymous Operator
๐ Executive Summary
SSH public keys are the digital equivalent of leaving fingerprints at a crime scene. They cannot be faked, they prove identity across sessions, and they persist across provider boundaries. Our entity-link graph correlates keys across the entire honeypot database.
Result: the "Private Customer" anonymization fails. A single SSH key (75:77:42:bc) connects a redacted WHG IP to "gereng" โ a non-anonymized registrant on NOCIX (AS33387). Another key links WHG to Internap and WorldStream simultaneously, proving the same operator runs infrastructure across at least three ASNs and three jurisdictions.
This is what attribution looks like when human operators make the universal mistake: reusing a key.
๐งฌ How SSH Key Attribution Works
When an attacker connects to our honeypot, we capture their SSH public key fingerprint. This fingerprint is deterministic โ the same key always produces the same fingerprint. When the same fingerprint appears from two different IPs, it means:
- The same operator controls both IPs (they carried their key between machines), OR
- A shared botnet toolkit was deployed to both machines (the toolkit includes a static key)
In both cases, the two IPs are operationally linked. This is the highest-confidence attribution signal available โ stronger than shared credentials (commonly reused by different actors), stronger than shared HASSH (identical SSH clients produce identical HASSH), stronger than IP proximity (nearby IPs may be independent customers).
Confidence: 0.90+. In courts, this would be digital fingerprint evidence.
๐ญ The Cast โ Every Entity Named
| Entity | Type | Jurisdiction | Role in Structure | Evidence |
|---|---|---|---|---|
| IPXO UAB | Company | Lithuania | IP marketplace; LIR; leases address space | RIPE LIR, 14M+ IPs |
| Vincentas Grinius | Person | Lithuania | IPXO co-founder & CEO; RIPE Programme Committee | LinkedIn, RIPE NCC records |
| Internet Utilities LATAM LTD | Shell Company | Belize | Operates netutils-mnt; operates AbuseRadar; manages IP registrations | RIPE mntner, abuseradar.com |
| WHG Hosting Services Ltd | Company | UK (Norwich) | Physical hosting; AS14670; 9 attacking IPs | Companies House 14644356 |
| Sebastian de Lemos | Person | UK | WHG CEO | Companies House records |
| Oakley Capital Investments | Private Equity | UK (Bermuda-listed) | WHG majority owner via Daisy Group acquisition | LSE filings |
| AbuseRadar | Service | Belize (= Internet Utilities) | Abuse complaint black hole | abuseradar.com footer |
| "gereng" | Handle (Person?) | Unknown | Operator โ exposed via SSH key reuse | NOCIX RDAP for 198.204.244.210 |
| Aokigahara SRL | Company | Romania (Bucharest) | Tor relay hosting from residential address; sponsor LIR unknown | CUI 48489042, RIPE |
| NOCIX LLC | Hosting | US (Kansas City) | Hosts "gereng" infrastructure; known for lenient abuse handling | AS33387 |
๐ธ๏ธ The Three Key Clusters
Cluster 1: "gereng" link (75:77:42:bc)
This key was observed authenticating from both 191.101.33.115 (WHG/Private Customer, threat score 98) and 198.204.244.210 (NOCIX/"gereng"). The WHG IP is anonymized behind "Private Customer" registration. The NOCIX IP is registered to a unique handle: "gereng". Same key = same operator.
Implication: The operator behind the most aggressive "Private Customer" IP has a NOCIX account under the name "gereng". This is the de-anonymization event.
Cluster 2: Three-ASN bridge (ac:a1:39:92)
This key connects 179.61.232.244 (WHG) โ 65.60.5.244 (Internap) โ 89.38.96.216 (WorldStream). Three different hosting providers. Three different ASNs. One operator.
Implication: The operation is not confined to WHG. It uses WHG for IPXO-anonymized IPs, Internap and WorldStream for others. The diversification is deliberate โ if one provider reacts to abuse, the others continue.
Cluster 3: German link (74:05:ae:6d)
This key connects WHG IP 191.101.33.110 to 78.111.67.246 (Surfplanet, Germany). Surfplanet is a small German hosting provider.
Implication: EU presence. GDPR-covered infrastructure. Different legal framework than US/Belize.
๐ณ๏ธ The Conspiratorial Read
โ What if "gereng" is not a person โ but a toolkit?
Possible but unlikely. SSH keys tied to toolkits (like Outlaw or Shellbot) appear across hundreds of IPs simultaneously with identical behavioral patterns. "gereng" shares a key with exactly ONE Private Customer IP. This is personal-scale reuse, not toolkit-scale deployment.
โ Why would a professional operator reuse an SSH key across anonymized and non-anonymized infrastructure?
Because operational security is a discipline, and disciplines fail in predictable ways. The key was likely generated on a personal machine and deployed by habit across all infrastructure the operator manages. The operator trusted the "Private Customer" label to be sufficient anonymization โ they didn't anticipate honeypot-level SSH key correlation across providers.
โ What does the three-ASN spread tell us about the operation's scale?
It tells us this is not a script kiddie renting one server. The operator maintains accounts at WHG (US/UK), Internap (US), WorldStream (NL), NOCIX (US), and Surfplanet (DE). Five providers across four countries. This is professional infrastructure management. The question becomes: what business requires this level of distribution and anonymization for SSH-based operations?
๐๏ธ Read Between the Lines
โก What this tells you that we're not saying directly:
- "gereng" hasn't rotated the key yet. As of publication, key
75:77:42:bcis still active on both IPs. Either they don't know they're being correlated, or they don't care. Both are informative. - NOCIX knows who "gereng" is. They have billing information. A subpoena to NOCIX in US jurisdiction could identify the operator of 198.204.244.210 within days. Nobody has sent that subpoena.
- Every key reuse is an opsec budget decision. Generating new keys is free. Using old keys is fast. The choice to reuse reveals the operator's threat model: they assessed that nobody correlates SSH keys across providers. They were wrong โ but only because a single honeypot in Romania is doing what no commercial threat-intel platform does systematically.
- The three-ASN cluster suggests a business model. You don't pay for five hosting accounts across four countries to send spam. You do it when you need: uptime guarantees (failover), jurisdictional diversity (no single takedown kills the operation), and separation of concerns (different providers see different subsets of activity).
๐ Linked Dossiers
- TI-021A "The Nowhere Registry" โ the closed-loop abuse structure this actor operates within
- TI-021C โ Aokigahara SRL and the double-anonymization layer
- TI-020C "The Roll-Up" โ WHG/IPXO corporate overview