❓ Has Anyone Ever Filed an Abuse Report to BuyVM About This Server?

This IP has been publicly documented as botnet C2 in academic papers, vendor reports, and threat intelligence platforms for years. Filing an abuse report is free and takes five minutes.

Four possibilities: (1) Nobody bothered — the bystander effect applied to cybercrime. Every researcher assumes someone else will do it. (2) Reports filed and ignored — BuyVM's abuse handling may route reports to /dev/null when the customer pays crypto and the evidence requires IRC protocol knowledge. (3) Law enforcement is watching — C2 servers are sometimes left operational for intelligence gathering. Eight years seems... patient. (4) The server has been cleaned but re-provisioned — taking down a $2/month VPS inconveniences the operator for approximately 10 minutes. The most likely answer combines all four.

❓ Is BuyVM Complicit or Merely Indifferent?

BuyVM/FranTech markets "DDoS-protected" VPS, accepts cryptocurrency, and emphasizes privacy. Francisco Dias founded the company in Canada.

BuyVM's business model is "abuse-complaint-resistant" hosting. Not bulletproof in the classic sense (they won't host CSAM or terrorism). But operating in a gray zone where IRC is legitimate, where proving a specific customer's traffic is criminal requires more effort than any single abuse reporter invests. Their ToS prohibits illegal use. Their enforcement mechanism is designed to fail. You can't be complicit if you never look. This is the "plausible deniability" hosting model — structurally identical to complicity in outcome, legally distinct in intent.

Sources: BuyVM.net · ARIN AS53667 registration · LSN Entity-Link Graph (c2_for relationship)

❓ What Would It Take to Kill This Botnet?

The IRC architecture has a single point of failure: the central server. No server = no commands.

Technically: one enforcement action against 198.98.56.205 kills coordination. Bots continue mining (embedded pool addresses) but lose DDoS capability, update mechanism, and coordination. Practically: BuyVM enforces ToS, OR ARIN threatens AS53667's address space, OR the FBI (Nevada jurisdiction) issues a takedown. None have happened in four years. The bots would still mine, but the operator loses control. For $2/month they'd re-provision elsewhere, but forcing them to move reveals infrastructure patterns and potentially operational errors.

❓ Why Do 46 BytePlus/ByteDance VMs Mine Monero for Romanian Criminals?

ByteDance — TikTok's parent company — operates BytePlus cloud (AS150436) from Singapore. Our honeypot confirmed 46 BytePlus IPs as active mdrfckr propagation nodes.

The detection signatures are trivial: (1) SSH key injection from external IP, (2) 100% CPU from process named kswapd0 that isn't kswapd0, (3) IRC traffic to 198.98.56.205:443, (4) connections to mining pools. Any one is detectable. The combination is unmistakable. BytePlus has the capability. They lack the incentive. A compromised VM mining at 100% CPU might need upgrading to a larger instance. A customer notified of compromise might leave the platform. The financial incentive to detect is negative.

❓ Is the Geographic Targeting Deliberate?

The botnet preferentially occupies infrastructure where IT budgets are minimal, SSH key management doesn't exist, servers stay unpatched for years, abuse reports have no enforcement, and electricity is subsidized.

Whether deliberate or emergent, the result is the same: a Romanian criminal group extracts value from Ethiopian, Bangladeshi, and Pakistani infrastructure. The weak are exploited by the stronger. Compute stolen from a university in Dhaka becomes Monero in a Romanian wallet. This is not a metaphor — this is the literal flow of value. If it were physical resources crossing borders without compensation, we'd call it colonialism. Because it's CPU cycles, we call it "cybercrime" and publish PDFs about it.

Sources: LSN Threat Intel Platform (AS-level analysis) · Kaspersky victim telemetry · OHIIHO Research (Syrian relay, 2026)

❓ How Does $200/Month Justify Eight Years of Operation?

The visible revenue seems trivially small. 81 nodes × 2 KH/s = nothing remarkable.

Our honeypot is one machine. We see ~1% of the botnet. Kaspersky's global telemetry suggests thousands of active infections at any time. At 5,000+ nodes: $10,000+/month in untraceable Monero. Operational cost: $5/month. No employees. No infrastructure to maintain (victims maintain the hardware). Passive income. Zero prosecution risk. By Romanian economic standards (median salary €800/month), even the low estimate represents transformative wealth. And the XMR they mined in 2019 at $50 may now be worth $150+. The hodl bonus applies to stolen compute too.

❓ What Does Each Victim Actually Pay?

The botnet extracts value not in XMR from the victim but in electricity and hardware degradation.

Per compromised server: ~$15-30/month in stolen electricity (100% CPU = +200-400W). ~$50/year accelerated hardware depreciation. Opportunity cost (server can't serve its purpose). Remediation cost when discovered ($500-5000). Across 10,000 nodes: $150,000-300,000/month in stolen electricity alone. The operators extract $1M while causing $10-50M in damage. This is negative-sum: the parasite always costs the host more than the parasite gains.

❓ Why Does the Security Industry Document But Never Act?

Kaspersky, Trend Micro, Antiy Labs, CyberCloud/UPB — all published detailed analysis. Not one resulted in an arrest, takedown, depeering, or enforcement action.

The security industry's incentive structure rewards documentation over action. A Kaspersky blog post generates brand awareness. A Trend Micro report justifies product licensing. A conference talk advances careers. Shutting down a botnet generates nothing billable. The botnet persists because it is useful to the industry that documents it. Each publication creates a new "threat landscape" talking point that sells more endpoint protection licenses.

❓ The UPB Romania Irony — A Romanian University Studies a Romanian Botnet?

CyberCloud (University Politehnica Bucharest) documented mdrfckr attacks against their own honeypot. They published a detailed analysis.

Romanian researchers studying a Romanian botnet attacking Romanian infrastructure. The academic publication generates a DOI and a citation. It does not generate an arrest. The irony compounds: Romanian academia studies Romanian crime and produces knowledge rather than consequence. Both the botnet and the publication exist in the same ecosystem — both self-sustaining, both generating value for their operators, neither capable of ending the other.

Sources: CyberCloud UPB Romania (EU SOCcare Grant 101145843)

❓ Who Actually Benefits From This Botnet's Continued Existence?

More parties than you'd expect:

The operators — passive income. Mining pools — fee revenue. BuyVM — hosting revenue ($2-10/month). Cloud providers — infected customers consume more = more revenue. Security vendors — threat existence justifies product sales. Researchers — publications and conference talks. Everyone benefits except the victims. And the victims have no voice — they're a university in Bangladesh, a hospital in Ethiopia, a textile company in Mexico.

❓ Why IRC for C2 in 2026?

Modern botnets use HTTPS beaconing, DNS-over-HTTPS, Tor hidden services, blockchain dead drops. mdrfckr uses IRC from the 1990s.

IRC is not legacy reluctantly maintained — it is cultural. These operators grew up on IRC. They formed criminal networks on IRC. They trust it because they understand it intimately. Channels = campaigns. Nicknames = bots. Operators = admins. The protocol maps naturally to botnet structure. And critically: it works. They haven't been caught despite using IRC for eight years. If your OpSec is sufficient with IRC, upgrading adds complexity without benefit. The threat model they operate under (basically: none) doesn't require more sophisticated C2. If law enforcement ever demonstrated ability to take down IRC botnets, they'd upgrade. They haven't needed to.

❓ What Does "345gs5662d34" Mean?

12 characters. Mix of numbers and letters. Used as BOTH username AND password. Not a credential — it's a handshake.

When the botnet scans for SSH and tries 345gs5662d34:345gs5662d34, it's not breaking in. It's asking: "Are you one of mine?" If a server accepts this credential, it was already compromised. It's a roll-call, not an attack. An inventory mechanism. The botnet pinging itself. As for the string's origin: likely randomly typed once in 2018 and became permanent through operational habit — like a password on a sticky note that becomes the company standard because nobody changes it.

❓ The Portuguese Connection — Is There a Brazilian Crew?

Kaspersky's deobfuscation revealed Portuguese comments in the Perl source. The Brazil incident was a real enterprise breach. Romanian-Portuguese linguistic connection is significant.

Both Romance languages with mutual intelligibility. Romania has documented criminal network connections to Brazil (Europol reports: credit card fraud, money laundering). Brazil's .gov.br Linux infrastructure is a massive attack surface. A Romanian-Brazilian crew would combine: Romanian technical skills + Brazilian target knowledge + shared language capability for social engineering. Whether collaboration or coincidence — the Portuguese comments exist, the Brazilian victims exist, and the connection is at minimum worth investigating.

Sources: Kaspersky (Portuguese comments in code) · Europol Romanian cybercrime reports

❓ What If the Botnet Is Monitored by Law Enforcement?

Intelligence agencies sometimes leave criminal infrastructure operational for intelligence gathering.

If FBI or Romanian SRI monitors 198.98.56.205's IRC traffic, they could map every bot, every command, every target. Eight years of patience would be unusual but not unprecedented. Counter-argument: No intelligence value justifies allowing a botnet to compromise hospitals and universities for eight years. The "we're watching" explanation only works if the end goal is a massive coordinated takedown. We see no indication this is coming.

❓ What If Monero Mining Is the Cover Story?

The Perl Shellbot has DDoS capability. 10,000+ nodes capable of coordinated DDoS is worth far more than mining revenue.

The mining could be the "legitimate" operation that keeps servers online while real revenue comes from selling DDoS-for-hire. Our honeypot hasn't captured DDoS commands from these nodes. But IRC commands are channel-specific — we'd only see them if our bot was in the right channel at the right time. Absence of evidence ≠ evidence of absence. A DDoS-for-hire service backed by 10,000+ nodes across 84 countries would be worth $50,000-500,000/month to the right buyers.

❓ What If There Are Multiple Operators Sharing Infrastructure?

Same SSH key everywhere. Same credential. Same directory. But: "modzmodz" marker differs from historical ones. Portuguese comments suggest non-Romanian collaborator. Some variants use dota vs dota3.

Theory: the infrastructure is shared (one group maintains IRC server and payload hosting), but multiple crews deploy it. A criminal franchise: one entity provides tools, multiple entities use them. This explains variants while maintaining consistency. Different markers (modzmodz vs others) could indicate different franchisees — each changing the ownership password to their own string while using the shared SSH key and C2.

❓ What If This Never Stops?

Predict 2028: will this SSH key still be active?

Yes. Nothing will change until: (1) SSH password auth disabled by default in major Linux distros (unlikely — breaks workflows), (2) cloud providers implement mandatory mining detection (conflicts with legitimate miners), (3) law enforcement develops a prosecutable case (jurisdiction problems + Monero), (4) operators make an identity-revealing mistake (unpredictable), (5) a more aggressive competitor takes their infrastructure (possible). The most likely scenario: the botnet outlives the researchers documenting it.