1. The Global Map — 81 Machines, 29 Countries, Zero Consent

The mdrfckr botnet doesn't own infrastructure. It borrows it — from telecoms, cloud providers, ISPs, universities, and government networks across 29 countries. Every machine in this network was somebody's server, somebody's VPS, somebody's project. Now it's a node in a cryptomining operation run by people who didn't build it, don't maintain it, and don't pay for it.

What follows is the complete mapping of 81 compromised machines that attacked our honeypot between March and June 2026. Each one is simultaneously a victim of the botnet and an attacker in its service. This is the parasite's defining trick: every infection creates a new weapon.

2. Geography of Infection — Where the Parasites Live

The geographic distribution isn't random. It reflects where weak passwords persist — developing nations with rapid internet growth (and rapid deployment of unsecured infrastructure), plus cloud regions where disposable VPS instances launch with default credentials.

3. The Cloud Giant Problem — Microsoft, DigitalOcean, Tencent, Google, Oracle

Six machines belong to Microsoft Azure. Six to DigitalOcean. Three to Tencent Cloud. Two to Oracle Cloud. One to Google Cloud. That's 18 machines — 22% of the botnet — running on the world's largest cloud platforms.

4. The Telecom Problem — National Networks Turned Botnet Nodes

While cloud providers host disposable VPS instances, the other half of the botnet lives on national telecom networks — ISPs serving millions of residential and business customers. These are not servers someone rented. These are routers, NAS devices, IoT equipment, and forgotten Linux boxes on home and business networks.

5. The Top Ten — Most Dangerous Nodes

Not all botnet nodes are equal. Some are freshly infected machines that made a single scan attempt. Others are veteran nodes — active for weeks, scanning constantly, accumulating abuse reports from hundreds of sources. These are the top ten:

6. Cross-References — Where These IPs Appear Elsewhere

Several of these 81 IPs appear in our other investigations, revealing that the mdrfckr botnet shares infrastructure with — or has parasitized machines from — other campaigns:

7. The Yisu Cloud Connection — Hong Kong's Bulletproof Shadow

Two of the most dangerous nodes in the botnet (threat scores 98 and 62) belong to Yisu Cloud Ltd (AS142403) — the same Hong Kong-registered hosting provider we documented extensively in the TI-2026-026 Phantom ASN series as a bulletproof hosting nexus.

The question: is Yisu Cloud knowingly hosting mdrfckr nodes, or are these compromised customer VPSes? Given Yisu's documented history of abuse tolerance (1,600+ abuse reports in 2025 alone per our Phantom ASN research), the distinction may be academic. The infrastructure exists in a gray zone where "we didn't know" is the business model.

8. The Education Network — Tanzania's Research Institution

One IP stands out for what it represents: 41.93.28.9, belonging to the Tanzania Education and Research Network (TERNET, AS37182). This is not a commercial ISP or a cloud provider. This is a national academic institution — the equivalent of a university research network.

9. The BytePlus Question — TikTok's Parent in the Botnet

BytePlus (AS150436) is the enterprise cloud division of ByteDance — the Chinese company that owns TikTok, Douyin, and a constellation of other apps serving 2 billion users. Two of their Singapore-region cloud instances are infected with mdrfckr and actively scanning the internet for new victims.

BytePlus is already under intense geopolitical scrutiny due to its Chinese ownership and data-handling practices. The fact that their infrastructure is participating in a botnet — even unwittingly — adds a layer: if BytePlus can't detect a mdrfckr infection on their own servers (one of the simplest, most well-documented botnets on earth), what does that say about their operational security for customer data?

10. The Chinese Cloud Ecosystem — UCloud, Tencent, CognetCloud

Beyond BytePlus, three other Chinese-origin cloud providers host mdrfckr nodes. Together, Chinese cloud infrastructure accounts for 10 of 81 nodes (12%) — a significant concentration for providers that collectively have a small fraction of the global cloud market.

11. The Laundering Layer — PacketExchange in Estonia

One of the higher-threat nodes sits on 196.196.253.20 — geolocated to Estonia but belonging to PacketExchange / Orion Network Limited (AS58065, registered in Great Britain). Threat score: 78. Honeypot hits: 28.

PacketExchange is a transit/hosting provider that has appeared in abuse databases for years. Their IP space uses African-region prefixes (196.x.x.x) routed through European infrastructure — a common pattern in IP address laundering where geographically African IP ranges are actually hosted in European data centers to avoid African RIR abuse controls while appearing to be in Africa to geo-restricted services.

This is the same infrastructure-laundering pattern we documented in the Phantom ASN series: IPs that say one thing about where they are and another about where they actually live.

12. What the Map Tells Us

The mdrfckr botnet's infrastructure is not chosen. It is accumulated. It grows wherever security is weakest — wherever passwords are unchanged, wherever VMs are forgotten, wherever abuse reports go unanswered. Its geographic distribution is a map of digital neglect:

The botnet operator doesn't need to rent servers. They don't need bulletproof hosting for their scanning nodes. They just need the internet to continue being the internet — a network where root:password opens doors that should never have existed.

The only infrastructure the operator actually controls is one IRC server at FranTech. Everything else is theft. And the victims — from Microsoft Azure to Tanzanian universities — cannot or will not stop it.

Investigation Date: June 2026 · Analyst: Lișneanu Dumitru-Cristian · Classification: TLP:WHITE — Public
Data Source: Cowrie Honeypot + Threat Intelligence DB (81 IPs enriched via Shodan, GreyNoise, AbuseIPDB, RDAP) · Series: The SSH Parasite (2 of 6)
Cross-references: TI-2026-026 (Phantom ASN), DOSSIER-VIETTEL-001, TI-007, TI-2026-023 (VPN Laundromat)