๐ฅ๏ธ The 628 Machines
TI-2026-026H โ Anatomy of a Coordinated Scanning Campaign
Series: The Phantom ASN (Part 8 of 9)
628 machines. 48 countries. One SSH library. One fingerprint. Zero successful logins โ because they're not trying to log in to us. They're trying to log in to everyone else. Our honeypot captured 16,253 connection attempts from a campaign that uses identical tooling across six continents. Every machine runs libssh2 version 1.11.0. Every machine tries root with an empty password. Every machine shares HASSH fingerprint 14b2ddda386a4d10.
This is not a botnet of compromised home routers. This is professionally provisioned scanning infrastructure, hosted on commercial servers, paid for with real money, and designed to map every SSH server on the internet that forgot to disable password authentication.
Chapter 1: The Fingerprint That Reveals Everything
Every SSH client negotiates a cipher suite when connecting. The order and selection of algorithms creates a HASSH fingerprint โ a cryptographic hash that identifies the exact SSH implementation and version. It's like a browser fingerprint but for SSH.
HASSH 14b2ddda386a4d1006108ccd231b42fc corresponds to:
Client: SSH-2.0-libssh2_1.11.0 KEX: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,... Host Key: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa Encryption: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,... MAC: hmac-sha2-256,hmac-sha2-512,hmac-sha1,...
When 628 IPs across 48 countries present the identical cipher negotiation, it proves:
- Same binary: They all run the exact same compiled SSH client (libssh2 1.11.0)
- Same configuration: No customization โ deployed from a single template
- Centralized control: One operator distributing one tool to hundreds of machines
โ Could this be coincidence?
No. libssh2 1.11.0 is a specific minor release. The default cipher order in libssh2 can be configured at compile time. Finding 628 machines with identical HASSH across 48 countries is statistically conclusive โ this is one deployment, one operator, one purpose.
Chapter 2: The Infrastructure Map
The 628 IPs are hosted across major commercial hosting providers. This is not compromised residential infrastructure โ it's purchased infrastructure:
| ASN | Provider | Country | IPs | Classification |
|---|---|---|---|---|
| AS16276 | OVH SAS | ๐ซ๐ท France | 45 | Major cloud |
| AS32475 | SingleHop/Internap | ๐บ๐ธ USA | 39 | Bulletproof |
| AS40676 | Psychz Networks | ๐บ๐ธ USA | 34 | Known abuse |
| AS36352 | ColoCrossing/HostPapa | ๐บ๐ธ USA | 33 | Known abuse |
| AS35916 | MULTACOM Corporation | ๐บ๐ธ USA | 26 | Budget hosting |
| AS24940 | Hetzner Online | ๐ฉ๐ช Germany | 24 | Major cloud |
| AS9009 | M247 Europe SRL | ๐ท๐ด Romania | 20 | Known abuse |
| AS198584 | PIO-Hosting GmbH | ๐ฉ๐ช Germany | 15 | Bulletproof |
| AS23470 | ReliableSite.Net | ๐บ๐ธ USA | 13 | Budget hosting |
| AS53667 | FranTech Solutions | ๐บ๐ธ USA | 13 | Bulletproof |
| AS62390 | NexonHost SRL | ๐ท๐ด Romania | 13 | Bulletproof |
| AS200019 | AlexHost SRL | ๐ฒ๐ฉ Moldova | 12 | Bulletproof |
Pattern: The operator mixes a few legitimate cloud providers (OVH, Hetzner) with multiple known abuse-tolerant hosts. This diversification ensures that if one provider terminates service, only a fraction of the campaign goes offline.
โ How much does this infrastructure cost?
Conservative estimate: 628 VPS instances ร $10-25/month = $6,280 to $15,700 per month. At budget providers (ColoCrossing, Psychz), bulk purchasing drops this to approximately $5-8/instance. Annual cost: $75,000-$188,000. This is not a hobby project. Someone is investing six figures annually to maintain this scanning fleet.
Chapter 3: The Geographic Spread
The campaign distributes across 48 countries, but the concentration tells a story:
| Country | IPs | % | Interpretation |
|---|---|---|---|
| ๐บ๐ธ United States | 270 | 43% | Cheapest bulk hosting market |
| ๐ณ๐ฑ Netherlands | 84 | 13% | Abuse-tolerant hosting hub |
| ๐ฉ๐ช Germany | 39 | 6% | Hetzner + PIO-Hosting |
| ๐ซ๐ท France | 37 | 6% | OVH (largest EU provider) |
| ๐จ๐ฆ Canada | 21 | 3% | OVH Canada + budget hosts |
| ๐ท๐ด Romania | 16 | 3% | M247 + NexonHost |
| ๐บ๐ฆ Ukraine | 14 | 2% | Known bulletproof territory |
| ๐ง๐ท Brazil | 14 | 2% | Regional scanning coverage |
| Others (40 countries) | 133 | 21% | Global distribution for IP diversity |
The US dominates because that's where the cheapest dedicated servers are. The Netherlands concentrates because that's where abuse-tolerant transit providers (including PIO/SkyLink) operate. Romania and Moldova because that's where bulletproof hosting is cheapest in the EU.
โ Why does geographic distribution matter?
Three reasons: (1) IP reputation systems penalize concentrated blocks โ spreading across countries avoids bulk blacklisting; (2) target networks have geo-based blocking โ US IPs scan US targets, EU IPs scan EU targets; (3) jurisdictional defense โ no single country's law enforcement can seize all 628 machines simultaneously.
Chapter 4: The Credential โ root:<empty>
Every single machine in this campaign tries the same credential: username root, password (empty). Across 670 IPs sharing this fingerprint, the combination was attempted 24,239 times.
This is not credential stuffing. It's misconfiguration hunting. The operator is looking for:
- SSH servers with password authentication enabled AND root login permitted AND no password set
- Docker containers with exposed SSH and default credentials
- IoT devices with blank root passwords
- Development/staging servers accidentally exposed to the internet
Success rate against our honeypot: 0% (we simulate a real system but never actually grant access). But across the internet, with 628 machines scanning millions of targets, even a 0.001% hit rate yields thousands of compromised systems.
โ What happens when they find a hit?
We cannot observe post-exploitation from our honeypot (which denies access). But based on similar campaigns we've documented (TI-2026-018 Operation MEOW, TI-2026-012 MDRFCKR Botnet): successful entries typically lead to cryptocurrency miner deployment, DDoS botnet enrollment, or SSH key installation for persistent access. The discovered servers become part of the next layer of infrastructure.
Chapter 5: The PIO-Hosting Nexus
Of the 628 campaign IPs, 15 sit directly on PIO-Hosting AS198584. Additionally, the HBING AS208949 carries campaign traffic through its IPXO-sourced prefixes (102.129.200.x). Together, the two ASNs documented in this series provide infrastructure for the campaign's core.
The 16 IPs we observe on AS198584:
| IP | Threat Score | Hits | AbuseIPDB | Cymru Country | RDAP Country |
|---|---|---|---|---|---|
| 194.120.230.28 | 90/100 | 42 | NL | HK ๐ญ๐ฐ | HK ๐ญ๐ฐ |
| 176.65.136.31 | 90/100 | 42 | NL | DE ๐ฉ๐ช | DE ๐ฉ๐ช |
| 176.65.131.189 | 90/100 | 12 | NL | DE ๐ฉ๐ช | DE ๐ฉ๐ช |
| 176.65.131.188 | 86/100 | 36 | NL | DE ๐ฉ๐ช | DE ๐ฉ๐ช |
| 195.62.32.180 | 85/100 | 48 | NL | DE ๐ฉ๐ช | DE ๐ฉ๐ช |
| 103.161.34.59 | 79/100 | 36 | NL | HK ๐ญ๐ฐ | HK ๐ญ๐ฐ |
Notice the geographic discrepancies: AbuseIPDB says Netherlands (where SkyLink's data center is). Cymru BGP says either Germany or Hong Kong (where the IP blocks are registered). RDAP confirms the registration. This triple-disagreement is what started our entire investigation.
โ What do the Hong Kong IPs tell us?
194.120.230.x and 103.161.34.x are registered in Hong Kong โ they belong to IPv4 Superhub Limited and Guosheng IDC respectively. These are the IP reputation laundering service and the dead-domain Chinese LIR documented in 026C. Their traffic routes through a German company, appears to come from the Netherlands, but their registration is in Hong Kong. Four "countries" for one IP address.
Chapter 6: The HBING Machines
Five IPs on AS208949 (HBING LIMITED) contribute to the campaign. Their geographic discrepancies are even more extreme:
| IP | Threat | AbuseIPDB | Cymru | RDAP | Registrant |
|---|---|---|---|---|---|
| 102.129.200.117 | 93/100 | NL | ZA ๐ฟ๐ฆ | US ๐บ๐ธ | IPXO/HEFICED |
| 102.129.200.101 | 88/100 | NL | ZA ๐ฟ๐ฆ | US ๐บ๐ธ | IPXO/HEFICED |
| 45.88.0.252 | 83/100 | NL | VG ๐ป๐ฌ | PL ๐ต๐ฑ | lir-vg-itweb-1 |
| 45.148.146.52 | 79/100 | NL | VG ๐ป๐ฌ | PL ๐ต๐ฑ | lir-vg-itweb-1 |
| 45.148.145.60 | 78/100 | NL | VG ๐ป๐ฌ | BE ๐ง๐ช | lir-vg-itweb-1 |
IP 102.129.200.117: Physically in the Netherlands. AbuseIPDB says Netherlands. Cymru BGP says South Africa (AFRINIC block). RDAP says United States (IPXO's registration). The company is British. The director is Turkish. Five countries for one IP address.
โ Why does this matter beyond academic curiosity?
Geographic discrepancy defeats geographic blocking. If an abuse report goes to AFRINIC (South Africa), they say "not our server." If it goes to the UK (where HBING is registered), they say "no data center here." If it goes to Turkey (where the director lives), they say "not our jurisdiction." The victim's abuse report enters a void between five jurisdictions, each disclaiming responsibility.
Chapter 7: The Business Model
Scanning campaigns exist because they make money. The economics:
| Component | Cost/Revenue |
|---|---|
| Infrastructure (628 VPS, 1 year) | -$75,000 to -$188,000 |
| Compromised servers sold (Access-as-a-Service) | $50-500 per server |
| Cryptocurrency mining (compromised fleet) | $1-10/day per server |
| DDoS botnet rental | $50-300/hour |
| Data exfiltration (corporate targets) | $1,000-$100,000+ per target |
If the campaign compromises even 1,000 servers per month (a conservative estimate given 628 scanners hitting millions of targets), the revenue from cryptomining alone ($10-30K/month) covers infrastructure costs. Access-as-a-Service and targeted data theft are pure profit.
โ Who buys the results?
The scanning and the exploitation may be different actors. "Initial Access Brokers" (IABs) sell credentials on dark web markets. The scanner operator doesn't need to exploit each target โ they sell root credentials in bulk. Recorded Future and Flashpoint report IAB listings at $10-500 per server, depending on the target's value (healthcare, finance, government pay premiums). The scanning campaign is the first step in a supply chain.
Chapter 8: The Campaign in Context
The libssh2_1.11.0 campaign (628 IPs) is just one of several we observe using PIO/HBING infrastructure. Our honeypot detects 57 active campaigns total. The largest:
| Campaign | IPs | Countries | Sessions | Strategy |
|---|---|---|---|---|
| libssh_0.11.x cluster | 1,313 | 84 | 44,341 | Scanner |
| libssh2_1.11.0 cluster | 628 | 48 | 16,253 | Scanner |
| libssh_0.9.6 cluster | 421 | 59 | 14,222 | Botnet |
| Go_SSH cluster | 320 | 43 | 7,115 | Scanner |
The libssh2_1.11.0 campaign is the one most directly connected to PIO/HBING infrastructure. But it operates alongside larger campaigns that may use different infrastructure. The internet is being scanned by thousands of machines simultaneously, each running different tools, owned by different operators, all competing for the same prize: unpatched servers with weak credentials.
๐ Read Between the Lines
- 628 machines costing $75K+/year means someone expects ROI well above $200K annually from the compromised systems
- The 0% success rate against our honeypot is meaningless โ we're one server. The campaign hits millions.
- PIO-Hosting's 15 IPs are the visible tip. The other 613 IPs on OVH, Psychz, ColoCrossing may also route through PIO/SkyLink at the BGP level without appearing in their ASN directly
- The campaign ran for exactly 19 days (May 2-21, 2026) then stopped โ suggesting a "burst" operational pattern designed to scan the entire IPv4 space quickly, then go quiet before blacklists propagate
- root:(empty) is the cheapest credential to try. Finding even one unprotected server justifies thousands of failed attempts.
Chapter 9: The Unscannable Truth
We documented the infrastructure (026A-026C). We traced the money (026D-026E). We identified the sanctions risk (026F). We named the people (026G). Now we've shown what the infrastructure does.
628 machines, paid for with real money, run by real people, routing through registered companies, scanning the entire internet for weak systems. And the response from every institution in the chain:
"Not our responsibility."
โ RIPE NCC (we just register resources)
โ PIO-Hosting (we just provide transit)
โ IPXO (we just lease IPs)
โ Companies House (we just register companies)
โ E-SIRKET (we just verify identities)
โ 123LIR (we just set up ASNs)
Everyone does their narrow job. Nobody looks at what the machine does when all the narrow jobs combine.
๐ Series Navigation โ The Phantom ASN
026A: The Phantom ASN (Overview)026B: The Bulletproof Archipelago
026C: The German Gray Zone
026D: The IP Marketplace
026E: The Offshore Chain
026F: The Sanctions Question
026G: The People Behind the Curtain
โ 026H: The 628 Machines (You Are Here)
026I: The Registry That Looked Away