TI-2026-033F: The Payload
The abstract network reaches the concrete: a Caisse d'รpargne phishing kit, Russian actors probing their own government's corporate registry, an anti-phishing platform under DDoS attack, and the correction of a misattribution that matters โ rdp.sh is not starkrdp.io.
Executive Summary
Five articles have mapped the Psychedelic Connector network from identity to scale to substrate to corporate structure to operators. This final article examines what the network was actually used for โ the payload layer where abstract infrastructure makes contact with real targets.
The focal point is 45.154.98.153, a 1337 Services GmbH IP on AS210558. This single address has hosted a Caisse d'รpargne bank phishing kit (December 2022), carried a HiddenPhish toolkit SSL fingerprint (valid through October 2026), had a Russian-language domain hosted on it (November 2024), and was caught three times in May 2026 sending HTTP CONNECT proxy requests to egrul.nalog.ru โ the Russian Federal Tax Service's legal entity registry. The same IP participated in a 1.67 billion-request DDoS attack targeting phishdestroy.io, an anti-phishing monitoring platform.
This article also corrects an attribution error that appears in multiple threat intelligence reports: rdp.sh is not starkrdp.io. rdp.sh is 1337 Services GmbH's own commercial hosting domain, confirmed by the RIPE geofeed field in their AS210558 WHOIS record. starkrdp.io was a separate cybercriminal VPS marketplace seized in Operation Talent. The naming similarity is either coincidental or deliberate criminal mimicry of a legitimate brand.
The Correction: rdp.sh โ starkrdp.io
The RIPE geofeed field is a machine-readable IP geolocation data source defined by RFC 8805. When an organization registers a geofeed URL in their RIPE WHOIS record, they are making a formal declaration to the internet infrastructure community about what organization operates those addresses. 1337 Services GmbH registered https://rdp.sh/geofeed as their geofeed for AS210558, making this the single most authoritative confirmation available that rdp.sh is their own domain. No criminal operator would register a legitimate domain in their RIPE record โ that creates an auditable link to their real corporate identity. This is a registration 1337 Services made voluntarily as a legitimate LIR (Local Internet Registry).
Operation Talent is a law enforcement operation that targeted cybercrime infrastructure. starkrdp.io offered no-questions-asked Windows RDP server rentals aimed at cybercriminals who needed Windows infrastructure for attacks, fraud, and malware operations. Its seizure is a matter of public record; its empty DNS records are the forensic confirmation. The naming convention โ using "rdp" to evoke remote desktop services โ was likely deliberate brand confusion designed to make starkrdp.io appear adjacent to legitimate hosting services in cybercriminal forums.
45.154.98.153: The Payload Server
Open ports on this server reveal its operational architecture:
Four open HTTP ports are not a standard single-site web server โ they are a multi-tenant virtual hosting setup, consistent with a phishing panel serving multiple concurrent campaigns under different virtual hosts. Port 9100 is the standard Prometheus node_exporter metrics endpoint; port 9600 is used by Logstash or Elasticsearch monitoring. Both are exposed to the public internet without filtering, meaning the operator's monitoring stack is readable by any IP that connects โ a significant operational security failure for a server hosting criminal infrastructure.
The HiddenPhish branding in the SSL certificate is significant: it suggests a phishing-as-a-service (PhaaS) platform rather than a single-use phishing kit. A self-signed CA named "HiddenPhish" implies an operator who issues certificates for multiple phishing domains from a single root authority โ maintaining control over their own certificate infrastructure rather than relying on public CAs that log all issued certificates to Certificate Transparency logs. The one-year validity window (October 2025 to October 2026) means this certificate was issued after this investigation's timeline began and is still valid as of this article's publication date.
Passive DNS: Five Years of Tenants
The passive DNS history reveals a server that has hosted a range of tenants across five years โ from legitimate business software in 2020 to phishing infrastructure in 2022 to Russian-language commercial domains in 2024. This is not a dedicated phishing server. It is a shared hosting IP on an abuse-tolerant provider where criminal and legitimate tenants coexist, separated only by virtual hosting configuration. The HiddenPhish SSL cert, still valid, suggests the phishing infrastructure is current and active alongside whatever other tenants currently occupy this IP.
The Russian Actor Signal
egrul.nalog.ru โ What It Is
EGRUL (ะะดะธะฝัะน ะณะพััะดะฐัััะฒะตะฝะฝัะน ัะตะตััั ััะธะดะธัะตัะบะธั ะปะธั) is the Russian Federal Tax Service's official registry of legal entities โ the Russian equivalent of Companies House (UK) or SIRET (France). It contains registration data for every Russian company and individual entrepreneur: directors, founders, legal addresses, charter capitals, business activities. EGRUL access is used for due diligence, fraud, counterparty verification, and corporate intelligence gathering. Russian-speaking actors routinely query EGRUL to identify company structures for social engineering, fraud schemes, and corporate espionage.
egrul.nalog.ru:443 โ caught by SentinelX honeypot (JP reporter). Connection hijacked and held in tarpit.egrul.nalog.ru:443 โ same SentinelX honeypot. Same reporter. Pattern: recurring access attempts.s.ccxe.com.cn:443 โ Chinese exchange/market platform. Same actor, different target.egrul.nalog.ru:443. Three-week pattern of systematic Russian corporate registry access via this Tor exit as proxy./domain/satellitestress.st/ and /domain/terrastress.st/ within 23 hours. Part of 1.67B-request attack from 197,000 IPs.The egrul.nalog.ru proxy pattern recurs across three separate dates in May 2026 โ the same SentinelX honeypot catching the same IP using an HTTP CONNECT tunnel to reach the Russian tax registry. HTTP CONNECT is the method used to establish a TCP tunnel through a proxy: the actor is using this IP as a proxy to reach egrul.nalog.ru, not running code on the server itself. This means a Tor user is exiting through 45.154.98.153 and then using it as an additional proxy layer to access the Russian registry โ two layers of anonymization for what should be a publicly accessible database.
Why anonymize access to a public registry?
EGRUL is publicly accessible โ Russian companies can look themselves up without authentication. So why use a Tor exit as a proxy to access it? Three scenarios: (1) The actor is querying EGRUL at scale in an automated way that triggers rate limiting or IP blocking โ using proxied exit nodes to rotate source IPs. (2) The actor is in a jurisdiction where nalog.ru is blocked or monitored, using Tor and proxy chains to access Russian government infrastructure without revealing their location. (3) The actor is conducting corporate intelligence gathering that they do not want attributed to a specific network or organization. All three scenarios are consistent with Russian-speaking fraud or corporate espionage actors. Scenario 1 is the most operationally likely explanation for repeated proxy probing of a single target from the same source IP.
Supporting the Russian actor profile: the Russian-language domain ned.moyuniversalnyy.store hosted on this IP in November 2024 (four months before the egrul.nalog.ru probing began). Russian-language user-agents appear in AbuseIPDB reports: YaBrowser/20.3.5.90.00 (Yandex Browser, overwhelmingly Russian usage) and "ZTE Blade V10 Vita RU" (a Russia-market device variant). These are separate data points, not necessarily from the same actor, but they collectively indicate a Russian-speaking presence in the tenant population on this server.
The Anti-Phishing Counterattack
On May 16, 2026, phishdestroy.io โ an anti-phishing monitoring platform โ came under a 1.67 billion-request L7 DDoS attack involving 197,000 source IPs. One of those IPs was 45.154.98.153. The specific target paths were /domain/satellitestress.st/ and /domain/terrastress.st/, suggesting the attackers wanted to prevent phishdestroy.io from actively monitoring and reporting those two domains.
| Attribute | Value |
|---|---|
| Target | phishdestroy.io (anti-phishing monitoring platform) |
| Attack type | Layer 7 DDoS (HTTP GET flood) |
| Total requests | 1,670,000,000 (1.67 billion) |
| Unique source IPs | 197,000 |
| Requests from 45.154.98.153 | 818,293 in 23 hours |
| Target paths | /domain/satellitestress.st/ and /domain/terrastress.st/ |
| Date | 2026-05-16 |
| Mitigation | Cloudflare L7 DDoS mitigation (phishdestroy.io behind Cloudflare) |
A DDoS attack specifically targeting the domain monitoring paths of an anti-phishing platform is not random traffic. It is a deliberate attempt to disable threat intelligence infrastructure. phishdestroy.io tracks active phishing domains โ if their monitoring is blinded for the duration of an attack, phishing campaigns linked to those domains get an operational window without exposure. The fact that 45.154.98.153 โ the same IP hosting a HiddenPhish SSL cert โ was one of 197,000 IPs in this attack suggests coordination: this is not a coincidentally compromised machine, but part of an infrastructure operated by actors who have both phishing kits deployed and the botnet capacity to attack monitoring platforms simultaneously. This is mature criminal infrastructure, not amateur activity.
Threat Classification Summary
Investigative Q&A
What does "powered by rdp.sh" in the PTR record mean exactly?
1337 Services GmbH configures the reverse DNS (PTR record) for their IP space to include "powered.by.rdp.sh" โ a branding decision similar to "powered by Cloudflare" in PTR records. It is a marketing statement embedded in infrastructure: any network operator doing reverse DNS lookups on their customer IPs will see "rdp.sh" as the hosting brand. This is entirely normal for commercial hosting providers. It also means every AbuseIPDB report and security log entry for any IP in their range carries the rdp.sh name, contributing to the (incorrect) association between rdp.sh and abuse activity that actually originates from their customers, not from rdp.sh itself.
Is HiddenPhish a known PhaaS operation?
The hiddenphish.xyz domain and the self-signed CA "HiddenPhish" appear in threat intelligence as an identifier for a phishing kit or panel operator. The Cloudflare-fronted domain (no origin IP visible) makes attribution to a specific actor difficult. The self-signed CA design โ issuing certificates to specific phishing servers like 45.154.98.153 โ indicates either a single operator managing multiple servers under a common certificate authority, or a PhaaS kit that includes its own CA as part of the package. The one-year certificate validity, issued October 2025, suggests active operational maintenance rather than a legacy deployment. What is confirmed: this identifier is present on a server documented hosting banking phishing, with an AbuseIPDB score of 100 and Spamhaus DROP listing.
Why target Caisse d'รpargne specifically?
Caisse d'รpargne is France's third-largest banking group by assets โ approximately โฌ700 billion โ with a customer base concentrated in retail banking and savings accounts. French banking credential phishing has been a persistent category since at least 2018, targeting Crรฉdit Agricole, BNP Paribas, Sociรฉtรฉ Gรฉnรฉrale, and the Caisses d'รpargne specifically. The domain caisse-epargne-se-connecter.net was designed to impersonate the bank's online login portal (se-connecter = to connect/log in). The December 2022 hosting date coincides with a documented uptick in French banking phishing campaigns. The phishing was not novel in technique โ it was a commodity campaign on a shared server, consistent with PhaaS operations where any paying customer can rent a phishing page for a major French bank.
Does Operation Talent implicate 1337 Services GmbH / rdp.sh in any way?
No. Operation Talent targeted starkrdp.io, not rdp.sh. The operation was directed at the criminal marketplace that sold access to servers without identity verification, enabling criminal use. 1337 Services GmbH operates rdp.sh as a legitimate LIR registered with RIPE NCC, incorporated in Hamburg, Germany. Their Spamhaus DROP listing and AbuseIPDB reputation come from customer abuse โ criminals who rent servers from them and use those servers for malicious activity. Abuse-tolerant hosting is not the same as a criminal operation, even when it results in high abuse scores. Operation Talent's targets were operators who knowingly facilitated crime as their primary business model; 1337 Services GmbH is an overly permissive hosting provider, which is a different category.
What does this final article conclude about the Psychedelic Connector network?
The six-article investigation reveals a layered criminal infrastructure ecosystem that is not a single organization but a convergence of independently motivated actors sharing the same infrastructure choices. At the bottom: AS210558 (1337 Services GmbH) provides the raw hosting capacity, tolerating abuse at the cost of Spamhaus DROP listings. Above that: the Psychedelic Connector relay family (2cb.li) provides Tor exit capacity, with the KN offshore corporate structure (Mynymbox Hosting LLC) providing anonymized DNS and hosting for the operation's own infrastructure. At the operator layer: Satanist, em/j3, maxzrbn, and secretdrop.to each run components with distinct philosophies and OPSEC profiles. At the payload layer: phishing toolkits like HiddenPhish, Russian-speaking actors accessing corporate registries, and a DDoS botnet attacking anti-phishing monitors. The Psychedelic Connector is not commanded. It is convened โ by shared hosting choices, shared values around anonymity, and shared infrastructure that enables all of the above simultaneously.
Final Assessment โ Series Conclusion
Six articles. One network. The Psychedelic Connector (2cb.li relay family) operates as an anonymization layer for a diverse payload: French banking phishing, Russian corporate intelligence gathering, DDoS against anti-phishing infrastructure. The same AS210558 IP that carries a HiddenPhish toolkit SSL cert also runs Tor exit relays tracked in 50 consecutive OTX Anonymization_Network pulses. The same operator (Satanist) whose handle appears in Tor relay family keys has their personal blog hosted on NymDNS โ the anonymous DNS service of the same Saint Kitts LLC that issues SSL certificates from the same /24 subnet as the phishing server.
The rdp.sh correction matters because misattributing a legitimate (if abuse-tolerant) hosting provider as a criminal marketplace pollutes threat intelligence and misdirects law enforcement attention. starkrdp.io was seized because it was a criminal marketplace; rdp.sh remains operational because it is a commercial hosting provider that tolerates customer abuse. Both Spamhaus listings and the distinction are accurate โ they describe different things.
Confidence in infrastructure attribution: HIGH. Confidence in Russian actor profile: MEDIUM (behavioral evidence consistent with Russian-speaking operators; no direct identity link). Confidence in HiddenPhish as active PhaaS: HIGH (SSL cert current, domain active, multi-port HTTP panel architecture consistent with production phishing infrastructure).
Cross-references in this series
- TI-2026-033A: The Psychedelic Identity โ 2cb.li domain forensics, AROI relay family key, initial operator identification
- TI-2026-033B: 49 Relays, 17 ASNs โ Full relay inventory, April 6 deployment event, relay family cryptography
- TI-2026-033C: The Bulletproof Substrate โ Seven hosting providers including 1337 Services GmbH / AS210558
- TI-2026-033D: The Saint Kitts Pattern โ Mynymbox Hosting LLC (KN), NymDNS, offshore corporate structure
- TI-2026-033E: The Operators โ Satanist, em/j3, maxzrbn, secretdrop.to operator profiles and OPSEC tiers