📊 The Botnet Census

The previous three letters of this series dissected individual operations: the proxy hunters who recruit routers (037A), the operators who compete for the first ten seconds after login (037B), and the delivery networks that deploy malware payloads (037C).

This letter steps back to ask a different question: who owns all of this?

Not the operators. Not the malware authors. The owners. The companies whose networks carry the traffic. The cloud providers whose free trials spawn the scanners. The telecom companies whose residential customers have been quietly conscripted into botnets. The bulletproof hosts who collect monthly payments to look the other way.

We processed 11,026 fingerprinted sessions across 63 unique HASSH fingerprints from 2,190+ unique IP addresses in 84 countries. Every session cataloged. Every fingerprint classified. Every IP traced to its registrant, its ASN, its physical address.

The results are not what the cybersecurity industry tells you to expect.

I. The Classification — What's Scanning Us

Every HASSH fingerprint was classified into one of nine behavioral categories. The classification is based on observed behavior — not reputation, not attribution, not threat feeds. What did the session do?

II. The Seven Armies — Botnet Census by Campaign

Sixty-three fingerprints sounds like noise. It is not. Seven campaigns account for the overwhelming majority of all hostile traffic. Each has a distinct toolchain, a distinct strategy, and a distinct owner.

III. The Country Map — Where Attacks Originate

Country-level attribution is problematic. An IP geolocating to the United States tells you where the server is, not where the operator is. But the distribution pattern reveals something important: attack infrastructure concentrates where data centers concentrate.

The Three Patterns

IV. The Credential Economy — What They Know About Us

Across 15,861 credential attempts, our honeypot recorded 2,638 unique username:password combinations. The distribution reveals the market segmentation of SSH exploitation.

The Structural Insight

Two credentials account for 93.6% of all successful authentications: admin:123456 and admin:admin. But look at the IP counts: admin:123456 has only 11 unique source IPs. admin:admin has 83.

This means 11 IPs know the exact password 123456 and hammer it relentlessly (average 306 attempts per IP). These are the professional operators — the ISAEV go_scanner cluster and the libssh2_scanner duo — running optimized dictionaries against IoT devices where admin:123456 is a factory default.

Meanwhile, 83 IPs try admin:admin — a distributed botnet where each compromised node carries a small, generic dictionary. Less efficient per-IP, but covering more ground through parallelism.

V. The Fingerprint Taxonomy — Reading the Toolchain

HASSH fingerprints are not just identifiers. They are forensic signatures that reveal the exact SSH library, version, and configuration used by each scanner. The taxonomy of our 63 fingerprints reveals the supply chain of SSH exploitation tools.

The dominance of libssh (versions 0.9.6 and 0.11.x combined: 2,303 IPs) reveals a monoculture. One open-source C library, developed by the KDE community on libssh.org, underpins the majority of the internet's SSH attack infrastructure. The botnet operators didn't write custom scanning tools. They compiled an open-source library and pointed it at the internet.

VI. The Ownership Question — Who Profits

Every IP in this census has a registered owner. Not a hacker handle, not a nation-state codename — a company, with a mailing address, a phone number, and an abuse email that someone is paid to monitor.

When you aggregate the RDAP registrations across all campaigns, three categories emerge:

Category 1: Cloud Providers (58% of botnet infrastructure)

Category 2: Bulletproof Hosts (32% of session volume)

Category 3: Telecommunications (compromised infrastructure)

VII. The Grand Total — What One Honeypot Sees

Our Cowrie honeypot has been operational since March 2026. In approximately three months, with a single SSH port on a single IP address, it has recorded:

Extrapolate. There are approximately 3.7 billion IPv4 addresses. If every address with port 22 open receives similar traffic — and research from GreyNoise, Shodan, and SANS suggests they do — then the seven botnets documented in this census are generating billions of SSH probes per day across the internet.

One honeypot. Three months. Sixteen malware families. Seven botnets. Two thousand source IPs. This is what the baseline of the internet looks like.

"The internet is not a network of computers. It is a network of botnets, connected by infrastructure owned by companies that profit from the traffic."

VIII. What Comes Next

This census has identified the armies. The next letter will identify the economy that sustains them. The money trail — from compromised device to cryptocurrency mixer to clean fiat — is the thread that connects everything.

The proxy hunters recruit routers because someone pays for residential proxies. The malware operators deploy binaries because someone pays for compute. The credential harvesters run dictionaries because someone pays for access. The Go_SSH surgeons operate without leaving traces because someone pays for deniability.

Follow the money. That's Letter E.

TI-2026-037D · Ghost Machines Series · Letter D
Published by LSN Threat Intelligence · Data: LSN Cowrie Honeypot + threat_intel DB
11,026 sessions · 63 fingerprints · 2,190+ IPs · 84 countries
All data sourced from proprietary honeypot deployment and open-source intelligence.