🏠 The Permanent Residents

038A documented a single attacker — Private Layer INC — flooding the honeypot with 86,239 proxy verification events over 94 days. During that investigation, while counting the flood, a second number emerged that was equally extraordinary.

185.246.128.133 — w1n ltd — had generated 92,342 events over 87 days.

More events than Private Layer. More consistent. And with a trick that Private Layer doesn't use: 37 different SSH client version strings rotated on every connection, while the actual HASSH fingerprint never changes.

Together, these two IPs account for 178,581 events — approximately 96% of all honeypot traffic over the entire observation period. Every other attacker on the internet — every botnet, every scanner, every APT operator — competes for the remaining 4%.

I. Side by Side — The Two Permanent Residents

II. w1n Ltd — The More Dangerous Operator

While Private Layer operates in bursts — baseline polling punctuated by monthly flood sweeps — w1n ltd runs at a perfectly constant rate. Approximately 1,150-1,250 events per day, every single day, for 87 consecutive days. No spikes. No dips. No weekends off. The consistency of a factory production line.

This operational discipline reveals something important: w1n is automated infrastructure, not a human-operated tool. The scanning rate is tuned to avoid triggering volume-based alerts while maintaining maximum verification throughput. It's the difference between a factory that runs 24/7 and a construction site that has surges.

The Anti-Forensics: 37 Client Version Strings

This is the most sophisticated technique we've observed in the entire investigation series.

Every SSH connection carries a "client version" string — the software identification that the client sends during the protocol handshake. Normally, this string is constant for a given tool: if you connect with OpenSSH 8.9, every connection says "SSH-2.0-OpenSSH_8.9".

w1n's scanner rotates through 37 different version strings while keeping the same Paramiko-based HASSH fingerprint (57e4cc8ee36c3d78). The HASSH is a hash of the client's key exchange algorithms — it reveals the actual SSH library. The version string is just a text label that can be set to anything.

The rotation covers eight different SSH client families: Paramiko (11 versions), PuTTY (9 versions including KiTTY and a Snapshot build), WinSCP (7 versions), OpenSSH (5 versions), libssh (3 versions), JSCH (2 versions), and the obscure Granados SSH library. Every version is deliberately outdated — the newest is Paramiko 2.1.2 from 2017.

III. Dual-Market Verification — Yahoo AND Yandex

This is the finding that separates w1n from Private Layer.

Private Layer verifies proxies exclusively against Yahoo.com — 12 Yahoo IPs, HTTP/1.0, one test target. This serves the Western proxy market: customers who need to appear as residential users accessing American/European websites.

w1n verifies against both Yahoo.com AND Yandex.ru:

The payload split is exactly 50/50: 64 Yahoo requests and 64 Yandex requests in each verification cycle. Equal priority. Equal market weight.

IV. The Third Node — 185.246.130.20

During the persistence analysis, a third IP emerged: 185.246.130.20 — active for 93 days (longer than the primary node) but generating only 1,248 total events. Approximately one session per day.

The sentinel node uses a different HASSH fingerprint — a different SSH library or configuration. It connects once per day with admin:123456, confirms the target is alive, and disconnects. No tunneling, no verification. Just a heartbeat.

This is operational redundancy. If the primary node goes down or gets blocked, the sentinel maintains awareness of the target pool. When the primary comes back online, it knows which targets are still responsive without having to re-scan from scratch.

Notable on the sentinel: Shodan shows ports 3306 and 33060 — MySQL and MySQL X Protocol. This node also functions as a database server, likely storing the proxy pool inventory, verification results, and customer routing tables.

V. The Operational Comparison

VI. What Two IPs Tell Us About the Internet

Our Cowrie honeypot has been operational for 94 days. In that time, it has been contacted by thousands of unique IP addresses from 84 countries. Seven botnets have been documented. Sixteen malware families captured. Five revenue streams identified.

And yet: two IP addresses generate 96% of all traffic.

This reveals a structural truth about the SSH attack landscape: the threat is not distributed. It is concentrated. The botnets with thousands of IPs (037D) generate the headlines. But the permanent residents — the two IPs that never leave, that probe every few minutes, that rotate version strings and test dual markets — these are the operational backbone of the proxy economy.

They don't exploit. They don't deploy malware. They don't execute commands. They verify. They check. They maintain. They are the quality assurance department of the criminal proxy industry, and they run 24/7/365.

"The internet's residential proxy market is sustained not by spectacular breaches but by two servers in Panama and Britain that check, every few minutes, whether your router can still forward traffic to Yahoo and Yandex. When it can, you're a product. When it can't, they move on to the next one. They will check again tomorrow."

TI-2026-038B · The Permanent Siege · Letter B
Published by LSN Threat Intelligence · June 22, 2026
178,581 events · 2 IPs · 96% traffic share · 37 fake client versions · Yahoo + Yandex dual-market
All data sourced from live Cowrie honeypot logs and open-source intelligence.