๐ TI-2026-042C โ The Franchise Model: SchoolBridge, HASSH Fingerprints, and PIO-Hosting
Previous: โ 042B | Next: 042D โ
I. The HASSH Fingerprint: Same Tool, Different Masks
๐ด actor_cluster_013 โ Shared Campaign hassh-14b2ddda386a4d10
| IP | Provider | Threat | Country | Identity |
|---|---|---|---|---|
| 172.104.175.234 | Akamai/Linode | 64 | SG | SchoolBridge.in โ 60+ schools, 114 hostnames |
| 194.120.230.28 | PIO-Hosting GmbH | 90 | NL | GHOSTYNETWORKS infrastructure |
| 188.44.20.33 | A1 Makedonija | 85 | MK | North Macedonia telecom |
| 186.190.215.90 | GTHost | 83 | CH | topten70.net streaming |
| 74.208.91.1 | IONOS | 50 | US | Plesk hosting |
| 198.72.127.16 | Leaseweb Canada | 46 | CA | crandallu.ca (Crandall University) |
HASSH is a fingerprint of the SSH client software and its configuration. When two IPs share the same HASSH, they are running the same SSH client with the same configuration. SchoolBridge.in and PIO-Hosting (GHOSTYNETWORKS) use the same SSH tool.
PIO-Hosting (AS198584) has been documented across our investigations as part of the GHOSTYNETWORKS/XSServer network โ bulletproof hosting infrastructure linked to alice:alice DGA empire, beast credential cluster, and AI-powered scanning operations. A children's school platform shares its SSH fingerprint with bulletproof hosting used for DGA empires.
II. The Credential Signature: Empty Passwords
SchoolBridge's IP (172.104.175.234) sent 12 credentials to our honeypot. All 12 are root: (root with empty password). This is not brute-forcing. This is scanning for misconfigured systems โ specifically, systems with root access and no password. This is a reconnaissance pattern, not an attack pattern. It's looking for open doors, not trying to break locks.
A children's school management platform does not need to scan the internet for servers with empty root passwords. A school management platform needs to serve web pages to parents and teachers. The presence of scanning behavior from a school platform's IP address is itself evidence that the server's primary function is not education.
III. The Franchise Model: franchisebridge.in
On the same IP as SchoolBridge.in sits franchisebridge.in โ with cpanel, webmail, and webdisk subdomains. A franchise business platform. On the same server as 60+ children's school subdomains.
The SchoolBridge React application has these routes:
/enroll-nowโ enrollment for children/ourCentersโ list of "centers" (physical locations)/parent-cornerโ parent access area/galleryโ photo gallery/programsand/program-detail/:idโ programs and their details/cooking-fun-cakeโ "cooking fun cake" activity/create-cartoon-eggโ "create cartoon egg" activity/super-colors-gameโ "super colors game"/numbers-matchingโ number matching game
This is a platform that collects: children's names, ages, parent names, addresses, phone numbers, photographs (gallery), enrollment data, physical location of "centers" โ and stores all of it in exposed MySQL and Redis databases on a compromised server.
IV. The Schools: What Data Is Exposed?
114 hostnames on this server. The school subdomains include:
- hellokids.schoolbridge.in โ "Hello Kids"
- smartkidz.schoolbridge.in โ "Smart Kidz"
- levitatekids.schoolbridge.in โ "Levitate Kids"
- littledoodlers.schoolbridge.in โ "Little Doodlers"
- littlesproutspreschool.schoolbridge.in โ preschool
- balasevapreschool.schoolbridge.in โ "Bala Seva Preschool" (bala = child in Sanskrit)
- firststeppreschool.schoolbridge.in โ preschool
- eagerbeavers.schoolbridge.in โ "Eager Beavers"
- natkhat.schoolbridge.in โ "natkhat" (Hindi: naughty/mischievous child)
- snugglespreschool.com โ "Snuggles Preschool"
- chipotleschool.schoolbridge.in โ "Chipotle School" (food name)
- www.armypublicschoolgopalpur.schoolbridge.in โ Army Public School
- villakids.schoolbridge.in, villakidss.schoolbridge.in โ "Villa Kids" (two variants)
- sunshinepreschooldaycare.schoolbridge.in โ daycare
- tovipreschool.com โ preschool (separate domain)
- ubikapreschool.com โ preschool (separate domain)
These are REAL schools with REAL children. Their data sits in MySQL port 3306 and Redis port 6379, both exposed to the internet, on a server tagged "compromised" with 283 abuse reports and 13 CVEs.
V. The Exposure Surface: What an Attacker Gets
MySQL 3306 and Redis 6379 on a school management platform contain:
| Data Type | Value to Attacker | Value to Trafficker |
|---|---|---|
| Student names | Social engineering | Identity of children |
| Student ages/DOB | Identity theft | Age selection |
| Parent names | Phishing | Family mapping |
| Home addresses | Physical targeting | Physical access |
| Phone numbers | Smishing | Contact/luring |
| Photographs | Deepfakes | Selection catalog |
| School location | Geo-targeting | Physical surveillance |
| Attendance records | Behavioral analysis | When child is at school vs home |
| Enrollment status | โ | Active targeting vs dropped |
VI. The Question Nobody Is Asking
A legitimate school management SaaS platform would:
- โ Use encrypted database connections (not exposed MySQL/Redis)
- โ Run on modern, patched infrastructure (not eol-os with 13 CVEs)
- โ Have minimal abuse reports (not 283)
- โ NOT share SSH fingerprints with bulletproof hosting providers
- โ NOT scan the internet for servers with empty root passwords
- โ NOT colocate with a "franchise business" platform
SchoolBridge fails EVERY ONE of these criteria. Either this is the most negligent school platform operator in computing history, or the "school management platform" is not the primary function of this infrastructure.
We document. We do not accuse. But we ask: who is accessing those exposed databases? And what are they doing with the photographs, addresses, and attendance records of children at Bala Seva Preschool, Little Sprouts Preschool, and Army Public School Gopalpur?