Letter D of The Web Siege — a forensic series documenting multi-vector attacks at our Traefik ingress during June 2026.

In the previous letters, we dissected specific attack types: A: .env credential harvesters, B: WordPress ghost shell checkers, C: the reconnaissance spectrum. Each examined HTTP traffic in isolation.

This letter breaks the walls down. Because 39% of the IPs we observed attacking HTTP are simultaneously attacking SSH. They don’t specialize. They don’t choose a protocol. They scan everything, everywhere, all at once.

Cross-referenced: 4,459 web-threats IPs × 8,000+ SSH honeypot IPs × CrowdSec intelligence × MikroTik address lists. The overlap is not coincidence. It is architecture.

Think about what this means. An IP address probing your web server for /server/application.yml is, at the same time, trying root:admin123 against your SSH port. The same infrastructure. The same operator. The same cloud billing account.

This is not two separate threat actors coincidentally sharing an IP. This is one platform, one tool chain, running parallel attacks across every available protocol. The TCP port number is a parameter, not a specialization.

Scaleway leads at 92% — nearly every Scaleway IP in our HTTP logs also appears in the SSH honeypot. But the sheer volume belongs to Google Cloud (444 dual-protocol IPs) and Microsoft (267). Amazon’s 84% rate across 146 IPs makes it the most weaponized hyperscaler per capita.

Three Azure IPs stand out for sheer volume — single nodes generating over 1,000 requests each:

IP 20.104.203.253 alone hit 249 unique paths — empty User-Agent, targeting WordPress upload directories, admin panels, and obfuscated PHP shells (dx.php, CDX2.php, 166.php). This single Azure IP generated more malicious traffic than most entire ASNs.

20.206.64.115 hunts for phpinfo() pages — which leak server configuration, environment variables, and sometimes credentials. 1,293 requests from a single Microsoft cloud IP. Not a scan — a siege.

“Tier 1 Professional: AS396982 Google — 54 IPs, temporal bursts, zero honeypot overlap. Tier 2 Research: AS14061 DigitalOcean — 51 IPs, LeakIX + individuals, some overlap. Tier 3 Criminal: AS22295 Advin — 44 IPs, ALL in SSH honeypot.”

The three-tier model holds, but with an update: Google Cloud’s “professional” tier has a 77% SSH overlap when examined at full scale (575 IPs vs. the 54 in the .env-specific campaign). The “professional” label was based on the specialized .env fleet. The broader GCP presence is overwhelmingly criminal.

The real taxonomy is simpler: there are specialized operators (the 54-IP .env fleet with 0% overlap) and general-purpose attack platforms (everything else). The specialists are professional. The platforms are commodity.

From our OSINT library — provider abuse rates across SSH and HTTP attack data:

These are not outlier customers on otherwise clean networks. When half of Google Cloud’s IPs in our dataset are involved in attacks, that’s not an abuse problem — it’s a business model. Cheap VPS + credit card verification only + slow abuse response = attack infrastructure with a billing department.

1. Cross-Protocol Correlation Is Mandatory

If you monitor HTTP and SSH independently, you are blind to 39% of the threat. An IP that’s brute-forcing your SSH should automatically be blocked from your web applications. An IP scanning your web server for .kube/config should be immediately banned from SSH. Protocol-isolated defenses are a 2015 model fighting 2026 threats.

2. Cloud Provider Reputation Is a Liability

Allowing traffic from Google Cloud, Amazon, and Microsoft because “they’re legitimate cloud providers” is actively dangerous. 77% of GCP IPs in our dataset attack SSH. 84% of Amazon’s. The “cloud provider” allowlist is the widest hole in most security configurations.

3. The Credential Landscape Has Expanded

If your WAF only blocks /.env probes, you’re running 2020 rules. Attackers now target: .openai/config.json, .kube/config, .docker/config.json, gcp-credentials.json, service-account.json. Every infrastructure-as-code credential file. Every AI API key config. Your WAF rules need to include the full 2026 attack surface.

4. Grey-Hat Scanners Are Part of the Kill Chain

LeakIX finds your exposed .env. Criminal operators harvest from LeakIX. The “responsible disclosure” platform is, functionally, a targeting database. Whether you consider this ethical is irrelevant — it’s happening, and the time between LeakIX indexing your exposure and an attacker exploiting it is measured in hours.

The era of specialized attack tools is over. What we observe in 2026 is the attack platform: a single cloud-hosted infrastructure that scans every protocol, probes every credential format, and checks every known vulnerability — simultaneously.

These platforms don’t choose between HTTP and SSH. They don’t choose between .env and .kube/config. They don’t choose between WordPress shells and Spring Boot configs. They scan everything, everywhere, all at once.

The defense model must evolve to match: cross-protocol correlation, cloud-provider-aware blocking, and WAF rules that cover the full 2026 credential attack surface — from .env to .openai/config.json to .kube/config.

The TCP port number is a parameter, not a specialization.
The protocol is irrelevant. The platform attacks everything.

Series: TI-2026-046 “The Web Siege” · Letter: D · Classification: TLP:WHITE

Data Sources: Traefik access logs (7-day window) · SSH honeypot (8,000+ IPs) · CrowdSec intelligence · MikroTik address lists · Qdrant OSINT library (15,392 crosslinks) · web-threats behavioral database (4,459 IPs)

Investigation: TI-2026-046D · 5 actors · 6 evidence · 6 findings · 4 connections

← 046C: The Reconnaissance Industrial Complex · 046E: The Cloud Mercenaries →