The Login Page That Watched Back

🪞 HIGH — The gate built to keep attackers out became the instrument that catalogued them

TI-2026-047A — The Login Page That Watched Back

TI-2026-047A · Series: 🪞 The Glass Cage (Letter A) · TLP:WHITE

How an Authelia forward-auth gate turned every credential-scanning bot into a fully-logged specimen.

📋 The Short Version

Sensitive LSN services sit behind Authelia, a login gate. It answers every path with a 200 login page — and records the real target in the ?rd= parameter.
So a scanner hunting /.env or database dumps hands over its entire target list — and gets nothing back.
One Amazon IP enumerated 100 .env variants in 62 seconds.
47 scanners probe protected and unprotected hosts identically — they never notice the wall.
1,820 IPs hit both the web and the SSH honeypot. One crowd, two windows.
The single human the system flagged as a brute-forcer was a harmless false positive.

A 404 says "nothing here" and forgets. This login page says "nothing here" while writing down exactly what you asked for.

🪞 The Mechanism

An ordinary server answers a path-scan with a stream of 404s — and discards every one.

Behind Authelia, the same scan plays out completely differently:

① Scanner sends GET /.env to the Traefik ingress

↓ forward-auth check

② Authelia sees no valid session

↓

③ 302 → /?rd=…%2F.env&rm=GET — the real target is preserved

↓

④ 200 login page — the bot believes it found a live app

✔ We keep the decoded ?rd= value = the scanner's exact intent

The pipeline decodes every ?rd= back into the path the scanner wanted, then labels the source by behaviour:

scanner_fingerprint / credential_harvest — reconnaissance
auth_probe / auth_bruteforce — genuine login attempts

Takeaway — the labels let us prove, with counts, that most "login" traffic to these services is not login traffic at all.

💣 Specimen One — the 62-second `.env` storm

On 25 June 2026, a single Amazon IP — 18.118.155.138 (AS16509, AMAZON-02) — went to work.

965 requests in 62 seconds (≈ 36,572 paths/hour)
100 unique decoded targets, every one a .env permutation
Flagged by CrowdSec under crowdsecurity/http-sensitive-files
Spoofed a Windows browser user-agent

.env.backup.env.bak.env.ci.env.dev.env.docker.env.example.env.fly.env.json.env.production/crm/.env/storage/.env/var/www/html/.env/api/v2/.env/prestashop/.env

This is not opportunism. It is a pre-compiled secret-file dictionary fired at machine speed — the kind that ships inside off-the-shelf harvesters.

Takeaway — the bot hammered the protected host exactly as it would an unprotected one. It never registered the login wall.

🎭 Specimen Two — the harvester in a browser costume

95.173.216.24 (AS60068, CDN77 / DataCamp Limited, GB) arrived labelled credential_harvest.

Its decoded ?rd= list was tighter and more telling — /.env, then a sweep of database dumps:

/backup.sql/backups/database.sql/config/db.sql/data/dump.sql/database.sql/db.sql/db_backup.sql/dump.sql/mysql.sql/_profiler/phpinfo

Two details give it away:

Its user-agent claims to be a desktop browser — but the fingerprint leaks python-httpx/0.28.1.
The same IP is present in the SSH honeypot. Not a web scanner or an SSH attacker — both.

When the declared identity contradicts the behaviour, the contradiction is the evidence.

🚷 The Auth-Indifferent Cohort

Forty-seven IPs are confirmed multi_surface_scanner — they hit protected and unprotected hosts with identical path sets.

The auth layer changes the status code they receive (a 200 login instead of a 404). It changes nothing about what they do. They run open-loop — they never read the response — which is exactly why the trap keeps working.

And the cohort is not obscure. It runs on the most reputable networks on the internet, beside names this program has documented before:

IP	Network	Unprot. 404s	Authelia intercepts	Prior dossier
`18.118.155.138`	Amazon AS16509	6	538	046A / 046E
`3.144.156.150`	Amazon AS16509	308	244	046E
`34.129.126.223`	Google Cloud AS396982	13	147	046A
`146.70.194.252`	M247 Europe SRL	48	18	023B / 036B
`82.102.18.188`	M247 Europe SRL	10	27	023B / 036B
`139.28.219.70`	M247 Europe SRL	9	9	023B / 036B
`208.84.100.55`	ADVIN Services LLC	94	21	046E
`85.204.70.96` / `.114`	Hydra Communications (GB)	10 / 10	18 / 18	—
`85.115.209.52`	GODLIKE DIGITAL SOLUTIONS (RO)	16	4	036C

Takeaway — M247 (TI-2026-023B / 036B) and ADVIN (046E) reappear here. The networks we documented on the SSH and VPN side are the same ones probing the login page.

🌐 The Census — one population, two windows

Cross-referenced against the SSH honeypot and the published corpus (15,587 resolved crosslinks), the overlap is structural — not coincidence:

Relationship	Count	Meaning
`same_ip_web_and_ssh`	1,820	Same IP attacks HTTP and SSH
`web_probe_matches_investigation`	217	Web IPs matching prior-dossier infrastructure
`same_asn_web_and_ssh`	91	Networks active on both surfaces
`multi_layer_blocked`	73	Banned at L3 + L7 + honeypot + web
`multi_surface_scanner`	47	Protected + unprotected, identical probes
`web_campaign_overlaps_investigation`	38	Web campaigns overlapping investigations

Takeaway — the HTTP gate and the SSH honeypot watch one overlapping crowd, not two separate internets.

🧑 The Human in the Machine

Of fifteen confirmed Authelia auth events, almost all are auth_legitimate — operator infrastructure and known residential logins.

Exactly one external address was labelled auth_bruteforce. It was a false positive.

The "attacker" is a real, trusted young person learning IT with no formal schooling. The failures were not an attack — they were the ordinary friction of setting up OAuth and multi-factor authentication for the first time, which was hard enough.

The heuristic saw three failures and shouted brute-force. It had no way to see a kid trying to get his second factor to work. (Identity withheld — TLP:WHITE.)

For every one genuine human at the login page, hundreds of bots arrive — and the single human the machine accused was the one person there who meant no harm.

🛰️ The Global Baseline — this is not local weather

Everything the trap recorded matches the documented state of the internet:

EMERALDWHALE (Sysdig): scanned 500M+ IPs for exposed .git/config and .env files; harvested 15,000+ cloud credentials.
Unit 42: a large-scale cloud-extortion campaign built entirely on credentials from public .env files.
CVE-2017-9841 (PHPUnit RCE): nine years old, still 80,000+ exploit attempts in 30 days (VulnCheck) — and the exact CrowdSec scenario that fired on cross-surface scanner 185.177.72.58 (AS211590, BUCKLOG SARL, FR).
Verizon DBIR 2024: credentials compromised in 71% of basic web-app breaches. CrowdStrike 2024: cloud intrusions +75% YoY, shifting to identity-based attacks.

Takeaway — harvested credentials are the highest-yield initial-access commodity of 2024–2026. The cheapest way to find them is to ask ten thousand servers for their .env and see who answers.

❓ The Questions

Who is this?
Not one actor — a population. Commodity scanners renting both reputable compute (Amazon, Google) and abuse-tolerant networks (M247, ADVIN, Hydra, GODLIKE).

Why did it attack?
Credential and secret harvesting. The lists — .env, DB dumps, phpinfo — want secrets, not access to this app.

Who does it claim to be?
Desktop browsers. The fingerprints say python-httpx and Go clients. The costume contradicts the body.

Whom is it related to?
Itself, on another port. 1,820 of these IPs are in the SSH honeypot; the probes resolve onto prior dossiers.

Where is the money?
Downstream — stolen cloud keys resold or used for extortion. The scan is free; the payday is the credential.

What is the official anchor? [INST]
The hosts are fully anchored (ARIN/RIPE members, listed firms). The operators are not. That absence is the finding: a decentralised market renting anchored infrastructure, not one named APT.

What if it is more than it appears?
The trap's edge is that the adversary does not know it is one. Every bot that keeps firing at a login page it cannot read donates its full target dictionary — free, in real time.

⚖️ Verdict

A login gate deployed only to keep unauthorised users out became the highest-fidelity reconnaissance sensor in the estate.

By answering every probe with 200 and preserving the target in ?rd=, it turns blind denial into a decoded record of attacker intent — and proves, with counts, that most "login" traffic is automated secret-hunting by an auth-indifferent crowd that overlaps the SSH attackers and the actors of prior dossiers.

The cage is made of glass. From the inside it looks like a door; from the outside, everyone who rattles it is fully visible.

🔗 Related

TI-2026-046A — The .env Harvesters (the outside view of the same fleet)
TI-2026-046C — The Reconnaissance Industrial Complex
TI-2026-046E — The Cloud Mercenaries
TI-2026-023B — The Backbone (M247) · TI-2026-036B — The M247 Empire

Series: 🪞 The Glass Cage · Letter: A · Classification: TLP:WHITE

Data sources: LSN web-threats database (Traefik + Authelia forward-auth) · SSH honeypot · CrowdSec L7 · MikroTik L3 · Qdrant entity crosslinks (15,587 edges) · OSINT library. External: Sysdig EMERALDWHALE · Unit 42 · The DFIR Report (Bissa, 2026) · VulnCheck (CVE-2017-9841) · Verizon DBIR 2024 · CrowdStrike GTR 2024.

Investigation: TI-2026-047A · 8 actors · 11 evidence · 9 findings · 10 connections · 14 infrastructure records