The Shell Game

Follow the IP addresses and you find VPS providers. Follow the VPS providers and you find shell companies. Follow the shell companies and you find the Seychelles.

The Go_SSH fleet's 320 IPs are not randomly distributed. They arrange themselves into three distinct tiers — each serving a different operational purpose, each occupying a different risk position, each existing in a different jurisdictional reality. What initially appeared to be a swarm of independent European VPS nodes is, on closer inspection, a structured network of offshore entities operating through bullet-proof hosting providers.

I. The Map

320 IPs. 43 countries. But the distribution is not random.

The contrast is stark. The Go_SSH fleet is 9.7 times more concentrated in Western Europe than the libssh swarm. Western Europe — France, Germany, UK, Spain, Finland, Italy, Netherlands — hosts 35% of Go_SSH IPs but only 3.6% of libssh nodes. Conversely, East Asia (China, Korea, Japan, Hong Kong) hosts 23.1% of libssh but only 7.5% of Go_SSH.

Two operations. Two completely different geography. Two different procurement ecosystems.

The Country Leaders

France at #2 is the headline. Forty-three IPs — 13.4% of the fleet — on French hosting infrastructure. France is essentially absent from the libssh swarm. This is not random variation. This is a procurement preference. The Go_SSH operator has access to French hosting markets that the libssh operator does not — or chooses not to — use.

II. The Three Layers

The geographic data reveals structure. The Go_SSH fleet is not a flat collection of equivalent nodes. It has tiers — three distinct layers of infrastructure, each with different characteristics, different risk profiles, and different operational roles.

III. The Seychelles Connection

Two companies. Same country. Same IP space. Different names.

Both Seychelles-registered. Both with Dutch RDAP records. Both operating in the 91.92.x.x address space. The IP allocation overlap is the strongest indicator: IP address blocks are assigned by Regional Internet Registries (RIPE, in this case) to specific organizations. Two different companies operating in the same /16 prefix (91.92.0.0/16) suggests either a shared upstream provider or — more likely — related registrations that obtained adjacent allocations.

Why the Seychelles?

The Republic of Seychelles — 115 islands in the Indian Ocean, population 100,000, GDP $1.7 billion — has become a preferred jurisdiction for bullet-proof hosting companies. Why:

• Minimal corporate transparency. The Seychelles International Business Companies Act allows registration with minimal disclosure. Beneficial ownership is not publicly recorded. Directors can be nominees.

• No data retention requirements. Unlike EU countries (which require ISPs to retain data for 6-12 months), the Seychelles has no mandatory data retention. There is nothing to seize.

• Limited cooperation with EU/US law enforcement. While the Seychelles has mutual legal assistance treaties (MLATs) with some countries, enforcement is slow and under-resourced. A takedown request that would be processed in days by a German court takes months — if it's processed at all.

• Low registration cost. An International Business Company can be registered for under $1,000. An ASN can be obtained through RIPE for a few hundred euros. The total cost to establish a bullet-proof hosting shell in the Seychelles is under $5,000.

IV. The Panamanian Anchor

Private Layer INC deserves separate attention. Panama-registered, operating from Switzerland, 53 sessions from a single IP — all successful. A 100% success rate from a single node means this IP never attempts a connection it won't win. It has advance knowledge of which hosts accept which credentials.

Private Layer is a known entity in the bullet-proof hosting ecosystem. Unlike TechTies and Omegatech (which appear to be purpose-built shells), Private Layer is a commercial service — a hosting provider that markets itself on privacy and resilience. Its Swiss infrastructure provides EU-adjacent performance with Swiss data protection law.

V. The Individuals

Layer 2 contains two entities that don't fit the corporate shell model: w1n ltd (UK) and ISAEV Igor (Kazakhstan).

w1n ltd — The UK Small Operator

UK-registered company. AS42237. A single IP in Sweden generates 37 sessions with 94.6% success. The UK registration provides banking access in pounds sterling — useful for European payment processing. The Swedish hosting provides good connectivity and Swedish privacy law (one of the strongest in the EU). This entity bridges UK financial infrastructure with Nordic hosting.

ISAEV Igor — The Personal ASN

An individual named Igor Isaev. Kazakhstan. AS200730. A single IP in Poland. 35 sessions, 100% success. This is the most anomalous entity in the fleet: a personal ASN registered to an individual, not a company. Personal ASN registrations require providing real identity to the Regional Internet Registry (RIPE). Either this is a real person whose ASN has been co-opted, or it's a straw man registration — a name used for ASN procurement by someone else.

The Kazakhstan-to-Poland routing is notable: the ASN is registered in Kazakhstan but the infrastructure is hosted in Poland. This geographic split between registration and hosting mirrors the Seychelles-to-Netherlands pattern of TechTies and Omegatech.

VI. The Inverted Pyramid

The session data reveals something counterintuitive about the Go_SSH fleet's structure:

This inversion makes sense through the two-phase architecture lens. Layer 3 performs Phase 1: try a credential, disconnect, move on. Each IP touches each target once — low session count per IP, distributed across 280 nodes. Layer 1 performs Phase 2: revisit validated hosts with the mega-command. Each IP returns to many hosts — high session count, concentrated on a few IPs.

The disposable fleet does the dangerous work (trying passwords that might fail, getting blocklisted). The offshore core does the valuable work (profiling hosts for exploitation). Risk and value flow in opposite directions.

VII. The Absence of China

The libssh swarm has 228 Chinese IPs — 9.7% of its fleet. The Go_SSH fleet has three. 0.9%.

This absence is as informative as any presence. Chinese cloud infrastructure — Alibaba, Tencent, Huawei Cloud, UCloud, ByteDance — is abundant, cheap, and used extensively by the libssh operator. The Go_SSH operator avoids it entirely. Three IPs from a fleet of 320 is statistical noise, not a procurement strategy.

Possible explanations:

1. Different operator nationality. Chinese cloud platforms often require Chinese phone numbers, Chinese payment methods, or Chinese identity verification. A European operator cannot easily procure Chinese cloud VPS. The Go_SSH operator's European focus suggests they operate from — or at least bank in — Europe.

2. Deliberate avoidance. Chinese cloud providers are increasingly cooperative with international law enforcement (especially for cybercrime involving non-Chinese targets). An operator aware of this might deliberately avoid Chinese infrastructure to reduce exposure.

3. Different supply chain. The Go_SSH operator's procurement chain runs through European markets (OVH, Contabo, Hetzner, DigitalOcean) and offshore shells (Seychelles, Panama). This is a self-contained ecosystem that doesn't need Chinese cloud.

VIII. The Thread Forward

The shell game reveals itself. Three offshore entities. A jurisdictional triangle spanning Seychelles, Panama, Netherlands, and Switzerland. A three-layer infrastructure that separates risk from value. France as an unexpected node in the geographic map. And the absence of China as a negative indicator of the operator's identity.

The next letter steps back from the Go_SSH fleet to examine what happens when its validated credentials are used. 333 hosts profiled. Some with GPUs. Some abandoned for months. Some are honeypots (including ours). The mega-command outputs went somewhere — to a triage system that sorts hosts by value and queues them for exploitation. What does that exploitation look like? What payloads follow? What does the operator do with a GPU server that no one is watching?

The shell game shows us who operates the fleet. The next letter shows us why.