The Stuffing Machine

I. The Question of Coincidence

When two IPs attack the same target at the same time, it might be coincidence. When five do it, it's suspicious. When ninety-nine do it within the same ten-minute window, it is a system.

IP address 87.251.64.176 — the ISAEV operator documented in TI-2026-051A — has 99 temporal correlations with other IP addresses. Each correlation means both IPs attacked within the same 10-minute time bucket. The cluster sizes range from 5 to 9 IPs per bucket, across dozens of time windows spanning weeks of observation.

IP address 179.43.139.58 — the Private Layer operator — has 105 temporal correlations. Even more coordination.

The mathematics of coincidence have a limit. If our honeypot receives ~63 unique IPs per day (current 24h rate), and attacks are distributed uniformly across 144 ten-minute buckets per day, the expected number of IPs per bucket is ~0.44. Observing clusters of 5-9 IPs in the same bucket is a 11-20× deviation from random expectation.

At 99 correlated IPs, we're not measuring coincidence. We're measuring clockwork.

II. The ISAEV Assembly Line

The subnet 87.251.64.0/24, registered to Isaev Igor (NIC handle II1979-RIPE, Kazakhstan), contains the most complete example of coordinated credential operations we've observed:

This is not eight independent attackers who happen to share an address block. This is one operator running a production line with each IP assigned a specific role:

• .176 — The heavyweight. Runs the most common credentials at maximum volume. The primary revenue generator.
• .145 — The specialist. Targets service accounts (support/*, a credential category that .176 never touches). Different market segment.
• .144, .147, .149, .150 — Reserve capacity. Low-volume activity suggests either testing, overflow handling, or rotation preparation (IPs warming up before taking over from exhausted/blocked primaries).

The division is by credential dictionary, not by target. All IPs scan the same target space. But each IP works a different section of the credential list. This is parallel processing — the computational concept made operational in an attack infrastructure.

Why this matters: If you block 87.251.64.176 (the loudest IP), you eliminate 96% of the volume from this subnet. But you don't eliminate the operation. The .145 specialist continues targeting service accounts. The reserve IPs can absorb the primary's workload. The subnet is resilient by design.

III. The Same Tool in Three Countries

The SSH fingerprint eff4c24daffc8532c160e86e5f006e53 appears in:

A HASSH fingerprint is derived from the SSH key exchange algorithms, encryption ciphers, MACs, and compression methods offered by the client. It identifies the exact compiled binary being used. The same fingerprint across three different countries in three different ASNs means one of three things:

1. Same operator, multiple locations — One person deploys the same scanner binary across VPS instances in Poland, Bulgaria, and Russia.
2. Tool distribution — Someone builds the scanner and distributes it to multiple operators, like a franchise model.
3. Shared codebase — Open-source or leaked tool compiled identically by multiple users (unlikely — even minor compilation differences change the HASSH).

The RDAP data narrows it further. The ISAEV Polish IPs (87.251.64.*) and the Bulgarian IP (80.66.66.10) share an RDAP organizational link through the "ru-avm-1-mnt" maintainer handle. Same administrative entity across both registrations.

This is the stuffing machine: one operator, one tool, one scheduler, deployed across multiple jurisdictions for resilience. If Poland blocks the subnet, Bulgaria continues. If Bulgaria goes down, Russia absorbs the load. The geographic distribution is not for stealth — it's for continuity of operations.

IV. The Forty-Eight Vietnamese Ghosts

Compare the ISAEV model (concentrated, high-volume, persistent infrastructure) with the Viettel model:

This is the opposite extreme from ISAEV. Where ISAEV concentrates volume on few IPs (3,942 attempts from one IP), the Viettel pattern distributes one attempt across 48 IPs. The aggregate effect is identical — the same credential is tested against the same target. But the detection profile is radically different:

The 48 Vietnamese IPs are compromised residential devices — home routers or PCs on Viettel broadband, infected with malware that includes SSH scanning as a secondary capability. The human owner doesn't know. Their device connects to our honeypot, types "root/password" once, and disappears. From our perspective, it looks like 48 unrelated humans making the same mistake. From the operator's perspective, it's one operation viewed through 48 lenses.

The parallel: This is the same operational structure that Epstein's financial networks used — described by Whitney Webb as "multiple shell companies, each appearing independent, all controlled by the same beneficial owner through layers of corporate indirection." Replace "shell companies" with "compromised residential IPs" and the structure is identical. Many apparent actors. One real actor. The multiplicity IS the disguise.

V. The Seychelles Again

In TI-2026-051A, we documented TechTies (AS197170) and Omegatech (AS202412) in the admin/admin credential landscape. In TI-2026-050A-E (The Toolmakers), we documented them as the Go_SSH fleet's persistent infrastructure. Now, examining admin/password (83 attempts, 80 IPs):

The Seychelles shell companies are the utility infrastructure of the credential economy. They don't specialize in one credential pair or one attack type. They run everything: Go_SSH scanning (Series 050), admin/admin stuffing (051A), admin/password stuffing (051C), and presumably every other credential operation we haven't specifically queried.

This is what "vertically integrated" means in criminal infrastructure. The same entity that scans for open SSH ports also stuffs credentials into them, also validates the access, also deploys the payloads. There is no market transaction between stages. It's all one pipeline, one operator, one set of offshore shells.

The institutional parallel: The DOJ APT41 indictment describes a similar vertical integration — the same actors who conducted espionage also ran commercial cybercrime. The line between intelligence gathering and criminal profit is drawn by the customer, not by the operator. The Seychelles infrastructure serves whoever pays.

VI. The Temporal Signature

The temporal correlations reveal not just that attacks are coordinated, but how they're scheduled:

The pattern: European working hours (06:50-10:10 UTC = 08:50-12:10 CET), weekday-concentrated, with recurring time slots suggesting a cron-like schedule. This matches the findings from Series 050D (The Food Chain), where Go_SSH attacks showed 61% concentration in 02:00-04:00 UTC and 78.5% on Wednesdays.

Different campaigns. Same operator timezone. Same scheduling infrastructure.

The temporal signature is the most difficult thing to fake. You can rent IPs in any country. You can route through any VPN. You can register shells in any jurisdiction. But when your attacks consistently cluster during European working hours, you reveal where the human is sitting. Not where the server is. Where the person is.

VII. The Machine Metaphor

The "stuffing machine" is not a metaphor. It is a literal description of the system architecture:

This architecture mirrors legitimate distributed computing systems. Replace "credential dictionaries" with "work items" and "validated credentials" with "processed results," and you have described a standard job queue with worker pools and geographic load balancing. The criminal innovation is not in the technology — it's in the application.

VIII. The Thread Forward

This letter documented the coordination behind credential stuffing — temporal synchronization, subnet-level division of labor, cross-border tool distribution, and the two-model architecture (concentrated vs. distributed). The stuffing is not random noise. It is a scheduled production run.

The next letter — TI-2026-051D: "Keys to the Kingdom" — will examine SSH key forensics. When the same public key appears from multiple IPs, it provides the strongest single signal of same-operator attribution. The SSH key is the fingerprint of the person, not the machine.

Ninety-nine IPs in ten minutes is not an attack.
It's a shift change at the factory.