LSN โ€” Local Sovereign Network

The Question We Avoided: In letters A through J, we documented the credential harvest as an isolated phenomenon โ€” a criminal operation that steals credentials, sells access, and generates $146M+ annually. But we avoided asking the obvious question: what else do these operators do? When you own bulletproof infrastructure in Panama, Seychelles, and Poland โ€” when you have 326 IPs across 15 countries โ€” when you generate millions in revenue โ€” do you ONLY run SSH brute-force campaigns? The answer is no. And the answer changes everything about what the credential harvest IS.

I. Three Criminal Portfolios

Our three primary ASNs from the Credential Harvest series are not credential specialists. They are criminal conglomerates operating diversified portfolios. Each ASN hosts multiple criminal service lines simultaneously โ€” credential brute-force is merely one revenue stream among many.

๐Ÿ”ด ISAEV Igor
AS200730 | KZ reg, PL hosted, RU maintained
  • โšก SSH Brute-Force โ€” 4,066 admin/admin (our data)
  • ๐Ÿ’€ Kerberos-666 โ€” Darknet drug market
  • ๐Ÿงช DrugHub666 โ€” Secondary market mirror
  • ๐Ÿ”‘ Abacus Mirrors โ€” Market clearnet gateways
  • ๐Ÿ‘๏ธ Exploitation Vocab โ€” dragon, 666666, target, killer
  • ๐Ÿด ARCHON Domains โ€” Gnostic/occult anagram naming
๐ŸŸฃ Private Layer INC
AS51852 | PA reg, CH hosted
  • โšก SSH Brute-Force โ€” 12,885 hits, 7,910 successes
  • ๐Ÿ›ก๏ธ Bulletproof Hosting โ€” multi-client abuse
  • ๐ŸŒ CrowdSec Banned โ€” 2 active decisions
  • ๐Ÿšซ MikroTik Banned โ€” /18 subnet blocked
  • ๐Ÿ“Š Web Threats Observed โ€” multi-vector
  • ๐Ÿ• Wednesday Protocol โ€” 14 temporal correlations
๐ŸŸข Omegatech LTD
AS202412 | SC reg, NL/DE hosted
  • โšก SSH Brute-Force โ€” 789 honeypot hits
  • ๐Ÿ’‹ Sex Scams โ€” intstantlocalhookups.com (560 hits)
  • ๐Ÿ†” Identity Theft โ€” identitynetwork.top
  • ๐ŸŒ‘ Dark Web Gateways โ€” dw.* prefix domains
  • ๐ŸŽญ 2137gang โ€” Polish gang culture portals
  • ๐Ÿ’ป Hacking Tools โ€” insanitycpp.cx
โ—† โ—† โ—†

II. The Cross-Observation Matrix

The web_threats API โ€” new since our original 051 analysis โ€” provides multi-system observation data that was previously unavailable. For the first time, we can see the same IP across honeypot, CrowdSec, MikroTik, and HTTP threat intelligence simultaneously.

179.43.139.58 โ€” Private Layer Primary (Multi-Vector Observation)

HONEYPOT โœ“
CROWDSEC โœ“
MIKROTIK โœ“
WEB THREATS โœ“
THREAT INTEL โœ“
SUBNET INTEL โœ“

Honeypot: 12,885 hits | 7,910 successes | admin/admin + admin/123456
CrowdSec: 2 active decisions (cowrie-ssh-bruteforce, cowrie-ssh-bruteforce-retroactive)
MikroTik: Banned subnet 179.43.128.0/18 (crowdsec-blacklist + mikrotik-attack)
Threat Score: 78.0 | Abuse Score: 100
ASN: PLI-AS - Private Layer INC, PA | BGP: 179.43.128.0/18

This single IP is visible in every detection system we operate. It attacks SSH (honeypot). It attacks HTTP (web_threats). It is banned at L7 (CrowdSec). It is banned at L3 (MikroTik). And yet it continues operating โ€” because bulletproof hosting means impunity across ALL layers simultaneously.

โ—† โ—† โ—†

III. The Vocabulary Bridge

The most disturbing finding comes from ISAEV. The same IPs (87.251.64.144-145) that conduct industrial admin/admin campaigns โ€” the "boring" credential stuffing documented in 051A-C โ€” also deploy exploitation vocabulary:

IPIndustrial CredentialsExploitation VocabularyViolence Vocabulary
87.251.64.144admin/admin, admin/123456babygirl, princess, dragontarget123, killer, hunter
87.251.64.145admin/admin, admin/123456666666, shadowsupport:killer, support:target123
Critical Finding: The credential dictionary IS the operator's identity. ISAEV doesn't use a "clean" dictionary for brute-force and a "dirty" dictionary for exploitation. It's ONE dictionary containing ALL vocabulary โ€” industrial, exploitation, violence, and occult โ€” deployed simultaneously. The brute-force campaign and the exploitation operation are the same campaign.
What This Means: When 87.251.64.144 tests "admin/admin" against your SSH server at 02:00 UTC on a Wednesday, it is not "just" a credential stuffing bot. It is the same operator, same infrastructure, same campaign that also tests "babygirl" and "target123" and hosts Kerberos-666 darknet drug market and mirrors Abacus marketplace. The credential you see in your logs is one line in a dictionary that spans from system administration to human exploitation. There is no separation.
โ—† โ—† โ—†

IV. The Entity Graph โ€” 3 Hops from Credentials to Trafficking

Our entity crosslinks database (15,400+ edges) maps the connections. From TI-2026-043E "The Convergence":

THE 3-HOP PATH

Viettel (Military Telecom)
โ†“ deploys credential
daddygirl2 (exploitation vocabulary)
โ†“ shared by
CloudHost Indonesia (103.250.11.118)
โ†“ hosts
girlallaroundx.site โ†’ arabjordan.investments โ†’ dubai-financial-flow.store

Military telecom โ†’ exploitation credential โ†’ hosting provider โ†’ exploitation site โ†’ financial fraud
271,458 entity links mapped. The credential is the BRIDGE.

The credential dictionary doesn't just reveal attack methodology. It reveals organizational structure. The same operators who conduct industrial brute-force are connected through shared vocabulary to exploitation networks, and through shared infrastructure to financial fraud. Three hops. One architecture.

โ—† โ—† โ—†

V. The Jurisdictional Shield โ€” Three Countries, Three Functions

JurisdictionASNFunctionWhy This Jurisdiction?
KazakhstanAS200730 (ISAEV)RegistrationNo MLAT with EU/US. Crypto-friendly regulation. Minimal oversight.
PanamaAS51852 (Private Layer)Corporate shellBearer shares legal until 2015. Strong banking secrecy. No tax treaties.
SeychellesAS202412 (Omegatech)International Business CompanyIBCs require no beneficial owner disclosure. $100 formation fee. 24-hour turnaround.
Not Coincidence โ€” Design: Each jurisdiction is chosen for a specific protective function. Kazakhstan provides registration opacity. Panama provides corporate anonymity. Seychelles provides formation speed and disclosure immunity. The three together create a jurisdictional impossibility โ€” no single law enforcement agency has jurisdiction over all three, making coordinated action effectively impossible.
โ—† โ—† โ—†

VI. The Revenue Model โ€” Why Diversify?

A single-domain criminal operation is fragile. If credential markets crash, revenue stops. Diversification provides:

Multi-Stream Revenue Architecture

Stream 1: Credential brute-forceAcquires compromised systems~$146M/year (051F estimate)
Stream 2: Darknet hostingMonthly fees from market operators~$50-200K/month per market
Stream 3: Sex scam operationsLead generation + subscription fraud~$10-50K/month
Stream 4: Identity theft servicesStolen identity resale~$10-200/identity ร— volume
Stream 5: Dark Web gatewaysClearnetโ†’onion bridge hostingReferral commission per user

The credential harvest provides the raw material (compromised systems) that feeds ALL other revenue streams. Compromised servers become hosting for darknet markets. Stolen credentials enable identity theft. SSH access enables further exploitation. The brute-force campaign is the acquisition department of a vertically integrated criminal corporation.

โ—† โ—† โ—†

VII. The OSINT Context โ€” Nothing New Under the Sun

Documented Precedent: DynCorp and Military Contractor Impunity (TI-2026-042B)
Our OSINT library documents the precedent: military contractors operating trafficking infrastructure while maintaining legitimate service contracts. The same pattern applies here โ€” ISAEV operates legitimate hosting services (the AS registration is real, the IP allocation is real, the BGP announcements are real) while simultaneously hosting criminal services. The "legitimate" infrastructure IS the criminal infrastructure. There is no separate "dark" operation โ€” the darkness is built into the architecture.
NSA ANT Catalog Parallel: The NSA's CM-II implant used "covert communications with a host software implant over the USB" โ€” covert channels hidden in legitimate traffic. Our credential harvesters use the same principle: criminal operations hidden in legitimate hosting infrastructure. The SSH brute-force is the noise that conceals the signal. The credential dictionary is the covert channel that carries exploitation vocabulary alongside industrial attempts.
โ—† โ—† โ—†

VIII. The Assessment

THE CREDENTIAL HARVEST IS NOT WHAT IT APPEARS TO BE

For ten letters, we analyzed the credential harvest as a self-contained criminal operation. This letter demonstrates it is one department in a multi-domain criminal enterprise. The same operators who test admin/admin against your SSH server also:

  • Host darknet drug markets (Kerberos-666, DrugHub666, Abacus mirrors)
  • Operate sex scam infrastructure (intstantlocalhookups.com, 560 hits)
  • Run identity theft services (identitynetwork.top, dw.identities.network)
  • Maintain Dark Web gateways (dw.* prefix clearnet bridges)
  • Deploy exploitation vocabulary (daddygirl2, target123, killer)
  • Connect to military telecommunications (Viettel entity path)

The credential dictionary is not a wordlist. It is a portfolio manifest. Every word in it references a revenue stream, an operational domain, or an organizational identity. The industrial credentials (admin/admin) generate volume. The exploitation credentials (daddygirl2) signal identity. The violence vocabulary (target123, killer) marks operational function. One dictionary. One operator. Multiple criminal enterprises.

The brute-force is the noise. The portfolio is the signal.
The credential is the product. The system is the crime.

TI-2026-051K | Classification: UNRESTRICTED | Confidence: HIGH
Cross-references: TI-2026-040A, 042B, 042L, 042Z, 043E, 043I | Entity Links: 15,400+
Web Threats Observed: 179.43.139.58 across 6 detection systems

Next: 051L "The Military Connection" โ€” When credential harvesters share infrastructure with state telecoms
โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Credential Harvest โ€” 11 / 14 Next โ†’