The Threat Portrait

no-reverse-dns-configured.com — PTR Attribution Evasion & HASSH-Linked RU/NL Bruteforce Infrastructure

ID: TI-2026-057A Date: 2026-06-30 Status: Dossier Confidence: MEDIUM Series: The Evasion Codex — Part 1 Analyst: Automated enrichment + manual review

Threat Overview

On 2026-06-30, MikroTik blocked 89.248.168.227 (AS202425 IP Volume Inc., Amsterdam) for SSH bruteforce activity detected via Cowrie honeypot. Subsequent enrichment surfaced two anomalies that elevated this beyond a routine block.

The first anomaly is the PTR record. 89.248.168.227 resolves to no-reverse-dns-configured.com — a Namecheap-registered domain actively renewed 23 days before observation. This is not absent reverse DNS. It is a purpose-registered, deployed domain designed to return a string that reputation systems interpret as unconfigured PTR. A /24 survey of 89.248.168.0/24 establishes that 132 IPs transparently identify as security.criminalip.com and 10 as scanner.openportstats.com, while exactly 23 IPs — including .227 — use the deceptive no-reverse-dns-configured.com PTR. The 23 deceptive nodes are operationally distinct from the 142 transparent commercial scanners sharing the same /24.

The second anomaly is the HASSH fingerprint. c39f4cec145ee3d50fb590595143b9d5, observed on 89.248.168.227 (SSH banner: SSH-2.0-Go), is identical to the HASSH observed on 77.246.159.182 (AS29182 JSC IOT, Moscow), which presents a spoofed banner SSH-2.0-OpenSSH_7.4. This fingerprint is unclassified — it matches none of the 68 known HASSH signatures in the honeypot database. Both IPs are flagged as similar_ips of each other in the intelligence similarity engine. On 2026-05-26, 77.246.159.182 achieved a successful root:root login in Cowrie and executed uname -o -m -n.

Central Hypothesis

These two nodes are operated by the same actor or share a private Go-based SSH toolkit, running scanning infrastructure from Netherlands bulletproof hosting (AS202425) and a Russian Skolkovo datacenter VPS (AS29182) simultaneously. The HASSH link is the technical anchor. The operational divergence — PTR evasion on one node, banner spoofing on the other — suggests deliberate opsec partitioning across the two platforms.

Severity Matrix

Finding	Title	Severity	Confidence	Evidence
F1	HASSH cross-infrastructure link: shared toolkit NL + RU	HIGH	MEDIUM	E1, E2, E3
F2	no-reverse-dns-configured.com: engineered PTR attribution evasion	HIGH	HIGH	E4
F3	SSH banner spoofing on 77.246.159.182 confirms deliberate opsec	MEDIUM	HIGH	E2, E3
F4	Multi-protocol attack: concurrent SSH + HTTP scanning from 89.248.168.227	MEDIUM	HIGH	E7
F5	77.246.159.182 infrastructure repurposing: dormant VPS weaponized 2026	MEDIUM	MEDIUM	E8

Key Confirmed Facts

89.248.168.227 — AbuseIPDB & GreyNoise

AbuseIPDB confidence:  100/100
Total abuse reports:   2929
GreyNoise:             MALICIOUS — last seen 2026-06-30
CrowdSec SSH ban:      cowrie-ssh-bruteforce (23h6m14s remaining at observation)
CrowdSec HTTP ban:     http:scan (164h47m19s remaining at observation)
AS202425 status:       Spamhaus ASN-DROP listed — bulletproof hosting
Traffic ratio:         Heavy Outbound

no-reverse-dns-configured.com — Domain Registration Record

Registered:     2024-05-07
Renewed:        2026-06-18   ← 23 days before observation
Registrar:      Namecheap
Deployed on:    23 IPs in 89.248.168.0/24
PTR role:       Evasion mimicry — returns string that appears as absent reverse DNS

Same /24 breakdown:
  132 IPs → security.criminalip.com       (transparent commercial scanner)
   10 IPs → scanner.openportstats.com     (transparent commercial scanner)
   23 IPs → no-reverse-dns-configured.com (DECEPTIVE — operationally distinct)

HASSH Cross-Infrastructure Link

HASSH:          c39f4cec145ee3d50fb590595143b9d5
Seen on:        89.248.168.227  (banner: SSH-2.0-Go)
                77.246.159.182  (banner: SSH-2.0-OpenSSH_7.4 — SPOOFED)
DB status:      UNCLASSIFIED — not in 68-signature honeypot database

Known Go SSH HASHs for comparison:
  2aec6b44b06bec95d73f66b5d30cb69a → go_scanner   (303 IPs)
  16443846184eafde36765c9bab2f4397 → Go_SSH        (320 IPs)
  e54ef3ec27fe1fea7ab64d3fa05359fd → go_scanner    (18 IPs)
  c39f4cec145ee3d50fb590595143b9d5 → UNKNOWN       (2 IPs — this investigation)

Conclusion: private Go SSH toolkit, distinct from all classified scanner families.

77.246.159.182 — Cowrie Session & Reputation

Honeypot session:   2026-05-26T09:58 UTC
Credential used:    root:root — SUCCESSFUL login
Command executed:   uname -o -m -n  (OS + architecture + hostname)
Ipsum score:        9 (as of 2026-06-29)
OTX pulse:          PurpleSynapz
AbuseIPDB:          77/100 — 42 reports from 32 DISTINCT reporters
PTR record:         mihaiilginkin1.fvds.ru (FastVDS customer billing hostname)
ASN:                AS29182 JSC IOT — Skolkovo Innovation Center, Moscow
AS internal risk:   65.3 (higher than AS202425's 31.8 despite non-bulletproof classification)

Five Findings in Detail

F1 — HASSH Cross-Infrastructure Link: Shared Toolkit NL + RU

Severity: HIGH | Confidence: MEDIUM

HASSH fingerprint c39f4cec145ee3d50fb590595143b9d5 is identical on both IPs despite different countries (NL, RU), different ASNs (AS202425, AS29182), and different stated SSH banners. HASSH encodes SSH client key exchange algorithm negotiation — cipher lists, MAC algorithms, compression preferences, KEX methods — as compiled into the SSH binary. It cannot be trivially spoofed independently of the underlying implementation. Two hosts sharing this fingerprint run the same SSH toolkit at the same configuration. The intelligence similarity engine independently flags both IPs as similar_ips, corroborating the HASSH match through a separate signal path. Confidence is MEDIUM rather than HIGH because shared toolkit is consistent with either a single operator or two actors using the same private tool without direct C2 or coordination evidence.

F2 — no-reverse-dns-configured.com: Engineered PTR Attribution Evasion

Severity: HIGH | Confidence: HIGH

The PTR for 89.248.168.227 and 22 sibling IPs resolves to no-reverse-dns-configured.com — a domain registered 2024-05-07 and renewed 2026-06-18, 23 days before observation. A legitimate unconfigured PTR returns NXDOMAIN or an ISP default. This domain is purpose-built to mimic that output in automated log parsers and analyst review workflows, while actually constituting a configured PTR that satisfies any check requiring PTR presence. The renewal date and systematic deployment across exactly 23 IPs confirm maintained, active infrastructure. This technique specifically defeats: DNSBL checks filtering on PTR absence; IDS signatures matching "no reverse DNS"; allowlist systems that exclude IPs without PTR. Confidence is HIGH — domain registration records and /24 survey are direct evidence, not inference.

F3 — SSH Banner Spoofing on 77.246.159.182 Confirms Deliberate Opsec

Severity: MEDIUM | Confidence: HIGH

77.246.159.182 presents banner SSH-2.0-OpenSSH_7.4 — common and unremarkable. The HASSH value (identical to .227's Go implementation) is encoded in the SSH key exchange and cannot be independently manipulated. The contradiction between claimed banner and actual HASSH directly proves deliberate spoofing. Analysts filtering on SSH-2.0-Go as a scanner indicator miss this node. The opsec priority differs from .227: .182 masks the banner but accepts a descriptive PTR hostname; .227 presents honest banner but invests in PTR evasion infrastructure. This is consistent with partitioned roles within the same operation.

F4 — Multi-Protocol Attack: Concurrent SSH + HTTP Scanning from 89.248.168.227

Severity: MEDIUM | Confidence: HIGH

At time of observation, 89.248.168.227 held two simultaneous CrowdSec bans: cowrie-ssh-bruteforce (23h6m14s remaining, placed ~2026-06-29T14:16) and http:scan (164h47m19s remaining, placed ~2026-06-23T16:35). The HTTP campaign predates the SSH campaign by approximately 5 days 21 hours. The HTTP ban duration is 7x longer, reflecting CrowdSec policy weighting. Blocking this IP for SSH only leaves web scanning unaddressed. Defense scope for AS202425 / bulletproof-hosted IPs must include HTTP vector coverage as a baseline requirement.

F5 — 77.246.159.182 Infrastructure Repurposing: Dormant VPS Weaponized 2026

Severity: MEDIUM | Confidence: MEDIUM

Passive DNS from OTX traces 77.246.159.182 to 2019 hosting Russian silver trading domains (opt-argent.ru, argent-tm.ru) through approximately 2023. AbuseIPDB reports begin only in March 2026, escalating in May 2026 when the Cowrie capture occurs. This is consistent with a VPS acquired from a legitimate business and repurposed for attack infrastructure — inheriting the IP's clean pre-2026 reputation history as a benefit. Confidence is MEDIUM because the transition is inferred from passive DNS gaps and report date distribution, not directly observed.

Operational Impact

PTR evasion has direct defensive consequences. Any security control using PTR lookup to identify or filter scanner traffic — DNSBL checks, IDS signatures matching "no reverse DNS," allowlisting known scanners by PTR — is blind to all 23 nodes using no-reverse-dns-configured.com. The 142 CriminalIP/openportstats nodes in the same /24 are transparent and easy to categorize; the deceptive-PTR subset requires HASSH fingerprinting, ASN-DROP list checking, or behavioral detection to surface.

HASSH-based detection is operationally necessary. F3 establishes that the Russian node evades banner-string-based IDS by claiming OpenSSH 7.4. SSH banner filtering or blocklists relying on version strings will not identify 77.246.159.182. Only HASSH fingerprinting — or behavioral analysis of the Go client's key exchange negotiation sequence — reveals the true client identity and links it to this investigation.

root:root credential success in Cowrie. 77.246.159.182 achieved a login Cowrie permitted and followed immediately with OS enumeration. If this session had reached a real host with default credentials, the next phase would be payload deployment driven by the architecture returned by uname -m. The actor advances beyond probing when access is granted.

Multi-vector scanning from 89.248.168.227. Blocking this IP for SSH only — the initial trigger — leaves the HTTP scanning operation entirely unaddressed. The HTTP campaign was active for nearly a week before the SSH probe was observed.

Watch Indicator — HASSH c39f4cec145ee3d50fb590595143b9d5

Any new honeypot or IDS session presenting this HASSH fingerprint —
regardless of:
  - SSH banner string (Go, OpenSSH 7.4, or any other claimed identity)
  - Source ASN or country of origin
  - PTR record value or absence

...should be immediately correlated to TI-2026-057.

This is a private Go SSH toolkit with no match in the 68-signature database.
Two IPs. Two countries. Two ASNs. One binary.

HASSH c39f4cec145ee3d50fb590595143b9d5 is the attribution anchor.

Series Overview — The Evasion Codex

This investigation is documented across multiple sub-articles, each examining a distinct layer of the infrastructure and technique set observed in TI-2026-057.

Article	Title	Focus
TI-2026-057A	The Threat Portrait	Executive overview — severity matrix, five findings, confirmed facts, operational impact (this article)
TI-2026-057B	The Two Nodes	Full forensic profiles of 89.248.168.227 (AS202425, NL) and 77.246.159.182 (AS29182, RU) — ASN details, reputation scores, CrowdSec ban timeline reconstruction, Cowrie session analysis, behavioral divergence, HASSH proof

What Is Not Yet Known

Actor identity (A3 unattributed). No APT match. No direct link to a named group or campaign. The Go SSH toolkit is private and unidentified in the fingerprint database.
A4 confidence is LOW. mihaiilginkin1.fvds.ru suggests a FastVDS account holder “Mikhail Ginkin” — FastVDS hostnames derive from customer billing usernames, which may be aliases, stolen identities, or resold accounts. No corroboration exists.
Infrastructure scope. Only 89.248.168.0/24 was surveyed. Whether all 23 deceptive-PTR IPs are actively scanning, or some are reserves, is not established.
HASSH origin. The specific Go SSH library, version, or compile-time configuration producing c39f4cec145ee3d50fb590595143b9d5 is unidentified. It does not match any of the four classified Go HASSH patterns in the database.
Single operator vs. shared toolkit. HASSH match is consistent with either one operator running two nodes or two actors using the same private tool. No C2, campaign overlap, or credential-sharing evidence was observed. F1 confidence is MEDIUM for this reason.
HTTP scanning activity extent. The http:scan CrowdSec ban indicates prior web scanning from .227 but targeted paths, tool identity, and request details are not in evidence.
Post-compromise activity on .182. Only uname -o -m -n was captured in the Cowrie session. What the operator attempted after OS enumeration is not known.