The Two Nodes

Full forensic profiles: AS202425 NL bulletproof vs. AS29182 RU commercial VPS — linked by HASSH c39f4cec

ID: TI-2026-057B Date: 2026-06-30 Status: Dossier Series: The Evasion Codex — Part 2 Nodes: 89.248.168.227 + 77.246.159.182 HASSH: c39f4cec145ee3d50fb590595143b9d5

Node 1 — 89.248.168.227 (AS202425, Netherlands)

Reputation Summary

Source	Value	Detail
AbuseIPDB confidence	100/100	2929 abuse reports
GreyNoise	Malicious	Last seen 2026-06-30
CrowdSec — SSH	cowrie-ssh-bruteforce	23h6m14s remaining at observation
CrowdSec — HTTP	http:scan	164h47m19s remaining at observation
Ipsum score	Not in evidence	—
OTX pulse	Not in evidence	—

Network Attribution

Attribute	Value
IP	89.248.168.227
BGP prefix	89.248.168.0/24
ASN	AS202425
AS name	IP Volume Inc.
AS registration	Seychelles (offshore jurisdiction, minimal abuse enforcement)
Geolocation	Netherlands (NL) — EU datacenter physical location
Hosting type	Bulletproof — Spamhaus ASN-DROP listed
Traffic ratio	Heavy Outbound
PTR record	no-reverse-dns-configured.com

PTR analysis. A legitimate unconfigured PTR returns NXDOMAIN or an ISP-generated record. The presence of a purpose-registered domain as the PTR value is intentional: the operator controls the domain and has deployed it across 23 IPs in the /24 to defeat analyst heuristics that flag absent PTR as suspicious. The domain name mimics default-unconfigured-state language, engineered to be skipped in automated log processing. Renewal on 2026-06-18 — 23 days before observation — confirms maintained, active infrastructure.

/24 PTR Survey — 89.248.168.0/24

Total /24 addresses: 256

Transparent commercial scanners (easy to classify):
  132 IPs → security.criminalip.com       (CriminalIP scanner identity)
   10 IPs → scanner.openportstats.com     (openportstats scanner identity)
  ──────────────────────────────────────
  142 IPs  subtotal — transparent, ASN-associated, publicly documented

Deceptive PTR (evasion domain — operationally distinct):
   23 IPs → no-reverse-dns-configured.com  ← .227 is one of these
  ──────────────────────────────────────────────────────────────
   23 IPs  subtotal — NOT part of commercial scanner footprint

The 23 deceptive-PTR IPs cannot be identified by PTR lookup alone.
Surface via: ASN-DROP list | HASSH fingerprinting | behavioral analysis

Cowrie Honeypot Session — 2026-06-30T13:23 UTC

Session date:           2026-06-30T13:23 UTC
Duration:               0.1 seconds
Credential attempts:    NONE
SSH banner presented:   SSH-2.0-Go  (honest — Go client identity not masked)
HASSH:                  c39f4cec145ee3d50fb590595143b9d5
HASSH classification:   UNCLASSIFIED (not in 68-signature honeypot database)
Infrastructure role:    attack_node
Internal threat score:  42.0

Session interpretation. A 0.1-second SSH session with zero credential attempts is a capability probe, not a bruteforce attempt. The SSH handshake completes — banner exchange and HASSH-generating key exchange both occur — then the connection terminates without authentication. This serves two purposes: host verification (confirms SSH is running and responsive on the expected port) and server fingerprinting (the HASSH exchange captures the server's own key exchange preferences, identifying daemon version and configuration without triggering authentication-layer logs at the target). The honest SSH-2.0-Go banner on this node contrasts with the spoofed banner on linked node .182, indicating different opsec priorities across the two platforms.

CrowdSec Dual-Ban Timeline Reconstruction

Observation anchor:   2026-06-30T13:23 UTC
(All derived timestamps subtract ban remaining-time from this anchor)

BAN 1 — http:scan:
  Remaining at observation:    164h47m19s (~6 days 20 hours)
  Estimated ban placement:     ~2026-06-23T16:35 UTC
  Implication:                 HTTP scanning campaign detected 6d 21h before SSH probe

BAN 2 — cowrie-ssh-bruteforce:
  Remaining at observation:    23h6m14s (~23 hours)
  Estimated ban placement:     ~2026-06-29T14:16 UTC
  Implication:                 SSH campaign detected (or escalated to threshold) day before

Δ between ban placements:      ~141.7 hours (5 days 21 hours)

Duration ratio (HTTP:SSH):     ~7:1
  Reflects CrowdSec policy: http:scan scenarios carry longer default ban duration
  than cowrie-ssh-bruteforce detections in this deployment

Sequence established:
  HTTP scanning → detected first (~Jun 23)
  SSH scanning  → detected second (~Jun 29)
  SSH probe     → captured in Cowrie (~Jun 30) ← observation

This IP ran multi-protocol reconnaissance for at least 7 days before observation.
Single-vector SSH blocking leaves the HTTP operation unaddressed.

Node 2 — 77.246.159.182 (AS29182, Moscow)

Reputation Summary

Source	Value	Detail
AbuseIPDB confidence	77/100	42 reports from 32 DISTINCT reporters
Ipsum threat score	9	As of 2026-06-29
OTX pulse	PurpleSynapz	Named threat intelligence collection
GreyNoise	Not in evidence	—
CrowdSec bans	Not in evidence	—
Infrastructure role	attack_node	—
Internal threat score	11.0	—

The AbuseIPDB value of 77 from 32 distinct reporters indicates broad, independent corroboration across multiple observation points — not a single prolific reporter. The Ipsum score of 9 places this IP in elevated threat territory. The OTX PurpleSynapz attribution confirms capture within at least one named threat intelligence collection effort, independent of this investigation.

Network Attribution

Attribute	Value
IP	77.246.159.182
BGP prefix	77.246.158.0/23
ASN	AS29182
AS name	JSC IOT
AS location	Skolkovo Innovation Center, Moscow
ISP sub-org	JSC Datacenter / webdc.ru
Hosting type	Commercial VPS (FastVDS) — not bulletproof-classified
PTR record	mihaiilginkin1.fvds.ru
Internal AS risk score	65.3 (vs. AS202425's 31.8 — higher despite non-bulletproof status)
IXP peering	9 IXPs including MSK-IX

PTR analysis. mihaiilginkin1.fvds.ru resolves to FastVDS, a Russian VPS provider. FastVDS generates hostnames deterministically from the customer's billing username. The string mihaiilginkin1 encodes the account identity under which this server was provisioned. Actor A4 designation in the investigation record carries LOW confidence: this may be an alias, a stolen identity, or a resold VPS account. No corroboration exists for the name as the actual operator. It is noted, not relied upon.

Cowrie Honeypot Session — 2026-05-26T09:58 UTC

Session date:           2026-05-26T09:58 UTC
Outcome:                SUCCESSFUL root:root LOGIN
SSH banner claimed:     SSH-2.0-OpenSSH_7.4  ← SPOOFED (see Banner Spoofing section)
HASSH:                  c39f4cec145ee3d50fb590595143b9d5
Command executed:       uname -o -m -n

Command decomposition:
  uname -o   → operating system name       (e.g., "GNU/Linux")
  uname -m   → machine hardware name       (e.g., "x86_64", "aarch64", "armv7l")
  uname -n   → nodename / system hostname  (e.g., "server-01", "router.local")

Executed as a single command immediately after login.
Answers: what OS, what architecture, what hostname.

Architecture result drives second-stage payload selection in botnet
recruitment flows — ARM vs. x86 vs. MIPS require different binaries.
This is automated post-exploitation enumeration, not manual reconnaissance.

Banner Spoofing — Technical Proof

Claimed (application layer):  SSH-2.0-OpenSSH_7.4
Actual (implementation):      Go SSH client

HASSH encodes these SSH client parameters (from the key exchange):
  kex_algorithms          — KEX method preferences and order
  server_host_key_algo    — host key algorithm preferences
  encryption_algorithms   — cipher preferences (client→server, server→client)
  mac_algorithms          — MAC algorithm preferences
  compression_algorithms  — compression preferences

These lists are COMPILED into the SSH binary at build time.
They differ substantially between OpenSSH and Go SSH implementations.

Proof by contradiction:
  Premise A:  SSH-2.0-OpenSSH_7.4 is an OpenSSH client
  Premise B:  OpenSSH 7.4 produces HASSH != c39f4cec145ee3d50fb590595143b9d5
  Observation: HASSH on .182 == c39f4cec145ee3d50fb590595143b9d5
  Premise C:  89.248.168.227 presents SSH-2.0-Go + c39f4cec... (directly observed)
  Conclusion: .182 banner is SPOOFED. Implementation is Go SSH.

Implication:
  Any IDS/SIEM filter matching "SSH-2.0-Go" as a scanner indicator
  will NOT fire on 77.246.159.182.
  Only HASSH fingerprinting detects the true client identity.

Historical Infrastructure Timeline

2019-06-20   Earliest OTX passive DNS record for this IP
             l08a60fb.justinstalledpanel.com
               WHM/cPanel auto-generated hostname on first install
               "l08a60fb" is the IP address (77.246.159.182) in hexadecimal
               Indicates: shared hosting / cPanel panel was running

2019         ns1.opt-argent.ru
               Nameserver record for Russian silver trading domain

2019–2023    opt-argent.ru, www.opt-argent.ru
               Russian wholesale silver trading ("opt-argent" = silver wholesale)

2020–2022    argent-tm.ru, www.argent-tm.ru
               Second Russian silver trading domain on same IP

             [~3-year gap — no recorded activity 2023–2026]

2026-03      AbuseIPDB reports BEGIN
               Description: ubnt-targeted SSH bruteforce
               (Ubiquiti SOHO/network device targeting — root:root targeting pattern)
               IP transitions from dormant to active attack use

2026-05-26   Cowrie session: root:root login, uname -o -m -n executed
T09:58 UTC   Banner spoofed as SSH-2.0-OpenSSH_7.4
             HASSH: c39f4cec145ee3d50fb590595143b9d5

Current PTR  mihaiilginkin1.fvds.ru (FastVDS customer hostname)

Infrastructure repurposing interpretation. The WHM justinstalledpanel.com record in 2019 confirms this IP ran a cPanel/WHM web hosting panel. The silver trading domains hosted 2019–2023 are consistent with legitimate Russian e-commerce operation. The 3-year gap before abuse reports begin in 2026 is consistent with a VPS acquired or repurposed from that operation — intentionally selecting an IP with years of clean history to inherit reduced initial reputation risk. Confidence on F5 is MEDIUM because this transition is inferred from passive DNS and report date distributions, not directly observed.

Comparative Analysis

Dimension	89.248.168.227	77.246.159.182
ASN	AS202425 — IP Volume Inc.	AS29182 — JSC IOT
AS registration	Seychelles	Russia (Skolkovo Innovation Center, Moscow)
Geolocation	Netherlands	Russia
BGP prefix	89.248.168.0/24	77.246.158.0/23
Hosting type	Bulletproof — ASN-DROP listed	Commercial VPS (FastVDS / webdc.ru)
PTR record	no-reverse-dns-configured.com (evasion domain)	mihaiilginkin1.fvds.ru (VPS customer hostname)
SSH banner	SSH-2.0-Go (honest)	SSH-2.0-OpenSSH_7.4 (spoofed)
HASSH	c39f4cec145ee3d50fb590595143b9d5 — IDENTICAL
AbuseIPDB confidence	100/100 (2929 reports)	77/100 (42 reports, 32 reporters)
GreyNoise	Malicious (2026-06-30)	Not in evidence
Ipsum score	Not in evidence	9 (2026-06-29)
OTX pulse	Not in evidence	PurpleSynapz
CrowdSec bans	2 active (SSH + HTTP)	Not in evidence
Honeypot session	2026-06-30T13:23	2026-05-26T09:58
Session duration	0.1 seconds	Not specified
Credentials attempted	None	root:root (successful)
Commands executed	None	uname -o -m -n
Internal threat score	42.0	11.0
Infrastructure role	attack_node	attack_node
DB cross-linkage	similar_ips → .182	similar_ips → .227

Shared Indicators — HASSH Uniqueness in Context

Known Go SSH HASSH signatures in honeypot database (68 total classified):
  2aec6b44b06bec95d73f66b5d30cb69a → go_scanner   (303 IPs — large cluster)
  16443846184eafde36765c9bab2f4397 → Go_SSH        (320 IPs — large cluster)
  e54ef3ec27fe1fea7ab64d3fa05359fd → go_scanner    (18 IPs  — small cluster)
  c39f4cec145ee3d50fb590595143b9d5 → UNKNOWN       (2 IPs   — this investigation)

c39f4cec is not in any of the known clusters.
It is a distinct Go SSH implementation — different library, version, or build config.

Detection gap: agents using the known Go HASSH signatures as blocklist indicators
will not match c39f4cec. This fingerprint requires explicit addition as a watch indicator.

Behavioral Divergence

Despite running the same underlying SSH toolkit (confirmed by HASSH), the two nodes demonstrate different attack chain stages and divergent opsec strategies:

Behavior	89.248.168.227	77.246.159.182
Session type	Capability probe (no authentication)	Full exploitation (login + command execution)
Credential phase	Skipped entirely	root:root — attempted and accepted
Post-auth phase	None	OS fingerprinting via uname -o -m -n
Evasion: SSH banner	None — Go banner shown honestly	Active — OpenSSH_7.4 spoofed
Evasion: PTR record	Aggressive — registered evasion domain across 23 IPs	Minimal — VPS default hostname exposed
Multi-protocol scanning	Yes — SSH + HTTP (dual CrowdSec bans)	Not evidenced
Abuse report volume	Very high (2929 reports, 100/100)	Moderate (42 reports, 77/100)
Hosting infrastructure	Bulletproof (established scanner platform)	Commercial VPS (repurposed legitimate IP)
IP reputation age	Burned across databases (2929 reports)	Lower profile (42 reports, started Mar 2026)

Opsec Partitioning Hypothesis

The divergence in evasion strategy between the two nodes is systematic, not random. Each node invests in different evasion at different layers:

.227 invests in PTR evasion — registered domain deployed across 23 IPs, renewed 23 days before observation. But does not mask its SSH banner. Consistent with an IP operating at high volume (2929 reports) already burned across reputation databases: PTR evasion targets automated pipeline detection that relies on PTR to classify scanners. The banner being honest costs nothing at this reputation level.
.182 invests in banner spoofing — claiming OpenSSH 7.4 to defeat banner-based scanner filters. But accepts a descriptive PTR hostname (FastVDS customer account). Consistent with a lower-profile IP (42 reports, active only since Mar 2026) where PTR-based analyst attribution is lower risk, but banner-based IDS filtering is a concern in environments where the IP hasn't yet accumulated a reputation record.
Neither node defeats HASSH. The shared HASSH c39f4cec145ee3d50fb590595143b9d5 is the blind spot in both opsec strategies. Whether this is ignorance of HASSH as a detection vector, or operational acceptance of that risk, is not determinable from evidence.

Attack Timeline

Reconstructed from Evidence — Approximate Timestamps Derived from CrowdSec Ban Remaining-Time Values

2019-06-20  77.246.159.182: First OTX passive DNS record
            Hosting: Russian silver trading domains (opt-argent.ru)
            Infrastructure: WHM/cPanel shared hosting panel (justinstalledpanel.com)
            │
            ▼
2019–2023   77.246.159.182: Legitimate commercial hosting continues
            (opt-argent.ru, argent-tm.ru, associated nameserver records)
            No attack activity recorded in this period
            │
            ▼  [~3 year gap — no recorded activity]
            │
2026-03     77.246.159.182: AbuseIPDB reports BEGIN
            Description: ubnt-targeted SSH bruteforce
            IP transitions from dormant/legitimate to active attack platform
            │
            ▼
2026-05-26  77.246.159.182 → Cowrie honeypot
T09:58 UTC  Banner:    SSH-2.0-OpenSSH_7.4 (SPOOFED)
            HASSH:     c39f4cec145ee3d50fb590595143b9d5
            Cred:      root:root — SUCCESSFUL
            Command:   uname -o -m -n (OS + arch + hostname)
            │
            ▼  [~35 day gap between .182 session and first .227 ban]
            │
~2026-06-23 89.248.168.227: CrowdSec http:scan ban placed
T16:35 UTC  HTTP scanning campaign from NL/AS202425 detected
            [DERIVED: 164h47m19s before observation anchor 2026-06-30T13:23]
            │
            ▼  [~5 days 21 hours]
            │
~2026-06-29 89.248.168.227: CrowdSec cowrie-ssh-bruteforce ban placed
T14:16 UTC  SSH scanning campaign escalates to CrowdSec detection threshold
            [DERIVED: 23h6m14s before observation anchor 2026-06-30T13:23]
            │
            ▼  [~23 hours]
            │
2026-06-30  89.248.168.227 → Cowrie honeypot session
T13:23 UTC  Duration:  0.1 seconds (capability probe — no auth)
            Banner:    SSH-2.0-Go (honest)
            HASSH:     c39f4cec145ee3d50fb590595143b9d5
            Status:    Two active CrowdSec bans (SSH + HTTP) at session time
            ← OBSERVATION ANCHOR — all derived timestamps computed from here

Timeline interpretation. The .227 HTTP scanning campaign predates its SSH scanning campaign by approximately 5 days 21 hours. The Cowrie honeypot capture on 2026-06-30 is therefore the tail end of an SSH probe campaign that itself began within a broader multi-protocol reconnaissance operation. The .182 honeypot session (2026-05-26) precedes all .227 activity by approximately 35 days. The HASSH fingerprint is the sole direct technical bridge between the two events. Whether .182 and .227 are the same operator working from different nodes, or separate actors using the same toolkit, cannot be determined from available evidence alone.

Confidence Statements

Claim	Confidence	Basis
Both IPs run the same SSH toolkit	HIGH	Identical HASSH c39f4cec145ee3d50fb590595143b9d5; bidirectional similar_ips linkage in intel database
.182 SSH banner is spoofed	HIGH	HASSH/banner contradiction; HASSH is implementation-level and cannot be independently configured as a banner string
.227 PTR is intentional evasion, not misconfiguration	HIGH	Domain purpose-registered with evasion-mimicking name; renewed 23 days before observation; systematically deployed across 23 IPs
.227 HTTP scanning preceded SSH scanning by ~6 days	MEDIUM-HIGH	Derived from CrowdSec ban remaining-time subtraction; assumes bans placed at time of CrowdSec detection (not necessarily first activity)
HASSH c39f4cec belongs to a Go SSH implementation	MEDIUM	.227 presents SSH-2.0-Go banner with this HASSH (direct evidence); .182 presents spoofed banner with same HASSH; Go SSH fingerprint family confirmed by cross-reference with known Go HASSH patterns
A4 (Mikhail Ginkin) is the operator of .182	LOW	Single data point: FastVDS hostname encoding of billing username; may be alias, stolen identity, or resold account; no corroboration