Who Provides the Roads

Infrastructure networks enabling the dual-node threat — AS202425 and AS29182 profiled, actor cards documented

TI-2026-057E Page 331 2026-06-30 Infrastructure Analysis 4 Actor Cards

Overview

Two attack nodes. Two autonomous systems. One in the Netherlands under a Seychelles-registered bulletproof host — flagged by Spamhaus at the ASN level, the harshest classification available. The other in Moscow at the Skolkovo Innovation Center — clean public reputation, 23-year RIPE history, 9 IXPs across Europe and Russia. Both host infrastructure for the same private Go-based SSH toolkit.

This article profiles the two networks that provide the roads this threat actor travels: AS202425 (IP Volume inc) and AS29182 (JSC IOT). It then documents four actor cards — two organizational infrastructure providers, one unknown individual operator, and one LOW-confidence possible billing identity — and maps the infrastructure relationships from ASN to attack node.

AS202425 — IP Volume inc

Network Profile

Field	Value
ASN	AS202425
Name	IP Volume inc
Registered country	SC (Seychelles)
Operational country	Netherlands
Allocation date	2018-05-17
IPv4 prefixes	600
IPv6 prefixes	20
Spamhaus listing	ASN-DROP (active)
PeeringDB traffic type	Heavy Outbound
PeeringDB peering policy	Open
Internal risk score	31.8
Attack node hosted	89.248.168.227

Spamhaus ASN-DROP: What It Actually Means

Spamhaus ASN-DROP (Don't Route Or Peer) is not a standard per-IP blocklist entry. It is a list of ASNs that Spamhaus has determined to be so thoroughly controlled by or dedicated to criminal or abusive infrastructure that network operators are advised to drop all traffic from the entire ASN at the routing level — not per-IP, not per-subnet, but the entire autonomous system.

This is the most severe network-level classification Spamhaus publishes. Any carrier or enterprise importing ASN-DROP into their routing policy will null-route all traffic from AS202425 prefixes. The listing does not mean every IP in the ASN is actively malicious — it means the abuse response from the operator has been assessed as so inadequate, or the operator so complicit, that block-everything is treated as the correct default. Attack node 89.248.168.227 is hosted in an ASN that the security community consensus says should not be routed at all.

Offshore Corporate Structure

IP Volume inc is incorporated in the Seychelles — a common offshore jurisdiction for hosting companies seeking insulation from the legal frameworks of countries where their infrastructure physically operates. Physical operations are in the Netherlands, placing servers under Dutch law while the corporate entity remains in a jurisdiction with limited regulatory exposure. The ASN was allocated in May 2018: recent enough to have been purpose-built for the current business model, yet old enough that BGP peers do not treat it as suspicious on age alone. At 600 IPv4 prefixes, this is not a small VPS reseller — it represents a significant IP address inventory supporting high-volume abuse operations: rotating attack source IPs, allocating clean-looking ranges to legitimate-seeming tenants as cover, and maintaining enough address space that individual /24 blocks being blocklisted does not materially affect operations.

Heavy Outbound: What the Traffic Pattern Signals

PeeringDB's "Heavy Outbound" designation means the ASN pushes significantly more traffic out than it receives. For a hosting provider in the context of an ASN-DROP listed network, this aligns with customers who are primarily generating traffic — scanning, probing, spraying credentials, running attack toolkits — rather than hosting web applications serving legitimate users. Combined with an Open peering policy, the profile is consistent with a network whose primary commercial model involves selling outbound connectivity to customers generating high volumes of unsolicited traffic.

Mixed-Use Architecture: The Legitimacy Shield

The RDAP record for AS202425 reveals two distinct contact registrations within the same address space. The specific co-mingling in the /24 containing 89.248.168.227 is architecturally significant:

Co-mingling in 89.248.168.0/24

Entity	Contact	Node Count	Type
AI Spera (CriminalIP)	request@aispera.com	132	Legitimate security research scanner
openportstats.com	—	10	Port scanning research
no-reverse-dns-configured.com PTR	—	23+	Adversary-controlled, obfuscated

Attack node 89.248.168.227 belongs to the no-reverse-dns-configured.com PTR cluster.

This co-mingling is operationally deliberate. When a defender queries the /24 block, they encounter a mix of well-known, explicitly labeled security research IPs — CriminalIP is a legitimate service with documentation and opt-out mechanisms. The presence of 132 CriminalIP nodes creates noise in automated classification: a simple "is this a scanner network?" check returns TRUE, and some defenders apply scanner-network handling (rate-limiting, no blocking) rather than attacker-network handling (full block) to the entire prefix. The attacker nodes behind no-reverse-dns-configured.com PTRs hide inside this apparent scanner cluster. This is not incidental proximity — it is infrastructure partitioning that exploits the heuristic that "scanner IPs are usually not attacking me."

AS29182 — JSC IOT

Network Profile

Field	Value
ASN	AS29182
Name	JSC IOT (Joint Stock Company IOT)
Address	Skolkovo Innovation Center, Bolshoy Blvd 42, Moscow 121205
Admin contact	IOT Network Operations / Pinigin Sergey
Admin phone	+7 495 133-04-86
RIPE allocation date	2003-06-23 (23 years)
Spamhaus listing	None
IPv4 prefixes (PeeringDB)	200
Capacity	100–200 Gbps
PeeringDB traffic type	Content / Mostly Outbound
IXPs	9 (MSK-IX, GlobalNet, DataIX, PITER-IX + SPB/MSK/TLL/RIX/HEL/AU/FRA)
Internal risk score	65.3
Attack node prefix	77.246.158.0/23
Attack node hosted	77.246.159.182

The Skolkovo Context

JSC IOT is not registered at a generic Russian datacenter address. Skolkovo Innovation Center is a state-sponsored technology development zone established in 2010, modeled after Silicon Valley, intended to house high-technology companies under favorable regulatory and tax frameworks. It is closely associated with Russian government strategic technology investment programs.

This is not a claim of government affiliation for JSC IOT specifically — the Skolkovo ecosystem includes hundreds of companies, not all with state operational ties. However, the registered address matters for context: this is not a fly-by-night registrant. JSC IOT has been RIPE-registered since 2003 (more than two decades), has named administrative contacts with Moscow phone numbers, and operates with significant infrastructure (200+ prefixes, 100–200 Gbps capacity). It is an established Russian network operator with a premium address. The geopolitical context is noted without assumption about operational ties.

Sub-Tenant Architecture: Three Layers to the Attack Node

Attack node 77.246.159.182 does not sit directly under JSC IOT's administrative control. The routing path is layered:

Infrastructure Chain: IOT → Datacenter → VPS → Attack Node

AS29182 — JSC IOT (backbone provider)
    └── JSC Datacenter (webdc.ru / WEBDC-MNT)
            └── FastVDS (VPS hosting service)
                    └── 77.246.159.182 (attack node)
                        PTR: mihaiilginkin1.fvds.ru

This layering means direct attribution of attacks to JSC IOT would be technically incorrect. JSC IOT is the backbone provider. JSC Datacenter is the sub-tenant operating datacenter infrastructure within the AS under the webdc.ru identity and WEBDC-MNT RIPE handle. FastVDS is the immediate hosting layer. The attack operator rented a VPS from FastVDS, which allocates addresses from JSC Datacenter's block, which routes through JSC IOT. Each layer provides plausible deniability for the levels above it.

IXP Geographic Footprint

JSC IOT peers at 9 IXPs across multiple cities and countries. For a "Content + Mostly Outbound" operator, this geographic reach means traffic originating within AS29182 can exit via Frankfurt, Helsinki, or Tallinn — potentially appearing to downstream observers as west-European or Baltic-proximate traffic rather than Russian-origin traffic.

IXP Presence — 9 Exchange Points

Exchange	Location	Region
MSK-IX	Moscow	Russia
GlobalNet	Moscow	Russia
DataIX	Moscow	Russia
PITER-IX SPB	St. Petersburg	Russia
PITER-IX MSK	Moscow	Russia
PITER-IX TLL	Tallinn	Baltic
PITER-IX RIX	Riga	Baltic
PITER-IX HEL	Helsinki	Nordic
PITER-IX FRA	Frankfurt	Western Europe

The Risk Score Inversion

Counterintuitive Finding: Higher Reputation, Higher Risk Score

ASN	Public Reputation	Spamhaus	RIPE Age	Internal Risk Score
AS202425 (IP Volume inc)	SEVERE — ASN-DROP	ASN-DROP (active)	7 years	31.8
AS29182 (JSC IOT)	CLEAN — No listings	Not listed	23 years	65.3

This inversion is counterintuitive but explainable. The internal risk score is based on observed behavior in honeypot telemetry — specifically, the frequency, severity, and nature of attacks originating from each network's address space as seen by the sensor network. Spamhaus ASN-DROP is primarily calibrated to abuse reports (spam, phishing, botnet hosting), not to targeted SSH scanning campaigns. An ASN with thousands of spam nodes scores high on Spamhaus metrics; an ASN hosting a smaller number of purpose-built attack tools targeting specific protocols may generate fewer abuse complaints while producing significantly more relevant honeypot hits.

The operational interpretation: from the perspective of this honeypot — which monitors SSH and credential-theft activity — the Russian node at 77.246.159.182 is operating in a context that is more dangerous to the monitored infrastructure than the Dutch node at 89.248.168.227. The NL node has the worse public reputation; the RU node is more precisely targeted at the observed attack surface. Surface reputation is the cover story. Observed behavior is the ground truth.

Actor Cards

A1 — IP Volume inc · Organization · HIGH Confidence

Role: Infrastructure provider for attack node I1 (89.248.168.227)

IP Volume inc is the operating entity of AS202425. Its role is that of infrastructure provider — the network whose address space includes the attack node. There is no evidence that IP Volume inc directly operates the SSH scanning toolkit or directs attacks. The known pattern: its commercial model appears to involve accepting tenants regardless of use case, including abuse-generating operations, while maintaining ASN routing connectivity. The presence of legitimate scanner tenants (CriminalIP, openportstats.com) alongside attack nodes suggests either a deliberate "mixed-use" hosting model or severely insufficient tenant vetting. The Spamhaus ASN-DROP listing indicates the security community has concluded that abuse reports to IP Volume inc do not result in remediation.

Relationship to A3: Provider. IP Volume inc sells network services; A3 (the toolkit operator) uses those services. The relationship is commercial, not operational.

Accountability posture: The Spamhaus ASN-DROP listing represents industry consensus that network operators should not route traffic from this ASN. This is the maximum available response short of law enforcement action. The abuse contact abuse@ipvolume.net exists on RDAP record. Whether it processes reports in good faith is not addressable from this evidence set.

A2 — JSC IOT · Organization · HIGH Confidence

Role: Infrastructure provider (via sub-organization JSC Datacenter / webdc.ru) for attack node I2 (77.246.159.182)

JSC IOT is the backbone ASN. The attack node sits under JSC Datacenter, a sub-organization of JSC IOT. The routing relationship is established; the administrative responsibility relationship is less clear. JSC Datacenter (webdc.ru) directly manages the 77.246.158.0/23 prefix, and FastVDS is the apparent immediate tenant-facing hosting service. JSC IOT's knowledge of or involvement in the specific attack activity is not established by available evidence.

The Skolkovo Innovation Center address establishes JSC IOT as an established, named Moscow-registered organization with verifiable administrative contacts. This is not an anonymous or offshore entity — it is potentially accountable through Russian legal mechanisms, which is noted without assumption about how effective that accountability would be in practice. The absence of a Spamhaus listing means ISPs and enterprises have no public-list reason to block AS29182 traffic. The attack node at 77.246.159.182 benefits from transiting a network with clean public reputation.

The disconnect: The clean RIPE history and no-blocklist status describe how AS29182 appears to the outside. The internal risk score of 65.3 describes what the honeypot telemetry has observed from that network. The honeypot is the ground truth for this investigation; the public reputation is the cover story.

A3 — Unknown Go-SSH Toolkit Operator · Individual · MEDIUM Confidence

Role: The actual attack operator — the entity that deployed, configured, and ran the SSH credential-scanning toolkit observed in this investigation.

What the evidence establishes:

The toolkit is implemented in Go. It presents a custom SSH client string (HASSH c39f4cec145ee3d50fb590595143b9d5) that does not match any publicly known tool — Metasploit, Hydra, Medusa, Ncrack, go-sshscan, or any of the 68 classified signatures in the fingerprint database.
The operator maintains infrastructure across two different ASNs in two countries: AS202425 (Netherlands) and AS29182 (Russia). This dual-ASN presence requires separate VPS accounts at different providers or access to infrastructure in both networks. This is not a single-machine operation.
Opsec awareness across both nodes: use of a custom non-attributable SSH client string; selection of hosting providers with permissive or weak abuse response; use of no-reverse-dns-configured.com PTR obfuscation on the NL node; banner spoofing to SSH-2.0-OpenSSH_7.4 on the RU node.

What the evidence does not establish: Identity, nationality, or language. APT affiliation or state sponsorship. Target scope beyond what was observed on this sensor. Whether the tool was self-developed, privately purchased, or a modified fork of a private codebase. The number of additional nodes not captured by this sensor.

Toolkit assessment: A Go-based custom SSH client not matching any public tool implies one of two things: (1) the operator wrote it themselves, requiring at minimum intermediate Go development skill; or (2) the operator acquired it through private channels (criminal forum sale, private tool sharing, or commission). Either interpretation implies a threat actor with access to more technical resources than a commodity attacker running off-the-shelf tools.

Confidence rationale: MEDIUM reflects strong behavioral evidence of toolkit and infrastructure choices, but zero direct evidence connecting any identity to those operational elements.

A4 — Mikhail Ginkin · Individual · LOW Confidence

Role: Possible billing identity associated with attack node I2 (77.246.159.182)

Evidence basis: Sole evidence is the PTR record mihaiilginkin1.fvds.ru, which follows FastVDS hostname conventions incorporating customer-provided naming at account creation.

Why this is LOW confidence:

PTR records are set by the hosting provider based on account data. Account data can be false. A threat actor with operational security awareness routinely provides fictitious registration details when acquiring VPS infrastructure.
No independent corroboration exists in the available evidence. There is no second data point — no domain registration, no WHOIS record, no forum account, no payment trace — connecting "Mikhail Ginkin" to this infrastructure.
The account associated with this name may have been sold, compromised, or abandoned. The account holder at time of registration may not be the current operator.
Even if the name is real and corresponds to a real person, that person may be a victim of identity reuse — their account credentials acquired and used by a third party.

What would raise confidence: Additional infrastructure registered under the same name at different providers; WHOIS records for campaign-associated domains showing the same name; FastVDS nodes with similar PTR conventions appearing in related campaigns; social or professional profile correlation to this IP's activity timeline. Until at least one of these corroborating data points exists, A4 remains a name on a PTR record — potentially significant, potentially noise.

Infrastructure Relationship Map

Full Infrastructure Chain — Both Attack Nodes

ATTACK NODE I1                          ATTACK NODE I2
89.248.168.227                          77.246.159.182
NL | threat_score: 42.0                 RU | threat_score: 11.0
        |                                       |
        |  /24: 89.248.168.0/24                 |  /23: 77.246.158.0/23
        |  [mixed: CriminalIP x132,             |  [FastVDS customer VPS]
        |   openportstats x10,                  |
        |   attacker nodes x23+]                |
        |                                       |
        v                                       v
  no-reverse-dns PTR obfuscation          FastVDS (VPS hosting svc)
  [evasion: hides in scanner cluster]     [immediate tenant layer]
        |                                       |
        v                                       v
  AS202425 — IP Volume inc            AS29182 — JSC IOT
  Seychelles-reg / NL-operated        Skolkovo, Moscow 121205
  Spamhaus: ASN-DROP [MAX SEVERITY]   Spamhaus: NOT LISTED [CLEAN]
  Risk score: 31.8                    Risk score: 65.3
  600 IPv4 prefixes                   200 IPv4 prefixes
  Alloc: 2018-05-17                   RIPE alloc: 2003-06-23
  Peering: Open                       IXPs: 9 (MSK/SPB/TLL/RIX/HEL/FRA/AU)
        |                                       |
        |  RDAP contacts:                       |  Admin: Pinigin Sergey
        |  AI Spera / request@aispera.com       |  +7 495 133-04-86
        |  IP Volume / abuse@ipvolume.net        |  Sub-org: webdc.ru (WEBDC-MNT)
        |                                       |
        v                                       v
  A1: IP Volume inc [org, HIGH]          A2: JSC IOT [org, HIGH]
  [infrastructure provider]             [infrastructure provider]
        \                                       /
         \                                     /
          \_______ DUAL-ASN OPERATION _________/
                           |
                           v
            A3: Unknown Go-SSH Toolkit Operator
                  [individual, MEDIUM confidence]
            dual-ASN presence | custom Go SSH client
            opsec: PTR obfuscation + banner spoofing
                           |
                           | PTR record only — no corroboration
                           v
             A4: Mikhail Ginkin [individual, LOW]
          possible FastVDS billing identity for I2
              treat as noise until corroborated

Actor Confidence Summary

Actor	Type	Confidence	Basis
A1 — IP Volume inc	Organization	HIGH	RDAP, RIPE, PeeringDB, Spamhaus records — unambiguous
A2 — JSC IOT	Organization	HIGH	RDAP, RIPE registration, PeeringDB — unambiguous
A3 — Toolkit operator	Individual	MEDIUM	Behavioral evidence (toolkit, dual ASN) — identity unknown
A4 — Mikhail Ginkin	Individual	LOW	PTR record only — no corroboration

Analytical Notes

The juxtaposition of these two networks illustrates a recurring pattern in threat infrastructure: actors who operate from multiple network environments with complementary risk profiles. AS202425 offers high anonymity through bulletproof-tolerant hosting but carries severe public reputation damage. AS29182 offers clean public reputation and legitimate organizational cover but routes to an attack node that scores higher on behavioral threat metrics.

The infrastructure choice is not incidental. An operator selecting both these networks demonstrates awareness of both dimensions: the value of bulletproof hosting for one node, and the value of clean-reputation hosting for another — possibly for different operational phases or target populations that have different blocklist coverage. The roads are chosen to complement each other.