Seven Years to a Weapon
Overview
Two IPs. One with a seven-year documented history. One with none. Both active against the honeypot within a 24-hour window, sharing identical SSH fingerprints. The older IP's history is not incidental โ it is the mechanism. Reputation systems that decay threat scores over time granted 77.246.159.182 near-zero risk classification at the moment of first attack. The dormancy was operational preparation.
77.246.159.182 โ Three Phases
Phase 1 ยท 2019โ2021 ยท Commercial Hosting
Earliest OTX record: 2019-06-20. The IP's first observable identity is a cPanel/WHM installation marker: l08a60fb.justinstalledpanel.com. This pattern โ a random hex prefix followed by .justinstalledpanel.com โ is automatically assigned by cPanel before an operator configures a proper hostname. It marks the moment of VPS provisioning on FastVDS (fvds.ru), AS29182 (JSC IOT), Russia.
Domains hosted during this phase:
| Domain | Period | Type | Notes |
|---|---|---|---|
opt-argent.ru | 2019โ2023 | Silver trading | Primary business domain |
www.opt-argent.ru | 2019โ2023 | Silver trading | WWW alias |
argent-tm.ru | 2020โ2022 | Silver trading | Secondary brand |
www.argent-tm.ru | 2020โ2022 | Silver trading | WWW alias |
ns1.opt-argent.ru | 2019 | Nameserver | Authoritative NS hosted on same IP |
l08a60fb.justinstalledpanel.com | 2019 | cPanel marker | Auto-assigned, pre-hostname configuration |
argent = silver in French and financial terminology; opt = wholesale in Russian. These were Russian silver wholesale trading businesses. Zero abuse reports during this period. No threat intelligence signals of any kind.
Phase 2 ยท 2022โ2025 ยท Dormancy
argent-tm.ru drops from passive DNS in 2022. opt-argent.ru follows in 2023. No AbuseIPDB reports until March 2026. The IP produces no threat signals for approximately three years.
Three possible explanations for the dormancy:
- VPS abandoned and reassigned to a new operator
- Hosting account sold or transferred
- Same operator retained the VPS with changed purpose (preparation)
The available evidence does not distinguish between these hypotheses. What is certain: the three-year clean gap caused time-decay reputation systems to assign near-zero threat scores. Systems like AbuseIPDB weight recent reports heavily and decay historical signals. An IP silent for 36 months arrives at the attack phase with a freshly laundered reputation.
Phase 3 ยท 2026-03 onward ยท Weaponization
| Timestamp | Event | Detail |
|---|---|---|
| 2026-03 | AbuseIPDB reports begin | Ubiquiti (ubnt) SSH bruteforce targeting |
| 2026-05-26T09:58 | Cowrie capture โ root:root | Successful login; command executed: uname -o -m -n |
| 2026-06-29 | Ipsum score = 9 | 9 distinct public blacklists |
| 2026-06-30 | AbuseIPDB 77/100 | 42 reports from 32 distinct reporters |
The captured command uname -o -m -n retrieves three fields: OS type (-o), hardware name (-m), and node hostname (-n). Minimum viable reconnaissance โ the smallest payload that returns actionable targeting information. Combined with the shared HASSH c39f4cec145ee3d50fb590595143b9d5, this is Go-toolkit infrastructure operating post-authentication.
89.248.168.227 โ Observable Window Only
No passive DNS history exists for this IP. The observable record begins when it intersected honeypot detection systems. All timestamps are reconstructed from ban durations remaining as of 2026-06-30.
Reconstructed Timeline
| Reconstructed Onset | Event | Source |
|---|---|---|
| ~2026-06-23 | HTTP scan onset | CrowdSec http:scan ban โ 164h remaining 2026-06-30 |
| ~2026-06-29 | SSH scan onset | CrowdSec cowrie-ssh-bruteforce โ 23h remaining 2026-06-30 |
| 2026-06-30T13:23 | Cowrie probe captured | Duration: 0.1s ยท No credentials submitted ยท Banner: SSH-2.0-Go |
The 2026-06-30 Cowrie capture lasted 0.1 seconds with no credential submission. This is a port availability probe โ confirming SSH is listening before the credential phase begins. The banner SSH-2.0-Go identifies the Go SSH toolkit directly, with no spoofing (unlike .182). AbuseIPDB 100/100, 2929 reports. GreyNoise classification: malicious, last seen 2026-06-30.
PTR Evasion Domain: no-reverse-dns-configured.com
Registration Timeline
| Date | Event |
|---|---|
| 2024-05-07 | Domain registered via Namecheap |
| 2026-06-18 | Domain renewed โ 12 days before first .227 alert |
| 2026-06-30 | First honeypot alert on 89.248.168.227 |
23 IPs across the 89.248.168.0/24 subnet carry this PTR record. This is not per-IP coincidence โ it is subnet-level infrastructure maintenance. The renewal 12 days before first observed attack activity is operationally significant: the operator maintained the deceptive PTR infrastructure as active preparation, not neglect.
The domain name mimics the system message a resolver produces when no PTR record exists. Security tools that check "PTR present vs. PTR absent" rather than validating PTR content are blind to this technique. The domain was registered 25+ months before the first observed attack โ placed and waiting.
Comparative Timeline
Full Historical Record โ Both IPs + PTR Domain
YEAR โ 77.246.159.182 (AS29182, RU) โ 89.248.168.227 (AS202425, NL) โ no-reverse-dns-configured.com
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2019 โ [Jun] WHM/cPanel installed โ [no history available] โ [not registered]
โ justinstalledpanel.com marker โ โ
โ opt-argent.ru silver trading begins โ โ
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2020 โ argent-tm.ru begins (silver) โ [no history available] โ [not registered]
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2021 โ justinstalledpanel marker drops โ [no history available] โ [not registered]
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2022 โ argent-tm.ru drops off โ [no history available] โ [not registered]
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2023 โ opt-argent.ru drops off โ [no history available] โ [not registered]
โ [DORMANCY BEGINS] โ โ
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2024 โ [DORMANT โ no abuse reports] โ [no history available] โ [May 07] DOMAIN REGISTERED
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2025 โ [DORMANT โ no abuse reports] โ [no history available] โ [active, no changes]
โโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
2026 โ [Mar] AbuseIPDB reports begin โ [~Jun 23] HTTP scan detected โ [Jun 18] DOMAIN RENEWED
โ ubnt SSH bruteforce โ [~Jun 29] SSH scan detected โ (12 days before alert)
โ [May 26] root:root compromise โ [Jun 30 13:23] Cowrie probe โ
โ uname -o -m -n โ 0.1s, no creds, Go banner โ
โ [Jun 29] Ipsum score = 9 โ [Jun 30] AbuseIPDB 100/100 โ
โ [Jun 30] AbuseIPDB 77/100 โ HASSH: c39f4cec... โ
โ HASSH: c39f4cec... โ โKey Findings
- HIGH โ 77.246.159.182 operated legitimate silver trading infrastructure from 2019โ2023, producing a clean reputation record spanning four years.
- HIGH โ A 36-month dormancy (2023โ2026) caused time-decay reputation systems to assign near-zero threat score at the moment of first attack in March 2026. The clean record was not historical coincidence โ it was operational value.
- HIGH โ HASSH c39f4cec145ee3d50fb590595143b9d5 is shared across both IPs, identifying a common Go SSH toolkit not present in any public HASSH database.
- HIGH โ no-reverse-dns-configured.com was registered 25 months before first observed attack activity. Renewed 12 days before first alert. Active maintenance, not neglect.
- MEDIUM โ The three-phase lifecycle of .182 (legitimate โ dormant โ weaponized) is consistent with deliberate reputation laundering. The precise transition mechanism โ reassignment, account sale, or operator retention โ cannot be determined from available evidence.