TI-2026-062C — The Residential Layer: Viettel Lines That Ask "What Do I Look Like?"

Classification: MEDIUM · Forensic threat intelligence · Honeypot-derived · Published 2026-07-07 · Series: The Proxy Recruiters

The bulletproof operators in this series (062A, 062B) run from datacenters — leased prefixes, shell companies, abuse-proof ASNs. This part is about the other end of the same industry: the exit nodes themselves. A cluster of 151 source IPs, almost all of them Vietnamese Viettel home-broadband lines, connects to the honeypot with one uncommon toolkit and, when it gets a shell-forwarding channel, asks a single question no datacenter validator asks: what IP do I look like from the outside? These are not the sellers of proxy inventory. They are — or are recruiting — the inventory: real consumer connections whose value is precisely that they are not a datacenter.

1. The Cluster

One SSH client fingerprint isolates the cluster cleanly:

AsyncSSH is a Python asyncio SSH library; version 2.1.0 produces this specific HASSH. It is not a common attacker banner — 151 IPs sharing it, nearly all from one country, is a coordination signal in itself.

2. Residential, Not Hosted

This is the fact that separates the cluster from every other actor in the series. A representative node, 27.79.44.126:

Viettel is Vietnam's largest telecom, military-owned. 27.79.x, 116.99.x, 116.110.x, 171.231.x, 171.243.x — the ranges the cluster occupies — are dynamic consumer-broadband pools, not hosting. The individual IPs carry near-zero abuse reputation (many at threat score 0) precisely because they are ordinary home connections that rotate. That low reputation is not innocence; it is the product. A residential proxy's entire commercial value is that it looks like a real person's home connection, because it is one.

The behavioural profile matches: each IP appears for a single short burst — 27.79.44.126 ran all 12 of its sessions inside a seven-minute window (23:14→23:21 on 2026-03-25) and never returned. That is the signature of a dynamic IP cycling through a botnet's worker rotation, not a persistent server.

3. The Credential Dictionary — Routers and IoT

Unlike the admin/admin-only monoculture of the datacenter validators, this cluster carries a broad, purpose-built credential list aimed squarely at embedded devices:

Two of these (system:OkwKcECs8qJP2Z, admin:0l0ctyQh243O63uD) are non-guessable hardcoded firmware defaults — their presence means the operator has a curated device-credential database, not a generic password list. This is a botnet hunting for more routers and IoT devices to enrol: the worker layer expanding itself.

4. What It Asks For

When a session in this cluster opens a direct-tcpip forward, the destination is — in 629 of 629 cases across the whole honeypot — ip-who.com:80, an IP-echo service that answers only one thing: what source address did you arrive from? (062B establishes this 1:1 binding between the AsyncSSH toolkit and the mirror method.)

For a datacenter validator, exit IP is a given — it owns its address space. For a residential proxy, exit IP is the whole question. A compromised home router is only saleable inventory if the operator can confirm that traffic exiting through it presents as the consumer's real, geolocated, residential IP — not as a flagged datacenter or a CGNAT address that collapses many users into one. ip-who.com answers exactly that. The concept was first surfaced in TI-2026-021M "The Phantom Pipes"; what this dossier adds is the identity of the cluster performing it: a Vietnamese residential Viettel fleet, not a hosting provider.

5. The Two Layers of One Industry

Reading 062A–062C together, the honeypot has captured both ends of the residential-proxy supply chain:

The datacenter operators maintain and re-sell a catalogue; the residential cluster is the catalogue's stock and simultaneously recruits more of it. Neither could function without the other. That the same honeypot sees both — the wholesaler pinging its inventory and the inventory checking its own reflection — is what makes the proxy economy legible from a single sensor.

6. Alternative Interpretation

Steelman: "Residential IPs with near-zero abuse scores running a Python SSH library are more likely compromised bystanders or a researcher's scanner than a coordinated proxy botnet. Attributing a market role to a home broadband line over-reads a low-signal cluster." And unlike the datacenter actors, no single Viettel IP shows persistence — each appears once.

Why the residential-worker reading holds — at MEDIUM confidence:

• The credential database gives away intent. Bystander malware and academic scanners do not carry hardcoded firmware defaults like system:OkwKcECs8qJP2Z. A curated router/IoT credential set is the tooling of a botnet that enrols embedded devices — the exact mechanism by which residential proxy pools are built.
• The single-burst-per-IP pattern is the point, not a weakness. Persistence is a datacenter property. A residential proxy botnet's workers are expected to be ephemeral — dynamic IPs cycling — so "each IP appears once, briefly" is consistent with rotation, not against coordination. The coordination lives in the shared HASSH across 151 IPs, not in any single IP's longevity.
• The forward destination is unambiguous. ip-who.com has one function. A host that tunnels to an exit-IP oracle is asking about its own external appearance; on a residential line, that question only has commercial meaning in a proxy context.

What is not claimed: that these Viettel lines are knowingly operated by their owners (they are almost certainly compromised), or that this cluster is affiliated with the datacenter operators in 062A/062B (no shared infrastructure links them — they are the opposite end of the market, not the same hand). The honesty here is that a residential cluster is inherently lower-signal than a datacenter actor; hence MEDIUM, not higher.

Confidence: MEDIUM — the toolkit isolation, residential origin, IoT credential set, and ip-who.com binding are all HIGH-confidence facts; the interpretation of the cluster as a residential-proxy worker/recruitment layer is well-supported but inferential.

7. Defense Response

• Same one-line control. AllowTcpForwarding no defeats the exit-IP mirror check exactly as it defeats the datacenter methods. On embedded devices — the cluster's real targets — change vendor-default credentials and disable SSH/remote admin from the WAN; the ubnt/ubnt, installer/installer and hardcoded-firmware logins are the entire attack surface.
• Detection: SSH-2.0-AsyncSSH_2.1.0 (HASSH fda360b1) + a forward to ip-who.com is a high-precision indicator of residential-proxy mirror activity. From a residential ASN, that combination is essentially never legitimate.
• Reputation is inverted here. These IPs score ~0 on AbuseIPDB because they are residential and rotating — the low score is the tell, not the all-clear. Don't allowlist a source just because its individual reputation is clean; weight the HASSH-cluster and forward-destination signals over per-IP reputation.

8. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence