TI-2026-062D — The Map: What the Proxy Recruiters Add Up To

Classification: MEDIUM–HIGH · Forensic threat intelligence · Synthesis · Published 2026-07-07 · Series: The Proxy Recruiters

Three parts into this series, the pieces are on the table: a DNS-canary toolkit (062A), a three-method census of 50,348 forward probes (062B), and a residential exit-node cluster (062C). This closing part does not add a new actor. It draws the map — how the methods, the operators, and the two market layers fit together — and, more importantly, it sets that map against what the wider shuffle-on corpus already knows. The 062 series' contribution is not the discovery that proxy verification happens; a dozen prior dossiers established that. It is the taxonomy of how it happens, and the demonstration that one honeypot renders the whole economy legible from supply to distribution.

1. What This Series Established

The through-line is the finding of 062B: the forward destination is the signature. A DNS resolver, a big website, or an IP-echo service — the choice tells you the toolkit and the market in a single field, before any payload is read.

2. The Two-Axis Map

Everything in the series sits on two axes: who runs it (datacenter vs residential) and how it validates (DNS / HTTP / mirror).

The datacenter operators sit in the top row: they own address space, so they never ask "what IP am I?" — they ask "does my catalogued proxy still relay?" (DNS or HTTP). The residential cluster sits alone in the bottom-right: it does not own its address, so its only question is "what exit IP do I present?" (the mirror). The empty cells are not gaps in the data; they are structural — a residential line has no catalogue to validate, and a datacenter has no exit-IP mystery to resolve.

3. Where This Fits in the Corpus

This is the part the interconnected data makes possible. The 062 series did not discover the proxy-verification market — it inherited a well-documented one and added the missing method layer. The corpus already holds:

• TI-2026-021M "The Phantom Pipes" — "proxy verification is a market function, not a side effect," and the first identification of the AsyncSSH/ip-who.com residential pattern.
• TI-2026-038A "The Proxy Verifier" — Private Layer's proxy verification as an industrial operation (86,239 events, keepalive + monthly bulk sweeps).
• TI-2026-038B "The Permanent Residents" — the Yahoo-vs-Yandex market split (Western vs CIS).
• TI-2026-039C "The Proxy Economy" — the same Viettel AS7552 / AsyncSSH fda360b1 / ip-who.com residential pattern, framed as legal-and-criminal shared infrastructure.
• TI-2026-024D "The w1n Network", TI-2026-001, TI-2026-007, TI-2026-019I — w1n and Private Layer as bulletproof operators, the underground pricing, the multi-pronged methodology.

Read against that, the 062 series' place is precise: prior work answered who verifies proxies and that it is an industry; 062 answers how — the destination-keyed method taxonomy that lets any forward event be classified by market from a single log field. That is the value of a knowledge base that connects: a new investigation does not restate the market, it slots a new layer onto it.

4. The Same Economy, a Different Sensor

The honeypot watches SSH. But open-proxy recruitment is protocol-agnostic, and the web sensor sees its HTTP face. In the web_threats corpus, the clearest example is 91.103.251.94 (AS201884, ISP SUPPORT LLC, Armenia): 2,084 hits using the HTTP CONNECT method, classified proxy_abuse, and — notably — not present in the honeypot at all. Where the SSH recruiters ask our server to open a direct-tcpip channel, this actor asks it to open a CONNECT tunnel: the identical request ("relay my traffic onward") expressed in the other protocol's grammar.

The lesson is not that these are the same operator — they are not linked. It is that the behaviour is one behaviour, observable wherever a relay might exist. A honeypot that logs SSH direct-tcpip and a web proxy that logs HTTP CONNECT are two windows onto the same economy: someone testing whether your machine will carry traffic it should not.

5. Alternative Interpretation

Steelman: "A synthesis is where analysts over-reach. Co-occurrence on one honeypot is not a network. Drawing a two-axis 'market map' from four unrelated operators plus a residential cluster plus one Armenian web IP risks manufacturing structure that isn't there — the map is a narrative imposed on noise."

Why the map holds:

• It claims structure, not conspiracy. The map explicitly does not assert shared operators (062A–C each say so). It asserts a shared market structure — supply, distribution, validation methods — which is a claim about an industry, not a cabal.
• The structure is corroborated by independent investigations. The market reading is not this series' invention: 021M, 038A, and 039C reached it separately, from different actors and data. When multiple independent analyses converge on "proxy verification is an industry with residential supply and bulletproof distribution," the convergence is the evidence. The 062 series adds the method axis; it does not carry the market claim alone.
• The empty cells predict correctly. A fabricated map would fill every cell. This one is empty exactly where the economics say it must be (residential lines don't run catalogues; datacenters don't wonder about their exit IP) — a sign the axes are real, not decorative.

What is not claimed: that the Armenian CONNECT abuser, the Viettel residential cluster, and the bulletproof validators are operationally connected. They are instances of a common behaviour on a common market, seen from a common sensor — not nodes of one network.

Confidence: MEDIUM–HIGH — HIGH that the two-axis map faithfully organises the series' facts and the corpus' prior findings; MEDIUM that the cross-protocol (SSH↔HTTP) and cross-layer (seller↔worker) framing reflects one integrated economy rather than parallel independent ones.

6. Defense — The Consolidated Picture

Everything in this series collapses to a small, durable control set:

• One server control ends all of it. AllowTcpForwarding no (plus PermitTunnel no, GatewayPorts no) defeats every SSH method — DNS-canary, provider-fetch, and mirror alike — at the channel-open step. For the HTTP face, disable proxy/CONNECT handling on any server not meant to be a forward proxy. Neither the toolkit nor the destination matters once forwarding is off.
• Detection is one field per protocol. SSH: log the direct-tcpip destination — 1.1.1.1:53 / big-provider :80 / ip-who.com classifies the recruiter by market with no payload inspection. HTTP: the CONNECT verb to an external host on a non-proxy service is proxy_abuse by definition.
• Invert your trust in reputation for the residential layer. The exit-node cluster scores ~0 on AbuseIPDB because it is residential and rotating (062C). Weight the HASSH-cluster and forward-destination over per-IP reputation; a clean score on a residential ASN forwarding to ip-who.com is the signal, not the all-clear.
• Kill the credentials. Every actor in the series depends on admin/admin or vendor-default logins (062A, 062C). On real hosts and especially embedded devices, non-default credentials remove the entire foothold before forwarding is ever attempted.

7. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence