TI-2026-065B — Two Doors, One Landlord

Series: The Return · Part B · Classification: HIGH · Confidence: HIGH (for the disjointness); MEDIUM (for intent)

This part was commissioned to prove a single thing: that the SSH botnet and the web cohort on Tencent/Aceville's AS132203 (Part A, The Second Front) are one operator working two doors. We built the query to confirm it. The evidence refused. What follows is not the dossier we planned — it is the one the data allowed. The correction is the point: a forensic method that cannot return a "no" is not a method.

Executive Summary

We asked: is the same hand behind both doors of AS132203? The honest answer, tested at five independent forensic layers, is no — or at least, nothing links them but the landlord.

• IP address: the SSH botnet (50 IPs) and the web cohort (203 IPs) share zero IPs.
• Operator DNA: the SSH side carries 237 shared_authorized_key / same_operator edges — the mdrfckr backdoor — and its fleet spans ~13 ASNs. None of that DNA touches the web cohort.
• Tooling: SSH runs libssh; the web cohort runs one forged iPhone user-agent. Different toolchains.
• Clock: SSH is a nocturnal cron burst; the web cohort is a flat 24/7 carpet. Different schedulers.
• Reach: the SSH botnet is globally dispersed (AS132203 is 1 of ~13 rented substrates); the web cohort is 97% Tencent-hosted. Opposite topologies.

The only thing both doors share is the building they are in — AS132203 and its Aceville abuse-desk front. That is a more damning finding than a single operator, because it is not a bad tenant. It is a bad landlord: one abuse-tolerant substrate renting the same recycled address pools to independent criminal operations at once. And one of those operations, we found, is reading these very dossiers.

I. The Five Layers of Disjointness

We treated "one operator" as a hypothesis and tried to break it at every layer where a shared hand would leave a mark.

Layer 1 — Addresses: zero overlap

Intersecting the honeypot's AS132203 attackers with the web platform's AS132203 clients returns the empty set. Not a small number. Zero. Whatever runs the two doors, it does not reuse a single instance between them.

Layer 2 — Operator DNA: the mdrfckr key, and where it does not go

The SSH side is not anonymous. Its 50 IPs carry 237 shared_authorized_key edges and 237 same_operator edges in the curated entity graph — the strongest attribution class we keep, because a shared_authorized_key is a deployed artifact: a backdoor public key the attacker physically wrote into ~/.ssh/authorized_keys during the intrusion. The command tape is textbook mdrfckr:

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4…" > .ssh/authorized_keys
chattr -ia .ssh; lockr -ia .ssh
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh

Install a persistence key, lock it against removal, then evict rival botnets. This is a coherent operator — and we can follow it. Its same_operator fleet reaches DigitalOcean, Microsoft, SK Broadband, UCloud, Oracle, Korea Telecom, Vietnam, Nigeria, the Dominican Republic. AS132203 holds only 2 of those fleet IPs. And critically: none of the fleet is in the web cohort. The operator we can name does not own the second door.

Layer 3 — Tooling: a borrowed key vs a forged face

The SSH HASSH f555226df1963d1d3c09daf865abdc9a (libssh_0.9.6) sits on 39 of the 50 IPs — but on 1,312 IPs globally. It is the shared libssh-swarm tool documented back in TI-2026-012 and TI-2026-026M, not a signature unique to this actor. The web cohort, by contrast, presents a single identical forged iPhone-13.2.3 Safari user-agent across 187 IPs / 814 requests. Real iPhones show version diversity; 187 machines frozen on one point release is a botnet stamp. Two internally-coherent tools — and they are not the same tool.

Layer 4 — The clock: two different machines

Converted to China Standard Time, the two doors keep different hours:

• SSH: 157 of 353 sessions (44%) fire in the 03:00–04:00 predawn window; business hours (09–18) hold just 12.2%. A cron job in the dark.
• Web: near-uniform across all 24 hours; business hours hold 39.7%, almost exactly the 41.7% a pure round-the-clock scanner would produce. A carpet, not a burst.

Had one scheduler driven both, the clocks would rhyme. They do not. (Note: this also kills the tempting "Chinese state employee on a 9-to-5" story — neither door is a human at a keyboard. Both are automation. We say so plainly.)

Layer 5 — Reach: passing through vs living there

The most elegant tell is topological. The SSH botnet is a tourist: globally spread, AS132203 is one of ~13 clouds it rents. The web cohort is a resident: of the 220 IPs worldwide flying that forged iPhone UA, 214 (97%) sit on Tencent's own two ASNs (AS132203 + AS45090). One operation treats Tencent as incidental transit; the other treats it as home. Opposite relationships to the same landlord cannot be one operator.

II. The Landlord Is the Only Common Factor

Strip away IP, key, tool, clock and topology and what remains binding the two doors is exactly one thing: the building. Same ASN (132203), same Aceville RDAP abuse handle, same address pools. And even the address overlap is weaker than it first looks. The two populations share 19 of 24 /16 ranges and 6 /24s — but co-tenancy is sequential, not simultaneous:

The SSH box and the web box in a given /24 rarely breathe at the same time. These are high-churn address pools recycled across different tenants over weeks — the signature of a rental commons, not a coordinated deployment. The landlord hands the same keys to whoever pays next.

III. The Seven Questions

Who is this? Two distinct threat clusters: a global mdrfckr libssh SSH botnet, and a Tencent-concentrated forged-iPhone web crawler/harvester. Plus the landlord: AS132203 / Aceville Pte Ltd.

Why did they attack? Both pursue access — SSH by credential brute-force + backdoor key, web by .env/login probing — but they pursue it separately.

Who do they claim to be? The SSH botnet claims nothing (libssh, no UA). The web cohort claims to be an iPhone. The landlord claims, in PeeringDB, to be a Content network.

Who are they really? Two unrelated automated criminal operations sharing a rental substrate — and a landlord whose only documented function in the record (an IRT handle) is to answer for the abuse it keeps hosting.

Whom are they related to? The SSH botnet relates to a 13-ASN fleet (its real family). The web cohort relates to Tencent's own address space (97%). To each other: nothing but the postcode.

Where is the money? In the rent, twice over. Tencent bills the SSH tourist by the instance-hour and the web resident by the month. Abuse is revenue on both meters.

What is the official anchor? APNIC allocation, PeeringDB self-classification, Aceville's Singapore RDAP registration. All legitimate. All quietly load-bearing.

IV. Steelman — "It really is one operator, you just can't see the seam"

The strongest case against our finding: the web door leaves no SSH key by design; absence of a shared key is not proof of a different hand. A sophisticated actor would compartmentalize exactly like this — disjoint IPs, separate tooling, staggered subnets — precisely to defeat correlation. You have proven good tradecraft, not two operators.

This is fair, and we concede its core: we cannot prove the two are different people. Absence of a link is not a link to absence. But the steelman has to explain the one thing compartmentalization does not predict — the reach asymmetry. A single operator hiding behind two doors would place both on similar substrate. Instead one door is 1/13th on Tencent and the other is 97% on Tencent. Deliberate compartmentalization makes the doors look unrelated; it does not make one of them structurally live on Tencent while the other merely visits. The honest verdict is therefore narrow and two-sided: there is no evidence of one operator, and positive evidence (topology) that the two have different relationships to the substrate. We claim the shared substrate as fact and leave single-operator as unproven — not disproven, unproven.

V. Read Between the Lines

• The finding we could not get is itself a finding. A honeypot sees SSH; a web sensor sees HTTP; neither sees the other's operator. The "one operator" question is, at the artifact level, structurally unanswerable from our vantage — and pretending otherwise is how bad attribution is made.
• A landlord renting the same /24 to a global botnet in May and a web harvester in June is not failing to notice. Recycling abuse pools is the product.
• The web cohort lives on Tencent. That is the tell the SSH botnet lacks. Whatever the web operation is, Tencent is not incidental to it.

VI. The Institutional Anchor & The Money

Nothing here is off-book. The pools are APNIC-delegated; the abuse contact is a registered Singapore entity; the peering posture is publicly declared. The economics are the point: IaaS makes a landlord indifferent to the tenant's purpose. The SSH tourist and the web resident are, to the billing system, two line items in good standing. An abuse desk that exists (Aceville / IRT-ACEVILLEPTELTD-SG) beside abuse that persists is not a contradiction under this model — it is the model working as designed.

VII. The Human Layer

There is a strange intimacy in the last finding. The same forged-iPhone web cohort that harvests .env files also fetched /the-human-document.html fifteen times, /threat-intel.html twelve times, and one specifically-named dossier — /threat-intel/ti-2026-037a-proxy-hunters — from inside AS132203, the very ASN those dossiers name. A machine on the accused's own network, reading the accusation. We record the access as fact and mark the intent as unproven. But it is the kind of fact that changes how you read everything else — and it is why the next part exists.

VIII. Verdict

AS132203 is not one operator with two doors. It is one abuse-tolerant landlord renting the same recycled address pools to at least two independent, internally-coherent malicious operations — a globally-dispersed mdrfckr SSH botnet passing through, and a Tencent-concentrated web crawler/harvester that lives there. The two are disjoint at IP, operator-key, tooling, schedule and reach. Confidence: HIGH that the two are forensically distinct and that the substrate is shared; the single-operator claim is neither made nor refuted — it is left, honestly, unproven. The landlord is the finding.

IX. Defensive Response

Both doors are already handled at the layers where they appear: CrowdSec http:scan / web-threats/autoban bans the web cohort; the honeypot's classification and blocklist pipeline tracks the SSH fleet; both propagate to the MikroTik crowdsec-blacklist at L3. No manual action was required for this dossier.

Crosslinks

• ← TI-2026-065A — The Second Front — established that the web door exists at all.
• TI-2026-027A — The Shared Substrate — the pattern this dossier confirms for AS132203 specifically.
• TI-2026-012 / TI-2026-026M — mdrfckr / the libssh swarm — the SSH botnet's real (global) identity.
• TI-2026-032H — The Double Standard — why Tencent is named by the same rule as AWS/Azure/Google.
• → TI-2026-065C — The Reader — the web cohort reading its own case file: what it fetched, when, and what that does and does not prove.

Sources: honeypot entity-resolution graph (same_operator/shared_authorized_key), honeypot_sessions/commands/fingerprints, web-threats requests/ip_intel, prefix + temporal analysis. Method note: the honeypot in_honeypot cross-layer flag was independently corrected during this investigation (99.2% false-positive rate removed) so that "0 shared IPs" rests on raw session ground truth, not a derived flag. TLP:WHITE.