TI-2026-066D — The Quiet German

Series: The Allowlist · Part D · Classification: HIGH · Confidence: HIGH

The last three parts were about hiding in plain sight — inside a trusted cloud, behind a forged name tag, under a proxy everyone permits. This one is about the opposite trick: hiding by being too small and too quiet to look at. Meet AS200373, Drei-K-Tech / 3xK Tech GmbH — a network you have never allowlisted, never blocked, and never heard of. It has been harvesting credentials from inside your blind spot for a month.

Executive Summary

Where Cloudflare (Part C) is the most-watched network on the internet, Drei-K-Tech is the least. It is the invisible middle: too obscure to earn a place on anyone's allowlist, too dispersed and quiet to trip anyone's blocklist. And that gap is exactly where it operates.

178 IPs, average effective_bad_rate 0.955 — near-pure hostility.
154 of those 178 IPs sent exactly one request each. The whole campaign is 345 requests spread so thin that no single address does anything worth noticing.
85 distinct /24s — not a block you can CIDR-ban, but a scatter across dozens of small subnets.
Sustained June 5 to July 7 — a month of patience, not a burst.
It wears no costume at all (empty user-agent) and runs the standard commodity playbook from Part E: .env sweeps, /api/v1/applications, a WordPress plugin probe.

Reputation defense is built to catch the loud extremes — trust the giants, block the notorious. Drei-K-Tech is neither, on purpose. It is the fourth way to hide, and the one the other three dossiers never named: beneath notice.

I. Invisibility by Arithmetic

The defining number is not the hostility rate; it is the requests-per-IP curve:

Requests from one IP	Number of IPs
1	154
2	21
3	1
37	1
109	1

One request per address, 154 times over. This is not laziness; it is the entire design. Every per-IP defense ever built — rate limits, request-count thresholds, "ban after N failures," IP reputation feeds that need an address to accumulate badness — requires a single IP to do enough to be noticed. A one-request-per-IP spray does none of that. Each address shows up, fires a single credential-harvest probe, and is never seen again, having spent its entire reputational budget on one shot. Multiply by 178 across 85 different /24s and you have a coordinated, near-pure-hostile campaign that, viewed one address at a time — which is how reputation systems view the world — looks like 154 shrugs.

II. Two Speeds: The Swarm and the Core

The operation runs at two tempos. The scout swarm is the 154 one-shot IPs, scattered through 45.3.x, 104.207.x, 65.111.x — disposable addresses that each try one thing and vanish. Behind them sits a small workhorse core in a different prefix entirely: 195.63.25.46 (109 requests, credential_harvest) and 195.63.22.95 (37 requests, credential_harvest). The swarm is the reconnaissance surface — cheap, wide, quiet; the core is where sustained harvesting actually happens. Splitting the two means the noisy part is only two addresses, and the wide part is never noisy at all.

III. The Playbook Is Borrowed; Only the Delivery Is Clever

There is nothing novel in what Drei-K-Tech does. Its request paths are the exact commodity kit decoded in Part E:

The .env sweep — /.env, .env.local, .env.development.local, .env.save, .env.bak, .env.dist, .env.sample, .env.production.local.
API enumeration — /api/v1/applications.
A CMS-plugin probe — /wp-json/gravitysmtp/..., hunting a specific WordPress plugin.
The open-redirect check — the Authelia /?rd= of Part F.

Same SecLists wordlist, same scanners, same goals. The sophistication is not in the tooling — it is entirely in the distribution. Cheap commodity offense plus a large, cheap, disposable IP pool equals a campaign that is trivial to run and nearly invisible to reputation defense. That combination — boring attack, clever spread — is the entire point.

IV. The Seven Questions

Who is this? Drei-K-Tech / 3xK Tech GmbH, AS200373 — a small German-registered AS announcing scattered US-allocated abuse ranges. Why did it attack? Credentials and secrets, the usual harvest. Who does it claim to be? Nothing — empty user-agent, no costume. Who is it really? A dispersed harvest operation optimised for invisibility over volume. Whom is it related to? No SSH-honeypot overlap and thin OSINT — it keeps to itself, which is part of the camouflage. Where is the money? The one .env that returns 200 across 178 cheap attempts. What is the official anchor? A German company registration and an APNIC/RIPE allocation quiet enough that no reputation feed has an opinion about it.

V. Steelman — "345 Requests Is Nothing"

The strongest objection: this is a rounding error. Three hundred forty-five requests over a month, from a no-name AS — every serious network sees more than this in a second. And maybe it is just a handful of compromised customer VMs, not the AS itself. Why does this deserve a dossier?

The volume objection concedes the finding by misreading it. The smallness is not a limitation of the threat; it is the mechanism of the threat. A campaign engineered to stay below thresholds will, by construction, produce low per-IP volume — pointing at the low volume as evidence of insignificance is mistaking the camouflage for the size of the thing wearing it. The 0.955 effective-bad-rate across 178 IPs and 85 /24s is not the fingerprint of a few compromised boxes generating incidental noise; it is a pool where nearly everything that arrives is hostile and nearly everything arrives exactly once. Compromised-customer sprawl looks like a long benign tail with a few bad apples; this looks like a coordinated instrument tuned for silence. And the reason it deserves a dossier is the general one: the technique is not rare, it is just unattended, because it is designed to be. The value here is naming the blind spot, not the byte count.

VI. Read Between the Lines

Reputation is a popularity contest, and this actor declined to enter. It never does anything loud enough to earn a bad reputation — which, in a reputation-based world, is indistinguishable from having a good one.
The one-request-per-IP pattern is a direct message to the defender's tooling: I have read your thresholds and priced them in. Dispersion is not sloppiness; it is the attacker doing threat-modeling of your detection.
"German GmbH announcing American abuse ranges" is its own small tell. Registration jurisdiction and address geography have come apart — the same address-is-rented lesson as Parts A and C, one rung further down the food chain.

VII. The Human Layer

There is a /24 in this campaign that will never appear on a single threat feed, because every address in it did exactly one quiet thing and then went dark. No SOC will ever page on it. No blocklist will ever carry it. To every reputation system on earth it is, and will remain, unremarkable — and that is precisely why it was chosen. The defender's failure here is not inattention; it is that the entire apparatus of IP reputation is built to reward exactly the behavior this actor performs: doing nothing memorable. The quiet ones are quiet on purpose, and the tools we built to find attackers are, by design, blind to the ones who never raise their voice.

VIII. Verdict

AS200373 (Drei-K-Tech / 3xK Tech GmbH) runs a month-long, near-pure-hostile credential-harvest campaign engineered for invisibility: 178 IPs at a 0.955 effective-bad-rate, 154 of them firing a single request each across 85 /24s, wearing no costume and running the standard commodity playbook — from an AS too obscure to allowlist and too dispersed to blocklist. Confidence: HIGH (direct behavioral profile). It is the fourth hiding place of the series, and the one reputation defense is structurally guaranteed to miss.

IX. Defensive Response

This actor is the clean proof of the series' thesis. A per-IP rate limit, a volume threshold, an IP reputation feed — none can catch one request per address; the math forbids it. What catches Drei-K-Tech is per-request behavioral scoring: judging that single .env sweep on its own conduct via effective_bad_rate and probe_intent, with no memory of the sender required, then banning on behavior and propagating to the MikroTik crowdsec-blacklist. The one-shot IP that every reputation system waves through is scored and blocked on the strength of its one shot.

Crosslinks

← TI-2026-066C — Behind the Orange Cloud — from the most-watched network to the least.
← TI-2026-066E — The .env Playbook (TI-2026-065E) — the commodity kit this actor delivers by dispersion.
→ TI-2026-066E — The Bulletproof Midtier — the neighborhood Drei-K-Tech lives in: the abuse-friendly hosts between the giants and the notorious.
→ TI-2026-066F — Behavior Over Reputation — the synthesis this dossier proves: score the request, not the sender.

Sources: LSN web-threats ip_intel/requests — AS200373 full behavioral profile (178 IPs, 85 /24s, requests-per-IP curve, intents, paths, timespan), honeypot-overlap and enrichment checks. Method: profile behavior at the request level; treat low per-IP volume as evasion, not innocence. TLP:WHITE.