The Laundered Vector: An Attack That Arrived by VPN

TI-2026-077A · The Laundered Vector, Part A Confidence: HIGH on the infrastructure and behaviour; MEDIUM on single-operator unification Classification: TLP:WHITE

Start with the plain version

Before the fingerprints and the ASN numbers, here is the whole story in ordinary words.

Someone attacked this network. They tried to steal passwords, upload a webshell, and hunt for admin panels on the websites; and separately, on the SSH service, they ran scanning tools and a small worm that reads the victim's command history to steal it. Nothing unusual so far — this happens to every internet-facing server, constantly.

What makes it worth a dossier is how the attacker hid. They did not attack from their own computer. They routed everything through a commercial VPN — the same kind millions of people pay for to watch geo-blocked shows or protect their privacy on café Wi-Fi. When you route an attack through a VPN, the target does not see your real address. It sees the VPN's exit — a rented server that could be in any country the VPN offers. So the attack appeared to come from fourteen different countries at once, none of which is where the attacker actually is.

This is called laundering the vector: washing your traffic through infrastructure that hides where it came from. And the point of this letter — the thing the whole series is built on — is a simple, useful truth: the VPN can hide where you are, but it cannot hide what you are doing. The origin lies. The behaviour does not. That is why the dossier is titled the way it is, and why the honest phrase for the method is: vectors don't lie.

Now the evidence.

What the network actually is

The attack arrived through AS212238 — an "autonomous system," which is just the technical name for a block of internet addresses run by one organisation. This one belongs to CDNEXT / Datacamp Limited, a British content-delivery and hosting company. It is registered properly through RIPE (the European internet registry), its listed administrator is a real person (Jiri Prochazka), it announces 3,391 blocks of IPv4 addresses, and — this is important — it is not a criminal network. Its risk score is a low 23.5, it carries no "bulletproof host" flag, and it is not on the Spamhaus blocklist. By every reputation measure, it is a clean, ordinary CDN.

So why is a clean CDN carrying credential theft and a worm?

Because of what Datacamp also does, which the reverse-DNS names of the attacking addresses reveal with no ambiguity at all. When you look up the hostnames behind the attacking IPs, you get things like:

• 97-1-mn.cg-dialup.net, 87-1-at.cg-dialup.net, 97-1-gr.cg-dialup.net — the cg-dialup.net domain is CyberGhost VPN's exit-node naming convention.
• unn-156-146-55-165.cdn77.com, unn-154-47-30-21.datapacket.com, unn-79-127-175-74.datapacket.com — CDN77 and DataPacket are Datacamp's own brands, the hosting substrate underneath multiple commercial VPN services.

In plain terms: AS212238 is where commercial VPN traffic comes out. It is a legitimate business selling legitimate exit capacity to legitimate VPN companies serving legitimate customers — and, riding in that same pipe, this attack. The corpus already knew this network in this role: it is documented in The VPN Laundromat (TI-2026-023A), The Privacy Empire (034C), and The Bulletproof Midtier (066E). This letter is the live capture of the pattern those dossiers described.

The first vector: the web

On the web layer — the ordinary HTTP/HTTPS traffic to the sites, watched by Traefik's access logs and the CrowdSec intrusion-prevention engine — the attack shows its hand clearly, because CrowdSec labels why it banned each source. These labels are the attacker's own intentions, written down by the defence:

• 149.22.81.216 (a DataPacket exit) was autobanned for credential_harvest:14, shell_upload:1, api_enum:5, admin_hunt:1 — four distinct hostile intents from one address. In plain words: it tried to steal login credentials fourteen times, attempted to upload a webshell (a backdoor script), probed the API five times, and hunted for an admin panel. This is the worst single source, and it is doing real intrusion work, not scanning.
• 143.244.47.86 — banned for vhost_enum:5 (guessing which websites the server hosts).
• 178.132.109.237 — banned for cms_detect:27 (fingerprinting the content-management system, the first step before firing a matching exploit).
• 84.17.43.213 (threat score 76) — ran cms_detect fifteen times.

Independent attack-pattern detection agrees: credential_harvest from 149.22.81.216, twenty-one events, high confidence. None of this is ambiguous. It is credential theft, backdoor-upload attempts, admin-panel hunting, and target fingerprinting — the standard opening moves of a web intrusion, all arriving through VPN exits.

The second vector: SSH

At the same time, the same ASN is attacking the SSH service — the remote-login protocol — and this is where the story connects to everything this project has documented before. The tools it brings are not new. They are the exact fleets the 26-letter Armory census catalogued, identified by their HASSH (a fingerprint of how an SSH client negotiates its connection):

• 14b2ddda386a4d10 — libssh2 1.11.0, the scanner fleet profiled in The Version Fleets (075P), The Tenant (075G), and The Sharpest Edge (075R).
• acaa53e0 — OpenSSH_7.4, the "ambiguous" client that hides behind a normal banner, the subject of The Borrowed Face (075T).
• f555226d — libssh_0.9.6, the old-build botnet version fleet of 075P.
• plus Renci.SshNet (a .NET/C# SSH library) and a generic libssh2_scanner.

The shared credential across these SSH sessions is root with a blank password (46 uses) — the identical root:blank signature that unified the dispersed Tenant of The Tenant of Fifty-Six Networks (075G). The attacker's toolkit, seen from the SSH side, is the same commodity arsenal the whole Armory series mapped — now arriving through a VPN instead of a rented cloud.

And one SSH session went further. It ran this command:

HISTZISE=10000; HISTFILE=~/.bash_history; HISTTIMEFORMAT=' d2ae636d-7d32-4072-a7aa-3a885d8bdd32 '; history -r $HISTFILE; history

To a non-specialist that is gibberish; to the corpus it is a signature. This is the bash-history-theft routine of TI-2026-005 (Two Worm Families). The misspelled HISTZISE (it should be HISTSIZE) is a developer typo frozen into the worm's code, and the long string in the middle — d2ae636d-7d32-4072-a7aa-3a885d8bdd32 — is a GUID, a unique tag the worm stamps onto the victim's stolen shell history so its command-and-control server can tell one victim's data from another's. In other words, a documented, self-propagating worm ran through this VPN exit to read and exfiltrate a shell's history. The cross-corpus confirms AS212238 is present in the TI-2026-005 investigation.

The address that appears in both doors

If the web attack and the SSH attack were two unrelated strangers who merely happened to rent exits from the same VPN, that would be a coincidence, not a story. But they are not fully unrelated, and one address proves it.

5.183.101.141 appears in both sensors. It is in the web-threats layer and it is in the SSH honeypot — 18 Cowrie honeypot hits, carrying the same libssh2_1.11.0 HASSH (14b2ddda) as the SSH fleet above. Its reputation is severe: an AbuseIPDB score of 100 with 454 abuse reports, and a GreyNoise classification of "suspicious." And its geography is a perfect illustration of the laundering: the sources disagree on what country it is in — AbuseIPDB says Sweden, RDAP says Denmark, Team Cymru says the United States — while its abuse ISP resolves to "CEGRGO-DigitalVM" (digital-vm.com), a separate VPS/hosting brand. That disagreement is not an error. It is the fingerprint of an address whose true location is hidden behind rented infrastructure: every source guesses from a different clue, and they land in different countries because none of them can see the real one.

This is the cross-vector operator described in the Armory's The Cross-Vector (075X), caught live: one hand, two doors, 454 complaints. A defence watching only the web would file it as a web attacker; a defence watching only SSH would file it as a libssh scanner; only correlating both reveals that the same laundered source is working both protocols.

Fourteen countries that are one attacker

The attack's addresses geolocate across fourteen countries — Great Britain (253 IPs), the Netherlands, the United States, France, Romania, Germany, the British Virgin Islands, Canada, Slovakia, the UAE, Bulgaria, Switzerland, Japan, Singapore. Read at face value, that looks like a coordinated multinational campaign, a coalition of attackers from four continents.

It is nothing of the kind, and understanding why is the heart of the series. Those fourteen countries are VPN exit locations — entries on a commercial VPN's server-list menu. The same operator, connecting through the VPN, can choose to exit in London this hour and Tokyo the next, and the target dutifully records "an attack from the UK" and then "an attack from Japan." The fourteen-country spread is not the nationality of an attacker; it is the catalogue of a VPN's server locations. This is the exact same "procurement geography, not nationality" lie the Armory documented for rented clouds (075G) and for launch-timing (075W) — now operating one layer up, at the VPN itself. The map of where the attack came from is a map of what the attacker bought, not who they are.

Why "vectors don't lie" — and what it means for defence

Put the two vectors together and the series' thesis states itself.

The source vector — the IP address, the country, the ASN — lies. It says the attacker is in fourteen countries; it is in none of them. It scatters 5.183.101.141 across Sweden, Denmark, and the US. The VPN's entire purpose is to make this vector lie, and it succeeds: from the source alone, the attacker's origin is genuinely unknowable.

The behaviour vector — what the traffic actually does — cannot lie, because to attack, you have to attack. On the web, the behaviour is credential theft, shell upload, admin hunting. On SSH, it is catalogued scanning tools, a root:blank login, and a history-stealing worm. That behaviour is identical in intent across both protocols, and no amount of VPN laundering changes it, because it is the attack. You can hide where you are standing; you cannot hide that you are throwing a punch.

For a defender, this is not despair — it is direction. It means:

• Never attribute origin from VPN-exit geography. The country is the VPN's, not the attacker's. Reading it as nationality is the exact mistake the laundering is designed to induce.
• Never treat a clean ASN as safe traffic. Datacamp scores 23.5 and carries no bad flags — and that is precisely why the attacker chose it. The laundering layer is selected for its good reputation, because good reputation is what does not get blocked.
• Judge the act, not the pipe. The defence that already worked here keyed on behaviour: CrowdSec autobanned the hostile sources by intent — 149.22.81.216 for its credential-harvest and shell-upload, 143.244.47.86 for its vhost enumeration — and MikroTik bans followed. The hostile acts were removed; the millions of legitimate VPN users on the same network were never touched. That is the whole model: gate on the behaviour, leave the shared pipe open for the innocent.

You cannot blanket-block a commercial VPN's exit range without punishing every legitimate person using it — the privacy-conscious, the travellers, the journalists. And you do not need to. The attack told you what it was, in a language the VPN cannot translate away. Read that vector, and the laundering fails.

Where this series goes

This letter is the map. The three that follow read the same live attack from the angles that matter most:

• Part B — The Pipe That Hides: what a VPN exit actually is, why it is a shared pipe like a Tor node, and why "just block it" is both impossible and wrong — the innocent-fraction problem in full.
• Part C — One Hand, Two Doors: the cross-vector operator study — 5.183.101.141, 149.22.81.216, and how the same behaviour and tooling appear on both protocols.
• Part D — The Midtier: the economics of laundering through a reputable network — why "clean enough to not be blocked" is the most valuable property an attacker's infrastructure can have.

The attack is still live as of this writing (bursts on 8 and 10 July 2026). It came in wearing fourteen flags, and not one of them was true. Everything true about it was in what it did.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-023A — The VPN Laundromat · 034C — The Privacy Empire · 066E — The Bulletproof Midtier — AS212238 as documented VPN-laundering infrastructure.
• TI-2026-075X — The Cross-Vector — the same-ASN web+SSH operator, here caught live.
• TI-2026-075Y — The Innocent — the VPN exit as a shared pipe; judge the act, not the pipe.
• TI-2026-005 — Two Worm Families — the HISTZISE history-theft worm that ran through this exit.
• TI-2026-075P / 075G / 075T — The Version Fleets / The Tenant / The Borrowed Face — the SSH tool fleets reappearing here.

This dossier documents observed abuse of legitimate commercial-VPN infrastructure for defensive purposes. AS212238 (Datacamp) and the VPN providers named are lawful services whose shared exit infrastructure is abused by third parties; nothing here attributes the attack to them. Attribution rests on behaviour, not on the pipe. TLP:WHITE.