The Harvest: A Budget Host Where Nearly Everything Is an Attack

TI-2026-079A · The Harvest, Part A Confidence: HIGH on the network profile and doctrine; MEDIUM on single-operator unification Classification: TLP:WHITE

A different kind of attacker's home

The previous series, The Cloud Offensive, was about the hardest possible network to defend against: Google Cloud, so reputable and so essential that it cannot be blocked. This series is about its exact opposite — and the contrast is the whole point.

AS22295, Advin Services LLC, is a small, young, cheap budget-VPS host. It is not the backbone of the legitimate internet; it is a low-cost provider of disposable US IP space, the kind you rent for a few dollars a month, no questions asked. And against this infrastructure, it is almost purely hostile. Where Google Cloud hides a minority of attacks inside an ocean of legitimate traffic, Advin hides almost nothing — because there is almost nothing legitimate to hide behind. Nearly four out of every five requests from it are an attack.

This letter maps that network — what it is, how hostile it is, and what it is harvesting — and sets up the two letters that follow: the specific probe of this estate's document-search service that arrived hours before this was written (Part B), and the reseller stack and wider criminal economy behind it (Part C). But it begins with a single, clarifying idea: there are two kinds of network an attacker fires from, and they are mirror images. Google is un-blockable and mostly clean. Advin is blockable and mostly dirty. Understanding which one you are looking at decides how you fight it.

Young, cheap, and disposable

Start with what Advin is. AS22295 was allocated by ARIN on 5 January 2024 — under two years old at the time of writing. It trades as advinservers.com, announces 250 IPv4 prefixes, runs an Open peering policy, and lists itself in PeeringDB, somewhat misleadingly, as a "Cable/DSL/ISP" — despite being, in practice, a cheap virtual-server and IP-leasing shop.

Every one of those attributes matters. Young, because a two-year-old ASN has no long reputation to protect and little history for reputation systems to weigh. Cheap, because low prices and easy signup are exactly what an operator wants for disposable attack infrastructure. IP-leasing, because the business is sub-dividing and renting out address space — which, as Part C will show, means the network is a stack of thin reseller allocations rather than one accountable operator. This is not the profile of a hyperscaler running the world's workloads. It is the profile of a field rented cheaply and worked hard — and what it grows is the harvest this series is named for.

Nearly everything here is hostile

Now the number that defines the network. Advin's effective-bad-rate against this infrastructure is 0.779 — roughly four out of every five requests observed from it are classifiably hostile. Set beside it the supporting figures:

• 74 attacker IPs, of which 49 are aggressive.
• The average IP probes 68 distinct paths — heavy, systematic scanning, not a stray hit.
• The ASN risk score is 79.4 — against Google Cloud's 20.
• And the tell that seals it: every single threat IP on this network carries an AbuseIPDB score of 100. Not most. Every one.

Think about what "every threat IP is AbuseIPDB-100" means. On a mixed network, hostile IPs are needles in a haystack of legitimate ones, and their reputation scores scatter. Here, there is no haystack. The threat IPs are AbuseIPDB-100 across the board because the network is the threat — a place where the population of visible addresses is, to a first approximation, uniformly abusive. This is the opposite of the hyperscaler's problem. Google's danger is that its clean average hides the needle; Advin has no clean average to hide behind. It is, almost end to end, a hostile network.

The credential army, again

What is all that hostility doing? The same thing the Google Cloud offensive was doing (078C): running a distributed credential army.

Dozens of Advin IPs each fire large credential-harvesting bursts. The heaviest: 207.241.173.236 (281 attempts), 208.84.101.25 (230), 208.84.100.28 (180), 208.84.100.220 (160), 208.84.101.75 (159), 207.241.173.215 (150), 208.84.100.238 (142), 207.241.173.205 (127). And beneath the heavy hitters, the tell: a whole cluster of IPs fixed at exactly 102 attempts, and another at exactly 80 — the same count, repeated across many otherwise-unrelated addresses.

That repetition is the fingerprint, and it is the same one Part C of the Cloud Offensive named: identical magazine sizes across many IPs mean one campaign distributing a shared credential list across a rented fleet. When address after address fires exactly 102 rounds, they are not independent attackers who coincidentally chose 102; they are one operation, one magazine, many disposable guns. This is distributed credential-stuffing — and it is the identical doctrine seen on Google Cloud, running here on a cheaper substrate. The host changed; the method did not.

The harvest is aimed

Crucially, this is not blind spraying. The harvest has a chosen target, and CrowdSec's autoban scenarios name it: web-threats/lsn-ai: credential_harvest/shell_upload/scanner, fired against 207.241.173.236, 208.84.100.28, and 208.84.100.196. Three Advin IPs, working the estate's AI service specifically — harvesting credentials against it, attempting to upload a webshell (a backdoor), and scanning it. Others were banned for probing 85–91 distinct paths apiece.

The combination — credential harvesting plus shell-upload plus scanning, all pointed at one high-value application — is the signature of a campaign hunting for a foothold, not just testing passwords. It wants access: a working credential or a planted backdoor on a service worth having. This is the credential-harvesting-for-access economy the corpus documented in The Secret Harvest (059A) and The .env Harvesters (046A), and it is aimed, deliberately, at named targets. (In Part B, a fresh Advin IP does the same to a second named service — the document search — and it is the clearest single example of how these targets are chosen.)

And it runs on both doors: the cross-corpus records AS22295 as same_asn_web_and_ssh — hitting the web layer and the SSH honeypot, the dual-vector shape that has recurred across this entire body of work.

The pole it occupies — and why that is good news

Here is where the contrast with Google becomes useful, not just interesting. The two networks sit at opposite poles of attacker hosting:

• Google Cloud — reputation-laundering: un-blockable, mostly-clean, the attack a needle in a legitimate haystack. You cannot block it; you must catch each hostile act.
• Advin (AS22295) — cheap disposability: blockable, mostly-dirty, the network itself almost uniformly hostile. You can consider blocking it, because there is little legitimate traffic to lose.

That difference is directly actionable. Against Google, an ASN-level block is unthinkable — it would sever the legitimate internet. Against Advin, with an effective-bad-rate near 0.78 and every threat IP AbuseIPDB-100, a subnet- or ASN-level block carries low collateral, because there is almost nothing legitimate on it to harm. The behavioural per-act defence still does the primary work (and it is holding — CrowdSec is autobanning Advin IPs by intent, MikroTik enforcing, no compromise observed). But unlike the hyperscaler, this network is a candidate for the blunter instrument, precisely because it is a cheap field grown for one crop rather than a shared city everyone lives in.

Measuring which pole a network occupies — its bad-rate, its abuse-score distribution — is therefore not academic. It is the measurement that decides whether the blunt instrument is safe to use. On Advin, it is closer to safe than almost anywhere.

The translation, for everybody

In plain words: some attackers hide in a crowd, in the nicest part of town, where you cannot cordon off the street because thousands of innocent people live there. Others rent a cheap, half-abandoned warehouse on the edge of town where everyone inside is up to something. This network is the warehouse. Almost nobody legitimate is in there; nearly everything coming out of it is an attempt to break into your things — and right now, specifically, to steal the keys to your AI service and, as the next chapter shows, your document library.

The good news about the warehouse is the flip side of the bad news: because almost nothing good comes from it, you can be much more aggressive about slamming the door on the whole address without hurting anyone innocent. You still watch each hand that reaches for a lock — that is always the main defence — but this is one of the rare cases where you can also, reasonably, decide the whole building is not worth hearing from. Same burglars, same tools, same goals as the fancy-neighbourhood crew — just working from a cheaper base, which happens to be a base you are far freer to wall off.

Where this series goes

• Part A — The Harvest (this letter): the network — young, cheap, ~78% hostile, running a credential army against lsn-ai.
• Part B — The Docsearch Probe: 65.110.40.130, hours old, probing this estate's document-search service — discovered, almost certainly, by scraping the public website — down to its exact JavaScript bundle.
• Part C — The Reseller Stack: Octopus Web Solution on Advin, the sub-allocation laundering, who is behind it, and the links that tie this network to the wider credential-harvest economy and the nastier actors already in the record.

The harvest is live. It is aimed at named services. It runs from a cheap, almost-uniformly-hostile network that — unlike its hyperscaler mirror — you are genuinely free to wall off. Same crop, cheaper field.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-078A–D — The Cloud Offensive — the reputable-hyperscaler mirror; same doctrine, opposite pole.
• TI-2026-059A — The Secret Harvest · 046A — The .env Harvesters — the cloud credential-harvest economy this network belongs to.
• TI-2026-066A — Trusted by Default — the cloud-hosting attacker economy; Advin at its cheap-disposable end.
• TI-2026-073B — The Control Plane Lie — the lsn-ai / masked-200 auth-probe pattern (Part B).

This dossier documents a budget-hosting network's sustained attack on this infrastructure, for defensive purposes. AS22295 (Advin Services) is a lawful hosting provider whose disposable IP space is abused; the finding concerns the network's near-uniform hostility against this estate and the credential harvest it carries. TLP:WHITE.