The Reseller Stack: Who Is Behind the Harvest

TI-2026-079C · The Harvest, Part C — The Finale Confidence: MEDIUM-HIGH — infrastructure documented; operator attributed to a category, not an identity Classification: TLP:WHITE

The question the harvest leaves

Two letters have shown what the Advin harvest is (a cheap, near-uniformly-hostile network running a credential army, Part A) and how it reconnoiters (reading the public website to find lsn-docsearch, Part B). This finale answers the harder questions the reader is owed: who is behind it, and how does it connect to the other nasty actors already in our record?

The honest answer to "who" is not a name — and the letter will say exactly why, and exactly how far the evidence does reach, which is further than it first appears. Because while the human operator hides in a gap that cannot be closed, the shape of the operation is legible, its doctrine is unmistakable, and its links to the wider threat picture are strong. You cannot name the harvester. You can describe the harvester precisely — and, on this field, do something about it that you could not do on the last.

A layered lease, not a single owner

Start with the structure, because the structure is the first reason the operator is hidden.

AS22295 does not attack as one accountable block. Its hostile address space is a stack of sub-allocations, resold to thin brands. The 65.110.40.0/24 that fired the docsearch probe (Part B) is held by Octopus Web Solution Inc — a reseller riding Advin's ASN. Around it sit 208.84.100.0/22, 207.241.173.0/24, 142.248.80.0/24, 185.147.157.0/24, 23.137.105.0/24 — each a leased slice. So the ownership runs in layers: Advin is the host and ASN operator; Octopus and its peer brands are the tenants of record who lease the ranges; and the actual attacker is a tenant of the tenant — someone who rented a virtual machine on Octopus's space and pointed it at this estate.

Three layers, and each one is a place accountability can be handed off. The network is not a single owner you can hold responsible. It is a lease within a lease within a lease.

Accountability lost in the gap — again

That layering reproduces, at the cheap-host pole, the exact accountability gap the Google Cloud finale documented (078D, via The Deed and the Tenant, 068B) — and makes it worse.

The deed — the IP — belongs to Advin and its reseller Octopus. The tenant — the attacker who rented a VM and fired the credential harvest — is anonymous and, by the time you look, gone. Responsibility falls into the space between the owner (who did not commit the act) and the renter (who did, but cannot be found). And the reseller stack deepens the gap: an abuse report to Advin lands on a reseller's customer's customer, and each layer can, truthfully, point at the next. Advin can say "that range is Octopus's." Octopus can say "that VM is a customer's." The customer is a throwaway account behind a throwaway VM.

So attribution, done honestly, stops at the reseller stack. The human operator is not recoverable from this evidence, and any dossier that claimed otherwise would be inventing. This is the same structural shield the hyperscaler provided in the last series — only built cheaply, out of sub-allocations, instead of out of scale. The reputable giant and the cheap reseller arrive at the same hiding place by opposite roads.

The company it keeps

Attribution up the lease chain is a dead end, but the network's routing neighbourhood is not, and it is telling. Advin is not adjacent to the reputable internet. Its BGP-upstream graph is thick with the bulletproof mid-tier: Host Universal Pty Ltd (AU, risk 93.4, bulletproof), IENTC (MX, 93.1, bulletproof), THG Hosting / UK2NET (GB, 90.1, bulletproof), ReliableSite (83.4, bulletproof), Nocix, WholeSale Internet — and a direct upstream to AS35100 (PatrikWeb, Patrik Lagerman, SE).

This is the topological signature The Bulletproof Midtier (066E) described: a cheap host routed among the abuse-tolerant tier, one hop from the genuinely bulletproof, wearing the thin respectability of a young US LLC. It is the same heuristic that flagged the VPN midtier in the previous arc (077D), applied to the budget pole — and it is a useful hunting rule in its own right: a clean-looking budget ASN whose BGP neighbourhood is thick with bulletproof networks deserves scrutiny its registration would never trigger. You are known by the company you route with.

The decisive link: one doctrine, two fields

Now the answer to "how does this connect to the other actors" — and it is the strongest finding in the letter, because it is not a weak-shared-upstream link but a method match.

Advin runs the identical playbook to the Google Cloud offensive (078), tool for tool:

• Synchronized credential magazines — repeated identical attempt-counts (102, 80) across many unrelated IPs, exactly as Google's fleet fired identical 146-round magazines.
• The lsn-ai target, worked with credential_harvest, shell_upload, and scanner — the identical CrowdSec signature seen on the Google Cloud IPs.
• Masked-200 auth-probing through the Authelia portal — the same ?rd= redirect technique.
• Dual-vector across web and SSH.

Two entirely different hosts — the world's most reputable cloud and a cheap two-year-old reseller — running the same doctrine, against the same targets, with the same tools. That is not coincidence, and it is not two separate threats. It is one trade, run from two addresses. The method is substrate-independent: it does not care whether it fires from Google Cloud or Advin, because the doctrine is the constant and the host is a rented, interchangeable variable.

And the corpus already drew the map this sits on. Advin is documented, across six prior dossiers, in the same credential-harvest economy as the cloud actors: The .env Harvesters (046A), The Multi-Vector Operators (046D), The Secret Harvest (059A, cloud-hosted credential scanning at scale), Trusted by Default (066A), The Bulletproof Midtier (066E), The Control Plane Lie (073B). These are not unrelated files. They are the atlas of a commodity industry — cloud-hosted credential scanning and access brokering — and Advin and the Google Cloud offensive are two nodes of it, running the same business from different rented rooms.

Who is behind it — stated honestly

So, to the question directly. Whom might be behind this?

Not a name. Not a state. Every signal points to a commodity credential-harvest / access-brokering operation — the industrialised low end of the access economy, which harvests logins and footholds at scale to sell, rather than a targeted or nation-state actor pursuing a specific victim. The evidence for that reading, and against a more dramatic one:

• Public, dual-use ammunition — shared credential lists, not bespoke or stolen-private corpora.
• Interchangeable disposable hosting — a cheap reseller here, a reputable hyperscaler in 078; an operator that cared about a specific victim would not treat its infrastructure as fungible.
• A broad, foothold-hunting target set — lsn-ai, lsn-docsearch, and the wider lsn-* sweep of 078B: casting for access, not pursuing one prize.
• No bespoke tooling, no exclusive infrastructure — everything is off-the-shelf and rented.

That is the honest ceiling of attribution: a category, not an identity. An industrialised access-economy trade, shielded by the reseller stack and the disposable VM, that rents whatever hosting is convenient and runs one playbook across all of it. To name a person or a government here would be to cross from evidence into fiction, and this work does not cross that line. The harvester is describable in full — its trade, its method, its economics, its infrastructure — and un-nameable, and both of those are true at once.

Two fields, one harvest — and one you can burn

The finale earns its title by putting the two series side by side. Advin and Google are two fields for one harvest. The harvester rents the reputable hyperscaler when it wants un-blockability (078), and the cheap reseller when it wants disposable, throwaway addresses (079) — one trade, two hosting strategies, chosen by convenience.

But the two fields are not equally defensible, and that is the practical payoff of reading them together. Against the reputable field, the defender can only ever judge the act — Google is un-blockable, and Part D of the last series was the long proof of it. Against this field, the defender can judge the act and do something the hyperscaler denied them: wall off the field. Advin is ~78% hostile, every threat IP AbuseIPDB-100, a stack of sub-allocations grown for one crop. A subnet or ASN block of the Octopus/Advin ranges carries low collateral, because there is almost nothing legitimate on them to harm. Behavioural per-act defence remains primary — it is what actually holds, and it holds here as everywhere. But on the cheap-disposable field, the defender gets back the blunt instrument the reputable field took away, and can use it as a supplement: catch each hand and burn the field it reaches from.

Same harvester. Same crop. Two fields — and one of them, you are free to set alight.

The translation, for everybody

In plain words: you asked who is behind this. The honest answer is that you cannot get a name, and here is exactly why. The attacker rented a room, in a building, on a street, where the building's owner rents to a middleman, who rents to renters, who let their rooms out by the hour to strangers. Knock on any door and the person behind it truthfully points at the next. The trail ends at "a stranger who rented a room and left" — and no amount of digging turns that stranger into a name.

But you are not helpless, and you know more than a name would tell you. You know the trade: this is a professional key-copier who breaks into places to sell the keys, not a stalker fixated on you — you can tell, because the same crew works from a fancy downtown office and this cheap warehouse, using the exact same tools on both, treating the address as disposable. And you know something useful about this particular building: unlike the fancy downtown office (which you cannot touch because a thousand innocent businesses share it), this warehouse is full of nothing but people like this. So while you keep doing the main thing — catching each hand that reaches for your lock — you can also, here, reasonably decide the whole warehouse is not worth hearing from, and wall it off. You will never learn the burglar's name. You do not need it. You need to keep your keys, and you can — one caught hand at a time, and, on this one cheap street, one walled-off building.

The Harvest — complete

Three letters, one budget network, still firing. It is a cheap, young, near-uniformly-hostile host, running the same credential-harvest doctrine as the Google Cloud offensive from the opposite end of the hosting spectrum, aimed at this estate's lsn-ai and lsn-docsearch services, laundered through a reseller stack routed among the bulletproof tier, operated by a commodity harvester who cannot be named — and, unlike its hyperscaler mirror, it runs from a field the defender is genuinely free to burn.

The Harvest — complete. Same crop, cheaper field, and this one you can wall off.

The series

Cross-references

• TI-2026-078A–D — The Cloud Offensive — the reputable-hyperscaler field of the same harvest; the doctrine match.
• TI-2026-068B — The Deed and the Tenant — the accountability gap the reseller stack reproduces.
• TI-2026-046A / 046D / 059A / 066A / 066E — The .env Harvesters / Multi-Vector Operators / The Secret Harvest / Trusted by Default / The Bulletproof Midtier — the credential-harvest economy Advin belongs to.
• TI-2026-073B — The Control Plane Lie — the masked-200 auth-probe shared across both fields.

This dossier documents the infrastructure and economics behind a budget-hosting credential harvest, for defensive purposes. Attribution is stated at the level the evidence supports — a commodity credential-harvest/access-brokering category, laundered through a reseller stack — and no further; no individual or state is named, as the evidence does not support one. AS22295 (Advin) and the resellers are lawful entities whose disposable IP space is abused by transient tenants. TLP:WHITE.