The Bank That Wasn't: A Microcredit Name Over a Scanner Fleet

TI-2026-082A · The Tripwire Ledger, Part A Confidence: HIGH — infrastructure and behaviour documented across five independent sources; the operator's real trade is inferred at stated confidence Classification: TLP:WHITE

The sensor that should not have caught it

Every network keeps a ledger it never reads. On this estate that ledger is a MikroTik address-list called mikrotik-attack — a firewall rule that adds any source IP to a permanent ban the instant it touches a router management port. Winbox on 8291, the API on 8728, the web console, SSH to the router itself: none of these are services any legitimate visitor has a reason to reach. So the list has a property almost nothing else in security enjoys — a false-positive rate of zero. If you are on it, you self-identified. There is no innocent explanation for knocking on the router's private door.

For a long time that list was treated as exhaust: a pile of banned addresses, useful for blocking, uninteresting for analysis. The insight that produced this dossier was to read it the other way round — not as a block-list, but as a detector for a population no other sensor sees. When we cross-referenced all 767 of its entries against the SSH honeypot, against the Traefik web-threat pipeline, and against 600-plus published dossiers, the result was stark: 761 of them had touched nothing else. Zero honeypot sessions. Zero web requests. No dossier. The router was the only witness.

Most of that population is background radiation — disposable cloud VMs sweeping the internet for vulnerable RouterOS. But buried in the quiet were a handful of small, patient, coordinated operators that had been probing this estate's perimeter for weeks while remaining invisible to every application-layer sensor we own. This dossier is about the most incongruous of them. On paper it is a bank. In practice it is a scanner fleet wearing a bank's name.

AS209630, or: the name that lies three times

The subject is Autonomous System 209630. Query its holder and you get a respectable-sounding institution: "KREDIT-AS — LLC VASH KREDIT BANK." Vash Kredit — "your credit" — is the kind of name a consumer-lending outfit wears. A bank has an ASN; nothing unusual there; large financial institutions run their own networks.

Except this one lies about where it is, and it lies more than once.

• Its RIR registration (RDAP) returns country code AE — the United Arab Emirates.
• AbuseIPDB geolocates its live address 151.243.11.245 to DE — Germany.
• Team Cymru places the autonomous system in UA — Ukraine.
• Its registered usage type is not "financial services" but "Data Center / Web Hosting / Transit."

A genuine Ukrainian microcredit bank does not register in the Emirates, route through Germany, and describe its own network as bulk hosting. Each of those data points is defensible in isolation — companies do incorporate abroad, IPs do geolocate imperfectly — but stacked together they describe not a bank with an unusual footprint, they describe an address block wearing a bank's name. The institution is the disguise. The hosting is the reality.

And the portfolio confirms it. AS209630 announces a scatter of unrelated /24 blocks that no single domestic lender would ever hold:

151.243.11.0/24     151.241.144.0/24
181.214.125.0/24    181.215.41.0/24     181.215.186.0/24
93.123.118.0/24     2604:be0:ffe0::/48  (IPv6)

181.214 and 181.215 are Latin-American-style ranges; 93.123.118 is Bulgarian; 151.x sits elsewhere again. This is not a bank's data-centre. It is a grab-bag of rented address space — the exact profile of a reseller who acquires whatever /24s are cheap and announces them under one convenient identity. The bank name is the label on the box, not the contents.

Globally infamous, locally invisible

Here is the finding that makes this worth a dossier rather than a footnote.

151.243.11.245 is, by any external measure, one of the noisiest bad actors on the internet. On AbuseIPDB it scores a maximum 100/100, built from 9,451 reports filed by 351 distinct organisations — and it was still being reported on the day we pulled the record. Its report categories are the unambiguous ones: Port Scan (14), Hacking (15), Web App Attack (21). It appears on the DShield block-list. GreyNoise marks it as internet "noise," classification suspicious, last seen the same day. Three hundred and fifty-one independent defenders, all over the world, have looked at this IP and said the same thing: this is an attacker.

And yet, on this estate, across every sensor we operate above the network layer, it left no trace at all:

• SSH honeypot (Cowrie): zero sessions, zero login attempts, zero commands.
• Traefik web-threat pipeline: zero requests, zero probed hosts, zero masked-200 auth attempts.
• Dossier corpus: zero prior mentions — AS209630 had never once surfaced in over 600 investigations.

The only place it existed for us was the router's tripwire, where four of its addresses sat quietly banned. A host that 351 organisations have flagged as hostile walked up to our perimeter, and the only reason we can tell you it was here is that it brushed against a management port and the router wrote its name down.

This is not a gap in the enrichment. It is a structural property of where the sensors live. Honeypots catch what tries to log in. Web pipelines catch what tries to fetch a page. Both are application-layer instruments; they see attackers who engage the application. An actor whose entire interaction is a knock on the router's control plane — a port probe, a Winbox banner grab, a management-port sweep — sails straight past them. It is not stealthy in any clever sense. It is simply aimed at a layer the sensors don't watch. The tripwire watches that layer, and nothing else does. That is the whole lesson of this series, and AS209630 is its clearest single illustration: you can be the most-reported IP on the internet and still be a ghost inside a well-instrumented network, if you only ever touch the one door nobody thought to alarm — until they did.

Patient by design: the 15-day fleet

The behaviour matches the disguise. This was not a smash-and-grab. Across the tripwire's timestamps, AS209630 ran a small rotating fleet inside a single /24, and it ran it slowly:

Two IPs opened the campaign, faded, and were replaced by two others that carried it for the next fortnight — the persistent .245 continuously present the whole time. Low volume, long dwell, quiet rotation within one block. This is the antithesis of the loud, disposable, single-use cloud-VM sweeps documented across the corpus (the Google Cloud offensive of TI-2026-078, the Advin harvest of TI-2026-079). Those actors want to fire a full magazine before the VM is torched. This one wants to stay under the threshold — to probe a little, from a stable address, for as long as it can, precisely so that no volumetric alarm ever fires. It is reconnaissance run on the patience of someone who intends to be around later.

The company it keeps

An operator this careful about its front-of-house identity is worth judging by its neighbours, and the neighbours are where the disguise slips.

Its siblings ride a documented bulletproof shell. Route objects attribute two more prefixes to AS209630 — 85.11.167.0/24 and 91.92.40.0/24 — and in the live routing table both are announced by AS197170, TechTies Inc. TechTies is not an unknown quantity here: it appears across 29 infrastructure records in the existing corpus (TI-2026-010, 029, 029A/B/D, 030G and more), a recurring bulletproof-adjacent host behind cloud-hosted credential-scanning operations. The "bank" shares a routing neighbourhood with a shell we have already convicted in prior work.

Its IPv6 comes from an address broker — the same one that feeds its sibling in Part B. AS209630 announces 2604:be0:ffe0::/48. The parent block, 2604:be0::/32, is registered to EMBNEX, LLC (a US ARIN entity, EMBNEX-AS / AS401661) — an address broker whose business is leasing number resources to whoever rents them. That single fact is the spine of this series: VPSVAULT.HOST (AS215925), the subject of Part B, draws its own IPv6 — 2604:be0:fff0::/44 — from the identical EMBNEX parent. Two operators, two false identities, one broker. We will return to what that means.

Its abuse desk is a decoy. The RDAP abuse contact for 151.243.11.0/24 is not the bank, nor an obvious upstream. It is report@abuseradar.com — a domain registered 2022-12-14, sitting behind Cloudflare nameservers, with a privacy-shielded "Whois Agent" as its registrant. File a complaint and it disappears into an intermediary with no visible operator. The named institution never has to answer for what the addresses do. That is not how a bank handles abuse; it is how abuse is laundered.

Why wear a bank?

Steelman the innocent reading first, because the work demands it. Could AS209630 genuinely be a small financial company whose network was compromised, whose VMs were rented out, whose reputation is collateral damage? It is not impossible. Netblocks are hijacked; brands are abused; a legitimate holder can be slow to notice.

But the evidence defeats that reading on its own terms. A compromised-but-legitimate bank would show some banking footprint — a website, a mail domain doing financial business, a coherent home jurisdiction, an abuse desk that answers. Instead every attribute points away from finance and toward hosting: the datacenter usage type, the scattered rented /24s, the bulletproof siblings, the broker IPv6, the privacy-fronted abuse decoy, and a live fleet that does nothing but probe routers. There is no bank here to compromise. The name is doing exactly one job, and it is doing it well: a financial-sounding holder is reputational camouflage. Automated blocklists and tired analysts skim "BANK" and move on; a name like that buys a few seconds of benefit-of-the-doubt at every checkpoint, and a few seconds, aggregated across thousands of targets, is worth renting a bank's name for. The identity is not an accident of registration. It is load-bearing infrastructure — as much a tool as the scanner itself.

So we state the attribution at the level the evidence supports, and no further. This is not a bank. It is, with HIGH confidence, an abuse-tolerant hosting operation using a financial institution's name as camouflage, running patient perimeter reconnaissance from brokered address space. We do not name a human operator, because the structure is built specifically to prevent that — and inventing one would be the opposite of forensics.

The link forward: one broker, two masks

The single most important sentence in this dossier is the one about EMBNEX. AS209630 (a "bank") and AS215925 (a "UK VPS company," Part B) wear completely different disguises, register in different jurisdictions, and would never be filed together by any tool that keys on names. But they draw their IPv6 from the same 2604:be0::/32 broker allocation, and they run the same low-and-slow router-scanning playbook against the same target, and they were both caught by the same tripwire and nothing else. Strip the costumes and you find two hands provisioned from one supplier, doing one job. Part B follows that thread into the Seychelles address empire. The costumes differ; the operator's method — and its address broker — do not.

What to actually do about it

The IP itself needs no action: the tripwire banned it on contact, weeks ago, which is the system working exactly as designed. The value here is not one more blocked address; it is a lesson about sensor coverage, and it produces two concrete recommendations.

1. Treat the router tripwire as a first-class intelligence source, not exhaust. It is the only sensor on the estate that observes perimeter-only actors, and it was catching a documented, globally-reported threat that every other instrument missed. Its output deserves enrichment and review, not just a drop.

1. Wire enrichment into the ban event. The reason AS209630 sat unenriched — no ASN, no abuse score, no history — is that our enrichment pipeline fires on honeypot and web hits, never on a router ban. A small hook that enriches every mikrotik-attack addition would convert a blind spot into a live feed, and would have surfaced this fleet on day one rather than day fifteen. The perimeter is already watching; it simply hasn't been listening.

The translation, for everybody

Imagine your house has a dozen ways to reach it, and you've put a silent alarm on exactly one: the little service panel round the back that only a utility worker would ever open. Nobody with an honest reason ever trips it. One day you check that one alarm's log and find that a man has been quietly trying the back panel, on and off, for two weeks — never the front door, never a window, so none of your other alarms ever made a sound.

You look him up, and it turns out the whole neighbourhood has reported this man to the police — hundreds of separate complaints. He is famous for casing houses. But you had no idea he'd been at yours, because he only ever touched the one spot you happened to alarm, and stayed away from everything the rest of your cameras watch.

And the strangest part: his van says BANK on the side. Not because he's a banker — because a van that says BANK gets waved past a lot of checkpoints. The name is the disguise. Underneath it he shares a garage with a second man (next door's problem, in Part B) who paints a different word on his van — but both vans were rented from the same yard.

You didn't need to catch him in the act; your back-panel alarm already locked him out weeks ago. What you needed was to read the log — and to put that little silent alarm on the same alert system as all your other cameras, so next time a famous burglar tries your back panel, you hear about it the same day, not two weeks later.

The series

Cross-references

• TI-2026-082B — The Borrowed Vault — VPSVAULT.HOST; the sibling operator sharing the EMBNEX 2604:be0::/32 IPv6 parent.
• TI-2026-010 / 029 / 029A–D / 030G — TechTies (AS197170) — the bulletproof shell announcing AS209630's sibling prefixes.
• TI-2026-078 / 079 — The Cloud Offensive / The Harvest — the loud, disposable-VM contrast to this low-and-slow perimeter reconnaissance.

This dossier documents abuse infrastructure for defensive purposes. Attribution is stated at the level the evidence supports — an abuse-tolerant hosting operation using a financial-institution name as camouflage — and no individual is named, as the structure is designed to prevent that. "LLC VASH KREDIT BANK" is treated as a network identity, not as any specific real-world financial institution; where a legitimate entity of a similar name exists, no association is implied. TLP:WHITE.