LSN โ€” Local Sovereign Network

The Eastern Crawlers: Fake-Baiduspider and Fake-YandexBot

TI-2026-086D ยท Series: The Wardrobe ยท Case 4 ยท Classification: HIGH ยท Confidence: HIGH

The first three cases took down Western costumes โ€” Google's crawler, then the Internet Archive's. This case reaches for two coats cut from a different cloth: the crawlers of China's and Russia's dominant search engines. They are smaller fleets than the flagship, but they are the two most convicted on the rack โ€” every classified request from both is hostile. And they exploit an allowlist entry most defenders forget they even keep.

Executive Summary

Two fleets on the AS396982 rack forge the search identities of the non-Western internet:

An effective bad-rate of 1.0 means something worth pausing on: every classified request from these fleets is hostile. There is no ambiguous traffic to weigh, no benign fraction to preserve. Where the Googlebot fleet was 90% bad and the archiver 96%, these two are the purest-conviction costumes in the wardrobe. They are also the ones that exploit the most specific trust: not the universal Google allowlist, but the deliberate exception a globally-minded operator keeps for the East.

All members are banned under their fleet-keyed CrowdSec/MikroTik scenarios as of 2026-07-13 06:45 UTC.

The Internationalised Allowlist

Every operator's crawler allowlist starts the same way โ€” Google, Bing โ€” because those are the search engines that send Western traffic. But an operator who wants Chinese or Russian audiences has to add two more names, deliberately, or lose visibility in those markets:

These are not default entries. They are chosen exceptions, added by exactly the sites that care about international reach โ€” e-commerce, media, anything with a global audience. And here is the gap they open: those are also the sites least equipped to sanity-check an Eastern crawler by behaviour. A Western operator has a strong intuition for what Googlebot should and shouldn't do; almost none has the same intuition for Baiduspider. So a request that says Baiduspider lands on an allowlist entry the operator added on purpose and then never learned to police.

That is the trust these fleets are built to spend. The wardrobe, in other words, is stocked to a map of which exceptions defenders actually keep โ€” Western masks for the default allowlist, Eastern masks for the internationalisation exception. The costume set is a survey of trust.

The Flag Never Matches the Origin

There is a discriminator these two fleets hand us for free, and it is geopolitical. Baiduspider is a Chinese identity. YandexBot is a Russian one. Every IP flying those flags in this data is a United States Google Cloud tenant address on AS396982.

A real Baiduspider request comes from Baidu's own networks in China (AS23724, AS55967, reverse-confirming under crawl.baidu.com). A real YandexBot comes from Yandex's networks (AS13238, confirming under yandex.com/yandex.ru). Neither operates out of a rented US cloud instance. So every member of these fleets embodies a contradiction a defender can read at a glance: a Chinese search crawler that lives in Iowa; a Russian one that lives in Belgium. The country of the flag never matches the country of the origin.

This is the same country-discrepancy signal the honeypot's enrichment flags across its corpus โ€” an IP whose claimed or routed nationality disagrees with its actual home. Here it is baked into the costume itself. A naive geo-trust rule ("allow the Chinese crawler because we want Chinese traffic") swallows the mismatch whole; a rule that simply checks whether a Chinese crawler comes from China rejects the entire fleet on one field. The mask advertises its own forgery, if you read the passport next to the uniform.

One Machine, Three Nationalities

The most important evidence in this case is that these are not a separate, "Eastern" operation. They are more costumes on the same body.

Baidu member 136.107.160.133 fired 97 distinct .env paths at lsn-git.shuffle-on.com โ€” the Gitea host, a source-code server โ€” in about two seconds, every probe answered 401. That is the identical .env toolkit documented in 086B and 086C. And its campaign memberships are the giveaway: alongside Fake-Baiduspider Fleet AS396982 (10 IPs), it belongs to Shared-Exploit Cluster (5 IPs, 10 paths) โ€” the same cluster that contains 34.125.48.170, the Yandex-masked node that 086B used to prove the costume is cosmetic.

Trace that link and the picture resolves. One Shared-Exploit Cluster contains a node wearing Baidu and a node wearing Yandex, both running the same ten-path exploit set, both tied through the flagship toolkit to the Googlebot fleet. Three national search identities โ€” American Google, Chinese Baidu, Russian Yandex โ€” collapse into a single behavioural cluster. The operator is not Chinese or Russian or American; the operator is someone with a wardrobe, reaching for whichever flag the target's allowlist honours, from one set of Google Cloud instances. The nationalities are props.

And, as with the archiver, the costume is finished with a period-accurate UA pool โ€” Mozilla/4.8 (X11; SunOS 5.7 sun4u), ELinks 0.4pre5, Lynx/2.8.5, NetPositive/2.1.1 (BeOS), even a Facebot string โ€” the same over-decoration that impersonates an old, heterogeneous crawler and, in doing so, produces a client distribution no live 2026 population matches.

The Target Tells You the Intent

The Googlebot fleet went after webmail and a video host; the archiver after peertube. The Baidu node went after the Gitea server, and that choice is not incidental. A source-code host is where developer secrets accumulate โ€” CI/CD tokens, deploy keys, .env files checked into repositories, database URLs in config. It is, for a credential harvester, the highest-yield door in the estate. Aiming a .env sweep at lsn-git specifically is target selection, not spray-and-pray: the fleet knows what a git host holds and dressed as a search crawler to go get it.

The 401 wall held โ€” Authelia intercepted all 97 probes and the harvest learned nothing, exactly as in 086B โ€” but the intent is the finding. The costume was chosen to reach the crown jewels quietly, and the only reason it failed is that the door it knocked on answers every knock the same way.

Steelmanning: "Chinese and Russian scanning is normal noise โ€” why attribute a costume?"

The honest objection: the internet is full of genuinely Chinese and Russian scanning; maybe these are just ordinary scanners that happened to pick Baidu/Yandex UAs, not a coordinated wardrobe. Two answers.

First, origin. If this were ordinary Chinese/Russian scanning, it would come from Chinese/Russian networks. It comes from US Google Cloud. The nationality is in the costume, not the infrastructure โ€” which is precisely the inversion this case documents. Real CN/RU scanners do not need to forge CN/RU crawler names; the forgery only makes sense as allowlist-defeat, which requires the fake to sit where the allowlist is checked (the target's edge), wearing the name the target trusts.

Second, the shared cluster. Ordinary unrelated scanners do not converge into a five-IP, ten-path exploit cluster that also contains a Yandex-masked and (via the flagship) a Googlebot-masked node. That convergence is computed from identical paths and timing, not from shared hosting. It is the signature of one toolkit, not three coincidences. The nationality of the mask is chosen; the machine underneath is one.

We keep the discipline the objection demands โ€” we do not claim these operators are Chinese or Russian; the evidence says the opposite, that their flags are forged โ€” and we stop attribution at "one operation with a wardrobe," leaving the actor-identity question to 086M.

What Holds, and What Is Bounded

Documented, HIGH confidence: both fleets' composition, volume and ebr 1.0; the Baidu node's 97-path .env sweep of the Gitea host and its Shared-Exploit-Cluster membership shared with the Yandex node; the flag/origin geo-discrepancy; the archaic UA pools; fleet-keyed enforcement.

Inferred, MEDIUM confidence: the "internationalised allowlist" as the specific motive for these masks. The behavioural and provenance facts are certain; the claim that operators chose Baidu/Yandex because global sites allowlist them (rather than simply cycling through a large UA list) is a strong inference from the target profile, not a stated intent. It is consistent with the costume-fits-the-crime pattern of 086C, and 086I revisits it across the whole rack.

Why It Matters

The Eastern crawlers extend the series' thesis in two directions at once. On trust, they show the wardrobe is stocked to the shape of real allowlists: not just the universal names, but the deliberate exceptions defenders add for reach they value โ€” the Chinese and Russian search entries that a global site keeps and then cannot police. Wherever a defender extends trust for a good business reason, the wardrobe has a coat cut to fit it.

On detection, they hand us the cleanest discriminator in the series: a forged nationality that contradicts the origin. You do not need to understand Baiduspider's behaviour to reject a Baiduspider that lives on US Google Cloud โ€” you only need to check that a Chinese crawler comes from China. The most sophisticated part of the disguise, its claim to a foreign flag, is defeated by the least sophisticated question you can ask of it. And underneath all three flags โ€” American, Chinese, Russian โ€” the same .env machine hums in one Google Cloud tenancy, wearing whichever passport opens the door.

Cross-references

Next in the series โ€” TI-2026-086E, The Newest Trust: the fake AI crawlers โ€” ClaudeBot, GPTBot, ChatGPT-User โ€” across AWS, DigitalOcean and Cloudflare, and the allowlist that did not exist two years ago.

TLP:WHITE. Attacker infrastructure only; Baidu, Yandex and the Internet Archive are named as impersonation victims. No internal addresses, credentials, or PII disclosed.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 4 / 26 Next โ†’