LSN โ€” Local Sovereign Network

The Wordlist as a Blueprint: Reading the Attacker's Model of Your Estate

TI-2026-086R ยท Series: The Wardrobe ยท Case 18 ยท Classification: HIGH ยท Confidence: HIGH

Every case so far has read the attacker's disguise. This one reads the attacker's shopping list. Under the forged crawler names, the fleets are running dictionaries โ€” of secret-file paths, of login credentials, of subdomain names โ€” and a dictionary is not just a tool. It is a hypothesis, written down, about what your estate contains. Read it back and it becomes a portrait of you, drawn by the adversary: what technology they expect you to run, how they think your secrets leak, what they believe your engineers named their accounts. The wordlist is intelligence about the intelligence, and it points a defender at their own exposure more precisely than most audits do.

Executive Summary

The wardrobe runs three dictionaries, and each is a lens on the attacker's model of a 2026 target:

And the whole thing is current โ€” claude:Claude2026!, a vector database, an image-generation UI โ€” not a legacy dump. The operators maintain their model of you against the technology you actually run. Which yields the case's practical turn: your enemy's wordlist is your best pentest scope.

Dictionary One: The .env List Is a Bet on Your Sloppiness

Read the .env variant list closely, because its structure is an argument:

/.env            /.env.backup     /.env.backup.txt   /.env.bak
/.env.copy       /.env.default    /.env.dev          /.env.dev.local
/.env.development /.env.development.local  /.env.dist  /.env.production

A single /.env probe would just be "do you leak your config." This list is more specific and more knowing. The environment flavours โ€” dev, development, dev.local, production, dist โ€” model an app with multiple environments, the normal shape of a modern deployment. But the load-bearing entries are the backups: .bak, .copy, .backup, .backup.txt. Those do not exist in any framework's default layout. They exist because a human made them โ€” a developer who copied .env to .env.bak before an edit, or a deploy script that snapshotted the config, and left the copy web-reachable and un-gitignored. The dictionary is not betting that your framework leaks; it is betting that a person on your team was careless in a specific, common way. It encodes a theory of human error, and the theory is good enough that 415 IPs run it continuously.

That it is commodity matters as much as its shape. This is not a bespoke tool the wardrobe operators wrote; the l9scan/leakix.net User-Agent on 91 of the hits marks it as shipped in a commercial leak scanner, and the spread across DigitalOcean, AWS, budget hosts and hyperscalers alike shows the whole ecosystem running it. The .env sweep is the most productized credential-harvest primitive on the internet, which means its blueprint of "how apps leak secrets" is a consensus model โ€” the collective belief of the scanning population about where your keys are. When you read it, you are reading not one operator's guess but the industry's.

Dictionary Two: The Credential List Is a Portrait of Your Org Chart

The SSH wordlist from the cross-vector node (086J) is a different kind of blueprint โ€” not of your files but of your people:

deploy:admin@123    deploy:github    git:0000     dev:Dev23!
azureuser:azureuser@1234   ansadmin:admin   claude:Claude2026!

Every username is a role in a modern shop. deploy and dev are the CI/CD and engineering accounts. git is the source-control service account. azureuser is the default admin on an Azure VM. ansadmin is the Ansible control account โ€” the operators expect you to run configuration management. And claude is an AI-era account, someone's name for the box running an assistant. This is not the root:root, admin:admin dictionary of a decade ago; it is a guess about the specific roles that exist at a 2026 engineering organisation, and it is a good guess.

The passwords are their own tell: deploy:github, git:0000, claude:Claude2026! โ€” the password is the tool, or the year, or a trivial pattern. That models a second human failure the operators bet on: the service account whose password was set once, weakly, to something memorable, and never rotated because "it's just the deploy user." The credential list, like the .env list, is a theory of how real teams cut corners โ€” here in who holds a weak key rather than which file leaks one.

Dictionary Three: Your Naming Convention, Turned Against You

The third dictionary is the most revealing, because it shows the attacker learning. When 35.240.197.184 enumerated subdomains, it did not guess generic names like mail, admin, dev. It guessed lsn- ones โ€” lsn-auth, lsn-pgadmin, lsn-redis, lsn-qdrant, lsn-jupyter, lsn-netdata, lsn-llm-factory, lsn-docling, lsn-ai-comfyui. That lsn- prefix is this estate's convention. The operators did not invent it; they learned it โ€” the most plausible route being a single lsn-* host visible in DNS or certificate transparency โ€” and then permuted it against a catalogue of modern services.

Two blueprints are stacked in that list. The prefix is a fact stolen from you: your naming scheme, extracted from one exposed host, which turns "guess a hostname" into "guess a service, prepend lsn-." The service catalogue is the attacker's model of a 2026 stack: an SSO gateway, a Postgres admin, Redis, a vector database (Qdrant), a Jupyter server, monitoring (Netdata), an LLM pipeline, document processing (Docling), image generation (ComfyUI). That is not the service list of an old scanner. It is a current, AI-and-data-native picture of what an interesting target runs, and combined with your own prefix it becomes a precise reconnaissance list: convention ร— catalogue = the exact subdomains worth trying.

The lesson for a defender is uncomfortable and specific: a predictable naming convention is a small information leak. Expose one lsn-* host and you have taught the adversary the pattern for all the private ones. The operability of consistent names trades against a modest recon gift, and the mitigation โ€” where it matters โ€” is names an adversary cannot generate from one example.

The Blueprint Is Current, Which Means the Adversary Is Not Stale

It is worth dwelling on how modern these dictionaries are, because it refutes a comfortable assumption. A defender might suppose the scanning population runs old lists โ€” wp-admin, phpMyAdmin, /administrator โ€” and that anything built after 2023 is below the adversary's horizon. The wordlists say otherwise. claude:Claude2026! is a credential for the AI era. lsn-qdrant targets a vector database that rose with retrieval-augmented generation. lsn-ai-comfyui targets an image-generation UI that barely existed two years ago. lsn-llm-factory and lsn-docling target LLM and document-processing pipelines. The operators are guessing the 2026 AI/data stack, not the 2016 LAMP stack.

That currency is the same signal 086E found in the masks โ€” freshly forged ClaudeBot and GPTBot identities, added the moment those crawler names became trust-bearing. The wordlist and the mask are maintained by the same discipline: the operators track the ecosystem and update their model as it moves. An adversary this current is not defeated by novelty; the moment you deploy a new vector DB, its default subdomain is already in someone's dictionary.

Steelmanning: "A wordlist is generic; you are reading tea leaves"

The fair objection: scanner wordlists are enormous, generic, and copied between tools โ€” reading intent or a "model of the estate" into a list that also contains ten thousand other paths is over-interpretation, and the lsn- prefix could be coincidence or a broad permutation engine rather than deliberate learning.

Three things keep the reading disciplined. First, the case's strongest claims rest on structure, not cherry-picked entries: the .env backup variants (.bak, .copy) are not framework defaults and only make sense as a theory of human error โ€” that is an inference from the list's shape, reproducible by anyone reading it. Second, the lsn- prefix is not generic โ€” it is this estate's specific string, and a permutation engine that tried lsn- had to have lsn- as a seed, which it could only get from observing the estate; the deliberate-learning claim is held at MEDIUM confidence precisely because the route (cert transparency vs a leaked link) is inferred, but that the prefix was learned is nearly certain. Third, the currency claim is checkable against the entries themselves (qdrant, comfyui, Claude2026!) and against the independent evidence of 086E's fresh masks. The objection rightly warns against reading a novel into a wordlist; the case reads only its structure, specificity, and currency, which are properties of the list as found, not projections onto it.

What Holds, and What Is Bounded

Documented, HIGH confidence: the commodity breadth of the .env dictionary (415 IPs, 99 hosts, LeakIX productization); the backup-variant structure of the .env list; the DevOps role-and-tool-password structure of the SSH wordlist; the lsn- subdomain enumeration and its current AI/data catalogue; the wordlist's currency.

Inferred, MEDIUM confidence: the route by which the lsn- convention was learned (DNS/certificate-transparency exposure is the leading hypothesis, not a proven acquisition), and the framing of the dictionaries as a deliberate, maintained "model of the estate" rather than an emergent property of copied tooling โ€” a strong reading of consistent evidence, held as interpretation. The defensive-scope corollary is a recommendation, not a measured control.

Why It Matters

The Wordlist as a Blueprint inverts the series' usual direction. Every other case reads what the attacker shows you โ€” its mask, its behaviour, its provenance. This one reads what the attacker assumes about you, and the assumptions are a mirror. The .env dictionary is the industry's consensus that your secrets are in a file you forgot to gitignore. The credential list is a bet that your deploy user has a weak, unrotated password. The subdomain sweep is your own naming convention, stolen from one host and turned into a map of the rest. Put together, they are the adversary's model of you โ€” current, specific, and, uncomfortably, mostly right.

The practical turn is the gift hidden in that. The paths, accounts, and subdomains the attackers guess are, by definition, the assets a defender should verify are not exposed โ€” and the commodity .env dictionary, run by hundreds of IPs and shipped in commercial scanners, is a free, continuously-updated exposure checklist the adversary maintains on your behalf. Do not only detect the sweeps; harvest their dictionaries. Audit every .env backup variant, rename or lock every guessed service account, and confirm every catalogued subdomain is absent or authenticated. The attacker has already enumerated your attack surface as they see it. The least a defender can do is read the map they left behind.

Cross-references

Next in the series โ€” TI-2026-086S, The Rhythm: the burst timings that fingerprint a fleet independent of any mask it wears.

TLP:WHITE. Attacker dictionaries and impersonated-crawler telemetry only. Credentials shown are attacker-submitted guesses against the honeypot, not real accounts. No internal secrets disclosed.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 18 / 26 Next โ†’