The Tenant's Second Floor: The Same Tool, a Borrowed Bank, a Faceless Operator

TI-2026-088L — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH for the tenant's presence on the TechTies floor and the second dual-origin finding (direct honeypot + RIPE evidence); the tenant's identity remains unestablished — and that persistence, across two floors, is itself the finding.

The finding in one paragraph

088K left one thread standing: a twelve-host 91.92.40.x sub-block on AS197170 (TechTies, Seychelles) — the rival bulletproof host — tied by the graph to the DMZHOST tenant. This letter follows it onto that second floor and finds two things worth the trip and one worth admitting. First, the shared tenant is confirmed to be The Appraiser (088D): its bespoke GPU-triage profiler runs, verbatim, on all twelve TechTies hosts, and its scanner fingerprint forms a single 38-host cluster spanning both floors. That is the tenant's own tool — not commodity overlap — appearing on two competing landlords' networks, the cleanest proof yet of the multi-host-tenant model this series has argued since 088D. Second, TechTies runs the same structural trick as DMZHOST: 91.92.40.0/24 carries two route objects under one maintainer (mnt-bg-eurocrypt-1) — the exact dual-origin failover pattern that 088F used to prove DMZHOST's two ASNs are one operator — except here the second origin is a repurposed, dormant Ukrainian bank ASN (AS209630, "LLC VASH KREDIT BANK", Donetsk). And third, the admission: for all of that, the second floor does not name the tenant — no SSH key, no captured sample, no C2 domain, no naming credential, on either floor. The operator is confirmed, mapped across two hosts, and still faceless. That is the honest state of the attribution, reported plainly.

1. The tenant confirmed — its own tool on the rival's floor

Every prior letter that touched the shared tenant had to lean on commodity signals — a popular scanner HASSH, a common wordlist — which are weak evidence of one actor. This floor supplies the strong signal the others lacked: the Appraiser's bespoke reconnaissance script, the one described in 088D, running character-for-character on all twelve TechTies hosts.

The captured chain is unmistakable and specific: uname -s -v -n -m with the same multi-fallback cascade (/proc/version, /etc/os-release), then nproc / lscpu, then the tell — lspci | grep -i nvidia — followed by the same anti-honeypot xxxxxx sentinel self-test the Appraiser uses to fingerprint a shell before it trusts it. The entity graph records this as a shared_commands cluster with 505 hits across 26 IPs spanning both floors. This is not a wordlist that a thousand actors share; it is one operator's particular way of appraising a box for its GPU before deciding whether to commit — and it is on DMZHOST and on TechTies.

The scanner fingerprint corroborates it. HASSH 2ec37a7cc8daf20b10e1ad6221061ca5 (a Go crypto/SSH scanner) forms a single 38-host cluster that reaches across both landlords in one set: the DMZHOST side (195.178.110.217/.227/.228/.232), all twelve TechTies hosts, and the wider RO cluster (92.118.39.x, 80.94.92.x, 2.57.122.x). One tenant, one scanner build, one recon script, two rival hosts.

A discriminating detail, because precision is the point. The other named HASSH in this series — 16443846184eafde36765c9bab2f4397 (the commodity Go_SSH/zgrab2 scanner shared by 486 unrelated IPs worldwide) — is absent from all twelve target hosts. It appears on other 91.92.40.x addresses (.23, .27, .41, .45…), which is exactly what you would expect of a commodity fingerprint on a shared bulletproof /24: it tags the general tenant population, not this specific operator. The tenant's footprint is defined by the bespoke profiler and the 2ec37a7c build, and it does not include the commodity 16443846 noise. That distinction — keeping the operator's own tool separate from the ambient commodity scanning around it — is what makes the cross-floor identification a real link rather than another tooling coincidence.

[DOCUMENTED] The Appraiser's bespoke GPU-profiler and its 2ec37a7c scanner fingerprint run on all twelve 91.92.40.x TechTies hosts and cluster with the DMZHOST side (38-host set) — the same tenant on two rival floors.

2. The twelve hosts — a per-IP map

The sub-block is a working, currently-banned attack surface. All twelve carry the 2ec37a7c HASSH; none carries a captured sample or download:

Only one host, .176, carries a named malware family — Mirai, the most generic IoT-botnet label there is, and (like the AdaptixC2 on the DMZHOST side) a commodity capability, not a tenant fingerprint. Across the entire AS197170 (95 active IPs, 84,661 attempts, 2,164 commands) the honeypot recorded zero downloads, zero retained samples, and zero shared-SSH-key edges. The TechTies floor is, if anything, a thinner data surface than DMZHOST — the same behaviours, fewer artifacts. The whole 91.92.40.0/24 prefix is actively banned on the LSN perimeter (CrowdSec blacklist, refreshed through 2026-07-22), and AS197170 is Spamhaus ASN-DROP, bulletproof, risk 85.4.

[DOCUMENTED] All twelve hosts are active, 2ec37a7c-fingerprinted, currently banned; only .176 carries a (commodity Mirai) family; zero samples/downloads/keys ASN-wide.

3. The second dual-origin — the same trick, a darker second face

The structural discovery on this floor is that TechTies uses the exact failover mechanism 088F documented for DMZHOST. RIPE shows the 91.92.40.0/24 inetnum carrying two route objects:

• route: 91.92.40.0/24 · origin: AS197170 · mnt-by: mnt-bg-eurocrypt-1 (created 2026-06-10)
• route: 91.92.40.0/24 · origin: AS209630 · mnt-by: mnt-bg-eurocrypt-1 (created 2026-06-08)

Both route objects are signed by the same maintainer, mnt-bg-eurocrypt-1. As 088F established, a single maintainer authenticating two origin claims for one prefix is not coincidental multihoming — it is one credential-holder pre-authorising itself, in RIPE's own database, to fly the prefix under either ASN. TechTies has built the identical routing-resilience apparatus DMZHOST built: a prefix portable between two autonomous systems at will.

But the second origin is where the two hosts diverge, and it is genuinely striking. DMZHOST's second origin (in 088F) was its own sister shell (AS48090↔AS47890). TechTies' second origin, AS209630, is KREDIT-AS — "LLC VASH KREDIT BANK", of Donetsk, Ukraine (reg-nr 36011085), with an admin contact Garbuz Vadim and — for a bank's autonomous system — a ProtonMail abuse address (ripe.abuse@proton.me). AS209630 has zero honeypot footprint of its own: it originates no observed attacks, hosts no observed nodes. It exists in this picture purely as a second route path for the TechTies prefix. A dormant-looking Ukrainian bank ASN, with a consumer-webmail abuse contact, suddenly re-announcing a Seychelles hosting /24 in June 2026, is the signature of a leased or hijacked autonomous system — an ASN that belongs (on paper) to a defunct or captured entity, pressed into service as disposable routing. This report does not prove a hijack (that would require the bank's own confirmation and BGP-history forensics beyond this pass); it documents the pattern and names it for what it most resembles.

[DOCUMENTED] 91.92.40.0/24 has two route objects (AS197170 + AS209630) under one maintainer mnt-bg-eurocrypt-1 — a same-maintainer dual-origin identical to 088F; AS209630 is a Ukrainian bank ASN with a ProtonMail abuse contact and zero own traffic. [INFERRED] AS209630 is a leased/repurposed dormant ASN used as a disposable second route path.

4. TechTies, too, is assembled from rented parts

Look at who maintains TechTies and the same theme from 088K — rented all the way down — reappears one host over. The mnt-bg-eurocrypt-1 maintainer that signs both route objects is a Bulgarian LIR handle, and it sits on the TechTies (Seychelles) organisation object alongside a whole cluster of others: techties-mnt, NETERRA-MNT, MNT-ZEXOTEK, mnt-de-xsserver-1, mnt-nl-skylink2-1. A Seychelles shell company whose RIPE object is co-maintained by a scatter of Bulgarian, German, and Dutch LIR handles is not the registry footprint of a single real operating company; it is the footprint of an ASN assembled through resellers and proxy registrars — the same "purchase the registry credibility, own none of the substance" pattern the DMZHOST shells showed in 088G, executed through a different jurisdiction's intermediaries. Two rival bulletproof hosts, the same underlying method: rent the shell, rent the maintainers, borrow a disposable second ASN, and keep no single component load-bearing. The competitors are not related — 088H proved that — but they shop the same suppliers.

5. What the second floor did not do — name the tenant

The reason to visit a second floor is the hope that the operator was sloppier there — reused a personal SSH key, dropped a sample with a builder artifact, called back to a naming domain. The Appraiser was not. Across AS197170's 95 IPs and specifically across the twelve-host footprint: shared_ssh_keys: [], campaigns: [], downloads_total: 0. No captured binary, no C2 domain, no operator-naming credential, no key that a shared_ssh_key edge (the entity graph's strongest same-operator signal, confidence 0.90) could pin to a person. The tenant's discipline is symmetric: it is exactly as careful on TechTies as on DMZHOST, and it leaves exactly as little.

So the honest attribution stands where 088D put it, now confirmed twice: the tenant is a coherent, single actor — the same bespoke profiler, the same scanner build, the same GPU-hunting objective — operating across at least two rival bulletproof hosts, and it is unnamed. Confirming an operator's coherence and reach while conceding its identity is not a failure of the investigation; it is the accurate output of it. We can say with confidence what the tenant does and where; we cannot yet say who, and inventing a who would betray everything the series has built.

[DOCUMENTED] No SSH key, sample, C2 domain, or naming credential on the TechTies floor (or the DMZHOST floor). [CONCEDED] the tenant remains unnamed; it is confirmed as one coherent multi-host actor, no more.

6. Seven questions

Q1. Is a shared recon script really stronger evidence than a shared HASSH? Yes, decisively. A HASSH is a client build thousands share; a bespoke, multi-fallback uname→nproc→lspci-nvidia→xxxxxx-sentinel chain is one operator's particular procedure. Commodity fingerprints suggest a shared population; a bespoke script identifies a shared actor. The profiler is the difference between "same kind of tenant" and "the same tenant."

Q2. Why is the commodity 16443846 HASSH absent from the twelve? Because the twelve are defined by the tenant, and the tenant runs 2ec37a7c and the profiler. 16443846 is ambient commodity scanning that touches other addresses on the shared /24. Its absence from the tenant's own hosts is a feature of the identification, not a gap — it shows the footprint was drawn around an operator, not around a prefix.

Q3. A bank's ASN announcing a bulletproof prefix — isn't that just a data error? It is possible, but the pattern argues otherwise: a same-maintainer route object (deliberately created 2026-06-08), a bank ASN with a ProtonMail abuse contact, and zero own traffic. Errors don't get co-signed into a dual-origin apparatus by the prefix's maintainer. This looks built, not mistaken — though "leased vs hijacked" is left open.

Q4. Does the AS209630 finding change the attribution of TechTies? It sharpens it. TechTies (088H) is a separate operator from DMZHOST; this shows it is a sophisticated one, running the same maintainer-signed dual-origin failover and sourcing a disposable second ASN — the mark of an operator that expects to be blocked and engineers around it, exactly like DMZHOST, independently.

Q5. If the tenant is so careful, how do we know it's one actor and not several? Because the bespoke elements are constant: the same profiler script, byte-for-byte, on both floors. Multiple independent actors do not converge on an identical custom reconnaissance cascade including the same nonsense-command sentinel. Commodity tools can be shared; a specific homemade procedure is a signature.

Q6. Why does the tenant stay unnamed across two floors? Because it never brings anything personal to the floor. It logs in with commodity credentials, runs a script that touches nothing identifying, and — where it drops at all — fetches commodity binaries from third-party clouds (088K). It carries no SSH key, no builder-stamped sample, no callback domain of its own. The anonymity is operational discipline, not our blindness.

Q7. What single artifact would finally name it? A reused private SSH key linking the operator across hosts (a shared_ssh_key edge — absent here), a captured meow-style binary with a builder watermark or an embedded C2 the operator controls, or a credential/username that is the operator's own rather than a target's default. None has appeared across two floors. The next floor — or a captured sample — might; this one did not.

7. The counter-narrative, steelmanned — then defeated

Steelman: "You have twelve IPs on a bulletproof /24 running a common scanner and default passwords, plus a weird bank ASN in a route object. That is ordinary bulletproof-hosting mess. Calling the profiler 'bespoke' and the dual-origin a 'trick' is you dressing up noise, and admitting you can't name anyone proves the thread is thin."

Defeat: The profiler is not a common scanner — it is a specific, multi-fallback, GPU-targeting, sentinel-testing shell procedure that the entity graph tracks as one shared_commands cluster (505 hits) across both floors; commodity tools were explicitly excluded (the 16443846 HASSH is absent from the twelve). That is the opposite of noise: it is the one signal in this whole series that is both bespoke and cross-host. The dual-origin is not dressing — it is a maintainer-authenticated RIPE construct, the identical mechanism 088F used and defended, now independently present on TechTies with a bank ASN as its second origin. And "can't name the operator" is not a thin thread; it is a calibrated one. The investigation proves reach and coherence to HIGH confidence and stops exactly at identity, which the evidence does not reach. A thread that knew its own limit is stronger than one that guessed past it.

8. Read between the lines

Two rival landlords, one tenant, and the same playbook on every layer. The tenant brings the same homemade tool to both floors and its own name to neither. The hosts, though genuinely separate (088H), independently converge on the identical techniques — the maintainer-signed dual-origin, the reseller-assembled shell, the disposable second ASN — because those techniques are simply what works in this market, and the market teaches every participant the same lessons. TechTies even out-does DMZHOST on one axis: where DMZHOST's second origin was its own sister shell, TechTies borrows a dormant bank's autonomous system, a resource with a real institution's name on it and (apparently) no one minding it. That is the frontier this floor exposes — bulletproof operators reaching past shell companies and offshore addresses into the abandoned corners of the legitimate routing table, repurposing the ASNs of defunct or captured entities as disposable infrastructure. The tenant's facelessness and the host's borrowed bank are the same phenomenon seen from two ends: an ecosystem where identity is the one thing nobody supplies, because supplying it is the only thing that gets you caught.

9. What if

What if attribution stopped treating "unnamed" as unfinished? The Appraiser is now a fully characterised actor — bespoke profiler, GPU-hunting objective, two confirmed host relationships, symmetric operational discipline — lacking only a legal name. That profile is actionable without the name: its profiler script, its 2ec37a7c build, and its GPU-triage behaviour are all detectable signatures a defender can hunt on any host, so the tenant can be found on its third and fourth floors the moment it appears. And the AS209630 finding hands enforcement a different lever entirely: a route object binding a Seychelles prefix to a Ukrainian bank's ASN under a Bulgarian maintainer is a filable anomaly at the RIR level — RIPE can question a maintainer that co-signs a bank ASN into a bulletproof prefix. You do not need the tenant's name to track its tool, and you do not need the host's name to challenge its routing. Name-lessness is a gap in the biography, not in the case.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

Tenant footprint (TechTies floor, AS197170):
  91.92.40.{5,6,7,10,11,13,176,204,231,233,237,240}   all HASSH 2ec37a7cc8daf20b10e1ad6221061ca5
  .176 = ThreatFox Mirai (commodity)  |  all currently banned (CrowdSec, thru 2026-07-22)
Tenant signature (cross-floor):
  bespoke GPU-profiler: uname -s -v -n -m -> /proc/version -> /etc/os-release -> nproc/lscpu -> lspci|grep -i nvidia -> xxxxxx sentinel
  38-host 2ec37a7c cluster: DMZHOST 195.178.110.217/.227/.228/.232 + all 12 TechTies + RO 92.118.39.x/80.94.92.x/2.57.122.x
  (commodity HASSH 16443846184eafde… = NOT on the 12 — excluded as noise)

TechTies dual-origin (the 088F echo):
  route 91.92.40.0/24 origin AS197170   mnt-by mnt-bg-eurocrypt-1   created 2026-06-10
  route 91.92.40.0/24 origin AS209630   mnt-by mnt-bg-eurocrypt-1   created 2026-06-08   <-- same maintainer
  AS209630 = KREDIT-AS "LLC VASH KREDIT BANK" (Donetsk, UA, reg 36011085) | abuse ripe.abuse@proton.me | 0 own traffic
  TechTies org co-maintainers: techties-mnt, mnt-bg-eurocrypt-1, NETERRA-MNT, MNT-ZEXOTEK, mnt-de-xsserver-1, mnt-nl-skylink2-1

NOT FOUND (conceded): shared_ssh_key [], campaigns [], downloads_total 0 (ASN-wide) — tenant unnamed

Defensive action: hunt the tenant by its portable bespoke signatures — the GPU-profiler command chain and the 2ec37a7c HASSH — on any host, since it will reappear on new floors under new commodity cover. Track the AS209630/mnt-bg-eurocrypt-1 dual-origin as a filable RIR anomaly (a bank ASN co-signed into a bulletproof prefix). Do not wait for a name to act: the actor is fully characterised behaviourally and is blockable and trackable without one.

12. Sources

LSN honeypot (sec_intel_ip_dossier ×12 for the sub-block; honeypot_fingerprint_coordination for the 38-host 2ec37a7c cluster; shared_commands for the Appraiser profiler; sec_intel_asn_dossier(197170) for the empty samples/keys/campaigns; honeypot_ioc_feed for ban status); RIPE NCC whois (sec_whois_lookup — the 91.92.40.0/24 dual-origin route objects, mnt-bg-eurocrypt-1, and AS209630 = LLC VASH KREDIT BANK); ThreatFox (.176 Mirai), VirusTotal, OTX (per-IP). Cross-references: 088D (the Appraiser), 088F (the dual-origin proof), 088H (TechTies as a separate operator), 088K (rented-all-the-way-down). TLP:WHITE.