The Neighborhood: A Staging Server Is Never Alone

The Broad Sweep — Part 3

Classification: HIGH · Confidence: HIGH on infrastructure; CALIBRATED on operator identity

The previous letter followed a download record inward, from a Windows binary to the Latvian server that served it, and collapsed two apparent operators into one. This letter follows the same server outward — into the network it lives on, the networks it works with, and the tooling fingerprint that ties them together — and finds that the thing the census filed as a lone Latvian VPS is nothing of the kind. It is one node of a two-network operation embedded in the bulletproof-hosting economy, and the intelligence graph names the other node. A staging server is never alone; it has a neighborhood, and the neighborhood is where attribution actually lives when the payloads themselves — as the last letter showed — cannot be trusted to identify anyone.

Set against it is the second staged-sweep operator, Nexus, whose server sits in a completely different kind of neighborhood: not a bulletproof cluster with a two-network structure, but a lone drop on a commodity reseller, unconnected to anything the graph can see. The same technique — the Mirai-lineage staged sweep dissected earlier — is run by two operators whose infrastructure could not be more different, and reading the neighborhood is what tells them apart when reading the loader cannot.

Whisper scans from one country and stages from another

The single most revealing structural fact about the Whisper operator is that its two functions live on two different networks. The intelligence graph, correlating by shared SSH-client fingerprint and by curated tooling links, resolves the Latvian staging server 31.170.22.205 into a cluster of five addresses — and they do not all belong to the same host, or the same country, or the same job.

31.170.22.196 sits beside the staging server on the same Sia Nano IT range in Latvia (AS43513) — a sibling on the same shelf. But the other three — 185.246.128.133, 193.105.134.45, and 193.105.134.95 — belong to AS42237, "w1n ltd," registered in the United Kingdom, and they are not staging servers. They are the scanning front end: the addresses that brute-force SSH credentials, sharing a single SSH-client fingerprint across all three. The operation is split by function across two networks and two jurisdictions: the credential-cracking happens from w1n ltd in the UK, and the payloads are warehoused on Sia Nano IT in Latvia.

That separation is deliberate and defensive. If the Latvian staging server is taken down, the UK scanners keep cracking hosts — they simply have nowhere to point the loader until a new warehouse is stood up. If the UK scanning addresses are blocked, the Latvian warehouse survives untouched, ready for the next set of scanners. Splitting scanning from staging across independent networks means no single takedown ends the operation; it removes one replaceable component and leaves the other standing. A lone VPS running both jobs is one abuse complaint from death. This operator is not.

The fingerprint the payload couldn't provide

The join that reveals all of this is not a payload match — the previous letter showed the payloads cannot be trusted to identify an operator, since one of them turned out to be a stray Windows binary. It is a HASSH: a fingerprint of the SSH client, computed from the exact set of key-exchange algorithms, ciphers, MACs, and compression methods the client offers when it opens a connection. Different SSH tools offer different sets in different orders, so the HASSH acts as a signature of the software doing the connecting, independent of the source IP or the payload delivered.

The Whisper cluster shares the HASSH 57e4cc8ee36c3d78…, and the honeypot's own campaign detection labels that fingerprint a paramiko_script — a brute-force client built on the Python paramiko SSH library, the tell-tale signature of a custom automation script rather than a stock OpenSSH client. Every scanning address in the cluster presents the identical paramiko fingerprint, which is exactly what you expect when one operator runs one brute-force script from several IPs: the tool is the same, so the fingerprint is the same, even as the addresses rotate. Where the payload could not fingerprint the operator, the client software does — and it does so across the network boundary, tying the UK scanners to the Latvian warehouse by the common thread of the same custom tool reaching out from both sides of the operation. The HASSH is the connective tissue the samples could not supply.

The company the warehouse keeps

Now the neighborhood in the literal, routing sense. The Latvian staging network, Sia Nano IT (AS43513), does not route in isolation — it shares BGP upstream transit with a set of other autonomous systems, and that set reads like a directory of the bulletproof-hosting world. Its BGP neighbors include Digit One LLC and Icewood LLC, both Russian; UARNET / EKSINTECH, Ukrainian; Zenex5ive; and Latitude.sh — and the intelligence platform scores every one of them at or near the maximum risk of 100 and flags them bulletproof. The Latvian warehouse is not a stray cheap VPS that happened to get abused. It sits, by its own routing, in the middle of the criminal-hosting ecosystem — the cluster of Russian, Ukrainian, and shell-company networks that exist precisely because they answer no abuse complaints and honor no takedown requests.

That placement is a choice, and the choice is intent. An operator who wanted legitimate, responsive hosting would not be routing beside Digit One and Icewood; an operator who wanted their payload warehouse to survive is exactly there, because survival is what that neighborhood sells. The neighborhood is therefore attribution of a kind the payload can never provide: it tells you not who the operator is, but what economy they belong to — and belonging to the bulletproof economy is itself a strong statement about an operator's seriousness, budget, and expectation of longevity. A hobbyist rents a cheap VPS and loses it to the first complaint. This operator bought into the neighborhood that does not process complaints, and staged its payloads there on purpose.

And it is not new to us. The Sia Nano IT ASN surfaces in this platform's own prior published work — the "Download Arsenal" dossier catalogued it among the download-server networks — which means the Whisper operator chose a warehouse district this investigation has documented before as a fixture of the payload-hosting economy. The neighborhood is a repeat location, not a one-off.

What the routing actually tells you

It is worth being precise about why a network's BGP neighbors are evidence, because the reasoning is not obvious and the bound on it matters. Autonomous systems do not choose their neighbors at random; they buy transit from, and peer with, the networks that will carry their traffic — and the bulletproof-hosting world is a relatively small, interconnected set of networks that carry each other's traffic because the mainstream transit providers increasingly will not. When a small hosting AS routes its traffic through the same upstreams as Digit One and Icewood, it is not a coincidence of geography; it is a statement about which part of the internet's plumbing is willing to keep that AS reachable. Legitimate hosts route through legitimate transit and get de-peered when they misbehave; the bulletproof cluster routes through the handful of upstreams that do not de-peer for abuse, and so they end up as each other's neighbors by a kind of natural selection — the networks nobody else will carry pool together with the networks that will carry anybody.

That is what makes the neighborhood a signal rather than a smear. It does not assert that Sia Nano IT is Digit One, or that the Whisper operator is Russian, or that these networks share an owner. It asserts something narrower and more defensible: that Sia Nano IT has chosen, or been driven, into the routing vicinity that tolerates abuse, and that an operator staging payloads there has selected a warehouse in exactly the district built to survive complaints. The risk score of 100 on those neighbors is not a verdict on Whisper; it is a description of the block Whisper decided to live on. And for a defender, the block is actionable in a way the individual tenant is not: an operator embedded in that routing neighborhood will keep re-emerging within it, so the neighborhood — not the address — is the thing worth watching, because it is the thing the operator will not leave.

Nexus keeps entirely different company

The contrast with the second staged-sweep operator is the whole point, because it shows that the technique does not determine the operator. Nexus — the 472-byte loader that fetches from 202.155.10.112 and disguises its payload as sshd — runs the same Mirai-lineage staged sweep as Whisper. Its neighborhood is nothing alike.

Its server resolves to AS212238, CDNEXT / Datacamp Limited, a commodity United Kingdom hosting reseller, on an APNIC prefix registered to Indonesia, with twenty-three assorted domains behind it — dynamic-DNS names like synology.me, cg-dialup.net dial-up-style PTRs, datapacket.com datacenter reverse records — the mixed, unremarkable tenancy of a general-purpose reseller. And when the graph is asked what else connects to this address — shared fingerprints, shared tooling, cluster membership — it returns nothing. Zero relations. Nexus's server is isolated: no HASSH cluster, no sibling scanners, no two-network structure, no bulletproof neighbors. It is a lone drop on rented commodity space.

Two operators, one technique, two neighborhoods. Whisper is a structured crew: scanning and staging split across two abuse-tolerant networks, tied by a shared paramiko fingerprint, embedded in the bulletproof economy, in a district we have documented before. Nexus is a transient: one loader, one commodity reseller, no connective tissue the graph can find. Reading only the loaders — both Mirai-lineage, both multi-architecture, both staging externally — they look like the same kind of thing. Reading the neighborhood, they are a professional operation and a passing renter, and the difference matters enormously for how each should be tracked and taken down.

A small tight cluster in a sea of huge loose ones

Placing Whisper's paramiko cluster against the honeypot's other scanning fabric sharpens what kind of operation it is. The sensor's campaign detection is dominated by a few enormous HASSH clusters: a libssh_0.9.6 fingerprint shared by 421 IPs across 59 countries running fourteen thousand login attempts; a Go_SSH fingerprint shared by 320 IPs across 43 countries. These are the mass, sprawling, commodity brute-force botnets — huge, geographically scattered, loosely coordinated populations all running the same stock library, the background roar of the internet's credential-guessing.

Whisper's paramiko cluster is the opposite shape. It is small — a handful of IPs, not hundreds — and tight: a single custom paramiko script, confined to two named networks, tied to a specific staging warehouse. Where the libssh and Go_SSH clusters are broad and anonymous, a fingerprint shared by a cast of thousands that identifies no one in particular, the paramiko cluster is narrow and attributable, a bespoke tool run by a specific small operation. The size difference is a sophistication difference. The giant clusters are rented or commodity botnets spraying with off-the-shelf libraries; the small paramiko cluster is a crew that wrote its own scanner and runs it, deliberately, from infrastructure it curated. In a corpus where most scanning is a faceless roar, Whisper's scanning has a face — a small, consistent, custom-tooled one — and that is precisely why the graph could resolve its two-network structure at all. You cannot cluster a fingerprint shared by four hundred strangers into an operator; you can cluster one shared by five addresses running one custom script into exactly the crew that wrote it.

The architecture is a maturity tell

The two-network split is worth reading as an organizational fact, because it mirrors, in criminal form, exactly the architecture a competent legitimate service adopts: a front end that faces the world and takes the abuse, separated from an origin that holds the valuable assets and is kept quieter and better protected. A real web service puts a CDN in front of an origin server for the same reasons the Whisper operator puts UK scanners in front of a Latvian warehouse — so that the exposed, attacked, frequently-blocked component can be replaced without touching the component that actually matters. That an SSH mining operation has independently arrived at front-end/origin separation is a sign of operational maturity that the crude single-file loaders would never suggest on their own. The loader looks like a script kiddie's Mirai fork; the infrastructure behind it is organized like a small service provider. It is another instance of the gap this series keeps finding between how simple these operations look at the payload and how considered they are underneath — and it is one more reason the neighborhood, not the loader, is where the operator's real capability shows. A hobbyist does not separate scanning from staging across two abuse-tolerant networks in two countries. Someone running this as a business does.

Defense: the durable unit is the neighborhood, not the address

The operational lesson is that individual IPs are the least durable thing to act on, and the neighborhood is the most. A staging IP can rotate in minutes; a scanning IP is disposable by design. But the ASN an operator chose (Sia Nano IT, w1n ltd), the prefix they route in, and the tooling fingerprint they carry (the paramiko HASSH 57e4cc8e) all persist across IP rotation, because they are the parts of the operation that cost something to change. Blocking 31.170.22.205 inconveniences the operator until their next VPS; monitoring the paramiko HASSH catches their scanners no matter which address they spray from; treating the bulletproof neighborhood as suspect pre-empts the next warehouse before it is even used, because an operator embedded in that economy will stage their next payload in the same district.

There is a general form of this worth stating. When an operator's payloads are unreliable identifiers — and the previous letter proved they can be, resolving to a stray Windows file — the stable identifiers move up the stack: from the byte (which can be wrong) to the URL (which named the server), to the ASN and prefix (which named the neighborhood), to the client fingerprint (which named the tool), to the graph edges (which named the two-network structure). Each rung is more durable than the last and harder for the operator to shed. The census's method — count durable artifacts, not labels — extends cleanly here: the most durable artifact of a staging operator is not any file it serves but the neighborhood it serves from and the tool it serves with, and both are exactly what the intelligence graph is built to hold.

Bounds and limits

DOCUMENTED, first-party and enrichment: 31.170.22.205 and 31.170.22.196 on AS43513 (Sia Nano IT, Latvia); 185.246.128.133, 193.105.134.45, 193.105.134.95 on AS42237 (w1n ltd, GB); the shared HASSH 57e4cc8ee36c3d78… labeled paramiko_script across the scanning cluster; Sia Nano IT's BGP-upstream adjacency to Digit One (RU), Icewood (RU), UARNET/EKSINTECH (UA), Zenex5ive, and Latitude.sh, all scored ~100 and flagged bulletproof; Nexus's server on AS212238 (CDNEXT/Datacamp) with 23 domains behind it and zero graph relations; and Sia Nano IT's prior appearance in this platform's published "Download Arsenal" work.

INFERRED, high confidence: that Whisper splits scanning (w1n ltd) from staging (Sia Nano IT) across two networks for resilience (the functional split and the shared fingerprint make this the natural reading); that the neighborhood placement is a deliberate choice of the bulletproof economy (an operator routing beside Digit One and Icewood is there for the properties that neighborhood sells). INFERRED, moderate confidence: that Nexus is a transient lone renter rather than a structured crew (its graph isolation supports this, but isolation can also reflect under-observation of a single drop).

BOUNDED — and these bounds matter for attribution: the two-network join rests on shared-HASSH and curated entity-resolution edges at ~0.85 confidence, which is a strong software-and-tooling correlation, not a payload match or a proof of common ownership. "Bulletproof neighborhood" means BGP-upstream adjacency — shared transit — which places the operator in the ecosystem's routing vicinity but does not make the operator identical to the Russian and Ukrainian networks it routes beside; it is the district they chose, not proof of who they are. The paramiko cluster's 100% login-success figure is against the honeypot, which accepts credentials, so it measures the tool's activity, not real-world success. And Nexus's zero relations may understate its connections if the sensor simply saw too little of it.

None of these bounds change the finding. The lone Latvian VPS the census recorded is one node of a two-country operation — UK scanners, Latvian warehouse, one paramiko tool, a bulletproof neighborhood, a district we have mapped before. Its counterpart runs the identical technique from a commodity reseller with no neighborhood at all. A staging server is never alone; and when the payloads it serves cannot be trusted to name their operator, the network it serves from, the company that network keeps, and the tool that reaches out from it will.

This is Part Three of The Broad Sweep. Part Two corrected who the payloads belonged to; this part mapped the infrastructure behind them. Part Four returns to the victim's shell — to the reconnaissance preamble the breadth operators run before they drop anything, and the exhaustive arch-detection oracle that is the front half of the same everything-covering philosophy their multi-architecture payloads are the back half of.