TI-2026-095B — The Tunnel Scout: A One-Shot Probe That Interviews the Box for a Proxy Job

Classification: HIGH · Forensic threat intelligence · Honeypot-derived · Series: Below the Noise Floor

The loud attackers announce themselves — a thousand IPs hammering admin/admin, the same dropper command a hundred times a day. This one came once. On 2026-04-17 a single address logged in, asked the box a short list of very specific questions, ran whoami, and left. It planted nothing. But the questions give it away: every one of them is a question a proxy recruiter asks. It was not looking to mine the host or enlist it in a flood — it was interviewing the box for a job as a covert relay, and grading whether it was worth hiring.

1. One Session, Two Commands

The entire encounter, from the threat_intel record:

Two commands, one visit, nothing installed. A bot repeats; a recruiter grades and moves on. This reads as the latter.

2. The Interview

Stripped to its questions, the probe asks the box the following — and the grouping is the whole story:

# capability: can this host forward / tunnel / relay?
grep -iE 'AllowTcpForwarding|DisableForwarding|PermitTunnel|GatewayPorts|ForceCommand' /etc/ssh/sshd_config

# tooling: are the relay tools here — or installable?
which socat curl wget python3 python ncat chisel gost
which apt yum apk opkg dnf pacman zypper
sudo -n true && echo SUDOOK
touch /tmp/.sshprobe && rm /tmp/.sshprobe && echo OK

# exposure: what is it already serving?
ss -tlnp || netstat -tlnp

# grade: is it a network appliance (the prize)?
/system resource print          # MikroTik RouterOS
cat /etc/openwrt_release        # OpenWRT
cat /etc/version                # Ubiquiti / EdgeOS

(alongside routine uname/id/os-release/nproc/df context). Read top to bottom, it is a single coherent objective expressed as a checklist.

3. Why Each Question Is a Relay Question

The forwarding grep is the tell. Those five sshd_config directives are exactly the ones that decide whether a host can be an SSH tunnel or jump box. AllowTcpForwarding and PermitTunnel switch forwarding and tun devices on; GatewayPorts lets a forwarded port bind to every interface, turning the box into a publicly reachable relay; DisableForwarding and ForceCommand would shut all of that down. A miner does not care about forwarding policy. A DDoS bot does not care. A relay recruiter cares about nothing else first.

chisel and gost are not generic tools. The which list hides them among curl and wget, but they are purpose-built: chisel tunnels TCP/UDP over a single HTTP port; gost is a multi-protocol proxy/relay. Probing for them — and then checking every package manager and passwordless sudo — is an operator asking "is the tunnel software already here, and if not, can I install it right now?"

The appliance checks name the prize. /system resource print (MikroTik), /etc/openwrt_release (OpenWRT), /etc/version (Ubiquiti) — three ways to ask "are you a router?" Edge appliances are the best relays on the internet: always powered, long-lived IPs, almost never patched, almost never logged. A generic VPS is usable; a forgotten router is ideal. The scout grades accordingly.

Put together, the probe is a suitability audit: can you forward, can you tunnel, what are you exposing, and are you the kind of box worth keeping?

4. The Silence After

It ran the audit, ran whoami, and left — no download, no key, no cron, no implant. That absence is not a failure; it is the phase. The product of this step is information: a graded entry in a catalog of candidate relays, to be acted on later or sold as access to someone who builds the tunnel. We caught the reconnaissance half of a proxy-network build, in isolation, before any relay was stood up.

This is what "below the noise floor" means. Nothing here trips a volume threshold. One login, one probe. The intent is invisible to anything counting events and obvious to anything reading them.

5. The Origin

87.251.64.146 sits in AS200730, and the registration tells its own small story:

A small hosting AS with a Russian maintainer handle, a Kazakh domain, a Polish RDAP country, and a maxed-out abuse score. Per this program's standing rule, the three-way country split is recorded, not resolved — the disagreement is the finding. What it adds up to is a low-attribution, high-abuse rent-a-box: exactly the kind of origin from which cheap, disposable scouting is launched.

6. The Counter-Narrative

Steelman: "This is just a generic recon script. Every post-exploitation toolkit runs uname and which. You are reading intent into a checklist and you never even saw a second command."

Where it holds, and where it breaks:

• Generic recon does not grep sshd_config for GatewayPorts. The forwarding-directive read has one purpose. A script that merely wanted to profile the host would run uname/id and stop; this one specifically interrogates relay capability.
• Generic recon does not which chisel gost. Those two names are the intent, stated aloud. You do not check for a multi-protocol proxy tool unless a proxy is the plan.
• The single visit is the point, not a gap. We are explicit that we observed the grading, not the recruitment — the downstream is inferred (MEDIUM), and we say so. But the grading itself is captured in full, and it is unambiguous about what was being graded.

What is not claimed: a named actor (unattributed — the origin is a rent-a-box), a botnet size (one host, one session — the technique and intent are the finding), or that a relay was actually installed here (it was not; this is the triage phase).

Confidence: HIGH that this is a proxy/tunnel suitability audit — a relay-recruitment reconnaissance probe — from a single operator; MEDIUM on the downstream (whether this host was later recruited or sold) and on operator identity.

7. Defence Response

• Alert on the audit, not the outcome. The one-command combination of a forwarding-directive grep (AllowTcpForwarding|PermitTunnel|GatewayPorts|ForceCommand), a which that includes chisel/gost, ss -tlnp, and reads of /etc/openwrt_release + /etc/version + a MikroTik /system resource print is a near-zero-false-positive proxy-recruitment signature. No legitimate admin interviews a freshly-logged-in box this way. It fires at reconnaissance, before any relay exists.
• Set the forwarding policy the scout is checking. If a host has no business forwarding, make its sshd_config say so — AllowTcpForwarding no, GatewayPorts no, and a ForceCommand/DisableForwarding where appropriate. The scout reads these to decide suitability; configure them so the answer is no.
• Watch the edge devices hardest. The scout grades MikroTik/OpenWRT/Ubiquiti highest because they are the least monitored. Bring appliance SSH logs into the same visibility as servers; a router that suddenly forwards is the relay this recon was shopping for.
• And, as ever: admin/admin opened the door. These audits only run against hosts that already let a guessable credential in.

8. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence