🔑 Executive Summary

The Trident (DOSSIER-019I) has become The Quadrant. What was presented as three coordinated entities is now proven to be a four-vertex corporate shell structure operating the largest bulletproof hosting operation we have encountered — with direct hosting of Russian darknet market mirrors (Kraken, Mega), industrialized crypto fraud ("pig butchering"), pharmaceutical spam, and phishing infrastructure.

The corporate structure uses five jurisdictions (UK, Ukraine, Sweden, Panama, Seychelles) to create legal opacity, while the technical fingerprints prove unified operational control.

Combined: 11,293 sessions, 11,029 successful logins (97.7%) across 28 IPs over 81 consecutive days.

🏢 w1n ltd — The Corporate Autopsy

UK Companies House (company number 14123971) reveals a textbook bulletproof hosting shell:

The Three-Layer Corporate Stack

w1n ltd (UK shell, "dormant", £1 capital, Doncaster mailbox)
  └── lir-uk-win-1-MNT (RIPE LIR, controls AS42237 since 2022-10-18)
        └── ICME Networks (operational network brand, icmenet.com — also blank)
              └── Sweden Dedicated Ltd (customer-facing hosting brand)
                    └── Stockholm data centers (physical infrastructure)
                          └── MNT-SWEDEDI admin: 103 Sham Peng Tong Plaza, Mahé, SEYCHELLES

The Seychelles link: Sweden Dedicated's RIPE admin maintainer (MNT-SWEDEDI) is registered to 103 Sham Peng Tong Plaza, Victoria, Mahé, Seychelles — a well-documented virtual office address. This is the same jurisdiction as OMEGATECH LTD. Given the shared HASSH fingerprint evidence from DOSSIER-019I, this constitutes a geographic corroboration of technical attribution.

🌐 What w1n ltd Actually Hosts

Despite filing as "dormant," AS42237 hosts 4,499 domains across 1,792 IPv4 addresses:

"sprut.name" (Russian спрут = octopus, slang for criminal network) uses the same nameservers and SPF records as offshorehosting.name — this IS w1n's business model: hosting-as-a-service for criminals.

🔬 55 Faces, One Fingerprint

IP 185.246.128.133 rotates 55 different SSH client version strings — from SSH-2.0-OpenSSH_3.9p1 (2004 vintage) to SSH-2.0-paramiko_2.1.2 (2017). Each gets ~70-80 sessions (even distribution = automated rotation). Includes PuTTY, WinSCP, paramiko, libssh, JSCH, Nmap, Granados, CoreLab.

But the HASSH fingerprint (57e4cc8ee36c3d78) remains constant — because HASSH is computed from key exchange algorithm negotiation, not the banner. Only 4 IPs globally share this fingerprint:

The fourth vertex: Nano IT (Latvia) uses the same tool, same credentials (admin:admin, admin:123456), same silent login behavior. A separate AS for operational resilience.

⏱️ 81-Day Campaign — Temporal Forensics

Day        | w1n  | PLI   | OMEGA | Event
-----------+------+-------+-------+-----------------------------------
2026-03-21 |   39 |    38 |     0 | Both start SAME DAY
2026-03-24 |   70 |    61 |    15 | OMEGATECH joins (profiling begins)
2026-03-29 |   74 |   595 |    68 | PLI BURST — mass validation event
2026-04-05 |    4 |    30 |    69 | OMEGATECH's LAST DAY
2026-04-06 |   58 |    26 |     0 | OMEGA gone. Profiling complete.
2026-05-23 |   76 | 2,774 |     0 | PLI MASSIVE BURST — pre-sale?
2026-05-27 |   78 |    24 |     0 | Nano IT appears (new node test)
2026-06-04 |   72 |    24 |     0 | Nano IT last seen
2026-06-09 |   39 |    13 |     0 | STILL RUNNING TODAY

Key patterns: Synchronized start (March 21). OMEGATECH's 12-day profiling window then permanent decommission. Two PLI burst events (pre-sale credential dumps?). w1n persistent at ~70/day for 81 days straight. Nano IT testing for 8 days = new infrastructure brought online.

🎯 The Supply Chain

STAGE 1: PROFILING (OMEGATECH, Seychelles) — 12 days
├── Tool: SSH-2.0-Go + HASSH a7a87fbe (shared with PLI)
├── 222 commands: CPU, GPU, architecture, uptime detection
├── Purpose: Identify cryptomining/botnet-worthy targets
└── Status: Spamhaus DROP LISTED (expendable)

STAGE 2: PERSISTENT VALIDATION (w1n ltd, UK→Sweden) — 81+ days
├── Tool: Custom (55 banners, HASSH 57e4cc8e)
├── Credentials: admin:admin (3,874×), admin:123456 (830×)
├── Zero commands = pure credential testing
└── Status: NOT Spamhaus listed (reputation maintained)

STAGE 3: MASS BURST (Private Layer, Panama) — spikes
├── Tool: SSH-2.0-libssh2_1.8.1 + HASSH a7a87fbe (shared with OMEGA)
├── Bursts: 595 and 2,774 sessions in single days
├── Purpose: Validate batches before sale/handoff
└── Status: NOT Spamhaus listed

STAGE 4: EXPANSION (Nano IT, Latvia) — 8 days
├── Tool: Same as w1n (HASSH 57e4cc8e)
├── 6 sessions with identical credentials
└── Status: NOT listed (new, undetected)

🌍 Jurisdictional Arbitrage

LEGAL LAYER:                                    OPERATIONAL LAYER:
┌───────────────────────────────────┐          ┌─────────────────────┐
│ UK: w1n ltd (dormant, £1)         │          │ Sweden: Data centers │
│ Panama: Private Layer INC         │          │ NL: w1n.nl domain   │
│ Seychelles: OMEGATECH + SWEDEDI   │ ───────► │ Stockholm: Hardware  │
│ Latvia: Sia Nano IT               │          │ ICME Networks: NOC   │
│ Ukraine: Director (Kiev, wartime) │          └─────────────────────┘
└───────────────────────────────────┘

RESULT: UK claims dormant → no audit. Sweden → strong privacy.
Ukraine director → unreachable. Panama/Seychelles → no transparency.
RPKI valid → nobody blocks. Spamhaus clean → nobody investigates.

💡 What This Means

At $3-10 per validated IoT credential (conservative IAB pricing), 11,029 successful logins represent $33,000-$110,000 in potential revenue — from a single honeypot target. Scaled across thousands of simultaneous targets, this is a multi-million dollar operation running under a "dormant" company with £1 capital.

The validated credentials likely feed: darknet market hosting expansion, crypto scam relay infrastructure, and Initial Access Broker (IAB) marketplaces for ransomware groups.

⚠️ Recommendations

• UK Companies House: Filing as SIC 99999 (dormant) while operating 4,499+ domains = potential filing fraud (Companies Act 2006, s.386)
• RIPE NCC: AS42237 policy violations — hosting criminal infrastructure
• Spamhaus: Ranges 185.246.128.0/22, 193.105.134.0/24, 185.217.0.0/22, 91.236.116.0/24 warrant DROP consideration
• NCA/Europol: Kraken/Mega darknet market mirrors on UK-registered infrastructure provides MLAT jurisdiction
• Upstream providers: Tele2 Sverige (AS1257), Hurricane Electric (AS6939) should be notified

📎 Sources & Evidence Chain