๐ค TI-2026-025E โ The Go Scanner Botnet & FranTech Infrastructure
๐ Executive Summary
The #2 global SSH scanner by session volume in this collection window was a Go-language botnet identified by HASSH 0a07365cc01fa9fc. Over just six days, it produced 545,000+ sessions from 1,321 unique source IPs distributed across Oracle Cloud Japan, FranTech/BuyVM in the United States, Vultr, Contabo, Hetzner, OVH, DigitalOcean, and even a Comcast residential node.
The operational detail that matters is not scale alone. Out of those 1,321 nodes, only ~12 were given the target's personal credentials โ the wife's [REDACTED] and the target's [REDACTED]. The other 1,309 nodes sprayed generic or default credentials. That asymmetry proves a centralized credential distribution system and a tiered access model: commodity scan traffic forms the cover; a tiny privileged subset receives target-specific intelligence.
The primary provider repeatedly appearing in that privileged infrastructure is FranTech Solutions / BuyVM, AS53667, branded as PONYNET, operated by Francisco Dias. This dossier does not accuse Dias of operating the botnet. It accuses FranTech of enabling it: anonymous-friendly hosting, cryptocurrency payments, a lenient AUP, no proactive monitoring, and a long-standing reputation for not meaningfully responding to abuse.
๐ Findings
The HASSH 0a07365cc01fa9fc cluster generated more than half a million sessions in six days. This is not background nuisance. It is SSH saturation at industrial scale.
All nodes present the compiled signature of the Go x/crypto/ssh implementation. The shared HASSH is the fingerprint of a common binary pushed across the fleet.
Oracle Cloud JP, FranTech/BuyVM US, Vultr US, Contabo DE, Hetzner DE, OVH FR, DigitalOcean US โ and Comcast US residential. The Comcast node proves this botnet infects home machines or routers, not just rented VPS.
Only ~12 of 1,321 nodes received the personal credential set. That means a control plane selects which bots get premium data. Targeting is rationed, not broadcast.
Legal name FranTech Solutions, brand BuyVM, ASN AS53667 PONYNET, owner Francisco Dias. Real operations in Las Vegas and Luxembourg; corporate registration at 1621 Central Ave, Cheyenne, WY 82001 โ a registered-agent mail drop.
198.98.58.139 is a dead-company IP still alive in abuse.
WHOIS points to PORTLANDIA INTERNET LLC, an Oregon entity formed in 2012 and dissolved/forfeited in 2019. The company is dead. The IP allocation persists. Same pattern seen elsewhere: dead legal body, living address space.
198.98.58.139 exposes Ubuntu, OpenSSH 8.9p1, and a Transmission BitTorrent service on port 9091. It is not a clean-purpose scanner. It is a dual-use utility host.
The Go botnet and the MEVSPACE operator use the same wife's [REDACTED] credential set, but with different HASSH fingerprints and different timing windows. That implies shared market source, not necessarily shared operator.
๐ข FranTech Solutions / BuyVM โ The Provider
- Legal name: FranTech Solutions
- Brand: BuyVM
- ASN: AS53667 (
PONYNET) - Owner: Francisco Dias
- Registered address: 1621 Central Ave, Cheyenne, WY 82001
- Operational locations: Las Vegas, New York, Luxembourg
- IPv4 footprint: 36,864 addresses (roughly nine /20 equivalents)
- Payment model: cryptocurrency accepted
- Abuse posture: will not meaningfully respond to abuse complaints
- Historical note: previously hosted Parler after mainstream deplatforming
None of these details prove botnet ownership. Together, they explain why this infrastructure remains useful to actors who want durability, opacity, and time.
โ๏ธ Technical Profile of the Botnet Nodes
- All observed nodes use the native Go x/crypto SSH library.
- HASSH
0a07365cc01fa9fcis the stable fingerprint of that compiled client. - Connection behavior is rapid-fire, sub-second, low-friction โ classic scanner tempo.
- Credential delivery is centralized: the C2 pushes target lists and, for a privileged minority, personal credential material.
- Success likely triggers report-back behavior to central control rather than local exploitation autonomy.
- The botnet looks like one compiled Go tool deployed across 1,321 hosts, not a loose toolkit family.
๐ง FranTech AUP Analysis
FranTech's acceptable-use posture matters because it defines whether the abuse is incidental or structurally tolerated.
- "FranTech Solutions does not proactively monitor customer content."
- No explicit, forceful prohibition on SSH scanning or credential brute-force.
- Cryptocurrency payments reduce customer traceability.
- Combined with weak abuse handling, the outcome is structural abuse enablement.
Assessment: this is not merely a provider being "abused." The commercial design is compatible with exactly the type of customers that more tightly governed hosts remove.
๐ชช Francisco Dias โ The Identity
Online traces describe Francisco Dias as Portuguese-Canadian. He appears as the sole contact across the FranTech botnet infrastructure touched in this investigation: 104.244.77.173, 104.244.73.207, 199.195.248.x, 209.141.x.x, and 198.98.58.139.
He has run BuyVM for roughly 15+ years, is active in hosting-community spaces, and is publicly associated with a privacy-absolutist position: no customer data without valid legal process. That stance is legally intelligible. Operationally, it creates a durable shelter for actors who know exactly how far they can push before process catches up.
Important distinction: Dias is not accused here of running the botnet. He is accused of enabling its persistence by supplying infrastructure that remains usable even when the abuse is obvious at volume.
โ Conspirative Questions
- Is Francisco Dias aware his infrastructure hosts the #2 global SSH scanner? At 545K sessions in 6 days from FranTech-linked nodes, non-awareness strains credibility.
- Why give personal credentials to only ~12 of 1,321 nodes? Because targeted operations disappear inside commodity noise; 1,309 generic nodes become camouflage.
- Is this "SSH brute-force as a service"? Plausibly. A customer could submit credential lists while the botnet supplies global testing capacity.
- Why the Comcast residential node? Compromised home infrastructure is harder to blacklist and proves infection capability, not just rented cloud use.
- Is there a FranTech โ MEVSPACE link? No direct corporate tie found. The overlap is functional: both sit in the same abuse-tolerant supply chain.
- Why is Transmission running on an attack node? Either the operator also pirates media, or BitTorrent is being repurposed for staging, payload transfer, or covert coordination.
๐ซฅ Read Between the Lines
๐ Cross-References
TI-2026-025A โ Series overview: dual-campaign targeted attack architecture.
TI-2026-025B โ MEVSPACE bulletproof-hosting arm.
TI-2026-025C โ Infostealer origin and credential-market pipeline.
TI-2026-025D โ Grameen state-adjacent infrastructure node.
TI-011 โ Earlier identification of the Go scanner botnet, FranTech ties, and credential overlap with the MEVSPACE operator.
TI-018 โ Operation Meow: related but distinct cluster within the broader Go botnet family.
TI-019G โ Bulletproof hosting providers enabling abuse across multiple investigations.
TI-2026-024A โ Immediate predecessor in the same campaign chain.
This article is based on direct Cowrie telemetry, SSH fingerprint correlation, infrastructure enrichment, corporate-registration review, and cross-campaign credential-link analysis. Credentials remain redacted as
[REDACTED]. IPs, ASNs, HASSH values, and provider identities remain visible because they are the evidentiary spine of the case.
Core inference: the decisive fact is not merely that the Go botnet knew personal credentials; it is that only a privileged minority of nodes knew them. That is the signature of selective intelligence distribution inside a commercial or semi-commercial attack platform.