Threat Intelligence: Dual-Use NTP Infrastructure, Scanner Farms, and Certificate-Related Disruptions

Written By Connor Lovgren

Executive Summary

During routine network monitoring and reconnaissance, a cluster of inbound scanning activity was observed targeting a residential/public IP, coinciding with local service disruptions involving TLS certificate validation failures on networked devices. Subsequent analysis uncovered multiple overlapping infrastructure sets:

  • High-volume scanner nodes operated under Mevspace (AS201814) with historical ties to ALPHV/BlackCat ransomware affiliates via the Nitrogen campaign.

  • Noisy Bulgarian hosting infrastructure under Tamatiya EOOD (AS50360).

  • A dual-use NTP/DNS node at 142.202.190.19 (resolving to

    dns-e.ns4v.icu

    ) that participates in public NTP pools while also serving web content previously flagged by commercial security systems as a phishing risk.

  • Anomalous responses from root DNS server infrastructure during parallel investigation.

This report compiles all observed indicators, scan results, domain infrastructure, and relevant artifacts into a structured intelligence product suitable for defensive use and client education.

Inbound Scanning Clusters

Mevspace (AS201814 – MEVSPACE sp. z o.o.)

Primary ranges observed:

  • 194.180.48.0/24

  • 109.205.211.0/24

Specific IPs recorded in discard logs (TCP Generic Discards):

  • 194.180.48.213

  • 194.180.48.215

  • 194.180.48.217

  • 194.180.48.219

  • 194.180.48.223

  • 194.180.48.225

  • 194.180.48.227

  • 194.180.48.229

  • 194.180.48.231

  • 194.180.48.233

  • 194.180.48.235

  • 194.180.48.237

  • 194.180.48.243

  • 194.180.48.245

  • 194.180.48.247

  • 194.180.48.249

  • 109.205.211.211

  • 109.205.211.217

  • 109.205.211.229

  • 109.205.211.231

  • 109.205.211.233

  • 109.205.211.235

  • 109.205.211.253

Historical context:

Public reporting (Darktrace, eSentire, KPMG CTI) has previously associated hosts within 194.180.48.0/24 with Cobalt Strike and Sliver C2 infrastructure used by Nitrogen campaign operators that ultimately deployed ALPHV/BlackCat ransomware. Specific historical C2 addresses of note include 194.180.48.149 and 194.180.48.169.

These nodes exhibited sequential, high-volume TCP probing consistent with internet-wide scanning.

Tamatiya EOOD (AS50360)

Observed IPs:

  • 79.124.40.126

  • 79.124.49.114

  • 79.124.56.238

  • 79.124.56.250

  • 79.124.58.218

Key host: 79.124.49.114

  • Reverse DNS (historical):

    ip-49-114.4vendeta.com

  • Current reverse DNS: NXDOMAIN (PTR rotated or removed)

  • Open port: 22/tcp – OpenSSH 7.4 (protocol 2.0)

  • Remaining ports: filtered (25, 111, 135, 139, 427, 445)

  • OS fingerprint: Linux 3.x–5.x range

  • Uptime estimate (at time of scan): ~6.5 days

  • AbuseIPDB: Hundreds to 1,000+ reports

  • Corporate front:

    4vendeta.com

    resolves to a separate IP (79.124.60.2)

These hosts function as classic minimal scanner/VPS nodes with aggressive firewalling.

Additional Scanner Sources Observed

  • Palo Alto Networks Cortex Xpanse / Expanse ranges (147.185.132.0/23, 198.235.24.0/24, 205.210.31.0/24) – legitimate commercial asset discovery.

  • Shadowserver / Hurricane Electric (64.62.156.0/24, 64.62.197.0/24).

  • Various Google Cloud research ranges (35.203.210/211.x).

  • Opportunistic DigitalOcean and other VPS scanners.

Dual-Use NTP / DNS Infrastructure – Primary Focus

Core Indicator

  • 142.202.190.19

  • Hostname:

    dns-e.ns4v.icu

  • ASN: AS398019 – Dynu Systems Incorporated

Resolution chain:

Open ports (nmap):

  • 22/tcp – SSH

  • 53/tcp – DNS

  • 80/tcp – HTTP

HTTP behavior:

When accessed directly, the host has returned:

  1. An AT&T security interstitial page (see HTML below).

  2. A plain-text message referencing the Ubuntu “pollinate” client.

Captured HTML from http://142.202.190.19/

<!doctype html>

<html style="height:100%">

<head>

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1">

<title></title>

<script type="text/javascript">

var url="

https://myhomenetwork.att.com

";

var reason=["phishing"];

</script>

</head>

<body style="margin: 0 auto; padding: 0 auto; width:100%; height: 100%; overflow : hidden;">

<iframe src="" id="frame" seamless="seamless" style="margin: 0 auto; padding: 0 auto; border: 0; width:100%; height: 100%" > </iframe>

<script type="text/javascript">

document.getElementById('frame').src = url+"/networkprotected/index.html?reason="+reason[0]+"&source="+encodeURIComponent(window.location.href);

</script>

</body>

</html>

This is an AT&T network-protection interstitial. Commercial security tooling classified the destination as a phishing risk and injected/served the block page. The page loads the official AT&T “Network Protected” warning inside an iframe and passes the original URL as a source parameter.

Domain Infrastructure –

ns4v.icu

WHOIS (summary):

Root domain status: Cloudflare HTTP 530 (origin unreachable or misconfigured).

Subdomains enumerated (subfinder + assetfinder):

The heavy concentration of ntp* subdomains is atypical for a standard public NTP pool participant and is a strong behavioral indicator of dual-use or opportunistic infrastructure.

Cloudflare edge for

ns4v.icu

(at time of scan):

172.66.41.42

Ports: 80, 443, 8080, 8443 (Cloudflare proxy only)

Related NTP Resolutions Observed in Packet Capture

From DNS responses for

0.debian.pool.ntp.org

/ related pool queries:

  • 142.202.190.19

  • 23.143.196.202

  • 23.186.168.128

  • 23.186.168.130

UDP/123 traffic consistent with legitimate client NTP queries was present alongside the above resolutions.

Ancillary Observations

  • Multiple root-server IP addresses (192.5.6.30, 192.12.94.30, 192.26.92.30, 192.31.80.30, 192.33.14.30, 192.35.51.30, 192.41.162.30, 192.42.93.30, 192.43.172.30, 192.48.79.30, 192.52.178.30, 192.54.112.30, 192.55.83.30) appeared in capture traffic during parallel DNS investigation.

  • One root-server address exhibited anomalous service banners (including an unexpected FTP listener and atypical OS fingerprint) during active probing — noted for further monitoring but not confirmed as related to the primary clusters.

  • Local TLS certificate validation failures on networked devices coincided temporally with the inbound scanning window as well as after to look for the IoT device the attack was launched from. Isolation of a local streaming device resolved the immediate certificate errors, suggesting a possible local interaction or resource/TLS-stack fragility amplified by external probing pressure.

Indicators of Compromise / Watchlist (Sanitized)

High priority block candidates:

  • 194.180.48.0/24

  • 109.205.211.0/24

  • 79.124.40.0/24

  • 79.124.49.0/24

  • 79.124.56.0/24

  • 79.124.58.0/24

  • 142.202.190.19

  • *.ns4v.icu

Historical C2 references (for hunting):

  • 194.180.48.149

  • 194.180.48.169

Domain watchlist:

Analysis & Assessment

The observed activity represents a convergence of three common modern threats:

  1. Commodity scanner farms (Mevspace + Tamatiya) performing continuous internet-wide reconnaissance. The Mevspace range carries elevated risk due to documented prior use as ransomware affiliate C2.

  2. Dual-use public service infrastructure (

    dns-e.ns4v.icu

    ). Participation in NTP pools provides legitimate cover and high query volume while the same host serves web content that commercial security products (including major ISP protections) classify as phishing-related.

  3. Local device fragility. Consumer IoT and streaming devices frequently possess brittle TLS implementations. High volumes of unexpected handshakes or certificate anomalies can produce cascading validation failures.

No evidence of successful remote code execution or persistent compromise was identified in the examined data. The primary risk is reconnaissance and opportunistic exploitation of misconfigured or outdated services.

Recommendations for Defenders

  1. Block the listed ranges and domains at the perimeter and recursive resolvers.

  2. Pin NTP sources to trusted operators only (

    time.google.com

    ,

    time.cloudflare.com

    ,

    time.nist.gov

    , or ISP-provided servers). Avoid unrestricted public pool usage on sensitive or IoT segments.

  3. Segment IoT / streaming devices onto isolated VLANs with strict egress filtering and client isolation.

  4. Monitor for residual callbacks to the listed historical C2 addresses and the

    ns4v.icu

    infrastructure.

  5. Update camera, NVR, and streaming device firmware — many certificate-related lockups are resolved in later releases.

  6. Enable ISP-provided network protection where available and review its telemetry for similar dual-use nodes.

Conclusion

This incident illustrates the modern reality of dual-use infrastructure: hosts that simultaneously provide legitimate public services (NTP, DNS) while attracting abuse and commercial security blocks. Combined with persistent scanner farms that have previously hosted ransomware C2, the environment requires continuous indicator-driven blocking and careful local network hygiene.

Quantitative Security continues to track the Mevspace and

ns4v.icu

clusters. Clients requiring custom detection content, firewall policy packs, or deeper passive-DNS historical analysis should contact the team.

Prepared by: Quantitative Security – Protective Intelligence

Connor Lovgren
Previous

Quantitative Security – Q1 & Q2 2026 Review
Next

High-Risk NTP Servers and the Quiet Risks to Internet Time