🔍 Q1: Why use Tor if you're doing legitimate research?

Their likely answer: To test if hosts respond differently to Tor traffic vs. direct traffic.

The problem with that answer: They have 30 disclosed scanning nodes across 16 geographic regions including AWS IPs in 10 countries. They could compare responses from Germany vs. Singapore vs. Brazil vs. Virginia without Tor. They CHOSE Tor specifically because it provides anonymity, not just geographic diversity.

What the data says: Their direct scans (Scanner A) use NO credentials and do NO exploitation. Their Tor scans (Scanners B/C) use credentials AND execute commands. The anonymity layer correlates with the aggression level. This is not accidental.

🔍 Q2: Why does the disclosure page lie?

The quote: "We never attempt to abuse security vulnerabilities on your system, guess for passwords or upload files to your systems."

The evidence: root:root (19 sessions), admin:admin (3 sessions with command execution). These are passwords. They were used to authenticate. The honeypot accepted them.

Possible explanations:

• (a) The Tor operation is conducted by different people than those who wrote the disclosure → compartmentalization
• (b) The disclosure was written for the direct scans only; the Tor operation is deliberately not covered → selective disclosure
• (c) They don't consider root:root "guessing" because it's a known default → semantic evasion
• (d) The Tor operation is not authorized by the institution → rogue researcher or separate funding source

What we can verify: The same SSH key (d4:98:c4:f3:...) links the disclosed direct scanner to the undisclosed Tor scanner. Same operator, same key material. Either the institution knows or its security is compromised.

🔍 Q3: Who funds this and what do they receive?

Known facts:

• Max Planck Society receives €2.4 billion/year from German federal (50%) and state (50%) governments
• The INET department's research areas explicitly include "Internet measurement" and "Network Security"
• The German government's BND reform (2016) expanded signals intelligence authority
• Germany participates in the "14 Eyes" intelligence alliance
• MPI-INF has documented collaborations with German government agencies

What we cannot verify: Whether the scanning dataset is shared with BND/BSI, whether EU-funded projects (Horizon Europe) require data sharing with security agencies, whether classified side-agreements exist.

What the disclosure page carefully avoids: It says they "will try to publish all our findings to a wider audience" and will never publish data that "clearly identifies you." It does NOT say who else receives the RAW data. "Publishing" and "sharing" are different verbs.

🔍 Q4: Is this honeypot detection... or honeypot MAPPING?

The distinction matters:

• "Detection" (research): Can honeypots be identified? Result → academic paper
• "Mapping" (intelligence): WHERE are honeypots? Result → operational database for avoiding them

What the commands reveal: /proc/1/mounts + /proc/cpuinfo + bash --help = a binary classifier: "is this target real or fake?" The tracking IDs allow correlating results across sessions. An internet-wide scan with this classifier produces a global map of deception infrastructure.

Who would want a honeypot map?

• Attackers — to avoid detection when deploying actual exploits
• Intelligence agencies — to know which networks deploy deception (= who is security-aware)
• Researchers — to quantify honeypot deployment for a paper

All three users benefit from the same dataset. The intent is indistinguishable from the data alone.

🔍 Q5: Why evening timing? Why human-scheduled?

Data: Tor scans cluster 18:00-21:00 UTC (19:00-22:00 CET = German evening). Direct scans are distributed 01:00-23:00 (automated).

Research interpretation: A PhD student runs the Tor experiments manually as part of their daily routine.

Counter-interpretation: After-hours operation avoids institutional oversight. IT departments don't monitor traffic at 9pm. The direct scans are automated (cron job = institutional); the Tor scans are manual (human = personal/deniable).

The Friday pattern: 9 of 15 direct scan sessions occurred on Fridays. Either the researcher likes Fridays, or batch jobs run on end-of-week schedules.

🔍 Q6: What does it mean that MPI shares a threat feed with Russian bulletproof hosting?

Data: OTX pulse 69e1ede7... (cluster of 6 IPs) contains BOTH MPI (139.19.117.129) AND FORTIS-AS (45.144.233.139 — Baykov Ilya Sergeevich, Russia, 6,795 abuse reports).

Research interpretation: Threat feeds aggregate scanners indiscriminately. MPI scans the internet; so do botnets. Both end up in the same "malicious scanners" lists. This is a false positive.

Counter-interpretation: Being categorized alongside Russian bulletproof hosters in a 6-IP cluster means their scanning BEHAVIOR is indistinguishable from actual threats. If the 4,612 AbuseIPDB reporters and OTX pulse curators cannot tell the difference, why should we?

🔍 Q7: The SSH key paradox — deliberate or negligent?

Data: SSH key d4:98:c4:f3:... is used both from a named institutional IP AND through Tor exits. This perfectly deanonymizes them.

If deliberate: The key serves as a "flag" to anyone monitoring Tor exits who has MPI's key on file. It says "this is us, not a criminal" — a deconfliction mechanism. NATO/5-Eyes partners with access to this key would know not to investigate further.

If negligent: A world-class computer science institution studying network security failed to generate a separate key for their anonymized scanning. This would be a remarkable oversight for experts in this exact field.

If research-intentional: They're deliberately testing whether honeypots correlate keys across connections (testing OUR detection capability). By reusing the key, they learn which targets can deanonymize Tor users.

All three are concerning for different reasons.

🔍 Q8: 4,612 abuse reports — why no institutional response?

Data: AbuseIPDB confidence: 100%. Reports: 4,612. No public acknowledgment or statement from MPI-INF about these reports.

Research interpretation: The disclosure page IS their response. Anyone who looks up the IP finds the page. They don't respond to individual reports because there are too many.

Counter-interpretation: 4,612 organizations reported being scanned without consent. The Menlo Report (cited on their OWN disclosure page) requires "beneficence" and "respect for persons." Scanning without active consent and ignoring 4,612 complaints is a debatable interpretation of these principles.

The practical question: Would YOU accept this behavior from a Russian, Chinese, or Iranian institution? If not, why is German state-funded scanning acceptable?