🌐 TI-2026-021J · The Architecture of Impunity · Part 10 of 10 — Series Finale

The Honeypot Testimony: 8,000 IPs, 271,000 Links, One Conclusion

This series has made claims about architecture. Now the architecture testifies. Not through theory. Through data. Not through diplomatic language, registry policy, or corporate self-description. Through the behavior of machines that touched a sensor every day for more than six months, through credentials tried thousands of times with mechanical consistency, through fingerprints shared across offshore networks that are supposed to be unrelated, and through an entity graph large enough to show that what appears fragmented at the IP level is coordinated at the infrastructure level.

A great deal of internet-abuse analysis fails because it stops too early. It catches an IP, writes a block rule, maybe files a complaint, and then treats the event as self-contained. The honeypot does not make that mistake. It remembers recurrence. It remembers timing. It remembers banners, HASSH fingerprints, username/password vocabularies, ASN lineages, hostnames, enrichment feeds, and the quiet structural fact that the same operator logic keeps reappearing behind new infrastructure. A single IP can lie. A six-month corpus is much harder to lie to.

The numbers are already more than enough to end the pretense that this is a story about isolated attackers. At the series baseline, the local threat-intelligence corpus held 7,994 unique attacking IPs, 110,140 entity links, and 64,411 honeypot hits spanning 64+ countries. A separate graph view over the broader threat_intel database maps 271,000+ entity connections linking IPs, ASNs, hostnames, WHOIS artifacts, abuse data, and operator clusters. The live database continues to drift upward; the conclusion does not drift with it. The conclusion hardens.

This matters because the machine doing the witnessing is not a state sensor, not a hyperscaler telemetry planet, not a national CERT. It is a Cowrie SSH honeypot running on a personal homelab in a 44-square-meter apartment in Iași, Romania. One machine in one apartment in one city captured enough evidence to reconstruct a global architecture of tolerated abuse. That fact alone is devastating. If the pattern is visible here, it is visible to every institution with more money, more jurisdiction, and more authority than this one node. They are not blind. They are choosing a threshold of action that remains far above what the evidence already justifies.

The rest of this finale proceeds the only way it can: by letting the corpus speak. The countries. The ASNs. The credential vocabularies. The HASSH clusters. The residential proxy fleet. The recurrence of Private Layer, PIO-Hosting, Omegatech, ChinaNet, and other infrastructure that ties together earlier investigations. Then, at the end, the real conclusion: this is not an accidental cloud of abuse. It is a maintained global system with commercial and institutional tolerance built in.

1. The Honeypot: what it is, what it captures, and why its testimony matters

Cowrie is an interaction honeypot. In this case it presents an SSH surface attractive to opportunistic brute forcers, scanners, proxy validators, botnet loaders, and scripted credential testers. Unlike a passive sensor that merely notes connection attempts, an interaction honeypot records more of the behavioral chain: usernames, passwords, whether a login would have succeeded inside the emulated environment, commands issued after authentication, downloads attempted, client banners, timing data, and other execution traces. It therefore captures not only that something touched the machine, but what kind of operator logic the touch expressed.

That difference is crucial. A simple list of attacking IPs often encourages shallow interpretation. One sees many countries and assumes a global human swarm. One sees residential ISPs and assumes random compromise. One sees major cloud providers and assumes background internet noise. The Cowrie record complicates all of that by preserving patterns. If 133 IPs present the exact same SSH-2.0-AsyncSSH_2.1.0 banner and concentrate around the same credential vocabulary, that is not noise. If multiple Swiss- and Seychelles-linked IPs share the same HASSH fingerprint and reuse the same success pattern, that is not coincidence. The honeypot turns vague suspicion into structured comparison.

It also matters that the observation window is not anecdotal. The series is built on 6+ months of continuous observation, with daily scanning and repeated return traffic. Some operators appear once and vanish. Others become residents. One of the most important Private Layer nodes, 179.43.139.58, generated 12,881 honeypot hits locally and participated in a shared fingerprint cluster with other offshore infrastructure. Another signal IP, 87.251.64.176, attempted 4,141 admin:admin logins with a 100% success count for that credential pair and an average session duration around 0.5 seconds. Humans do not behave like that. Validation pipelines do.

Because the platform enriches the raw events into a broader intelligence graph, the testimony is two-layered. First there is the immediate evidence: a connection from an IP, a credential, a banner, a session duration. Then there is the relational evidence: this IP shares a fingerprint with that IP; both live in different jurisdictions but express the same toolchain; both sit in ASNs already examined elsewhere; both inherit the same reputation logic; both belong to an operator cluster that becomes visible only when events are linked across time.

This is why the honeypot belongs at the end of the series rather than the beginning. Earlier installments mapped the architecture conceptually: registry weakness, abuse-report failure, upstream tolerance, jurisdictional gaps, reputation laundering, and economic incentives. The honeypot now shows those claims in operational form. The argument is no longer “this structure could enable abuse.” The argument is “this structure is visibly being used for abuse, repeatedly, across jurisdictions, with stable operator fingerprints.”

2. The numbers that matter

Every large corpus has many numbers. Most of them are distractors. The important ones are the ones that change what kind of explanation remains intellectually honest. Here they are. At the series baseline: 7,994 unique attacking IPs. 110,140 entity relationship links. 64,411 total honeypot hits. 64+ countries in the focal slice. The broader relational graph now exceeds 271,000 connections across the full threat_intel environment. That is not a hobby dataset. It is national-scale density seen from a personal sensor.

The live database is even broader than the series freeze. Current direct queries show the graph continuing to grow, country coverage expanding well beyond the 64-country baseline, and a very large long tail of ASNs. That does not weaken the earlier counts. It strengthens them by showing that the baseline was not inflated rhetoric; it was a snapshot of a moving target that kept producing more evidence after the initial finding was already established. The point of the baseline numbers is therefore not false precision. It is that even the conservative frozen view was already enough.

These figures matter because each one collapses an escape route. Thousands of IPs eliminate the “small sample” defense. Tens of thousands of hits eliminate the “rare anomaly” defense. Hundreds of thousands of graph relationships eliminate the “these are probably unrelated” defense. Multi-country spread eliminates the “this is just one regional hygiene issue” defense. The argument that remains is not whether a pattern exists. It is whether institutions that see it will continue pretending the pattern is too diffuse to act on.

The same numbers also say something methodological. Threat intelligence is often crippled by overreliance on single-source enrichment. One feed flags a host, another misses it, and the analyst hesitates. Here the corpus is not one feed. It is honeypot telemetry plus enrichment plus graph linkage plus historical dossier knowledge. That is why it can make stronger claims. When an IP is not just “bad” but linked to a known ASN, a known HASSH, a repeated credential family, and a prior series pattern, the uncertainty narrows drastically. This is evidence accumulation, not single-indicator theater.

An architecture reveals itself not when one IP looks suspicious, but when thousands of IPs keep arranging themselves into the same story.

3. Country distribution: why the United States leads, and why that does not mean what lazy analysts think it means

The most easily abused statistic in datasets like this is country count. People see the United States at the top and rush toward one of two bad conclusions: either Americans are the operators, or the dataset must be meaningless because “everyone knows” the real attackers are somewhere else. Both interpretations are wrong. Country in a hosting corpus is often better read as where infrastructure is cheap, plentiful, and friction-light than as a reliable indicator of operator nationality. The United States leads many datasets because U.S.-based or U.S.-labeled cloud and hosting capacity is abundant, routable, and easy to acquire through layers of intermediation.

At the series baseline, the top five country counts were US 1,874, CN 686, DE 543, NL 339, and VN 282. The live database snapshot taken while composing this finale shows the same rank order with only modest drift: US 1,857; CN 710; DE 534; NL 387; VN 289. That stability matters more than the minor numerical movement. It shows that the geography of the infrastructure market is not random. Cheap U.S. cloud, Chinese state and quasi-state telecom space, German and Dutch hosting fabrics, and Vietnamese residential or edge-compromise surfaces all remain recurrent staging grounds.

The current top-20 live snapshot is still useful because it reveals the broader hosting and compromise ecology. It is not a nationality ranking. It is an infrastructure availability ranking. Where do cheap servers exist? Where are edge devices plentiful? Where are residential or CGNAT pools large enough to disappear into? Where are legal and reputational frictions low enough that operators can keep rotating? Those questions explain the table far better than any patriotic story about who the human attackers “really” are.

The Swiss line is a useful example of why raw counts can mislead. Switzerland does not place high by volume in the live table. Yet the Swiss-operated or Swiss-branded Private Layer environment is one of the most important high-impact recurrence nodes in the entire corpus. A few IPs with very large hit counts can matter more than hundreds of scattered low-activity cloud IPs. The same is true for the Netherlands: it is not merely a country count. It is a recurring landing zone where supposedly foreign shells surface as routable European presence.

So the country lesson is simple. Hosting countries are logistics. Operator countries are another problem entirely. When the public treats geolocation as attribution, it mistakes warehouse location for authorship. The honeypot corpus repeatedly shows why that is a category error.

4. The top ASNs: infrastructure that keeps reappearing

If country analysis can mislead, ASN analysis is often sharper because it speaks to actual routing and commercial environments. Current live queries across the corpus place major commodity-cloud and telecom environments near the top by IP count—DigitalOcean, Tencent, Microsoft, ChinaNet, OVH, Google Cloud, and others. That is important because it shows how much abuse rides on ordinary infrastructure. But the series finale cannot stop there. Some ASNs matter not because they dominate raw IP count, but because they concentrate repeated, high-value, and architecturally revealing activity.

But the more revealing operator table looks different. It weights architectural significance, honeypot hits, and recurrence across the series rather than just the number of distinct IPs seen. By that measure, Private Layer, PIO-Hosting, Omegatech, and ChinaNet deserve direct treatment.

Private Layer is the clearest example of why counts alone do not tell the story. The Swiss-operated / Panama-registered environment is not dominant by number of IPs, but it is dominant by impact. Prior cross-corpus work identified it as accounting for roughly 29% of all traffic in one comparative slice, and the local fingerprint evidence ties it directly to offshore operator patterns that are supposed to be unrelated. The same HASSH appears on Private Layer and Omegatech nodes. That is not “same country, same ISP” handwaving. That is shared tooling across shells.

PIO-Hosting matters differently. It is a German company, which means it punctures the lazy idea that the worst infrastructure always lives only in stereotyped offshore jurisdictions. The local corpus shows multiple Netherlands-geolocated PIO IPs with high threat scores and repeated honeypot contact. This is exactly how tolerated abuse survives in Europe: not only through far-away islands, but through regional fabrics that remain usable long after their toxicity is visible.

Omegatech is the series' Seychelles case study made operational. The fact that 94.154.35.215 produced 560 honeypot hits and 560 successes using admin:admin is analytically devastating. This is not a subtle actor cautiously exploring a target. It is a machine verifying a known condition through routable infrastructure that should never have been socially cheap to assemble. The shell-company analysis from earlier parts lands here with full force: the paperwork was not decorative. It was infrastructural.

ChinaNet AS4134 belongs in the finale for a different reason. Its raw hit volume in the focal set is smaller, but its presence proves that state-scale telecom space repeatedly appears inside the same global attack ecology. That does not let the analyst leap to “the state did it.” It does, however, force a harder truth: the architecture of abuse is comfortable operating inside mainstream national backbone environments when those environments are abundant, under-policed, or full of compromised edge devices.

5. The credential evidence: industrial validation, not human curiosity

The credential table is where the human-romantic image of hacking begins to die. If a person imagines a solitary attacker improvising in real time, the corpus says otherwise. The dominant patterns are repetitive, highly structured, and frequently 100% successful for the credential combinations that matter most. That is not how exploratory brute force looks. It is how validation looks. Someone already believes the credential will work and is using the honeypot or an exposed service to confirm reachability, proxy quality, account state, or tool-chain correctness.

The top-20 all-time credential combinations are especially revealing. root with empty password leads by sheer volume—24,758 attempts from 700 IPs—but with zero successes, which makes it the background radiation of opportunistic scanning. Immediately beneath it, however, the pattern changes. admin:admin appears 15,151 times with 15,151 successes across 316 IPs. admin:123456 appears 5,290 times with 5,290 successes. pi:raspberry is 487 for 487. root:password is 103 for 103. test:test is 94 for 94. That is not guessing. That is machine memory.

The per-IP examples are even sharper. 87.251.64.176 from the ISAEV environment used admin:admin 4,141 times, all successful, with average session duration around 0.5 seconds. That is not a person navigating a shell. It is a validator checking whether the path works. 179.43.139.58 on Private Layer used admin:admin 4,574 times and admin:123456 3,454 times, again with complete success on those pairs. 94.154.35.215 on Omegatech used admin:admin 560 times with 560 successes. These are not three different artistic personalities. They are variations of the same industrial grammar.

The temporal dimension makes the same point. Across the broader corpus, some coordinated clusters exhibit a near-metronomic ~44.5-second operational rhythm. In the specific exemplars foregrounded here, session duration compresses even further into sub-second or roughly one-second bursts. The exact timing varies by operator and task, but the principle is the same: the cadence is too regular, too brief, and too repetitive to be explained by humans typing into shells. This is automation speaking with a clock.

The credential evidence therefore does more than identify bad defaults. It identifies business function. A residential proxy seller, scanner fleet, or access validator must know quickly whether a node is alive, whether a proxy path works, or whether a default credential still opens the door. The honeypot recorded that logic directly. When the same credential grammar appears across different ASNs and shells, it stops looking like random opportunism and starts looking like a commodity service class.

6. The SSH fingerprint map: shared HASSH proves that “unrelated” infrastructure is often related

HASSH fingerprints are powerful because they collapse one of the easiest lies in infrastructure analysis: the lie of administrative separation. A provider can have a different company name, a different country code, a different ASN, and a different abuse address. But if it presents the same client fingerprint at scale, reuses the same credential grammar, and appears in the same time windows, the supposed independence begins to look theatrical. HASSH is not magic, and one fingerprint alone never proves authorship beyond doubt. But at scale it is a strong coordination signal.

The most important fingerprint in this finale is a7a87fbe86774c2e40cc4a7ea2ab1b3c. The local coordination view classifies it as a programmatic libssh2 scanner. It appears across four IPs that span supposedly distinct infrastructures: two Private Layer nodes in the Swiss/Panama environment and two Omegatech-linked nodes in the Seychelles / NL / TR corridor. Across the local corpus it generated 9,623 sessions. The distribution is lopsided enough to be revealing: 179.43.139.58 accounts for 7,903 sessions, 179.43.133.154 for 1,018, 94.154.35.215 for 560, and 178.16.54.226 for 142.

What makes this especially persuasive is the credential overlap. The same coordination view shows shared use of admin:admin and admin:123456 across the cluster. That means the shared fingerprint is not floating in isolation. It is embedded in a common behavioral package: same library, same style of authentication, same offshore and quasi-offshore hosting mix, same preference for rapid success rather than broad password exploration. This is the kind of convergence one expects from one operator family or a tightly shared toolkit—not from independent strangers coincidentally behaving alike.

This is also where the broader entity graph earns its keep. If one only saw the IPs, one could still tell a skeptical story: maybe two operators both use libssh2, maybe they copied each other, maybe it is just a popular scanner. Once the graph adds shared credentials, repeated recurrence, common narrative placement across prior investigations, and aligned jurisdictional behavior, the skeptical story becomes costly to maintain. The simpler explanation is coordinated infrastructure.

The point is not that one HASSH solves attribution permanently. The point is that the architecture keeps accidentally confessing through technical reuse. Operators depend on shared libraries, shared playbooks, shared upstreams, and shared economic corridors. Every convenience they use to scale is also a chance to be linked. The honeypot recorded those linkages in plain view.

7. Phantom Pipes: the AsyncSSH residential proxy fleet

If the Private Layer / Omegatech HASSH cluster shows offshore operator coordination, the Phantom Pipes pattern shows something equally important: the industrialization of residential proxy validation. The key banner is SSH-2.0-AsyncSSH_2.1.0. In the live local query used for this article, that banner appears across 4,323 sessions from 133 IPs tied overwhelmingly to a single HASSH: fda360b1b4f4d3455cb75c6e7edb1d11. Prior dossier work identified this as a residential proxy verification fleet concentrated in Vietnamese Viettel CGNAT pools, with a frozen 2019 AsyncSSH build reused programmatically at scale.

The behavioral signature is not “break into a server and live there.” It is “touch the node, verify the path, move on.” Earlier corpus work described the same fleet using credentials like admin:admin, root:admin, test:test, and root:password, then testing external resolution through services such as ip-who.com. That is not what brute-force romance looks like. It is what a proxy marketplace or credential-validation pipeline looks like when the workers are software rather than people.

This matters for the finale because it expands the series beyond the simple image of “bulletproof hosting” as a datacenter problem. The architecture of impunity does not stop at offshore shells or tolerated VPS sellers. It extends into the proxy economy, where compromised residential or edge infrastructure is validated, classified, and sold as if it were a raw commodity. The similarity to commercial residential-proxy markets is not incidental. The difference between a glossy consent narrative and a criminal one is sometimes less about the underlying technical workflow than about whether the host ever meaningfully agreed.

One can now see how the layers fit together. Residential proxy fleets need validation infrastructure. Validation infrastructure needs tolerated scanning and quick credential checks. Those checks run from IP space purchased or tolerated somewhere. That somewhere is attached to transit somewhere else. The companies behind the routes may have been formed cheaply through wrappers and shells. What looks like many different stories—hosting, phishing, proxies, credential attacks—keeps folding back into the same commercial and infrastructural skeleton.

The residential-proxy layer also helps explain why some countries and ASNs behave strangely in the aggregate. Large pools of ephemeral, consumer-looking IPs are attractive precisely because they confuse simplistic attribution and evade some reputation heuristics. The honeypot corpus does not eliminate that ambiguity, but it proves the operational model behind it. The “randomness” has a banner, a fingerprint, a credential grammar, and a repeat cadence. Randomness is not the right word for that.

8. What the data proves about each previous article

A finale is not only supposed to conclude. It is supposed to test what came before it. The honeypot corpus does exactly that. It does not replace the earlier articles. It corroborates them operationally. The architecture described in prose and institutional analysis reappears in telemetry, graph linkage, and live infrastructure behavior.

The abuse-report argument is perhaps the easiest to test. Earlier work established a 96% failure rate for comparable bulletproof-hosting reporting. The honeypot shows why that failure is not theoretical. The same operators remain present. The same nodes continue touching the sensor. The same fingerprints recur across months. If reporting were a meaningful interruption, the graph would show decay. Instead it shows continuity. Silence is not neutral when continuity keeps paying.

The upstream argument also hardens under telemetry. Reachability is not an abstract legal concept. It is the reason every one of these sessions existed. Every successful login, every zero-command validation burst, every AsyncSSH proxy check, every Private Layer recurrence happened because the route remained alive. The honeypot cannot see the carrier contract directly, but it sees the result of that contract: sustained packet delivery for repeatedly suspicious downstreams.

The resource-governance and reputation-laundering arguments become stronger, not weaker, under graph analysis. The fact that the full threat_intel graph now contains 271,000+ connections means that “new” infrastructure is often only superficially new. It shares prefixes, hostnames, registrant patterns, abuse contacts, HASSH values, OTX pulses, or command grammars with older nodes. That is exactly what one would expect in a market where addresses, shells, and ASNs are inputs to be rotated, not identities to be preserved.

The MLAT and cross-border-enforcement gap is almost too obvious in the data. A single meaningful chain can now touch Swiss-operated / Panama-registered hosting, Seychelles incorporation, Dutch geolocation, German or Romanian transit relationships, Chinese telecom space, and Vietnamese residential nodes. Every additional jurisdiction is a delay multiplier. The honeypot does not need to know the treaty status between all relevant pairs. It shows the chain that would require the treaties. That is enough.

And the economics article receives the strongest confirmation of all. Nothing about this corpus looks like sporadic individual experimentation. The density, repetition, and tooling reuse are exactly what a monetized market produces. It is not a teenager trying passwords by hand. It is infrastructure behaving like infrastructure.

9. The institutional meaning of the testimony

What, then, does one machine in one apartment actually prove? It proves first that the architecture is observable. That alone matters. Institutions often shelter behind a performance of uncertainty: the internet is too large, abuse is too distributed, attribution is too difficult, evidence is too noisy. The honeypot does not solve every attribution problem, but it destroys the excuse that the pattern is too faint to see. The pattern is strong enough that a personal sensor can record it, enrich it, cluster it, and connect it to prior investigations at global scale.

Second, it proves that the architecture is selective, not chaotic. The same kinds of spaces recur: certain cloud environments, certain telecom backbones, certain tolerated routing fabrics, certain offshore or wrapper jurisdictions, certain credential grammars, certain scanner libraries, certain residential proxy behaviors. That is what architecture means. It means the system has shape. A shapeless phenomenon is weather. This is not weather.

Third, it proves that impunity is not created only by law-enforcement weakness. It is created by a chain of institutions that each have a reason to interpret their own role narrowly and their own duty minimally. The formation agent sells paperwork. The registry sells membership. The broker sells access. The carrier sells bandwidth. The hoster sells tolerance. Each step can point away from itself. The honeypot, because it stands at the receiving end of the chain, sees the whole result at once.

There is a deeper moral consequence too. When a local sensor can record the architecture of abuse in detail, the burden of proof shifts. The question is no longer “can this be demonstrated?” It has been demonstrated. The question becomes “what level of evidence would actually cause institutions that profit from continuity to act against continuity?” That is a harsher question because it suggests the missing variable may not be data at all. It may be willingness to bear economic and political cost.

That is why this finale must end where the series has been heading all along. The architecture of impunity is not hidden behind technical brilliance. It is visible behind tolerated incentives. The honeypot did not discover a secret universe. It simply paid attention long enough for the ordinary universe of tolerated abuse to reveal its structure.

10. Final statement

This honeypot is one machine, in one apartment, in one city. It captured a global testimony. 7,994 IPs. 110,140 entity links. 271,000+ graph connections. Private Layer. PIO-Hosting. Omegatech. ChinaNet. AsyncSSH residential fleets. Repeated default credentials with 100% success. Shared HASSH values across supposedly unrelated shells. Cross-border chains that any meaningful legal response would have to chase through multiple jurisdictions before the operator had already moved on.

The architecture is not hidden. It is not subtle. It is not waiting for a smarter analyst. It is visible to anyone who looks with enough patience and enough refusal to stop at the first convenient explanation. What the institutions with more power than this apartment do with that visibility is their own testimony. So far, the testimony is simple: the profits of tolerance still outweigh the costs of intervention.

The internet-abuse system is not failing in the dark. It is succeeding in the light, because the people who could stop it are still paid more reliably for managing its symptoms than for dismantling its structure.

That is the conclusion of The Architecture of Impunity. Not that the internet is lawless. Not that attribution is impossible. Not that all infrastructure actors are equally guilty. The conclusion is narrower and more damning: the architecture of global abuse is maintained by institutions that could impose friction but repeatedly choose cheaper forms of non-consequence. One Cowrie node in Iași saw enough to prove it. Everyone larger than this sensor now has to explain why they still have not acted as if it is true.