⏳ As-of note (2026-07-08): This dossier draws on the honeypot's malware-download / shared_malware graph, which is retention-limited: the shared_malware graph was later corrected to exclude junk/trivial hashes that had inflated these counts (the raw download data is fully retained since March 2026), so the malware-download figures cited here (downloaded-sample counts, shared_malware edge counts) are a point-in-time snapshot and are not live-reproducible (the current shared_malware graph holds ~68 links / ~16 IPs). The findings hold as of the capture window; the live graph will not match. Session, command, credential, HASSH and SSH-key evidence in this dossier is unaffected.

🏠 TI-2026-042Q — The Quiet Scanners: Universities That Attack

Series: Glass Houses Revisited | Letter 17 of 26 | Published: 2026-06-23

Abstract: Academic and research networks in our database: DFN Germany (49 hits), HaNoi University of Science and Technology (10 hits), Khajeh Nasir University Iran (10 hits), Air University Pakistan, Gunadarma University Indonesia, University of Waterloo, Carnegie Mellon. When universities scan the internet, is it research or reconnaissance?

I. The Academic Networks

Institution	ASN	Country	IPs	Hits
DFN (German Research Network)	AS680	DE	2	49
HaNoi University of Science and Technology	AS38727	VN	1	10
Khajeh Nasir University	AS47558	IR	1	10
Air University Islamabad (PERN)	AS45773	PK	1	4
Tanzania Education and Research Network	AS37182	TZ	2	5
Zambia Research and Education Network	AS37532	ZM	1	0
Alpha Strike Labs (research company)	AS208843	DE	4	0
Carnegie Mellon University	AS9	US	1	0
University of Waterloo	AS12093	CA	1	0

II. DFN: Germany's Research Network

DFN (Deutsches Forschungsnetz) connects over 300 German universities and research institutions. 2 IPs, 49 honeypot hits. This is not zero-day scanning or passive reconnaissance — 49 hits from a research network indicates active, repeated interaction with our honeypot. DFN's post-TI-017 publication activity (documented in the backfill) shows the network continued operating after being named.

III. Vietnam + Iran + Pakistan: The Military-Academic Nexus

HaNoi University of Science and Technology (Vietnam) — in the same country as Viettel (military telecom). Khajeh Nasir University (Iran) — named after a Persian polymath, operated under Iranian government oversight. Air University Islamabad (Pakistan) — an air force institution.

In all three countries, academic institutions operate under varying degrees of military/state influence. Academic networks provide plausible cover for scanning: "it's research." The same deniability that intelligence agencies use for surveillance — "it's signals intelligence" — applies to academic scanning: "it's cybersecurity research."

IV. The Research Defense

Some of these may be legitimate security research — Alpha Strike Labs is explicitly a security research company. But research that interacts with honeypots 49 times (DFN) or 10 times (HaNoi, Khajeh Nasir) is persistent, not casual. And when the same countries' military telecoms carry exploitation credentials (Viettel in Vietnam, NTC in Pakistan), the "research" defense becomes less plausible.

VII. The University That Shares Malware with 68 Attack Nodes

175.107.32.186. A Pakistani academic institution. CIPMA — with subdomains for authentication, cloud storage, HPC computing, IoT research, and a SIEM (Security Information and Event Management).

CIPMA Pakistan — Entity Relationships:

68 shared malware — downloading the same attack payloads as 68 other IPs worldwide
49 shared commands — executing the same post-exploitation commands as 49 other attackers
117 total entity relationships — highest for any academic IP in our database
Hosted on Cybernet AS9541 — same ISP as 042P's Pakistan-Russia ansible link
Subdomains: auth, cloud, drive, hpc, iot, siem

An institution where students attend class, submit homework through the cloud drive, authenticate through the portal — on the same network that downloads malware alongside 68 attack operations worldwide. The children studying at CIPMA use infrastructure that is operationally integrated with global attack campaigns.

VIII. MKUltra: The 70-Year Precedent

Our OSINT Library contains the 1977 Senate Hearing on CIA's MKUltra program:

"The Director of Central Intelligence wrote to the technical services staff officials criticizing their judgment because they had participated in an experiment involving the administration of LSD on an unwitting basis to Dr. Frank Olson, who later committed suicide. The individuals criticized were the same individuals responsible for this subproject 3, involving exactly the same practices."

Context: From 1953 to 1973, CIA's MKUltra used 80+ universities as sites for human experimentation — often without the institutions' knowledge. LSD administered to unwitting subjects. Mind control experiments on prisoners, mental patients, and students. At least one documented suicide (Frank Olson). Universities were chosen because their institutional legitimacy provided cover.

The Senate hearing discusses "preserving the independence of our research areas" — the fiction that academic freedom was maintained while CIA conducted experiments. The university launders the operation through its reputation.

70 years later: CIPMA Pakistan's academic network shares malware with 68 attack nodes. The mechanism is identical: academic institutional legitimacy provides operational cover. Whether 1953 (CIA drug experiments) or 2024 (malware distribution), the university's educational mission makes the operation invisible.

IX. Six Countries, Six Universities: The Global Pattern

Institution	Country	Notable	Child Exploitation Context
CIPMA	Pakistan	117 relations (68 malware, 49 commands)	132 children massacred at school (042P)
Max Planck Institute	Germany	Named: "inet-research-scan-5"	Historical: Lebensborn program
Universidad Don Bosco	El Salvador	Patron saint of youth, Oracle hosting	MS-13 child recruitment, gang violence
RENATA	Colombia	National academic network	FARC child soldiers, trafficking corridor
Ensign College	Ghana	Public health LMS	West African child labor/trafficking
PUCC (Panjab University)	India	pucc.edu.in	Child marriage, bonded labor

Of six academic institutions in our threat intelligence, five are in countries with documented child exploitation crises. The sixth (Germany) names its activity honestly ("research-scan"). The pattern: wherever children are exploited physically, the academic networks that supposedly serve those children also produce attack-adjacent traffic. Same governance failures. Same institutional dysfunction.

X. Don Bosco: The Patron Saint of Prey

Giovanni Melchiorre Bosco (1815-1888) — Italian Catholic priest who dedicated his life to the education of impoverished youth. Canonized 1934. Patron saint of young people, apprentices, and students. His mission: protect vulnerable children through education.

Universidad Don Bosco (El Salvador) carries this mission in its name. Its infrastructure (biblio.udb.edu.sv, rd.udb.edu.sv) appears in threat intelligence — hosted on Oracle Cloud (150.136.129.10, US infrastructure). VirusTotal flags. OTX records.

The Irony: An institution NAMED for the protection of children, in a country where MS-13 and Barrio 18 recruit children as young as 8 into gang operations. Where children's schools are extortion targets. Where children are killed for refusing recruitment. The university named to protect them exists on infrastructure flagged in threat intelligence. The patron saint of children's education watches over a network that cannot protect itself — in a country that cannot protect its children.

XI. The Max Planck Confession

139.19.117.129 — hostname: inet-research-scan-5.mpi-inf.mpg.de

Max Planck Institute for Informatics (Saarbrücken, Germany) NAMES its scanner. "inet-research-scan-5" — the fifth internet research scanning node. This is transparency: legitimate academic research into internet security, openly conducted.

But here is what matters: the traffic is identical. Same ports probed. Same protocols. Same fingerprints in our honeypot. If we cannot distinguish MPI's legitimate research from CIPMA's 117-relationship attack nexus, then:

Any academic institution can claim "research" for attack operations
MPI's transparency is the exception — CIPMA provides no explanation for 68 malware downloads
The cover is perfect: research scanning and malicious scanning are technically indistinguishable
"We were doing research" is unfalsifiable — like MKUltra's "academic freedom" cover

XII. CIPMA → Cybernet → Russia: The Same Network

CIPMA (175.107.32.186) is hosted on Cybernet AS9541 — the same ISP documented in 042P:

The Cybernet Chain:

CIPMA students study on Cybernet's network (auth.cipma.edu.pk, cloud.cipma.edu.pk)
CIPMA infrastructure shares malware with 68 attack nodes (shared_malware relationships)
Cybernet ISP (175.107.201.149) shares "ansible" credential with Digit One LLC Russia (042N)
Digit One Russia (213.167.43.130): 60 hits, 46 relationships, Moscow region

One ISP carries: children's education (CIPMA), international attack coordination (ansible cluster with Russia), and 30 entity relationships of its own. The Pakistani student doing homework and the Russian attack operator use the same upstream infrastructure. The child's education and the attack share the wire.

XIII. Why Universities Attack: Failed Governance as Dual Exploitation

The question is not "why do universities attack?" The question is: what kind of governance fails to both protect children AND secure academic networks?

The answer is the same governance in every case:

Pakistan — cannot prevent school massacres, cannot prevent madrasa radicalization, cannot secure CIPMA (117 relationships)
Colombia — cannot prevent FARC child soldiers, cannot prevent trafficking, RENATA appears in threat intel
Ghana — cannot prevent child labor/trafficking, Ensign College in threat intel
El Salvador — cannot prevent MS-13 child recruitment, Don Bosco university flagged

Same governance failure, dual manifestation: children exploited physically AND their educational networks exploited digitally. Not because the university is complicit — but because the state is equally incapable of protecting children and protecting infrastructure. The failures are the same failure.

XIV. The 042 Series: Education as Exploitation Vector

How Education Exploits Children Across the Series:

042P (Pakistan) — Army Public Schools make children military targets (132 killed). Madrasas radicalize millions. PERN academic network attacks.
042N (Russia) — "Summer camps" used to abduct Ukrainian children. Schools in occupied territories raided.
042Q (Universities) — Academic networks in 6 countries produce attack traffic. CIPMA shares malware with 68 nodes. Students attend class on attack infrastructure.
MKUltra precedent — CIA used 80+ universities for human experimentation on unwitting subjects.

Education — the institution designed to PROTECT children by giving them knowledge and opportunity — is consistently weaponized AGAINST them. Their schools are bombed (Pakistan), their camps are abduction traps (Russia), their networks are attack platforms (CIPMA), and their universities are experimentation sites (MKUltra). The institution meant to save them becomes the instrument of their exploitation.

XV. Sources and Methodology

Primary Sources:

LSN Honeypot — .edu hostname search (17 results, 6 countries), CIPMA entity relationships (117)
OSINT Library — MKUltra_Senate_Hearing_1977.pdf (CIA university exploitation precedent)
OSINT Library — Sex Trafficking: Inside the Business of Modern Slavery (child trafficking from conflict)
Cross-references: 042P (CIPMA on Cybernet → ansible → Russia/042N), 042N (Russia summer camp abductions)
Max Planck Institute hostname analysis (self-identified research scanner)

Methodology: Academic hostname identification via .edu TLD search in honeypot data. Entity relationship analysis for academic IPs (shared malware, shared commands as key relationship types). Historical precedent mapping (MKUltra → modern academic attack infrastructure). ISP correlation (CIPMA/Cybernet → 042P ansible cluster). Country-level governance failure correlation (child exploitation + insecure academic networks as dual symptoms). Traffic indistinguishability analysis (legitimate MPI scanning vs. malicious CIPMA operations).

⚠️ Correction & Update — 2026-07-04

Reason for update: Re-verification against the platform's new authoritative entity-resolution layer (source-attributed golden records with provenance, cross-source conflict tracking, and LLM disambiguation by claude-opus-4.8) and the newly-available shared_authorized_key operator-identity signal. Nothing below is removed; the original analysis is preserved above. These notes record what fresh data corrects or strengthens.

1. CIPMA ASN attribution corrected — Cybernet AS9541 → NTC AS23888. The original text placed CIPMA (IP 175.107.32.186, cipma.edu.pk) on "Cybernet AS9541." The authoritative golden record now resolves this host to AS23888 — National Telecommunication Corporation (NTC) (verdict: consistent; entity class: telecom; disambiguation confidence 0.92; resolver: claude-opus-4.8; a documented org_mismatch across ipinfo/cymru/rdap was coalesced by source priority). AS9541 is Cyber Internet Services (Pvt) Ltd., a distinct operator. This correction strengthens the Part P thesis: the cyber-policy academy sits directly on the military-connected national telecom's ASN — reinforcing "no separation between military communications infrastructure and educational systems," rather than a separate commercial ISP.

2. "117 relationships" figure refreshed → 98 (current observation window). The original composition (68 shared-malware + 49 shared-commands = 117) has aged. Current entity_links for 175.107.32.186 show 49 shares_commands + 49 shared_authorized_key = 98 behavioral relationships; shared-malware-download edges have decayed to 0 in the present window. The 49-command overlap is stable across both readings. shared_authorized_key (identical SSH authorized keys across hosts = same operator) is a stronger same-operator signal than shared malware downloads, and did not exist as a tracked relationship type when this dossier was first published. The core conclusion — an academic IP exhibiting a behavioral-relationship count no legitimate academic activity produces — stands.

Method note: These corrections derive from honeypot behavioral interlinking (shared commands, shared SSH keys, actor clustering) cross-checked against golden entity resolution — not from document co-occurrence. During the same audit, a separate class of automated OSINT-library backlinks (bulk blocklist / open-resolver dumps) was found to generate non-investigative edges and was excluded from the cross-corpus graph; it never affected this investigation's behavioral findings.

Correction logged 2026-07-04 · evidence: entity-resolution golden record + live honeypot entity_links · original analysis unchanged above.