Six layers. One infrastructure. The transit map is complete โ and it reveals that the internet's attack surface is not a bug. It's a feature of the architecture that enables everything else.
You cannot separate the roads from the commerce they carry. Not without destroying both.
The Stack
Series 053 mapped six layers of infrastructure enabling 9,972 malicious IPs:
| Layer | Article | Key Finding | Links Analyzed |
|---|---|---|---|
| Transit | 053A | 3 hyperscalers carry 10% of attack traffic | 11,064 |
| Registration | 053B | 661 IPs without meaningful attribution | 11,411 |
| Abuse Contact | 053C | 102K reports to one IP, still online | 11,324 |
| Registrar | 053D | 682 IPs behind RIPE's own markers | 10,575 |
| 053E | One email spans 15 ASNs (shell entity) | 3,873 | |
| Ownership | 053F | 26.9% of threats in 4 companies | 14,143 |
The Governance Gap
Each layer has a governance framework. Each framework was designed for good faith. Each has been subverted:
| Layer | Governance | Assumption | Reality |
|---|---|---|---|
| BGP Transit | Peering agreements | Transit providers verify customers | Transit is a commodity; verification kills business |
| IP Registration | RIR policies | Registrants are identifiable | "Private Customer" and registry self-references |
| Abuse Contacts | RDAP requirements | Contacts respond to reports | No audit, no enforcement, no consequence |
| Allocation | KYC cascade | Each hop verifies the next | Verification evaporates at LIRโcustomer boundary |
| Hosting | Terms of Service | Providers enforce acceptable use | Economic incentive to retain paying customers |
The gap isn't in any single layer โ it's in the spaces between layers. RIPE verifies LIRs. LIRs verify payments. But no one verifies the chain end-to-end. The system has accountability at each node and zero accountability along the path.
The Coordination Problem
Three potential solutions exist. All fail for the same reason:
1. Provider-Level Detection
If Microsoft, Google, DigitalOcean, and Amazon implemented aggressive behavioral detection, they could eliminate 26.9% of attack infrastructure. But:
- False positives cost legitimate customers (and lawsuits)
- Attackers migrate to the next provider (arms race)
- Unilateral action creates competitive disadvantage
2. Registry-Level Enforcement
If RIPE, APNIC, ARIN revoked allocations for non-responsive abuse contacts, 682+ RIPE-masked IPs would go offline. But:
- RIRs are registries, not police (mandate limitation)
- Revoking IP space affects all customers on shared infrastructure
- Jurisdictional limits prevent cross-border enforcement
3. Transit-Level Filtering
If Tier-1 providers (NTT, GTT, Lumen) refused transit for known-malicious prefixes, attack traffic would lose connectivity. But:
- Net neutrality principles prohibit content-based filtering
- "Known-malicious" is a judgment call with legal liability
- Distributed attacks use legitimate infrastructure (no distinct prefix to block)
Each solution requires coordination between competitors โ the exact condition that market economics optimizes against.
The Economic Reality
The transit map reveals an uncomfortable truth: the infrastructure enabling attacks is the same infrastructure enabling commerce, communication, and the global economy. You cannot surgically remove the attack surface without damaging the legitimate surface. They're the same surface.
| Provider | Malicious IPs | Total Customer VMs (est.) | Malicious % |
|---|---|---|---|
| Microsoft Azure | 560 | ~15,000,000 | 0.004% |
| Google Cloud | 640 | ~5,000,000 | 0.013% |
| DigitalOcean | 444 | ~700,000 | 0.063% |
| Tencent Cloud | 225 | ~3,000,000 | 0.008% |
From the provider's perspective: 0.004% to 0.063% of their infrastructure is malicious. This is background noise โ indistinguishable from legitimate experimentation, testing, and temporary misconfiguration without deep behavioral analysis. The needle is real. The haystack is enormous.
Read Between the Lines
The invisible hand of the internet's infrastructure isn't Adam Smith's โ it's a structural force that creates attack surface as a byproduct of creating value. Every design decision that makes cloud computing efficient also makes cloud-based attacks efficient. Every governance framework that enables rapid IP allocation also enables rapid attack deployment.
The transit map doesn't reveal villains. Microsoft isn't complicit. RIPE isn't negligent. FranTech isn't bulletproof. Each operates rationally within their incentive structure. The problem is that no one's incentive structure includes "prevent all misuse of the infrastructure they provide" โ because that incentive would destroy the infrastructure itself.
What the map reveals instead is opportunity cost. The concentration in four providers means that coordinated action by four companies could eliminate 26.9% of attack traffic. The concentration in five countries means that coordinated policy by five governments could address 60%+ of the problem. But coordination between four companies requires trust. Coordination between five governments requires diplomacy. Both are harder than building another firewall.
The transit infrastructure is invisible because it's ubiquitous. The hand that built it serves everyone โ including those who would use it as a weapon. That's not a failure of design. It's the design working as intended, in a world that's changed since the design was made.
The Thread Forward
The roads are mapped. The tenants are identified. The governance gaps are documented. In Series 054: The Clock Tower, we add the temporal dimension โ when attacks happen reveals as much as where they come from. Geography tells you where the infrastructure lives. Timing tells you when the operator works. And working hours tell you who they are.