Twenty-two thousand three hundred eleven times, an IP looked sideways and found a neighbor doing exactly the same thing. Same prefix. Same behavior. Same purpose. On some /24 blocks, every single address is hostile. On others, one attacker hides among 131,000 legitimate tenants. The prefix tells you which.
In real estate: location determines everything. In IP space: prefix density determines intent.
I. The Largest Relationship
Same_prefix is the most prolific relationship in our entity_links database โ more than temporal_correlation (1,616), more than shared_geo_pattern (4,531), more than shared_rdap_org (10,903). It is the simplest possible assertion: these IPs share a BGP prefix announcement. They are routed through the same autonomous system, announced as a single block, and therefore โ in the eyes of the internet's routing table โ neighbors.
But shared routing is not shared intent. The same /24 that hosts a Tor exit node might also host a legitimate web server. The same /17 that carries 155 Google Cloud attack IPs carries millions of legitimate ones. The signal is in the density.
II. The Anonymization Clusters
๐ฉ๐ช 185.220.101.0/24 โ Stiftung Erneuerbare Freiheit
One hundred eight IP addresses. Every one a confirmed Tor exit node. Every one linked to every other by the same_prefix relationship โ because they all share 185.220.101.0/24. That's 108 ร 107 รท 2 = approximately 5,778 bidirectional links from a single prefix.
This is not a botnet. It's a privacy foundation operating exit relay infrastructure. But from our honeypot's perspective, it's a wall of anonymization through which attackers route traffic to break geographic attribution. The intent of the infrastructure operator differs entirely from the intent of the traffic passing through it.
๐ณ๐ฑ 192.42.116.0/24 โ Church of Cyberology
The deliberately provocative name masks legitimate Tor exit infrastructure. Twenty-two nodes on a Dutch /24, operating under an organization name designed to invoke both religious freedom and digital rights. Combined with the German cluster, 130 Tor exits on just two prefixes create the anonymization layer that enables geographic obfuscation for the entire attack ecosystem.
Together, these two clusters account for roughly 50% of all same_prefix relationships. This is an important caveat: the same_prefix topology is dominated by anonymization infrastructure, not by attack coordination. The Tor exit nodes aren't coordinating with each other โ they're each independently providing anonymity services. Their clustering is an artifact of deployment policy, not operational intent.
III. The Three Densities
| Pattern | Prefix Size | Malicious Density | Example | Interpretation |
|---|---|---|---|---|
| Dense | /24 (256 addr) | 50-100% | 87.251.64.0/24 (ISAEV) | Purpose-built attack block |
| /24 | ~42% | 185.220.101.0/24 (Tor) | Anonymization infrastructure | |
| /24 | ~6% | 91.92.40.0/24 (TechTies) | Hostile hosting provider | |
| Medium | /21 (2,048 addr) | 1-2% | 27.79.40.0/21 (Viettel) | Compromised residential |
| /21 | ~1% | 116.99.168.0/21 (Viettel) | Compromised mobile | |
| Sparse | /17 (131,072 addr) | 0.001% | 142.171.128.0/17 (MULTACOM) | Commodity cloud abuse |
| /17 | 0.001% | 51.158.128.0/17 (Scaleway) | Individual VPS instances |
Dense /24: The Dedicated Block
When we see 14+ malicious IPs on a /24 (87.251.64.0/24 โ ISAEV Igor), the entire subnet is weaponized. These blocks were acquired for the purpose of attack. No legitimate services share the space. Abuse reports to the ASN operator are meaningless because the ASN operator is the attacker. TechTies' 91.92.40.0/24 shows the same pattern: 16 malicious IPs, avg threat 61.7, Spamhaus-listed. Every resident of that block is hostile.
Medium /21: The Involuntary Botnet
Viettel's /21 prefixes contain 18-22 malicious IPs out of 2,048 addresses โ roughly 1% density. These are not attack infrastructure. They are compromised phones, home routers, and consumer devices on a Vietnamese mobile network. The prefix is legitimate. The infections are parasitic. The operator (Viettel) likely doesn't know which specific customers are compromised at any given time.
Sparse /17: Cloud Noise
MULTACOM and Scaleway each show 2-5 malicious IPs within /17 blocks (131,072 addresses). At 0.001% density, these are isolated instances โ individual attackers renting individual VPS units. There is no subnet-level coordination. Each malicious IP is independently operated. The provider is not complicit; they're simply too large to catch every abuser.
IV. The Weaponized Subnet Signature
The diagnostic question for any prefix: what percentage of its address space is malicious?
The Density Threshold
Above 5% density on a /24 = deliberate attack infrastructure. The operator chose this. Below 1% on a /21+ = environmental contamination. Between = grey zone requiring behavioral analysis.
This creates an actionable triage: any /24 with 5+ malicious IPs (out of 256) warrants prefix-level investigation, not IP-level. The subnet itself is the entity.
For ISAEV's /24, this is definitive. The ASN was allocated February 2026. The /24 was announced shortly after. Within weeks, every observable IP on the block was attacking. This is not infrastructure that got infected. This is infrastructure that was born hostile.
V. The Cross-Prefix Coordination
Same_prefix shows who is physically adjacent in routing terms. But the temporal_correlation from 054A shows who is operationally coordinated. When we overlay the two:
| Prefix | Same-Prefix Links | Also Temporal? | Meaning |
|---|---|---|---|
| 87.251.64.0/24 | 14 | Yes (99 temporal) | Same subnet AND coordinated timing = single operator |
| 185.220.101.0/24 | 108 | No | Same subnet but independent exits = infrastructure, not coordination |
| 91.92.40.0/24 | ~16 | Yes (4 temporal) | Same subnet AND some coordination = hosted attack team |
| 51.158.128.0/17 | 2 | No | Same large prefix, no coordination = unrelated tenants |
The overlay is the diagnostic. Same-prefix alone is necessary but not sufficient. Same-prefix PLUS temporal correlation is the definitive signal of a coordinated unit.
VI. Read Between the Lines
The Prefix as Procurement Evidence
When an operator acquires a /24 and weaponizes every address, they've made a purchase order. The size of the block tells you the scale of the operation. The allocation date tells you the planning horizon. ISAEV's 8-week gap between ASN allocation and first attack is the minimum infrastructure provisioning time for this class of operation.
The Anonymization Tax
130 Tor exits consuming 50% of our same_prefix topology is not a flaw in the analysis โ it's a revelation about the economy. The attack ecosystem invests heavily in anonymization. Those 130 nodes aren't cheap to operate (bandwidth, legal risk, hardware). Someone funds them. The attackers may or may not be the funders โ but they are certainly the beneficiaries.
VII. The Thread Forward
Next: The Working Day
Prefixes tell us where. Temporal correlation tells us when. But the circadian rhythm of individual IPs โ their daily patterns of activity and rest โ tells us something more intimate: the schedule of the human behind the machine.
In 054D โ "The Working Day", we analyze attack timing at the individual IP level. When an IP follows a 9-to-5 pattern, the attacker has a day job. When it's 24/7, it's pure automation. The circadian signature is a fingerprint of human presence.
Continuity
โ TI-2026-054B "The Geography of Command" โ the countries within these prefixes
โ TI-2026-053A "The Roads They Travel" โ BGP transit infrastructure carrying these prefixes
โ TI-2026-054D "The Working Day" โ circadian analysis of individual attackers