๐ TI-2026-058N: The University
Series: The Operators | Letter N: When a Max Planck Researcher Gets Blocklisted Alongside Worm Fleets
139.19.117.129 made 410 attempts against our honeypot over 27 days. It shares SSH keys with Tor exit nodes. It's in the same actor cluster as criminal infrastructure. And it's one of the world's most respected computer science institutions โ doing exactly what it says on the tin.
The Accusation
The numbers look damning:
| Metric | Value | Looks Like |
|---|---|---|
| Honeypot hits | 49 | Persistent attacker |
| Login attempts | 410 | Brute force |
| Threat score | 97/100 | Nearly maximum threat |
| Active period | 27 days (May 21 โ Jun 16) | Long campaign |
| Actor cluster | 17 IPs across 3 countries | Distributed operation |
| SSH key sharing | 16 other IPs (Tor exits) | Criminal infrastructure |
| Blocklists | 3 (blocklist_de, cins_army, ipsum) | Known bad |
| Client | SSH-2.0-Go (custom) | Bespoke attack tool |
By every automated metric, this is a threat actor. Our system scored it 97/100. Three independent blocklists flag it. It's clustered with 16 other IPs via shared SSH keys. It runs a custom Go SSH client. It persisted for 27 days.
Every single one of these indicators is wrong.
The Defense
๐ฌ The Evidence of Innocence
| Indicator | What It Means | Verdict |
|---|---|---|
Hostname: inet-research-scan-5.mpi-inf.mpg.de | Self-identifies as "internet research scanner #5" | LEGITIMATE |
Abuse email: inet-scan-abuse@mpi-inf.mpg.de | Dedicated scanning abuse address โ they EXPECT complaints | LEGITIMATE |
| Credentials: only root:(empty) and admin:(empty) | Tests ONLY empty/default passwords โ cannot compromise patched systems | LEGITIMATE |
| Commands executed: 0 | Never runs any command after connection โ purely measures reachability | LEGITIMATE |
| Organization: Max Planck Institute for Informatics | Nobel Prize-level research institution, Saarbrรผcken, Germany | LEGITIMATE |
| ASN 680: DFN | German Research Network โ the NREN serving all German universities | LEGITIMATE |
| Port 4949 (Munin) | Monitoring tool โ they monitor their own scanning infrastructure | LEGITIMATE |
The Researcher and the Priest
The SSH key fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef connects 17 machines across three countries:
The Church of Cyberology (AS215125, Netherlands) operates Tor exit nodes โ documented in our earlier investigation TI-2026-019L as legitimate privacy infrastructure. Now we know who operates them: the same person who runs internet measurement research at the Max Planck Institute.
This makes perfect sense. A computer science researcher studying internet architecture:
- Needs scanning infrastructure (the MPI scanner)
- Studies privacy networks (operates Tor exits)
- Has hosting across Europe (DE/NL/FR for geographic diversity)
- Uses the same SSH key for all their infrastructure (standard ops practice)
- Builds custom Go tools (common in academic CS research)
The False Positive Problem
โ ๏ธ How Good Research Looks Like Bad Attacks
This IP appears on three independent blocklists:
- blocklist.de โ German-operated, community-reported blocklist
- CINS Army โ Collective Intelligence Network Security
- IPsum โ Aggregated threat intelligence feed
All three made the same mistake. Their detection logic is simple: "This IP makes many SSH connection attempts โ it's an attacker." The logic fails when the IP is a measurement probe that connects, tests a default credential, records whether it works, and moves on โ without exploiting anything.
The difference between a worm and a researcher:
| Behavior | Worm (058M) | Researcher (058N) |
|---|---|---|
| Credentials tried | 20+ per IP, dictionary attack | 2 only (root: and admin: empty) |
| Commands after login | 11-phase infection chain | Zero |
| SSH key injection | Yes (permanent backdoor) | No |
| Payload download | Yes (4 Chinese cloud C2s) | No |
| Self-identification | None (anti-forensic) | hostname + abuse email + RDAP |
| Announced purpose | Hidden | "inet-research-scan" |
| Opt-out mechanism | None | Email inet-scan-abuse@mpi-inf.mpg.de |
| Institutional backing | Shell companies (058K) | Max Planck Society (Nobel-tier) |
What the Research Measures
Internet-wide scanning studies from institutions like Max Planck, the University of Michigan (ZMap creators), and CAIDA typically measure:
๐ Common Research Questions
- Default credential prevalence: What percentage of SSH servers accept root:(empty)? This directly measures global security hygiene.
- Deployment statistics: How many SSH servers exist? What versions run? What key exchange algorithms are supported?
- Vulnerability exposure: After a CVE disclosure, how quickly do servers get patched?
- Geographic distribution: Which countries have the most exposed services?
- Longitudinal change: 27 days of scanning = temporal analysis of how the SSH landscape evolves.
The scanner numbered "5" implies at least 5 scanning instances โ likely covering different protocol ports or IP ranges in parallel. This is a systematic internet measurement study, published in academic conferences like IMC (Internet Measurement Conference), SIGCOMM, or USENIX Security.
The Ethical Framework
Academic internet scanning operates under established ethical guidelines:
- Minimal invasiveness: Test only default/empty credentials. Never exploit. Never persist. (โ confirmed: zero commands executed)
- Identification: Reverse DNS names the project. Abuse email provided. (โ confirmed: inet-research-scan-5, inet-scan-abuse@)
- Opt-out: Respond to abuse complaints and exclude reported IPs. (โ confirmed: dedicated abuse address)
- Institutional review: German research institutions require ethical board approval for internet measurement. (presumed: Max Planck Society has rigorous oversight)
- Benefit to community: Results published openly, improving global security. (presumed: academic publication)
The Cluster Composition
| Attribute | Cluster actor-635f93aca759 | Interpretation |
|---|---|---|
| Total IPs | 17 | Manageable research infrastructure |
| Countries | DE, NL, FR | EU-only (GDPR-compliant research) |
| ASNs | DFN (academic), Church of Cyberology (Tor), MOJI SAS (hosting) | Research + privacy + infrastructure |
| Total hits | 75 | Low for 17 IPs over 27 days |
| Avg threat score | 38.6 | Low (except the high-volume scanner) |
| Linking signal | Shared SSH key only | Same administrator, not behavioral similarity |
Average threat score of 38.6 across the cluster (vs. the enterprise clusters averaging 70-90). The only reason it's noticed at all is the volume from the single scanning IP. The Tor exits barely register (2 hits each).
The Verdict
๐ฏ Classification: LEGITIMATE RESEARCH
139.19.117.129 is NOT a threat actor. It is a Max Planck Institute internet measurement probe conducting academic research on SSH security posture.
Evidence of legitimacy:
- Self-identifying hostname and abuse email
- Only tests empty passwords (cannot compromise secured systems)
- Zero post-authentication commands (no exploitation)
- Institutional backing (Max Planck Society, German Research Network)
- Cluster composition entirely European academic/privacy infrastructure
Correction to our own scoring: Our automated threat score of 97/100 is a false positive. Volume-based scoring without behavioral analysis cannot distinguish between a worm that tries 20 passwords and runs 121 commands, and a researcher that tries 2 passwords and runs zero commands. The score should be โค20.
Why this matters for the series: Among 2,934 hostile nodes documented in this investigation, there exist entities that look identical by volumetric metrics but are categorically different in intent. The researcher's 410 attempts produce no damage. The worm's 155 attempts (058L, Indonesian node) produce permanent compromise. Numbers alone cannot distinguish research from attack.
The Lesson
Three blocklists. Threat score 97. Clustered with Tor exits. Custom attack tool. 27-day campaign. Every checkbox marked "malicious" by automated systems. And yet: a scientist, at a desk in Saarbrรผcken, measuring the internet's immune system.
The same SSH key that connects a Nobel Prize institute to Tor exit nodes tells a story about what computer science researchers actually do: they study both the attack surface AND the privacy infrastructure. They need scanning tools to measure vulnerability AND anonymity networks to study censorship. The tools of research and the tools of crime are identical. Only the intent differs. And intent cannot be measured by a blocklist.
We corrected our earlier assessment from TI-2026-058G, where this cluster was initially labeled a "scanning rack" before being identified as Church of Cyberology Tor exits. Now we complete the picture: it's a unified academic operation. The researcher scans from Germany, runs Tor from the Netherlands, and hosts from France. A pan-European privacy and security research laboratory operating openly, with institutional backing, doing exactly what it claims โ and being punished by automated systems for the sin of looking like the things they study.
Next: TI-2026-058O โ "The Counter-Intelligence" โ How the enterprise monitors its own exposure: shuffleon2025#, nimda callbacks, and credential-as-acknowledgment.
โ ๏ธ Correction & Update โ 2026-07-04
Reason for update: Persistence re-verified 2026-07-04. Nothing above has been altered or removed; this is an append-only forensic addendum.
The misclassification persists. Re-checked on 2026-07-04, IP 139.19.117.129 (Max Planck Institute / DFN, AS680) still scores 96/100 threat with GreyNoise classified malicious and AbuseIPDB 100. The volume-based scoring flaw this dossier identified is not a transient artefact โ it remains live months later, demonstrating the problem is systemic. Original analysis preserved above.
Added by automated platform-wide correctness audit (LSN threat-intel), 2026-07-04. Method: cross-checking published claims against live honeypot / campaign / entity-resolution data via MCP tools.