TI-2026-060B — The Census of the Invisible

Classification: HIGH · Population Study Confidence: HIGH — direct sensor census + prior-dossier corroboration TLP:WHITE — external networks named in full; the guessed hostnames are described by pattern, not by our estate. Series: The 200 That Lied — Part B. Part A proved a single 200 could lie. This part counts the liars, and finds they have a shape.

The shape of a blind spot

In Part A we established the mechanism: Authelia login pages, single-page apps and catch-all routers hand hostile requests a 200 OK, and reconstructing effective_status from the (method, host_type, path, ?rd=) tuple un-masks what actually happened. A single request proved the point. The obvious next question is the one every methodology paper skips: when you switch on the reconstruction across the whole corpus, what is the population of the invisible? Who lives in the blind spot, and does it have a shape?

It does. And the shape is not noise. It is a list of names you would recognise.

We define a network as benign-on-404 / hostile-on-reconstruction when its raw 404-rate sits below 0.20 — the number a status-keyed reputation system reads — while its effective_bad_rate sits at or above 0.60 once the mask is pierced. Across all time, twenty ASNs (with at least three distinct IPs each) meet that definition. Every one of them would pass a status-based reputation check with a clean record. Every one of them is, by reconstruction, mostly-to-entirely hostile.

Here is the census, worst-first:

Read the flags column and the shape jumps out. This is not a random draw from the internet's ASNs. It is three cohorts.

Cohort one: the Chinese state telecoms

Five of the twenty are Chinese state infrastructure — China Telecom in three separate ASNs (AS140527, AS4811, AS141679), CHINANET Guangdong (AS58466), and Huawei Cloud (AS136907, the largest single member at 46 IPs). China Telecom AS140527 posts the maximum possible signature: a 0.00 404-rate and a 1.00 effective-bad-rate — a state carrier that is, by reconstruction, totally hostile and, by status, totally clean.

This matters because of what these carriers are institutionally. China Telecom and Huawei are not bulletproof shells that vanish when reported; they are pillars of a nation's telecommunications, subject to China's National Intelligence Law, and — as this series' Glass Houses and Chinese Ecosystem dossiers documented — routinely present in hostile web traffic. The 200-mask does something specific for them: it lets that traffic never register as abuse in the first place. A Western SOC that would never dare block Huawei's ranges outright is not even given the chance to consider it, because the traffic wears a success code all the way through.

Cohort two: the Asian carriers

Korea Telecom (AS4766, 21 IPs, 0.91 effective-bad on a 0.05 404-rate) and SK Broadband (AS9318, 1.00 on 0.12) extend the same pattern one border over. These are consumer-broadband incumbents — the traffic is likely compromised residential and small-business hosts, CGNAT-fronted, disposable to the carrier and attributable only to it. The reconstruction does not tell us who is at the keyboard; it tells us the carrier's network is a launch surface that its own status logs will never flag.

Cohort three: the offshore and Western hosters — where the recidivists hide

This is the cohort that should worry a defender most, because it is where the 200-mask launders a criminal record.

• Contabo (AS40021, 🇩🇪) — 1.00 effective-bad on a 0.00 404-rate. Contabo is not an unknown; it is documented in this very corpus, in TI-2026-042T — The European Axis and TI-2026-032F — The OVH-Contabo Axis. A network we have named before, back in the census with a spotless 404 record.
• VPSVAULT.HOST LTD (AS215925, 🇸🇨) — registered in the Seychelles, the exact offshore-bulletproof jurisdiction dissected across the TI-2026-024 and TI-2026-026 series. Effective-bad 1.00, 404-rate 0.00.
• INTERNET-MAGNATE (AS214209) — announced across the UAE, Romania and the US at once, the multi-jurisdiction footprint of a network built to be hard to serve process on. 1.00 / 0.00.
• Akamai / Linode (AS63949) and Zenlayer (AS21859) — the respectable-cloud end of the same cohort: brand-name providers whose throwaway VMs run the reconnaissance and whose brand suppresses the block.

The finding writes itself: a reputation system that forgets an operator the moment its 4xx volume drops is a system you can beat by routing through the mask. Contabo and a Seychelles shell do not have to become new; they only have to become quiet on the one axis the industry watches. The 200-mask is a record-expungement service that the operators did not even have to ask for.

The surface they are mapping: 244 doors that were never built

The census answers who. The host taxonomy answers what they are looking for — and it is the most quietly alarming number in the corpus.

Our sensor classifies every requested hostname. 244 distinct hostnames that do not exist were probed — pure subdomain guessing, 3,656 distinct IPs, 64,114 hits, and because none of these hosts is real, every single hit returned a catch-all 200. On a status dashboard, 64,114 successful requests. On the reconstruction, 64,114 attempts to find a door that isn't there — yet.

And the guessed names are not random strings. They are a wordlist, and the wordlist is a confession of intent:

This is not enumeration for its own sake. It is a map of the credential-and-remote-access attack surface, drawn by guessing the operational subdomains that every organisation names the same way. mail dominating the list is the tell: the first thing this population hunts is the mail and webmail surface — the front door to credential theft and business-email compromise. And every probe is invisible, because a guess at a door that doesn't exist returns the same 200 as a guess at one that does.

The cartographers are the clouds

Here is the part that should end the argument about where the reconnaissance industry lives.

Every one of the four coordinated vhost-sweep campaigns — the machine-driven, multi-node subdomain-guessing operations — originates from a hyperscaler:

Azure, AWS and Google Cloud are not incidental hops here. They are the firing platform for the mapping phase of web attacks. The economics are perfect for the attacker: a VM is cents an hour, egress from a hyperscaler is trusted by default, and — the decisive advantage — the source IP wears a brand a defender cannot afford to block. The Azure sweep alone fired 10,845 requests at an effective-bad-rate of 0.96. That is not a misconfigured backup job. That is a reconnaissance business, running cloud-native, and its cover charge is the same 200-mask plus a logo.

The seven questions

Who is this? A structured population, not a mob: Chinese state telecoms, Korean carriers, and an offshore/Western hosting cohort that includes previously-documented recidivists (Contabo, a Seychelles shell), with the mapping phase concentrated on Azure/AWS/GCP.

Why did it attack? To map the credential-and-access surface (mail, auth, vpn, admin subdomains) as reconnaissance — the phase before exploitation, kept deliberately below the 404 waterline.

Who does it claim to be? Clean networks. Every census member claims, via its status footprint, to be a good citizen. The reconstruction is the only thing calling the claim.

Whom is it related to? The entity graph ties AS40021 to European Axis (042T), AS215925 to the Seychelles offshore chain (024/026), AS8075 to The WordPress Ghosts (046B). These are recurrences, not debuts.

Where is the money? Cheap. Hyperscaler VMs for the sweeps, throwaway offshore VPS for the persistence, free tooling. The whole point of the mask is that invisibility lowers cost — you do not pay the reputational tax of a 404 trail.

What is the official anchor? State telecoms (China Telecom, KT, SK), a German incorporated hoster, a Seychelles LTD, a multi-jurisdiction ASN, and three US hyperscalers. Every actor has a fully documented institutional anchor — and every anchor's abuse process stayed silent, because a status log gave it nothing to act on.

What if it is not who it claims / what is hidden? See below.

What if…

• What if the census is just the biggest networks, and size explains the hostility? No — size is controlled for. Huawei Cloud (46 IPs) and a 3-IP Seychelles shell sit side by side at the top. The signature is the gap between 404-rate and effective-bad-rate, and that gap is independent of volume.
• What if these are legitimate cloud tenants doing legitimate crawling? Then they would not concentrate their requests on non-existent mail, vpn and admin subdomains. Crawlers follow links; these follow a wordlist. Crawlers hit real pages; these hit doors that were never built.
• What if the offshore cohort is coincidence? Two of them (Contabo, VPSVAULT-SC) are already in our published record for exactly this behaviour. The graph flagged them before the census did. Coincidence does not repeat itself into a citation.

Steelman: the strongest case against the census

"You have drawn a shape by choosing your thresholds. Set the effective-bad cutoff differently and the 'shape' dissolves. Chinese and Korean carriers are simply the largest sources of internet background traffic, so of course they top any list. Hyperscalers host everything, so of course scanning comes from them. You are seeing faces in clouds."

It is the right challenge. Here is why it fails:

• The thresholds are conservative, and the shape survives them. Raise the effective-bad cutoff to 0.9 and the population is still Chinese state telecoms, an offshore cohort, and hyperscaler sweeps — the same three faces, fewer of them. Lower it and you add more of the same. The cohorts are stable across the cut; that is the opposite of a threshold artefact.
• Background-traffic volume is exactly what the 404-rate would capture — and doesn't. If these were just big, noisy, benign networks, their 404-rate would be ordinary, not 0.00. A 0.00 404-rate on real hostile intent is not what background radiation looks like; it is what a mask looks like.
• The recidivists are the control group. Contabo and the Seychelles shell were independently documented as hostile before this census existed. Their reappearance at 1.00/0.00 is not us finding a face in a cloud; it is a known face, wearing a new clean shirt.

The steelman concedes one true thing: any single census member, taken alone, could be argued down. The census is not a single member. It is a distribution with a stable shape that survives its own thresholds and contains its own controls. Confidence: HIGH.

Read between the lines

The most eloquent thing in this data is again a number that should not be zero. A real network — even a benign one — generates 404s: broken links, moved pages, typo'd URLs, dead bookmarks. A 404-rate of 0.00 across a network sending real traffic is not the signature of cleanliness. It is the signature of traffic that has been engineered to never miss visibly — every probe aimed at a catch-all or an auth-wall that answers 200 no matter what. The absence of errors is itself the anomaly. In a normal internet, everyone occasionally knocks on a door that isn't there and gets told so. A network that never gets told so is not lucky. It is only ever knocking where the doorman lies for it.

And read the cohorts together. State telecoms that cannot be blocked, offshore shells that cannot be served, and hyperscalers that cannot be firewalled — the 200-mask's population is precisely the set of networks a defender is institutionally least able to act against. That is not a coincidence of who scans. It is a selection effect of who can afford to be seen scanning — and the mask lowers even that bar to zero.

The human layer

Behind the mail.* at the top of the wordlist is the actual stake. The census is a map of where 3,656 machines went looking for other people's inboxes, login pages, and VPNs — and found the doors invisibly, one guessed subdomain at a time. Nobody whose mail server was fuzzed got an alert, because the fuzzing returned 200. The organisations in the crosshairs are not in this dossier by name; they are every business that names its webmail mail. and its VPN vpn. — which is to say, all of them. The census is not a list of victims. It is a list of the doorways the attackers now know to try, drawn from a surface that told them nothing while they mapped it.

Defense — turning the census into a tripwire

The reconstruction that produced this census is also a control. Three things fall directly out of it: (1) score ASN reputation on effective_bad_rate, not 404-volume, so a Contabo or a Huawei Cloud cannot launder its record by going quiet on 4xx; (2) treat a 0.00 404-rate on non-trivial traffic as a suspicion signal in its own right — the absence of misses is an anomaly, not a clean bill; (3) because the nonexistent_guessed host class is, by definition, traffic to hosts that were never built, it is a zero-false-positive tripwire — a request to a subdomain that does not exist is, categorically, reconnaissance, and can be scored hostile the instant it arrives, whatever status the catch-all returns.

Investigation metadata

Next in the series — TI-2026-060C: The Method Is the Message — the anomalous-verb dimension (a single IP issuing thousands of CONNECT tunnels), WebDAV abuse, and what the HTTP method reveals that neither status nor path can.

Part A proved a 200 could lie. Part B counted the liars and found they were organised — a census with three faces, a wordlist for a confession, and a 404-rate of zero where zero is the most suspicious number of all.