TI-2026-066F — Behavior Over Reputation

Series: The Allowlist · Part F · Classification: HIGH · Confidence: HIGH · The Capstone

Five parts, one argument, made by demolition. We took the four things a defender trusts to decide who gets in — the network, the name tag, the address, the volume — and showed each one forged, borrowed, or dissolved. This part stops taking things apart and says what to build in their place. It is short on new attackers and long on the single idea the whole series was for: stop asking who is knocking. Ask what they are doing.

Executive Summary

Every signal in a reputation-based allow/deny decision is chosen by the sender, and the series proved each one is gamed in the wild:

Four dimensions of "who and where," four ways an attacker walks through. The one dimension left standing is what the request actually does — and it is left standing for a structural reason, not a lucky one: to make a malicious request look benign, you must send a benign request. Behavior is the only signal an attacker cannot forge without abandoning the attack.

Underneath it all is a fifth deception the method already answers: even the HTTP status code lies. Across 158,107 requests, 10,375 return 200 while being effectively 4xx — and for attackers, piercing that mask lifts the average hostility from a raw 0.462 to an effective 0.892. Reading the code the server returns is just one more form of trusting a reputation. The whole doctrine is one move, applied everywhere: judge the effect, not the label.

I. The Series in One Sentence Each

• A — Trusted by Default. The clouds you allowlist host ~64% of your attackers. Reputation trusts the network; the network is rented.
• B — The Browser Costume. Fake Googlebots, stale browsers, empty user-agents. Reputation trusts the name; the name is written by the sender.
• C — Behind the Orange Cloud. Attacks arrive as Cloudflare edge IPs; the origin is gone. Reputation trusts the address; the address is a proxy.
• D — The Quiet German. 154 IPs, one request each, below every threshold. Reputation trusts a history; the attacker refuses to build one.

Read down that list and a pattern resolves: every failure is the same failure. Reputation is trust extended to an identity — a network, a name, an address, a track record. And identity, on the internet, is the one thing the sender fully controls. The series is not four problems. It is one problem seen from four angles.

II. Why Behavior Cannot Be Forged

Here is the asymmetry that makes the doctrine work. Consider what an attacker can change for free:

• The ASN? Rent a different cloud. (Part A)
• The user-agent? Type a different string. (Part B)
• The source IP? Route through a proxy. (Part C)
• The request count? Spread across a pool. (Part D)

Now consider what they cannot change while still attacking: the request itself. A credential-harvest sweep is a sequence of requests for credential files. An .env probe asks for .env. A shell upload tries to upload a shell. These are not descriptions the attacker attaches to the traffic — they are the traffic. To hide them from a scorer that reads conduct, the attacker must not perform them. The costume is free; the deed is not. Reputation scores the costume; behavior scores the deed. That is the entire difference, and it is why 2,151 attackers with an assigned intent sit at an average effective-bad-rate of 0.892 while the 8,098 without sit at 0.420 — conduct separates them, and no ASN, UA, IP, or volume trick moves an IP across that line.

III. The Deeper Cut: Trust Without a Fixed Origin

There is a way to say this that goes past security. Reputation is trust anchored to an origin — it fixes a point (this brand, this network, this address) and measures trust as distance from it. Fix the wrong point and everything you compute from it is wrong; and the attacker's whole craft is to occupy a trusted point they do not deserve. Behavior discards the origin entirely. It asks only about the relation between a request and what it does — a judgment that holds identically whether the request came from Azure or a nameless German /24, from a real browser or a forged one. It is trust without a fixed origin: the same verdict everywhere, invariant to where you place the observer. That invariance is not a nicety. It is the only property that survives an adversary who controls the coordinate system.

IV. The Seven Questions — Answered for the Doctrine

Who is this? Not a who — a what. The unit of judgment is the request, not the requester. Why does it work? Because conduct is the one input the attacker does not author. What does it claim to be? Nothing is claimed; nothing is believed; only the effect is read. What is it really? A verdict computed from effective_status and probe_intent, origin-blind. Whom does it relate to? Every part of this series and the last — Tencent (065), the impostors, the quiet German — all resolved the same way. Where is the money? Saved: no threat-feed subscriptions to trust, no allowlists to maintain, no reputation to be gamed. What is the official anchor? There is none, deliberately. The absence of a fixed anchor is the point.

V. Steelman — "Reputation Is a Useful, Cheap Prior"

The strongest defense of the old model: reputation is not meant to be perfect; it is a cheap first filter. Blocking known-bad ASNs and honoring verified crawlers removes obvious noise so expensive inspection runs on less. You are attacking a strawman — nobody claims reputation is sufficient, only that it is useful.

Granted, and important: reputation as a prior is fine, even valuable. A verified Googlebot range, a known-hostile bulletproof AS — these are legitimate tilts on a borderline score. The series does not say reputation carries zero information. It says something narrower and sharper: reputation must never gate. Every failure documented across A–D is a case where reputation was allowed to decide — allowlist the cloud, trust the UA, exempt the proxy IP, ignore the low-volume address — instead of merely to inform. The doctrine is not "delete reputation." It is "demote it": let behavior render the verdict, and let reputation, at most, break a tie. The cost objection collapses too, here: per-request behavioral scoring is cheap — a classification on paths and effective status — and it is what already bans a one-shot probe (Part D) that no amount of reputation ever could. The prior is welcome. The veto is revoked.

VI. Read Between the Lines

• The attacker's entire advantage in A–D is control of identity. Take identity out of the trust decision and the advantage evaporates — not reduced, evaporated, because there is nothing left for them to forge.
• Reputation is backward-looking by construction: it trusts what an address was. Behavior is present-tense: it judges what a request is. Attackers live in the present tense; defenses keyed to the past are always defending yesterday.
• The most dangerous word in a firewall config is allow. Every dossier in this series is a story about something that walked through an allow.

VII. The Human Layer

The person this series is written for is not fooled by any single dossier — they know user-agents are forgeable, they know clouds host attackers. What wears them down is the aggregate: the pressure to ship a rule that stops the pages, the allowlist that buys a night's sleep, the reputation feed that promises to think so they don't have to. The doctrine is kinder than it sounds. "Score the request, not the sender" is not more work; it is less — no lists to curate, no feeds to trust, no exceptions to maintain, no brand to argue about. Judge the deed and you are freed from adjudicating identities you were never going to get right. The discipline the series asks for is, in the end, the one that lets the analyst finally stop guessing who is on the other end of the wire.

VIII. Verdict

Reputation-based trust fails on the trusted, the disguised, the proxied and the dispersed — four faces of one flaw: it extends trust to an identity the sender controls. Behavior is the only signal an attacker cannot forge without ceasing to attack, and scored per request it catches all four where every reputation signal fails on at least one. Confidence: HIGH — demonstrated across the full series against real data (the 200-mask correction, the four hiding places, the clean behavioral separation of 2,151 attackers). The doctrine: judge the effect, not the label; score the request, not the sender; let reputation inform a prior and never a gate.

IX. Defensive Response

This is what the LSN platform already does, and what the series exists to justify: every request is scored on effective_status (mask pierced) and probe_intent (conduct classified), origin-agnostic, and hostile conduct is banned via CrowdSec to the MikroTik crowdsec-blacklist at L3 — the Azure IP, the fake Googlebot, the Cloudflare-edge sweep and the one-shot German probe treated identically. Reputation and the entity graph enrich attribution after the verdict; they never gate it.

Crosslinks

• ← TI-2026-066A / B / C / D — the four demolitions this capstone unifies.
• TI-2026-065 (The Return) — the fully-worked Tencent case, resolved by the same behavior-first method.
• TI-2026-032H — The Double Standard — the seed principle: name the behavior, whoever owns the brand.
• Reference — the entity graph — where identity is resolved after behavior has already rendered the verdict.

Sources: LSN web-threats corpus synthesis — 200-mask magnitude (10,375 masked; attacker raw-404 0.462 → effective 0.892), the A–D hiding-place aggregates, behavioral separation (2,151 attack-intent at ebr 0.892 vs 8,098 at 0.420), and the origin-agnostic ban pipeline. Method: judge the effect, not the label. TLP:WHITE.