The Same Hand — When Behavior Is the Only Proof of One Operator

TI-2026-068D · Series: 🧭 Ground Truth · TLP:WHITE · 2026-07-09

Three dossiers on where the graph's sources disagree about identity. This one closes the arc from the other side: the handful of things the graph asserts with confidence — that two addresses are one hand — and why those claims come from its humblest source.

📋 The Short Version

068A, B and C were about doubt — the 60,077 places where authoritative sources contradict each other about who owns what and what to call it. This one is about conviction: the positive links that say these two addresses are the same actor.

There are far fewer than you'd expect, and they come from an unexpected place. Not RDAP. Not any registry. Not a commercial feed. Every single "same operator" claim in a 943,692-entity graph comes from the honeypot — priority 40, near the bottom of the authority ladder that 068A laid out.

That is not a weakness. It is the whole point. A registry can tell you who owns a box. Only behavior — a shared SSH key, a reused credential, an identical malware binary — can tell you whose hand is on it. Identity is registered; agency is behavioral. And the graph keeps them on separate shelves.

Confidence: HIGH — direct measurement, with the key cluster independently corroborated by two prior dossiers.

1. Two Different Questions

068A's authority ladder put registries on top: rir_delegation 100, rdap 95. Those answer who owns this address. They are excellent at it and useless at anything else.

Because ownership is not agency. RDAP will tell you that 102.88.137.80 is registered to Suburbia Networks in Nigeria. It will never tell you that the same hand is also operating a box in Hong Kong and another in Brazil. The registry records a deed; it has no field for a trigger finger.

To answer whose hand, you need something the operator carries with them from address to address — and that is only visible to whoever watches the behavior.

2. The Claim Comes From the Bottom of the Ladder

Here is every positive-attribution relation in the graph, and its source:

One source. Every edge. The honeypot — which 068A ranked near the bottom for questions of identity — is the sole authority for questions of agency, because agency is precisely what it can see and registries cannot: the SSH key reused across nodes, the bespoke credential 345gs5662d34 typed at box after box, the identical binary dropped on machine after machine, the HASSH fingerprint that survives an IP change.

The ladder is not "how trustworthy is this source." It is "trustworthy for what." A registry is authoritative about title and silent about conduct. The honeypot is the reverse. The graph uses each for exactly what it can prove.

3. It Would Rather Say Nothing

The most striking number is how little the graph is willing to assert:

The strongest positive claim is the rarest. Those 3,308 same_operator edges resolve to just 4 operator clusters spanning 97 IPs — 0.8% of the graph's 12,306 IP entities. For the other 12,209 IPs, the graph declines to name a shared hand at all.

That silence is deliberate. A false "same operator" is the most damaging error attribution can make — it invents a conspiracy out of coincidence, and coincidences are cheap on a network where everyone runs the same commodity kits. So the graph requires a carried artifact — a secret the operator drags between addresses — before it will draw the edge. No shared key, no claim.

4. The 81

One cluster dominates the four: 81 IPs, wired into a near-complete graph. And we have met it before.

Its members — 102.88.137.80, 170.106.82.79, 91.99.110.230, 202.51.214.98, and 77 more — are the Outlaw/mdrfckr botnet already documented in TI-2026-008B ("The Key to 81 Machines") and TI-2026-052A ("The Family Tree"): 81 nodes unified by the signature credential 345gs5662d34 and a single binary, SHA256 a8460f44…, deployed across all of them.

This is the load-bearing point. Those earlier dossiers identified the operator from shared malware and a shared backdoor key. The same_operator layer here reconstructs the exact same 81 machines from an independent behavioral pass. Two different methods — malware/key analysis and behavioral clustering — converging on the identical operator is about as strong as attribution gets. The 81-node operator is one of the most solidly attributed actors in the entire corpus, precisely because two roads led to it.

5. The Confidence Ladder Is the Argument

The four relations are not interchangeable, and their confidence numbers say why:

• same_operator (0.90) — rests on a carried secret: a shared SSH key or a bespoke credential. The strongest behavioral proof, because commodity actors do not share private keys.
• shared_tooling (0.79) — rests on a shared toolkit (matched HASSH, same scanner). Weaker, because a toolkit can be commodity — two unrelated actors can buy the same tool.
• coordinates_with (0.75) — rests on timing: addresses firing in lockstep.
• multi_vector_operator (0.57) — rests on cross-protocol inference (the same actor on HTTP and SSH). Held deliberately low, because it is the easiest to over-read.

A shared toolkit is not a shared operator, and the ladder exists so the two never get conflated. When a dossier states attribution "at high confidence," this is the machinery that word is standing on: a rung, and a reason.

6. Closing the Arc — Identity Is Registered, Agency Is Behavioral

Put the series together:

• 068A — the method: 21 ranked sources, and the disagreement they record.
• 068B — ownership conflict: who holds title to an IP (registry vs BGP) — 79% disagree.
• 068C — label conflict: what to call a threat (a synonym gap, mostly).
• 068D — the positive claim: whose hand is on the address.

The resolution is clean. The first three are about identity, and identity comes from the top of the ladder — registries, with all their contested, leased, mislabeled ambiguity. The fourth is about agency, and agency comes from the bottom — behavior, observed locally, asserted rarely and only with a carried secret in evidence.

The registry tells you whose name is on the deed. Only the honeypot tells you whose hand pulled the trigger. Confusing the two — mistaking a registrant for an operator, or a shared tool for a shared hand — is the root of most bad attribution. The graph's entire design is a refusal to make that mistake.

Investigation Metadata

Cross-references: TI-2026-068A (The Authority — the ladder) · TI-2026-068B (The Deed and the Tenant) · TI-2026-068C (The Synonym Problem) · TI-2026-008B (The Key to 81 Machines) · TI-2026-052A (The Family Tree — the same 81-node operator).