The Sharpest Edge: Where the Threat Score Peaks

TI-2026-075R · The Armory, Part R Confidence: HIGH — direct honeypot threat scoring + multi-source corroboration Classification: TLP:WHITE

The biggest fleet is not the most dangerous

The previous letter, The Version Fleets (075P), was about reach — the giant libssh cohorts, 1,341 IPs of one build across 84 countries. This one is about danger, and the first thing to say is that the two are not the same axis, and they do not point at the same place.

Run down the census's tool clusters by average threat score rather than by size, and the ranking inverts. The enormous version fleets — libssh_0.11.x at 1,341 IPs, libssh_0.9.6 at 1,312 — sit in the low 40s and low 50s. They are big, and they are mostly harmless per node. The peak belongs to something small: the libssh2_1.11.1 fleet (HASSH 0a07365cc01fa9fc82608ba4019af499, roughly 59 IPs) at an average of about 76 — nearly double the census mean — with its sibling, the libssh2_1.11.0 scanner tier, close behind at ~71.

The most dangerous tier of the whole armory is one of its smallest. That inversion is the subject of this letter, because it is a direct correction to the instinct that governs most defence: chase the loudest, biggest thing. The loudest, biggest thing is, by the census's own scoring, near the bottom of the danger ranking. The sharpest edge is somewhere much quieter.

What lifts a cluster to the sharp end

Why does a 59-IP fleet score twice what a 1,300-IP fleet does? Not because of any single trait — no one signal produces a 76. It is the stacking of several independent bad signals on the same nodes.

The libssh2_1.11.1 fleet classifies dominantly as botnet, not mere scanner. A meaningful share of its members carry the sub-behaviour c2_infrastructure — they are not just attacking outward; they host the operator's own command-and-control. And independent, external reputation sources corroborate: GreyNoise flags the same nodes as malicious. Botnet behaviour, plus self-hosted control plane, plus an outside malicious verdict, all landing on the same addresses — that is what compounds into a high score.

The lesson is about how a threat score is built. It is a composite, and the sharp edge is precisely where multiple axes of badness coincide. A node that only scans scores low. A node that scans and hosts C2 and is independently flagged malicious scores high, because three separate observers, using three separate methods, all point at it. The score is a form of triangulation, and the peak is where the triangulation converges.

Quality over quantity

The cleanest way to state the difference between the sharp edge and the bulk is this: in the big fleets, most nodes are harmless; in the sharp-edge cluster, every node is bad.

The 1,300-IP version fleets carry a heavy ballast of low-threat scanners — machines that connect, negotiate, maybe fire a credential, and do nothing worse. That ballast drags the fleet's average down even though the fleet is enormous. The sharp-edge cluster has no ballast. Its ~59 nodes are uniformly high-threat botnet and C2 machines; there is nothing harmless in it to dilute the average. So the score measures concentration of badness, not breadth of presence — and by that measure, fifty-nine uniformly dangerous nodes outrank thirteen hundred mostly-harmless ones.

For a defender this reframes the whole triage question. Volume answers "how many are knocking?" The threat score answers "how many of the ones knocking will actually hurt me?" — and those are different populations. The version fleets are weather: vast, ambient, mostly survivable. The sharp edge is a knife: small, specific, and the thing that actually cuts.

Current build, self-hosting, on rented ground

The sharp edge has a consistent profile, and every part of it corroborates the last. It is a current library build — libssh2 1.11.1, a recent release — which, per The Version Fleets (075P), marks a maintained, actively-run operation rather than the abandoned autopilot of the old-build fleets. Its C2-classified members sit on rented commercial infrastructure — Seychelles-registered networks and Netherlands hosting among them — the disposable substrate the whole series keeps finding under the offense.

Put those together and the profile is unmistakable: a small, current, self-hosting botnet on rented ground is a live, professionally-run operation. It is not a fossil still twitching on inertia; it is someone's active project, maintained, adaptive, and self-contained enough to host its own control plane. That is exactly the kind of operation that should sit at the top of a defender's attention — and exactly the kind that a volume-ranked view, dominated by the giant static fleets, buries near the bottom.

This tier is not unknown to the wider corpus. Identity Without an Address (TI-2026-048C) profiled a libssh2_1.11.1 botnet from the operator angle — bound together by a reused SSH key across many addresses. The Armory adds the complementary reading: what makes this tier the census's most dangerous is not only that a key unites it, but that its nodes stack botnet behaviour, self-hosted C2, and malicious reputation into the highest composite score in the dataset. The key names the hand; the stacked signals name the edge. Same tier, two lenses.

Reading the sharp edge — for defenders

• Rank by threat, not by volume. The most dangerous cluster is small enough to vanish in a size-ranked view. Sort your attack surface by composite threat and sub-behaviour; the sharp edge lives near the top of that list and the bottom of the volume list.
• Build your own composite. A single signal under-ranks the genuinely dangerous. Correlate behavioural class, self-hosting indicators, and external reputation, and escalate where they converge — the convergence is the triangulation that makes a 76.
• Hunt the self-hosting nodes. c2_infrastructure members are both attacker and control plane; blocking one degrades the operation more than blocking a plain scanner. They are the highest-value entries to identify and share.
• Treat current-build high-threat clusters as live. They are maintained and likely to adapt, unlike the static old-build fleets. Expect change and monitor accordingly.

The armory is mostly weather — vast, ambient, low-grade fleets that a defence can largely absorb. This letter is about the exception hiding inside the totals: the small, current, self-hosting cluster where every node is bad and three independent observers agree it is bad, scoring twice the mean while carrying a fiftieth of the addresses. It is the sharpest edge of the whole arsenal, and the surest way to miss it is to keep watching the biggest fleets — which is exactly where the danger is not.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the census whose threat scoring peaks here.
• TI-2026-075P — The Version Fleets — reach as an axis; this letter is its danger counterpart.
• TI-2026-048C — Identity Without an Address — the same libssh2_1.11.1 tier, read from the operator angle.
• TI-2026-075I — The Weapon Is Never the Point — the synthesis: danger is in behaviour and stacked signals, not the tool.

This dossier documents observed adversary infrastructure and behaviour for defensive purposes. Threat scores and self-hosted-C2 node indicators are published to help defenders rank and block by danger rather than volume. TLP:WHITE.