The Pipe That Hides: Why You Cannot Block a VPN

TI-2026-077B · The Laundered Vector, Part B Confidence: HIGH Classification: TLP:WHITE

The obvious question

Part A ended with a live attack laundered through a commercial VPN's exit infrastructure — credential theft and a worm arriving under fourteen false flags. Any defender who reads that has the same immediate reaction, and it is the right instinct: so block the VPN. If AS212238 is where the attack is coming out, cut it off.

This letter is about why that instinct, followed literally, is both impossible and wrong — and about what to do instead, which turns out to be exactly what already worked. The answer rests on one fact that everything else follows from: a VPN exit is not a person. It is a pipe, and the pipe is shared.

What a VPN exit really is

Strip away the marketing and a VPN does something simple. It takes your internet traffic, encrypts it so your local network and your ISP cannot read it, and sends it to one of the VPN company's servers somewhere else in the world. That server then forwards your traffic on to the website you wanted. The website answers the server, and the server relays the answer back to you. The website never sees your address — it sees the server's. That forwarding server is called the exit.

Here is the fact that decides this entire dossier: one exit is used by many people at the same time. A single exit address — one of the cg-dialup.net (CyberGhost) or datapacket.com (Datacamp) addresses in Part A — is carrying the traffic of thousands of unrelated customers simultaneously. The attacker running credential theft and the commuter checking their bank on café Wi-Fi come out of the same address, in the same minute, indistinguishable at the network layer. The exit is not a computer belonging to one attacker. It is a communal doorway that thousands of strangers walk through at once.

So when you say "block the VPN exit," what you are actually saying is: block the doorway that thousands of innocent people are using, in order to stop the one who is not. That is the whole problem in a sentence, and everything below is why it matters.

It is the same thing as a Tor exit

If this sounds familiar, it should. The Armory census already worked through this exact reasoning for a different pipe — Tor. The Innocent (TI-2026-075Y) documented the honeypot's 1,124 Tor exit nodes and reached a careful conclusion: a Tor exit carries genuinely mixed traffic — yes, attackers who want anonymity, but also privacy-conscious users, journalists, researchers, and ordinary people routing around censorship or surveillance. Because the traffic is mixed, a Tor exit is a shared pipe, not an actor. Its exit status raises scrutiny — you look harder at what comes out of it — but it does not, by itself, establish that any given connection is hostile.

A commercial VPN exit is the same class of object. The differences are cosmetic: a VPN is run by a paid company instead of a volunteer network, and it looks far more respectable. But the structural fact — many unrelated users, one exit address, mixed traffic — is identical, and therefore so is the correct way to treat it: classify on the behaviour behind the pipe, which the pipe does not change. The Tor lesson and the VPN lesson are one lesson, applied to two pipes.

The proof that it is a pipe, not a place

You do not have to take "it's a shared pipe" on faith. The data proves it, and the proof is beautiful in its simplicity.

Recall 5.183.101.141, the worst cross-vector address. Ask the standard sources where it is, and they disagree: AbuseIPDB says Sweden, the RDAP registration says Denmark, and Team Cymru's routing view says the United States. Three authoritative sources, three different countries, one address.

Now — a physical computer is in exactly one country. It has one location; it is plugged into one wall. An address that reliably reads as three countries at once cannot be a physical origin at all. It is a junction: a point where traffic from some unknown real source is forwarded out, and each geolocation source guesses the "location" from a different clue — the registration, the routing, the abuse history — so they land in different places because none of them can see the real one.

This flips a normally-annoying data problem into a useful signal. Geolocation disagreement is usually treated as noise to be resolved. Here it is affirmative evidence: when an address reads as several countries at once, that disagreement is the fingerprint of a pipe — a VPN, a proxy, a relay — and its geography should be discarded from attribution entirely. The address that is in three countries is in none of them. It is a doorway, and doorways do not have nationalities.

The same is true, one level up, of the whole attack's fourteen-country spread. That is not fourteen attackers; it is one operator choosing fourteen different exit doors from the same VPN's menu.

The arithmetic of collateral damage

Now the practical case against blocking, in numbers rather than principle.

AS212238 is a real CDN and a real VPN provider with real, paying customers. Its local risk score is a low 23.5, and its effective-bad-rate on the web layer is 0.151 — meaning that of everything the sensor saw from this network, only about 15% was classifiably hostile. The other ~85% was ordinary, legitimate traffic: people using a VPN for exactly the reasons people use VPNs.

So a network-level block of AS212238 would cut off service to roughly six innocent connections for every one hostile connection it stopped. That is not a defence; it is collective punishment — landing almost entirely on people who did nothing wrong, to inconvenience an attacker who, crucially, barely notices. Because the attacker can switch to a different exit — a different country, a different VPN, a different provider — in seconds, for no extra cost. Blocking the exit they used yesterday stops them for exactly as long as it takes them to click a different server in the app.

This is the cruel geometry of the shared pipe: network-level blocking maximises harm to the innocent while minimising harm to the guilty. It is the worst possible trade, and it is the one the naïve instinct reaches for first.

Why the attacker paid for a VPN at all

There is a question lurking here worth answering, because it explains why this pipe specifically. An attacker who just wants to hide their origin can use Tor for free. So why pay for a commercial VPN?

The answer is respectability, and it is the hinge of the whole series. Tor exit nodes are public, well-catalogued, and blocked or heavily scrutinised almost everywhere — using Tor announces that you are hiding, and increasingly gets you challenged or refused before you do anything at all. A commercial VPN exit is the opposite. It looks like an ordinary datacenter or business connection on a reputable network. It is rarely blocked — because, as we just established, blocking it breaks service for millions of legitimate paying users, so almost nobody does.

That is what the attacker is actually buying. Not just anonymity — Tor gives that away — but the appearance of legitimacy. Datacamp's clean 23.5 reputation, its status as a real CDN, its millions of innocent users, are not obstacles the attacker overcame; they are features the attacker rented. The laundering washes the origin, yes, but its real product is camouflage: a pipe respectable enough that no one dares block it. (Part D is entirely about the economics of this — why "clean enough to not be blocked" is the single most valuable property attack infrastructure can have.)

This is also why the laundering defeats reputation-based defence by design. A defender who trusts a network's clean reputation is trusting exactly the thing the attacker bought. Reputation cannot discriminate here, because the attacker specifically selected a good reputation to hide inside.

What actually works — and already did

If you cannot block the pipe, and you cannot trust the reputation, and you cannot use the geography, what is left? The one thing that cannot be laundered: the behaviour.

And the reassuring part is that this is not theoretical — it is what already happened, cleanly, in this very incident. The defence did not block AS212238. Instead, CrowdSec watched what each source actually did and banned individual addresses for their specific, proven, hostile intents:

• 149.22.81.216 — banned for credential_harvest, shell_upload, admin_hunt, and api_enum.
• 143.244.47.86 — banned for vhost_enum.
• 178.132.109.237 — banned for cms_detect.

MikroTik then enforced those bans at the router. Every single ban targeted a demonstrated hostile act from a specific address — and not one legitimate VPN user sharing that network was touched. The commuter on the bank site never noticed. The journalist behind the same exit never noticed. Only the hands that were caught throwing punches were removed.

This is the general solution to laundered attacks, and it is worth stating as a rule because it scales to every shared pipe there is: per-source, per-intent, behaviour-triggered bans. It removes the hostile act. It spares the shared infrastructure. And — this is the elegant part — it works without ever knowing the attacker's true origin. You do not need to defeat the VPN's anonymity to defeat the VPN's attack. You only need to watch what comes through the pipe and act on the part that is hostile. The origin can stay hidden forever; the attack still stops.

The translation, for everybody

Because this letter is meant to be readable by people who do not run honeypots, here is the whole thing without a single technical term:

A VPN is a shared doorway that thousands of people walk through at once. When someone commits a crime after walking through that doorway, you cannot lock the door — you would trap thousands of innocent people inside and the criminal would simply use a different door tomorrow. What you can do is watch what each person does once they are through, and stop the specific person who reaches for the lockpick, while everyone else passes freely. You never need to know which house the criminal came from. You only need to see them reach for the lock.

That is the entire defence against laundered attacks: don't block the door, watch the hands. The VPN was built to hide where the hands came from. It was never able to hide what the hands were doing — and what they are doing is the only thing you needed to see.

Reading the pipe — for defenders

• Treat VPN/Tor exits as origin-hidden pipes, not actors. Raise scrutiny on exit status; classify on the behaviour behind it. Never attribute the pipe's country or reputation to the attacker.
• Use geo-disagreement as a proxy detector. When authoritative sources disagree on an address's country, that is affirmative evidence of a pipe — drop its geography from attribution.
• Never blanket-block a shared VPN/CDN ASN. The collateral is the innocent majority (~85% here) and the attacker re-exits for free. Reserve network blocks for genuinely single-purpose malicious ranges.
• Gate on per-source, per-intent behaviour. CrowdSec-style autobans (credential_harvest, shell_upload, admin_hunt, vhost_enum) remove the hostile act, spare the pipe, and work without origin attribution. This is the correct and only scalable response.
• Do not trust the pipe's reputation. The attacker bought a clean-looking network on purpose. Reputation cannot discriminate; behaviour can.

The pipe hides where the attacker is. It was never able to hide what the attacker does — and Part C follows exactly that, tracing the one hand whose behaviour shows up on both doors at once.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-077A — The Laundered Vector — the live attack this letter explains you cannot network-block.
• TI-2026-075Y — The Innocent — the Tor-exit shared-pipe reasoning, applied here to VPN exits.
• TI-2026-066E — The Bulletproof Midtier — respectability laundering; developed further in Part D.
• TI-2026-075I — The Weapon Is Never the Point — judge the act, not the artifact — here, not the pipe.

This dossier documents observed abuse of legitimate commercial-VPN infrastructure for defensive purposes. The VPN providers and their users are lawful; the finding concerns how to defend against attacks laundered through shared exits without harming the innocent majority who share them. TLP:WHITE.