Reading the Good Name: A Field Guide to Borrowed Trust and Its Innocent Twins

TI-2026-084D · Borrowed Trust, Part D (capstone) Confidence: HIGH — the taxonomy and the innocent-case attributions are documented (is_tor_exit flags, self-declaring network names, reputation load); the discriminator method is offered as a discipline, not a classifier. Classification: TLP:WHITE

The problem the series was really about

Three cases in, Borrowed Trust has a clean pattern. A hostile device egresses the real, correctly-attributed address space of a genuine institution; the institution is the abused party, not the attacker; its good name is borrowed as cover. A university, a national CERT operator, a state research enterprise.

But the pattern hides a trap, and this capstone is about the trap. The surface signal in all three cases — an institution's IP is hitting a honeypot — is identical to the surface signal of institutional traffic that is completely innocent. Arizona State University's address hits our sensor too. So does the University of Michigan's. So does an Austrian privacy foundation's. If the lesson of Borrowed Trust were "distrust institutional space," it would be worse than useless: it would launder real intruders past you while defaming research networks and privacy services.

The real lesson is narrower and harder: an institutional IP in attack data is a question, not a verdict. This part is the field guide for answering it.

Three classes wearing the same surface

Line up everything the honeypot has logged from institutional address space and it sorts into three classes that look alike from a distance and could not be more different up close.

The three demand three different responses. Compromise: notify the abuse desk, the device needs cleaning. Transit: this is not the institution's traffic at all — chase the origin, not the exit. Research: it announced itself; opt out and move on. Confuse them and you either miss an intruder or accuse a scientist.

The innocent twins, named and cleared

The discipline this whole corpus runs on is the documented negative: when the evidence says an entity is not the culprit, that is a finding, recorded as explicitly as any accusation. Here are the negatives that keep Borrowed Trust honest.

Arizona State University — 206.206.192.178 (AS2900). RDAP org "Arizona State University," abuse desk mike.brown@asu.edu, usage "University/College/School." It appears in our data flagged is_tor_exit = true, behaviour "unknown," abuse 50. The honeypot hits are anonymized third-party traffic exiting a Tor node in ASU space — not an ASU machine attacking anyone. The Tor-exit flag is the whole verdict: this is transit, and the origin is somewhere else entirely, deliberately unknowable.

University of Michigan — 35.0.127.52 (AS36375). RDAP org "University of Michigan," internet-numbers@umich.edu. Flagged is_tor_exit = true, threat score 8 — effectively zero. UMich's 35.0.0.0/16 is also a historic home of large-scale internet-measurement research. Either way — Tor transit or announced measurement — the traffic is not a hostile UMich device. Near-zero reputation load plus the Tor-exit flag plus the research context is a clean negative.

Foundation for Applied Privacy — 109.70.100.1, 109.70.100.7 (AS208323, Austria). This is the clearest negative of all, because the network announces itself in its own RDAP record: the network is literally named Tor-Exit-Anonymizer--Foundation-for-Applied-Privacy, abuse abuse@appliedprivacy.net. Running Tor exit relays is the organisation's stated mission. It is a conduit by design and by declaration. Nothing is hidden; there is nothing to accuse.

Research networks (e.g. DFN). The Deutsches Forschungsnetz and its kin appear in honeypot data — TI-2026-042Q mapped the phenomenon — because they run sanctioned internet-measurement scanning. The mark of legitimate research is that it announces itself: a descriptive PTR, an opt-out abuse contact, a project URL, a low reputation load. Announcement is the difference between a scientist and an intruder.

None of these is a Borrowed Trust case. Saying so, with the evidence, is the point.

The four discriminators

What actually separates the compromise class (A/B/C) from the innocent twins? Four signals, each documentable, none decisive alone, decisive together.

1. Tor-exit status. is_tor_exit = true means the institution is carrying someone else's traffic. The device attacking is not theirs; the exit is a conduit. None of A/B/C is a Tor exit. ASU, UMich and Applied Privacy all are.

2. Announced purpose. Does anything declare a legitimate function? A descriptive PTR, an opt-out contact, a project URL, or a self-naming network (Tor-Exit-Anonymizer). Research and declared Tor exits announce; intruders are silent. NASK's recon node published no purpose — it hid behind fake iPhones.

3. Reputation load. Borrowed-trust compromises carry AbuseIPDB 100 across many unrelated victims and surface in multiple independent feeds (NASK: 175 reports, 8 OTX pulses; Chile: abuse-100, 121 sessions). Innocent transit and research sit near-zero to moderate (UMich threat 8). Weight of reports, from unrelated reporters, is hard to fake.

4. Deception. Is the traffic actively hiding? Spoofed consumer mobile user-agents on a datacenter box (NASK), forged intent, a curated malicious credential list (UNICON.UZ). Research and declared Tor exits do not disguise themselves; they have no reason to. Deception is the signature of an intruder who knows the good name is doing the work.

Score a candidate on all four. A/B/C are hostile on every axis that matters. ASU, UMich and Applied Privacy are benign on the axes that matter. The method is not a classifier you can run blind — it is a checklist that forces the documented-negative question before anyone gets accused.

The one sentence the whole series reduces to

A trustworthy source is not a trustworthy packet — but the source still tells you where to look.

Institutional provenance is real and must not be faked-away; NASK really is NASK, Chile really is Chile. But provenance is not a safety property of the traffic. What it is is a routing instruction for the response: the good name tells you whom to notify (the CERT, the university abuse desk, the origin behind the Tor exit), not whether the packet is safe. Safety is a per-IP evidence question — is this the institution's device, transit it carries, research it announced, or an intruder it is unaware of? — and it has to be answered every time, on the evidence, one address at a time.

Borrowed Trust is the inverse of The Tripwire Ledger (082), where attackers manufacture false respectability over rented space with fake bank names and shell identities. There, the respectability is a costume you can strip. Here, the respectability is genuine and inherited — which is the harder problem, because the provenance checks out and the danger rides on that reality. The tripwire series taught you to distrust a name that is faked. This series teaches you not to over-trust a name that is real. Both reduce to the same discipline: read the evidence, not the label.

Findings

1. Borrowed trust is one point on a spectrum, not all institutional attack traffic. (HIGH) — compromise / transit / research are three classes with one surface.
2. Four documentable discriminators separate compromise from conduit. (MEDIUM) — Tor-exit status, announced purpose, reputation load, deception.
3. [INST] Documented negative: ASU, UMich and Applied Privacy are conduits, not culprits. (INFO / HIGH confidence) — recorded explicitly, the opposite verdict from A/B/C on the same surface signal.
4. A trustworthy source is not a trustworthy packet — but it tells you where to look. (HIGH)

The series, closed

Three names borrowed; four names cleared. When the attacker has a good name, check whether the name is really the one attacking — or just the gate it came through, the exit it rode out of, or the research it openly announced. The name is where you send the report. The evidence is what you send.

Cross-references

• TI-2026-084A · 084B · 084C — the three compromise cases this capstone binds.
• TI-2026-082A — The Tripwire Ledger — the inverse pattern: manufactured false respectability.
• TI-2026-042Q — The Quiet Scanners — academic/research networks in honeypot data.