The Archivist's Coat: The 22-IP Fake-ia_archiver Fleet

TI-2026-086C · Series: The Wardrobe · Case 3 · Classification: HIGH · Confidence: HIGH

Case 2 took down the flagship — the Googlebot costume, worn 77 times. This case reaches for the coat next to it on the rack, and it is a costume the entire Unmasking series never once examined: the Internet Archive's crawler. Twenty-two IPs on Google Cloud, all claiming to be ia_archiver, the bot that populates the Wayback Machine. The question this case answers is not "is it fake" — the provenance failure settles that — but "why this mask," and the answer turns out to say something the Googlebot case could not: operators choose the identity whose story best explains the crime.

Executive Summary

The Fake-ia_archiver Fleet AS396982 (web-threats campaign #148060) is 22 IPs, 2,953 requests, an effective bad-rate of 0.958 — the highest-conviction fleet on the rack — and, like its Googlebot neighbour, an intent of credential_harvest. It impersonates ia_archiver, the historical User-Agent of the Internet Archive's Wayback Machine crawler.

Three things make this case distinct from everything before it:

The mask is a cover story, not just a passkey. Googlebot buys passage because it is trusted. ia_archiver buys something more specific: it licenses totality. An archiving bot is supposed to fetch your entire site, exhaustively, so a burst of hundreds of requests reads as diligence, not attack. The costume is chosen for what it explains.
The disguise includes a wardrobe of vintage User-Agents — BlackBerry9000, Nokia Series80, an abandoned RSS reader called Gregarius — meant to simulate a legacy archiver's diverse fetch fleet. It is period-accurate cosplay, and it is exactly why the fleet stands out: no real 2026 traffic is BlackBerry9000.
The harvest hit a 200, not a 401. Where the flagship fleet ran into Authelia's uniform 401 wall, this fleet's target answered every .env probe with a uniform 200. Opposite architectures, identical result: the response told the scanner nothing. This is the mask-200 mirror of the 401 wall, and it generalises the defensive lesson.

All 22 members are banned under the fleet-keyed CrowdSec/MikroTik scenario as of 2026-07-13 06:45 UTC.

Why the Archive? A Mask That Explains Itself

Every costume in the wardrobe answers the door-guard's question — who are you? — with a trusted name. But the best costumes answer a second, harder question the guard asks a moment later: and why are you doing that? Googlebot cannot always answer the second question; a search crawler hammering /wp-login.php is still a little odd. ia_archiver answers it perfectly.

The Internet Archive is a US 501(c)(3) nonprofit digital library. Its crawler exists to make complete copies of websites for the Wayback Machine. Exhaustiveness is its entire point — it is meant to fetch every path it can reach, including ones a search engine would skip, precisely so the historical record is complete. So when an ia_archiver-labelled client fires seventy-nine requests at your site in three seconds, the cover story writes itself: the Archive is taking a snapshot. Volume that would look alarming under any other name looks like diligence under this one.

That is why this mask is worth forging for a volume credential harvest specifically. The .env sweep is, by nature, a high-request-count operation — you are trying hundreds of filename variants. Under a search-engine costume, that volume is slightly incongruous. Under the archiver costume, it is the expected behaviour. The mask is selected to make the crime's signature look normal. That is a sharper claim than "the name is trusted," and it is the contribution this case makes to the series: the wardrobe is not just a set of passkeys, it is a set of alibis.

And the Archive's name is cheap to steal and rarely checked. archive.org is on nearly every operator's allowlist — blocking the Wayback Machine is something almost nobody deliberately does — and its crawler's provenance (egress from the Archive's own AS7941 and documented ranges) is almost never verified at request time. The genuine ia_archiver does not live on a Google Cloud tenant instance. Every IP in this fleet does. The provenance check fails cleanly: this is SPOOFED, not CLAIMED.

The Costume's Wardrobe-Within-a-Wardrobe: Vintage User-Agents

Here is the detail that makes this fleet visually unmistakable in the logs. Member 34.95.201.0 did not pair the ia_archiver identity with modern browser strings the way the Googlebot fleet did. It reached for a pool of archaic clients:

BlackBerry9000/4.6.0.167 Profile/MIDP-2.0 Configuration/CLDC-1.1
Gregarius/0.5.2 ( http://devlog.gregarius.net/docs )
Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/5.0 (Linux; Android 4.4.2; LG-V410 Build/K...)

Read that list as an attempt at authenticity. A real, decade-old archiving operation would have crawled from a heterogeneous fleet — old phones, feed readers, legacy browsers — because the early web was fetched by exactly those clients, and the Wayback Machine preserves what it saw. Gregarius is a genuine (now-abandoned) PHP RSS aggregator; BlackBerry9000 and Nokia Series80 were real mobile browsers. The costume is period-accurate. Someone thought about it.

And that care is the tell. No legitimate 2026 crawl traffic comes from a BlackBerry 9000 or a Nokia Series80. Those device populations are extinct. A UA distribution that heavy in fifteen-year-old clients does not occur in nature anymore; it only occurs when someone is simulating an old crawler. The impostor over-decorated — invested effort in realism that produced a signature no real client population matches. It is the same lesson the four-mask Googlebot node taught in reverse: there, the rotation was too varied to be one crawler; here, the vintage is too old to be any live one. The disguise's realism is its weakness, because the thing being imitated no longer exists to blend into.

The Harvest and the 200 Wall

34.95.201.0's behaviour under the coat is the by-now-familiar .env sweep — seventy-nine distinct secret-file variants (/.env, /.env.bak, /.env.copy, /.env.default, /.env.dev.local, /.env.development.local, /.env.dist, …) fired in three seconds, a cadence of 127,739 paths per hour. The target this time was peertube.shuffle-on.com, a video host. Same toolkit as the flagship fleet, worn under a different coat — the interchangeable-costume finding from 086B holding across a third mask.

But the outcome differs in an instructive way. In 086B, every .env probe hit Authelia and returned a uniform 401. Here, every probe returned a uniform 200 — the dossier records "92% of hits masked behind 200s." The peertube route answered the scanner with a catchall 200 for paths that do not exist, rather than the 404 an unprotected server leaks or the 401 an auth-gated one returns.

Follow what that does to the attacker. The entire value of a .env sweep is the oracle: the server is supposed to answer 404 for the 150 filenames that do not exist and 200 for the one that does, and that difference is how the harvester finds the prize. A uniform 200 destroys the oracle exactly as thoroughly as a uniform 401 does. When every path returns 200, the scanner cannot tell the real .env from the 149 misses; the response has no information in it. The harvest fired 79 shots into a wall that echoes the same note back regardless of where it hits.

This is the mirror of the 401 case, and putting the two together fixes a defensive principle the series will lean on: secret-file harvesting is defeated by response uniformity, not by any specific status code. Auth-gating (401) and catchall (200) are two roads to the same destination — a response that carries no signal. What starves the harvest is not "deny access"; it is "answer every guess identically." Both roads also produce a spotless detection signature: 79 identical-status requests in three seconds clusters instantly. Defence and telemetry, again, are the same act.

Steelmanning: "But maybe the Archive really does crawl from Google Cloud"

The honest objection specific to this mask: large crawl operations sometimes do run on rented cloud, and 085C established that a genuine crawler on a stranger's cloud (OAI-SearchBot on Azure) must not be misjudged by ASN alone. Could this be the real Internet Archive, or a legitimate contractor archiving on its behalf, running from GCP?

No, and the reasons are cumulative:

Provenance. The Internet Archive publishes and operates its crawler from its own infrastructure (AS7941 / documented ranges). These 22 IPs are GCP tenant addresses on AS396982, outside any Archive-attributable range. The check was run and failed — SPOOFED, per the 085 method, not the "unverifiable" verdict a genuinely ambiguous case would earn.
Conduct. The real ia_archiver archives content — it fetches pages and their assets to preserve them. It does not enumerate .env secret-file variants; there is nothing to archive at /.env.dev.local but a credential leak. The target grammar is disqualifying independent of the name.
The vintage-UA anomaly. A modern Internet Archive crawl does not present as BlackBerry9000 and Nokia Series80. The costume's own props contradict the identity it claims.
Fleet geometry. Twenty-two disposable tenant IPs bursting in seconds is not how a nonprofit's steady, forward-confirmable archiving crawler deploys.

The objection is the right one to raise — misjudging a real crawler on a borrowed cloud is the series' cardinal sin — but every discriminator points the same way. This is impersonation, and the Archive is a victim of it, not a party to it.

What Holds, and What Is Bounded

Documented, HIGH confidence: the fleet's composition, volume and 0.958 bad-rate; the 79-path .env burst and its uniform-200 outcome against peertube; the vintage User-Agent pool; the fleet-keyed enforcement. Direct observations from the edge and enforcement logs.

Inferred, MEDIUM confidence: that this fleet shares an operator with the Googlebot and Yandex-masked fleets rather than merely a tactic. It sits on the same ASN with the same .env toolkit and the same burst grammar, which points to shared authorship, but the ia_archiver members' campaign memberships observed here (Burst 2026-06-11) do not by themselves cross-link to the Shared-Exploit Cluster that binds the Googlebot/Yandex nodes. Same-operator is the leading hypothesis; the cross-mask operator resolution (086M) is where it is settled.

Why It Matters

The archivist's coat teaches the series' second lesson, after "the mask is interchangeable": the mask is an alibi. Operators do not grab trusted names at random; they grab the name whose purpose makes the crime's fingerprint look ordinary. A volume harvest wants a costume that explains volume, so it dresses as the bot whose whole job is to fetch everything. That is a more sophisticated adversary model than "attacker forges famous name," and it has a defensive corollary: the more perfectly a costume explains the behaviour, the more the behaviour itself — not the name — has to be your detector, because the name has been chosen precisely to disarm suspicion of the behaviour.

And the 200 wall closes the loop on defence. You do not need to authenticate every route to beat a secret-file harvest; you need only refuse to give the scanner an honest 404. Uniformity — a wall that answers every knock the same way, whether 200 or 401 — is what turns a harvest into noise. The Archive's coat got 79 identical answers and left with nothing, and the log kept a perfect print of the attempt.

Cross-references

TI-2026-086A — The Wardrobe Rack — the seven-mask rack this coat hangs on.
TI-2026-086B — The Flagship Mask — the Googlebot fleet whose .env toolkit reappears here under a new coat; the 401 wall this case mirrors with a 200.
TI-2026-085C — Verified, and Still Where It Shouldn't Be — why a real crawler on a borrowed cloud must not be misjudged; the discipline this case keeps while still convicting.
The Front Door (059) / masked-200 disambiguation — the catchall-200 mechanics that starve the harvest and fingerprint the fleet.

Next in the series — TI-2026-086D, The Eastern Crawlers: the Fake-Baiduspider and Fake-YandexBot fleets, and the internationalised allowlist they exploit.

TLP:WHITE. Attacker infrastructure only; the Internet Archive is named as an impersonation victim. No internal addresses, credentials, or PII disclosed.