The Costume Fits the Crime: The Intent-to-Mask Correlation

TI-2026-086I · Series: The Wardrobe · Case 9 · Classification: HIGH · Confidence: HIGH

Three of the earlier cases noticed it in passing — the archiver mask covered a volume harvest, the SEO mask covered a light recon, the AI mask hunted AI subdomains — and each time the observation was set aside as a detail. This case picks all those details up at once and asks whether they are a pattern. They are. Across the whole rack the mask is not chosen at random; it is chosen to fit the crime, so that the crime's signature reads as the costume's ordinary behaviour. And once you can see the correlation, you can weaponise it: the mask predicts the payload, which means the pair predicts the lie.

Executive Summary

Start with the population. Across 2,347 classified external IPs, the probe-intent distribution is:

Now lay the seven costume cases over it, and a structure appears that is not random. The masks pair with intents by two matching rules:

• Volume-match. Identities whose real job is high-volume fetching — search crawlers, the Internet Archive — cover high-volume credential harvests. Identities whose real job is a light touch — an SEO audit — cover low-volume recon.
• Purpose-match. Identities whose claimed reason maps to a target — AI crawlers — cover crimes against that target: vhost-enumeration of AI-service subdomains.

And there is a third, population-level correlation that only shows up at this altitude: the masks concentrate on the blend-in intents, while the loudest flood intents — shell_upload, cms_detect — are disproportionately run maskless, under empty User-Agents. The costume is a stealth-by-legitimacy strategy; a brute-volume flood has no use for it and drops it.

The reindexed entity crosslinks corroborate the pairings across both observation points, and — via one node — tie the masked web harvest to fingerprinted SSH scanning. The conclusion is a detector: expected-behaviour-for-claimed-identity, minus observed-behaviour, is an anomaly score — one that works before the ASN check even runs.

Volume-Match: The Costume Explains the Tempo

The clearest rule is tempo. Every mask carries an expected request rate, set by what the real agent does, and the crime is fitted to it.

High-fetch identities cover high-volume harvests. A search crawler or an archiver is supposed to fetch broadly and often — that is its entire function. So the fleets wearing those names run the loudest crimes and get away with looking normal: Fake-Googlebot (effective bad-rate 0.905), Fake-ia_archiver (0.958), Fake-Baiduspider, Fake-YandexBot and Fake-Twitterbot (all 1.0), every one of them a credential_harvest operation, executing .env sweeps of 79 to 151 distinct paths in two to six seconds. 34.125.48.170 fired 151 paths in six seconds; 34.95.201.0, seventy-nine in three; 136.107.160.133, ninety-seven in two. Under any other identity that burst is a screaming anomaly. Under "Googlebot" or "ia_archiver," it is crawling — the exact behaviour the costume exists to explain. The volume is not despite the mask; it is licensed by it.

Light-touch identities cover light recon. Invert the tempo and the mask inverts with it. An SEO audit is expected to make a handful of structural requests and leave. So the Fake-SemrushBot fleet ran exactly that shape — five requests, effective bad-rate 0.0, intent scanner_fingerprint — a quiet fingerprint that reads as a routine audit. Here brevity is the cover, where volume was the cover for the harvest masks. The operator did not pick Semrush and then decide to be quiet; the two came as a pair, because a loud SemrushBot would break the disguise as surely as a quiet Googlebot would waste it.

That is the volume-match rule in both directions: the mask sets the expected tempo, and the crime is sized to fit inside it.

Purpose-Match: The Costume Explains the Target

Tempo is not the only thing a mask carries. It also carries a reason to be here, and the sharpest operators match the crime's target to it.

The AI-crawler masks are the clean example. An AI crawler's declared purpose is to gather content for training or to fetch a specific page — so when a Fake-ClaudeBot on AWS runs vhost_enum against AI-service subdomains (lsn-ai-comfyui, and the real lsn-ai OpenWebUI host draws heavy probing), the target selection matches the mask's stated reason. An AI bot poking at AI infrastructure is not incongruous the way an AI bot poking at a mail server would be. The costume explains not just how fast the visitor moves but what it is interested in.

The search masks show a softer version of the same. Fake-Googlebot member 35.240.197.184 enumerated internal service subdomains — lsn-auth, lsn-pgadmin, lsn-redis, lsn-qdrant — under the cover that a search crawler discovers and follows hostnames. The purpose-match is weaker there (Googlebot has no special reason to want a Redis admin panel), which is exactly why that fleet leaned harder on the volume-match. The two rules trade off: where a mask's purpose does not quite explain the target, its tempo has to carry more of the disguise, and vice versa. But across the rack, at least one of the two is always doing work. The costume is chosen so that either how-fast or why-here — usually both — makes the crime look ordinary.

The Population Rule: Masks Blend, Floods Go Bare

Step back to the whole intent distribution and a third correlation emerges, one no single case could show. The trusted-crawler masks are concentrated on a specific band of intents — credential_harvest, vhost_enum, scanner_fingerprint — the intents where looking legitimate helps you. But the two single largest flood intents, cms_detect (555 IPs) and shell_upload (401 IPs), are not where the masks live. They are disproportionately the territory of the empty-User-Agent botnets — the Azure shell.php hunters of The Front Door (059B) and The Botnet Census (047C), and maskless vhost sweeps like the 19-IP, 10,849-request operation on Microsoft AS8075.

The reason is strategic, and it partitions the whole threat population into two philosophies:

• The mask economy wins by blending. Its crimes (harvest, recon) benefit from looking like a legitimate crawler, so it pays the cost of maintaining a costume. The mask is worth it because stealth is the strategy.
• The flood economy wins by volume. A shell-upload botnet trying every shell.php on the internet does not care whether it looks legitimate; it cares about request count. A costume buys it nothing — worse, maintaining a consistent forged identity across thousands of nodes is friction — so it goes bare, empty-UA, and simply pours.

That means the presence or absence of a mask is itself an intent signal. An empty User-Agent hammering shell.php is the flood philosophy; a crisp "Googlebot" running a .env sweep is the blend philosophy. They are not two points on one scale; they are two different bets about how to beat a defender, and the User-Agent field tells you which bet the operator made.

The Crosslinks Corroborate It Across Two Surfaces

A correlation drawn only from web logs could be an artifact of one pipeline. It is not — the reindexed entity graph confirms the pairings from an independent direction, and adds a finding the web edge alone could never see.

The fresh crosslinks resolve TI-2026-086A to its constituent fleets with high confidence — the Fake-Googlebot node 34.87.136.84, the Fake-ia_archiver nodes 34.95.201.0 and 34.77.83.98, the Fake-Baiduspider node 136.107.160.133 — and to the three credential_harvest Bursts (2026-06-09, 06-11, 07-04 on AS396982) and the Shared-Exploit Cluster. So the "search/archive mask ⇒ credential harvest" pairing is not read off a single log line; it is reconstructed from campaign membership across the corpus.

And then the graph does something the web logs cannot. Through node 35.188.112.111, it links TI-2026-086A to three honeypot HASSH campaigns — hassh-af8223ac (a libssh_0.12.0 scanner), hassh-03a80b21 (libssh_0.11.x), and hassh-f555226d (a libssh_0.9.6 botnet). HASSH is an SSH client fingerprint; these are the toolkits the same GCP address space uses to fingerprint and brute SSH. So the operator whose web mask covers a matched-tempo harvest also runs matched-tempo SSH scanning from the same pool — the correlation is not just mask-to-web-intent but mask-to-cross-vector-behaviour. Six of six investigation IPs are confirmed present in the honeypot. The costume-fits-crime rule holds across both surfaces, which is a strong sign it is a property of the operators, not of the sensor. (That same-hand overlap is the subject of the next case, 086J.)

The Detector Hiding in the Correlation

If the mask predicts the payload, then the pair predicts the lie — and that is a usable defence, arguably the tightest the whole series produces.

Give every trusted identity an expected behavioural envelope: a tempo (how many requests, how fast), a purpose (what kind of target), a shape (crawl vs single-fetch). Then the actionable signal is the distance between the claimed identity and the observed behaviour:

• a facebookexternalhit that issues 327 requests (envelope: one) — huge distance;
• a SemrushBot running a .env credential sweep (envelope: light structural audit) — huge distance;
• a Googlebot enumerating lsn-redis and lsn-pgadmin (envelope: follow public links) — large distance;
• a real Googlebot indexing your blog (envelope: exactly this) — zero distance.

Every costume case in this series supplied one of those mismatches by hand. 086I is the observation that they are the same measurement — identity-behaviour distance — and that it can be scored automatically. Crucially, this detector is independent of and complementary to the ASN provenance check of 086E. The provenance check asks are you where you say you live?; the mismatch score asks are you doing what your name does? An impostor has to pass both — egress the operator's real range and behave within the identity's envelope — and the harvest fleets fail the second even before you run the first. Two orthogonal locks, and the mask economy's own discipline (fitting the costume to the crime) is what guarantees there is always a costume to measure against.

Steelmanning: "You are pattern-matching after the fact"

The honest objection: with seven cases already written, of course an intent-to-mask correlation can be drawn — the cases were selected as spoofed fleets, so any structure among them may be curation, not nature. Is the correlation real or retrofitted?

Three checks keep it honest. First, the population distribution was not curated — the 2,347-IP intent breakdown and the maskless-flood concentration on shell_upload/cms_detect are platform-wide facts, not a selection of the fleets, and they show the blend-vs-flood split independently. Second, the cross-surface crosslinks are computed mechanically from shared IPs, not chosen — the honeypot HASSH linkage corroborates the pairing from a sensor that knows nothing about the web masks. Third, the correlation makes a falsifiable prediction: if it were retrofitted, we would expect to find high-volume harvests wearing light-touch masks (a .env flood as SemrushBot) and quiet recon wearing high-fetch masks (five requests as Googlebot) at the same rates — the mismatch cases. We do not; the tempo pairing holds in the direction predicted. The objection correctly warns against reading structure into a curated set, and the answer is that the load-bearing evidence (the population split, the crosslinks) comes from outside the curated set.

What Holds, and What Is Bounded

Documented, HIGH confidence: the platform intent distribution; the tempo-match pairing (high-fetch masks ⇒ high-volume harvest; light-touch mask ⇒ low-volume recon) across cases B–F; the purpose-match for AI masks; the cross-surface crosslink corroboration including the HASSH SSH linkage.

Inferred, MEDIUM confidence: the population-level "masks blend, floods go bare" split. The intent counts are solid and the empty-UA flood concentration is documented (059/047C), but the precise fraction of shell_upload/cms_detect that is maskless-versus-masked is not quantified here — it is asserted as a directional tendency from the known empty-UA botnets, not a measured ratio. Held as the leading reading; a clean mask-vs-intent contingency table is the follow-up.

Why It Matters

The costume-fits-crime rule is the moment the series stops describing costumes and starts reading them. It says the mask is not a free-floating lie you check in isolation; it is a lie fitted to a specific crime, and the fit itself is evidence. An operator who dresses a volume harvest as a crawler has told you, by the choice of costume, that the harvest is coming — because the costume only makes sense as cover for that tempo and that target.

For defenders this collapses the whole series into a single, cheap measurement. You do not need to enumerate every mask or maintain every operator's ASN list to get value; you need only ask, of any trusted identity, is it behaving like the thing it claims to be? — and score the distance when it is not. The mask economy's greatest strength, its care in matching the costume to the crime, is exactly what makes that measurement possible: a costume chosen to fit the crime is a costume that no longer fits the identity, and the gap between the two is the tell that no forged header can close.

Cross-references

• TI-2026-086C — The Archivist's Coat — where costume-fits-crime first appeared (the volume-alibi), generalised here across the rack.
• TI-2026-086F — The Social Unfurlers — the behavioural-envelope verifier (one fetch, not three hundred), a special case of the mismatch score.
• TI-2026-059B / 047C — The Azure Shell Game / The Botnet Census — the maskless empty-UA flood economy this case contrasts with the mask economy.
• TI-2026-086J — The Same Hand (forthcoming) — the cross-vector overlap the HASSH crosslinks here foreshadow.

Next in the series — TI-2026-086J, The Same Hand: the fresh crosslinks that tie the masked web harvest to fingerprinted SSH scanning from the same address space — one operator, two vectors.

TLP:WHITE. Attacker infrastructure and impersonated brands only. No internal addresses, credentials, or PII disclosed. One population-ratio claim explicitly held as inference.