LSN โ€” Local Sovereign Network

The Corroborators: Why Four Sensors Agreeing Collapses the Doubt

TI-2026-086U ยท Series: The Wardrobe ยท Case 21 ยท Classification: HIGH ยท Confidence: HIGH

The verifier's dilemma (086L) left an uncomfortable thread: the SPOOFED verdict that drives the aggressive autoban is strong but fragile, and enforcement rides on it. This case is the answer the series has been implicitly leaning on the whole time. No single signal convicts a masked node โ€” not the provenance verdict alone, not the behaviour alone, not any one reputation feed. What convicts is convergence: independent sensors, watching from different vantage points and failing in different ways, all pointing at the same IP. When four of them agree, the doubt does not shrink โ€” it collapses, because the alternative is four uncorrelated errors coinciding on one address, and that does not happen.

Executive Summary

The estate watches the same adversary from four independent internal vantage points, and it fuses about a dozen external ones:

The wardrobe's convicted nodes carry this convergence: 35.188.112.111 is GreyNoise-malicious + AbuseIPDB-100 + 46 honeypot hits + web corpus; 34.125.48.170 is honeypot + web (151 requests) + three dossiers. 047B named the principle: "four independent detection systems converging on one address collapses the false-positive space โ€” the highest-confidence ban list the estate produces."

And this is the case that resolves 086L: the fragile SPOOFED verdict, on a real hostile node, almost never stands alone. Corroboration is the margin that makes aggression on a fragile signal safe. (One honest caveat, below: the sensors are only partially independent, so the collapse is real but not the clean arithmetic the fully-independent model would suggest.)

Why Convergence Is Worth More Than Any Single Detector

Start with the logic, because it is the whole case. A single detector โ€” however clever โ€” has a failure mode. A WAF rule misfires on a legitimate burst; a reputation feed carries a stale entry; a provenance check hits a stale range (086L). Each of those produces false positives at some rate, and no amount of tuning drives that rate to zero, because the failure mode is intrinsic to how the detector sees the world.

Now add a second detector that sees the world differently โ€” a router ban list instead of an HTTP classifier, an SSH honeypot instead of a web log. Its failure mode is different too, and here is the point: its errors are largely uncorrelated with the first detector's. For a benign IP to be a false positive on both, two unrelated things have to go wrong at once. The probability of that is not the sum of the two error rates; it is closer to their product โ€” and products of small numbers are very small numbers. Add a third independent sensor and a fourth, and the joint false-positive probability drops through the floor. That is what 047B means by "collapses the false-positive space": a benign IP that lands on the MikroTik ban list and trips CrowdSec and attacks the SSH honeypot and probes the web edge and carries a GreyNoise-malicious flag is not a false positive, because five uncorrelated errors do not line up on one address.

This inverts the usual instinct. Faced with false positives, the reflex is to build a better detector. Corroboration says: build a different one. An additional uncorrelated sensor does more for precision than any amount of tuning the ones you have, because it attacks the error at its root โ€” the shared failure mode a single detector cannot escape.

The Mask Hides the Identity, Not the Footprint

For the wardrobe specifically, corroboration reaches something the mask is powerless against. A forged crawler identity hides who the node claims to be โ€” that is the whole series. But it does nothing to hide the node's footprint across sensors, because those sensors do not read the User-Agent at all.

The MikroTik ban list keys on the source IP, not the name it wears. The SSH honeypot never sees an HTTP User-Agent; it sees a libssh client trying deploy:github. GreyNoise and AbuseIPDB score the address's global behaviour, indifferent to what costume it presents to any one target. So when 35.188.112.111 wears whatever mask it likes at the web edge, it is simultaneously GreyNoise-malicious (from its internet-wide scanning), AbuseIPDB-100 (from others' reports), and a 46-hit SSH honeypot regular (from its credential guessing) โ€” none of which the costume touches. The mask is a lie told to one sensor (the HTTP identity check); the other sensors were never listening to it. Convergence works on the wardrobe precisely because the disguise is aimed at one channel and the corroborators watch the others.

34.125.48.170 shows the same shape from the web side: a Fake-Yandex node whose costume says "Yandex," but which the graph resolves as present in the honeypot and probing the web (151 credential_harvest requests) and cross-referenced across three separate dossiers. Every one of those is an independent observation the mask did not reach. The costume convinced no sensor that was not reading the User-Agent โ€” which is all of them but one.

Corroboration Is the Answer to the Verifier's Dilemma

This case exists in a specific relationship to 086L and 086K, and naming it closes the loop the back half of the series has been building.

086K described an aggressive autoban that fires at threshold one on the SPOOFED verdict. 086L then showed that SPOOFED is the most fragile verdict in the system โ€” dependent on curation freshness, vulnerable on shared clouds, degradable in silence. Put bluntly, 086K bets a week-long automated ban on 086L's shakiest signal, and read alone that looks reckless.

086U is why it is not. On a real hostile node, the SPOOFED verdict does not arrive alone โ€” it arrives in company. The Fake-Baiduspider 136.107.160.133 is not just "SPOOFED"; it is 4-source multi_layer_blocked. The cross-vector 35.188.112.111 is not just a bad provenance check; it is GreyNoise-malicious and AbuseIPDB-100 and a honeypot regular. So the autoban, though it triggers on SPOOFED, in practice acts on nodes that are corroborated many times over. The fragile signal is the trigger; the corroboration is the safety. The genuinely dangerous case 086L warned about โ€” a real crawler mistakenly marked SPOOFED โ€” is exactly the case that has no corroboration: a real Googlebot has no honeypot hits, no AbuseIPDB score, no router ban, so its lone, uncorroborated SPOOFED verdict is the signal a careful system treats with suspicion (and the VERIFIED_CRAWLER_ASN guard of 086K catches). The rule that falls out is clean: a SPOOFED verdict with no corroboration is the one to doubt; a SPOOFED verdict on a four-source node is the one to act on. 086K, 086L, and 086U are one system, and corroboration is what makes the aggression on the fragile signal defensible.

Steelmanning: "Your sensors aren't independent, so the collapse is an illusion"

The strongest objection is statistical, and it is correct enough that the case must concede most of it. The multiplicative false-positive collapse assumes the sensors are independent, and they are not. CrowdSec's community blocklist ingests AbuseIPDB; the honeypot feeds signals into CrowdSec; several external reputation feeds consume one another's data. So two "independent" agreements may really be one signal counted twice, and the clean "0.05โด" arithmetic overstates the confidence โ€” the collapse is not as deep as fully-independent sensors would give.

The case concedes this and narrows the claim to what survives. Partial independence still corroborates. The four internal sensors genuinely observe different layers โ€” a router ban (L3), an HTTP classification (L7), an SSH session (cowrie), a web probe (Traefik) are not the same measurement re-run, whatever community lists they also consult, because each has a primary signal the others cannot see (the SSH honeypot's credential attempts are invisible to the web edge; the router's L3 drop is invisible to the HTTP classifier). And the honest accounting is not "count the sensors and multiply" but "weight sensors by their independence": two feeds that share an upstream count as roughly one, and the confidence is computed from the effective number of independent observations, not the raw count. Under that accounting the collapse is smaller than the naive product but still real and still large โ€” a node confirmed by the SSH honeypot's own sessions and the web edge's own logs and GreyNoise's own internet-wide scanning is corroborated by genuinely different measurements, whatever blocklists they cross-pollinate. The objection correctly kills the clean arithmetic; it does not kill the principle, which only requires that the sensors' primary signals differ โ€” and they do.

What Holds, and What Is Bounded

Documented, HIGH confidence: the four internal sensors and the multi_layer_blocked relationship; the ~12 external feeds and the threat_score fusion; the concrete convergence on 136.107.160.133, 35.188.112.111, 34.125.48.170; the principle (047B) that convergence collapses the false-positive space; the resolution of 086L (corroboration backstops the fragile verdict).

Bounded (and stated as such): the magnitude of the false-positive collapse. Because the sensors are only partially independent (shared upstreams among CrowdSec/AbuseIPDB/honeypot), the true confidence gain is real but less than a naive product of independent error rates, and this case does not compute the effective-independence-weighted figure โ€” it establishes the principle and flags that the arithmetic must discount correlated sources.

Why It Matters

The Corroborators is the case that turns a pile of separate detectors into a system, and it does the quiet work of making the rest of the series safe to act on. Every prior case produced a signal โ€” the mask, the behaviour, the provenance, the rhythm, the reputation score. This one says the thing that keeps all of them honest: do not convict on any one of them; convict on their convergence. A node the mask fooled at the web edge is still the node the SSH honeypot caught, the router banned, and GreyNoise flagged, and the agreement of those independent witnesses is worth more than any single one's certainty โ€” because the mask can lie to one sensor but not to sensors that were never listening to it.

For the defender that is both a method and a reassurance. The method: add uncorrelated sensors, not better ones, and weight them by their independence when you fuse them. The reassurance: the aggressive, automated enforcement the series ends on is not betting a week-long ban on a lone fragile verdict โ€” it is acting on nodes that four independent witnesses and a dozen global feeds have all, separately, called hostile. The wardrobe's whole design is to control what a visitor says. Corroboration wins because it listens to everyone the visitor was not talking to, and asks them, one at a time, the same question โ€” and when they all say the same thing, the costume stops mattering at all.

Cross-references

Next in the series โ€” TI-2026-086V, The Ones That Passed: the false-positive audit โ€” the verified crawlers the method cleared, and why its restraint is the proof of its precision.

TLP:WHITE. Attacker nodes and defensive sensor architecture only. No internal addresses or secrets disclosed. The false-positive-collapse magnitude is explicitly bounded by partial sensor dependence.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 21 / 26 Next โ†’