LSN โ€” Local Sovereign Network

The Economics of a Face: Why the Mask Costs More Than It Earns

TI-2026-086X ยท Series: The Wardrobe ยท Case 24 ยท Classification: HIGH ยท Confidence: MEDIUM-HIGH

Every case so far has asked whether the wardrobe can catch the mask. This one asks a different and, in the long run, more important question: even when the mask is not caught, does wearing it pay? A defence that merely detects forgeries is in an arms race it can lose โ€” the adversary iterates, the disguise improves, the detector chases. A defence that makes the forgery uneconomic is not in that race at all, because it has changed what the adversary is optimising. So set aside detection for a moment and open the adversary's ledger. There is a cost side and a revenue side. The claim of this case is that the estate drives the cost up and the revenue to near zero, and that this โ€” not any single clever verdict โ€” is why the whole thing holds.

Executive Summary

Model the masked operator as a business. It has expenses and it has a target return.

The revenue it is chasing is legible in the intent data: across 2,360 classified external IPs, credential_harvest is 1,072 โ€” 45% of everything โ€” followed by cms_detect (560), shell_upload (401), and auth_probe (160). Nearly half of all masked and probing traffic is hunting one prize: a working credential against a real panel.

The expenses it is paying are legible in the ban data. The forged User-Agent is free โ€” a string, changed per request, conjured at zero cost. But the delivery vehicle is not: every masked node must ride a real IP on rentable infrastructure, and the MikroTik ban intel shows exactly which market supplies it โ€” of 9,473 banned addresses, the top ASNs are cloud tenants: AS8075 Microsoft (326), AS396982 Google Cloud tenant (217), AS14061 DigitalOcean (93), AS16509 Amazon (40). Those are metered, exhaustible addresses that cost money.

Now close the two sides:

The estate spends a classifier lookup to confiscate a week of the adversary's rented infrastructure, in pursuit of a prize worth nothing. Cost rising, value near zero, ROI negative. That is the economic kill, and it does not depend on winning the detection arms race.

The Cheapest Part of the Operation Is the Disguise

Start by pricing the mask itself, because the whole series has been about how powerful it is and this case is about how cheap it is โ€” and those are not in tension, they are the entire point.

A forged User-Agent costs nothing. It is a header field. The adversary types Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) into a request and it is done โ€” no rental, no lead time, no depletion, and it can be a different string on the very next request. In the adversary's ledger the disguise is a line item of zero. This is exactly why forged identities are ubiquitous: at the level of the individual request, the mask is the highest-leverage move available, infinite potential upside against literally no cost.

But a request is not an operation. To send that free string, the adversary needs a place to send it from โ€” a source IP, and not just any IP but one that will route, that is not already burned, that sits in address space plausible enough to survive a first glance. And that is not free at all. Look at where the banned masked nodes actually live: cloud-tenant space, dominated by the majors โ€” Microsoft's 326, the Google Cloud tenant range's 217, DigitalOcean's 93, Amazon's 40, across a 9,473-address ban list. These are rented. Somebody is paying, by the hour or the month, for those instances. They are metered and they are finite: an operator has a budget, and every address in it is a real unit of that budget.

So the operation's cost structure is lopsided in a way the adversary cannot fix: the powerful component (the mask) is free, and the free-riding component (the IP) is where all the money is. The disguise cannot be made cheaper because it is already free; the infrastructure cannot be made free because it is a rented physical-world resource. The wardrobe, by design, ignores the free part and attacks the expensive part. It does not try to make the mask harder to wear; it makes the IP under the mask more expensive to keep.

The Disguise Is the Trigger for the Loss

Here is the mechanism that turns that cost structure against the adversary, and it has a cruel elegance worth stating plainly.

The mask has exactly one job: to buy trust at the edge โ€” to make the estate treat the node as a welcome Googlebot rather than a probing stranger. That is the entire reason to wear it. But the estate's edge is a verifier-backed classifier, and presenting a forged crawler identity to a verifier is the definition of the SPOOFED verdict: you claimed AS15169, you were demonstrably not in it, verdict SPOOFED. And a SPOOFED verdict, at threshold one, fires the 168-hour autoban that confiscates the rented IP for a week (086K).

Read that as a loop. The adversary rents an IP (cost). It puts a mask on that IP to gain trust (the mask is free, but it is the purpose of the whole exercise). Wearing the mask in front of the classifier produces SPOOFED (automatic). SPOOFED confiscates the rented IP for 168 hours (cost realised). So the better and more committed the disguise, the more certainly it burns the expensive asset it was riding. The mask does not merely fail to protect the IP โ€” it is the specific act that gets the IP taken away. An operator who wore no crawler mask and simply probed as an unremarkable client would, ironically, avoid the SPOOFED-specific escalation entirely; it is the forged identity that triggers the identity-forgery ban.

This is the sense in which the wardrobe has changed the adversary's optimisation problem rather than just detecting its output. The adversary's most valuable trick โ€” impersonate a trusted crawler โ€” has been wired directly to its most expensive outcome โ€” lose the infrastructure for a week. It cannot use the mask without paying, and it cannot achieve the mask's purpose (trust at a verifier-backed edge) at all. The tool is not just neutralised; it has been turned into a self-inflicted cost.

The Prize Is Not in the Building

Cost is only half a ledger. An operator will happily burn infrastructure if the payoff justifies it โ€” a week of a $20 VPS is nothing against a real domain-admin credential. So the economic argument only closes if the revenue side collapses too, and it does, because of what the credential probes actually hit.

The dominant intent, remember, is credential_harvest at 45%. These nodes are hunting login panels โ€” admin consoles, CMS backends, auth endpoints โ€” to spray credentials against. Against a normal target that is a rational bet: find the real panel, guess or stuff credentials, sell or use what unlocks. But this estate's edge is the masked-200 architecture (086P): an Authelia ?rd= intercept in front of protected routes and a catchall that returns HTTP 200 for essentially everything. To a probe, every path looks alive and nothing confirms a real panel. The signal a credential-harvester depends on โ€” "this 200/302/login-form is a genuine authentication surface worth attacking" โ€” is drowned in a sea of indistinguishable 200s. And where a credential is actually accepted, it is accepted by a honeypot that unlocks nothing of value.

So the 45%-dominant activity โ€” the revenue line of the entire masked enterprise โ€” is spent hunting a prize the architecture guarantees is not reachable. The operator pays for infrastructure, pays for it again when it burns, and harvests credentials that either cannot be found (masked-200) or open nothing (honeypot). The return on the operation, against this specific estate, approaches zero.

I mark this MEDIUM-HIGH rather than HIGH deliberately, because it is the one claim the estate cannot fully measure from its own side. The intent distribution and the architecture are [DOCUMENTED]; the resulting yield to the adversary is [INFERRED] โ€” the estate sees the probes arrive and sees the architecture deny them a real target, but it cannot audit the attacker's books to confirm they walked away with nothing. What it can say with confidence is structural: the mechanism by which a credential-harvester extracts value has been specifically severed here.

The Asymmetry Is the Whole Strategy

Put the two sides together and the shape of the defence becomes clear, and it is not a detection strategy at all โ€” it is a cost-ratio strategy.

On the defender's side, every step is cheap and automated. The verdict is a classifier lookup against a cached taxonomy โ€” microseconds. The ban is an automated nftables rule and a MikroTik address-list entry โ€” a CronJob, no human. The memory that enriches the decision (086W) is a pre-built index. The defender's marginal cost to convict and confiscate one masked node is very close to zero.

On the adversary's side, every step is metered and slow. The IP is rented. The ban is 168 hours of that rental confiscated. The recovery is a fresh batch of addresses โ€” more rental โ€” and the rebuild time between burn and re-attack. The adversary's marginal cost per convicted node is a real, recurring expense.

So the estate spends a CPU cycle to impose a week-long infrastructure loss, in defence of a prize that is worth nothing to take. That ratio โ€” near-zero cost to the defender, real recurring cost to the attacker, near-zero value in the target โ€” is the sustainable core of the entire wardrobe series. It is why the defence does not have to win every detection: it only has to keep the expected value of wearing a mask against this estate below zero, and it does that structurally, on every convicted node, forever, without anyone watching. A detection-only defence is a race the defender can tire of running. An economic defence runs itself, because it is the adversary who pays to keep it going.

Steelmanning: "Cloud IPs are nearly free and disposable โ€” your 'cost' is a rounding error"

The strongest objection attacks the cost side directly. Cloud infrastructure is cheap and abundant: a DigitalOcean droplet is a few dollars a month, free-tier and stolen-card and hijacked-account capacity is effectively unlimited, and a 168-hour ban on one IP out of a rented /24 is a shrug, not a wound. If the "expensive part" costs the adversary pennies, then the whole economic argument is a rounding error dressed up as a strategy โ€” the estate is confiscating something the adversary barely values, and calling it a win.

The objection is partly right and forces the argument to be precise about whose economics. Three responses, conceding the first. One: yes โ€” and this is exactly why the ban list is dominated by DigitalOcean and the hyperscaler tenant ranges rather than by expensive dedicated hosting. The adversary has optimised for cheap disposable infrastructure, and the per-IP cost genuinely is low. The estate's economic pressure is therefore not "we bankrupt them per IP"; it is "we make the unit that produces value โ€” a masked identity that survives at the edge โ€” impossible to keep, so the low per-IP cost buys nothing." Two: the cost is not only dollars; it is addresses that still work. Cloud IPs are cheap but not infinite in the dimension that matters โ€” a burned address is not just re-rented, it is now on a MikroTik blacklist and a CrowdSec community feed that other defenders consume, so the burn has a reputational externality beyond this estate. Three, decisively: even if the cost side is a rounding error, the revenue side is still zero, and a positive rounding-error cost against a zero return is still a losing trade. The economic case does not actually need the infrastructure to be expensive; it needs the return to be worthless, and the masked-200 delivers that regardless of VPS pricing. So the honest form of the claim is narrower than the executive summary's punch: the estate does not make masks ruinous, it makes them unprofitable โ€” and against a rational adversary, unprofitable is sufficient, while ruinous was never required.

What Holds, and What Is Bounded

Documented, HIGH confidence: the intent distribution (credential_harvest 45% of 2,360); the ban composition (9,473 addresses, cloud-tenant ASNs dominant); the 168h autoban mechanism (086K); the masked-200 architecture (086P). These are measured facts.

Bounded / inferred (MEDIUM-HIGH): the adversary's actual yield is inferred, not measured โ€” the estate sees the denial mechanism but cannot audit the attacker's books. The magnitude of the infrastructure cost is genuinely low (cheap cloud IPs), so the strategy's force comes from the near-zero revenue, not from ruinous cost; the honest claim is "unprofitable," not "bankrupting." And this is an economic model of a rational actor โ€” an adversary probing indiscriminately, for reasons other than yield, is outside its scope.

Why It Matters

The Economics of a Face reframes the entire series as a business proposition rather than a detection contest, and that reframing is the point. Everything before this case answered "can we catch the mask?" This case answers "does the mask pay?" โ€” and the second question is the one that governs whether the adversary keeps showing up. A defence that only detects invites an arms race: the adversary funds a better disguise, the defender funds a better detector, and the contest never ends. A defence that makes the disguise unprofitable ends the contest by changing its terms โ€” the adversary's own cost-benefit calculation, not the defender's vigilance, becomes the thing that turns it away.

For the defender the lesson is to think like the adversary's accountant. Find the expensive, un-fakeable resource under the cheap, fakeable trick โ€” here, the rented IP under the free User-Agent โ€” and confiscate it automatically and cheaply on every conviction. Then sever the revenue: make sure the prize the operation is built to capture is not reachable, so that even a rounding-error cost has nothing on the other side of the ledger to justify it. Do both and the mask becomes what this case argues it already is against this estate: a free trick that reliably triggers a real loss in pursuit of a prize that isn't there. The adversary does not need to be caught to lose. It only needs to keep paying more than it makes โ€” and the wardrobe is built so that it does.

Cross-references

Next in the series โ€” TI-2026-086Y, The Next Rung: a forecast. Given everything the wardrobe now sees and prices, what does the adversary do next โ€” and which rung of the ladder is the estate already building toward?

TLP:WHITE. Aggregate economic analysis and public ban/intent statistics only. Cloud ASNs named as abused infrastructure suppliers, never as complicit. No internal addresses or secrets disclosed. The adversary's actual financial yield is explicitly inferred, not measured.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 24 / 26 Next โ†’