LSN โ€” Local Sovereign Network

The Next Rung: Where the Adversary Climbs When the Mask Stops Paying

TI-2026-086Y ยท Series: The Wardrobe ยท Case 25 ยท Classification: HIGH ยท Confidence: MEDIUM

The previous case argued the mask is unprofitable at a verifier-backed edge. A rational adversary does not respond to unprofitability by quitting โ€” it responds by moving. And the direction of the move is not random: it flows down the gradient of least verification, the way water flows downhill, toward whatever identity, origin, and tempo the current defence checks least. That makes the next rung forecastable. Not certain โ€” this is inference about intent, and intent is not a fact โ€” but forecastable, because the economics point one way. This case reads the gradient and names the three rungs the adversary climbs next, and for each one shows that the estate's counter is not a scramble to be improvised later but a defence already visible in the taxonomy and the sensor stack. The point of a forecast is to be standing on the next rung before the adversary reaches it.

Executive Summary

Economic pressure is directional. 086X showed that impersonating a verifiable crawler is a losing trade here; this case forecasts where the losing trade pushes the adversary, and finds three rungs โ€” each with a counter already in place.

The honest framing is the finding: this is a ladder, not a wall. No rung is final. The defence wins not by building something unclimbable but by staying one rung ahead of a migration whose direction is economically determined โ€” and therefore knowable before it is climbed.

Why the Next Move Is Forecastable at All

Begin with the epistemics, because a forecast that does not say how much it can know is just a guess with confidence. Predicting a specific adversary's specific next campaign is genuinely hard โ€” it depends on who they are, what they want, what tools they happen to have. But this case is not predicting a campaign; it is predicting a direction, and direction is far more tractable, because it is set by economics rather than by personality.

Here is the mechanism. 086X established that the expected value of wearing a verifiable mask against this estate is negative: the disguise is free, but it triggers the confiscation of the rented IP, in pursuit of a prize that is not there. A rational operator facing a negative-EV move stops making it and looks for a positive-EV alternative. And the alternatives are not a wide-open field โ€” they are constrained to the axes on which the current defence is weakest, because those are the only places the EV could be positive. So the forecast reduces to a question the defender can answer about its own system: where is my verification thinnest? Wherever that is, the gradient points, and the water flows there.

That is why the next rung is knowable. The adversary's move is a function of the defender's weakest axis, and the defender can see its own weakest axis. The taxonomy literally lists which identities have no verifier (086V). The sensor stack shows which signals are and are not identity-dependent (086U). The threshold detectors publish their own thresholds. Reading those is reading the map the adversary is also reading โ€” and the defender gets to read it first, because it is the defender's own map. The forecast is not clairvoyance; it is the honest inventory of one's own gaps, interpreted through the knowledge that a rational adversary will find them.

Rung 1: The NO-VERIFIER Migration

The clearest rung, and the one the taxonomy itself signposts. 086V documented the structural rule that makes the wardrobe restrained: an identity with no published network ground truth is NO-VERIFIER(claimed-only), can reach CLAIMED, and can never be escalated to SPOOFED. That restraint is a virtue against false positives โ€” and it is also, read from the other side, a published map of exactly which costumes are safe to wear.

A rational adversary reads it that way. Impersonating Googlebot is a trap: it is verifiable, so it produces SPOOFED, so it burns the IP. Impersonating CCBot, or builtin ClaudeBot, or simply arriving as python-requests, is not: the estate has no authoritative ground truth to disprove those, so the best it can do is CLAIMED, and CLAIMED does not fire the identity autoban. The migration is therefore not from "a mask" to "no mask" โ€” it is from a verifiable mask to an unverifiable one. The adversary keeps a costume; it just picks one off the rack that the estate has openly admitted it cannot check.

The estate's counter to this is the single most important thing to notice, because it is not a plan โ€” it is already in the taxonomy, running. The custom-rule layer (priority 5, the operator's own additions) is systematically manufacturing verifiers where the builtins have none. Perplexity now has CIDR checks (#2370/#2371). Telegram has a CIDR verifier (#2378). UptimeRobot, Pingdom, and Datadog have CIDR ranges (#2379โ€“#2381). DataForSeo and Censys have rDNS checks (#2382/#2383). Builtin ClaudeBot is NO-VERIFIER โ€” but a custom ClaudeBot rule verifies it against Anthropic's real AS399358 (#2367), converting a claimed-only identity into a checkable one at higher priority. Every one of these is a rung being pulled up before the adversary reaches it: each custom verifier shrinks the NO-VERIFIER surface, turning a formerly-safe costume into a SPOOFED-able one. The race on this rung is simply whether verifiers are added faster than the adversary migrates โ€” and the estate has the advantage, because it is adding them against a finite, enumerable list of impersonable identities, while the adversary is chasing a target that keeps becoming verifiable underneath it.

There is a bound worth stating: some identities may be intrinsically unverifiable โ€” a provider that publishes no ranges and no rDNS convention gives the estate nothing to build a verifier from, and curl/python-requests are honest self-identifications that were never a "mask" to begin with (a node calling itself python-requests is not impersonating a trusted crawler; it is just a script, and belongs to the behavioural sensors, not the identity ones). So Rung 1's counter shrinks the gap but cannot fully close it โ€” which is exactly why Rungs 2 and 3, and their identity-agnostic counters, matter.

Rung 2: The Provenance Move

The second rung attacks the foundation the whole identity check rests on: network provenance. Every SPOOFED verdict in this series is ultimately "you claimed to originate from network X and you demonstrably did not." So the adversary's move is to make that disproof impossible โ€” to originate from an address the check cannot condemn.

Two flavours. Residential-proxy botnets place the node in consumer ISP space, where there is no "this should be a datacentre" tell and no crawler-ASN claim to falsify. Legitimate-cloud origins (the recurring tenant ranges of this series) place it in plausible, widely-used address space. Neither beats a specific verifier โ€” a residential IP still is not AS15169, so it still cannot successfully impersonate Googlebot โ€” but that is not the goal. The goal is to arrive as an unremarkable, unclaimed client from an origin the estate cannot summarily blacklist, sidestepping the identity question entirely rather than winning it.

And here the forecast turns reassuring, because the provenance move defeats the identity check by walking directly into the behavioural one. 086U established the load-bearing fact: the four internal sensors โ€” MikroTik at L3, CrowdSec at L7, the honeypot at SSH, the web edge at HTTP โ€” and the fused external feeds do not read the User-Agent at all. A node that perfects its origin has changed where it comes from; it has not changed what it does. It still walks the same credential_harvest paths, still trips the same CrowdSec scenarios, still leaves the same honeypot footprint if it strays there. The provenance move spends real effort (residential proxies cost money; 086X's ledger applies here too) to defeat the one sensor that reads identity, and gains nothing against the four that read behaviour. The estate's answer to a better-disguised origin was written before the origin was disguised: convict on what the node does, not on who it claims to be or where it claims to be from.

Rung 3: The Tempo Move

The third rung attacks the detectors that count. Several of the estate's identity-layer signals are threshold-based: spoofed_impostor_cluster fires when โ‰ฅ5 IPs share one crawler identity with failed provenance; identity_rotation fires when a /24 cycles โ‰ฅ2 masks. Any threshold is, by definition, evadable from below โ€” run four IPs instead of five, rotate one mask instead of two, send one request an hour instead of a burst. As fleet-scale masking is priced out (086X) and verifier coverage expands (Rung 1), the surviving adversary's rational move is to slow down beneath the counting detectors.

The counter is the least intuitive and the most decisive, because it inverts what the adversary thinks it is buying. Low-and-slow assumes the defender forgets between requests โ€” that a probe today and a probe next week are seen as two unrelated events, each too small to matter. That assumption was true of raw logs and is false of the semantic layer (086W). The estate's memory is durable and entity-keyed: a node making one probe per week does not dissolve into noise; it accumulates, across the honeypot, web, and crosslink collections, into a single lengthening record filed under its own address. 086N called this the long con from the adversary's side; from the defender's side it is simply that slowing down does not reduce the footprint, it stretches it out over a longer, more legible paper trail. The tempo move trades the risk of a loud burst for the certainty of a long, quiet, permanently-remembered history โ€” and the memory was built to read exactly that history. Against a defender that does not forget, patience is not stealth; it is just a slower way of accumulating evidence.

Steelmanning: "You're describing your own hopes, not the adversary's moves"

The strongest objection is that this is a forecast graded by the forecaster: for each predicted rung I have conveniently produced a counter the estate already has, which is exactly what a defender would write whether or not it is true. A real adversary is not obligated to climb the rungs I can already defend; it will find the move I did not forecast, the axis I did not instrument, and the whole tidy "counter already in place" structure is survivorship bias โ€” I listed the threats I can answer and called the list a forecast.

The objection is fair and it disciplines the claim rather than defeating it. Three concessions and a floor. Concede: the specific rungs are not exhaustive โ€” there are moves outside this frame (a genuine zero-day against a service, a supply-chain compromise, an insider) that are not "climb the least-verified axis" and that this economic model does not predict; the forecast is scoped to the masking adversary the series is about, not to all threats. Concede: the timing and the dominant rung are genuinely uncertain โ€” I have ordered them by probability, not by knowledge. Concede: "the counter is already in place" is strongest for Rungs 2 and 3 (where the counter is structural โ€” behavioural sensors and durable memory that exist regardless of what identity appears) and weakest for Rung 1 (where the counter is a race the estate could lose if it stops adding verifiers). The floor that survives all three: the direction is not a hope, it is an economic gradient, and a defender who knows the direction can watch the right axis. The value of the forecast is not that it names the exact next campaign โ€” it cannot โ€” but that it tells the estate which of its own gaps to instrument next, before the adversary's migration turns a predicted rung into a climbed one. A forecast that correctly identifies the direction of pressure, and honestly flags which counters are structural versus which are races, is doing the only useful thing a threat forecast can do: pointing the defender's next unit of effort at the place the water is already starting to flow.

What Holds, and What Is Bounded

Documented, HIGH confidence: the NO-VERIFIER structural rule (086V); the custom-verifier expansion visible in the taxonomy (Perplexity/Telegram/UptimeRobot CIDRs, DataForSeo/Censys rDNS, custom ClaudeBot on AS399358); the identity-agnostic sensor stack (086U); the durable memory (086W); the threshold values of the counting detectors. These are facts about the defence.

Inferred, MEDIUM confidence: everything about the adversary. The direction of migration (down the gradient of least verification) is medium-high; the specific rungs, their ordering, their timing, and which dominates are medium; and the model excludes non-economic and out-of-frame threats entirely. This case states the gradient with confidence and the destination with humility, and marks itself MEDIUM overall for exactly that reason.

Why It Matters

The Next Rung is the case that turns the series from a record of what happened into a tool for what happens next. Every prior case documented a move the adversary already made; this one uses the accumulated understanding โ€” the economics of 086X, the structural gaps of 086V, the identity-agnostic sensors of 086U, the durable memory of 086W โ€” to stand where the adversary is going before it arrives. That is the whole return on building a system that understands its adversary rather than merely reacting to it: understanding is predictive, and prediction lets the defender spend its next unit of effort on the rung the adversary has not yet reached.

For the defender the discipline generalises cleanly. Do not model your adversary's identity; model its incentives, because incentives are stable where identities are not. Find your own weakest axis of verification and assume the pressure is already flowing toward it. Prefer structural counters (behavioural sensors, durable memory) that hold regardless of which rung is climbed, over racing counters (a verifier for each new mask) that must be re-won continually โ€” and know which of your defences is which. And accept the honest frame: there is no wall, only a ladder, and the win condition is not to end the climb but to always be standing one rung above it. The wardrobe cannot make the adversary stop moving. What it can do โ€” what this case argues it already does โ€” is know which way the adversary must move, and be there first.

Cross-references

Next in the series โ€” TI-2026-086Z, The Identity Layer: the synthesis finale. Twenty-five cases collapse into one claim about what the wardrobe actually is, and what it means that a homelab can hold this line at all.

TLP:WHITE. Forward-looking analysis of adversary incentives and public defensive architecture only. All adversary behaviour is explicitly forecast, not observed. No internal addresses or secrets disclosed; named ASNs are benign anchors or previously-documented origins.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 25 / 26 Next โ†’