The Ladder: How Persistence Gets Punished, One Tier at a Time

TI-2026-089A — The Recidivists series · Opener

Confidence: HIGH — this is a report on the estate's own defensive telemetry: the escalating-ban manager's source code and its authoritative SQLite ledger, read directly.

The finding in one paragraph

Most attackers hit once and vanish. A stubborn minority come back — and back — after being told no, and the LSN estate keeps a ledger of exactly how many times each one returned. Behind the honeypot and the web perimeter runs a custom escalating-ban manager (crowdsec-escalator, a systemd job that fires every five minutes) that does something stock CrowdSec does not: it tracks each offender's ban count and escalates the punishment on every return — 3 hours → 1 week → 1 month → 1 year — and when three or more IPs from the same /24 climb the ladder, it stops banning addresses and bans the whole subnet. Two feeds pour into it: every honeypot interaction is an instant block (guilt is assumed on first contact — you don't SSH-brute-force a honeypot by accident), and every web probe that clears an evidence gate is blocked too. Since 2026-03-10, the ledger has tracked 2,700 distinct IPs. The shape of that population is the story: 2,182 were banned once and never came back; 415 returned a second time; 80 a third; and a hard core of 23 climbed all the way to the one-year "permanent" tier by re-offending four, five, and six times. Ten subnets have been banned wholesale — the largest carrying eighteen coordinated IPs. This series is a portrait of that hard core: not the loudest attackers or the most numerous, but the most determined — measured not by what they did once, but by how many times they returned after the door was shut. This opener documents the ladder itself and the population it has caught. The letters that follow name the climbers.

1. The mechanism — a ban that remembers

Stock CrowdSec is amnesiac: it bans an IP for a few hours and forgets. The escalator gives it a memory. It keeps its own SQLite ledger (ban_history, subnet_tracking, escalation_log) and, on every five-minute pass, reconciles the live CrowdSec decisions against that history, incrementing a ban_count per IP and promoting the offender up a fixed ladder:

Two refinements make it sharper than a simple counter. First, a subnet rule: when three or more IPs from one /24 reach tier 1 or above, the escalator concludes it is not dealing with individual hosts but with a source — a coordinated range or a shared bulletproof block — and bans the entire /24. Second, a fast-track for the unambiguous: a scenario that no legitimate visitor ever triggers skips straight up the ladder on the first hit — session-hijacking jumps to tier 2 (a month); CVE exploitation and 401-floods start at tier 1 (a week). And it is disciplined about what it won't escalate: bulk threat-intel-feed imports and cscli-import origins are excluded, so the ladder measures observed behaviour against this estate, not reputation borrowed from a blocklist.

Everything the escalator decides is synced onward to the MikroTik router's crowdsec-blacklist address-list by a separate bouncer, so a tier-3 verdict is not a note in a database — it is a year-long silence at the edge of the network.

[DOCUMENTED] The ladder (3h/1wk/1mo/1yr), the 3-IP subnet rule, and the fast-track are read directly from the escalator's source and ledger.

2. The two feeds — instant guilt and gated guilt

The ladder is fed by two very different evidentiary standards, deliberately calibrated to the two planes.

• The honeypot feed is instant. Every interaction with the SSH honeypot is a ban on first contact (BAN_THRESHOLD = 1). The logic is unforgiving and correct: a honeypot is not a service anyone has a reason to reach. There is no such thing as an accidental login attempt against a machine that exists only to be attacked. Contact is the offense. This is why the honeypot side escalates so cleanly — every returning brute-forcer is, by definition, a repeat offender.
• The web feed is gated. A probe against the real web perimeter only bans once it clears an evidence threshold — the autoban weighs intent (credential_harvest, shell_upload, admin_hunt, cms_detect, api_enum) against per-intent counts, so a single mistyped URL or a real crawler fetching a real page never trips it. The gate exists precisely so the ladder's memory is spent on genuine adversaries, not on noise.

The result is that a climber's last_scenario reads like a rap sheet of how it earned each rung — crowdsecurity/http-sensitive-files, jira_cve-2021-26086, LePresidente/http-generic-403-bf, web-threats/autoban: credential_harvest:3, api_enum:8, admin_hunt:3. The ladder does not just count returns; it records the crime behind each one.

3. The funnel — persistence is rare, and that is the point

The 2,700-IP population, sorted by tier, is a near-perfect attrition curve:

Eighty-one percent of everything the estate bans is a one-shot: a scanner sweeps the address space, hits the honeypot or trips the web gate once, gets its three hours, and is never seen again — because the internet is enormous and there is always an easier target. That attrition is what makes the tail meaningful. An IP does not reach tier 3 by accident or by the ordinary churn of internet background radiation; it reaches tier 3 by choosing to come back to this specific estate four, five, or six separate times, each time after a ban expired. The funnel is a filter that distils 2,700 opportunistic scanners down to 23 that keep a grudge — and those 23 are the only ones worth a dossier's attention. The 606 logged escalations are the paper trail of that distillation.

[DOCUMENTED] 2,182 / 415 / 80 / 23 across tiers 0–3; 606 escalations logged since 2026-03-10.

4. The hard core — who reached one year

The twenty-three tier-3 IPs are the subject of this series; a few define its character:

• 138.68.86.32 (DigitalOcean, DE) — ban count 6, and still active today (last seen 2026-07-22). Its rap sheet is a full web-attack toolkit: credential_harvest:3, api_enum:8, admin_hunt:3. It has been banned six times over four months and returns anyway — a genuine, persistent, human-directed web attacker on rented cloud.
• 119.235.221.127 (PT Mora Telematika, Indonesia) — ban count 6 — repeatedly caught on crowdsecurity/http-sensitive-files (hunting /.env, /.git, credential files).
• The Jira-CVE cluster — 138.197.191.87, 164.90.208.56, 207.154.212.47 (all DigitalOcean) — each reached tier 3 firing crowdsecurity/jira_cve-2021-26086 (a Jira Server template-injection exploit) against the perimeter, again and again.
• The Azure http-probers — 52.178.176.146, 20.151.11.236, 20.151.2.242, 20.220.232.240 (all Microsoft AS8075) — persistent http-probing from rentable Azure compute.

The pattern in the hard core is not exotic malware; it is relentless, cheap, cloud-hosted web reconnaissance — sensitive-file hunting, CVE probing, credential harvesting — run from providers (DigitalOcean, Azure) where a burned IP costs nothing to replace, yet the same addresses keep returning rather than rotating. That choice — to return on a known-banned IP instead of spinning a fresh one — is itself a signal, and [089C] will ask what it means.

5. The subnet verdicts — when the estate stops arguing with addresses

Ten subnets have been escalated to a whole-/24 ban. These are the cases where the estate concluded it was facing a source, not a host — and they resolve to named operators:

Two stand out. 208.84.100.0/24 (Advin Services) sent eighteen separate IPs up the ladder — a single /24 behaving as one coordinated attack surface, which is the signature of a rented range under one tenant. And NextGenWebs, S.L. appears three times — 88.151.32.0/24, .33.0/24, .34.0/24 — a sibling range spanning three consecutive /24s (22 climbed IPs in total), the mark of an operator whose whole allocation is hostile, exactly the "ban the yard, not the vans" situation this defensive design was built for. [089D] takes the subnet actors apart.

[DOCUMENTED] 10 subnets banned wholesale; the largest (Advin, 18 IPs) and the NextGenWebs sibling range (3× /24) named via RIPE.

6. The familiar faces — the ladder catches who we already know

The recidivists are not strangers to this corpus. Cross-referencing the tier-2/3 climbers against prior investigations, several are already documented adversaries returning to climb the ban ladder:

• 195.178.110.137 — reached tier 2 — is AS48090 DMZHOST, the bulletproof host dismantled across the TI-2026-088 series.
• 102.88.137.213 — tier 2 — is a member of the warnight credential cluster.
• 35.196.241.166 — tier 2 — belongs to AS396982, the fake-Googlebot spoofed fleet.
• 62.164.177.0/24 — the year-banned subnet above — is AS215929 (Data Campus), one digit off VPSVAULT (AS215925) from the Costume Catalog.

This is the series' quiet thesis: the escalating-ban ladder is an independent instrument that, run purely on this estate's own observed behaviour, keeps rediscovering the same operators the OSINT-and-infrastructure investigations named separately. Persistence and provenance converge. The bulletproof hosts, the spoofed fleets, the botnet clusters — asked "who keeps coming back," the router answers with the same names.

7. Seven questions

Q1. Isn't "1 year = permanent" just theatre — attackers rotate IPs constantly? For the 2,182 one-shots, yes, rotation is the norm and the ban is moot. The finding is that the tier-3 cohort doesn't rotate — it returns on the same address after each ban. For those, a year of silence at the router edge is real denial, and their refusal to rotate is the anomaly worth explaining.

Q2. Why assume a honeypot hit is guilt on first contact? Because a honeypot has no legitimate function. It is not linked, not advertised, not a real service. The only way to reach it is to be scanning address space you have no business touching. Contact is the offense — which is exactly why the honeypot feed produces the cleanest repeat-offender signal of the two.

Q3. Could the web gate be banning real crawlers that then climb tiers? The gate is evidence-weighted precisely to prevent that — a crawler fetching real pages never trips it; you have to request /.env, brute-force auth, or fire a CVE. A tier-3 web climber has done so four-plus times. No crawler does that.

Q4. Is subnet-banning a whole /24 fair to innocent neighbours? It is a deliberate, high-threshold judgement: three separate IPs from one /24 must each independently climb to tier 1 before the /24 falls. That is not one noisy host; it is a range behaving as one hostile source (18 IPs, in Advin's case). The design accepts collateral risk on a /24 only after the range has convicted itself three times over.

Q5. Why do cloud IPs (DigitalOcean, Azure) dominate the hard core? Because rentable compute is where cheap, disposable web-attack infrastructure lives, and — tellingly — where operators are lazy enough to reuse addresses. A burned Azure IP costs pennies to replace, yet these return on the same one. That's either automation too crude to rotate or an operator who doesn't expect to be remembered. [089E] pulls that thread.

Q6. Does the ladder ever de-escalate — can an IP earn its way back down? No. ban_count only increments and current_tier only rises; there is no decay. Once you have proven you return, the estate treats you as someone who returns, permanently. That asymmetry is intentional — the cost of a false permanent-ban on a genuine attacker is nil; the cost of forgiving a proven recidivist is another intrusion attempt.

Q7. What would make a tier-3 verdict wrong? A shared NAT/CGNAT egress where many users exit one address, or a compromised legitimate host that was cleaned. The excluded-origins list and the evidence gate guard against the first class of error; the honeypot's contact-is-guilt logic makes the second (a cleaned host that keeps hitting a honeypot) self-correcting — a cleaned host stops scanning honeypots.

8. Read between the lines

The most interesting thing the ladder measures is not attacks but memory — specifically, the estate's willingness to have one, against an internet built to be forgotten in. The entire economics of opportunistic scanning depends on the target having no memory: hit everything once, move on, and the defender's short ban is irrelevant because you were never coming back anyway. The escalator inverts that. By remembering ban_count across months, it converts a defence that was purely reactive (block the current packet) into one that is cumulative (block the proven pattern), and in doing so it separates the 2,677 attackers for whom memory is wasted from the 23 for whom it is decisive. Those 23 are, almost by definition, the only ones whose behaviour is directed rather than sprayed — a sprayer never comes back to one apartment's honeypot in Iași six times. The ladder is therefore not really a punishment system; it is a filter for intent, and its tier-3 shelf is the shortlist of adversaries who have demonstrated, by the most expensive proof available — repeated return in the face of repeated denial — that they mean this estate specifically. Everything else in this series follows from that shortlist.

9. What if

What if every defender kept this ledger? The honeypot-instant-ban plus tiered escalation costs almost nothing — a five-minute cron and a SQLite file — yet it does what expensive threat feeds cannot: it ranks adversaries by their own demonstrated persistence against you, which is the single most operationally-relevant signal a defender can have, and one no purchased blocklist contains because it is specific to your estate. A tier-3 list is a personalised threat feed, earned rather than bought, and it is exactly the input that should drive the scarce, expensive work — the deep dossier, the abuse report, the upstream escalation. The lesson of the ladder is that the highest-value threat intelligence a network owns is a record of who refused to leave it alone.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

THE LADDER (crowdsec-escalator, systemd, every 5 min):
  tier 0 = 3h  |  tier 1 = 168h (1wk)  |  tier 2 = 720h (1mo)  |  tier 3 = 8760h (1yr)
  subnet rule: 3+ IPs from one /24 at tier 1+  ->  ban the whole /24
  fast-track:  session-hijack -> tier 2 ; CVE / http-401-flood -> tier 1  (first hit)
  feeds: honeypot instant-ban (threshold 1)  +  web autoban (evidence-gated)
  ledger: /var/lib/crowdsec/escalator/escalator.db  -> MikroTik crowdsec-blacklist

POPULATION (since 2026-03-10): 2700 tracked | tier0 2182 | tier1 415 | tier2 80 | tier3 23 | 606 escalations

HARD CORE (tier 3, 1-year, ban_count 4-6):
  138.68.86.32     DigitalOcean (DE)   ban6  credential_harvest/api_enum/admin_hunt  [active 2026-07-22]
  119.235.221.127  Mora Telematika (ID) ban6  http-sensitive-files
  138.197.191.87 / 164.90.208.56 / 207.154.212.47  DigitalOcean  jira_cve-2021-26086
  52.178.176.146 / 20.151.11.236 / 20.151.2.242 / 20.220.232.240  Azure AS8075  http-probing

SUBNET VERDICTS (whole /24 banned):
  208.84.100.0/24  Advin Services LLC (US)     18 IPs
  88.151.32-34.0/24  NextGenWebs, S.L. (ES)    22 IPs across 3 sibling /24s
  185.177.72.0/24  Bucklog SARL (FR)  |  62.164.177.0/24  Data Campus AS215929  |  31.56.58.0/24  Zkillu SAS

FAMILIAR FACES (recidivists already dossiered):
  195.178.110.137 -> DMZHOST AS48090 (TI-2026-088) | 102.88.137.213 -> warnight cluster
  35.196.241.166 -> AS396982 fake-Googlebot fleet | 62.164.177.0/24 -> AS215929 (VPSVAULT-adjacent)

Defensive action: treat the tier-3 shelf as the estate's personalised, earned threat feed — the input for deep dossiers, abuse reports, and upstream escalation. The one-shot majority needs nothing beyond the automatic 3h ban; spend the expensive attention on the 23 that keep coming back and the subnet actors (Advin, NextGenWebs) whose whole ranges convicted themselves.

12. Sources

/usr/local/bin/crowdsec-escalator (the escalating-ban manager — tier ladder, subnet rule, fast-track, exclusions); /home/lsn/cowrie-to-loki.py (honeypot instant-ban) and the web-threats autoban (evidence gate); the escalator's SQLite ledger /var/lib/crowdsec/escalator/escalator.db (ban_history, subnet_tracking, escalation_log); web_threats.crowdsec_decisions (5.1M-row decision history); RIPE NCC RIPEstat (holder resolution for the banned subnets and hard-core IPs). Cross-references: TI-2026-088 (DMZHOST), the Costume Catalog (TI-2026-082, VPSVAULT/AS215925). TLP:WHITE. A report on the estate's own defensive telemetry.