The Familiar Faces: How Many Recidivists We Already Knew

The Recidivists — Part 3

Every dossier in this series so far has treated the twenty-three year-banned hosts as a discovery — a roster our own escalation ladder produced, from first principles, out of one apartment's perimeter logs. Part 1 described the machine that built the roster. Part 2 walked the rap sheets one at a time. This letter asks the question that ought to have come first, and that a self-respecting analyst asks of every "discovery" before celebrating it: were these actually new?

The honest answer reframes the whole series. Our ladder did not discover a private rogues' gallery. It independently re-derived, from a single vantage point, a set of hosts that the wider internet had already flagged — some of them years earlier, some of them dozens of times over, at least one of them running under a hostname that literally advertises what it is. The escalator's tier-3 verdict and the world's existing verdict converge. That convergence is not a disappointment. It is the strongest possible external validation that the ladder is measuring something real — and it tells us something precise about the population of hosts that reach a one-year ban: they are, overwhelmingly, the internet's already-condemned, not its unknowns.

This is a letter about corroboration. Where a host was already on public record, we say so and cite the record. Where it was not, we say that too — because the hosts our ladder caught that nobody else had flagged are, if anything, the more interesting cases: the ones where a perimeter of one saw something the crowd missed.

The star witness: a scanner that never hid

Return to 138.68.86.32, the DigitalOcean host from Part 2 — six bans across a hundred and twenty-one days, methods evolving from crude probing to credential harvesting. Part 2 read it as the archetype of a directed, adapting recidivist. Pull its full external record and a second layer appears, entirely consistent with the first.

[DOCUMENTED] The host's reverse DNS is b69efeaf93.scan.leakix.org. It is a LeakIX scanner node — part of a well-known internet-wide scanning service whose crawlers fingerprint exposed services and misconfigurations at planetary scale. The name is not a disguise; it is a billboard. This single fact recontextualises the "method evolution" of Part 2: what looked like one operator learning to be nastier is at least partly a scanning platform cycling its probe repertoire across a target list, of which this apartment is one entry.

[DOCUMENTED] Its external reputation predates our ladder by years:

• AbuseIPDB: confidence score 100/100, with 861 reports on file.
• OTX (AlienVault): present in 50 threat-exchange pulses, the oldest a "Webscanners" collection dated to 2018.
• DShield / community threat feeds: listed in CIArmy since 2024-09-10; LeakIX since 2025-08-30; forumspam since 2024-03-22; multiple blocklist.de categories (apache, bots, ssh, web) since mid-2024.
• Passive DNS even records the address's prior civilian lives — it hosted a German wellness domain (entspannungsrausch.de) in 2019 and warp3.club in 2021 before its current career as a scanner node.

Those civilian lives are worth a moment, because they are a reminder of how these addresses accumulate history. An IP is not born hostile. 138.68.86.32 spent 2019 pointing at a wellness site and 2021 at a hobby domain; by 2025 the same address answered to scan.leakix.org and by 2026 our perimeter was banning it for credential harvesting. The address is a lease, not an identity — which is exactly why attribution in this series has always been anchored to behaviour and infrastructure rather than to the number itself. What makes 138.68.86.32 a familiar face is not the thirty-two bits; it is the eighteen-month, multi-continent, three-database record of what has been done from behind them. By the time our ladder reached its verdict, that record was long, public, and unambiguous.

Our escalator first banned this host in March 2026 and reached tier-3 in April. By then it had been on public abuse feeds for eighteen months to two years. The ladder did not find 138.68.86.32. It re-found it — arriving, independently and with no access to any of those feeds, at the same verdict the rest of the internet had already filed.

That is the model for what follows: the ladder as an independent corroborating sensor, not a lone discoverer.

A discipline note before the roster: co-listing is not co-operation

The entity graph offers a tempting shortcut here, and it is worth naming the trap before walking into it. Several roster members are linked in our graph by a relationship called shared_otx_pulse — they appear together in the same third-party threat-exchange pulse. The star case, for instance, shares a pulse with two other tier-3 hosts, 207.154.197.113 and 45.88.138.44.

It would be easy, and wrong, to read those edges as "same operator." An OTX pulse is a published list — often a honeypot's nightly dump of every IP it saw, or a "webscanners since 2018" mega-collection with tens of thousands of members. Two hosts sharing such a pulse have been co-listed by a third party, nothing more. It is the threat-intel equivalent of two names appearing in the same phone book. Shared artifact is not shared operator. Throughout this letter, shared_otx_pulse links are treated as what they are — corroborating co-listings that raise confidence a host is genuinely hostile — and never as attribution of common control. Where we do claim common operation (the Jira fleet, the Bucklog /24, the NForce pair from Part 2), it rests on shared behaviour and infrastructure, not on shared feed membership.

The roster, cross-checked against the crowd

Here is the entire tier-3 roster of Part 2, each host queried live against AbuseIPDB — the largest crowd-sourced abuse database, where any operator anywhere can report an attacking IP. The columns that matter are the last two: reports (how many times the host has been reported in the trailing year) and reporters (how many distinct, independent networks filed those reports). One angry sysadmin can file ten reports; a thousand distinct reporters means a thousand separate networks all independently reached the same verdict we did.

[DOCUMENTED] Every single host on the roster was already on AbuseIPDB — 23 of 23. The least-reported host on the list, 88.151.33.10, had still been reported by 209 independent networks. The most-reported, the Bucklog cluster's 185.177.72.51, carried 8,093 reports from 1,044 distinct reporters. Summed across the roster, these twenty-three hosts account for roughly 94,000 abuse reports in a single trailing year. There is no discovery here. There is confirmation, twenty-three times over, that the ladder's independent verdict lands exactly where the collective verdict of the internet already sat.

Of the two count columns, the distinct reporters figure is the one that carries the argument, and it is worth saying why. Raw report totals can be inflated by a single furious operator hammering the submit button, or by one large network's automated pipeline filing thousands of reports on autopilot. Distinct reporters cannot be inflated that way: each increment is a different network that independently observed the host attacking it and chose to say so. When 1,044 separate networks report 185.177.72.51, that is 1,044 perimeters that reached, on their own evidence, the same conclusion our escalator reached on ours. It is the closest thing the open internet has to a jury, and on every one of these twenty-three hosts the jury had already returned — hundreds strong at the minimum, a thousand strong at the top — before our ladder ever read out its own tier-3 verdict. Independent observers converging on the same defendant is not coincidence; it is corroboration in its most literal form.

The provider ledger: where the reports pile up, and where they pile up fastest

Group the roster by the providers Part 2 identified and the crowd's report counts resolve into a second confirmation of Part 2's central split — rentable cloud versus dedicated infrastructure — this time measured in the currency of external complaints.

• Microsoft Azure (8 hosts): 52.178.176.146, 20.151.11.236, 20.220.232.240, 20.151.2.242, 4.204.200.32, 4.213.99.137, 20.48.232.178, 52.169.5.4 — together roughly 40,400 reports, the largest single-provider share of the roster's complaint volume. Yet note the scores: mostly 19 to 33. Azure hosts are reported thousands of times each and still score low. Hold that contradiction; a later section — The mirror's blind spot — is about it.
• Bucklog SARL, one /24 (4 hosts): 185.177.72.50/.51/.60/.61 — roughly 24,700 reports, and the highest per-host intensity on the entire roster (average ~6,200 reports each, topping out at 185.177.72.51's 8,093). This is a dedicated, single-purpose sensitive-file cluster, and the crowd flags it harder, host for host, than any cloud fleet.
• DigitalOcean (5 hosts): the four-droplet Jira fleet plus the LeakIX star — roughly 17,800 reports. The Jira droplets cluster tightly (3,000–3,900 each), the even spacing itself consistent with Part 2's read of a single coordinated fleet.
• The long tail (6 hosts): AYOSOFT's 45.88.138.44 (6,191 — a heavily-reported outlier for a single host), the dedicated/ISP 62.164.177.222 (2,661), NForce's pair (~670 each), Mora's 119.235.221.127 (683), NextGenWebs' 88.151.33.10 (406).

The pattern that matters: the cloud fleets contribute the most total reports because there are more of them, but the dedicated hosts earn the most reports each. A Bucklog box or the AYOSOFT host is, individually, more-complained-about than any single Azure or DigitalOcean droplet. That is exactly what Part 2 inferred from behaviour — that the operators who own their infrastructure run it harder and longer, because they are not treating the address as disposable — now visible from an entirely independent direction: the volume of strangers who bothered to report it.

The third source: honeypots that saw them too

AbuseIPDB is one crowd. OTX (AlienVault's Open Threat Exchange) is another, and it corroborates from a different angle: not "someone filed a complaint" but "someone's sensor logged this address in a published threat pulse." Six of the roster's hosts carry OTX pulse memberships — 138.68.86.32, 207.154.197.113, 207.154.212.47, 45.88.138.44 (50 pulses each) and 164.90.208.56, 62.164.177.222 (11+).

[DOCUMENTED] The star case's fifty pulses are worth naming, because they show who else was watching. They include a "Webscanners 2018 thru current day" collection, "HoneyAI — HTTP Honeypot (Live)," "T-Pot" honeypot dumps from Sydney, a "Cloudflare Honeypot Web Attack Hosts" daily list, and a string of nightly "Honeypot mesh" feeds. In plain terms: this one host was independently caught by honeypots on at least three continents and folded into feeds that thousands of defenders subscribe to. When our escalator banned 138.68.86.32, it joined a global chorus that had been singing this address's name since 2018.

That is the shape of every corroborated host on the roster. The ladder is not a lone microphone. It is one more sensor in a planet-spanning mesh — and the value of confirming that is precisely that the mesh, the complaint database, and our escalator all agree without ever having consulted one another.

The two silences: what score-zero-with-thousands-of-reports tells us

Read the table's low scores carefully, because they hide the most interesting finding in this letter. Three hosts — 52.169.5.4 (3,288 reports), 45.227.255.31 and 46.161.27.151 (the NForce pair, ~670 each) — show an AbuseIPDB confidence score of 0. A naive reading calls them clean. They are not. The score is a recency-weighted figure: it decays as reports age out. All three were last reported in late April 2026 — three months before this writing. Their thousands of historical reports are real; the crowd simply stopped seeing them, because they went quiet on the wider internet.

But they did not go quiet here. Our escalator banned all three to tier-3, and a one-year ban does not decay. So the roster captures a phenomenon the crowd-sourced score structurally cannot: the ladder's memory outlasts the crowd's attention. A host that raided the internet in spring, earned a thousand reports, and then went dormant everywhere else is — on AbuseIPDB — a fading score sliding back toward zero. On this perimeter it is still a named, locked-out, year-banned host, exactly as dangerous as the day it earned the ban. The two silences are different silences: the world's is forgetting; ours is a sentence being served.

This is the practical case for the whole escalation apparatus of Part 1. A reputation feed answers "is this host hot right now?" The ladder answers a different and more useful question for a defender: "has this host ever earned my distrust, and is that sentence still running?" The score-zero recidivists are the proof that those two questions have different answers — and that the second one is the one that keeps a door locked.

The mirror's blind spot: why Azure attackers score low

Now the contradiction held in reserve from the provider ledger. The eight Azure hosts on the roster were reported thousands of times each — several of them as recently as today — and yet their AbuseIPDB scores sit at 19, 25, 27, 30, 33. These are not decayed scores like the NForce pair; the reports are current. The hosts are being flagged right now and the number still refuses to rise.

The explanation is structural, and it is a genuine blind spot in the mirror we have been holding up. AbuseIPDB's confidence score is not a raw report count — it is weighted, and one of the things it weights down is large shared cloud ranges. Microsoft Azure address space is enormous, heavily recycled between tenants, and full of legitimate traffic; a scoring model that took every Azure complaint at face value would flag half the cloud. So the model discounts them. The practical result is that a genuinely hostile Azure droplet — one firing WordPress scans and path-probes at our perimeter until it earned a one-year ban — presents to a casual AbuseIPDB check as a medium-confidence, maybe-benign address scoring 25. The 6,859 reports are right there in the record; the headline number buries them.

This matters for two reasons. First, it is a caution about the corroboration itself: a low reputation score is not exoneration, and any defender leaning on the headline figure alone would wave through hosts our behavioural ladder correctly locked out. The report count, not the score, is the honest signal — and our escalator, which never looked at either, agreed with the count. Second, it sharpens the thesis of this whole letter. The convergence between the ladder and the crowd is not a convergence of scores — on the Azure hosts the scores actively disagree with the verdict. It is a convergence of observed behaviour: thousands of independent networks watched these addresses do hostile things, and so did we. The number a feed prints can be dampened, gamed, or decayed. What cannot be argued away is that the behaviour was seen, over and over, from every direction at once.

That is the right note on which to state the limit plainly. This letter corroborates; it does not attribute. "Known to AbuseIPDB" means "reported by N networks," nothing more — not "identified as actor X." The value of the cross-check is not that it names anyone. It is that it independently confirms the ladder is measuring real hostility, and it exposes, in the Azure hosts, exactly where a defender who trusted reputation scores over observed behaviour would have been fooled.

What the convergence means

Three facts, laid side by side, close the case this letter opened.

The ladder discovers nothing — and that is its credential. Twenty-three of twenty-three tier-3 hosts were already condemned by hundreds to thousands of independent networks before our escalator reached its verdict. An instrument that, from a single vantage point with no access to any external feed, re-derives the crowd's conclusion twenty-three times running is not producing noise. It is calibrated. The convergence is the validation — the strongest kind, because it is independent.

Corroboration is not attribution. AbuseIPDB is itself a crowd — "known to AbuseIPDB" means "reported by N networks," not "identified as a specific actor." The shared_otx_pulse links between roster members (138.68.86.32, 207.154.197.113, 45.88.138.44, 207.154.212.47) are co-listings in shared feeds, and this letter has treated them as exactly that: raised confidence that a host is genuinely hostile, never a claim of common operator. Where Part 2 named shared operators — the Jira fleet, the Bucklog /24, the NForce pair — it did so from shared behaviour, and the crowd's co-listings here happen to agree, which is corroboration doing its proper, limited job.

The interesting hosts are the ones the crowd is forgetting. The score-zero recidivists — heavily reported in spring, dormant since, still year-banned here — are where a single well-kept perimeter outperforms a global feed. Not because it sees more, but because it forgets less. That is the quiet thesis of The Recidivists entire: persistence is met with a memory longer than the attacker's patience, and longer than the crowd's.

The familiar faces were familiar to everyone. What this perimeter added was not recognition. It was the refusal to look away after the crowd already had.