The Vanishing Majority: The Attackers the Ladder Cannot Count

The Recidivists — Part 8

Seven letters have studied recidivism — the attackers who come back to the same address until a ladder of escalating bans makes returning unaffordable. This one studies the opposite: the largest single population of attackers this perimeter sees, which never recidivates at all, and cannot, and what that impossibility reveals about the word the whole series is built on.

The perimeter has two sensors feeding one ladder. The web side classifies HTTP behaviour and bans on evidence. The honeypot side does something blunter: it runs a fake SSH server, and it bans every single address that touches it, instantly, on first contact — no threshold, no second chance, because a stranger reaching into a honeypot has already declared itself. That honeypot is, by raw volume, the ladder's biggest single source. One scenario — cowrie-ssh-bruteforce — accounts for 1,188 distinct attacking addresses, more than any web category, more than http-probing and http-sensitive-files combined.

And almost none of them ever come back. Of those 1,188 SSH attackers, 982 — eighty-three percent — were banned exactly once and never seen again. The most persistent SSH address in the entire history of the ladder was banned three times. Not one has ever reached the one-year tier that twenty-three web attackers earned. The population that attacks most is the population that recidivates least — and the gap between those two facts is the subject of this letter.

The two survival curves

Put the two sensor populations side by side, sorted by how far up the ladder each climbs, and the difference is not a matter of degree. It is a matter of shape.

At the bottom rung the two populations are comparable — a flood of first-time bans, roughly balanced. Then they diverge violently. The web population thins but persists: seventy-three reach a month, twenty-three reach a year, and the fat tail of Part 2's roster (hosts banned four, five, six times) lives up here. The SSH population collapses: from 982 down to eight down to zero. The honeypot's contribution to the upper ladder is, at tier 3, nothing at all. Every long-term recidivist this perimeter has ever recorded is a web attacker. The honeypot, for all its volume, feeds only the ephemeral bottom.

The raw distributions say the same thing another way. Among SSH attackers, ban counts stop at three, and 83% stop at one. Among web attackers, ban counts run to six, and the tail past three bans — the 90-odd hosts that make recidivism a meaningful category — is entirely theirs. Two populations, two utterly different escalation curves, from one ladder applying one rule to both.

Why the majority vanishes

The naive explanation is that SSH attackers come from residential botnets — compromised home routers and IoT devices, each seen once as the botnet cycles to the next victim — while web attackers come from rented servers they hold onto. That is partly right, and instructively incomplete. Pull the origins of a sample of the SSH population and the picture is more interesting than "home devices versus servers":

This is not a residential botnet. It is a globally scattered, high-turnover source pool that mixes compromised telecom subscribers in Nigeria and Korea with cheap VPSs at Contabo, micro-allocations in Bangladesh, and — tellingly — the very bulletproof and dedicated hosts the rest of this series has been chasing. DMZHOST, subject of an entire earlier investigation; VPS Dedicated LLC, whose block earned a subnet ban in Part 4. Even the hosting-based SSH attackers, on the same infrastructure families as the web recidivists, still never climb the ladder.

Which means the explanation is not where the SSH attacks come from. It is how the operation uses its addresses. SSH brute-forcing is run in a rotate-fast mode: a controller drives an enormous, churning pool of sources — some botnet, some rented — where each individual address makes its attempts against many targets over a short window and is then cycled out, whether because the botnet moved on or because the operator tears down and re-provisions cheap boxes constantly. The web credential-harvesters of Parts 2 through 7 run the opposite, sit-and-hammer mode: a fixed handful of addresses returning to the same target list again and again, because their value is the persistent foothold, not the momentary blast. The same provider — even the same bulletproof host — can serve both modes. The mode, not the infrastructure, decides whether an attacker recidivates.

What "recidivism" actually measures

Here is the uncomfortable thing the vanishing majority forces into the open. The ladder does not measure how persistent an adversary is. It measures how persistent an address is. Those are not the same, and the SSH population is the proof.

Consider what the honeypot's 1,188 one-and-done SSH attackers actually represent. They are not 1,188 casual passers-by who tried once and lost interest. They are the visible surface of brute-force operations that run every single day, for months, without pause — the most relentless, highest-volume attack traffic this perimeter receives. As an adversary, the SSH brute-force economy is far more persistent than any of the twenty-three web recidivists; it never stops. But because it wears a different address each time — a new bot, a new cheap box — the per-IP ladder can only ever see it as an endless procession of strangers, each meeting its instant ban and vanishing before it can accumulate a record. The most persistent adversary produces zero recidivists.

So the twenty-three tier-3 hosts crowned across this series are not, it turns out, the worst attackers or the most persistent ones. They are the attackers who happened to operate in sit-and-hammer mode, from reusable addresses, long enough for a per-IP counter to notice. "Recidivist," in the ladder's precise operational sense, means reused its infrastructure — nothing more and nothing less. It is a category defined by the attacker's address economics, not by their menace. The series has been, all along, a study of one specific operational mode — and this letter is the boundary marker that says so, honestly, so the roster is not mistaken for a ranking of the dangerous.

The other ledger: where the SSH operator becomes visible again

There is a resolution to the paradox, and it is the most important technical point in this letter. The persistent SSH adversary is invisible in the address ledger — but the honeypot keeps a second ledger the web side does not have, and in that one the adversary reappears. Every SSH login attempt carries a username and password, and the honeypot records all of them: 219,366 credential attempts across 45,075 distinct username/password combinations. The per-IP counter cannot see the operator behind a thousand rotating addresses. The credential counter can — because while the operator changes IPs constantly, it carries its dictionary from address to address unchanged.

The signal is stark once you sort credentials by how many distinct IPs tried each one. The password field left empty for root was attempted from 722 different addresses; admin:admin from 486; root:root from 336; pi:raspberry from 83. The same handful of guesses, arriving from hundreds of unrelated networks, is the fingerprint of a shared operation that the address ledger dissolved into anonymous singletons. What looked, per-IP, like 722 strangers each trying once, looks per-credential like a single relentless campaign for the empty-root-password, wearing 722 faces.

But this second ledger demands the same discipline the whole series has insisted on, because it has the same trap. A shared credential is not automatically a shared operator — and here the distinction is the entire analysis. Common dictionary credentials — root with no password, admin:admin, root:12345, admin:123456 — are shared across hundreds of IPs for the boring reason that every brute-force toolkit on earth ships with them. Their breadth proves nothing about coordination; it is the universal dictionary, the SSH equivalent of the over-broad OTX pulse from Part 3. A hundred IPs trying admin:admin are not one operator; they are a hundred operators all using the same first guess.

Two fingerprints in the noise

The credentials that do fingerprint an operator are the ones no shared dictionary would contain — and they are in the data, hiding under the common noise. Filter the credential ledger for passwords that are neither dictionary words nor obvious patterns, and two stand out:

• root:nPSpP4PBW0 — a random-looking ten-character string, attempted from 103 distinct IPs.
• 345gs5662d34:345gs5662d34 — an identical random username and password, from 96 distinct IPs.

No brute-force dictionary independently ships a password like nPSpP4PBW0. For a hundred scattered addresses — across Nigerian telecom, Korean broadband, German VPS, Hong Kong cloud — to all try that exact string is only explicable one way: they are running the same hardcoded credential list, which means they are the same operation, or forks of one shared malware family. The random string is a serial number stamped on every bot in the fleet. Where the empty-root-password proves nothing, nPSpP4PBW0 across 103 IPs proves a single coordinated campaign — and it does so despite every one of those 103 IPs being a per-address singleton the ladder banned once and forgot. The operator's persistence, invisible in the address ledger, is legible in the credential ledger to anyone who knows to filter out the dictionary and read what remains.

Others surface the same way — pakchoi:Kermit123@ from 83 IPs, kim:kim123 from 111, root:1q2w3e4r from 87 — each a distinctive string binding a scattered set of one-time addresses into one recognisable hand. This is the SSH analogue of everything Parts 2 through 7 did with web infrastructure, relocated from the address to the credential: web recidivism is address reuse; SSH recidivism is credential reuse. Two ledgers, two persistence signals, one underlying truth — that a determined adversary always reuses something, and the art is knowing which column it hides in.

(One distinctive credential deserves a note for a later letter: pi:raspberry, tried from 83 IPs, is the default login of a Raspberry Pi — the specific target of a self-propagating worm this investigation has captured separately. The SSH flood is not only guessing generic passwords; part of it is hunting a specific device with a known factory credential, and that thread is its own investigation.)

The instant ban, in mechanism

Before the closing, the mechanism deserves to be named precisely, because its design encodes everything above. The honeypot's banning logic is deliberately, almost brutally simple: a single ingestion path watches the honeypot's session stream, and its ban threshold is one. There is no accumulation, no scoring, no second look. The first packet a source sends into the fake SSH server triggers a ban — a firewall block, applied immediately, for a fixed window. Every SSH attacker on this perimeter is banned on first contact, which is exactly why the tier-0 SSH count is enormous and the tier-3 count is zero: the mechanism spends its entire judgement in the first instant and never gets a second one, because the source is gone.

The fixed window is short — a day — and that choice, too, encodes the diagnosis. A day-long block on a source that will never return again is functionally a permanent one; there is nothing to extend it against. The short window matters only for the rare source that does come back, and for those the escalator's own tiering takes over — the same ladder that carries the web attackers. This is why the honeypot's handful of two- and three-time SSH offenders exist at all: they are the vanishingly small fraction of brute-force sources stationary enough to be seen twice inside the window, promoted a rung by the escalator before they, too, vanish. Eight of them reached a month; none reached a year; and that residue is the exact measure of how few SSH attackers hold still.

That threshold-of-one is not laziness; it is the correct and considered response to an adversary that does not recidivate per-address. A web ladder can afford to start soft and escalate, because the web attacker will still be at the same address next week to receive the harder ban. An SSH honeypot cannot, because the bot will not. When your only interaction with a threat is guaranteed to be your first and last, you spend the whole penalty at once. The two feeds' opposite thresholds — patient escalation for the web, maximal immediacy for SSH — are the system correctly reading the operational mode of each threat and answering it in kind.

What the honeypot keeps that the ban discards

The ban is only half of what the honeypot does, and the quieter half is where the SSH flood stops being a faceless statistic and reveals its purpose. A firewall block records only that a source arrived and was refused. A honeypot records what the source wanted — and to do that, it sometimes lets the attacker in. The credential ledger shows a 13.1% success rate: admin:admin "succeeded" 16,164 times, admin:123456 8,351 times, pi:raspberry 549. Those are not real breaches; they are the honeypot choosing to accept the guess, so it can watch what happens next. The instant ban punishes the source at the firewall; the fake shell, in parallel, plays along, and harvests the payload the attacker delivers once it believes it is inside.

That harvest is where the vanishing majority finally becomes legible. A brute-force source seen once and banned forever is, to the address ledger, a null event — a singleton, gone. But if that one visit got far enough to drop a script, the honeypot kept the script, and the script does not rotate. The code the SSH flood deploys — download URLs, shell commands, second-stage binaries — persists across thousands of disposable IPs exactly as the distinctive credentials do, and it is the deepest fingerprint of all. Two operators may share the empty-root-password by coincidence of dictionary; they do not share a byte-identical dropper by coincidence. The honeypot's willingness to be fooled, once per stranger, is what converts an un-countable flood of source addresses into a countable, comparable library of payloads — the one artifact of an SSH campaign its authors cannot make disposable, because it is the campaign itself.

This is the third ledger, beneath the addresses and the credentials: the ledger of intent. It is where an SSH source that recidivates nowhere else — not by IP, sometimes not even by credential — can still be bound to a family, a lineage, a specific worm, by the code it carries. It is also the seam between this series and the next: the payloads harvested from this flood are their own investigations, and at least one of them — a self-propagating bot dropped by a source that guessed pi:raspberry and got in — is already captured and waiting to be read. The recidivist ladder counted the knockers. The honeypot's fake shell kept what they were carrying.

Why the immediacy is the right answer

Step back to the design and the two feeds resolve into two deliberate, opposite philosophies. The web ladder is patient: it starts at three hours and escalates slowly, because a web attacker's persistence is the thing worth measuring, and each rung raises the cost of a return the attacker is going to keep making. The honeypot is immediate: threshold of one, the whole penalty front-loaded into first contact, because there will be no return to escalate against — yet it pairs that immediacy with the fake shell's patience, refusing the source at the firewall while indulging it in the sandbox long enough to learn what it came to do. Patience for the persistent; immediacy-paired-with-observation for the ephemeral. The two feeds are not two versions of one policy; they are two policies, each matched to the operational mode of the threat it faces — and the fact that they share one ladder, one ledger, one set of tiers is what let this series mistake them for one thing for seven letters before this one drew the line.

The count and the countless

The Recidivists began by promising to name the attackers who would not stop. It delivered — twenty-three of them, corroborated, mapped to their blocks, their clouds, their landlords. But the honest close of the series is the admission that those twenty-three are the countable adversaries, the ones whose mode of operation leaves a per-address trail. Underneath them, unbanned-past-first-contact and uncounted-as-recidivist, runs a majority that is larger, more relentless, and structurally invisible to the very lens that made the series possible: the vanishing SSH flood, 1,188 faces and not one repeat, a single tireless adversary wearing a new mask every day.

Neither the ladder nor this series is diminished by naming that boundary. A tool that measures infrastructure reuse is exactly right for catching the attackers who reuse infrastructure, and the honeypot's instant-ban is exactly right for the ones who don't; between them they cover both modes. What matters is not to confuse the map for the territory — to remember that the twenty-three recidivists are the ones who stood still long enough to be photographed, not the only ones in the room. The count is real. So is the countless. The last thing an honest ledger does is mark the edge of what it can count, and then keep the door shut against the rest anyway — one instant ban at a time, on a threat it will never see twice.