TI-2026-096G — Running the Carousel Down: What Joining the Streams Actually Finds

Classification: HIGH · Forensic threat intelligence · Entity-graph / lifecycle vector · Series: The Unannounced

The synthesis in Part F closed the map and left one experiment unrun: its fourth rule, join the streams to catch a carousel turning. Take a prefix, trace its ownership history across the change-log, and you should be able to watch a dead-ASN carousel rotate a block through fresh wrappers in real time. This letter runs that experiment. What it found is not the clean carousel the doctrine promised — and the way it failed to find one is worth more than a carousel would have been. The flashiest candidate dissolved under resolution into an ordinary hosting reseller. The most boring one held. That inversion is the whole letter.

1. The Experiment

The method is exactly the doctrine's rule 4. Start from the owner_changed transfers Part D flagged as suspicious — the brand-to-opaque direction, where a named hosting provider hands a block to a bland acronym. For each one, do two things the earlier letters did not: pull the prefix's full change history (not just the single flagged event), and resolve the successor wrapper to ground truth — is the new holder a real network or an empty shell?

Three candidates went in: the ZetServers, ODCLOUD, and NELLICUS transfers. Their prefix histories, laid out, look like this:

If you stopped here — at the raw change-log, before resolution — you would write the obvious story. The 82.41.67.0/24 row is the carousel: three hops, a block oscillating between two holders, the origin ASN number itself flipping back and forth between two adjacent fresh 2026 numbers. Case closed, dead-ASN carousel caught in the act. The single-hop rows would be footnotes.

That obvious story is wrong. Resolution turns it upside down.

2. The Flashy Candidate Dissolves

Resolve AS215030 — the "PINKMARE-AS" the /24 keeps bouncing back to — and the carousel evaporates:

• AS215030 is AspireHosting — full holder string "Budankailu Namrata Patra trading as AspireHosting", India, allocated 2026-02-03.
• It has a real website (aspirehosting.net), a VirtFusion/nginx hosting panel, a peeringdb record declaring 10 IPv4 and 10 IPv6 prefixes, 1-5Gbps traffic, an open peering policy.
• Its risk score is 2.4 (LOW). Its total honeypot footprint is one IP, four connection attempts, threat 8.0 LOW — a single libssh_0.9.6 fingerprint that the classifier tagged botnet-adjacent, sitting in a "Shared nginx infrastructure" recon campaign. Minor. Ordinary. The background hum of the small-hosting internet.

This is not a bulletproof rotation. It is a real small Indian hosting reseller — and note the holder form: an individual trading as a business, the exact retail-floor pattern of Part C. Its /24 flaps between AS215030 and AS214616 (ODCLOUD-AS, another fresh 2026 Indian hosting ASN), and the flips land precisely on iptoasn's daily 03:44–03:46 scrape times. The most economical explanation is not a carousel operator rotating wrappers to launder reputation; it is iptoasn's dataset being unstable about which of two sibling reseller ASNs originates a shared block. Multi-hop drama, resolved, is a data artifact of the messy retail-hosting scene.

The lesson lands hard: the number of hops is not evidence of a carousel. The flashiest row in the table was the noise.

3. The Boring Single Hop Holds

Now resolve the row that looked like a footnote. 82.109.207.0/24: ZETSERVERS (AS25198, Romania) → MES (AS213962, Lebanon). One hop. No oscillation. Nothing dramatic.

Except the successor is a ghost. Resolve AS213962 (MES) and the record is empty: zero IPs, zero prefixes, no peeringdb entry, no RIR fields, UNKNOWN classification. It is a brand-new autonomous system with no footprint of any kind — a wrapper and nothing else. And the block did not just change holders; it changed country, from Romania to Lebanon, as it moved from the named brand to the empty shell.

That is the reputation-laundry direction, stated in TI-2026-021G, caught in a single clean event: a named, marketed hosting provider (ZetServers.com — a real brand with a real reputation to shed) hands a /24 to a fresh, zero-footprint, opaque ASN in a different jurisdiction. There is no drama because laundering does not need drama. It needs exactly one quiet hop from a burdened name to a clean blank. The signal was the boring row all along.

(The third candidate, NELLICUS-NETWORKS → DACSIX-NORTH, resolves to neither a clean empty shell nor an obvious reseller — the origin ASN flips to a legacy 16-bit US number. It is genuinely ambiguous, and it is recorded as ambiguous rather than forced into either bin.)

4. The Discriminator: Test the Successor's Footprint

The experiment yields a rule sharper than the doctrine that motivated it. The thing that separates a laundering transfer from reseller churn is not the shape of the ownership history — hops, oscillation, ASN flips are all producible by ordinary data instability. It is the footprint of the successor:

• Successor is a real network — has a website, a panel, declared prefixes, some honeypot presence (AspireHosting): the transfer is churn. The block moved between operating businesses; the drama is noise.
• Successor is a ghost — zero prefixes, zero peeringdb, zero honeypot, UNKNOWN, freshly allocated (MES): the transfer is the laundry direction. A block handed to a blank is a block being cleaned.

This is cheap to apply and it inverts the naive read. A single-hop transfer to an empty shell outranks a three-hop oscillation between two real resellers, every time. Resolve the successor before you believe the carousel. That one line is the operational residue of the entire experiment.

5. The Counter-Narrative

Steelman. "You promised, in Part F, that joining the streams would catch a carousel turning. You ran it and caught nothing — one reseller flapping and one boring transfer you can't even prove is laundering. This is an anti-climax dressed up as a method."

The anti-climax is the method, and here is why that is not a dodge:

• "You caught no carousel." Correct — and reporting that honestly is the finding. The dramatic candidate failed its own resolution check. An analyst who wanted a carousel could have published the 82.41.67.0/24 oscillation as one and been wrong. The value of the experiment is that it stopped that mistake — it is the difference between intelligence and pattern-matching. Finding that the flashy thing dissolves is a result.
• "You can't prove MES is laundering." Bounded — and stated as MEDIUM. What is documented is the structure: a named brand → a zero-footprint opaque ASN → across a border. That is the laundry direction with the empty-successor property, which is as far as registry evidence takes it. It could be an ordinary asset sale to a quiet buyer; the letter says so. The claim is the discriminator, not a conviction.
• "So the doctrine's rule 4 is weak." No — it is refined. Rule 4 said join the streams. This letter adds the missing half: joining surfaces candidates, but resolution to the successor's footprint is what confirms. The rule got sharper by being run, which is what experiments are for.

What is not claimed: that a dead-ASN carousel was caught (none was, honestly); that AspireHosting is malicious (it is an ordinary small reseller); that MES is proven criminal (it is a zero-footprint successor in the laundry direction, no more). The claim is methodological: the empty-successor test beats the hop count.

Confidence: HIGH that joining the streams surfaces real prefix-level transitions, that the oscillating candidate is a benign reseller not a carousel, and that the empty-successor test is the reliable discriminator; MEDIUM that the ZetServers→MES transfer is reputation laundering rather than an ordinary sale.

6. Defence Response

• Never publish a carousel on hop count alone. Oscillation and ASN-flips are producible by iptoasn instability over the retail-hosting scene. Before calling a prefix history a carousel, resolve every wrapper.
• Apply the empty-successor test. Alert when a named, footprinted holder transfers a block to a zero-prefix, zero-peeringdb, zero-honeypot, freshly-allocated ASN — bonus weight if the country changes. That single test is the reliable laundry discriminator and it is cheap at registry-scan time.
• Treat reseller churn as a filter, not a lead. A block flapping between two real panelled resellers (websites, VirtFusion, declared prefixes) is churn; drop it. The analyst's time goes to the quiet transfers into blanks, not the loud oscillations between businesses.

7. A Note on Method

Built entirely through the entity-graph and honeypot MCP layers, no direct database access — entity_detail for each prefix's full owner_changed history and origin-ASN flips, and honeypot_asn_dossier to resolve every successor wrapper to ground truth (AspireHosting's panel and minor activity; MES's empty record). The experiment is exactly TI-2026-096F's rule 4, run and then corrected by resolution. No SQL touched the investigation, and the anti-climax is reported as found.

8. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence