TI-2026-100B — The Quiet Transit, Part B: The Flag That Fired on Spectrum

Classification: TLP:WHITE · Confidence: HIGH · Series: The Quiet Transit, Part B Investigation window: 2026-05-21 → 2026-07-26 · Subject: our own scoring pipeline

1. A number that should not exist

Part A examined AS41745 — a nine-IP Russian-registered reseller with five maintainer handles, five trading names, a registration jurisdiction that matched none of its operating jurisdictions, and a hundred-percent critical-abuse population. That dossier was careful. It steelmanned the benign reading, accepted it, and concluded with a deliberately unexciting verdict: an abuse-tolerant reseller, not a criminal enterprise.

Our platform scores AS41745 at 80.46.

It scores AS20115 — Charter Communications, trading as Spectrum — at 90.4, is_bulletproof = true.

Charter is a twenty-five-year-old ARIN registration announcing 2,417 IPv4 prefixes across twenty-six upstreams. It holds fourteen internet-exchange records and twelve facility records in PeeringDB, publishes an interconnection policy, maintains an IRR as-set, and answers abuse mail at a documented address. It is one of the largest internet service providers in the United States.

Our system rates it ten points more bulletproof than the operator Part A spent an entire dossier declining to call criminal.

This dossier is about why — and it is about our own instrument, not about Charter.

2. What the flag was built on

The bulletproof_assessment record for AS20115 is short enough to quote entirely:

Two signals. One of them is a restatement of the conclusion. The other is an average.

Here is the telemetry that average was computed from:

Twelve authentication attempts. Across sixty-six days. From three machines. The busiest single day recorded two.

Every collection that would evidence an operator is empty: no shared credentials, no shared commands, no downloads, no shared SSH keys, no subnet intelligence. There is nothing here. And on this, the platform concluded that a million-address consumer ISP is a bulletproof host.

3. Who the three machines actually are

Reverse DNS answers the question immediately.

biz.spectrum.com, with zero-padded octets — Charter's standard PTR format for Spectrum Business subscriber lines. These addresses are assigned to customers. They are not Charter-operated servers.

Shodan says what the customers are running:

Port 8291 is MikroTik Winbox. Port 8728 is the RouterOS API. Port 2000 is the RouterOS bandwidth-test server. Two of these three machines are MikroTik routers with their management plane exposed to the public internet, carrying thirty-four and forty-seven known vulnerabilities respectively, with telnet and FTP also open.

These are compromised customer-premises routers. The SSH probing our honeypot recorded is an implant doing its work on a subscriber's hardware.

The entity whose abuse is being scored is not the entity being blamed.

The fingerprint says the same thing

All three share HASSH acaa53e0a7d7ac7d1255103f37901306 — OpenSSH_7.4 — in a parent cluster of 757 IPs across 78 countries, which our own platform classifies ambiguous rather than botnet or scanner.

OpenSSH 7.4 is the stock build in an enormous population of embedded and legacy Linux images. Matching on it groups devices by the firmware they shipped with, not by who is driving them. The platform labelled the cluster ambiguous and was right to. Then the score treated its members as evidence anyway.

4. Root cause

The mechanism is not subtle once the numbers are next to each other.

avg_threat is computed across observed IPs only.

AS20115 announces 2,417 IPv4 prefixes — on the order of a million addresses. Three were observed. Those three happen to be infected. Their individual threat scores are 71, 67 and 66, averaging 68. The signal high_avg_threat: 68 fires. is_bulletproof follows.

There is no term anywhere in that chain for how large the network is, and no floor on how many IPs must be observed before the claim is allowed.

A small-N numerator divided by a denominator that was never included.

Three infected routers out of a million addresses score identically to nine infected servers out of nine. Part A's AS41745 had a 100% critical-abuse population across its entire visible estate — twelve of twelve — and that is a genuinely meaningful ratio. Charter's ratio is three out of roughly a million, and the pipeline cannot tell the difference, because it never computes a ratio at all.

5. It is systematic

This is not one mislabelled ASN.

Charter operates several ASNs, linked in our graph by shared_peeringdb_org at confidence 0.9 under PeeringDB org 1971:

Four of five flagged. Same corporate family, same mechanism, same wrong answer.

Widen the lens to the ASNs sharing upstreams with AS20115 and the pattern is worse:

Consumer ISPs. A national mobile carrier. A mainstream German hosting provider. All carrying a bulletproof designation.

Any defender who consumed this field as a blocklist input would be blocking a substantial share of the legitimate internet.

6. The counter-narrative, steelmanned

The strongest case for the flag deserves a fair hearing, and it is not nothing.

All three observed IPs carry AbuseIPDB confidence 100. External reporters do consider these addresses abusive. And an ISP that leaves subscriber CPE with 34–47 known vulnerabilities and Winbox exposed to the internet for months is not blameless — TI-2026-021M argued precisely that consumer CPE security is an ecosystemic anti-abuse issue rather than a consumer-hygiene one, and that argument stands.

But look carefully at what that argues for. It argues that Charter may be negligent in customer-equipment lifecycle management.

Bulletproof hosting means something specific: knowingly selling abuse-tolerant capacity to criminal customers and refusing to act on takedown requests. Charter publishes an abuse contact, an interconnection policy, facility records and a peering policy. Nothing in the evidence suggests it sells to abusers or refuses takedowns.

The counter-narrative sharpens the finding rather than defeating it:

Charter may well be negligent about CPE. Negligent about CPE and bulletproof host are not the same accusation, and our platform is making the wrong one.

7. Every other indicator points the other way

The single entity-resolution discrepancy recorded for Charter is that PeeringDB says "Charter Communications" while RIPEstat says "Charter Communications LLC". That is a formatting difference.

Every structural signal that genuinely fired for AS41745 is absent here. And Charter still scored higher.

8. The fix — applied, not proposed

Update, 2026-07-26: this has been fixed and deployed. Both defects are corrected in jobs/intel-linker/linker.py::update_asn_risk_scores(), shipped as intel-linker v54 (is_bulletproof) and v55 (risk_score). The numbers below are measured end-state, not projections.

8.1 is_bulletproof — sample floor, eyeball guard, size gate

The offending branch was a single unguarded line:

OR COALESCE(agg.avg_threat, 0) >= 60      -- no floor, no denominator

It now carries three guards:

The Spamhaus branch is deliberately left unguarded — an external authority's published listing should override our own heuristics in both directions.

One design decision is worth recording, because the obvious choice was wrong. The natural eyeball guard is re_entity_class = 'isp', which has better coverage (99% of rows versus 75%). It cannot be used: entity resolution also classes AS41745 — the subject of Part A — as isp. Guarding on it would have suppressed the genuine finding along with the false ones. peeringdb_info_type separates them cleanly, because Charter publishes Cable/DSL/ISP and AS41745 publishes nothing at all.

Measured result:

8.2 risk_score — the same defect, one layer down

Publishing §2 of this dossier exposed a second problem: clearing the boolean left the number untouched. Charter still read 90.4. The formula's first term was a raw ratio over observed IPs:

(high_ips / ip_count) * 100 * 0.7 + avg_threat * 0.3

Three-of-three infected devices = 100%, contributing 70 points before avg_threat was even added. 883 of 2,055 scored ASNs — 43% — sat at 80 or above. A scale on which nearly half of everything is critical is not a scale.

Two corrections, applied to the ratio term only:

1. Shrinkage. Additive (Laplace) smoothing toward the corpus base rate — 0.583 of observed IPs are threat>30 — with pseudo-count k=10: (high_ips + 10 × 0.583) / (ip_count + 10). A 3-of-3 sample no longer reads as 1.0; a ratio must earn its extremity with volume.
2. Coverage scaling. Multiply by how much of the estate we have actually observed. Eyeball networks and large announced estates need 20 observed IPs for full weight; everything else needs 5, matching the sample floor in §8.1.

Measured result:

8.3 What the ranking looks like now

Every published bulletproof subject kept its designation and its approximate rank. Every network identified in §5 as a false positive collapsed. The ordering is now doing the job the field was always supposed to do.

One side benefit worth noting: linker.py gates the creation of weak shared_bgp_upstream edges on risk_score > 30. Deflating the inflated scores means fewer of those 0.4-confidence edges get minted — which quietly reduces the graph over-linking that Part A §7 had to caveat so heavily.

9. Why publish this

The is_bulletproof field feeds dossier generation, and dossier generation feeds this website.

The harvest that produced Part A was a survey of unpublished investigations ranked by substance. Had it been run without a manual read of the underlying telemetry, the obvious next dossier would have asserted that one of the largest internet service providers in the United States is a bulletproof host — citing our own risk score of 90.4 as the evidence. That dossier would have been published here, under the same masthead as everything else, and it would have been false.

Nothing prevented it except someone opening the record and asking how many IPs the number was computed from.

This corpus already carries two published false-positive corrections, TI-2026-019L and TI-2026-019M. This is the third, and the shape is identical in all three: an automated signal was trusted at exactly the point where a human should have asked what the denominator was.

A threat-intelligence platform that only publishes its hits is a marketing instrument. The corrections are what make the hits worth anything. So the correction goes in the same public place the claim would have gone.

10. Defence response

For anyone consuming ASN-level reputation — ours or anyone else's:

1. Never treat an ASN reputation score as a blocklist input without checking the observation count. Ask how many IPs it was computed from and how many the ASN announces. A score without a denominator is a rumour.
2. Check entity_class before acting. Consumer ISPs and mobile carriers will always accumulate abusive IPs, because their customers get infected. That is a property of having customers, not of being criminal.
3. For the actual problem here — exposed CPE: block inbound 8291, 8728 and 2000 at the subscriber edge, disable Winbox and RouterOS API on WAN interfaces, close telnet and FTP, and keep RouterOS current. The three machines in this dossier are victims, and the remediation belongs to whoever owns them.

11. Metadata

Sources

• LSN threat_intel — bulletproof_assessment, activity aggregate, entity graph, deep-enrichment classifier, 2026-05-21 → 2026-07-26
• PeeringDB net 2144 — Charter Communications
• Shodan port and vulnerability data via LSN deep enrichment
• ARIN allocation record, AS20115, 2001-03-26
• TI-2026-100A — The Quiet Transit
• TI-2026-021M — The Phantom Pipes

Charter Communications LLC is named in this dossier as the subject of an incorrect rating produced by the author's own tooling. No allegation of wrongdoing is made against Charter Communications, and the bulletproof designation recorded against AS20115 in the LSN platform is stated here to be false.