The Silent Majority: What the Instrument Declines to Say

Thirteen letters of this series have been about what the counting gets wrong. This one is about what it does not count at all.

Of every address that has reached this edge:

Nearly two in three visitors arrive, are enriched, are profiled — and the classifier declines to say anything about them.

That is either the largest blind spot in this estate's measurement or its most accurate single output, and the difference is testable.

The obvious worry

A classifier that has no opinion about 62% of its subjects looks like a classifier that is not working. The whole point of the preceding letters is that this instrument has been wrong four separate times, so the reasonable first assumption is that the silence hides something.

Three tests, in ascending order of how much they settle it.

Test one: what do they receive?

70.6% of everything the unlabelled population asks for, it gets. Compare that with the populations this series has named: the scavengers of Letter J ran 28,479 404s against 1,037 successes; the model hunters of Letter M got 306 refusals and 23 successes, none of them the thing they wanted.

Getting what you asked for is what reading a website looks like.

Test two: what do they ask for?

Look at the bottom half of that table. apple-touch-icon.png. site.webmanifest. favicon-16x16.png. og-threat-intel.png.

Nobody probes a web manifest. There is no vulnerability in apple-touch-icon.png, no credential inside a favicon, no exploit that begins by fetching an Open Graph image. Those files are requested by exactly one kind of client: something rendering the page.

And this is the same signal Letter K used, running in the opposite direction. That letter proved a 964-address cohort was not a browser because it fetched zero static assets across 1,204 requests — the absence was the evidence. Here the presence is:

Test three, which settles it

The first two tests show the population behaves like readers. That is not the same as showing the classifier is not missing attackers hidden among them. So: how many of the 16,913 unlabelled addresses have ever requested one of the paths this series has spent thirteen letters documenting — .env, .git/, wp-config, wp-login, wp-admin, .ssh/, id_rsa, phpmyadmin, /bin/sh?

Eleven.

Eleven addresses out of sixteen thousand nine hundred and thirteen. Not eleven percent — eleven.

And they get thinner on inspection. Here is everything those eleven did:

Read the redirect_to values. Those are real articles on the personal site, and that parameter is what WordPress itself puts in a login link when a reader clicks log in from a page. admin-ajax.php is the endpoint ordinary WordPress front-end code calls on every page load. Neither is an attack; both are my own pattern matching the site's normal behaviour.

Which leaves /.envrc — three addresses, one file — as the only unambiguous probe in the entire unlabelled population.

The silence is not blindness. When this instrument declines to label an address, it is almost always because the address did nothing worth labelling.

That deserves to be said plainly, because this series has been hard on its own measurement and the criticism should be calibrated. Four defects in four letters is a real record and none of them are retracted. But the same instrument, asked about the two-thirds of its subjects it stays quiet on, turns out to be quiet for the right reason.

The third that never got anything

The comfortable version of this letter would stop there. It should not, because the population is not uniform.

5,838 of the 16,913 unlabelled addresses never received a single 200. Not one success, ever. They are silent to the classifier and refused by the estate, which is a different condition from the readers above and deserves its own accounting.

Sorted by what kind of host they were asking for:

The 2,397 could never have succeeded: they asked for hostnames this estate has never had, which is Letter H's population arriving from a different direction. The 512 met Authelia. The 1,075 are Letter M's appliance hunters. And the 2,493 who addressed a real host and still got nothing are mostly the same readers as before, arriving at a path that has moved or never existed.

Their top paths look like the readers' — / (6,322 requests from 4,104 addresses), /favicon.ico, /robots.txt, the icon set. Right up until they do not:

/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings   163 requests, 144 addresses
/wp-json/gravitysmtp/v1/tests/mock-data                             153 requests, 136 addresses
/wp-json/gravitysmtp/v1/settings                                    151 requests, 135 addresses

The thing the silence was actually hiding

That is a WordPress plugin. Gravity SMTP is a mail-delivery add-on, and /wp-json/gravitysmtp/v1/settings is its REST API — the endpoint that holds mail-server configuration, which on a misconfigured install means SMTP credentials.

Measured across the whole corpus rather than just the never-succeeded residue:

One hundred and sixty-nine addresses have spent two months probing one plugin's credential-bearing API, and the classifier has no opinion about 151 of them.

Put that beside the populations this series has already written letters about:

It is larger than every one of them, and it is invisible — not because it hides, but because nobody has written the rule. Every path rule in this estate's classifier was authored in response to something somebody noticed. This is what the surface looks like before anybody notices.

It is not hiding at all

The most striking thing about this campaign is how little effort it makes to be missed.

Read the second row. The scanner puts the CVE number in its own User-Agent. It is not merely unhidden; it is self-documenting. Whoever built this tool wanted the target's logs to say what it was testing — the behaviour of a bulk research scan or an automated advisory-verification service, not of somebody trying to get away with something.

That single string also settles a question this letter could otherwise only infer. Every request in this campaign was refused, so no outcome reveals purpose. The User-Agent supplies it directly: this is CVE-2026-4020 verification against the Gravity SMTP plugin, at scale.

The paths show the same competence, tried in both of WordPress's REST styles:

The last row matters. /?rest_route= is the fallback WordPress uses when pretty permalinks are disabled and /wp-json/ does not resolve. A scanner that only knew one form would miss every install configured the other way; this one carries both. Two further requests arrived wrapped in Authelia redirect parameters, aimed at lsn-webmail and lsn-book-fetcher — so it also enumerates hostnames before probing them.

And the origin is concentrated to a degree nothing else in this series matches:

One hundred and forty-seven of 169 addresses — 87% — are Google Cloud, across ten countries. Compare Letter K's cohort at 470 networks, or Letter M's at 77. This is one tenant of one cloud provider running a scan at volume and making no attempt to distribute it, which is consistent with the self-declaring User-Agent: an operation that does not expect to be blocked because it does not consider itself an attacker.

Whether that self-description is accurate is a separate question this data cannot answer. /wp-json/gravitysmtp/v1/settings returns stored mail credentials on a vulnerable install, and a scan that confirms the vulnerability is one request away from a scan that harvests it. The distinction lives entirely in what the operator does with a positive result, and this estate never produced one.

So the honest verdict on the silence is two-sided, and both sides are load-bearing:

The silence is well-founded. Eleven addresses out of 16,913 touched a classic malicious path. The instrument is not sitting on a hidden army.

The silence is not complete. It concealed a 169-address, two-month, credential-seeking campaign against a named plugin, and the only reason I found it is that I went looking inside the unlabelled population for this letter rather than trusting the label counts.

The denominator is not a property of the traffic

One more thing about the 62%, and it is the part most likely to be quoted wrongly.

That number is not a fact about who visits this estate. It is a fact about the classifier on the day it was measured. Eight days ago it was worse:

A single change — widening the cohort detector's window from 24 hours to 30 days, described in Letter L — moved classification coverage by twenty percentage points in one deploy. Nothing about the traffic changed. The instrument simply started seeing a population that had been arriving the whole time.

Which means any figure of the form "N% of our traffic is unclassified" has a shelf life measured in deploys, and reporting it as a property of the threat landscape rather than of your own detection is a category error. This letter's 62.5% will be wrong the next time somebody writes a rule — including, if the recommendation below is taken, immediately.

What changes here

Write the Gravity SMTP rule. A 169-address population probing a plugin's credential API for two months should carry a label. The signature is unambiguous — /wp-json/gravitysmtp/v1/ — and it belongs under credential_harvest, which is where every other "fetch me the stored secrets" path already lives. It will relabel roughly 151 currently-silent addresses.

Report coverage as a metric, and date it. The share of addresses carrying a label is a measure of the instrument, not of the world, and it moved twenty points this month without a single change in the traffic. It should appear on the dashboard next to the intent counts, with the date it was computed, so that nobody reads a rising unclassified share as calm.

Do not chase the rest of the silence. Eleven addresses out of 16,913 is the strongest evidence in this letter, and it argues against building more rules speculatively. The unlabelled majority are readers: they ask for the index, they fetch the favicon and the web manifest, and 70.6% of the time they get what they came for. Labelling them would not make this estate safer; it would only make the dashboard busier.

And keep the asset signal in mind, both ways up. Letter K identified a scraper cohort by the static assets it never fetched. This letter identifies 3,535 readers by the ones they did. The same field, read in both directions, has now done more classification work than any threshold in the pipeline.

Method and limits

Single source: the Traefik edge access log and the ip_intel enrichment table, corpus 2026-06-03 → 2026-08-12, 288,561 requests from 27,071 distinct addresses. The corpus is live and the classifier runs continuously, so every figure here was taken in a single transaction rather than assembled from separate queries. That precaution was not theoretical: an earlier pass sampled across a running classify cycle and reported the unlabelled success rate as 69.0% against the coherent snapshot's 70.6% — a published error of exactly the kind this series exists to document. "Unlabelled" means probe_intent IS NULL for an address that appears in the request log; exactly one address in the corpus has traffic but no enrichment row at all, and it is excluded rather than counted either way.

The malicious-path test — the eleven — used the pattern set this series has documented across thirteen letters (.env, .git/, wp-config, wp-login, wp-admin, .ssh/, id_rsa, phpmyadmin, /bin/sh). That is the test's limitation and it is the important one: it can only find probes shaped like the ones already known. The Gravity SMTP campaign is the proof — 169 addresses, two months, and it matches none of those patterns. The eleven therefore establishes that the unlabelled population contains almost nothing resembling the attacks this estate already knows about, which is a narrower claim than "contains almost no attackers", and the difference between those two sentences is the whole second half of this letter.

The static-asset test is a floor. An address that read a page from cache, or fetched only HTML because a text-mode client was used, is a genuine reader that this method does not credit. 3,535 is the number provably browser-like, not the number of humans.

The before/after coverage comparison (16.9% → 37.6%) holds the corpus roughly constant across eight days of ordinary growth, so it is indicative rather than controlled. The 5,595-address swing is dominated by one deploy — the cohort-window change — and no other rule was added in that window.

Nothing in this letter was produced by contacting, probing, or fetching from any address described. No address is named; the populations here are counted, not identified.

Confidence: HIGH on the counts, which are direct queries. Confidence: HIGH that the unlabelled majority are readers rather than undetected attackers, on three independent tests that agree. Confidence: HIGH on the Gravity SMTP campaign's existence, scale and unlabelled status. Confidence: HIGH on its purpose, which is unusual for this series and rests on one field: the scanner declares vuln_scanner/3.1.0 (CVE-2026-4020) in its own User-Agent, so the objective is stated rather than inferred. Confidence: LOW on whether that self-description is complete — a scan confirming the vulnerability and a scan harvesting the credentials it exposes are one request apart, and since every request here was refused, this corpus cannot distinguish them.

The Census, Letter N. Previous: Letter M — The Model Hunters. The series counts what arrives at one small estate's edge and what the counting gets wrong.