Detection

What would have caught any of this, and why nothing did

TI-2026-103N · Series: The Loud Hour · Letter N of 15 — the final letter Operates under the rules of evidence in Letter O — The Instrument. This letter is the series turned around: every measurement failure documented across fourteen letters, reassembled as a specification for what should have found these actors.

1. The honest framing

Before anything else, a distinction the rest of this letter depends on.

[DOCUMENTED] The perimeter worked. Every principal actor in this series — 179.43.139.58, 94.154.35.215, 185.246.128.133, 80.66.66.10, 87.251.64.176 and the TechTies fleet — carries mikrotik-ban and crowdsec-blacklist tags. They reach the sensor at all only because the honeypot is deliberately exempted from those blocks.

[DOCUMENTED] The blocking is not what failed. Reputation feeds, CrowdSec and the router blocklist between them stopped this traffic everywhere it mattered, months ago.

What failed was understanding. For four months a hundred and eighteen machines ran a byte-identical job, five machines opened the same door twenty-two thousand times, and a hundred and thirteen machines installed the same backdoor key — and not one of those groups was identified as a group by any deployed analytic.

That is the subject of this letter. It is not a story about a defence that was breached. It is a story about a defence that held while the analysis behind it saw noise.

2. The scoreboard of failures

[DOCUMENTED] Every clustering and enrichment layer in this corpus, against the groups the series established by hand:

[DOCUMENTED] Nine layers. Nine failures. And they are not nine unrelated bugs.

3. The common shape

[INFERRED — confidence HIGH] Four failure modes account for all nine, and each recurred across multiple letters:

(a) The empty table that answers. The CVE linkage returns a well-formed total: 0 for Log4Shell across 16,137 addresses. Operator clustering returns total: 0. A filter with an HTML-escaped ampersand returns 0 results. An empty result with a valid schema reads as an answer, and in every case this series initially took it as one. The remedy is R16 — run a saturation control before reporting any absence.

(b) The derived field read as an observation. An empty campaign_ids array was read as "no fingerprint exists" when the fingerprint was the largest in the corpus. A HASSH tool_name was read as the client when the session banner said otherwise. R8 says a derived index's silence is evidence about the index; this series broke its own rule twice, in the same shape, and both times the correction made the finding sharper.

(c) The wrong denominator. Commands per connection across a window where the authentication rate moved from 100% to 7.2% produced a phantom "capability collapse" that reversed under the correct denominator. A fixed 54.06 divisor turned "July" into "anomalous". R11 — normalise against the population that can exhibit the behaviour.

(d) The unrepresentative sample. Pacing measured from the first 28 connections of one job gave 5.4 s/attempt; 22 complete jobs gave 6.47. first_seen read from a registry gave a date two months wrong. Sample at the extremes, generalise, get corrected.

[DOCUMENTED] This series made every one of these errors itself and caught them by cross-checking one instrument against another. That is the only method it claims, and it is the method a detection pipeline cannot apply on its own.

4. The metric that means nothing

[DOCUMENTED] The behavioural classifier reports:

labels_total          : 128
accuracy              : 0.9922
independent_labels    :   9
independent_accuracy  : 0.8889

[DOCUMENTED] 99.22% accuracy is not a measure of anything useful, for three independent reasons — and the endpoint flags the first itself:

*"Non-independent labels (GreyNoise/ThreatFox) also feed the classifier; their agreement reflects consistency/regression, not pure accuracy."*

First, it is circular. 119 of 128 labels come from feeds that are themselves inputs to the classifier. Agreement measures self-consistency.

Second, the honest number is 88.89% on nine samples. Nine is too few to distinguish 89% from 60%.

Third — and this is not flagged anywhere — the confusion matrix shows the taxonomy is collapsed. Ground-truth malicious, 121 labels, was predicted as:

[DOCUMENTED] Yet malicious recall is reported as 1.0, 121 of 121 correct. Both can only be true if scanner, malware and malicious are all scored as correct for a malicious label — that is, if the metric is really benign versus not-benign.

[DOCUMENTED] There is exactly one benign label in the entire evaluation set.

[INFERRED — confidence HIGH] The classifier's headline accuracy measures its ability to distinguish one benign example from 127 malicious ones, using labels it partly generated. The one class where a genuine distinction was attempted — scanner — has a recall of 0.5, one of two.

[DOCUMENTED] And scanner is precisely the class this series needed. Letter K established that distinguishing measurement from intrusion is the single most consequential classification in the corpus, and it is the one the classifier gets right half the time on two examples.

Rule R19. An accuracy figure computed against labels that feed the classifier is a consistency check, not an evaluation. Report the independent-label accuracy and its sample size, or report nothing.

5. What would have worked

Six detectors. Each is derived from a finding in this series, each uses only data the corpus already holds, and none requires a reputation feed.

D1 — Attempts per address, per credential

[DOCUMENTED] The sharpest discriminator found anywhere in this corpus. For admin/admin, attempts per contributing address by country:

CH  799.1     SE  554.9     PL  400.5     BG   99.5
                    ── no middle ──
VN    1.0     BE    1.0     US    1.0     GB    1.0

[DOCUMENTED] Ten addresses hold 94.64% of 16,500 attempts; the other 524 average 1.69.

[INFERRED — confidence HIGH] A per-source ratio of attempts on a single credential isolates the beacon class instantly and completely, with no dependency on any feed, score or fingerprint — the three signals that failed in §2. It would also have caught the two beacon operators this series missed until Letter E, and the class member with a threat score of 59.4 that reputation scoring rated harmless.

Alert rule: any source exceeding ~50 attempts on one credential over 30 days.

D2 — Job arithmetic

[DOCUMENTED] 118 addresses whose lifetime connection totals are exact multiples of 762, and whose fingerprint totals are exact multiples of 761. Three separate machines reporting precisely 2,286.

[INFERRED — confidence HIGH] Computing the greatest common divisor across per-source connection totals, or simply flagging repeated identical totals, would have surfaced this fleet immediately and as a unit — the thing every clustering layer in §2 failed to do. It requires one aggregate query and no intelligence at all.

Alert rule: three or more sources sharing an identical lifetime connection total.

D3 — Per-node baselines

[DOCUMENTED] The 2026-07-29 excursion was 348× that address's own baseline and roughly 2–13× the corpus baseline. Corpus-threshold alerting did not and structurally could not fire.

[INFERRED — confidence HIGH] Burst detection must run per source against that source's own history, not against a corpus aggregate. Letter O's finding stands as a design rule: corpus bursts and node bursts are different phenomena and need different detectors.

Alert rule: any source exceeding 10× its own trailing 7-day hourly median.

D4 — Self-identification triage

[DOCUMENTED] The Censys control: 42 addresses, rdap_org "Censys, Inc.", ASN registered in its own name, reverse DNS censys-scanner.com, 1 connection each, 0 authentications.

[INFERRED — confidence HIGH] Three cheap checks separate measurement from intrusion far more reliably than any threat score: does reverse DNS identify a scanner? does RDAP name a real company? does it attempt authentication? The last is decisive on its own — Letter K refuted three separate benign explanations on it. A source that authenticates is not measuring.

Triage rule: authentication attempted → not a measurement service, regardless of volume.

D5 — Inter-event dispersion

[DOCUMENTED] Fleet dispatch intervals have a coefficient of variation of 0.83; a cron schedule approaches 0 and a memoryless process approaches 1.0. Beacon intervals by contrast are near-constant.

[INFERRED — confidence MEDIUM-HIGH] CV of inter-event gaps separates scheduled from queued behaviour and needs only timestamps. Near-zero identifies a timer (the beacons); near-one identifies arrival from a rotation (the fleet). It classifies without attribution.

D6 — Cross-table artefact correlation

[DOCUMENTED] The mdrfckr key is shared by 113 addresses and is invisible to every key clustering tool, because it was written by a shell command and stored as a download artefact while the clustering operates on client authentication keys. Different tables; nothing bridges them.

[INFERRED — confidence HIGH] The largest coordination artefact in the corpus escaped three letters that flagged it, for a purely structural reason. Any artefact that appears identically across many sources is a clustering key regardless of which table it lives in — dropped keys, command strings, marker strings, URLs.

Alert rule: cluster on any artefact hash observed from ≥ 3 distinct sources, whatever its provenance table.

6. What the instrument needs

[DOCUMENTED] Three changes are analysis-independent and would each have altered this series' conclusions:

A control sensor. Letter L could not test selectivity — the single most direct measurement of targeting — because there is one sensor at one address. A second honeypot at an unrelated address, published about by nobody, makes the question answerable. This is the highest-value change available and it is instrumentation, not analytics.

Saturation controls in the pipeline. Every "zero" this corpus returns should be accompanied by a control query. A CVE endpoint that returns 0 for Log4Shell is broken; one that returns thousands is working. The pipeline knows enough to check itself and does not.

Stable field semantics. first_seen and last_seen are row ages, not observation dates (D1, D9). honeypot_hits and session totals diverge by ratios of 1.0, 1.64 and 2.00 with no documented definition (D2). tool_name contradicts the session banner (Letter J). Each of these produced a published error in this series, and each is a one-line documentation fix.

7. What a defender should take from this

[INFERRED — confidence HIGH] Five transferable conclusions, none of which depends on this particular sensor:

1. Volume is not capability. The loudest actors here took nothing; the population that installed 113 backdoors sits at 1.0 attempts per address, indistinguishable from noise. Ranking by anomaly magnitude surfaces the harmless first.
2. Reputation does not discriminate behaviour. An address at threat 59.4 with six abuse reports behaved identically to peers at threat 100 with thousands.
3. A success rate is not knowledge. 100% success on admin/admin is available to anyone who guesses the most predictable credential in existence — 534 addresses did.
4. ASN attribution fails on bulletproof infrastructure. One ASN carried an inventory fleet, a wallet thief and a third party simultaneously, beneath a reseller layer that appears in no registry.
5. The credential attempt is the line. It separates measurement from intrusion more reliably than volume, persistence, technique or reputation, and it refuted three benign explanations at once.

8. The rules, consolidated

[DOCUMENTED] Nineteen rules of evidence accumulated across fifteen letters — twenty as of 2026-07-30, R20 having been issued in the addendum. Each was written because something went wrong first. They are the series' most transferable output, and they apply to any analyst working this corpus or one like it.

⚠ ADDED 2026-07-30. R20 was issued after publication, in TI-2026-103P — The Sponsor, when the handle Letter C called "the only hard operator link in the series" resolved to a sponsoring Local Internet Registry. It belongs to the absence family below, which now numbers seven: Letter G named the LIR reading explicitly, ran a public-literature search instead of a registry query, found nothing, and reported the nothing. Twenty rules.

[INFERRED — confidence HIGH] The rules cluster into three families, and the clustering is itself the lesson. Six concern field semantics (R1, R2, R12, R13, R18, and half of R6) — fields that do not mean what their names suggest. Six concern absence (R3, R8, R15, R16, R17, R19 — and now R20, making seven) — every one written because a well-formed empty answer was mistaken for a finding. Seven concern normalisation (R5, R6, R7, R9, R10, R11, R14) — denominators, units and baselines.

Not one concerns the adversary. Every rule in this series exists because of the instrument.

9. What this letter — and this series — could not establish

• Whether any proposed detector works in production. D1 through D6 are derived from a four-month retrospective on one sensor. None has been implemented or tested against live traffic, and a detector that separates populations cleanly in hindsight may not in flight.
• Whether the classifier is actually poor. §4 establishes that its headline metric is uninformative, not that its output is wrong. Those are different claims and only the first is supported.
• Whether the missing clusters are a design choice. A linker may deliberately exclude large homogeneous ASN-concentrated groups as "infrastructure". The linker's rules were never read, and this letter infers from behaviour rather than code.
• What any of this would look like on another sensor. Every number in fifteen letters is conditioned on one Cowrie instance with a hand-enumerated accept list and three authentication regimes. The behavioural structures — a 761-entry job, a 30-minute beacon, a two-tier fleet — are facts about the adversary. Every rate, ratio and success figure is a fact about this instrument.
• Who operates any of it. Fifteen letters narrowed the question from an ASN to a tenant to a customer of a reseller, and stopped. vmheaven.io and ru-avm-1-mnt remain the two shortest paths to an operator, and neither was walked.

### ⚠ BOTH WALKED — 2026-07-30. Neither leads to an operator, for different reasons. ru-avm-1-mnt resolves to a sponsoring RIPE LIR (ORG-PMAV1-RIPE, org-type: LIR, reg-nr: "Not Applicable"), which holds allocations in both 87.251.x and 80.66.x. It links two beacons as customers of one registry, not as machines under one hand — withdrawing Letter C's operator link and leaving the series with zero demonstrated hard operator links. vmheaven.io advertises offshore DMCA-ignored hosting, no KYC, cryptocurrency payment, Tor hosting, rDNS on request, and — verbatim — "ZMap & Port Scanning Allowed." Domain behind NameCheap, an Icelandic privacy proxy and Cloudflare. **This closes the question rather than extending it:** the fleet hosts there because scanning is explicitly permitted, and the operator cannot be identified because a no-KYC crypto signup means **no customer record was ever created**. There is nothing behind the reseller layer to pierce. The item above is therefore answered in a stronger form than it was asked. *Who operates the fleet* is unanswerable by design, not by omission — and the design belongs to the provider, not the operator. Full resolution: TI-2026-103P — The Sponsor.

10. The last thing

[DOCUMENTED] This series began because a burst looked personal. It ends having established that it was not, that no burst in the record could have been ordered, and that the machines producing it have never read a word the operator published.

[DOCUMENTED] Along the way it corrected itself nine times — a capability collapse that was a concentration, a fingerprint that existed, a client that was Go, a wordlist ordering that was an API artefact, a knowledge claim that was a common password, a pacing figure from too small a sample, a disjointness that held only at the extremes, a burst ratio inflated by degraded coverage, and a suspicion about an endpoint that was a suspicion about the analyst.

[INFERRED — confidence HIGH] That count is the letter's real finding. Nine corrections in fifteen letters, in a corpus of 170,038 sessions, every one caught by checking one instrument against another rather than by trusting either. The detection failures catalogued in §2 are the same failures, committed by software that has no second instrument to check against and no capacity to notice.

A detection pipeline cannot cross-check itself. That is what the analyst is for — and the measure of the analysis is not how few errors it made but how many it caught before publishing.

The Loud Hour is complete. Fifteen letters: O, A–N.