Letter C of The Web Siege — a forensic series documenting multi-vector attacks at our Traefik ingress during June 2026.

In Letter A, we documented Google Cloud’s .env credential harvesters. In Letter B, Microsoft Azure’s ghost WordPress shell checkers. Both were clearly criminal operations.

This letter asks a harder question: Where does “legitimate scanning” end and “criminal reconnaissance” begin? The answer, it turns out, is nowhere. There is no line. There is only a spectrum — and the spectrum is measured in one number: the 404 error rate.

Data: 4,459 unique IPs, 87,883 requests, 7-day observation window. Cross-referenced with SSH honeypot (1,751 multi-vector overlap), CrowdSec intelligence, and OSINT vector library (15,392 entity crosslinks).

The cybersecurity industry has constructed a careful taxonomy. “Attack Surface Management” is a legitimate product category. Multi-billion-dollar companies sell it:

• Palo Alto (Cortex Xpanse) — continuous internet-wide scanning
• Censys — $75M funding, scans entire IPv4 every 24 hours
• Shodan — the “search engine for the internet of things”
• SEMrush — $2.7 billion market cap, systematic web enumeration

And somewhere in the same IP address space, criminal operators run the exact same tools against the exact same targets to build the exact same maps.

💡 The uncomfortable question: If you cannot distinguish the traffic of a $50 million “attack surface management” platform from a $500 criminal reconnaissance script at the packet level — what exactly is the customer paying for?

We observed the answer at our ingress point. They are paying for the branding.

Line them up by error rate. The pattern is unmistakable:

The gradient tells everything. Legitimate crawlers generate 0% errors because they only access published content. As you move up the spectrum toward criminal behavior, the error rate increases because the actor is probing for content that might exist but doesn’t — credential files, admin panels, upload forms, backup databases.

🤔 SEMrush occupies the gray zone. It generates errors probing for paths common on typical websites — sitemap variants, CMS paths, API endpoints. Not credentials specifically. But still: content that doesn’t exist on the target. The behavior is reconnaissance. The product pitch is “competitive intelligence.” The 10-K filing is the only difference.

“Commercial surveillance tools (phonesnoops, edgetrack, monitordog) operate from the same infrastructure as SSH scanning. No technical distinction between lawful intercept and criminal surveillance. Same tools, same techniques, different branding. The surveillance market and the criminal market are one market.”

This was documented at the SSH layer. We now independently confirm it at HTTP. Commercial reconnaissance platforms and criminal scanning operations use identical techniques, from adjacent or overlapping IP ranges, targeting the same endpoints.

Palo Alto Cortex Xpanse scans your network to show you what’s exposed. A criminal scanner does the same scan to show someone else what’s exposed. The packets on the wire are byte-for-byte identical. The difference is purely: who pays for the report.

The honeypot overlap statistics demolish the “these are just scanners” narrative:

If these were “just crawlers” or “just ASM products,” they would not simultaneously attempt SSH brute-force attacks. The 77% Google Cloud overlap means: for every 4 GCP IPs scanning your web server, 3 are also trying to brute-force your SSH.

Apple’s 37% is instructive: likely false positives from shared cloud ranges, since HTTP behavior is perfectly clean (0% errors). The correlation decreases with legitimacy — yet another confirmation of the error-rate-as-intent thesis.

The UA randomization library tells us when this operation was built:

The tooling is older than most analysts trying to detect it. It hasn’t been updated because it doesn’t need to be. Most WAFs filter by known-bad signatures, not by temporal impossibility. Nobody asks: “Is it physically possible for this device to be making this request?”

Implication: this scanning infrastructure has been continuously operational for 15+ years. Same tools. Same scripts. Same campaign. Running since the Obama administration, migrated through whatever cloud providers offered the cheapest VPS, now on Google Cloud. The operators probably don’t even remember why the library has BeOS in it.

111 IPs requested /robots.txt. What each did with it reveals everything:

💡 Robots.txt is not a security mechanism. It’s an intelligence goldmine for scanners. It tells them which paths exist and which you don’t want indexed — which is often exactly which paths contain sensitive content. Disallow: /admin is a neon sign.

The industry’s insistence on distinguishing “legitimate ASM” from “criminal scanning” serves the ASM vendors’ marketing departments. It does not serve you. If an entity probes for content that doesn’t exist, their corporate valuation is irrelevant to your security posture.

We call it the Reconnaissance Industrial Complex because that’s what it is:

An ecosystem where legitimate companies, state actors, and criminals all perform the same activity (systematic internet scanning) for the same purpose (mapping what’s exposed) using the same tools (HTTP requests to predictable paths) — and the only distinction is the business model attached to the output.

• Censys sells the map to defenders
• Palo Alto sells it to enterprises
• SEMrush sells it to marketers
• Chinese state telecom builds it for national intelligence
• Google Cloud criminals build it for credential theft

Same reconnaissance. Same infrastructure. Same techniques.
Different invoice.

For the defender, there is one useful signal: the error rate. Everything that probes for content that doesn’t exist is performing reconnaissance. Whether that reconnaissance is “legitimate” depends entirely on who’s asking.

What’s not above our pay grade: blocking anything with 30%+ error rate, regardless of User-Agent string, corporate valuation, or published privacy policy.

Series: TI-2026-046 “The Web Siege” · Letter: C · Classification: TLP:WHITE

Data Sources: Traefik access logs (7-day window) · CrowdSec intelligence · SSH honeypot (8,000+ IPs) · Qdrant OSINT library (15,392 crosslinks) · web-threats behavioral database (4,459 IPs)

Investigation: TI-2026-046C · 5 actors · 6 evidence · 6 findings · 4 connections

← 046B: The WordPress Ghosts · 046D: The Multi-Vector Operators →