The Watchman's Own Gate: Namespace Recon from the Network That Runs Poland's CERT

TI-2026-084B · Borrowed Trust, Part B Confidence: HIGH — the institutional anchor and the reconnaissance behaviour are documented from RDAP/Cymru, AbuseIPDB/OTX and web-threats telemetry; the specific downstream host is characterised, not named. Classification: TLP:WHITE

When the good name is the best name of all

Part A opened the Borrowed Trust series with a compromised device behind the University of Chile's open engineering gateway — an intruder inheriting a university's real respectability instead of manufacturing a fake one. That was borrowed trust in its ordinary form: a teaching institution's good name, borrowed.

This part finds the same failure mode, but escalated to the one address in the dataset where it becomes genuinely ironic. The recon traffic here egresses AS8308 — NASK-COMMERCIAL, the commercial network of NASK, the Naukowa i Akademicka Sieć Komputerowa – Państwowy Instytut Badawczy: the Polish state research institute that operates CERT Polska, the country's national computer-emergency response team, and administers the .pl domain registry.

The abuse is egressing the network of the organisation you are supposed to report abuse to.

The subject

One IP: 195.164.49.144.

Nothing about the reputation is ambiguous. This is a serially-reported hostile host — 175 abuse reports, eight independent honeypot/threat feeds — sitting on one of the most institutionally-anchored networks in Europe. The interesting part is not whether it is hostile. It is whose name it is hostile under.

What it actually did: it mapped, it did not strike

On our own web infrastructure the node's behaviour is precise and legible. Between 2026-06-23 and 2026-07-04 it made 27 requests at a steady cadence, and the web-threats pipeline classified its intent as vhost_enum — virtual-host enumeration. It was guessing subdomains:

registry.shuffle-on.com        lsn-qdrant.shuffle-on.com
lsn-vault.shuffle-on.com       lsn-storage.shuffle-on.com
lsn-wireguard.shuffle-on.com   lsn-trivy.shuffle-on.com
lsn-registry.shuffle-on.com    peertube.shuffle-on.com
lsn-ai-comfyui.shuffle-on.com  web-offline.shuffle-on.com

nonexistent_hosts = 7, internal_hosts = 0, target_host_type = exposed_public. Seven of the names it tried do not exist. That is the signature of reconnaissance, not exploitation: it fired no /wp-admin, no /.env, no shellshock string. It was building an inventory — which services does this target run? — by probing for a container registry, a secrets vault, a vector database, a VPN endpoint, an object store, a vulnerability scanner. The names it guessed are the names of the interesting doors.

Mapping is the phase that precedes the strike. A namespace inventory is the thing you hand to a follow-on tool, or a human, once you know what exists. Quiet, patient recon from a trusted IP is more dangerous than loud exploitation from a burned one, precisely because it is the kind of traffic a reputation filter waves through.

The deception layer

The node presented rotating consumer mobile browser user-agents:

Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) …
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 …

A subdomain-enumeration bot on a commercial datacenter IP has no reason to be an iPhone. The rotating mobile UAs are a low-grade blend-in: dress automated recon as organic mobile browsing so a casual log review sees "someone on their phone," not "a scanner." It is the same instinct as the borrowed institutional name, one layer down — make the hostile thing look ordinary.

The institutional anchor: this is the watchman

Run the mandatory anchor pass and the result is the opposite of the usual offshore shell. NASK is not a bulletproof host with a dead abuse desk. It is:

• a Polish state research institute (Państwowy Instytut Badawczy) supervised by the Ministry of Digital Affairs;
• the operator of CERT Polska — the first Polish CERT, established 1996, and a national CSIRT within Poland's statutory national cybersecurity system;
• the registry operator for the .pl top-level domain;
• the RDAP abuse contact abuse@nask.pl, i.e. a desk staffed by, effectively, the national cyber-defence body.

You could not construct a more strongly-anchored network operator if you tried. And that is the whole point. Every reputation heuristic a defender might use — "academic space is probably fine," "research networks aren't threats," "a CERT operator's own AS is trustworthy" — points the wrong way here. The one affiliation that ought to invite the most scrutiny (why is a recon node on the CERT's network?) is the one most likely to earn the node a pass.

So is NASK attacking us? No — and the ASN name says why

The honest answer is the same as in Part A: the institution is the victim, not the culprit. Two facts settle it.

First, AS8308 is explicitly NASK-COMMERCIAL — NASK's commercial ISP arm, distinct from its pure research/academic backbone, selling connectivity to Polish businesses and institutions (PeeringDB lists it as an NSP with ~350 IPv4 and ~150 IPv6 prefixes and an open peering policy). A commercial ISP's address space is full of customers. The abuse-100 recon almost certainly comes from a compromised or abused customer host — a hosted server, a rented box — not from NASK's own machines.

Second, this is structurally identical to Part A's NAT gateway: the observer sees only the trusted institutional attribution, while the actual hostile device is one machine among many sharing that trusted egress. In Chile it was one host behind a university NAT; here it is one host among a state institute's ISP customers. Either way, the institution's single trusted identity absorbs 100% of the reputational signal for whatever one machine behind it is doing.

The provenance is genuinely NASK. That is exactly what makes it dangerous — and exactly why it is not an accusation.

Steelman: maybe it really is just noisy academic scanning

The counter-narrative deserves its hearing. Research and academic networks do run scanners — measurement projects, security research, student experiments — and some of that legitimately reaches honeypots. Part of the Glass Houses corpus (TI-2026-042Q) is exactly this: universities that scan. Could 195.164.49.144 be benign research traffic mislabelled?

The evidence says no. Benign measurement scanning does not (1) carry AbuseIPDB 100 with 175 reports across unrelated victims, (2) surface in eight independent honeypot/threat feeds, and (3) spoof rotating consumer mobile user-agents to disguise itself. Legitimate research announces itself; it publishes a PTR, an abuse-contact opt-out, a project URL. This node hides behind fake iPhones. The counter-narrative preserves one true residue — NASK's network genuinely does carry legitimate academic traffic — but this host, on this evidence, is a compromised recon node, not a research probe.

The good news the series keeps earning

Every Borrowed Trust case has a remediation story the costume-host series (082) never did, and this one has the strongest of all. The abuse contact is abuse@nask.pl — the same institution that runs CERT Polska. If any operator on earth is equipped to locate and clean a compromised downstream host, it is the one that runs the national CERT. The finding is not an indictment of NASK; it is a report handed to the party best able to act on it. A trustworthy source is not a trustworthy packet — but a trustworthy source is exactly who you want reading the report.

Findings

1. A trusted state-institute IP is weaponized for namespace reconnaissance. (HIGH) — abuse-100 vhost-enumeration from a compromised host on NASK-COMMERCIAL (AS8308).
2. Vhost enumeration is reconnaissance, not exploitation — it maps before it strikes. (HIGH) — 7 guessed subdomains (registry/vault/qdrant/wireguard/storage), spoofed mobile UAs.
3. [INST] Borrowed trust at its most ironic: abuse from the CERT operator's own network. (MEDIUM) — the reputation heuristic is not merely unhelpful, it is inverted.
4. Remediable at the strongest possible contact. (HIGH) — abuse@nask.pl is the national CERT.

Cross-references

• TI-2026-084A — Borrowed Trust — the series opener; a university NAT gateway, same pattern, different vector.
• TI-2026-082A — The Tripwire Ledger — the inverse: attackers manufacturing false respectability over rented space.
• TI-2026-042Q — The Quiet Scanners — the broader phenomenon of academic/research networks in honeypot data.

When the attacker has a good name, check whether the name is really the one attacking — or just the gate it came through. Here the gate belongs to the watchman. The packet is still hostile.