They Stopped the Moment We Said Their Name
- Patrick Duggan
- 6 minutes ago
- 3 min read
# They Stopped the Moment We Said Their Name
Earlier today we published our investigation into a persistent probe of our STIX/TAXII threat intelligence feed. One IP address. One script. 100,000 requests over 65 days. Every 30 seconds. From an AT&T Wireless mobile device geolocated to Titusville, Florida — twenty miles from Kennedy Space Center.
The collection name hardcoded into the script matched a GitHub username belonging to a developer at one of China's largest technology companies, based in Beijing.
We published the investigation. We updated the endpoint to return a 410 Gone response with a link to the blog post. We waited.
Within minutes, the polling stopped.
Sixty-five days of persistence. Over 100,000 requests. Not a single interruption despite receiving 403 Forbidden on every attempt since February 7, 2026. And then — silence. The moment the JSON response included the word "reading" and a URL to our investigation, the requests ceased.
As of this writing, the endpoint is quiet for the first time in over two months.
We have questions.
The questions we had before
Why was a mobile device in the Kennedy Space Center defense corridor polling a threat intelligence feed that tracks nation-state IOCs every 30 seconds for 65 days?
Why does the collection name in the polling script match the GitHub username of a Beijing-based developer at a major Chinese technology company?
Why is that developer's active secondary account researching Claude Code and AI agent frameworks during the exact window the polling is occurring?
Why did that secondary account fork a repository containing leaked Claude Code source on March 31, 2026 — during the active polling window?
The new questions
Why did the polling stop within minutes of the endpoint returning a link to our investigation?
If this was a forgotten test script, who read the 410 response, parsed the JSON, found the URL, and killed the process — all within minutes?
If this was a misconfigured TAXII client, why did 65 days of 403 responses not trigger the same shutdown that one 410 with a blog post link triggered instantly?
If this was innocent, why did naming the GitHub account in a public investigation cause an immediate operational response?
What does it mean that 100,000 failed requests over two months produced no behavior change, but one response containing the word "reading" and a URL produced an immediate stop?
Who is monitoring the output of this script closely enough to react in minutes, but was not monitoring it closely enough to notice two months of 403 failures?
What we know
No data was exfiltrated. Our authentication held on every one of the 100,000+ requests.
The investigation is documented. The evidence is timestamped. The GitHub accounts are public. The geographic correlation between the source IP and the Kennedy Space Center counterintelligence corridor is a matter of public record, documented by the FBI, DCSA, and Vanity Fair.
The polling stopped the moment we said their name.
We have forwarded the complete evidence package to the appropriate authorities.
What we are
We are a two-person threat intelligence company in Minneapolis. We run on $600 per month of Azure compute. We publish a free STIX feed consumed by 275+ organizations in 46 countries. We index 1.07 million indicators of compromise across 44 indexes.
We built the thing that sees. Sometimes what it sees is interesting.
Today was interesting.
There is an episode of It's Always Sunny in Philadelphia where Charlie Kelly discovers a vast conspiracy in the mailroom. He connects names on envelopes, draws red string between pushpins, and concludes that a shadowy figure named Pepe Silvia is orchestrating everything. The joke is that Pepe Silvia does not exist. The letters say "Philadelphia." Charlie cannot read.
We thought about that scene when we started this investigation. One GitHub username matching a TAXII collection name. A copy-paste error in a Jekyll config file. An IP geolocated to a place Vanity Fair just profiled as a spy corridor. Red string and pushpins. Maybe we were Charlie.
Then we put a link to our investigation in the 410 response and 65 days of continuous polling stopped in minutes.
Charlie's mail kept coming. Ours didn't.
— Patrick
Read the original investigation: dugganusa.com/post/one-ip-one-script-100-000-requests-who-is-polling-our-stix-feed-from-the-space-coast
Search our feed: analytics.dugganusa.com/api/v1/search?q=AS7018
Register for a free API key: analytics.dugganusa.com/stix/register
Her name was Renee Nicole Good.
His name was Alex Jeffery Pretti.