Every number below is from the sealed receipt of customer test INC-20260915-105304-523b — a synthetic intruder planted on a clean machine. Nothing here is staged data.
Unsigned. Never fingerprinted on this box. No history. (The address is a documentation-range TEST-NET address — the test can never touch a real host.)
The fuzzy unit weighs risk, persistence and port rarity; five trained neural nets vote; a fuzzy governor fuses the verdict.
0.8625 crosses the governed 0.85 alarm band.
INC-20260915-105304-523b · severity alarm
Who — upd4te.exe (identity unknown, fingerprint drift)
Where — 198.51.100.23:4444, country XX, first contact
Why — unknown unsigned process reaching a foreign host on a rare port
Chain-sealed and signed at the moment it happened:
Evidence bundle 75,456 bytes — incident dossier, CSVs, receipts, manifest and public key. Verification needs no account, no trust, no us.
checks passed — and the negative control held too:
a clean box produced silence. No crying wolf.