§1From the Individual to the Population

Letter A read one session; C named one actor; D watched one host's task drift. Pull back to the whole window and a different object appears — not an attacker but an ecosystem: thousands of actors, a background hum and sudden storms, an origin that wanders and a toolkit that versions. The unit of analysis is now the climate, and only a long, unbroken memory can hold it.

§2The Sample

Ninety days, 31 March to 29 June 2026. 126,715 credential attempts across 30,700 unique combinations, 15.5% succeeding, from roughly three thousand distinct addresses — classed scanner (3,322), botnet (1,343) and pentest-tool (220). One door on the internet, watched without interruption for a quarter.

§3Why One Door Is Enough

A single honeypot seems a narrow lens, but the attack economy is global and commoditised — the same botnets, kits and credential lists sweep every reachable address. So one well-instrumented door is a core sample: a thin vertical cut that, because the medium is uniform, represents the whole stratum. What hits us hits everyone; we simply kept the record.

§4The Map of the Finale

II reads the baseline and the storms. III tracks the migrating origin. IV measures the toolkit's drift. V notes that the observer evolved too. VI sets the local sample against the documented macro climate. VII reads it through the lenses of meteorology, economics and forecasting. VIII closes the whole series — three timescales, one memory.

§5Daily Volume, 90 Days

Here is the whole quarter at a glance — daily login attempts, 31 March to 29 June. Red bars are the three surge storms:

The shape tells a story in three acts: a long ramp through April and May to a peak around 19–21 May (4,500–4,800/day), a violent spike on 23 May, then a collapse to a low June baseline broken only by the 22 June storm. Attack volume is not constant; it has a season.

§6The Calm: a Flat, Global Hum

Beneath the events sits a baseline near 15 sessions an hour, and tellingly it is nearly flat across the 24-hour clock — 4,300 to 7,000 attempts in every hour-of-day. There is no night. A human crime sleeps; this one does not, because it is automated and spread across every timezone at once. The calm itself is a finding: the internet is under continuous, circadian-free background fire.

§7The First Storm — 21 May

The detector flags a sustained wave from 21 May: 3,706 sessions over ~37 hours at an average of 100/hr — roughly 7× baseline, sustained for a day and a half. A single large botnet campaign arriving, saturating the door, and moving on.

§8The Second Storm — 23 May

Two days later, the most violent hour of the quarter: 1,299 then 1,476 sessions in two consecutive hours on the evening of 23 May, the day total reaching 4,307 attempts with 2,923 successes. A credential flood that not only knocked but largely got in — a botnet spraying a known-good list at scale.

§9The Third Storm — 22 June

After the June lull, one more: 1,528 then 1,336 sessions on the evening of 22 June, that day logging 2,935 attempts and 2,926 successes — a near-100% hit rate. This is the signature of a tightly-tuned admin/admin-class sweep against a population it already knew would answer.

§10Anatomy of a Storm

Every storm has the same shape — a sharp onset, a saturated peak, a decay — differing only in scale and success rate. Low-success storms are blind spraying; the near-100% June storm is a curated list hitting known-vulnerable hosts. The success rate of a wave is a read on how much homework the operator did beforehand.

§11The June Collapse

Daily volume falls sharply at the end of May and stays low through June. Several readings are possible — a large early-window campaign ending, a sensor/collection change, or a genuine lull — and honesty requires holding them open. But the contrast is itself informative: the climate has quiet seasons as well as storms, and the quiet is when the persistent, frozen actors (Letter A) stand out most clearly against the reduced noise.

§12Reading the Hyetograph

Meteorologists call a rainfall-over-time chart a hyetograph. The daily-volume chart is the attack hyetograph: baseline drizzle, three cloudbursts, a dry June. Once you accept that attack traffic has a hyetograph, the whole apparatus of climatology — baselines, anomalies, return periods — becomes available to defence.

§13Where Attacks Come From Is Not Fixed

Compare the source geography of the early window against the later one and the population has visibly relocated. This is not a single actor moving — it is the centre of gravity of the whole attacking crowd shifting across the quarter:

§14The Fall of Poland and Sweden

The early window was dominated by Poland and Sweden — the geo-footprint of the bulletproof hosts that recur throughout this corpus (w1n ltd's Swedish space, ISAEV's Polish-geolocated range). Their two-thirds early share collapsing to a fifth suggests those specific relay pools cooled — burned, rotated, or simply out-competed — over the quarter.

§15The Rise of Switzerland, the US, and Asia

What replaced them is telling: Switzerland and the US — reputable, hard-to-block geographies — rose sharply, and a spread of Asian broadband (Indonesia, Hong Kong, Korea, Singapore) climbed from nothing. The population migrated toward more reputable and more residential relays, exactly the disposable-mask economy of Letters C and 047.

§16What Migrates Is the Mask, Not the Hand

[INFERRED] Crucially, a shift in source geography need not mean new operators — it means the operators changed proxies. The behavioural fingerprints (Letter C) likely persist beneath the moving flags. The migration is in the residential-proxy and bulletproof market, not necessarily in the hands holding the keyboards. Geography is the most fluid layer of all.

§17The Front Metaphor

In meteorology a front is the moving boundary between air masses. The geo-shift is an attack front: the boundary between the receding PL/SE air mass and the advancing CH/US/Asia one, crossing the honeypot over ninety days. Track enough fronts and their motion becomes predictable — the basis of a forecast.

§18Why Country-Blocking Loses

The practical lesson: any defence keyed to source country is chasing a front that has already moved. By the time "block Poland" is policy, the population is in Switzerland and Indonesia. The migration rate outpaces the blocklist — which is why, again, behaviour (Letter C) and current-state (Letter D) beat geography every time.

§19Versions Move Within the Window

Even at 90 days the attacker's software is a moving target. The scanner population's SSH clients span and drift across versions: libssh2 1.11.0 (a 628-node campaign with onset ~2 May) alongside 1.11.1; libssh 0.9.6, 0.11.x and 0.12.0 all present; Go-based clients rising. The adversary's toolchain has a release cadence you can watch tick over.

§20Version-Drift Is Supply-Chain Intelligence

Tracking which client versions rise and fall is, in effect, intelligence on the attacker's own supply chain — which kits are being maintained, which are being abandoned, when an operator upgraded. A HASSH that shifts from 1.11.0 to 1.11.1 across an actor's history (the identity layer of Letter C) dates their patch cycle as precisely as a changelog.

§21New Species Arrive — elf.aisuru

The malware menagerie also turned over. The staples persist — elf.redtail (10 IPs), elf.xmrig (5), elf.mirai (2), elf.xorddos, win.havoc — but a newer Mirai-lineage variant, elf.aisuru, appears in the window: a fresh species entering the ecosystem. New families arriving is the clearest mark of an evolving climate.

§22New Credentials, New Canaries

The credential dictionaries mutate too. Mid-window (15–17 May) a new canary surfaces — root/warnightkardesim (a Turkish "warnight brother" string tied to the Warnight botnet) — sprayed by 76 IPs in a tight window and then fading. Credential lists are versioned artifacts; a new string blooming and dying dates a campaign as sharply as a postmark.

§23Drift Is Slow Where It Works, Fast Where It Doesn't

Tying back to Letter D: the frozen nine-command kit did not drift at all in 90 days (it works), while the toolchain at large versioned repeatedly (under selection pressure). The rate of drift is itself a signal — stagnant where an operator is satisfied, rapid where they are still hunting for what pays.

§24The Climate Has a Genome

Put together — versioned clients, arriving malware species, blooming credential strings — the population has a genome that visibly evolves over a single quarter. The honeypot is not photographing a fixed enemy; it is filming a living, mutating ecosystem.

§25A New Instrument Mid-Window

The record-keeper changed while keeping the record. During this same quarter the program brought a third sensor online — the web-threats surface (Traefik / Authelia / CrowdSec), which produced the entire TI-2026-046 and 047 series. The climatology gained a new instrument mid-season.

§26The Record Deepened as It Grew

Enrichment deepened in parallel: 5,644 IPs deep-enriched across 12 sources, the Qdrant crosslink graph growing to its 15,587 edges. Each new source retroactively sharpens older observations through the graph — the past gets clearer as the present is recorded.

§27The Observer Effect, Inverted

In physics observation disturbs the system; here observation compounds. A longitudinal record is the rare instrument that improves its own past: the web-threats sensor let us re-read the SSH actors as cross-surface operators (047), and the crosslink graph let 90 days of separate sessions resolve into named climates. The memory is not passive storage — it is an instrument that keeps getting better at seeing what it already saw.

§28The Local Sample Matches the Global Report

Hold the 90-day core sample against the published macro climate and they describe one system. CrowdStrike's 2024 Global Threat Report names eCrime the landscape cornerstone, Big-Game-Hunting (SCATTERED SPIDER, GRACEFUL SPIDER) the dominant force, with a 76% growth in data-leak-site posts and a turn to cloud-conscious operations. Our relentless credential floor and surge storms are the commodity basement of that same skyscraper.

§29The Loss Curve Underneath the Volume

The economics that drive the hum are quantified upstream: the FBI's IC3 logged 791,790 complaints in a year (+69% YoY) with self-reported losses above $4.1B; FinCEN's ransomware SAR analysis and the IC3 2023 report track the curve climbing. Every baseline login attempt is a micro-transaction in that multi-billion-dollar market — the intake funnel feeding the loss curve.

§30The Climate Is Coupled to Geopolitics

Storms have causes off the wire. The academic study Getting Bored of Cyberwar (WWW '24) shows low-level cybercrime and DDoS waves rising and ebbing around the Russia–Ukraine conflict. A surge in the hyetograph may be downstream of a takedown, a conflict flare, a holiday, or a new exploit drop — the attack climate has the same external forcings as the real one.

§31Commoditisation Is the Through-Line

What links every macro source is commoditisation: ransomware-as-a-service, access-as-a-service, proxy-as-a-service. The honeypot sees its floor — rented bots running rented kits against rented IPs. The 90-day climate is the weather produced by a fully industrialised criminal economy, and it is global precisely because the tools are products.

§32The Core-Sample Principle

This is why one door generalises. A geologist reads a continent from a core; an epidemiologist reads a population from a cohort. Because the attack medium is uniform and global, a single continuously-observed honeypot is a valid probe of the whole — its baseline, storms and migration are the planet's, sampled at one coordinate.

§33Meteorology — Baseline, Anomaly, Return Period

Borrow the climatologist's toolkit wholesale. The ~15/hr baseline is the normal; the storms are anomalies measured in standard deviations above it (the detector's avg of 14.96 makes a 1,476/hr hour a ~99-sigma event); and counting storms over time yields a return period — how often to expect a surge of a given size. Attack traffic is now a quantity with a climatology, not a vibe.

§34Seasonality — The Search for Cycles

Ninety days is too short to prove annual seasonality, but it already hints at rhythm: weekly cadence in the campaign bursts (Letter 047C's daily Google/Azure waves), the end-of-May peak, the June lull. With years of this record, true seasons would emerge — patch-Tuesday echoes, holiday lulls, quarter-end fraud pushes. The instrument is now in place to find them.

§35Economics — Surges Are Capital Events

A storm costs money to mount (rented infrastructure, a credential list, an operator's time), so a surge is a capital deployment — someone judged the return worth the spend that week. The near-100%-success June storm was efficient capital (a curated list); the blind May spray was speculative. Reading storms as investments reveals when and where operators believed the market was hot.

§36The Circadian Absence — A Machine World

The flat 24-hour profile is its own profound finding: this is a world with no day and no night because no human is in the loop at the volume layer. The baseline is machines talking to machines around the clock. The only circadian signal left is in the rare hands-on sessions (Letter D's "frustration") — the faint human pulse inside an automated ocean.

§37Ecology — Niches, Invasions, Extinctions

The population behaves like an ecosystem: incumbent species (libssh2 scanners, redtail miners) hold niches; an invasive arrives (elf.aisuru); a relay habitat cools and its dependent population declines (the PL/SE fall). Watching which species expand into which niches over seasons is attack ecology — and it predicts which threats will dominate next.

§38Forecasting — The Point of It All

Every lens converges on one prize: prediction. A system with a measured baseline, catalogued storm shapes, a tracked front and a tool-release cadence is, in principle, forecastable — the next surge window, the next favoured geography, the next client version. The honeypot has spent 90 days building the climatology. Climatology is the thing you need before you can ever issue a forecast.

§39Three Clocks, One Memory

The series resolves into three nested timescales, each read by the same instrument:

The same honeypot, the same graph, reads all three at once — the individual who never changes, the asset whose purpose rotates, and the ecosystem that turns over. The right answer to "is the attacker changing?" is: at which clock?

§40Why It Is Called The Long Memory

Every finding in this series required remembering. Letter A's frozen kit is only frozen because we held two sessions 23 days apart. C's 49 masks resolve only against months of accumulated fingerprints. D's drift is visible only across a host's whole history. E's climate exists only because 90 days were kept unbroken. Take away the memory and each becomes an isolated, meaningless log line. The platform's one irreplaceable asset is that it does not forget.

§41What the Machinery Bought

The week spent building Qdrant vectors, twelve enrichment sources and a 15,587-edge crosslink graph bought exactly this: the ability to hold the actor, the host and the climate in one queryable memory and to ask which is changing and which is not. A human analyst can read one session brilliantly; only the machine can read ninety days of three thousand actors and tell you the front is moving. That is the difference between logging and intelligence.

§42From Recording to Forecasting

And it points forward. A climatology is the prerequisite for a forecast. With the baseline measured, the storm shapes catalogued, the front tracked and the tool cadence known, the next horizon is prediction — anticipating the surge, the geography, the version, the family. [INFERRED] the honeypot has spent a season becoming a barometer; the work ahead is to make it a forecast.

§43The Series, in One Line

A — read one session. B — see what it was really hunting. C — name the actor by what it cannot change. D — watch what it changes. E — measure the climate it lives in. Five letters, one thesis: on the internet, identity is behaviour, behaviour leaves a record, and a long enough memory turns that record into foresight.

§44Coda — The Long Memory

The attackers came dressed as nobody, from everywhere, changing their addresses a thousand times and their tools a dozen. They counted on being forgotten between one visit and the next — that is the whole strategy of the crowd. The only thing that defeats it is a memory that does not blink. Ninety days in, the record holds: the frozen kit, the named hand, the drifting task, the moving front. They forgot nothing of how to hide. We forgot nothing of what they did. That asymmetry — their disguise against our memory — is the entire game, and memory wins it by simply refusing to end.