The Steady State — Four Shapes

TI-2026-067A · Series: 🔁 The Steady State · TLP:WHITE · 2026-07-09

A 37-day census of the web attack surface. 159,592 requests, 10,300 source IPs, 297 hosts — and only four shapes underneath all of it.

📋 The Short Version

We pointed every instrument we have at the web edge for 37 days (2026-06-03 → 2026-07-09) and asked a simple question: is anything new attacking us?

The answer is no — and that is the finding. The 159,592 requests resolve into 152 detected campaigns, and those 152 campaigns resolve into exactly four detection archetypes. Every one of the four already has its own published dossier. The newest 49 campaigns — arriving after June 25 — introduce zero new archetypes. The web surface has stopped producing new kinds of attack. It only produces new instances.

This is what a saturated threat surface looks like: infinite churn, finite shapes.

Confidence: HIGH on the census (the counts are direct platform measurements). MEDIUM on the strong claim that nothing novel is happening — a clustering detector can only name the shapes it already knows. That caveat is Section 6, and it is itself part of the finding.

1. The Corpus

Ninety-six percent of requests are GET. Almost none of this is a human. It is automation reading a target it never modeled — probing for WordPress on hosts that run none, hunting other hackers' shells that were never planted, sweeping for .env secrets that are not served.

Probe-intent breakdown (2,162 classified IPs): credential_harvest 997 · cms_detect 519 · shell_upload 380 · auth_probe 98 · vhost_enum 44 · api_enum 38 · admin_hunt 37 · scanner_fingerprint 22 · a long tail of webdav_abuse, ssrf_oast, proxy_abuse at 1–5 each.

2. The Four Shapes

Group all 152 campaigns by how the platform detected them, and the entire threat surface fits in one table:

Four shapes. One hundred percent coverage. There is no fifth column — no campaign in the corpus that fails to fall into one of these four buckets.

• temporal_burst — a cluster of IPs from one ASN firing in a tight time window. The synchronized wave.
• shared_exploit_paths — IPs probing an identical path-set: /x.php, /this_is_a_new_hello_world.php, hellopress/wp_filemanager.php. The parasitic hunt for pre-existing backdoors to reuse.
• empty_ua_asn_cluster — a fleet with blank user-agents from one cloud, checking for pre-planted webshells at scale.
• vhost_sweep — enumeration of guessed subdomains, mapping the estate's namespace.

Each was a dossier. Together they are the whole board.

3. Volume, Not Variety

The surface is not quiet. It is busy — and still not new.

Forty-nine campaigns arrived in the last two weeks of the window. Every one is a re-run: another burst, another shell-path cluster, another empty-UA fleet, another vhost sweep. The arrival rate of new campaigns is high; the arrival rate of new campaign types is zero.

That is the precise signature of a steady state. The system is not dead — it is in equilibrium.

4. Reputation Is Structurally Dead Here

Where do the attackers live? Overwhelmingly, in the clouds everyone trusts.

1,225 of the 2,162 classified attackers — 57% — ride hyperscaler clouds. They share address space with half the legitimate internet. No blocklist can pre-empt them without collateral damage to the services businesses depend on. This confirms, on fresh July data, the core finding of TI-2026-066A ("Trusted by Default"): IP reputation is not merely weak on this surface — it is structurally unable to separate signal from noise.

5. Behavior Is the Only Signal That Survives

If reputation can't see them, what can? What they do.

• Mean effective-bad-rate across classified attackers: 0.892.
• IPs at effective-bad-rate ≥ 0.90: 4,790.
• The measurement that makes this legible: 8,448 requests logged HTTP 200 but were really 401 — rejected at Authelia's login SPA, which returns a 200-status page. A naive log reader counts 8,448 successes; effective_status counts 8,448 blocked auth-probes.

effective_bad_rate — computed from path, method, and true outcome rather than source address — cleanly separates attacker from visitor exactly where the hyperscaler wash defeats reputation. This is not a new claim (see the 060 series, "The 200 That Lied"). It is the same claim, holding on new data, which is the point of a census.

6. The Honest Limit — Steelman

The strongest objection to this dossier is that it may be measuring its own detector, not the world.

The four archetypes are the four the platform was built to cluster. A genuinely novel TTP would not necessarily form a fifth cluster — it might hide in the unlabeled residual, invisible to a method that names only known shapes. A census that finds only four shapes because it can only see four shapes proves nothing.

Two independent checks push back:

1. Manual path review of the fresh window (49 campaigns) surfaced only known signatures — the same shell names, .env variants, and WordPress fingerprints already catalogued. No new family of paths appeared.
2. The SSH corpus, an entirely separate instrument, shows the same multi-year stasis: TI-2026-052 documented a worm with seven years of zero evolution. Two independent surfaces reporting stasis is harder to dismiss as one detector's blind spot.

But the objection is not fully defeated, and honesty requires saying so. This census proves saturation of the known shapes at HIGH confidence. It cannot fully exclude an unobserved novel behavior — so the stronger sentence, "nothing new is happening," is held at MEDIUM. The caveat is not a footnote to the finding. It is part of it.

7. What This Means

For this publication. The web-threats corpus has become what TI-2026-047B named it: a confirmation engine, not a discovery engine. Writing another "here is a scanning campaign" dossier would re-report 046B / 059B / 059C / 054 with new IPs in the tables. The honest next move is not another instance — it is to measure the saturation itself (this dossier), then point investigative effort where discovery is still possible: evolution/recount of the clusters that grew, and the under-mined OSINT and entity-graph substrates.

For defense. The census is an argument for a doctrine already in place here and worth restating:

• Stop cataloguing IPs. 57% of them are disposable hyperscaler leases; the address is noise.
• Score behavior at request time. effective_bad_rate on path+method+true-status is the signal that survived every test in this corpus.
• Turn the parasites into sensors. Any 200 to /x.php, wp_filemanager.php, or the bespoke shell names is a compromise alarm — the swarm runs your breach-detection for free (per 059B).
• Report to the clouds. Ephemeral IPs make blocking pointless; provider abuse reports are the only lever that removes the fuel.

Investigation Metadata

Cross-references: TI-2026-047B (The Repeat Offenders — confirmation engine) · TI-2026-059B (The Azure Shell Game — shared_exploit_paths) · TI-2026-046B (The WordPress Ghosts — empty_ua_asn_cluster) · TI-2026-059C (Mapping the Estate — vhost_sweep) · TI-2026-054 / TI-2026-014 (temporal_burst) · TI-2026-066A (Trusted by Default — reputation is dead) · TI-2026-060 series (The 200 That Lied — effective-status) · TI-2026-052 (seven years of zero evolution).