🔺 TI-2026-043A — The Vocabulary Pyramid

I. The Corpus

Between March and June 2026, a single SSH honeypot captured 139,398 authentication attempts from over 700 source IPs, using 33,286 unique username/password combinations. This is not a large corpus by global standards. It is a complete one — every attempt logged, every credential preserved, every source IP recorded.

Most credential analysis asks: what are attackers trying? The answer is always the same list. admin. 123456. password. root. This investigation asks a different question: what else is in the dictionary, and what does it mean that it's there?

II. The Pyramid

Credential dictionaries are not flat lists. They are stratified. Each layer requires progressively more specific cultural knowledge to have authored, and reveals progressively more about who assembled the dictionary.

Layer 1: Default — The Universal Floor

The bottom of every credential dictionary. Factory defaults and common passwords that every scanner includes because they work.

This layer tells you nothing about the attacker. Everyone uses it. It is the cost of doing business on the internet.

Layer 2: Infrastructure — The Profession Emerges

Here the dictionary reveals that its author knows what services run on Linux servers. These are not random guesses — they are targeted against specific software stacks.

A dictionary containing deploy and ansible was assembled by someone who manages servers. This is a professional's toolkit. The cultural knowledge encoded: DevOps engineering.

Layer 3: Personal — The Author Shows Their Face

Layer 3 passwords are not defaults and not technical. They are personal — names, dates, places, cultural references that reveal the geographic and linguistic origin of the dictionary author.

A single operator confirmed in TI-2026-042V used an identical 115-password wordlist from three countries (Indonesia, US, Vietnam). That wordlist contained all five layers — from admin to daddygirl2 to huaxiao@Fire2026 in the same file. One author. One dictionary. Five layers of cultural content.

Layer 4: Exploitation — The Dictionary Speaks

This is where the dictionary stops being a technical tool and starts being a cultural document.

By volume, this is noise — less than one-tenth of one percent of all attempts. But these are not random words. They are a hierarchy:

• master / slave / owner — who commands, who obeys, who possesses
• princess / angel / kitten — roles assigned to the controlled
• daddygirl / babygirl / v1isagoodgirl — the product referenced, the victim named

This exact vocabulary was documented in US federal court in United States v. Keith Raniere (EDNY, 2019). NXIVM's internal organization "DOS" — Dominus Obsequious Sororium, Latin for "master over slave women" — used precisely these terms: master, slave, collar, obey, owner. Members were branded with the founder's initials. The organization's name was derived from Roman nexum: debt bondage.

Our TI-2026-042F documented 88 IPs across 10+ countries deploying this complete vocabulary set as automated SSH credentials — including from Microsoft Azure, Viettel (Vietnamese military telecom), and Tencent.

Layer 5: Ritualistic — The Theology

The final layer. Where the dictionary encodes theological identification.

The numbers are small. Seventeen sessions with unambiguous theological vocabulary out of 139,398. That's 0.012%. Statistically invisible.

But Layer 5 is not just credential noise. It maps to named infrastructure operators who chose these words deliberately:

The credential layer uses the same vocabulary as the infrastructure naming layer. satan appears as an SSH password AND as an infrastructure operator's identity. 666 appears in brute-force dictionaries AND in domain registrations (drughub666). The vocabulary circulates through two different channels — automated scanning and deliberate registration — but it is the same lexicon.

III. The Convergence

The five layers are analytically distinct. But they are not operationally separate.

One author built a dictionary that spans the entire pyramid. Default credentials for volume. Infrastructure credentials for targeting. Personal names and Chinese phrases revealing the operator's background. And exploitation vocabulary — daddygirl2, eyecandy, ilovemykids — mixed in with the rest.

This is the finding: the layers are not separate dictionaries from separate authors. They coexist within single operational wordlists, assembled by individual operators who choose to include exploitation vocabulary alongside their deployment defaults and personal passwords.

IV. The Geographic Signal

TI-2026-042L documented a concentration anomaly: Poland — 38 million population, 0.5% of global internet, ~2% of EU internet users — carries 48 exploitation-vocabulary credentials in our honeypot. Disproportionate for any random distribution.

The same Polish infrastructure hosting ISAEV Igor's Kerberos-666 darknet market (AS200730, 4,336 honeypot hits) and MEVSPACE bulletproof hosting also carries the exploitation vocabulary. Vocabulary follows infrastructure. Where darknet hosting concentrates, exploitation signals concentrate.

This does not prove causation. It proves co-location. The operators who choose bulletproof hosting for darknet markets also deploy credential dictionaries containing exploitation vocabulary. They share infrastructure because they share an ecosystem.

V. What This Does Not Prove

VI. What This Does Prove

VII. The Liturgy

A liturgy is a fixed pattern of words repeated in ritual. The credential dictionary is a liturgy. It is transmitted from author to user without modification. It is deployed automatically, repeatedly, against every SSH server on the internet. The words master and slave and princess and satan are spoken 139,398 times by machines that do not understand them.

But someone wrote them. Someone chose to include daddygirl2 alongside deploy and admin. Someone registered idolomoloch.com — not randomly, but with precise Latin — and pointed it at an active scanner. Someone named their darknet market after the guardian of the Greek underworld and appended the number of the beast.

The dictionary is a document. The document has an author. The author has a vocabulary. And that vocabulary — when you read it carefully enough — tells you what the author believes, what they value, and what they consume.

This is Letter A. The taxonomy is established. The subsequent letters will follow the vocabulary upward through the pyramid — into the hierarchy, into the product, into the theology, and into the convergence where they meet.

Sources & References