⏱️ Fingerprint One — Coordination in Time

A human visits a website whenever they happen to think of it. A fleet visits when its controller tells it to — and that produces a burst: a spike of requests from one network, sharing one intent, packed into a narrow window.

The 23 temporal-burst campaigns we recorded do not scatter randomly. They split with almost suspicious tidiness by provider and purpose:

Day after day, Google's slice of the fleet goes looking for secrets and API surface; Azure's slice goes looking for places to drop and find webshells. The cadence is too regular, and the intent too cleanly separated, to be the sum of independent decisions.

🕳️ Fingerprint Two — Coordination in Identity

Every legitimate web client announces itself. Your browser sends a long, specific User-Agent. Googlebot says it is Googlebot. Even most clumsy scanners send something. So when a large group of IPs sends nothing at all — an empty user-agent — that silence is not anonymity. It is a uniform.

The Azure empty-UA botnet is the clearest example in the census:

Nearly 39,000 requests, all from Microsoft AS8075, all wearing the same non-disguise. The empty header does not make a single node harder to attribute — it makes the whole fleet trivial to group. They might as well have signed their work.

🧰 Fingerprint Three — Coordination in Toolkit

The first two fingerprints prove a fleet exists. The third proves who is holding the leash — because nothing ties scattered IPs together as tightly as the discovery that they are all reading from the same page.

A "shared-exploit cluster" is a group of IPs that request the same unusual set of paths. One server getting asked for /.env.docker is background noise. Seven servers on two different clouds getting asked for the identical 170-path list, in the same window, is a fingerprint with almost no innocent explanation.

🧠 Reading Between the Lines

The raw counts are the proof. The interpretation is the point. Four things the census quietly tells us:

1. Multi-cloud is a resilience strategy, not an accident

When one operator's dictionary shows up on Amazon and Google at once, the motive is obvious in hindsight: if either provider bans the nodes, the fleet keeps running on the other. Spreading across two "reputable" pools also launders the traffic — defenders who allowlist "trusted cloud" let both halves through. The cloud duopoly's good name is the camouflage.

2. The operators are anchored to nothing — and that is the finding

Run the institutional-anchor pass and the hosts resolve cleanly to listed corporations (Microsoft, Alphabet, Amazon, Macquarie-owned M247). The operators resolve to nothing — no registrant, no named group, only shared dictionaries and rented compute. In this corpus, the absence of an anchor is itself diagnostic: it marks a commodity criminal market, not a state actor with a flag to defend.

3. Recon and exploitation may be different shifts of the same job

The clean Google-harvests / Azure-uploads split, repeated daily, reads like a pipeline: one stage finds the secrets, a later stage plants the shells. Whether that is one crew with two tools or two crews trading access downstream, the staging is real — and it is exactly the two-phase kill chain documented across 047A and 047B.

4. Volume has replaced stealth as the business model

Empty user-agents, recycled filenames, 170-path brute dictionaries fired at 36,000 requests an hour — none of this is subtle. It does not need to be. When compute is near-free via trials and stolen cards, the rational strategy is to ask everyone for everything and harvest the fraction that answers. Quiet tradecraft is for targets; this is dragnet economics.