🌊 Part II — The Burst Wave

June 30, 2026. Tuesday. 02:00 UTC. Something wakes up.

Eight IPs. Two thousand three hundred thirty-nine connections. That is roughly one connection every 4.6 seconds per node, sustained for three hours. This is not organic scanning drift — someone pressed a button.

The burst starts at 02:00 UTC (10:00 CST), peaks at 03:00 (11:00 CST), and decays by 04:00 (noon CST). If you were sitting in a Chinese timezone office, you arrived at work, started the scan, let it run through the morning, and it wound down by lunch.

Monday deployed 136 different IPs and got roughly the same number of successes as Tuesday's burst (178 vs 175) — but with 5× fewer connections and 49% more commands per session. Monday was reconnaissance. Tuesday was the follow-up bombardment.

📅 Part III — The Weekend Silence

Saturday: 39 sessions. Friday: 17. Compare to Monday: 516. The weekend-to-weekday ratio:

A fully autonomous botnet — nodes scanning independently without coordination — would show no weekend differential. Compromised machines don't take Saturdays off. Cron jobs don't observe public holidays. The 91.6% weekday bias means one of two things:

• Human-initiated waves. The operator manually triggers scanning bursts during work hours. On weekends, nobody triggers them. The baseline trickle (17-39 sessions/day) is the autonomous component; the spikes are human-directed.
• C2 scheduling. The C2 server distributes scanning tasks on a schedule that reflects business hours. The nodes are autonomous executors, but the task queue is filled by a human on weekdays.

Either way: there is a human in the loop. The swarm has operators, not just infrastructure.

🗺️ Part IV — The Netherlands Migration

While the clock reveals when the operator works, the geographic shift reveals where they are moving infrastructure:

The Netherlands went from one of many sources to the dominant one. Meanwhile, US, China, Poland, Belgium, Malaysia, Vietnam, UK, Japan, and Thailand all declined. The swarm is consolidating through Dutch hosting — likely AMS-IX-connected data centers that offer excellent European peering at competitive prices.

This is not a timezone shift. The operator isn't moving to Amsterdam. They are moving their infrastructure to Amsterdam while operating from the same timezone they always have.

⏱️ Part V — The Deployment Calendar

The campaign first-seen timestamps reveal the operator's deployment strategy:

This timeline tells a story: the operator pre-built two versions, launched them simultaneously, monitored for 23 days, then deployed the third. All three stopped together. This is release management — the same discipline a software team applies to production deployments, applied to a botnet.

🔗 Related & Coming Next

Sources: Cowrie honeypot · honeypot_heatmap · honeypot_timeline_intelligence · honeypot_sessions_intelligence · campaign dossiers
Investigation: TI-2026-049E · 8 evidence · 2 actors · 5 findings · 4 connections · 3 infrastructure
Confidence: MEDIUM-HIGH — single honeypot temporal data + cross-validated with geographic/version evidence from 049C/049D
Classification: TLP:WHITE