โฐ TI-2026-051H
THE WEDNESDAY PROTOCOL โ Temporal Forensics of a Criminal Schedule
Series: The Credential Harvest โ Extension | Letter H | Confidence: HIGH
The Methodology: Intelligence agencies call it traffic analysis โ extracting meaning from the pattern of communication rather than its content. You don't need to read the message if the timing, frequency, and source-destination pairs tell you everything. The surveillance industry commercialized it: Qosmos sells it, Siemens packages it, governments deploy it against citizens. Today we turn it on the criminal infrastructure that targets us.
I. The Schedule
102 days of continuous honeypot observation reveal a schedule as regular as a train timetable:
78.3% Wednesday. Not 14.3% (uniform). Not even 20% or 30% (skewed). Seventy-eight percent of all credential stuffing sessions fall on a single day of the week. The ratio of best day (Wednesday: 3,553) to worst day (Saturday: 17) is 209 to 1. No automated process produces this distribution. This is a human being who works Wednesdays.
โฌฅ โฌฅ โฌฅ
II. The Daily Timeline โ A Day in the Life of a Criminal Operator
WEDNESDAY โ RECONSTRUCTED OPERATIONAL TIMELINE
00:00 UTC
02:00 CET
โ Low activity (27 sessions/hr). Operator sleeping.
01:00 UTC
03:00 CET
โ Slight uptick (39). Pre-staging?
02:00 UTC
04:00 CET
โโโโโโโโโโโโโโโโโโโโ 1,033 โ WAKE UP. ACTIVATE FLEET.
03:00 UTC
05:00 CET
โโโโโโโโโโโโโโโโโโโโโโ 1,146 โ PEAK. Full fleet operational.
04:00 UTC
06:00 CET
โโโโโโ 336 โ Fleet still running. Operator monitoring or stepped away.
05:00 UTC
07:00 CET
โโโ 153 โ Dawn. Winding down morning session.
06-18 UTC
08-20 CET
โ 30-127/hr โ Daytime. Background hum. Operator doing other things.
19:00 UTC
21:00 CET
โโโโโโโโโโโโโโโ 788 โ EVENING CHECK-IN. Review results. Second burst.
20:00 UTC
22:00 CET
โ 50 โ Wrapping up. Going to bed.
21-23 UTC
23-01 CET
โ 23-36/hr. Sleeping. Fleet idle.
The Portrait: Wake before dawn. Activate the scanning fleet at 04:00 CET. Let it run full-bore for 2 hours. Step away by 06:00 โ maybe go to a day job, maybe handle other business. Background operations continue with minimal supervision. Return at 21:00 CET for an evening session โ review results, harvest validated credentials, adjust target lists. Wind down by 22:00. Sleep. Repeat next Wednesday.
This is someone's side gig. The pre-dawn timing suggests they have another commitment during normal business hours. The evening check-in is like reviewing emails after dinner. The Saturday near-zero (17 sessions) is someone who respects their weekend. This is not a state actor running 24/7 shifts. This is one person with a routine.
โฌฅ โฌฅ โฌฅ
III. The Global Botnet Trigger โ 99 Nodes, One Command
When the operator activates the fleet, 99 devices across 15+ countries come alive within 10-minute windows:
๐ฎ๐ฉ
Indonesia
163.7.9.55๐ธ๐ณ
Senegal
41.208.147.131๐ฒ๐พ
Malaysia
180.74.84.64๐ง๐ท
Brazil
187.34.131.182๐ณ๐ฑ
Netherlands
20.123.146.93๐ง๐ช
Belgium
34.38.102.2๐ป๐ณ
Vietnam
14.248.83.33๐ป๐ณ
Vietnam
103.78.1.33๐ฎ๐น
Italy
151.95.83.235๐ฎ๐ฉ
Indonesia
36.92.140.209๐ง๐ท
Brazil
189.50.142.78๐บ๐ธ
United States
35.188.112.111๐ฐ๐ท
South Korea
211.253.9.49๐ท๐บ
Russia
176.65.136.31๐ณ๐ฌ
Nigeria
41.216.178.119๐ต๐ญ
Philippines
49.231.192.36๐จ๐ด
Colombia
190.242.109.42๐ซ๐ท
France
62.210.209.225
These are not scanning infrastructure. These are compromised devices โ residential routers, small business servers, IoT devices โ previously harvested and now serving as scanning proxies.
Probability of 99 independent actors choosing the same 10-minute window by chance:
โ 10-200
There are approximately 1080 atoms in the observable universe.
This is 10120 times less likely than randomly selecting the same atom twice.
Proof of Centralized C2: 99 devices across every inhabited continent activating within the same 10-minute window is not statistically possible without a centralized command-and-control mechanism. The operator in CET sends one signal. 99 devices respond. Within minutes, our honeypot sees credential attempts from Indonesia, Senegal, Brazil, Vietnam simultaneously. One button press โ global scanning fleet activation.
โฌฅ โฌฅ โฌฅ
IV. Two Command Structures โ One Schedule
A critical finding: there are two independent temporal correlation clusters:
| Cluster | Hub IP | Correlated IPs | Interpretation |
|---|
| ISAEV Cluster | 87.251.64.176 (PL) | 99 IPs | Global botnet + dedicated infrastructure. Largest operation. |
| Private Layer Cluster | 185.246.130.20 (SE) | 14 IPs | Smaller, possibly more curated infrastructure. Different operator. |
Two Operations, One Wednesday: ISAEV and Private Layer show independent temporal correlation clusters. They don't correlate with each other โ but they both peak on Wednesday. Three hypotheses:
(a) Same Boss, Different Departments: One organization runs both, scheduling different teams on the same day for operational efficiency.
(b) Coordination Without Colocation: Two independent operators who have agreed on a schedule, like rival gangs dividing territory but operating on the same market day.
(c) Convergent Optimization: Both independently discovered that Wednesday 02:00-04:00 UTC is optimal โ minimal security team staffing globally, pre-business-hours in most Western time zones, maximum time-to-detection before defenders arrive at work.
โฌฅ โฌฅ โฌฅ
V. The Surveillance Industry Mirror
๐ WikiLeaks Spy Files โ Qosmos: IP Metadata Intelligence
"Rendering conversations is no longer enough: need to also analyze patterns of communication."
Qosmos sold monitoring center technology that extracted intelligence from metadata โ who talks to whom, when, how often โ without ever reading the message content. Their system processed login credentials, session timing, and connection metadata to build intelligence profiles.
We apply the identical methodology. Our "monitoring center" is a honeypot. Our metadata is SSH session timestamps. Our "patterns of communication" are the Wednesday schedule, the pre-dawn activation, the evening check-in. We don't need to decrypt anything โ the pattern is the intelligence.
๐ WikiLeaks Spy Files โ Siemens Intelligence Mining
Siemens demonstrated "pattern recognition" in 21,237,645 call records: search for suspicious patterns using time-frame criteria (1 hour windows) and minimum count thresholds.
We search 13,991 SSH sessions for suspicious patterns using 10-minute windows and minimum count thresholds. Same methodology, different data source. Siemens sold this to intelligence agencies for millions. We built it from honeypot logs for $0.
The Symmetry of Surveillance: The tools designed to surveil citizens can surveil criminals. The methodology is identical. Qosmos analyzed login metadata to identify targets. We analyze login metadata to identify attackers. Siemens searched millions of records for temporal patterns. We search thousands of records for temporal patterns. The moral difference is who points the telescope โ but the optics are the same.
โฌฅ โฌฅ โฌฅ
VI. Why Wednesday? โ The Operational Logic
Wednesday between 02:00-04:00 UTC is not arbitrary. It represents a calculated optimization:
Defensive Coverage Gap: At 02:00 UTC: it's Monday evening in US Pacific (18:00 Mon) โ US SOC teams in transition. It's 04:00 CET โ European defense teams sleeping. It's 10:00 in East Asia โ but it's targeting Western infrastructure. The time is chosen to maximize the window between scan-and-compromise and defender-response.
Wednesday Positioning: Monday = heavy IT maintenance, fresh weekly deployments, heightened alertness. Friday = reduced staffing, weekend mode. Tuesday and Thursday = flanking days with moderate attention. Wednesday is the cognitive trough โ midweek routine, minimal alertness, maximum complacency. Scan results from Wednesday have maximum dwell time before anyone reviews Friday or Monday logs.
The Ramp Pattern: Tuesday = 516 sessions (11.4%). Wednesday = 3,553 (78.3%). Thursday = 288 (6.3%). The TuesdayโWednesday ramp suggests preparation: Tuesday is reconnaissance or testing day. Wednesday is production day. Thursday is clean-up. This is a project schedule, not a scan schedule.
โฌฅ โฌฅ โฌฅ
VII. What 17 Saturday Sessions Tell Us
Saturday's 17 sessions are perhaps the most revealing data point in the entire series.
Seventeen. Not zero. If the operation were purely scheduled, Saturday would show zero. Seventeen sessions means someone checked in. Ran a quick test. Verified infrastructure. Maybe deployed a configuration update. Then stopped.
This is maintenance behavior. Like a shopkeeper who closes on Saturday but walks by the store to make sure the lights are off. It reveals ownership psychology โ the operator cares about the infrastructure. It's not a fire-and-forget botnet. It's a managed asset that receives weekend maintenance checks.
Now consider: this person, with their Wednesday schedule and Saturday maintenance window, controls infrastructure that has attempted 14,662+ credential stuffing attacks against our sensor alone. Extrapolated across the internet, their operation produces thousands of validated access tokens feeding a billion-dollar ransomware pipeline. And on Saturday, they check in for 17 sessions.
The banality is staggering.
โฌฅ โฌฅ โฌฅ
VIII. Implications for Defense
Predictive Capability: If the schedule holds (and 102 days of data suggests it will), we can predict with high confidence: next Wednesday between 02:00-04:00 UTC, the scanning fleet will activate. This is actionable intelligence. Defenders can heighten monitoring specifically during this window. IDS alert thresholds can be lowered on Wednesdays. Honeypot operators can capture maximum detail during the predicted peak.
Attribution Precision: The CET timezone, the Wednesday preference, the pre-dawn pattern โ these narrow the operator's likely location to Central Europe (UTC+1/UTC+2). Combined with the ISAEV infrastructure in Poland, the HASSH fingerprint linking to Bulgarian and Russian nodes, and the Seychelles corporate shield โ we have a multi-dimensional profile of an individual (or small team) whose operational patterns are as distinctive as a fingerprint.
Next: Letter I will analyze the credential combinations themselves for information-theoretic anomalies โ unusual usernames, password patterns that might encode data, and credential sequences that appear designed rather than dictionary-derived.
TI-2026-051H | Classification: UNRESTRICTED | Confidence: HIGH
Key Finding: Wednesday = 78.3% of all sessions | 209:1 day ratio | CET timezone
99 global IPs trigger in 10-min windows = centralized C2 proven
Two independent clusters (ISAEV:99, Private Layer:14) share Wednesday schedule
The operator wakes at 04:00 CET. Every Wednesday. We'll be waiting.