I. The Map at Scale

Three thousand eighty-five IPs sounds like chaos. It isn't. The distribution has structure — extreme structure — that reveals the architecture of an attack economy more clearly than any individual IP ever could.

II. The Concentration Paradox

Sweden. Forty IPs. Five thousand one hundred sixty-eight hits. One hundred twenty-nine hits per IP.

That ratio is not a number — it's an accusation. The global average is approximately 15 hits per IP. Sweden's ratio is 8.6 times higher. From the previous article, we know why: 185.246.128.133 (w1n Ltd) and its temporal coordination network drive thousands of hits from a single IP. Sweden isn't a source of attacks. It's the clock from which attacks are coordinated.

Contrast with the United States: 695 IPs generating only 2,668 hits (3.8/IP). The US provides the raw compute — DigitalOcean, Google Cloud, Azure — but each instance is disposable. Used once, rotated, replaced. The US is the bullet. Sweden is the finger on the trigger.

III. The Three Tiers

IV. The Anonymization Layer

Between the tiers sits a shadow layer: 108 Tor exit nodes on 185.220.101.0/24, operated by Stiftung Erneuerbare Freiheit (Germany). This single prefix generates the largest same_prefix cluster in our entire dataset — 108 IPs all sharing prefix-level relationships.

The Tor exits serve a specific function in the geography of command: they break geographic attribution. An operator in Sweden can route through German Tor exits, emerge from a Dutch data center, and attack from Vietnamese compromised devices — creating a geographic trail that points everywhere and nowhere.

Twenty-two confirmed Tor exits appear in our honeypot data. But 108 share a prefix. Not all are attacking directly — some are part of the relay infrastructure that enables geographic obfuscation for others.

V. The Hyperscaler Problem

Three companies. Fourteen percent of all attack infrastructure. They're not complicit — they're enormous. At their scale, 438 malicious IPs are noise against millions of legitimate instances. But from the victim's perspective, the attacks come from the same infrastructure that serves Gmail, Azure DevOps, and Dropbox.

Microsoft is the most geographically diverse attacker (15 countries) because Azure's global footprint is the most geographically diverse cloud. The attack mirrors the legitimate infrastructure. This is not coincidence — it's camouflage by proximity.

VI. The Shared Geographic Patterns

4,531 shared_geo_pattern relationships connect 708 source IPs to 712 targets. These are IPs that don't just come from the same country — they share the same pattern of geographic behavior: attacking the same targets from the same source-country distributions at the same rates.

The top geo-pattern hubs are cloud infrastructure: DigitalOcean (30 links), Microsoft Azure (24 links), Linode (23 links). These IPs don't talk to each other — but they behave identically. Same scanning patterns, same target selection, same geographic distribution. This is the signature of a shared toolkit deployed across multiple cloud providers simultaneously.

VII. Read Between the Lines

VIII. The Thread Forward

Continuity

← TI-2026-054A "Synchronized Watches" — the temporal hubs that this geography serves

← TI-2026-053A "The Roads They Travel" — BGP transit analysis of the same infrastructure

← TI-2026-053F "Fourteen Thousand Tenants" — the belongs_to relationships behind these providers

→ TI-2026-054C "Twenty-Two Thousand Neighbors" — prefix-level coordination