The Recount — Churn Without Growth

TI-2026-067B · Series: 🔁 The Steady State · TLP:WHITE · 2026-07-09

Part A proved the web surface makes no new shapes. Part B asks whether the old shapes are at least still growing. They are not — and the way they fake growth is a lesson in its own right.

📋 The Short Version

The obvious next question after a saturation census: fine, no new attack types — but are the known clusters getting bigger? If the Azure shell-checker fleet went from 269 IPs to 466, that is a story.

Except it isn't. 466 is not a bigger fleet. It is the same ~150-node fleet, counted over more days, cycling through disposable IPs. Weekly-active never breaks 150. Eighty-three percent of the fleet's IPs are alive for a single day. The "growth" is an artifact of comparing a cumulative count over 37 days against a baseline cumulative count over 23.

This is a negative result — the recount found no growth — and it makes the steady state deeper than Part A showed: the four shapes are fixed not only in kind but in scale.

Confidence: HIGH. Every number here is a direct measurement of the same corpus, sliced by active-per-period instead of cumulative-distinct.

1. The Trap: 269 → 466

Here is the number that would make a lazy recount dossier:

A 73% jump. Headline writes itself: "Azure shell-checker botnet nearly doubles."

It would be false.

2. The Correction: Weekly-Active Is Flat

Count how many fleet IPs are active in each week instead of summing distinct IPs across the whole window, and the growth disappears:

The fleet rises to a ~150-node plateau by late June and holds there. It does not climb. Daily-active tells the same story — a noisy band between 20 and 40 nodes, no trend:

Jun17 ##########  20      Jun27 ####################  40
Jun18 ############ 24      Jun28 #################     35
Jun22 ###########  23      Jun29 #################     35
Jun25 ##############29      Jul03 ################      32
Jun26 ##################36  Jul07 ############          25
                            Jul08 #############         26

(The 2026-07-09 reading of 1 is the observation window ending mid-day, not a collapse.)

3. Why the Cumulative Count Lied: 3.1× Rotation

• Cumulative distinct IPs (37 days): 466
• Peak weekly-active: 150
• Rotation ratio: 3.1×

The fleet holds ~150 live nodes but burns through 466 distinct addresses across the window because it constantly replaces them. Extend the window and the cumulative number keeps rising — not because the operation grows, but because it rotates. Compare a 37-day cumulative total against a 23-day one and you have manufactured 60% of your "growth" out of nothing but calendar.

The disposability, quantified:

Eighty-three percent of these addresses exist for one day, fire ~131 requests, and vanish. This is a revolving door of Azure leases, not a swelling botnet.

4. The Whole Surface, Same Shape

It is not only the Azure fleet. Every population examined has the same plateau:

Total weekly-active IPs peaked at 2,712 in the June 29 week; weekly request volume peaked in the June 22 week. Both are now flat-to-lower. No cluster in the corpus shows sustained expansion. The surface is not just fixed in the kinds of attack it produces — it is holding steady in volume, delivered by continuous address churn.

5. What This Means

The steady state is deeper than Part A said. 067A showed no new attack shapes. 067B shows the shapes are not even growing. Constant kind, constant scale, constantly-rotating addresses — a genuine equilibrium.

For the growth-watcher. This platform flags dossiered clusters whose size grows past a threshold, to trigger evolution dossiers. This recount is a caution built into the method: if that size is a cumulative distinct-entity count and the current window is longer than the baseline window, rotation alone will trip the threshold. A disposable-IP operation will always look like it is growing when measured cumulatively. Growth must be normalized — active-per-fixed-period, or a trailing window of constant length — before it counts as evolution.

For defense. Nothing changes from the doctrine, and that is the point: individual fleet IPs are disposable (83% one-day) and individually worthless as blocklist entries; the durable signal is the behavior the ~150-node plateau keeps repeating. Score the request, not the address.

A negative result, reported as one. The recount set out to find growth and found rotation. That is not a failed dossier — it is the honest answer to a fair question, and it closes a door (there is no evolution story to tell here right now) so effort can move to where discovery is still live: the OSINT and entity-graph substrates, next.

Investigation Metadata

Cross-references: TI-2026-067A (The Steady State — Four Shapes) · TI-2026-046B (The WordPress Ghosts) · TI-2026-059B (The Azure Shell Game) · TI-2026-059A (The Secret Harvest) · TI-2026-066A (Trusted by Default — why disposable IPs defeat reputation).