The Rhythm: Timing as a Fingerprint the Mask Cannot Change

TI-2026-086S ยท Series: The Wardrobe ยท Case 19 ยท Classification: HIGH ยท Confidence: HIGH

The costume comes off and goes back on โ€” that was 086B's finding, the mask worn interchangeably over one machine. So a question the series has been circling: if the name is fungible and the wordlist is swappable and the IPs rotate, is there anything about a fleet that stays fixed? There is. The rhythm. How fast a node fires and when a fleet moves together are properties of the automation and the operation, not the disguise, and the operator cannot change them without abandoning the very coordination that makes the fleet worth running. Timing is the fingerprint the mask cannot take off.

Executive Summary

A fleet carries two temporal signatures, and neither depends on what it claims to be:

That 19-IPs-at-one-request case is the whole argument in miniature: nineteen nodes making a single request each are invisible to any volume rule โ€” but their simultaneous arrival is a coordination fingerprint. Rhythm catches what volume misses. And because the operator can swap the mask (086B), change the wordlist (086R), and rotate the IPs (086G) without touching either signature, rhythm tracks a fleet across every disguise change. It is the third orthogonal signal: the mask is what they say, the behaviour is what they do, the rhythm is how and when they do it.

Micro-Cadence: The Machine Has a Pulse

Start with the rate, because it is the cleanest of the two. A real crawler is polite: it honours crawl-delay, spreads its requests to avoid loading the server, and behaves, over time, like something that intends to come back. The verified OAI-SearchBot of 085C made fourteen requests over three days. That is what a legitimate crawler's rhythm looks like โ€” deliberate, spread, considerate.

The fleets do the opposite. 34.125.48.170 fired 151 distinct paths in six seconds โ€” a cadence of nearly ninety-nine thousand paths per hour. 34.95.201.0 hit a hundred and twenty-seven thousand. That is not crawling; it is a for loop over a wordlist, emptying it as fast as the network allows. And critically, it is the same rate across the fleet, because the fleet members are the same program running on different instances. The cadence is a property of the tool, not the node โ€” which makes it a fingerprint of the tool, in exactly the way a shared HASSH client fingerprint identifies an SSH botnet by its toolkit (086A, 086J).

This gives the web surface something it otherwise lacks. SSH has HASSH โ€” a handshake fingerprint that clusters a botnet regardless of what credentials it tries. HTTP has no equivalent handshake, so the web fleets have, until now, been clustered mostly by mask and by target. Cadence supplies the missing toolkit-fingerprint: two nodes bursting at the same superhuman rate against the same paths are running the same automation, whatever names they wear. And it is simultaneously a discriminator โ€” a self-declared Googlebot that bursts at a hundred thousand paths an hour is behaviourally not Googlebot, because the real one paces itself. Tempo convicts the costume before the provenance check even runs.

Macro-Coordination: The Org Chart in the Timestamps

The second signature operates at the fleet level, and it is where 047C's line โ€” "rhythm is intent made visible; the burst detector turns a timestamp column into an org chart" โ€” becomes an attribution tool rather than only an intent one.

The temporal_burst detector keys on date + asn + intent: it clusters IPs that first appear together, from the same network, doing the same thing, on the same day. The result is the Burst campaigns โ€” Burst 2026-06-09 AS396982 (83 IPs, credential_harvest), and the ones on 06-08, 06-10, 06-11, 07-04. But the campaign that proves the method's power is the small one: Burst 2026-07-06 AS200373 โ€” 19 IPs, 21 requests total. Nineteen nodes, one request each (and one node with three). By every volume metric that exists, that is nothing โ€” nineteen IPs below any conceivable per-IP threshold, each a single harmless-looking request. A volume-based detector sees nineteen unrelated one-off pings. The temporal detector sees nineteen nodes that arrived on the same network on the same day to do the same thing, which is a coordination fingerprint no amount of volume-hiding erases. The operator spread the work to stay under thresholds; the synchrony of the spreading is itself the tell.

temporal_correlation sharpens it further, clustering IPs by shared short windows rather than shared days. The cross-vector SSH node 35.188.112.111 (086J) correlates with seventeen other IPs this way, at lift values up to 305 โ€” meaning those IPs co-occur in the same ten-minute windows three hundred times more often than chance would produce. Independent actors do not arrive in lockstep three hundred times over; that is an orchestra following one conductor's downbeat, and the downbeat is visible in the timestamps even when everything else about the nodes differs.

Put the two together and the operation's shape appears in time: bursts of synchronized first-appearance mark the campaign's launches, tight correlation windows mark its coordinated runs, and neither is visible to a detector that only counts requests per IP.

Why Rhythm Survives Every Disguise Change

The reason this matters for the whole series is that rhythm is the one thing the wardrobe cannot re-dress. Walk through what the operator can change and watch the rhythm stay put:

Everything the operator controls at the surface โ€” the name, the paths, the source address โ€” is variable. The two things that make the fleet a fleet โ€” that it runs one automation (cadence) and moves as one operation (synchrony) โ€” are the two things it cannot vary without ceasing to be a coordinated fleet. Desynchronize the coordination to hide the rhythm and you have thrown away the coordination that made the campaign efficient; slow the cadence to look polite and you have thrown away the speed that made the harvest worth running. The rhythm is load-bearing for the attack, which is exactly why it cannot be faked away.

So timing becomes a third identity axis, orthogonal to the two the series already built. Provenance asks where do you really live (086E). Behaviour asks what did you actually do (086I). Rhythm asks how fast, and with whom, and when โ€” and its answer follows an operator through a whole wardrobe of masks, because it is written in the timestamps the operator cannot forge without disarming.

Steelmanning: "Timing is noisy โ€” clocks skew, networks jitter, and lots of things burst"

The fair objection: timestamps are among the least reliable forensic fields โ€” clock skew, network jitter, log buffering, and time-zone confusion all corrupt them, and plenty of legitimate things burst (a CI pipeline, a monitoring sweep, a real crawler hitting a sitemap). Reading identity out of timing seems fragile.

Three defences hold the signal at its real strength. First, the case does not rely on absolute timestamps (which skew) but on relative structure โ€” 151 requests within 6 seconds from one node, or 19 IPs first-seen on one date โ€” which is robust to clock offset because it measures intervals and co-occurrence, not wall-clock truth. Second, the coordination claims are backed by lift: a temporal_correlation lift of 305 is not "these happened around the same time" but "these co-occur 305ร— more than independence predicts," a measure explicitly designed to separate real coordination from ambient burstiness. Third, rhythm is never asked to convict alone โ€” it clusters and tracks, then hands its clusters to provenance and behaviour, exactly as robots.txt (086Q) sorts rather than convicts. A legitimate CI burst has legitimate provenance and benign targets; the fleet burst does not, and the combination is what carries the verdict. The objection correctly warns against trusting raw timestamps; the case uses intervals, lift, and corroboration precisely because raw timestamps cannot be trusted.

What Holds, and What Is Bounded

Documented, HIGH confidence: the per-node burst cadences (151/6s, 79/3s, 97/~2s); the temporal_burst campaigns including the 19-IP/21-request AS200373 cluster; the temporal_correlation lift-305 windows on the cross-vector node; the polite-crawler contrast (14 requests over 3 days); the mask-independence of both signals across cases B/G/R.

Inferred, MEDIUM confidence: that cadence functions as a full HASSH-equivalent toolkit fingerprint on the web surface โ€” the analogy is sound and the same-rate-across-fleet evidence supports it, but a rigorous cadence-clustering that tracks one operator across a documented mask change is a follow-up (the components exist; the end-to-end cross-mask track is asserted, not yet demonstrated in a single worked example here).

Why It Matters

The Rhythm answers the question the interchangeable costume of 086B raised and left open: if the mask is fungible, what is fixed? The answer is the pulse and the synchrony โ€” the rate one node fires and the way a fleet moves together โ€” and both are fixed precisely because they are the mechanics of the attack rather than its disguise. An operator can be anyone it likes in the User-Agent, target anything it likes in the path, and come from anywhere it likes in the IP; it cannot stop running its tool at its tool's speed or coordinating its campaign in its campaign's windows, because those are what make it a fleet instead of a crowd.

That gives a defender the tracking signal the mask economy is built to deny. The wardrobe's whole design is variability at the surface โ€” a new name, a new path, a new address for every session. Rhythm reaches under all of it to the invariant: this is the same automation, running as the same operation, whatever it is wearing today. Provenance says where you live and behaviour says what you did, but rhythm says it is still you โ€” across the mask you took off and the one you just put on. The timestamps were never just a log column. They were the one part of the disguise the operator forgot they were wearing.

Cross-references

Next in the series โ€” TI-2026-086T, The Estate Map: the vhost-sweep reconnaissance arm that turns one exposed hostname into a map of the whole estate.

TLP:WHITE. Attacker timing telemetry only. No internal addresses or secrets disclosed.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 19 / 26 Next โ†’