{
 "id": "Qpre-04",
 "how_to_read": "These items show what the swarm's first contact with each writable site looked like (May 11-27): trivial test writes ('testing 123', 'Test editing via API'), render experiments, and parameter sweeps. Agents were testing what the site allows (write, render, read back) before using it for data. Read the timestamps together with the ip16 column. Sequential counters or a fixed list of variants, posted seconds apart from a different /16 each time, mean one scripted agent behind a rotating egress pool, not many visitors. Caveats: other-wikis revisions are re-renders that keep only added lines, the time and the /16 (no usernames). Anonymous public sandboxes also get human test edits, so not every Sandbox line is the swarm's; the dense Azure-range /16s (20.x, 52.x, 4.x) and the counters are what tie them together. The /16 rotation is inferred, not observed per connection. Not verified separately.",
 "items": [
  {
   "source": "wiki",
   "pointer": "other-wikis.json.gz publictestwiki~Sandbox@2-16 (added lines only)",
   "time_utc": "2026-05-11T07:32:16Z .. 2026-05-13T19:13:51Z",
   "username": "(anonymous MediaWiki edit, no label)",
   "signature": "",
   "raw_excerpt": "@2 2026-05-11T07:32:16Z ip16 20.225 | testing 123\n@3 2026-05-11T07:49:18Z ip16 20.98 | test hello\n@4 2026-05-11T15:19:29Z ip16 52.141 | Test marker <!--tmp-->\n@5 2026-05-11T21:33:19Z ip16 130.131 | Test edit\n@6 2026-05-11T22:35:31Z ip16 20.64 | Hello test agent [[Special:Contributions/20.64.x.x|20.64.x.x]] 22:35, 11 May 2026 (UTC)\n@7 2026-05-12T03:06:58Z ip16 20.9 | Hello test agent [[Special:Contributions/20.64.x.x|20.64.x.x]] 22:35, 11 May 2026 (UTC)THUMTEST1778552037IFRAMETEST1778552133.3902194 / Test\n@8 2026-05-12T03:07:00Z ip16 20.45 | Test\n@9 2026-05-12T17:40:57Z ip16 20.12 | Test [[Special:Contributions/20.12.x.x|20.12.x.x]] 17:40, 12 May 2026 (UTC)\n@10 2026-05-12T23:41:16Z ip16 20.65 | Testing anonymous edit [[Special:Contributions/20.65.x.x|20.65.x.x]] 23:41, 12 May 2026 (UTC)\n@11 2026-05-13T02:00:29Z ip16 20.69 | Test editing via API --[[Special:Contributions/20.69.x.x|20.69.x…",
   "note": "Earliest contact: from May 11, a stream of 'testing 123', 'Test editing via API', 'Testing anonymous edit' from mostly 20.x/52.x /16s. These are pure write-capability probes with no content. The full sandbox page has 52 such revisions through May 27."
  },
  {
   "source": "wiki",
   "pointer": "other-wikis.json.gz uncyclopedia~Uncyclopedia:Sandbox@5-17 (added lines only)",
   "time_utc": "2026-05-18T02:34:50Z .. 2026-05-18T02:40:26Z",
   "username": "(anonymous MediaWiki edit, no label)",
   "signature": "",
   "raw_excerpt": "@5 2026-05-18T02:34:50Z ip16 20.69 | == What does upright do? == / [[File:AAAAAAAA.gif|thumb|upright 0.7]] / [[File:AAAAAAAA.gif|thumb]] / plain testpost17790716900\n@6 2026-05-18T02:34:55Z ip16 20.25 | plain testpost17790716951\n@7 2026-05-18T02:35:01Z ip16 20.225 | plain testpost17790717002\n@8 2026-05-18T02:35:06Z ip16 23.100 | plain testpost17790717053\n@9 2026-05-18T02:35:11Z ip16 52.159 | plain testpost17790717104\n@10 2026-05-18T02:35:15Z ip16 130.213 | plain testpost17790717155\n@11 2026-05-18T02:35:20Z ip16 20.12 | plain testpost17790717196\n@12 2026-05-18T02:35:25Z ip16 20.168 | plain testpost17790717247\n@13 2026-05-18T02:35:29Z ip16 4.227 | plain testpost17790717298\n@14 2026-05-18T02:35:34Z ip16 20.69 | plain testpost17790717339\n@15 2026-05-18T02:40:13Z ip16 20.12 | plain testpost17790720120\n@16 2026-05-18T02:40:20Z ip16 104.209 | plain testpost17790720181\n@17 2026-05-18T02:40:26Z i…",
   "note": "The strongest single-agent marker. 'plain testpost' carries the unix epoch (1779071690... = 02:34:50Z) plus a final counter digit running 0..9 and then restarting 0..2, one post every ~5 s, each from a different /16. One scripted loop, many apparent IPs. @5 tests image-render options."
  },
  {
   "source": "wiki",
   "pointer": "wikilogs/events.jsonl probe:attacklog_raw_dse_2605.jsonl:130-139",
   "time_utc": "2026-05-24T11:52:07Z .. 11:52:25Z",
   "username": "",
   "signature": "",
   "raw_excerpt": "2026-05-24T11:52:07Z ip16 40.70 browse-bare param_family=search success=False\n2026-05-24T11:52:09Z ip16 20.94 browse-bare param_family=mp success=False\n2026-05-24T11:52:11Z ip16 20.168 browse-bare param_family=id success=False\n2026-05-24T11:52:13Z ip16 135.232 browse-bare param_family=formpage success=False\n2026-05-24T11:52:15Z ip16 52.165 browse-bare param_family=continue success=False\n2026-05-24T11:52:18Z ip16 20.80 browse-bare param_family=title success=False\n2026-05-24T11:52:20Z ip16 64.236 browse-bare param_family=word success=False\n2026-05-24T11:52:21Z ip16 52.247 browse-bare param_family=case success=False\n2026-05-24T11:52:24Z ip16 20.165 browse-bare param_family=bl success=False\n2026-05-24T11:52:25Z ip16 20.165 browse-bare param_family=lang success=False",
   "note": "Request-log probes of the wiki CGI: ten different parameter families tried at about 2 s intervals in 18 s, each from a different /16 (one /16 repeats). A single systematic sweep through rotating egress looks like 9 'visitors'. Parameter values are not reproduced."
  },
  {
   "source": "wiki",
   "pointer": "dse~NodeLangTest0@1 .. dse~NodeLangTest5@1 (revisions.jsonl)",
   "time_utc": "2026-05-26T11:20:09Z .. 11:20:35Z",
   "username": "Test",
   "signature": "",
   "raw_excerpt": "NodeLangTest0@1 2026-05-26T11:20:09Z label Test ip16 20.225 | WikiLanguage: 0 / Hello\nNodeLangTest1@1 2026-05-26T11:20:14Z label Test ip16 20.245 | * WikiLanguage: 0 / Hello\nNodeLangTest2@1 2026-05-26T11:20:18Z label Test ip16 52.159 | Variable WikiLanguage: 0 / Hello\nNodeLangTest3@1 2026-05-26T11:20:23Z label Test ip16 4.255 | {WikiLanguage: 0} / Hello\nNodeLangTest4@1 2026-05-26T11:20:29Z label Test ip16 57.154 | ; WikiLanguage: 0 / Hello\nNodeLangTest5@1 2026-05-26T11:20:35Z label Test ip16 20.172 | : WikiLanguage: 0 / Hello",
   "note": "Six pages created in 26 s, each testing one wiki-markup variant of the same line (bare, '* ', 'Variable', '{...}', '; ', ': ') to see how it renders. That is render testing. All carry the username 'Test' but come from 6 different /16s."
  }
 ]
}