Monday morning. I'm refreshed.

  I head downstairs. Mom's making breakfast.

  "Big test today?"

  "Biology. Cellular respiration."

  "You studied?"

  "Yeah. I'm ready."

  I eat quickly. Check my watch. Twenty minutes to get to school.

  I grab my backpack. Head out the door.

  ---

  When I get back home I see seven missed PMs from SpaceGoat. All timestamped between midnight and 3am.

  [SpaceGoat] ok this is definitely not normal traffic

  [SpaceGoat] same IP blocks. coordinated.

  [SpaceGoat] you awake?

  [SpaceGoat] two more bots are lagging hard

  [SpaceGoat] im gonna restart some services

  [SpaceGoat] nvm that made it worse

  [SpaceGoat] call me when youre up

  I check the time. 3:45.

  I check the server stats. Numbers don't look good.

  [SKa] sorry just saw these

  [SKa] what happened with the restart

  I wait. No response. He's probably still in school.

   server's still slow

   yeah getting ping timeouts

  I check the stats. Load times are higher than yesterday. Still climbing.

  I pull up the access logs. Same pattern as last night. Too many connections from similar IP ranges. Not random traffic.

  Wait.

  I scroll back through yesterday's logs. Same IP blocks. Same request patterns. Same timing intervals.

  This isn't new. This has been happening for days.

  I switch to the website. Load the main page. Seven seconds. Refresh. Nine seconds. The page times out.

  I try again. HTTP 503. Server too busy to respond.

  Those "traffic spikes" I dismissed. That "network lag" I postponed checking.

  I pull up the detailed access logs. Not just similar IP ranges—the SAME IP blocks hitting specific endpoints on our servers.

  Not random users browsing pages. Targeted requests testing response times. Probing upload scripts. Looking for writable directories. Mapping the infrastructure.

  Not spikes. Not lag.

  Reconnaissance.

  They've been testing our systems for a week. Learning which shells we use. Which endpoints are vulnerable. Where the bottlenecks live. How fast we respond. What we monitor.

  Like velociraptors testing the fence. Methodical. Patient.

  Clever girl.

  Back in #crew.

   website just went down

   ok i'm back. checking

   yeah its dead. 503 on everything

  The server load has been jumping over the last 10 minutes. This is not traffic. This is an attack.

  My first bot drops. The shell it's running on a free provider in California, completely unreachable.

   lost ska|ghost

   checking mine

   shit. daemon just died

  I SSH into my backup shells. Connection slow. The login prompt takes eight seconds to appear.

  I check server logs again.

  Ten processes fighting for resources that should handle one. Processes hanging. The shell is drowning.

   three of my bots cant connect anymore

   same. theyre ddosing our shells

   all of them?

  I pull up my infrastructure map. Eight bots across six shell providers.

  Two shells completely offline. Three more lagging badly. Three still functional.

   lost daemon

  The IRC server is choking. Messages delayed by thirty seconds. Join notifications crawling across the screen. The entire network feeling sluggish.

  I check the server stats. Network latency spiking. Ping times jumping from 50 milliseconds to 8,000. Then 15,000. Packets traveling cross-country and back three times over before getting a response. Connections dropping and reconnecting in waves.

  I try loading . Timeout. Connection refused. The entire website offline.

  I check the bot count. Started with eight.

  Now: six running. Two offline.

   lost another one

  Five bots.

   phantom just dropped

  Four.

   which shells are still up

   just my university account and one backup

   same. lost all my free shells. only uc santamonica left

  Wait.

  I check which systems are getting hit. Free shell providers. SpaceGoat's goodmonin2ya.net hosting. SteeZ's university account showing high load.

  Unauthorized usage: this narrative is on Amazon without the author's consent. Report any sightings.

  And—

  The high school network.

  No.

  I SSH into the lab machine. Connection refused.

  I try again. Same error.

  My PM window blinks.

  [FLiPZ] your bot on hs-d214.k12.il.us is in the logs

  He means the high school. That bot is running on my high school's network.

  [FLiPZ] outbound IRC traffic. lots of it.

  [FLiPZ] network admin is going to notice if they havent already

  [FLiPZ] kill it now

  Outbound traffic. From their attack hitting my bot. It must've started looping or flooding—enough to light up every log the district has.

  [SKa] i cant access it. connection refused

  [FLiPZ] then its already dead

  [FLiPZ] hope they dont trace it back to you

  Blocked. Or killed. Either way, the school has already shut it down.

  Every login: my student ID. Every session: timestamped, logged, tied to my real name. District property. Unauthorized use. Network abuse. They won't need to investigate—the evidence is already sitting there waiting for someone to read it.

  This isn't getting kicked off IRC. This is getting expelled. Maybe worse.

  I stare at the screen. Maybe it's fine. Maybe nobody will notice. Maybe the logs will scroll past and—

  No. Someone already noticed. That's why the connection is refused. They've killed my access because they found it.

  The T1 line I've been using for months—the fast, reliable connection that makes everything possible—has just turned into a paper trail leading straight to my locker.

   they hit the school network

   what

   my bot on the high school t1. its showing in their logs now

   can they trace it

   yeah

  I try to think through damage control. Deny everything? Claim someone else used my account? Except nobody else has my password. Nobody else logs in from my house. The timestamps will match my class schedule perfectly.

  I'm trapped. Completely, totally trapped.

  Four bots left. Then three.

   uc santamonica shell just locked me out

   sysadmin probably saw the traffic

   same. university account suspended

  They're hitting every shell we have. Every hosting provider. Every piece of infrastructure we've built over the past two months.

  But the channels—

  I check #mp3 and #warez.

  Still holding ops with the bots we do have. Still locked down. No attacks on the channels themselves.

  They aren't trying to take the channels back.

  They are destroying everything else.

  I switch to #main. The channel is lighting up.

  server keeps disconnecting me

   modes arent sticking. rubberbanding everywhere

   file bot isnt responding at all

   this is worse than yesterday

   whats going on with the server

   is this server dying

   moving to dalnet. this is unusable

   yeah same. cant use this.

  I check the user count on irc.goodmonin2ya.net.

  87 users an hour ago.

  Now: 64.

  I refresh. 58.

  Another refresh. 52.

  One more. 41 users.

  People are leaving.

   damage report

   five shells offline. website completely down. got two bots left

   three shells dead. university account locked. one bot running

   same. three bots total between us

  But #mp3 and #warez still show our bots with ops.

   they could have hit the channels

   yeah

   but they didnt

   no

  I hear the terminal bell sound, a message on EFNet.

  [SKriLLa] nice infrastructure you had there

  Of course it is him. Of course he is watching this whole time.

  [SKa] had?

  Im nauseated.

  [SKriLLa] yeah. past tense.

  [SKriLLa] you won the channels. congratulations.

  [SKriLLa] but channels dont mean shit if you cant keep your infrastructure online.

  [SKriLLa] and once that falls, we take our channels back.

  [SKriLLa] high school network showing in district logs now. university accounts flagged. free shells terminated.

  He knows exactly which systems we're using.

  [SKriLLa] channels are yours for now