[grier]

It's also only a good signal as long as you aren't actioning on it.

As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly.

The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.