Ninety active accounts produced most of Exploit.in's traffic, and the habits they built still shape today's ransomware crews.