Every request between 1 Jan and 31 Mar 2026, pulled and pattern‑matched for what actually happened — not just what got logged.
24 addresses inside 185.177.72.0/24 show up on 71 of the quarter's 90 days. They never once touch a login form or a PHP dropper. Every visit is the same job: walk a list of file names that might be a leaked config.
It spread the work across 1,890 distinct paths and 20 different decoy domains — the signature of a single tool run on a schedule, not 24 separate curious humans.
Traffic to mire.cc's video catalogue was unremarkable all quarter — then in the last week of March it wasn't. One IP, one request, guessing a /vod/play/id/N URL that's wrong nine times out of ten, then gone for good.
The week of 25–31 March alone carried 79.7% of everything mire.cc logged all quarter — 27,335 of 34,274 requests, from 13,908 distinct addresses. 75.1% of those addresses (10,448) sent exactly one request and never came back. 90.5% of the week's requests ended in a 404: it was guessing IDs, not reading a sitemap.
618 addresses spent the quarter probing for .git/config — pure reconnaissance. 877 addresses spent it requesting oddly‑named files like ioxi-o.php and adminfuns.php — checking whether a webshell someone already planted is still alive. Cross‑referenced against every address seen this quarter: zero addresses appear in both lists.
Same address, no config or git probing at all — straight into a list of known dropper filenames, checked one after another:
GET /wp-content/themes/haha.php GET /xmr.php GET /k.php GET /adminfuns.php GET /cgi-bin/ GET /ioxi-o.php GET /wp-admin/css/bolt.php GET /ioxi-o.php (checked twice)
Meanwhile the blunter instrument, wp-login.php, drew 8,311 attempts from 1,032 separate addresses — the largest single crowd of the quarter, and a different population again.
MIRE runs the same engine behind every domain, but each one draws a different kind of visitor — shaped by whatever the domain's fake identity implies it is.
By far the widest reach — carries the March video‑ID scraper plus the usual background noise of secret and webshell probes.
WordPress‑branded target: 2,878 login attempts, plus repeated requests for two oddly specific theme JS assets (hetong.js, check.js) that read as CMS fingerprinting.
The most focused WordPress attack of the four: heavy wp-login.php POSTs, xmlrpc.php, and a specific plugin exploit path (hellopress/wp_filemanager.php).
Webshell‑signature checkers again, plus wlwmanifest.xml requests — a classic older WordPress version‑fingerprinting probe.
A /24 is one actor, not 24. The secrets‑hunting subnet only reveals its shape when you group by network, not by address.
A traffic spike can be one narrow thing, not a general uptick. 79.7% of a whole quarter's traffic to one domain landed in a single week, driven by IDs that were mostly wrong.
Recon and exploitation are often literally different operators. Zero address overlap this quarter between the config‑hunters and the webshell‑checkers — different tools, different hands, sold or run separately.
These statistics have a short shelf life. The scanning never stops; a number pulled in July can look very different by the time it's read. Always state the date the data was pulled.
The maze doesn't chase anyone — it stands still and lets the traffic reveal its own shape. Group by network and behaviour, and a quarter of noise resolves into a handful of tools, run by a handful of hands.
"Turn your noise into their cost."
Window analysed: 1 Jan – 31 Mar 2026, pulled 2026‑07‑12.
Live logs assessed by Claude Code CLI, fact‑checked against the source, then tuned and styled by hand.
Lee Mössner