Every request between 1 Apr and 30 Jun 2026, pulled and pattern‑matched for what actually happened — not just what got logged.
cfd.mire.cc is a demonstration endpoint — normally kept out of the logs entirely. This quarter it served 194.75 GB: nearly every byte MIRE sent across all 23 domains. None of it went to an attacker. It went to two crawlers that announce themselves in the User‑Agent.
The surprise isn't the AI crawler — it's that the SEO crawler out‑drank it. Both were fed the same synthetic 4 MB SQL dumps and archives, laced with canary tokens, until the User‑Agent match was flipped to return a 205‑byte notice instead.
Two crawlers spent the quarter trying to read the whole maze. They chose opposite disguises — one loud and concentrated, one quiet and spread thin.
Few IPs, enormous volume. It followed the maze's own generated links recursively until the paths folded into nonsense:
GET /staging/config/status.php/health/status.php GET /dev/status.php/config/config/status.php GET /dev/health/health/status.php/status.php GET /staging/config/status.php/health/status.php/health
Spoofed Chrome, spread across 43.173.179–182 to look like a crowd — all pulling mire.cc's fake catalogue:
GET /tags.php GET /招商银行结汇资金属性怎么选？/ GET /google-adsense穿插广告详解-如何关闭/ GET /wordpress在安装中出现404、500问题的解决/
One announced itself and brute‑forced volume from 39 addresses; the other used 795 to disappear into the noise. Group by network, not by address, and the second one stops looking like a crowd.
52,320 distinct addresses reached the maze this quarter. Half of them came, guessed once, and were never seen again — while a few hundred did nearly all the work.
185.177.72.0/24 was the star of the Q1 report — a /24 walking a list of config and secret filenames, 36,411 requests. A quarter later it's still here, quieter (9,987) and broadened to crawl commerce paths too. But its neighbour in the same trade, 45.148.10.0/24, didn't change a thing — same list, same schedule, two quarters running:
Same eight filenames, quarter after quarter. To operators like these the maze is a fixed point they keep circling back to — which is exactly what makes a honeypot's field notes worth keeping.
The expensive traffic wasn't stealthy. 95% of the quarter's bandwidth went to two bots that name themselves in the User‑Agent — and the SEO crawler cost more than the AI one.
The same goal wears opposite disguises. One crawler used 39 addresses and brute volume; another used 795 to look like a crowd. Group by network, not by address.
Unique‑IP counts oversell the threat. Half of all addresses knocked once and left; a few hundred did most of the work. Size a crowd by behaviour, not by address count.
Operators persist across quarters. Q1's secrets‑hunting /24s are still running the same lists in Q2. Field notes age fast, but the regulars stay — so always state the date the data was pulled.
A quarter that looked like 52,000 attackers was really two declared crawlers, a few busy scanners, and a very long tail that knocked once. The maze stayed still; the traffic told on itself.
"Turn your noise into their cost."
Window analysed: 1 Apr – 30 Jun 2026, pulled 2026‑07‑13.
Live logs assessed by Claude Code CLI, fact‑checked against the source, then tuned and styled by hand.
Lee Mössner