MIRE // MULTI-LAYER INTRUSION RESPONSE ENGINE — ORIGIN STORY, CHAPTER 1

MIRE/Inception

The first 24 days. Before comprehensive reporting, it was clear that the MIRE had teeth.

Dec 8–31, 2025. From the earliest surviving line to the last hour of the year — reconstructed straight from the logs, one connection line paired with one impact line per request, exactly as the maze wrote it down at the time.

Scroll
The problem

Scanners do not stop at the first error.

Without a deception layer, commodity scanners keep iterating through mistakes, forgotten routes, and noisy framework errors until they find something useful.

WITHOUT MIRE

  • Attacker sends probe →
  • Unexpected routes and framework errors are exposed directly
  • Clean 404s and stack-specific responses help scanners classify the target
  • Misconfigurations become cheap reconnaissance for the attacker
  • Attack traffic keeps iterating at full speed against the exposed surface

WITH MIRE/C³

  • Attacker sends probe →
  • MIRE intercepts risky errors and default-protected routes
  • Serves realistic decoys and progressive delay instead of crisp scanner feedback
  • Noise is trapped, slowed, and instrumented rather than passed straight through
  • Canary tokens and telemetry turn attacker persistence into defensive signal
Active deception, week one

Not just detection — even then.

The three-part design was already there and already working on day one: deceive, delay, detect.

01Deceive

2,164 distinct decoy paths hit in 24 days. Fake PHP, admin panels, CI/CD configs, .env files, cloud metadata — all authentically rendered.

02Delay

IP-based progressive slowdown, live from the start. The slowest single response of the month held an attacker for 9.06 seconds — every one of those seconds billed to them, not to a real service.

03Detect

Canary tokens baked into fake archives, credentials, and config files — already loaded 3,960 times this month. Fires on exfiltration. Real attribution on who took what.

How it works

Every 404 becomes a trap.

Internetattacker probe
→
Cloudflareedge / WAF
→
Caddyreverse proxy
→
MIRETreacle
logging, as it evolved — first 24 days
Dec 8, 15:42First surviving line. The delay log is bare — "for <path>", no categories yet.
Dec 9Delay logging switches to categorized "for route: X" (27 categories). The bare format is gone within a day.
Dec 9, 10:03A 4-line burst exposes the delay formula itself — base + ip_extra = total, the per-IP surcharge that makes repeat offenders wait longer. From a dev IP, then never logged again.
Live data ·

days. Real attackers. Real numbers.

Response time distribution — held 3–10s (treacle working)
Attack patterns

What are they looking for?

Top targeted paths
File types targeted

Chinese VOD piracy scrapers found the maze inside the first month — hunting media platforms that don't exist here, in paths full of non-ASCII characters.

Threat actors

Meet the regulars.

No user-agent logging yet, so there are no fingerprints to lean on. Every host below is known purely by behaviour: request volume, the paths it chose, its timing.

Top source IPs · enriched at time of writing
The standout

The honest gaps

One trap. No idea which domain it caught.

Every number on this page is real — but this chapter has genuine holes worth naming up front. For these 24 days, the maze bit hard and logged the impact, yet three things it does record now, it simply wasn't recording yet.

MISSINGPer-domain attribution

No [host] field in the logs yet. Every request in this chapter is anonymous as to which of the cluster's domains received it.

MISSINGUser-Agent capture

User agents weren't logged yet. The heaviest hitters are known only by IP and behaviour — no fingerprints to lean on.

MISSINGCredential-harvest logging

Whatever attackers submitted to the decoy login forms went unrecorded. The knocks are counted; the payloads are not.

The treacle

Making attackers pay in time — a little.

Requests by hour (server local time) — attacks never sleep, even in week one.

00:0003:0006:0009:00 12:0015:0018:0021:0023:00
The delay engine, up close

27 categories. One route already dominates.

The delay engine doesn't treat every path the same — it groups them into categories, each with its own timing. By the end of week one, of all categorized delay hits were wp_login alone.

Top delay categories by hit count
Closing note

The teeth were real. The reporting hadn't caught up.

Twenty-four days, 31,159 trapped requests, 2.57 GB of treacle, and 28 hours of attacker time burned — all before the instrumentation that describes it existed. The bite was there from the first line. Everything that came after was learning to write it down.

"Turn your noise into their cost."

Production honeypot. Real data. Live since December 2025.

← Back to the maze

Lee Mössner