I pointed Claude Code at ten months of website logs and let it look for patterns. I forced Claude Code to then fact‑check itself. Finally, I tuned the output.
27 real domains, each protected by MIRE/C3 — serving up fabricated WordPress installs, admin panels, and "internal" dashboards to catch and log the traffic a live site would quietly 404 away.
MIRE synthesises responses rather than return a 404 not found error. Grouped by intent rather than by individual path, these five URI taxonomies account for nearly half of every response MIRE has ever created.
Each bar is that taxonomy's share of every 200 MIRE has logged. PHP shell probes — random names like alfa.php and ioxi-o.php hunting for a webshell someone already left behind — are the single biggest slice and together these five taxonomies make up 48% of every 200 MIRE has ever handed out.
● 173,297 served OK
12% of all traffic — 122,660 requests — carries no identifying label at all. It looks like 1,360 independent visitors. It isn't.
1,360 IPs → same paths, same order → a small number of shared toolkits
cfd.mire.cc alone accounts for 34.2% of everything. Inside it, two well‑known bots split the traffic — almost.
ClaudeBot's first hit on cfd.mire.cc was March 17. The last log line — July 6 — shows it still crawling. 99.1% of its requests got a "yes."
Fake downloads suffer a variable, exponential delay. Across 51,607 throttled files, duration ran 3.1s–31.2s, clustering around 11–16s. Two outliers were delayed exactly 30s.
Of every address sending the ClaudeBot label against cfd.mire.cc, 258 of 294 fell inside Anthropic's published crawler range. The rest didn't.
"UA strings are free. IP ranges aren't."
One address, one request every 6–7 seconds for nine minutes. 20 API‑shaped paths, four attack techniques each — hunting for a way to read local files or reach the internal address cloud servers use to hand out temporary credentials. Every attempt was rejected. The tooling didn't care.
A POST request carrying a hidden, gated file‑upload backdoor — active only with the right secret key. One second later, the same address checked for the signature of a known webshell family: not planting something new, but testing whether an old backdoor was still alive.
if($_GET['Fox'] == 'd3wL7'){ $saw1 = $_FILES['file']['tmp_name']; ... }
Every response is a deliberate choice, not a reflection of reality. A convincing "200 OK" on the right path keeps a scanner digging; a 404 sends it away. Review which traps actually hold attackers' attention — and retire the ones that don't.
Count patterns, not addresses. A thousand IPs running one script is one campaign wearing a thousand coats.
A label is a claim, not proof. 12% of "ClaudeBot" wasn't Anthropic. Half of the busiest domain's traffic was dressed as a browser.
Budget for AI crawlers as major traffic. But verify — two well‑known bots together were still under half of this domain's load.
These statistics have a short shelf life. The scanning never stops, so totals can double between analysis and publication. Always state the date the data was pulled.
A million requests, twenty‑seven domains, and one crawler still going after four months. Point a model at the logs, force it to fact‑check itself, and the noise resolves — most "attackers" are a handful of tools, most labels are claims, and a few visitors were never bots at all.
"UA strings are free. IP ranges aren't."
Window analysed: Sep 2025 – Jul 2026, pulled 2026‑07‑06.
Live logs assessed by Claude Code CLI, fact‑checked against the source, then tuned and styled by hand.
Lee Mössner