MIRE ∩ TOCE · Dec 2025 – Jul 2026
MIRE catches whoever probes the website. TOCE catches whoever knocks on raw ports. For seven months they kept separate lists — then we joined them, and almost nobody was on both.
Two populations of a hundred thousand attackers each, almost perfectly disjoint. The intersection is where the operators live — and this is their story.
Act I — The Tide
Of the 1,405 shared visitors, 70% found the canary before the website — 757 of them by more than a month. The tide comes in on raw ports first; the webshells follow.
Together they logged 154,392 web requests and 287,033 canary events. But the whole story lives in the bottom row: fifty mentalists — IPs that invested a hundred-plus hits on each front.
Interlude — The Census
453 of the shared IPs are the internet's census-takers — research scanners that visit everything, so of course they visited both. But the league table isn't what you'd guess.
driftnet.io's InternetMeasurement and Palo Alto's Expanse own the intersection between them. Censys — the famous name — barely registers. Strip all 453 out, and what remains is genuinely hostile.
Act II — The Campaign
Strip the census and the drive-bys, and most of the serious residue is one repeating shape: an IP whose entire canary footprint is VNC on port 5901, arriving cloaked — VPN exit nodes rented from M247, DataCamp and friends — and probing the website on the side.
The classic substrate of consumer VPN services. Fourteen prefix families, one behaviour.
A browser build from 2019, presented in 2026 — by 86 of 159 cloaks. Another 33 send a blank user agent. Three quarters of the wardrobe, two signatures, one toolkit.
Act II — The Reversal
The general population scans ports, then tries the web — 70% TOCE-first. The VNC campaign moves against that tide: two thirds of its cloaks touched MIRE before they ever tried the canary. Web reconnaissance first, credentials second. That inversion is fingerprint-grade behaviour.
Act III — The Tell
MIRE's most obsessive visitor — 62.169.29.85, 15,533 requests in two months — wore 21 different user agents. Twenty were competent forgeries. The twenty-first gave the whole game away:
Three misspellings, none of them ours. Years ago a bot author hand-mangled a Galaxy S8 user agent into their tool, and that exact broken string has shipped inside exploit kits ever since — nobody proofreads malware. No real Android has ever said Mozlila. The camouflage became the fingerprint.
The tell collapses 21 "browsers" into one scripted client — which makes what happened next legible: on 12 June, still mid-campaign, the same address opened an SSH front on the canary. 238 attempts in 72 hours, then the SSH job ended, and three days later the web traffic stopped too. A rented box, repointed at the end of a contract — and the join watched the handover.
Act III — Careers
Same /24, same eight-port template — including nonstandard 33306, a port only a shared config produces. Overlapping runs through spring, ~350 hits each per front, and both went silent the same day: 7 May. Two boxes, one operator, one kill switch.
The heavyweight of the fifty: 24,055 RDP attempts on the canary while methodically working the web tarpit with 1,104 requests. Most attackers pick a trade. This one runs both, simultaneously, from one address.
Epilogue
On its own, TOCE saw scattered VNC brute-force sources. On its own, MIRE saw scattered web probes with a stale browser string. Neither could see a campaign. The join could: same cloaks, same toolkit, same rhythm — one actor behind 159 addresses, still running as this page went to press.
Port scans forecast web attacks — by a month.
One operator can wear 159 cloaks. Spelling gives them away.
The interesting adversaries show up on two surfaces.
0
IPs both honeypots know by name — 1.5% of either world, and where all of the story lives.
The OpenCanary Experience →