SecuriLee🇨🇭✓ Add us as a preferred source on Google
Make a deal with SecuriLee🇨🇭
🔒 Paid proposals held safely in escrow — released only when the work's approved.
Known for
5 views
I run two honeypots: a web tarpit (MIRE) and a bank of OpenCanary port sensors (TOCE). For 7 months they kept separate guest books. Then I joined them.
91,602 web attackers ∩ 100,836 port scanners = just 1,405 IPs in both.
In that sliver: one operator wearing 159 VPN "cloaks" — unmasked by a fossilized 2019 Chrome user agent. And a bot that spells it "Mozlila".
Full story: https://about.ciso.li/TO
5 views
🤖 I run a deception platform — fake admin panels, fake .env files, fake everything. Most bots bounce off it and move on.
ClaudeBot moved in.
Over nine days it sent more requests to one subdirectory than every other bot on my entire infrastructure had sent in the previous five months. 170,000 verified hits. ~12GB of fabricated breach data served. Still going.
The twist: it wasn't ignoring robots.tx
3 views
I've decided to replace Excel with Claude Code.
This week, I ran Claude Code CLI on my MIRE host to assess the live Caddy and MIRE logs. 2.5Gb of data...!
This was instead of copying those logs to my machine and churn them into a plausible data source then pivot from it in Excel, I asked Claude the following:
"Assess these logs and give me three notable takeaways from the data."
Read more: http
3 views
903 days. 176,043,025 connections. First knock came 10 seconds after I flipped the switch.
I've been letting canaries sit on the open internet just to see what shows up, and the honest answer is: the same handful of idiots, over and over, at industrial scale. admin/admin tried 627,939 times. One South Korean IP alone hit me 10.6 million times — at some point it stopped being a scanner and started
📊 Post engagement
🔥 Top post: I run two honeypots: a web tarpit (MIRE) and a bank of OpenCanar · 5 likes + reposts
📊 Activity & format
Recent posts
View on Mastodon ↗
🔥 Top post
I run two honeypots: a web tarpit (MIRE) and a bank of OpenCanary port sensors (TOCE). For 7 months they kept separate guest books. Then I joined them.
91,602 web attackers ∩ 100,836 port scanners = just 1,405 IPs in both.
In that sliver: one operator wearing 159 VPN "cloaks" — …
📡 MIRE/C³ August release
We widened our bot blocklist. It caught 0.7% more traffic.
We stopped identifying and just counted requests per IP. That caught 28.7%.
🕵 Biggest single "user-agent" on the honeypot: none at all
🔗 https://mire.cc/ho…
I've done a mega-update to the #MIRE statistics and stories page with Genesis, Evolution, Q1, Q2, and What Claude Found stories.
👍
https://about.ciso.li/MIRE/index.html
I've decided to replace Excel with Claude Code.
This week, I ran Claude Code CLI on my MIRE host to assess the live Caddy and MIRE logs. 2.5Gb of data...!
This was instead of copying those logs to my machine and churn them into a plausi…
MIRE/C³ July release: I finally read my own 404 logs to drive what to build next.
421'000 requests fell through to a generic "not found" — about a third of all traffic. That gap became the backlog. I also rebuilt the tarpit to be massivel…
I blamed ClaudeBot. The logs had other ideas.
Follow-up to the MIRE/C³ ClaudeBit story: SemrushBot was in the trap first and ate more fake SQL (117 GB vs 98 GB), my query double-counted every request, and the "250/day ClaudeBot wall" was A…
The reporting also now has a history of The OpenCanary Experience 👍
The reporting for The OpenCanary Experience is now embedded in Claude Code; take a private Github repository, hook that into Claude Code, pull the raw data from the honeypots and Splunk into Claude's realm and ask for the storyline from t…
903 days. 176,043,025 connections. First knock came 10 seconds after I flipped the switch.
I've been letting canaries sit on the open internet just to see what shows up, and the honest answer is: the same handful of idiots, over and over, …
🐤 Stats from The OpenCanary Experience from the last 90 days. Here's what came knocking.
13,136,119 connections. Four campaigns. One very unexpected #1 country.
Some highlights from the data:
🔴 MSSQL was the most-targeted protocol — 5.18 m…
I built my own RSS reader. FastAPI, SQLite, Docker, Caddy — deployed via a single bootstrap script, served exclusively over Tailscale.
No open ports, no public exposure, proper TLS.
https://ciso.li/building-lees-feeds/
#infosec #selfhoste…
🤖 I run a deception platform — fake admin panels, fake .env files, fake everything. Most bots bounce off it and move on.
ClaudeBot moved in.
Over nine days it sent more requests to one subdirectory than every other bot on my entire infrast…
🐘 Community & instance
💡 Facts
🕵️ Fake follower check
Estimated- Est. 92% real, active audience · Low fake-follower risk.
- Engagement (~3.0% of followers engage each post) is around typical for Mastodon.
- Verified account.
- Established account (3+ years old).
Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.
About
📸 Gallery
🔀 Audience overlap
EstimatedEstimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.
More like this
Find more →Frequently asked questions
How much does SecuriLee🇨🇭 charge for a sponsorship?
How do I contact SecuriLee🇨🇭 for a brand deal or collaboration?
How many followers does SecuriLee🇨🇭 have?
✉ Message SecuriLee🇨🇭
Reaching out to influencers is a Pro feature. Upgrade to message any influencer directly — perfect for brands and agencies booking sponsorships.
- ✓ Message any influencer from their listing
- ✓ The influencer gets notified by email
- ✓ Manage every conversation in one inbox
Already Pro? Log in.
🎤 Event / appearance with SecuriLee🇨🇭
Booking an event / appearance is a Pro feature. Upgrade to book SecuriLee🇨🇭 for an in-person or virtual appearance — payment held safely in escrow until the event is done.
- ✓ Book them for events, livestreams, panels & more
- ✓ SecuriLee🇨🇭 gets notified by email
- ✓ Fee held in escrow, released after the appearance
Already Pro? Log in.
You're out of free requests this month
Free accounts get 5 per month. Go Pro for unlimited sponsor pitches, collab requests & sponsorship deals — plus featured placement, the Verified badge, free withdrawals and more.
Upgrade to Pro — $9.95/mo →Your free limit resets on the 1st of next month.
Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove