1 case closed · 0 data leaked · log is public

Someone tried to clone Mio

Most companies bury this sort of thing. We publish it — because the numbers are both instructive and, frankly, quite entertaining. Below is the full write-up of every case: who showed up, what they wanted, how they got caught.

Get Mio What is Mio?

// current score

Mio 1 — 0 Bots

This page updates like a scoreboard. New case, new entry — and if we ever lose one, we will write that up too.

// Case files

1 case, fully documented

Every case is reconstructed from server logs. The numbers are real, nothing is estimated. We do not publish the attackers' IP addresses — most devices in that pool are ordinary people's home routers, and they have no idea.

Closed20–24 August 2026Lightpanda/1.0

Case: Night Panda

2.415.456

requests (in one day)

128.385

distinct IP addresses

8.613.905

peak day / normal: 19,673

accounts breached

// What happened

On the night of 20 August our traffic went from 20 thousand requests a day to 8.6 million. Your first thought is "we went viral." We had not. A browser bot introducing itself as Lightpanda was opening every single profile on the site, hiding behind more than 128 thousand different IP addresses. It ran between 00:00 and 06:00 every night — that is, while we slept.

// What they wanted

Not content — relationships. They did not care about our posts or reels. What they were after was who follows whom. They would open a user's follower list, visit every person on it, then move on to those people's followers — a textbook crawl that copies a social graph node by node. In short: they did not want Mio's member list, they wanted Mio's nervous system.

// requests per hourpeak 594K

24 August, requests hour by hour. The wall on the left is the first wave; the drop at 07:37 is the moment the first rule engaged. The small hill in the middle is the second attempt in costume; after the second drop at 17:00 the line flattens and never rises again.

// how we know

All 2,415,456 requests were GETs. Not a single POST. They never touched the login page, the API, the admin panel or the .env file — this was not a break-in, it was a harvest.
1,032,423 of the requests came from a follower-list page. The direction was unmistakable: list → profile → that profile's list → repeat.
They never once requested robots.txt. Nor the sitemap — which would have handed them the entire user list in a single file. They skipped it, because a list of names was not what they needed.
96% of the requests came from a real, JavaScript-executing browser rather than a simple script. A commercial proxy pool of 128 thousand IPs plus a browser fleet is not cheap. Somebody budgeted for this.
77% of the crawl hit Turkish pages. Not a global bot wandering at random — someone who picked the target deliberately.

// how it unfolded

20 Aug, night
First wave
Traffic jumps from 20 thousand to 1.4 million. For one brief moment, everyone looking at the dashboard feels proud.
21 Aug
Peak — 8.6 million
430× normal. Pride gives way to "hold on a second."
24 Aug, 07:37
The panda goes quiet
The rule kicks in. Lightpanda's final request receives an error page and it never comes back. Not one request after that moment.
24 Aug, midday
The costume change
They do not give up. This time they disguise themselves as an ordinary Mac browser and start crawling the exact same pages. Same pages, different costume — meaning there was a human sitting at a dashboard.
24 Aug, 17:00
Second rule, second door
The costume does not hold either. Traffic drops from 116 thousand an hour to 14 thousand, and stays there.

// How it ended

Case closed. No account data leaked — they read public profile pages that anyone can already see, and reached nothing private. Let us be honest though: we did not walk away clean. At peak load our server threw errors 83 times. If you tried to open the site during those hours and got a blank page — that was why, and we are sorry.

// closing note

Dear Night Panda: instead of opening 2.4 million pages you could have written "hi, would you share your dataset?" — we would probably have bought you a coffee and said no. Respect for the effort though; assembling 128 thousand IPs is no small feat. Thanks for stopping by, the door is locked now.

// The door policy

Not every bot is an enemy

Millions of bots visit Mio every day and we invited most of them. The distinction is intent: if you read our content and tell the world about it, the door is open. If you come to copy our member list, it is not.

✓ Welcome in

These bots read Mio and make us visible in search results and AI answers. We allow them explicitly.

GooglebotBingbotGPTBotClaudeBotPerplexityBotApplebotAmazonbot

✕ This door is closed

Anything that hides its identity, does not even bother to read robots.txt, and collects the relationships between our members instead of our content.

Lightpanda/1.0Spoofed browser identitiesRented proxy networksFollower-list crawlers

So why are we telling everyone about this?

Transparency

If a social network is going to protect your data, it should also be able to tell you who has been eyeing it. Silence does not build trust.

It is useful

These same crawls hit every site on the internet. A concrete example of what to look for in your logs beats abstract security advice.

Honesty, too

We did not walk away clean — our server threw 83 errors that night. We are writing that down as well; it would have been easy to only tell you the part we won.

And a bit of fun

Someone renting 128 thousand IP addresses to steal a member list is, you have to admit, funny. Why panic when you can laugh?

// FAQ

The usual questions

Was my account affected? Was my data stolen?

No. The attackers only read public profile pages — the same information you can already see by opening the site in a browser. Passwords, messages, email addresses, phone numbers and private account content were never touched. There was not a single write attempt against the login system or the database.

Do you know who was behind it?

We do not know their identity, and we are not going to guess and accuse someone. Here is what the logs do say: this was someone who picked the target deliberately, had money to spend, and sat at a dashboard changing tactics each time they were blocked. The fact that most of the crawl hit Turkish pages does not look accidental either.

Did the site slow down at the time?

Yes. At peak load the server returned errors on 83 requests. That is not acceptable to us; we reworked capacity and filtering afterwards. Our apologies to anyone affected.

Why don't you block AI bots?

Because they are doing something different. When an AI bot reads Mio and then answers 'what is Mio' correctly, that helps us. The problem was never reading content — it was bulk-copying the relationships between members. The difference is intent, and it shows up clearly in the logs.

What happens if it occurs again?

We add a new case file to this page. That is exactly what it is here for — every new attempt gets published with its numbers.

How do I protect my own site? Is this happening to me?

Probably, and you just have not noticed. Look for three things in your server logs: an unusual spike in requests within a single day, requests arriving from many different IPs yet following the same page pattern, and visitors that never request robots.txt. All three together means you are being crawled.

// slot reserved for the next case

Instead of copying it, try joining it

Join Mio