The problem
Visitors hitting a dead link saw a bare server error, while vulnerability scanners hammered the fleet with tens of thousands of probes for exploits that do not exist here.
What Claude Code did
Claude replaced every error page across 15 domains with branded ones, in two tiers so client sites stay brand-neutral, and masked the server fingerprint. Then it replayed 96,597 real probe requests from the logs to tune blocking rules keyed on behavior, never on IP ranges, because LinkedIn's preview bot and Bing live in the same cloud as the attackers. Scanners now get a closed connection and zero bytes.
The result
412 scanner IPs would have been auto-banned under the new rules, humans who hit a 404 get a page that sells, and the AI crawlers Joe wants indexing his sites (231,000 hits from one of them) sail through untouched.