diff --git a/tools/analyze-historical-attacks.sh b/tools/analyze-historical-attacks.sh
index 2071709..a3f225e 100755
--- a/tools/analyze-historical-attacks.sh
+++ b/tools/analyze-historical-attacks.sh
@@ -253,11 +253,14 @@ uri="${temp#*||}"
 
                 # Store sample URL (keep first 3)
                 current_urls="${IP_SAMPLE_URLS[$ip]}"
-                url_count=$(echo "$current_urls" | grep -o "||" | wc -l)
-                if [ "$url_count" -lt 3 ]; then
-                    if [ -z "$current_urls" ]; then
-                        IP_SAMPLE_URLS["$ip"]="${uri:0:100}"
-                    else
+                if [ -z "$current_urls" ]; then
+                    # First URL
+                    IP_SAMPLE_URLS["$ip"]="${uri:0:100}"
+                else
+                    # Count existing URLs by counting delimiters + 1
+                    url_count=$(echo "$current_urls" | grep -o "||" | wc -l)
+                    url_count=$((url_count + 1))
+                    if [ "$url_count" -lt 3 ]; then
                         IP_SAMPLE_URLS["$ip"]="$current_urls||${uri:0:100}"
                     fi
                 fi