Security & Traffic Report

This is a live report of real traffic against this site, generated from our own nginx access logs. Every request is classified as legitimate traffic or a specific attack type using the same rule-based techniques covered in our Web Application Firewall and HTTP User Agents articles — published here as a live demonstration of what that traffic actually looks like.

Window: last 30 days · Last scan: 2026-10-26 20:02 UTC · Source IPs for attack activity are masked (last octet zeroed) before storage — see Methodology below.

Requests Analysed

125,572

Flagged as Attacks

66,085

52.6% of all requests

Legitimate Traffic

59,487

Unique Visitors

21,916

daily-unique, summed across window

Proof-of-Work Defence

— compute we forced requestors of restricted URLs (e.g. /wp-admin/, config.php) to spend

Hashes Demanded

estimated SHA-256 computations across all challenges

Challenges Issued

362

restricted-URL requests gated

Challenges Solved

clients that completed the work

fail2ban — Automated Intrusion Prevention

— offending IPs are detected in our logs and firewall-banned automatically · last scan: 2026-10-26 20:24 UTC

IPs Banned

7,144

ban actions in the last 30 days

Failures Detected

79,897

log matches that counted toward a ban

Active Jails

rule sets that issued at least one ban

Bans Lifted

7,134

expired or manually removed

Bans by Jail

sshd 7,144

Daily Bans

Recent Bans

Time (UTC)	Jail	Source (masked)
10-26 20:22	sshd	123.253.162.0
10-26 20:15	sshd	190.89.55.0
10-26 20:14	sshd	203.154.158.0
10-26 20:10	sshd	103.190.7.0
10-26 20:09	sshd	166.62.41.0
10-26 20:07	sshd	202.79.29.0
10-26 19:52	sshd	49.213.6.0
10-26 19:52	sshd	109.160.32.0
10-26 19:51	sshd	36.37.73.0
10-26 19:47	sshd	118.70.182.0
10-26 19:42	sshd	121.10.252.0
10-26 19:42	sshd	14.121.242.0
10-26 19:17	sshd	181.228.80.0
10-26 18:56	sshd	45.148.10.0
10-26 18:50	sshd	45.148.10.0
10-26 18:45	sshd	109.160.32.0
10-26 18:24	sshd	45.148.10.0
10-26 18:18	sshd	183.109.124.0
10-26 18:18	sshd	193.47.62.0
10-26 18:09	sshd	211.200.11.0
10-26 18:02	sshd	183.63.125.0
10-26 18:01	sshd	36.7.90.0
10-26 18:00	sshd	179.48.18.0
10-26 17:59	sshd	45.148.10.0
10-26 17:53	sshd	20.244.17.0
10-26 17:52	sshd	36.33.27.0
10-26 17:51	sshd	94.190.229.0
10-26 17:47	sshd	45.148.10.0
10-26 17:45	sshd	109.160.32.0
10-26 17:40	sshd	45.148.10.0
10-26 17:30	sshd	23.97.182.0
10-26 17:29	sshd	103.155.46.0
10-26 17:25	sshd	162.215.223.0
10-26 17:18	sshd	150.109.16.0
10-26 17:18	sshd	223.83.131.0
10-26 17:15	sshd	193.47.62.0
10-26 16:57	sshd	45.148.10.0
10-26 16:50	sshd	223.134.89.0
10-26 16:45	sshd	92.118.39.0
10-26 16:40	sshd	203.156.108.0
10-26 16:38	sshd	45.148.10.0
10-26 16:33	sshd	220.76.220.0
10-26 16:33	sshd	121.15.7.0
10-26 16:31	sshd	45.148.10.0
10-26 16:19	sshd	45.148.10.0
10-26 16:05	sshd	45.148.10.0
10-26 15:59	sshd	45.229.91.0
10-26 15:40	sshd	92.118.39.0
10-26 15:39	sshd	121.46.244.0
10-26 15:12	sshd	167.99.98.0

Daily Traffic — Legitimate vs Attacks

Legitimate Attacks

Attack Types

Reconnaissance / Scanning 33,406

Sensitive Path Probing 30,338

Known Attack Tool 1,008

Path Traversal 766

Local/Remote File Inclusion 332

Command Injection 192

Cross-Site Scripting 25

SQL Injection 18

Client Types (User-Agent)

Browser 68,073

Scripting / API Client 23,782

Other 12,550

Search Engine Bot 10,301

Empty / Missing UA 8,606

AI Crawler 1,126

Known Attack Tool 1,008

Social Link-Preview Bot 103

Headless Browser 23

Most Targeted Paths

/wp-admin/install.php?step=1	88 hits
/	45 hits
/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	27 hits
/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	21 hits
/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input	21 hits
/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input	17 hits
/.git/config	11 hits
/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\x22hi\x22));?>+/tmp/index1.php	11 hits
/index.php?lang=../../../../../../../../tmp/index1	11 hits
/.env	9 hits

Recent Attack Activity

Time (UTC)	Type	Source (masked)	Target	Status
10-26 19:41	Known Attack Tool	71.6.142.0	GET /	200
10-26 19:33	Sensitive Path Probing	162.158.182.0	GET /wp-admin/install.php?step=1	404
10-26 19:32	Sensitive Path Probing	20.201.77.0	GET /.git/config	404
10-26 19:32	Sensitive Path Probing	20.201.77.0	GET /.git/config	301
10-26 19:21	Sensitive Path Probing	151.241.122.0	GET /.env	404
10-26 19:21	Sensitive Path Probing	172.70.243.0	GET /wp-admin/install.php?step=1	429
10-26 19:21	Sensitive Path Probing	172.70.243.0	GET /wp-admin/install.php?step=1	301
10-26 19:21	Sensitive Path Probing	172.70.243.0	GET /wp-admin/install.php?step=1	301
10-26 19:19	Sensitive Path Probing	122.63.71.0	GET /xmlrpc.php	404
10-26 19:19	Sensitive Path Probing	122.63.71.0	POST /xmlrpc.php	301
10-26 19:03	Known Attack Tool	103.158.121.0	GET /admin/config.php	404
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /app/.env	404
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /laravel/.env	404
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /app/.env	301
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /.env	301
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /.env	404
10-26 18:27	Sensitive Path Probing	20.201.77.0	GET /laravel/.env	301
10-26 18:24	Known Attack Tool	198.251.85.0	GET /	200
10-26 18:07	Sensitive Path Probing	172.235.210.0	GET /.git/config	400
10-26 18:07	Sensitive Path Probing	172.235.210.0	GET /.env	400
10-26 18:07	Sensitive Path Probing	172.235.210.0	GET /.git/config	301
10-26 18:07	Sensitive Path Probing	172.235.210.0	GET /.env	301
10-26 17:22	Sensitive Path Probing	104.23.217.0	GET /wp-admin/install.php?step=1	404
10-26 17:08	Sensitive Path Probing	172.70.248.0	GET /wp-admin/install.php?step=1	429
10-26 17:08	Sensitive Path Probing	172.70.248.0	GET /wp-admin/install.php?step=1	301
10-26 17:08	Sensitive Path Probing	172.70.248.0	GET /wp-admin/install.php?step=1	301
10-26 16:51	Sensitive Path Probing	102.220.163.0	GET /.env	404
10-26 16:51	Sensitive Path Probing	102.220.163.0	GET /.env	499
10-26 16:51	Sensitive Path Probing	102.220.163.0	GET /.env	301
10-26 16:19	Sensitive Path Probing	94.154.32.0	GET /.env	404
10-26 16:09	Known Attack Tool	20.171.192.0	GET /developmentserver/metadatauploader	301
10-26 15:18	Sensitive Path Probing	172.71.148.0	GET /wp-admin/install.php?step=1	404
10-26 15:12	Sensitive Path Probing	104.23.221.0	GET /wp-admin/install.php?step=1	301
10-26 15:12	Sensitive Path Probing	104.23.221.0	GET /wp-admin/install.php?step=1	429
10-26 15:12	Sensitive Path Probing	104.23.221.0	GET /wp-admin/install.php?step=1	301
10-26 15:05	Known Attack Tool	20.118.219.0	GET /	400
10-26 14:26	Sensitive Path Probing	104.23.223.0	GET /wp-admin/install.php?step=1	429
10-26 14:26	Sensitive Path Probing	104.23.223.0	GET /wp-admin/install.php?step=1	301
10-26 14:26	Sensitive Path Probing	104.23.223.0	GET /wp-admin/install.php?step=1	301
10-26 14:18	Sensitive Path Probing	45.8.17.0	GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /example-if.quarantine-pnap-vlan51.web-hosting.com/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /sites/all/libraries/mailchimp/.env	404
10-26 14:18	Sensitive Path Probing	45.8.17.0	GET /database/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /public/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /newsite/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /www/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /vendor/laravel/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /storage/.env	404
10-26 14:18	Sensitive Path Probing	45.8.17.0	GET /protected/.env	404
10-26 14:18	Sensitive Path Probing	45.128.199.0	GET /base/.env	404

Methodology & Privacy

Traffic is classified using rule-based pattern matching against request paths, query strings, and User-Agent strings — the same techniques described in our Web Application Firewall and HTTP User Agents articles. It is not a substitute for a dedicated WAF and will have false positives and false negatives like any signature-based system.

No raw log lines and no full IP addresses are ever stored. Only aggregated daily counts are kept long-term; individual attack events shown above have their source IP masked (last octet zeroed for IPv4) before being written to the database, and legitimate traffic is never shown at the individual-request level at all.

This report is generated periodically from our own nginx access logs by an automated scanner — see About for more on this site.