What Attacks an Internet-Facing Server
A monthly report built from the logs of LogTriage's own production API server: every SSH password guess, web probe and port scan it receives, aggregated and published as free data.
Real traffic, not a honeypot: an ordinary small cloud server running a production API. Aggregates only: no individual IP address is ever published. Data under CC BY 4.0.
Latest edition · September 2026
6 Sep – 5 Oct 2026
In the 30 days to 5 Oct 2026, 1,612 addresses made 239,750 failed SSH login attempts against one small production server — about 8,000 a day — and 54% of them came from a single hosting network (AS198364, BANATSYNC SRL). In the 14 days of web logs still on disk, 1,794 addresses sent 26,586 unsolicited HTTP requests; the most common target was leaked .env files (29% of requests), and 36% claimed to be Googlebot without coming from Google’s network. 18% of all source addresses were already in LogTriage’s threat-intelligence ranges — and they produced 70% of the attack traffic.
All editions
How it is made
- On the first of each month a script on the server reads the previous month's nginx access logs and sshd events, removes our own monitoring traffic, and publishes only aggregates.
- Web requests to LogTriage's real API routes count as legitimate; everything else — scans, exploit attempts, file hunting — is counted as unsolicited and categorised.
- The domain sits behind Cloudflare, and nginx restores each visitor's real address from Cloudflare's header; Cloudflare's own addresses are never counted as attackers.
- Countries and networks come from ipinfo.io, one lookup per /24 network. Overlap with LogTriage's threat-intelligence ranges is measured against the same data the product uses.
- Every edition ships its full numbers as JSON at /reports/server-attacks/YYYY-MM.json, and its page ends with a detailed methodology and caveats.
Turn the findings into detections
- Detect SSH brute force and user enumeration in auth.log →
- Detect path traversal and sensitive-file recon →
- Detect scanners and scripted clients on admin and auth endpoints →
- Detect web attack recon in Zeek HTTP logs →
- Detect SQL injection and data exfiltration in nginx logs →
- Check your own logs with the free log analyzer →
Find these attacks in your own logs
LogTriage reads nginx, auth.log and 50 other log formats, enriches every source against threat intelligence and writes an analyst-grade report in minutes. Try the live demo — no signup.