Monthly data report Window: 6 Sep – 5 Oct 2026 CC BY 4.0

What Attacks an Internet-Facing Server: September 2026

In the 30 days to 5 Oct 2026, 1,612 addresses made 239,750 failed SSH login attempts against one small production server — about 8,000 a day — and 54% of them came from a single hosting network (AS198364, BANATSYNC SRL). In the 14 days of web logs still on disk, 1,794 addresses sent 26,586 unsolicited HTTP requests; the most common target was leaked .env files (29% of requests), and 36% claimed to be Googlebot without coming from Google’s network. 18% of all source addresses were already in LogTriage’s threat-intelligence ranges — and they produced 70% of the attack traffic.

Every number comes from the logs of LogTriage's own production API server: SSH for the full window, web traffic for 22 Sep – 5 Oct (14 days) — older web logs had already been rotated away. Published 6 Oct 2026. Methodology · Download the data (JSON)

239,750
Failed SSH logins
≈7,992 a day · 1,612 addresses
26,586
Unsolicited web requests
≈1,899 a day · 1,794 addresses
3,393
Attacking addresses
web and SSH, counted once
18%
Already in our threat intel
of addresses · 70% of the traffic

Key findings

  • “root” was the most-tried SSH username: 43% of all attempts, from 1,381 different addresses. Attackers tried 11,368 distinct usernames in total.
  • 55% of SSH password guesses targeted accounts that do not exist on the server — wordlist spraying, not targeting.
  • AI-agent account names are now in SSH wordlists: “claude” ranked #13 (955 attempts from 119 addresses).
  • SSH guessing never stops: the busiest hour was 15:00 UTC, and even the quietest hour of the day averaged 240 attempts.
  • 9,609 web probes (36%) used Googlebot’s user agent from 6 addresses outside Google’s published crawler ranges; genuine Googlebot sent none.
  • Self-identified research and attack-surface scanners (Censys, LeakIX, Palo Alto Xpanse and others) accounted for 8.5% of web probes — the rest did not say who they were.
  • 59% of web probes went straight to the server’s raw IP address, bypassing the CDN in front of the domain (a lower bound — see methodology).
  • 777 connections to the web ports were not HTTP at all: TLS handshakes sent to port 80 (385), SOCKS proxy handshakes (121), Remote Desktop connection requests (35), HTTP/2 cleartext prefaces (34).
  • No SQL injection or Log4Shell strings appeared in any request line, user agent or referer: blind internet-wide scanning looks for exposed files and known exploits, not injectable parameters.
  • By number of addresses the top sources were United States (26%), Netherlands (12%), China (10%) — mostly cloud and hosting networks: Microsoft Corporation (243 addresses), DigitalOcean, LLC (223 addresses), Google LLC (206 addresses).

Attacks per day

Two charts, each on its own scale — SSH guessing runs at several times the volume of web probing.

Failed SSH logins attempts per day (UTC)
6 Sep 2026: 8,513 attempts 7 Sep 2026: 7,056 attempts 8 Sep 2026: 9,821 attempts 9 Sep 2026: 5,983 attempts 10 Sep 2026: 8,072 attempts 11 Sep 2026: 8,632 attempts 12 Sep 2026: 6,721 attempts 13 Sep 2026: 5,666 attempts 14 Sep 2026: 5,812 attempts 15 Sep 2026: 6,739 attempts 16 Sep 2026: 8,538 attempts 17 Sep 2026: 12,629 attempts 18 Sep 2026: 10,002 attempts 19 Sep 2026: 10,067 attempts 20 Sep 2026: 9,148 attempts 21 Sep 2026: 8,483 attempts 22 Sep 2026: 10,989 attempts 23 Sep 2026: 8,736 attempts 24 Sep 2026: 5,821 attempts 25 Sep 2026: 8,795 attempts 26 Sep 2026: 5,586 attempts 27 Sep 2026: 7,721 attempts 28 Sep 2026: 5,357 attempts 29 Sep 2026: 7,849 attempts 30 Sep 2026: 11,360 attempts 1 Oct 2026: 7,543 attempts 2 Oct 2026: 4,696 attempts 3 Oct 2026: 7,691 attempts 4 Oct 2026: 8,016 attempts 5 Oct 2026: 7,708 attempts 12,629
Unsolicited web requests requests per day (UTC)
Web logs for these days were already rotated away 22 Sep 2026: 2,294 requests 23 Sep 2026: 1,632 requests 24 Sep 2026: 967 requests 25 Sep 2026: 4,246 requests 26 Sep 2026: 860 requests 27 Sep 2026: 1,487 requests 28 Sep 2026: 5,531 requests 29 Sep 2026: 1,530 requests 30 Sep 2026: 1,431 requests 1 Oct 2026: 1,067 requests 2 Oct 2026: 1,088 requests 3 Oct 2026: 1,023 requests 4 Oct 2026: 2,315 requests 5 Oct 2026: 1,115 requests
Web logs for these days were already rotated away
5,531

Shaded days had no web log left on the server: nginx keeps two weeks of access logs, so this edition covers web traffic from 22 Sep 2026 only.

Show the daily numbers as a table
Date (UTC)Failed SSH loginsUnsolicited web requests
2026-09-068,513no data
2026-09-077,056no data
2026-09-089,821no data
2026-09-095,983no data
2026-09-108,072no data
2026-09-118,632no data
2026-09-126,721no data
2026-09-135,666no data
2026-09-145,812no data
2026-09-156,739no data
2026-09-168,538no data
2026-09-1712,629no data
2026-09-1810,002no data
2026-09-1910,067no data
2026-09-209,148no data
2026-09-218,483no data
2026-09-2210,9892,294
2026-09-238,7361,632
2026-09-245,821967
2026-09-258,7954,246
2026-09-265,586860
2026-09-277,7211,487
2026-09-285,3575,531
2026-09-297,8491,530
2026-09-3011,3601,431
2026-10-017,5431,067
2026-10-024,6961,088
2026-10-037,6911,023
2026-10-048,0162,315
2026-10-057,7081,115

Busiest hour of the day (UTC): 15:00 for SSH (14,601 attempts across the window) and 01:00 for web probes (4,354 requests).

What the web probes were looking for

Unsolicited requests by attack category, with the share of all 26,586 unsolicited requests. One request can match more than one category.

  1. .env files 7,831 · 29%

    86 addresses

  2. WordPress & PHP apps 3,710 · 14%

    110 addresses

  3. Config, backup & build files 3,419 · 13%

    102 addresses

  4. Command injection & RCE payloads 1,876 · 7.1%

    62 addresses

  5. Cloud & SSH credentials, instance metadata 1,229 · 4.6%

    28 addresses

  6. Source-control exposure (.git, .svn) 900 · 3.4%

    67 addresses

  7. Non-HTTP protocol probes (TLS, SOCKS, RDP…) 777 · 2.9%

    286 addresses

  8. Spring actuator & Java/enterprise apps 484 · 1.8%

    120 addresses

  9. Path traversal 322 · 1.2%

    60 addresses

  10. Router, camera & IoT exploits 279 · 1.1%

    121 addresses

  11. VPN gateways, firewalls & Exchange 172 · 0.7%

    64 addresses

  12. Open-proxy checks (CONNECT, absolute URLs) 142 · 0.5%

    19 addresses

  13. AI services: MCP/LLM endpoints & AI API keys 126 · 0.5%

    78 addresses

  14. Docker & Kubernetes APIs 63 · 0.2%

    47 addresses

  15. API discovery (Swagger, GraphQL) 54 · 0.2%

    15 addresses

Not seen at all: Log4Shell / JNDI injection, SQL injection.

What each category means
.env files
Requests for .env and its variants (.env.production, .env.bak, /app/.env…). Frameworks keep database passwords and API keys there, so one exposed file is a complete credential dump.
WordPress & PHP apps
Login and admin pages, phpinfo(), the PHPUnit eval-stdin.php RCE (CVE-2017-9841) — sprayed at every server whether or not it runs PHP.
Config, backup & build files
config.json, docker-compose.yml, .gitlab-ci.yml, package.json, database dumps and archive files — anything that might hold secrets or reveal the stack.
Command injection & RCE payloads
Requests that carry a command to run: /bin/sh through the Apache path-traversal bugs (CVE-2021-41773/42013), PHP-CGI argument injection (CVE-2024-4577), PHPUnit eval-stdin.php, wget/curl droppers.
Cloud & SSH credentials, instance metadata
AWS credential files (/.aws/credentials), SSH private keys, kubeconfigs, Terraform state, secrets.json and cloud instance-metadata endpoints.
Source-control exposure (.git, .svn)
/.git/config, /.git/HEAD and friends. A readable .git directory lets an attacker rebuild the whole source tree, history and any committed secrets.
Non-HTTP protocol probes (TLS, SOCKS, RDP…)
Bytes that are not HTTP at all, sent to the web ports: TLS handshakes on port 80, SOCKS and RDP handshakes, HTTP/2 prefaces, crypto-mining pool logins, SIP.
Spring actuator & Java/enterprise apps
Spring Boot actuator endpoints (/actuator/env, /heapdump), Tomcat manager, GeoServer, Atlassian and SAP NetWeaver paths (/developmentserver/metadatauploader, CVE-2025-31324).
Path traversal
../ sequences — often double-encoded (%%32%65) — trying to escape the web root and read /etc/passwd or run /bin/sh.
Router, camera & IoT exploits
/cgi-bin/, /boaform, /HNAP1, Hikvision /SDK/webLanguage (CVE-2021-36260) and other embedded-device exploits, fired blindly at any IP that answers on port 80.
VPN gateways, firewalls & Exchange
Fortinet, Cisco ASA, Ivanti/Pulse, Palo Alto GlobalProtect, Citrix and Exchange login paths — the edge appliances behind most recent mass-exploitation waves.
Open-proxy checks (CONNECT, absolute URLs)
CONNECT requests and absolute URLs asking the server to fetch someone else’s site — testing whether it can be abused as a proxy.
AI services: MCP/LLM endpoints & AI API keys
Model Context Protocol (/mcp, /sse), Ollama and OpenAI-style APIs (/api/tags, /v1/models) and files like .env.anthropic — hunting for exposed AI agents and API keys.
Docker & Kubernetes APIs
An exposed Docker socket (/containers/json) or kubelet is instant remote code execution; scanners check every address for one.
API discovery (Swagger, GraphQL)
Swagger, OpenAPI and GraphQL endpoints — a map of every route an API exposes.
Log4Shell / JNDI injection
${jndi:…} strings (CVE-2021-44228) in the request line, user agent or referer.
SQL injection
UNION SELECT, OR 1=1, time-based sleep() and similar payloads in the URL.

The 25 most-requested paths

Query strings dropped; IDs and embedded IP addresses replaced with placeholders. The site root and crawler housekeeping files (/robots.txt, /favicon.ico…) are left out.

  1. /.env 505

    84 addresses · .env files

  2. /index.php 210

    44 addresses · WordPress & PHP apps

  3. /.git/config 134

    64 addresses · Source-control exposure (.git, .svn)

  4. /.env.production 83

    34 addresses · .env files

  5. /.env.bak 81

    35 addresses · .env files

  6. /.env.backup 76

    31 addresses · .env files

  7. /SDK/webLanguage 75

    5 addresses · Router, camera & IoT exploits

  8. /.env.local 73

    33 addresses · .env files

  9. /admin/config.php 72

    20 addresses · WordPress & PHP apps

  10. /app/.env 71

    28 addresses · .env files

  11. /.env.example 67

    25 addresses · .env files

  12. /.env.save 64

    27 addresses · .env files

  13. /api/.env 63

    27 addresses · .env files

  14. /backend/.env 61

    25 addresses · .env files

  15. /src/.env 61

    26 addresses · .env files

  16. /.aws/credentials 59

    24 addresses · Cloud & SSH credentials, instance metadata

  17. /phpinfo.php 52

    25 addresses · WordPress & PHP apps

  18. /.env.old 51

    24 addresses · .env files

  19. /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh 50

    47 addresses · Command injection & RCE payloads

  20. /config/.env 50

    21 addresses · .env files

  21. /config.json 49

    23 addresses · Config, backup & build files

  22. /laravel/.env 49

    20 addresses · .env files

  23. /.env.development 47

    23 addresses · .env files

  24. /config.php 47

    15 addresses · WordPress & PHP apps

  25. /.env.test 46

    19 addresses · .env files

Who sends them: tools by user agent

Unsolicited web requests grouped by the client's self-reported user agent. A Googlebot claim counts as genuine only from Google's published crawler ranges.

  1. Browser-like UA (real or spoofed) 9,673 · 36%

    951 addresses

  2. Fake Googlebot (spoofed UA) 9,609 · 36%

    6 addresses

  3. Research & attack-surface scanners (Censys, LeakIX…) 2,246 · 8.5%

    225 addresses

  4. libredtail-http (RedTail botnet) 1,880 · 7.1%

    39 addresses

  5. No user agent 1,288 · 4.8%

    439 addresses

  6. curl 994 · 3.7%

    50 addresses

  7. ZGrab 204 · 0.8%

    169 addresses

  8. Go-http-client 166 · 0.6%

    56 addresses

  9. Other self-identified scanners 133 · 0.5%

    24 addresses

  10. Other 111 · 0.4%

    40 addresses

  11. Exploit PoC scripts (CVE-named UA) 96 · 0.4%

    2 addresses

  12. AI crawlers (ClaudeBot, GPTBot…) 65 · 0.2%

    19 addresses

  13. python-requests 36 · 0.1%

    27 addresses

  14. Search & SEO crawlers 35 · 0.1%

    8 addresses

  15. Python (urllib, aiohttp, httpx…) 18 · <0.1%

    9 addresses

  16. masscan 14 · <0.1%

    10 addresses

  17. Nmap 11 · <0.1%

    10 addresses

  18. Headless browsers 7 · <0.1%

    4 addresses

SSH brute force: the usernames tried

The 20 most-tried usernames out of 11,368 distinct ones, counted per failed attempt. 55% of all attempts named an account that does not exist on the server.

  1. root 103,884

    1,381 addresses

  2. admin 9,447

    755 addresses

  3. ubuntu 6,899

    666 addresses

  4. user 4,610

    495 addresses

  5. test 2,586

    413 addresses

  6. deploy 2,477

    287 addresses

  7. debian 1,783

    237 addresses

  8. ftpuser 1,390

    335 addresses

  9. solana 1,242

    34 addresses

  10. postgres 1,212

    269 addresses

  11. oracle 1,165

    279 addresses

  12. user1 1,116

    242 addresses

  13. claude 955

    119 addresses

  14. dev 921

    244 addresses

  15. solv 861

    5 addresses

  16. minecraft 823

    189 addresses

  17. git 822

    236 addresses

  18. sol 782

    65 addresses

  19. guest 777

    202 addresses

  20. administrator 756

    175 addresses

Where it comes from

Countries ranked by number of attacking addresses rather than by volume, so a single noisy host cannot top the list. Attribution covers 100% of addresses.

Top countries

  1. United States 881 · 26%

    2,657 web requests · 8,503 SSH attempts

  2. Netherlands 398 · 12%

    3,375 web requests · 158,019 SSH attempts

  3. China 339 · 10%

    132 web requests · 10,462 SSH attempts

  4. United Kingdom 231 · 6.8%

    1,047 web requests · 293 SSH attempts

  5. Germany 194 · 5.7%

    10,943 web requests · 2,056 SSH attempts

  6. Hong Kong SAR China 120 · 3.5%

    116 web requests · 2,618 SSH attempts

  7. South Korea 104 · 3.1%

    142 web requests · 3,264 SSH attempts

  8. Belgium 103 · 3%

    221 web requests · 86 SSH attempts

  9. Singapore 88 · 2.6%

    728 web requests · 1,289 SSH attempts

  10. India 82 · 2.4%

    255 web requests · 3,297 SSH attempts

  11. Brazil 81 · 2.4%

    356 web requests · 2,666 SSH attempts

  12. Indonesia 71 · 2.1%

    186 web requests · 2,043 SSH attempts

  13. Vietnam 68 · 2%

    117 web requests · 4,886 SSH attempts

  14. France 64 · 1.9%

    785 web requests · 2,222 SSH attempts

  15. Taiwan 45 · 1.3%

    49 web requests · 523 SSH attempts

The heaviest networks by volume

Volume is far more concentrated than addresses: a handful of hosting networks produce most of the traffic.

NetworkAddressesSSH attemptsWeb requests
BANATSYNC SRLAS198364 136 130,44254% 4<0.1%
TECHOFF SRV LIMITEDAS48090 21 21,1198.8% 7822.9%
UNMANAGED LTDAS47890 23 11,3314.7% 330.1%
Omegatech LTDAS202412 10 00% 7,72229%
CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRADAS215930 3 7,4813.1% 00%

Top networks by number of addresses

  1. Microsoft Corporation (AS8075) 243 · 7.2%

    714 web requests · 2,594 SSH attempts

  2. DigitalOcean, LLC (AS14061) 223 · 6.6%

    869 web requests · 4,099 SSH attempts

  3. Google LLC (AS396982) 206 · 6.1%

    967 web requests · 239 SSH attempts

  4. Hydra Communications Ltd (AS25369) 188 · 5.5%

    205 web requests · 0 SSH attempts

  5. Tencent Building, Kejizhongyi Avenue (AS132203) 171 · 5%

    308 web requests · 664 SSH attempts

  6. BANATSYNC SRL (AS198364) 136 · 4%

    4 web requests · 130,442 SSH attempts

  7. Hurricane Electric LLC (AS6939) 93 · 2.7%

    172 web requests · 0 SSH attempts

  8. Akamai Connected Cloud (AS63949) 79 · 2.3%

    520 web requests · 22 SSH attempts

  9. Korea Telecom (AS4766) 71 · 2.1%

    73 web requests · 2,686 SSH attempts

  10. UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED (AS135377) 68 · 2%

    176 web requests · 1,441 SSH attempts

  11. Alibaba (US) Technology Co., Ltd. (AS45102) 66 · 1.9%

    165 web requests · 153 SSH attempts

  12. CHINANET BACKBONE (AS4134) 59 · 1.7%

    12 web requests · 2,111 SSH attempts

  13. Beijing Baidu Netcom Science and Technology Co., Ltd. (AS38365) 50 · 1.5%

    0 web requests · 1,074 SSH attempts

  14. Censys, Inc. (AS398324) 50 · 1.5%

    196 web requests · 0 SSH attempts

  15. Oracle Corporation (AS31898) 45 · 1.3%

    450 web requests · 1,043 SSH attempts

How the traffic reached the server

The API's domain sits behind Cloudflare, but the server's IP address is reachable directly, and scanners sweep every IPv4 address. 15,754 unsolicited requests (59%) provably went straight to the raw IP — port-80 hits, connections nginx rejected itself, and requests naming the IP; the other 10,832 arrived over HTTPS, through Cloudflare or straight to the IP (the log format does not record which).

Connections to the web ports that were not HTTP
TLS handshake sent to the plain-HTTP port385
Other non-HTTP or malformed bytes140
SOCKS proxy handshake121
Remote Desktop (RDP) connection request35
HTTP/2 cleartext preface34
Connection opened, nothing sent29
SSH banner sent to a web port10
SSTP VPN handshake8
Crypto-mining pool (Stratum) handshake8
SIP / VoIP request7

What this means for defenders

Each finding maps to a free, validated Sigma rule you can drop into your SIEM.

About 8,000 password guesses a day reached one ordinary small server, 55% of them for accounts that do not exist. Use key-only SSH, and alert on failure bursts and invalid-user enumeration rather than on single failures.

Rule: Detect SSH Brute Force and User Enumeration in Linux auth.log →

27% of web probes came from scripted clients and scanners or sent no user agent at all — and most of the rest claimed to be a browser or Googlebot. A scripted client is normal on an API; one probing admin and auth routes is not.

Rule: Detect Vulnerability Scanners and Scripted Clients Hitting Admin/Auth Endpoints →

29% of probes asked for .env files, 3.4% for .git metadata and 1.2% tried path traversal. Make sure none of these can ever be served, and treat a burst of 404s for them as reconnaissance.

Rule: Detect Path Traversal & Sensitive-File Recon →

1,876 requests carried a remote-code-execution payload and 279 targeted router, camera and CGI exploits — the automated first step of exploitation. Network-level HTTP logs catch them even where no application log exists.

Rule: Detect Web Attack Recon and SQL Injection in Zeek HTTP Logs →

Blind internet-wide scanners sent no SQL injection this period: SQLi appears once someone targets your real parameters, which makes it a high-signal alert in your own access logs.

Rule: Detect SQL Injection and Follow-on Data Exfiltration in nginx Access Logs →

Want the same picture for your own server? Drop an access log or auth.log into the free in-browser log analyzer.

Open the free log analyzer →

Methodology

What was measured. Every request that reached nginx on ports 80 and 443 of LogTriage's API server (a small cloud VM that serves only a JSON API), and every failed SSH login recorded by sshd. A script on the server aggregates the logs once a month and publishes only the totals on this page. Window: 6 Sep – 5 Oct 2026 (SSH for the full window, web traffic for 22 Sep – 5 Oct (14 days)).

Unsolicited vs. legitimate. Requests to LogTriage's real API routes (81 in this window) count as legitimate unless they carry an attack payload; everything else — 26,586 requests — is unsolicited. That includes research scanners such as Censys, which are shown separately under tools.

Our own traffic is excluded: uptime monitoring and synthetic-customer checks (5,591 requests), the server's own addresses, and any address that logged in over SSH with our key during the window (24 operator addresses).

Cloudflare. api.logtriage.app is proxied through Cloudflare. nginx restores each visitor's real address from Cloudflare's CF-Connecting-IP header and trusts that header only from Cloudflare's published ranges, so the addresses counted here are the true clients either way; any address inside Cloudflare's own ranges is excluded rather than counted as an attacker (2 requests). Requests that provably bypassed Cloudflare — port-80 hits on the raw IP, connections nginx rejected itself (non-HTTP bytes, plain HTTP on the TLS port, malformed URLs) and requests naming the IP — are counted as direct; the rest may have come either way, because the default log format does not record the connecting peer. Requests that Cloudflare blocked at its edge never reach the server and are not counted.

SSH. A failed attempt is one "Failed password" (or publickey / keyboard-interactive) event from sshd in the systemd journal; one connection can make several. Usernames are counted per attempt.

Categories and tools. Categories are matched on the URL-decoded request target (and, for Log4Shell, the user agent and referer); a request can match several. Tool families come from the user agent, which clients choose themselves — hence the Googlebot check against Google's published ranges.

Countries and networks come from ipinfo.io, looked up once per /24 network (IPv4) or /48 (IPv6) — 2,447 networks, covering 100% of addresses and 100% of events.

Threat intel. "Already in our threat intel" means the address falls inside one of the 5,108 IP ranges LogTriage uses to enrich customer logs (Spamhaus DROP, FireHOL level 1, Tor exits and ranges from confirmed incident investigations). Those addresses produced 72% of SSH attempts and 50% of web probes.

Privacy. Only aggregates are published. No individual IP address appears on this page or in the data file, and addresses embedded in requested paths are replaced with <ip>.

Caveats for this edition

  • HTTP data covers 2026-09-22 to 2026-10-05 (14 days) of the window: older nginx logs had already been rotated away.
  • The server's log format does not record whether an HTTPS request arrived through Cloudflare, so only provably direct-to-IP requests are split out; client addresses are the true ones either way.
  • Only the request line, user agent and referer are logged: payloads in other headers or request bodies (a common place for Log4Shell strings) are invisible here.
  • Requests that Cloudflare's edge blocked before they reached the server are not counted.

Get the data

Part of the monthly server attack report series — a new edition is published at the start of every month.

Find these attacks in your own logs

LogTriage reads nginx, auth.log and 50 other log formats, enriches every source against threat intelligence and writes an analyst-grade report in minutes. Try the live demo — no signup.

Try Live Demo → Analyze Your Own Logs