LogTriage Research — attack data from a real server https://logtriage.app/ Monthly measurements from LogTriage's own internet-facing server: what attacks it (SSH brute force, web probes, scanners and the networks behind them) and how well free IP blocklists catch those attackers. Aggregates only, free to reuse under CC BY 4.0. Plus notes on detection engineering. en Sun, 08 Nov 2026 00:00:00 GMT What finds a new MCP server: directories, monitors and scanners https://logtriage.app/reports/mcp-scanners/ https://logtriage.app/reports/mcp-scanners/ Who called a public MCP server after its listing in the official MCP Registry, and the scanners that probed /mcp before it existed. Aggregated from our own logs, updated weekly. Reports Sun, 08 Nov 2026 00:00:00 GMT Which free IP blocklists stop real attacks? (2026-10) https://logtriage.app/reports/ip-blocklists/ https://logtriage.app/reports/ip-blocklists/ Free IP blocklists measured monthly against every address that attacked a real production server: coverage of attackers and attack traffic, list by list. Reports Mon, 02 Nov 2026 02:40:16 GMT What attacks an internet-facing server — 2026-10 edition https://logtriage.app/reports/server-attacks/2026-10/ https://logtriage.app/reports/server-attacks/2026-10/ Monthly data report from LogTriage's own production server: SSH brute force, web probes, attacking networks and tools, aggregated. Reports Sun, 01 Nov 2026 02:10:54 GMT What attacks an internet-facing server — 2026-09 edition https://logtriage.app/reports/server-attacks/2026-09/ https://logtriage.app/reports/server-attacks/2026-09/ Monthly data report from LogTriage's own production server: SSH brute force, web probes, attacking networks and tools, aggregated. Reports Tue, 06 Oct 2026 14:53:47 GMT Why a curl User-Agent Isn't Automatically Malicious https://logtriage.app/blog/context-aware-risk-scoring/ https://logtriage.app/blog/context-aware-risk-scoring/ Context-aware risk scoring explained: why the same user-agent string can be low risk on one endpoint and critical on another. Blog Wed, 17 Jun 2026 00:00:00 GMT Detecting Impossible Travel Without Expensive UEBA Tooling https://logtriage.app/blog/impossible-travel-detection/ https://logtriage.app/blog/impossible-travel-detection/ Impossible travel detection doesn't need a UEBA platform — haversine distance and elapsed time on sign-in coordinates is enough. Blog Wed, 17 Jun 2026 00:00:00 GMT What a Single Confirmed-Malicious Threat Intel Hit Should Do to Your Risk Score https://logtriage.app/blog/single-ti-hit-should-spike-score/ https://logtriage.app/blog/single-ti-hit-should-spike-score/ Why additive risk scoring under-reacts to a single confirmed-malicious threat intelligence verdict, and how a floor rule fixes it. Blog Wed, 17 Jun 2026 00:00:00 GMT