{
  "schema_version": 1,
  "edition": "2026-09",
  "generated_at": "2026-10-06T14:53:47Z",
  "period": {
    "kind": "last_days",
    "start": "2026-09-06T00:00:00Z",
    "end": "2026-10-06T00:00:00Z",
    "days": 30,
    "partial_month": false,
    "coverage_note": "HTTP: 2026-09-22 to 2026-10-05 (14 days); SSH: 2026-09-06 to 2026-10-05 (30 days, complete)"
  },
  "coverage": {
    "http": {
      "source": "nginx access log",
      "start": "2026-09-22T00:24:56Z",
      "end": "2026-10-06T00:00:00Z",
      "days": 14,
      "complete": false,
      "files": 15
    },
    "ssh": {
      "source": "systemd journal (ssh.service)",
      "start": "2026-09-06T00:00:00Z",
      "end": "2026-10-06T00:00:00Z",
      "days": 30,
      "complete": true
    }
  },
  "totals": {
    "http_requests": 26667,
    "http_api_requests": 81,
    "http_unsolicited_requests": 26586,
    "http_sources": 1794,
    "http_unsolicited_per_day": 1899,
    "ssh_failed_attempts": 239750,
    "ssh_invalid_user_attempts": 132714,
    "ssh_invalid_user_connections": 127165,
    "ssh_sources": 1612,
    "ssh_failed_per_day": 7991.7,
    "unique_sources": 3393
  },
  "channels": {
    "method": "inferred",
    "direct": {
      "requests": 15754,
      "sources": 1093
    },
    "undetermined": {
      "requests": 10832,
      "sources": 1024
    },
    "cloudflare": {
      "requests": 0,
      "sources": 0
    },
    "direct_breakdown": {
      "named_raw_ip": 461,
      "port80_redirect": 13898,
      "rejected_by_nginx": 1395
    },
    "cloudflare_edge_excluded": 2
  },
  "threat_intel": {
    "ranges": 5108,
    "known_sources": 623,
    "known_share": 0.1836,
    "http_known_share": 0.2062,
    "ssh_known_share": 0.1576,
    "known_event_share": 0.7022,
    "http_known_event_share": 0.5014,
    "ssh_known_event_share": 0.7244
  },
  "enrichment": {
    "method": "ipinfo.io, one lookup per /24 (IPv4) or /48 (IPv6), busiest prefixes first",
    "prefixes": 2447,
    "prefixes_enriched": 2447,
    "lookups_fresh": 0,
    "lookups_cached": 2447,
    "source_coverage": 1,
    "event_coverage": 1
  },
  "top_countries": [
    {
      "country": "US",
      "sources": 881,
      "http_requests": 2657,
      "ssh_attempts": 8503,
      "share": 0.2597
    },
    {
      "country": "NL",
      "sources": 398,
      "http_requests": 3375,
      "ssh_attempts": 158019,
      "share": 0.1173
    },
    {
      "country": "CN",
      "sources": 339,
      "http_requests": 132,
      "ssh_attempts": 10462,
      "share": 0.0999
    },
    {
      "country": "GB",
      "sources": 231,
      "http_requests": 1047,
      "ssh_attempts": 293,
      "share": 0.0681
    },
    {
      "country": "DE",
      "sources": 194,
      "http_requests": 10943,
      "ssh_attempts": 2056,
      "share": 0.0572
    },
    {
      "country": "HK",
      "sources": 120,
      "http_requests": 116,
      "ssh_attempts": 2618,
      "share": 0.0354
    },
    {
      "country": "KR",
      "sources": 104,
      "http_requests": 142,
      "ssh_attempts": 3264,
      "share": 0.0307
    },
    {
      "country": "BE",
      "sources": 103,
      "http_requests": 221,
      "ssh_attempts": 86,
      "share": 0.0304
    },
    {
      "country": "SG",
      "sources": 88,
      "http_requests": 728,
      "ssh_attempts": 1289,
      "share": 0.0259
    },
    {
      "country": "IN",
      "sources": 82,
      "http_requests": 255,
      "ssh_attempts": 3297,
      "share": 0.0242
    },
    {
      "country": "BR",
      "sources": 81,
      "http_requests": 356,
      "ssh_attempts": 2666,
      "share": 0.0239
    },
    {
      "country": "ID",
      "sources": 71,
      "http_requests": 186,
      "ssh_attempts": 2043,
      "share": 0.0209
    },
    {
      "country": "VN",
      "sources": 68,
      "http_requests": 117,
      "ssh_attempts": 4886,
      "share": 0.02
    },
    {
      "country": "FR",
      "sources": 64,
      "http_requests": 785,
      "ssh_attempts": 2222,
      "share": 0.0189
    },
    {
      "country": "TW",
      "sources": 45,
      "http_requests": 49,
      "ssh_attempts": 523,
      "share": 0.0133
    }
  ],
  "top_asns": [
    {
      "asn": "AS8075",
      "org": "Microsoft Corporation",
      "sources": 243,
      "http_requests": 714,
      "ssh_attempts": 2594,
      "share": 0.0716
    },
    {
      "asn": "AS14061",
      "org": "DigitalOcean, LLC",
      "sources": 223,
      "http_requests": 869,
      "ssh_attempts": 4099,
      "share": 0.0657
    },
    {
      "asn": "AS396982",
      "org": "Google LLC",
      "sources": 206,
      "http_requests": 967,
      "ssh_attempts": 239,
      "share": 0.0607
    },
    {
      "asn": "AS25369",
      "org": "Hydra Communications Ltd",
      "sources": 188,
      "http_requests": 205,
      "ssh_attempts": 0,
      "share": 0.0554
    },
    {
      "asn": "AS132203",
      "org": "Tencent Building, Kejizhongyi Avenue",
      "sources": 171,
      "http_requests": 308,
      "ssh_attempts": 664,
      "share": 0.0504
    },
    {
      "asn": "AS198364",
      "org": "BANATSYNC SRL",
      "sources": 136,
      "http_requests": 4,
      "ssh_attempts": 130442,
      "share": 0.0401
    },
    {
      "asn": "AS6939",
      "org": "Hurricane Electric LLC",
      "sources": 93,
      "http_requests": 172,
      "ssh_attempts": 0,
      "share": 0.0274
    },
    {
      "asn": "AS63949",
      "org": "Akamai Connected Cloud",
      "sources": 79,
      "http_requests": 520,
      "ssh_attempts": 22,
      "share": 0.0233
    },
    {
      "asn": "AS4766",
      "org": "Korea Telecom",
      "sources": 71,
      "http_requests": 73,
      "ssh_attempts": 2686,
      "share": 0.0209
    },
    {
      "asn": "AS135377",
      "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
      "sources": 68,
      "http_requests": 176,
      "ssh_attempts": 1441,
      "share": 0.02
    },
    {
      "asn": "AS45102",
      "org": "Alibaba (US) Technology Co., Ltd.",
      "sources": 66,
      "http_requests": 165,
      "ssh_attempts": 153,
      "share": 0.0195
    },
    {
      "asn": "AS4134",
      "org": "CHINANET BACKBONE",
      "sources": 59,
      "http_requests": 12,
      "ssh_attempts": 2111,
      "share": 0.0174
    },
    {
      "asn": "AS38365",
      "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
      "sources": 50,
      "http_requests": 0,
      "ssh_attempts": 1074,
      "share": 0.0147
    },
    {
      "asn": "AS398324",
      "org": "Censys, Inc.",
      "sources": 50,
      "http_requests": 196,
      "ssh_attempts": 0,
      "share": 0.0147
    },
    {
      "asn": "AS31898",
      "org": "Oracle Corporation",
      "sources": 45,
      "http_requests": 450,
      "ssh_attempts": 1043,
      "share": 0.0133
    }
  ],
  "heaviest_networks": [
    {
      "asn": "AS198364",
      "org": "BANATSYNC SRL",
      "sources": 136,
      "http_requests": 4,
      "ssh_attempts": 130442,
      "share_of_http": 0.0002,
      "share_of_ssh": 0.5441,
      "share_of_events": 0.4898
    },
    {
      "asn": "AS48090",
      "org": "TECHOFF SRV LIMITED",
      "sources": 21,
      "http_requests": 782,
      "ssh_attempts": 21119,
      "share_of_http": 0.0294,
      "share_of_ssh": 0.0881,
      "share_of_events": 0.0822
    },
    {
      "asn": "AS47890",
      "org": "UNMANAGED LTD",
      "sources": 23,
      "http_requests": 33,
      "ssh_attempts": 11331,
      "share_of_http": 0.0012,
      "share_of_ssh": 0.0473,
      "share_of_events": 0.0427
    },
    {
      "asn": "AS202412",
      "org": "Omegatech LTD",
      "sources": 10,
      "http_requests": 7722,
      "ssh_attempts": 0,
      "share_of_http": 0.2905,
      "share_of_ssh": 0,
      "share_of_events": 0.029
    },
    {
      "asn": "AS215930",
      "org": "CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRAD",
      "sources": 3,
      "http_requests": 0,
      "ssh_attempts": 7481,
      "share_of_http": 0,
      "share_of_ssh": 0.0312,
      "share_of_events": 0.0281
    }
  ],
  "attack_categories": [
    {
      "id": "env_files",
      "label": ".env files",
      "requests": 7831,
      "sources": 86,
      "share": 0.2946
    },
    {
      "id": "wordpress_php",
      "label": "WordPress & PHP apps",
      "requests": 3710,
      "sources": 110,
      "share": 0.1395
    },
    {
      "id": "config_files",
      "label": "Config, backup & build files",
      "requests": 3419,
      "sources": 102,
      "share": 0.1286
    },
    {
      "id": "rce",
      "label": "Command injection & RCE payloads",
      "requests": 1876,
      "sources": 62,
      "share": 0.0706
    },
    {
      "id": "cloud_credentials",
      "label": "Cloud & SSH credentials, instance metadata",
      "requests": 1229,
      "sources": 28,
      "share": 0.0462
    },
    {
      "id": "vcs",
      "label": "Source-control exposure (.git, .svn)",
      "requests": 900,
      "sources": 67,
      "share": 0.0339
    },
    {
      "id": "protocol",
      "label": "Non-HTTP protocol probes (TLS, SOCKS, RDP…)",
      "requests": 777,
      "sources": 286,
      "share": 0.0292
    },
    {
      "id": "java_enterprise",
      "label": "Spring actuator & Java/enterprise apps",
      "requests": 484,
      "sources": 120,
      "share": 0.0182
    },
    {
      "id": "traversal",
      "label": "Path traversal",
      "requests": 322,
      "sources": 60,
      "share": 0.0121
    },
    {
      "id": "router_iot",
      "label": "Router, camera & IoT exploits",
      "requests": 279,
      "sources": 121,
      "share": 0.0105
    },
    {
      "id": "edge_vpn",
      "label": "VPN gateways, firewalls & Exchange",
      "requests": 172,
      "sources": 64,
      "share": 0.0065
    },
    {
      "id": "proxy",
      "label": "Open-proxy checks (CONNECT, absolute URLs)",
      "requests": 142,
      "sources": 19,
      "share": 0.0053
    },
    {
      "id": "ai_llm",
      "label": "AI services: MCP/LLM endpoints & AI API keys",
      "requests": 126,
      "sources": 78,
      "share": 0.0047
    },
    {
      "id": "container_api",
      "label": "Docker & Kubernetes APIs",
      "requests": 63,
      "sources": 47,
      "share": 0.0024
    },
    {
      "id": "api_discovery",
      "label": "API discovery (Swagger, GraphQL)",
      "requests": 54,
      "sources": 15,
      "share": 0.002
    },
    {
      "id": "log4shell",
      "label": "Log4Shell / JNDI injection",
      "requests": 0,
      "sources": 0,
      "share": 0
    },
    {
      "id": "sqli",
      "label": "SQL injection",
      "requests": 0,
      "sources": 0,
      "share": 0
    }
  ],
  "protocol_probes": [
    {
      "id": "tls",
      "label": "TLS handshake sent to the plain-HTTP port",
      "requests": 385
    },
    {
      "id": "other",
      "label": "Other non-HTTP or malformed bytes",
      "requests": 140
    },
    {
      "id": "socks",
      "label": "SOCKS proxy handshake",
      "requests": 121
    },
    {
      "id": "rdp",
      "label": "Remote Desktop (RDP) connection request",
      "requests": 35
    },
    {
      "id": "http2",
      "label": "HTTP/2 cleartext preface",
      "requests": 34
    },
    {
      "id": "empty",
      "label": "Connection opened, nothing sent",
      "requests": 29
    },
    {
      "id": "ssh",
      "label": "SSH banner sent to a web port",
      "requests": 10
    },
    {
      "id": "sstp",
      "label": "SSTP VPN handshake",
      "requests": 8
    },
    {
      "id": "stratum",
      "label": "Crypto-mining pool (Stratum) handshake",
      "requests": 8
    },
    {
      "id": "sip",
      "label": "SIP / VoIP request",
      "requests": 7
    }
  ],
  "top_paths": [
    {
      "path": "/.env",
      "requests": 505,
      "sources": 84,
      "category": "env_files"
    },
    {
      "path": "/index.php",
      "requests": 210,
      "sources": 44,
      "category": "wordpress_php"
    },
    {
      "path": "/.git/config",
      "requests": 134,
      "sources": 64,
      "category": "vcs"
    },
    {
      "path": "/.env.production",
      "requests": 83,
      "sources": 34,
      "category": "env_files"
    },
    {
      "path": "/.env.bak",
      "requests": 81,
      "sources": 35,
      "category": "env_files"
    },
    {
      "path": "/.env.backup",
      "requests": 76,
      "sources": 31,
      "category": "env_files"
    },
    {
      "path": "/SDK/webLanguage",
      "requests": 75,
      "sources": 5,
      "category": "router_iot"
    },
    {
      "path": "/.env.local",
      "requests": 73,
      "sources": 33,
      "category": "env_files"
    },
    {
      "path": "/admin/config.php",
      "requests": 72,
      "sources": 20,
      "category": "wordpress_php"
    },
    {
      "path": "/app/.env",
      "requests": 71,
      "sources": 28,
      "category": "env_files"
    },
    {
      "path": "/.env.example",
      "requests": 67,
      "sources": 25,
      "category": "env_files"
    },
    {
      "path": "/.env.save",
      "requests": 64,
      "sources": 27,
      "category": "env_files"
    },
    {
      "path": "/api/.env",
      "requests": 63,
      "sources": 27,
      "category": "env_files"
    },
    {
      "path": "/backend/.env",
      "requests": 61,
      "sources": 25,
      "category": "env_files"
    },
    {
      "path": "/src/.env",
      "requests": 61,
      "sources": 26,
      "category": "env_files"
    },
    {
      "path": "/.aws/credentials",
      "requests": 59,
      "sources": 24,
      "category": "cloud_credentials"
    },
    {
      "path": "/phpinfo.php",
      "requests": 52,
      "sources": 25,
      "category": "wordpress_php"
    },
    {
      "path": "/.env.old",
      "requests": 51,
      "sources": 24,
      "category": "env_files"
    },
    {
      "path": "/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh",
      "requests": 50,
      "sources": 47,
      "category": "rce"
    },
    {
      "path": "/config/.env",
      "requests": 50,
      "sources": 21,
      "category": "env_files"
    },
    {
      "path": "/config.json",
      "requests": 49,
      "sources": 23,
      "category": "config_files"
    },
    {
      "path": "/laravel/.env",
      "requests": 49,
      "sources": 20,
      "category": "env_files"
    },
    {
      "path": "/.env.development",
      "requests": 47,
      "sources": 23,
      "category": "env_files"
    },
    {
      "path": "/config.php",
      "requests": 47,
      "sources": 15,
      "category": "wordpress_php"
    },
    {
      "path": "/.env.test",
      "requests": 46,
      "sources": 19,
      "category": "env_files"
    }
  ],
  "tool_families": [
    {
      "id": "browser_like",
      "label": "Browser-like UA (real or spoofed)",
      "requests": 9673,
      "sources": 951,
      "share": 0.3638
    },
    {
      "id": "fake_googlebot",
      "label": "Fake Googlebot (spoofed UA)",
      "requests": 9609,
      "sources": 6,
      "share": 0.3614
    },
    {
      "id": "research",
      "label": "Research & attack-surface scanners (Censys, LeakIX…)",
      "requests": 2246,
      "sources": 225,
      "share": 0.0845
    },
    {
      "id": "libredtail",
      "label": "libredtail-http (RedTail botnet)",
      "requests": 1880,
      "sources": 39,
      "share": 0.0707
    },
    {
      "id": "none",
      "label": "No user agent",
      "requests": 1288,
      "sources": 439,
      "share": 0.0484
    },
    {
      "id": "curl",
      "label": "curl",
      "requests": 994,
      "sources": 50,
      "share": 0.0374
    },
    {
      "id": "zgrab",
      "label": "ZGrab",
      "requests": 204,
      "sources": 169,
      "share": 0.0077
    },
    {
      "id": "go",
      "label": "Go-http-client",
      "requests": 166,
      "sources": 56,
      "share": 0.0062
    },
    {
      "id": "other_scanner",
      "label": "Other self-identified scanners",
      "requests": 133,
      "sources": 24,
      "share": 0.005
    },
    {
      "id": "other",
      "label": "Other",
      "requests": 111,
      "sources": 40,
      "share": 0.0042
    },
    {
      "id": "exploit_poc",
      "label": "Exploit PoC scripts (CVE-named UA)",
      "requests": 96,
      "sources": 2,
      "share": 0.0036
    },
    {
      "id": "ai_crawler",
      "label": "AI crawlers (ClaudeBot, GPTBot…)",
      "requests": 65,
      "sources": 19,
      "share": 0.0024
    },
    {
      "id": "python_requests",
      "label": "python-requests",
      "requests": 36,
      "sources": 27,
      "share": 0.0014
    },
    {
      "id": "search_crawler",
      "label": "Search & SEO crawlers",
      "requests": 35,
      "sources": 8,
      "share": 0.0013
    },
    {
      "id": "python_other",
      "label": "Python (urllib, aiohttp, httpx…)",
      "requests": 18,
      "sources": 9,
      "share": 0.0007
    },
    {
      "id": "masscan",
      "label": "masscan",
      "requests": 14,
      "sources": 10,
      "share": 0.0005
    },
    {
      "id": "nmap",
      "label": "Nmap",
      "requests": 11,
      "sources": 10,
      "share": 0.0004
    },
    {
      "id": "headless",
      "label": "Headless browsers",
      "requests": 7,
      "sources": 4,
      "share": 0.0003
    }
  ],
  "ssh_top_usernames": [
    {
      "username": "root",
      "attempts": 103884,
      "sources": 1381
    },
    {
      "username": "admin",
      "attempts": 9447,
      "sources": 755
    },
    {
      "username": "ubuntu",
      "attempts": 6899,
      "sources": 666
    },
    {
      "username": "user",
      "attempts": 4610,
      "sources": 495
    },
    {
      "username": "test",
      "attempts": 2586,
      "sources": 413
    },
    {
      "username": "deploy",
      "attempts": 2477,
      "sources": 287
    },
    {
      "username": "debian",
      "attempts": 1783,
      "sources": 237
    },
    {
      "username": "ftpuser",
      "attempts": 1390,
      "sources": 335
    },
    {
      "username": "solana",
      "attempts": 1242,
      "sources": 34
    },
    {
      "username": "postgres",
      "attempts": 1212,
      "sources": 269
    },
    {
      "username": "oracle",
      "attempts": 1165,
      "sources": 279
    },
    {
      "username": "user1",
      "attempts": 1116,
      "sources": 242
    },
    {
      "username": "claude",
      "attempts": 955,
      "sources": 119
    },
    {
      "username": "dev",
      "attempts": 921,
      "sources": 244
    },
    {
      "username": "solv",
      "attempts": 861,
      "sources": 5
    },
    {
      "username": "minecraft",
      "attempts": 823,
      "sources": 189
    },
    {
      "username": "git",
      "attempts": 822,
      "sources": 236
    },
    {
      "username": "sol",
      "attempts": 782,
      "sources": 65
    },
    {
      "username": "guest",
      "attempts": 777,
      "sources": 202
    },
    {
      "username": "administrator",
      "attempts": 756,
      "sources": 175
    }
  ],
  "ssh_usernames_distinct": 11368,
  "daily": [
    {
      "date": "2026-09-06",
      "http_unsolicited": null,
      "ssh_failed": 8513
    },
    {
      "date": "2026-09-07",
      "http_unsolicited": null,
      "ssh_failed": 7056
    },
    {
      "date": "2026-09-08",
      "http_unsolicited": null,
      "ssh_failed": 9821
    },
    {
      "date": "2026-09-09",
      "http_unsolicited": null,
      "ssh_failed": 5983
    },
    {
      "date": "2026-09-10",
      "http_unsolicited": null,
      "ssh_failed": 8072
    },
    {
      "date": "2026-09-11",
      "http_unsolicited": null,
      "ssh_failed": 8632
    },
    {
      "date": "2026-09-12",
      "http_unsolicited": null,
      "ssh_failed": 6721
    },
    {
      "date": "2026-09-13",
      "http_unsolicited": null,
      "ssh_failed": 5666
    },
    {
      "date": "2026-09-14",
      "http_unsolicited": null,
      "ssh_failed": 5812
    },
    {
      "date": "2026-09-15",
      "http_unsolicited": null,
      "ssh_failed": 6739
    },
    {
      "date": "2026-09-16",
      "http_unsolicited": null,
      "ssh_failed": 8538
    },
    {
      "date": "2026-09-17",
      "http_unsolicited": null,
      "ssh_failed": 12629
    },
    {
      "date": "2026-09-18",
      "http_unsolicited": null,
      "ssh_failed": 10002
    },
    {
      "date": "2026-09-19",
      "http_unsolicited": null,
      "ssh_failed": 10067
    },
    {
      "date": "2026-09-20",
      "http_unsolicited": null,
      "ssh_failed": 9148
    },
    {
      "date": "2026-09-21",
      "http_unsolicited": null,
      "ssh_failed": 8483
    },
    {
      "date": "2026-09-22",
      "http_unsolicited": 2294,
      "ssh_failed": 10989
    },
    {
      "date": "2026-09-23",
      "http_unsolicited": 1632,
      "ssh_failed": 8736
    },
    {
      "date": "2026-09-24",
      "http_unsolicited": 967,
      "ssh_failed": 5821
    },
    {
      "date": "2026-09-25",
      "http_unsolicited": 4246,
      "ssh_failed": 8795
    },
    {
      "date": "2026-09-26",
      "http_unsolicited": 860,
      "ssh_failed": 5586
    },
    {
      "date": "2026-09-27",
      "http_unsolicited": 1487,
      "ssh_failed": 7721
    },
    {
      "date": "2026-09-28",
      "http_unsolicited": 5531,
      "ssh_failed": 5357
    },
    {
      "date": "2026-09-29",
      "http_unsolicited": 1530,
      "ssh_failed": 7849
    },
    {
      "date": "2026-09-30",
      "http_unsolicited": 1431,
      "ssh_failed": 11360
    },
    {
      "date": "2026-10-01",
      "http_unsolicited": 1067,
      "ssh_failed": 7543
    },
    {
      "date": "2026-10-02",
      "http_unsolicited": 1088,
      "ssh_failed": 4696
    },
    {
      "date": "2026-10-03",
      "http_unsolicited": 1023,
      "ssh_failed": 7691
    },
    {
      "date": "2026-10-04",
      "http_unsolicited": 2315,
      "ssh_failed": 8016
    },
    {
      "date": "2026-10-05",
      "http_unsolicited": 1115,
      "ssh_failed": 7708
    }
  ],
  "hourly_utc": [
    {
      "hour": 0,
      "http_unsolicited": 1005,
      "ssh_failed": 11839
    },
    {
      "hour": 1,
      "http_unsolicited": 4354,
      "ssh_failed": 11046
    },
    {
      "hour": 2,
      "http_unsolicited": 866,
      "ssh_failed": 11592
    },
    {
      "hour": 3,
      "http_unsolicited": 3841,
      "ssh_failed": 8142
    },
    {
      "hour": 4,
      "http_unsolicited": 897,
      "ssh_failed": 10276
    },
    {
      "hour": 5,
      "http_unsolicited": 1090,
      "ssh_failed": 8652
    },
    {
      "hour": 6,
      "http_unsolicited": 698,
      "ssh_failed": 7198
    },
    {
      "hour": 7,
      "http_unsolicited": 431,
      "ssh_failed": 8671
    },
    {
      "hour": 8,
      "http_unsolicited": 476,
      "ssh_failed": 8824
    },
    {
      "hour": 9,
      "http_unsolicited": 1174,
      "ssh_failed": 7883
    },
    {
      "hour": 10,
      "http_unsolicited": 734,
      "ssh_failed": 8312
    },
    {
      "hour": 11,
      "http_unsolicited": 878,
      "ssh_failed": 12195
    },
    {
      "hour": 12,
      "http_unsolicited": 441,
      "ssh_failed": 7709
    },
    {
      "hour": 13,
      "http_unsolicited": 387,
      "ssh_failed": 9333
    },
    {
      "hour": 14,
      "http_unsolicited": 772,
      "ssh_failed": 12222
    },
    {
      "hour": 15,
      "http_unsolicited": 363,
      "ssh_failed": 14601
    },
    {
      "hour": 16,
      "http_unsolicited": 538,
      "ssh_failed": 12619
    },
    {
      "hour": 17,
      "http_unsolicited": 665,
      "ssh_failed": 10322
    },
    {
      "hour": 18,
      "http_unsolicited": 2493,
      "ssh_failed": 9177
    },
    {
      "hour": 19,
      "http_unsolicited": 1430,
      "ssh_failed": 11593
    },
    {
      "hour": 20,
      "http_unsolicited": 685,
      "ssh_failed": 9449
    },
    {
      "hour": 21,
      "http_unsolicited": 389,
      "ssh_failed": 7448
    },
    {
      "hour": 22,
      "http_unsolicited": 1127,
      "ssh_failed": 10173
    },
    {
      "hour": 23,
      "http_unsolicited": 852,
      "ssh_failed": 10474
    }
  ],
  "busiest_hour_utc": {
    "http": {
      "hour": 1,
      "requests": 4354
    },
    "ssh": {
      "hour": 15,
      "attempts": 14601
    }
  },
  "exclusions": {
    "own_traffic_requests": 5591,
    "operator_addresses": 24,
    "api_routes_known": 38
  },
  "notes": [
    "HTTP data covers 2026-09-22 to 2026-10-05 (14 days) of the window: older nginx logs had already been rotated away.",
    "The server's log format does not record whether an HTTPS request arrived through Cloudflare, so only provably direct-to-IP requests are split out; client addresses are the true ones either way.",
    "Only the request line, user agent and referer are logged: payloads in other headers or request bodies (a common place for Log4Shell strings) are invisible here.",
    "Requests that Cloudflare's edge blocked before they reached the server are not counted."
  ]
}