{
  "schema_version": 1,
  "edition": "2026-10",
  "generated_at": "2026-11-01T02:10:54Z",
  "period": {
    "kind": "month",
    "start": "2026-10-01T00:00:00Z",
    "end": "2026-11-01T00:00:00Z",
    "days": 31,
    "partial_month": false,
    "coverage_note": "HTTP: 2026-10-01 to 2026-10-31 (31 days, complete); SSH: 2026-10-01 to 2026-10-31 (31 days, complete)"
  },
  "coverage": {
    "http": {
      "source": "nginx access log",
      "start": "2026-10-01T00:00:00Z",
      "end": "2026-11-01T00:00:00Z",
      "days": 31,
      "complete": true,
      "files": 33
    },
    "ssh": {
      "source": "systemd journal (ssh.service)",
      "start": "2026-10-01T00:00:00Z",
      "end": "2026-11-01T00:00:00Z",
      "days": 31,
      "complete": true
    }
  },
  "totals": {
    "http_requests": 61094,
    "http_api_requests": 517,
    "http_unsolicited_requests": 60577,
    "http_sources": 3754,
    "http_unsolicited_per_day": 1954.1,
    "ssh_failed_attempts": 41780,
    "ssh_invalid_user_attempts": 28217,
    "ssh_invalid_user_connections": 61079,
    "ssh_sources": 1584,
    "ssh_failed_per_day": 1347.7,
    "unique_sources": 5316
  },
  "channels": {
    "method": "inferred",
    "direct": {
      "requests": 28011,
      "sources": 2214
    },
    "undetermined": {
      "requests": 32566,
      "sources": 2253
    },
    "cloudflare": {
      "requests": 0,
      "sources": 0
    },
    "direct_breakdown": {
      "named_raw_ip": 3411,
      "port80_redirect": 19837,
      "rejected_by_nginx": 4763
    },
    "cloudflare_edge_excluded": 9
  },
  "threat_intel": {
    "ranges": 5212,
    "known_sources": 1037,
    "known_share": 0.1951,
    "http_known_share": 0.2174,
    "ssh_known_share": 0.1439,
    "known_event_share": 0.5452,
    "http_known_event_share": 0.37,
    "ssh_known_event_share": 0.7993
  },
  "enrichment": {
    "method": "ipinfo.io, one lookup per /24 (IPv4) or /48 (IPv6), busiest prefixes first",
    "prefixes": 3468,
    "prefixes_enriched": 3468,
    "lookups_fresh": 1432,
    "lookups_cached": 2036,
    "source_coverage": 1,
    "event_coverage": 1
  },
  "top_countries": [
    {
      "country": "US",
      "sources": 1709,
      "http_requests": 8197,
      "ssh_attempts": 808,
      "share": 0.3215
    },
    {
      "country": "NL",
      "sources": 533,
      "http_requests": 6193,
      "ssh_attempts": 30229,
      "share": 0.1003
    },
    {
      "country": "GB",
      "sources": 443,
      "http_requests": 2066,
      "ssh_attempts": 2,
      "share": 0.0833
    },
    {
      "country": "CN",
      "sources": 342,
      "http_requests": 836,
      "ssh_attempts": 792,
      "share": 0.0643
    },
    {
      "country": "DE",
      "sources": 336,
      "http_requests": 9534,
      "ssh_attempts": 417,
      "share": 0.0632
    },
    {
      "country": "BE",
      "sources": 205,
      "http_requests": 599,
      "ssh_attempts": 25,
      "share": 0.0386
    },
    {
      "country": "BR",
      "sources": 146,
      "http_requests": 507,
      "ssh_attempts": 151,
      "share": 0.0275
    },
    {
      "country": "SG",
      "sources": 145,
      "http_requests": 1288,
      "ssh_attempts": 311,
      "share": 0.0273
    },
    {
      "country": "KR",
      "sources": 129,
      "http_requests": 526,
      "ssh_attempts": 327,
      "share": 0.0243
    },
    {
      "country": "HK",
      "sources": 127,
      "http_requests": 384,
      "ssh_attempts": 343,
      "share": 0.0239
    },
    {
      "country": "FR",
      "sources": 108,
      "http_requests": 6016,
      "ssh_attempts": 78,
      "share": 0.0203
    },
    {
      "country": "JP",
      "sources": 93,
      "http_requests": 452,
      "ssh_attempts": 11,
      "share": 0.0175
    },
    {
      "country": "IN",
      "sources": 88,
      "http_requests": 383,
      "ssh_attempts": 356,
      "share": 0.0166
    },
    {
      "country": "TW",
      "sources": 70,
      "http_requests": 147,
      "ssh_attempts": 121,
      "share": 0.0132
    },
    {
      "country": "ID",
      "sources": 68,
      "http_requests": 293,
      "ssh_attempts": 365,
      "share": 0.0128
    }
  ],
  "top_asns": [
    {
      "asn": "AS396982",
      "org": "Google LLC",
      "sources": 433,
      "http_requests": 3887,
      "ssh_attempts": 14,
      "share": 0.0815
    },
    {
      "asn": "AS14061",
      "org": "DigitalOcean, LLC",
      "sources": 432,
      "http_requests": 1578,
      "ssh_attempts": 176,
      "share": 0.0813
    },
    {
      "asn": "AS8075",
      "org": "Microsoft Corporation",
      "sources": 409,
      "http_requests": 588,
      "ssh_attempts": 204,
      "share": 0.077
    },
    {
      "asn": "AS25369",
      "org": "Hydra Communications Ltd",
      "sources": 367,
      "http_requests": 441,
      "ssh_attempts": 0,
      "share": 0.069
    },
    {
      "asn": "AS132203",
      "org": "Tencent Building, Kejizhongyi Avenue",
      "sources": 325,
      "http_requests": 821,
      "ssh_attempts": 100,
      "share": 0.0611
    },
    {
      "asn": "AS6939",
      "org": "Hurricane Electric LLC",
      "sources": 128,
      "http_requests": 318,
      "ssh_attempts": 0,
      "share": 0.0241
    },
    {
      "asn": "AS45102",
      "org": "Alibaba (US) Technology Co., Ltd.",
      "sources": 121,
      "http_requests": 428,
      "ssh_attempts": 1,
      "share": 0.0228
    },
    {
      "asn": "AS63949",
      "org": "Akamai Connected Cloud",
      "sources": 120,
      "http_requests": 1196,
      "ssh_attempts": 0,
      "share": 0.0226
    },
    {
      "asn": "AS198364",
      "org": "BANATSYNC SRL",
      "sources": 108,
      "http_requests": 15,
      "ssh_attempts": 26212,
      "share": 0.0203
    },
    {
      "asn": "AS31898",
      "org": "Oracle Corporation",
      "sources": 97,
      "http_requests": 2646,
      "ssh_attempts": 181,
      "share": 0.0183
    },
    {
      "asn": "AS14618",
      "org": "Amazon.com, Inc.",
      "sources": 92,
      "http_requests": 122,
      "ssh_attempts": 0,
      "share": 0.0173
    },
    {
      "asn": "AS135377",
      "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
      "sources": 91,
      "http_requests": 364,
      "ssh_attempts": 183,
      "share": 0.0171
    },
    {
      "asn": "AS398324",
      "org": "Censys, Inc.",
      "sources": 82,
      "http_requests": 310,
      "ssh_attempts": 0,
      "share": 0.0154
    },
    {
      "asn": "AS4134",
      "org": "CHINANET BACKBONE",
      "sources": 59,
      "http_requests": 34,
      "ssh_attempts": 102,
      "share": 0.0111
    },
    {
      "asn": "AS4766",
      "org": "Korea Telecom",
      "sources": 58,
      "http_requests": 134,
      "ssh_attempts": 260,
      "share": 0.0109
    }
  ],
  "heaviest_networks": [
    {
      "asn": "AS198364",
      "org": "BANATSYNC SRL",
      "sources": 108,
      "http_requests": 15,
      "ssh_attempts": 26212,
      "share_of_http": 0.0002,
      "share_of_ssh": 0.6274,
      "share_of_events": 0.2562
    },
    {
      "asn": "AS218785",
      "org": "TC DATACENTER LIMITED",
      "sources": 22,
      "http_requests": 7375,
      "ssh_attempts": 0,
      "share_of_http": 0.1217,
      "share_of_ssh": 0,
      "share_of_events": 0.0721
    },
    {
      "asn": "AS48090",
      "org": "TECHOFF SRV LIMITED",
      "sources": 32,
      "http_requests": 2896,
      "ssh_attempts": 3427,
      "share_of_http": 0.0478,
      "share_of_ssh": 0.082,
      "share_of_events": 0.0618
    },
    {
      "asn": "AS211590",
      "org": "Bucklog SARL",
      "sources": 6,
      "http_requests": 5169,
      "ssh_attempts": 0,
      "share_of_http": 0.0853,
      "share_of_ssh": 0,
      "share_of_events": 0.0505
    },
    {
      "asn": "AS396982",
      "org": "Google LLC",
      "sources": 433,
      "http_requests": 3887,
      "ssh_attempts": 14,
      "share_of_http": 0.0642,
      "share_of_ssh": 0.0003,
      "share_of_events": 0.0381
    }
  ],
  "attack_categories": [
    {
      "id": "env_files",
      "label": ".env files",
      "requests": 13731,
      "sources": 204,
      "share": 0.2267
    },
    {
      "id": "wordpress_php",
      "label": "WordPress & PHP apps",
      "requests": 8105,
      "sources": 290,
      "share": 0.1338
    },
    {
      "id": "config_files",
      "label": "Config, backup & build files",
      "requests": 6399,
      "sources": 252,
      "share": 0.1056
    },
    {
      "id": "rce",
      "label": "Command injection & RCE payloads",
      "requests": 3909,
      "sources": 135,
      "share": 0.0645
    },
    {
      "id": "protocol",
      "label": "Non-HTTP protocol probes (TLS, SOCKS, RDP…)",
      "requests": 2931,
      "sources": 492,
      "share": 0.0484
    },
    {
      "id": "cloud_credentials",
      "label": "Cloud & SSH credentials, instance metadata",
      "requests": 2652,
      "sources": 73,
      "share": 0.0438
    },
    {
      "id": "vcs",
      "label": "Source-control exposure (.git, .svn)",
      "requests": 1896,
      "sources": 153,
      "share": 0.0313
    },
    {
      "id": "router_iot",
      "label": "Router, camera & IoT exploits",
      "requests": 943,
      "sources": 208,
      "share": 0.0156
    },
    {
      "id": "java_enterprise",
      "label": "Spring actuator & Java/enterprise apps",
      "requests": 875,
      "sources": 247,
      "share": 0.0144
    },
    {
      "id": "traversal",
      "label": "Path traversal",
      "requests": 754,
      "sources": 132,
      "share": 0.0124
    },
    {
      "id": "proxy",
      "label": "Open-proxy checks (CONNECT, absolute URLs)",
      "requests": 573,
      "sources": 42,
      "share": 0.0095
    },
    {
      "id": "edge_vpn",
      "label": "VPN gateways, firewalls & Exchange",
      "requests": 362,
      "sources": 123,
      "share": 0.006
    },
    {
      "id": "ai_llm",
      "label": "AI services: MCP/LLM endpoints & AI API keys",
      "requests": 315,
      "sources": 180,
      "share": 0.0052
    },
    {
      "id": "api_discovery",
      "label": "API discovery (Swagger, GraphQL)",
      "requests": 175,
      "sources": 38,
      "share": 0.0029
    },
    {
      "id": "container_api",
      "label": "Docker & Kubernetes APIs",
      "requests": 143,
      "sources": 91,
      "share": 0.0024
    },
    {
      "id": "log4shell",
      "label": "Log4Shell / JNDI injection",
      "requests": 0,
      "sources": 0,
      "share": 0
    },
    {
      "id": "sqli",
      "label": "SQL injection",
      "requests": 0,
      "sources": 0,
      "share": 0
    }
  ],
  "protocol_probes": [
    {
      "id": "tls",
      "label": "TLS handshake sent to the plain-HTTP port",
      "requests": 1870
    },
    {
      "id": "socks",
      "label": "SOCKS proxy handshake",
      "requests": 496
    },
    {
      "id": "other",
      "label": "Other non-HTTP or malformed bytes",
      "requests": 317
    },
    {
      "id": "empty",
      "label": "Connection opened, nothing sent",
      "requests": 68
    },
    {
      "id": "rdp",
      "label": "Remote Desktop (RDP) connection request",
      "requests": 59
    },
    {
      "id": "http2",
      "label": "HTTP/2 cleartext preface",
      "requests": 53
    },
    {
      "id": "sstp",
      "label": "SSTP VPN handshake",
      "requests": 34
    },
    {
      "id": "ssh",
      "label": "SSH banner sent to a web port",
      "requests": 20
    },
    {
      "id": "stratum",
      "label": "Crypto-mining pool (Stratum) handshake",
      "requests": 8
    },
    {
      "id": "sip",
      "label": "SIP / VoIP request",
      "requests": 6
    }
  ],
  "top_paths": [
    {
      "path": "/.env",
      "requests": 1105,
      "sources": 160,
      "category": "env_files"
    },
    {
      "path": "/SDK/webLanguage",
      "requests": 467,
      "sources": 7,
      "category": "router_iot"
    },
    {
      "path": "/index.php",
      "requests": 451,
      "sources": 86,
      "category": "wordpress_php"
    },
    {
      "path": "/.git/config",
      "requests": 329,
      "sources": 140,
      "category": "vcs"
    },
    {
      "path": "/.env.production",
      "requests": 170,
      "sources": 68,
      "category": "env_files"
    },
    {
      "path": "/.env.save",
      "requests": 170,
      "sources": 65,
      "category": "env_files"
    },
    {
      "path": "/.env.bak",
      "requests": 168,
      "sources": 63,
      "category": "env_files"
    },
    {
      "path": "/.env.local",
      "requests": 165,
      "sources": 67,
      "category": "env_files"
    },
    {
      "path": "/admin/config.php",
      "requests": 155,
      "sources": 39,
      "category": "wordpress_php"
    },
    {
      "path": "/.env.backup",
      "requests": 153,
      "sources": 61,
      "category": "env_files"
    },
    {
      "path": "/api/.env",
      "requests": 151,
      "sources": 59,
      "category": "env_files"
    },
    {
      "path": "/.aws/credentials",
      "requests": 134,
      "sources": 42,
      "category": "cloud_credentials"
    },
    {
      "path": "/app/.env",
      "requests": 130,
      "sources": 51,
      "category": "env_files"
    },
    {
      "path": "/.env.prod",
      "requests": 124,
      "sources": 55,
      "category": "env_files"
    },
    {
      "path": "/backend/.env",
      "requests": 124,
      "sources": 51,
      "category": "env_files"
    },
    {
      "path": "/phpinfo.php",
      "requests": 120,
      "sources": 55,
      "category": "wordpress_php"
    },
    {
      "path": "/.env.example",
      "requests": 119,
      "sources": 45,
      "category": "env_files"
    },
    {
      "path": "/config/.env",
      "requests": 118,
      "sources": 45,
      "category": "env_files"
    },
    {
      "path": "/.env.old",
      "requests": 116,
      "sources": 58,
      "category": "env_files"
    },
    {
      "path": "/config.json",
      "requests": 111,
      "sources": 37,
      "category": "config_files"
    },
    {
      "path": "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",
      "requests": 111,
      "sources": 74,
      "category": "rce"
    },
    {
      "path": "/.git/HEAD",
      "requests": 110,
      "sources": 42,
      "category": "vcs"
    },
    {
      "path": "/.env.dev",
      "requests": 107,
      "sources": 45,
      "category": "env_files"
    },
    {
      "path": "/.env.development",
      "requests": 107,
      "sources": 48,
      "category": "env_files"
    },
    {
      "path": "/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh",
      "requests": 107,
      "sources": 86,
      "category": "rce"
    }
  ],
  "tool_families": [
    {
      "id": "browser_like",
      "label": "Browser-like UA (real or spoofed)",
      "requests": 25985,
      "sources": 1885,
      "share": 0.429
    },
    {
      "id": "fake_googlebot",
      "label": "Fake Googlebot (spoofed UA)",
      "requests": 8449,
      "sources": 11,
      "share": 0.1395
    },
    {
      "id": "research",
      "label": "Research & attack-surface scanners (Censys, LeakIX…)",
      "requests": 7173,
      "sources": 633,
      "share": 0.1184
    },
    {
      "id": "curl",
      "label": "curl",
      "requests": 4914,
      "sources": 99,
      "share": 0.0811
    },
    {
      "id": "none",
      "label": "No user agent",
      "requests": 4898,
      "sources": 828,
      "share": 0.0809
    },
    {
      "id": "libredtail",
      "label": "libredtail-http (RedTail botnet)",
      "requests": 3751,
      "sources": 67,
      "share": 0.0619
    },
    {
      "id": "other",
      "label": "Other",
      "requests": 2379,
      "sources": 83,
      "share": 0.0393
    },
    {
      "id": "go",
      "label": "Go-http-client",
      "requests": 1636,
      "sources": 111,
      "share": 0.027
    },
    {
      "id": "zgrab",
      "label": "ZGrab",
      "requests": 489,
      "sources": 343,
      "share": 0.0081
    },
    {
      "id": "other_scanner",
      "label": "Other self-identified scanners",
      "requests": 344,
      "sources": 48,
      "share": 0.0057
    },
    {
      "id": "ai_crawler",
      "label": "AI crawlers (ClaudeBot, GPTBot…)",
      "requests": 262,
      "sources": 47,
      "share": 0.0043
    },
    {
      "id": "python_requests",
      "label": "python-requests",
      "requests": 109,
      "sources": 71,
      "share": 0.0018
    },
    {
      "id": "search_crawler",
      "label": "Search & SEO crawlers",
      "requests": 60,
      "sources": 28,
      "share": 0.001
    },
    {
      "id": "python_other",
      "label": "Python (urllib, aiohttp, httpx…)",
      "requests": 58,
      "sources": 21,
      "share": 0.001
    },
    {
      "id": "masscan",
      "label": "masscan",
      "requests": 21,
      "sources": 19,
      "share": 0.0003
    },
    {
      "id": "nmap",
      "label": "Nmap",
      "requests": 17,
      "sources": 17,
      "share": 0.0003
    },
    {
      "id": "googlebot",
      "label": "Googlebot (verified)",
      "requests": 14,
      "sources": 6,
      "share": 0.0002
    },
    {
      "id": "headless",
      "label": "Headless browsers",
      "requests": 10,
      "sources": 5,
      "share": 0.0002
    },
    {
      "id": "exploit_poc",
      "label": "Exploit PoC scripts (CVE-named UA)",
      "requests": 4,
      "sources": 2,
      "share": 0.0001
    },
    {
      "id": "java",
      "label": "Java HTTP clients",
      "requests": 3,
      "sources": 2,
      "share": 0
    },
    {
      "id": "node",
      "label": "Node.js clients (axios, node-fetch…)",
      "requests": 1,
      "sources": 1,
      "share": 0
    }
  ],
  "ssh_top_usernames": [
    {
      "username": "root",
      "attempts": 13164,
      "sources": 339
    },
    {
      "username": "admin",
      "attempts": 1340,
      "sources": 135
    },
    {
      "username": "ubuntu",
      "attempts": 814,
      "sources": 128
    },
    {
      "username": "user",
      "attempts": 480,
      "sources": 96
    },
    {
      "username": "debian",
      "attempts": 293,
      "sources": 59
    },
    {
      "username": "test",
      "attempts": 205,
      "sources": 71
    },
    {
      "username": "logtriage",
      "attempts": 157,
      "sources": 1
    },
    {
      "username": "deploy",
      "attempts": 153,
      "sources": 39
    },
    {
      "username": "ftpuser",
      "attempts": 146,
      "sources": 62
    },
    {
      "username": "oracle",
      "attempts": 119,
      "sources": 45
    },
    {
      "username": "administrator",
      "attempts": 115,
      "sources": 36
    },
    {
      "username": "postgres",
      "attempts": 112,
      "sources": 44
    },
    {
      "username": "dev",
      "attempts": 90,
      "sources": 44
    },
    {
      "username": "solana",
      "attempts": 89,
      "sources": 15
    },
    {
      "username": "git",
      "attempts": 87,
      "sources": 40
    },
    {
      "username": "user1",
      "attempts": 87,
      "sources": 39
    },
    {
      "username": "developer",
      "attempts": 85,
      "sources": 32
    },
    {
      "username": "testuser",
      "attempts": 78,
      "sources": 51
    },
    {
      "username": "app",
      "attempts": 77,
      "sources": 28
    },
    {
      "username": "mysql",
      "attempts": 77,
      "sources": 40
    }
  ],
  "ssh_usernames_distinct": 5201,
  "daily": [
    {
      "date": "2026-10-01",
      "http_unsolicited": 1067,
      "ssh_failed": 7543
    },
    {
      "date": "2026-10-02",
      "http_unsolicited": 1088,
      "ssh_failed": 4696
    },
    {
      "date": "2026-10-03",
      "http_unsolicited": 1023,
      "ssh_failed": 7691
    },
    {
      "date": "2026-10-04",
      "http_unsolicited": 2315,
      "ssh_failed": 8016
    },
    {
      "date": "2026-10-05",
      "http_unsolicited": 1115,
      "ssh_failed": 7708
    },
    {
      "date": "2026-10-06",
      "http_unsolicited": 850,
      "ssh_failed": 6126
    },
    {
      "date": "2026-10-07",
      "http_unsolicited": 873,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-08",
      "http_unsolicited": 880,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-09",
      "http_unsolicited": 1904,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-10",
      "http_unsolicited": 695,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-11",
      "http_unsolicited": 4724,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-12",
      "http_unsolicited": 4155,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-13",
      "http_unsolicited": 2036,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-14",
      "http_unsolicited": 1755,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-15",
      "http_unsolicited": 1469,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-16",
      "http_unsolicited": 1022,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-17",
      "http_unsolicited": 1093,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-18",
      "http_unsolicited": 3350,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-19",
      "http_unsolicited": 2639,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-20",
      "http_unsolicited": 3317,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-21",
      "http_unsolicited": 3592,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-22",
      "http_unsolicited": 1514,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-23",
      "http_unsolicited": 2743,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-24",
      "http_unsolicited": 2539,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-25",
      "http_unsolicited": 1317,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-26",
      "http_unsolicited": 2680,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-27",
      "http_unsolicited": 1883,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-28",
      "http_unsolicited": 1274,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-29",
      "http_unsolicited": 998,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-30",
      "http_unsolicited": 1601,
      "ssh_failed": 0
    },
    {
      "date": "2026-10-31",
      "http_unsolicited": 3066,
      "ssh_failed": 0
    }
  ],
  "hourly_utc": [
    {
      "hour": 0,
      "http_unsolicited": 2735,
      "ssh_failed": 1231
    },
    {
      "hour": 1,
      "http_unsolicited": 3199,
      "ssh_failed": 724
    },
    {
      "hour": 2,
      "http_unsolicited": 2559,
      "ssh_failed": 2179
    },
    {
      "hour": 3,
      "http_unsolicited": 2083,
      "ssh_failed": 1841
    },
    {
      "hour": 4,
      "http_unsolicited": 2391,
      "ssh_failed": 2754
    },
    {
      "hour": 5,
      "http_unsolicited": 4233,
      "ssh_failed": 3003
    },
    {
      "hour": 6,
      "http_unsolicited": 1867,
      "ssh_failed": 1474
    },
    {
      "hour": 7,
      "http_unsolicited": 1869,
      "ssh_failed": 914
    },
    {
      "hour": 8,
      "http_unsolicited": 1287,
      "ssh_failed": 2340
    },
    {
      "hour": 9,
      "http_unsolicited": 2072,
      "ssh_failed": 2354
    },
    {
      "hour": 10,
      "http_unsolicited": 2184,
      "ssh_failed": 1484
    },
    {
      "hour": 11,
      "http_unsolicited": 1912,
      "ssh_failed": 1602
    },
    {
      "hour": 12,
      "http_unsolicited": 1603,
      "ssh_failed": 695
    },
    {
      "hour": 13,
      "http_unsolicited": 1620,
      "ssh_failed": 800
    },
    {
      "hour": 14,
      "http_unsolicited": 2638,
      "ssh_failed": 3000
    },
    {
      "hour": 15,
      "http_unsolicited": 1478,
      "ssh_failed": 3434
    },
    {
      "hour": 16,
      "http_unsolicited": 1539,
      "ssh_failed": 2430
    },
    {
      "hour": 17,
      "http_unsolicited": 2903,
      "ssh_failed": 1854
    },
    {
      "hour": 18,
      "http_unsolicited": 3343,
      "ssh_failed": 983
    },
    {
      "hour": 19,
      "http_unsolicited": 1901,
      "ssh_failed": 758
    },
    {
      "hour": 20,
      "http_unsolicited": 7386,
      "ssh_failed": 479
    },
    {
      "hour": 21,
      "http_unsolicited": 2349,
      "ssh_failed": 1107
    },
    {
      "hour": 22,
      "http_unsolicited": 3695,
      "ssh_failed": 2339
    },
    {
      "hour": 23,
      "http_unsolicited": 1731,
      "ssh_failed": 2001
    }
  ],
  "busiest_hour_utc": {
    "http": {
      "hour": 20,
      "requests": 7386
    },
    "ssh": {
      "hour": 15,
      "attempts": 3434
    }
  },
  "exclusions": {
    "own_traffic_requests": 26282,
    "operator_addresses": 42,
    "api_routes_known": 40
  },
  "notes": [
    "The server's log format does not record whether an HTTPS request arrived through Cloudflare, so only provably direct-to-IP requests are split out; client addresses are the true ones either way.",
    "Only the request line, user agent and referer are logged: payloads in other headers or request bodies (a common place for Log4Shell strings) are invisible here.",
    "Requests that Cloudflare's edge blocked before they reached the server are not counted."
  ],
  "ssh_messages": [
    {
      "id": "invalid-user",
      "count": 61079,
      "sources": 1557,
      "last_seen": "2026-10-31"
    },
    {
      "id": "failed-password",
      "count": 41780,
      "sources": 389,
      "last_seen": "2026-10-06"
    },
    {
      "id": "failed-publickey",
      "count": 0,
      "sources": 0,
      "last_seen": null
    },
    {
      "id": "accepted-publickey",
      "count": 26192,
      "sources": 42,
      "last_seen": "2026-10-31"
    },
    {
      "id": "accepted-password",
      "count": 0,
      "sources": 0,
      "last_seen": null
    },
    {
      "id": "connection-closed",
      "count": 77910,
      "sources": 2056,
      "last_seen": "2026-10-31"
    },
    {
      "id": "connection-reset",
      "count": 4240,
      "sources": 264,
      "last_seen": "2026-10-31"
    },
    {
      "id": "received-disconnect",
      "count": 24778,
      "sources": 1444,
      "last_seen": "2026-10-31"
    },
    {
      "id": "disconnected-preauth",
      "count": 24757,
      "sources": 1437,
      "last_seen": "2026-10-31"
    },
    {
      "id": "max-auth-attempts",
      "count": 206,
      "sources": 12,
      "last_seen": "2026-10-29"
    },
    {
      "id": "too-many-auth-failures",
      "count": 206,
      "sources": 12,
      "last_seen": "2026-10-29"
    },
    {
      "id": "pam-auth-failure",
      "count": 37795,
      "sources": 389,
      "last_seen": "2026-10-06"
    },
    {
      "id": "pam-user-unknown",
      "count": 28216,
      "sources": 0,
      "last_seen": "2026-10-06"
    },
    {
      "id": "pam-password-check-failed",
      "count": 10985,
      "sources": 0,
      "last_seen": "2026-10-06"
    },
    {
      "id": "pam-more-failures",
      "count": 1161,
      "sources": 13,
      "last_seen": "2026-10-06"
    },
    {
      "id": "pam-max-retries",
      "count": 863,
      "sources": 0,
      "last_seen": "2026-10-06"
    },
    {
      "id": "srclimit-penalty",
      "count": 290,
      "sources": 42,
      "last_seen": "2026-10-31"
    },
    {
      "id": "kex-identification",
      "count": 337,
      "sources": 0,
      "last_seen": "2026-10-31"
    },
    {
      "id": "banner-invalid-format",
      "count": 302,
      "sources": 172,
      "last_seen": "2026-10-31"
    },
    {
      "id": "unable-to-negotiate",
      "count": 321,
      "sources": 163,
      "last_seen": "2026-10-31"
    },
    {
      "id": "timeout-before-auth",
      "count": 2456,
      "sources": 553,
      "last_seen": "2026-10-31"
    }
  ],
  "probes": [
    {
      "id": "env-file",
      "requests": 13640,
      "sources": 200,
      "last_seen": "2026-10-31"
    },
    {
      "id": "git-config",
      "requests": 1531,
      "sources": 149,
      "last_seen": "2026-10-31"
    },
    {
      "id": "phpunit-eval-stdin",
      "requests": 3018,
      "sources": 77,
      "last_seen": "2026-10-31"
    },
    {
      "id": "hikvision-weblanguage",
      "requests": 467,
      "sources": 7,
      "last_seen": "2026-10-31"
    },
    {
      "id": "apache-cgi-bin-traversal",
      "requests": 198,
      "sources": 86,
      "last_seen": "2026-10-31"
    },
    {
      "id": "sap-metadatauploader",
      "requests": 64,
      "sources": 63,
      "last_seen": "2026-10-31"
    },
    {
      "id": "geoserver",
      "requests": 69,
      "sources": 44,
      "last_seen": "2026-10-31"
    },
    {
      "id": "docker-api",
      "requests": 93,
      "sources": 67,
      "last_seen": "2026-10-31"
    },
    {
      "id": "mcp-endpoint",
      "requests": 232,
      "sources": 205,
      "last_seen": "2026-10-31"
    },
    {
      "id": "cisco-webui",
      "requests": 75,
      "sources": 47,
      "last_seen": "2026-10-31"
    },
    {
      "id": "aws-credentials",
      "requests": 403,
      "sources": 46,
      "last_seen": "2026-10-31"
    },
    {
      "id": "spring-actuator",
      "requests": 377,
      "sources": 49,
      "last_seen": "2026-10-31"
    },
    {
      "id": "phpinfo",
      "requests": 767,
      "sources": 75,
      "last_seen": "2026-10-31"
    }
  ]
}