What Attacks an Internet-Facing Server: October 2026
In October 2026, 1,584 addresses made 41,780 failed SSH login attempts against one small production server — about 1,300 a day — and 63% of them came from a single hosting network (AS198364, BANATSYNC SRL). Over the same period, 3,754 addresses sent 60,577 unsolicited HTTP requests; the most common target was leaked .env files (23% of requests), and 14% claimed to be Googlebot without coming from Google’s network. 20% of all source addresses were already in LogTriage’s threat-intelligence ranges — and they produced 55% of the attack traffic.
Every number comes from the logs of LogTriage's own production API server: SSH for the full window, web traffic for the full window. Published 1 Nov 2026. Methodology · Download the data (JSON)
Key findings
- “root” was the most-tried SSH username: 32% of all attempts, from 339 different addresses. Attackers tried 5,201 distinct usernames in total.
- 68% of SSH password guesses targeted accounts that do not exist on the server — wordlist spraying, not targeting.
- SSH guessing never stops: the busiest hour was 15:00 UTC, and even the quietest hour of the day averaged 15 attempts.
- 8,449 web probes (14%) used Googlebot’s user agent from 11 addresses outside Google’s published crawler ranges; genuine Googlebot sent 14.
- Self-identified research and attack-surface scanners (Censys, LeakIX, Palo Alto Xpanse and others) accounted for 12% of web probes — the rest did not say who they were.
- 46% of web probes went straight to the server’s raw IP address, bypassing the CDN in front of the domain (a lower bound — see methodology).
- 2,931 connections to the web ports were not HTTP at all: TLS handshakes sent to port 80 (1,870), SOCKS proxy handshakes (496), Remote Desktop connection requests (59), HTTP/2 cleartext prefaces (53).
- No SQL injection or Log4Shell strings appeared in any request line, user agent or referer: blind internet-wide scanning looks for exposed files and known exploits, not injectable parameters.
- By number of addresses the top sources were United States (32%), Netherlands (10%), United Kingdom (8.3%) — mostly cloud and hosting networks: Google LLC (433 addresses), DigitalOcean, LLC (432 addresses), Microsoft Corporation (409 addresses).
Attacks per day
Two charts, each on its own scale.
Show the daily numbers as a table
| Date (UTC) | Failed SSH logins | Unsolicited web requests |
|---|---|---|
| 2026-10-01 | 7,543 | 1,067 |
| 2026-10-02 | 4,696 | 1,088 |
| 2026-10-03 | 7,691 | 1,023 |
| 2026-10-04 | 8,016 | 2,315 |
| 2026-10-05 | 7,708 | 1,115 |
| 2026-10-06 | 6,126 | 850 |
| 2026-10-07 | 0 | 873 |
| 2026-10-08 | 0 | 880 |
| 2026-10-09 | 0 | 1,904 |
| 2026-10-10 | 0 | 695 |
| 2026-10-11 | 0 | 4,724 |
| 2026-10-12 | 0 | 4,155 |
| 2026-10-13 | 0 | 2,036 |
| 2026-10-14 | 0 | 1,755 |
| 2026-10-15 | 0 | 1,469 |
| 2026-10-16 | 0 | 1,022 |
| 2026-10-17 | 0 | 1,093 |
| 2026-10-18 | 0 | 3,350 |
| 2026-10-19 | 0 | 2,639 |
| 2026-10-20 | 0 | 3,317 |
| 2026-10-21 | 0 | 3,592 |
| 2026-10-22 | 0 | 1,514 |
| 2026-10-23 | 0 | 2,743 |
| 2026-10-24 | 0 | 2,539 |
| 2026-10-25 | 0 | 1,317 |
| 2026-10-26 | 0 | 2,680 |
| 2026-10-27 | 0 | 1,883 |
| 2026-10-28 | 0 | 1,274 |
| 2026-10-29 | 0 | 998 |
| 2026-10-30 | 0 | 1,601 |
| 2026-10-31 | 0 | 3,066 |
Busiest hour of the day (UTC): 15:00 for SSH (3,434 attempts across the window) and 20:00 for web probes (7,386 requests).
What the web probes were looking for
Unsolicited requests by attack category, with the share of all 60,577 unsolicited requests. One request can match more than one category.
- .env files 13,731 · 23%
204 addresses
- WordPress & PHP apps 8,105 · 13%
290 addresses
- Config, backup & build files 6,399 · 11%
252 addresses
- Command injection & RCE payloads 3,909 · 6.5%
135 addresses
- Non-HTTP protocol probes (TLS, SOCKS, RDP…) 2,931 · 4.8%
492 addresses
- Cloud & SSH credentials, instance metadata 2,652 · 4.4%
73 addresses
- Source-control exposure (.git, .svn) 1,896 · 3.1%
153 addresses
- Router, camera & IoT exploits 943 · 1.6%
208 addresses
- Spring actuator & Java/enterprise apps 875 · 1.4%
247 addresses
- Path traversal 754 · 1.2%
132 addresses
- Open-proxy checks (CONNECT, absolute URLs) 573 · 0.9%
42 addresses
- VPN gateways, firewalls & Exchange 362 · 0.6%
123 addresses
- AI services: MCP/LLM endpoints & AI API keys 315 · 0.5%
180 addresses
- API discovery (Swagger, GraphQL) 175 · 0.3%
38 addresses
- Docker & Kubernetes APIs 143 · 0.2%
91 addresses
Not seen at all: Log4Shell / JNDI injection, SQL injection.
What each category means
- .env files
- Requests for .env and its variants (.env.production, .env.bak, /app/.env…). Frameworks keep database passwords and API keys there, so one exposed file is a complete credential dump.
- WordPress & PHP apps
- Login and admin pages, phpinfo(), the PHPUnit eval-stdin.php RCE (CVE-2017-9841) — sprayed at every server whether or not it runs PHP.
- Config, backup & build files
- config.json, docker-compose.yml, .gitlab-ci.yml, package.json, database dumps and archive files — anything that might hold secrets or reveal the stack.
- Command injection & RCE payloads
- Requests that carry a command to run: /bin/sh through the Apache path-traversal bugs (CVE-2021-41773/42013), PHP-CGI argument injection (CVE-2024-4577), PHPUnit eval-stdin.php, wget/curl droppers.
- Non-HTTP protocol probes (TLS, SOCKS, RDP…)
- Bytes that are not HTTP at all, sent to the web ports: TLS handshakes on port 80, SOCKS and RDP handshakes, HTTP/2 prefaces, crypto-mining pool logins, SIP.
- Cloud & SSH credentials, instance metadata
- AWS credential files (/.aws/credentials), SSH private keys, kubeconfigs, Terraform state, secrets.json and cloud instance-metadata endpoints.
- Source-control exposure (.git, .svn)
- /.git/config, /.git/HEAD and friends. A readable .git directory lets an attacker rebuild the whole source tree, history and any committed secrets.
- Router, camera & IoT exploits
- /cgi-bin/, /boaform, /HNAP1, Hikvision /SDK/webLanguage (CVE-2021-36260) and other embedded-device exploits, fired blindly at any IP that answers on port 80.
- Spring actuator & Java/enterprise apps
- Spring Boot actuator endpoints (/actuator/env, /heapdump), Tomcat manager, GeoServer, Atlassian and SAP NetWeaver paths (/developmentserver/metadatauploader, CVE-2025-31324).
- Path traversal
- ../ sequences — often double-encoded (%%32%65) — trying to escape the web root and read /etc/passwd or run /bin/sh.
- Open-proxy checks (CONNECT, absolute URLs)
- CONNECT requests and absolute URLs asking the server to fetch someone else’s site — testing whether it can be abused as a proxy.
- VPN gateways, firewalls & Exchange
- Fortinet, Cisco ASA, Ivanti/Pulse, Palo Alto GlobalProtect, Citrix and Exchange login paths — the edge appliances behind most recent mass-exploitation waves.
- AI services: MCP/LLM endpoints & AI API keys
- Model Context Protocol (/mcp, /sse), Ollama and OpenAI-style APIs (/api/tags, /v1/models) and files like .env.anthropic — hunting for exposed AI agents and API keys.
- API discovery (Swagger, GraphQL)
- Swagger, OpenAPI and GraphQL endpoints — a map of every route an API exposes.
- Docker & Kubernetes APIs
- An exposed Docker socket (/containers/json) or kubelet is instant remote code execution; scanners check every address for one.
- Log4Shell / JNDI injection
- ${jndi:…} strings (CVE-2021-44228) in the request line, user agent or referer.
- SQL injection
- UNION SELECT, OR 1=1, time-based sleep() and similar payloads in the URL.
The 25 most-requested paths
Query strings dropped; IDs and embedded IP addresses replaced with placeholders. The site root and crawler housekeeping files (/robots.txt, /favicon.ico…) are left out.
- /.env 1,105
160 addresses · .env files
- /SDK/webLanguage 467
7 addresses · Router, camera & IoT exploits
- /index.php 451
86 addresses · WordPress & PHP apps
- /.git/config 329
140 addresses · Source-control exposure (.git, .svn)
- /.env.production 170
68 addresses · .env files
- /.env.save 170
65 addresses · .env files
- /.env.bak 168
63 addresses · .env files
- /.env.local 165
67 addresses · .env files
- /admin/config.php 155
39 addresses · WordPress & PHP apps
- /.env.backup 153
61 addresses · .env files
- /api/.env 151
59 addresses · .env files
- /.aws/credentials 134
42 addresses · Cloud & SSH credentials, instance metadata
- /app/.env 130
51 addresses · .env files
- /.env.prod 124
55 addresses · .env files
- /backend/.env 124
51 addresses · .env files
- /phpinfo.php 120
55 addresses · WordPress & PHP apps
- /.env.example 119
45 addresses · .env files
- /config/.env 118
45 addresses · .env files
- /.env.old 116
58 addresses · .env files
- /config.json 111
37 addresses · Config, backup & build files
- /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 111
74 addresses · Command injection & RCE payloads
- /.git/HEAD 110
42 addresses · Source-control exposure (.git, .svn)
- /.env.dev 107
45 addresses · .env files
- /.env.development 107
48 addresses · .env files
- /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh 107
86 addresses · Command injection & RCE payloads
Who sends them: tools by user agent
Unsolicited web requests grouped by the client's self-reported user agent. A Googlebot claim counts as genuine only from Google's published crawler ranges.
- Browser-like UA (real or spoofed) 25,985 · 43%
1,885 addresses
- Fake Googlebot (spoofed UA) 8,449 · 14%
11 addresses
- Research & attack-surface scanners (Censys, LeakIX…) 7,173 · 12%
633 addresses
- curl 4,914 · 8.1%
99 addresses
- No user agent 4,898 · 8.1%
828 addresses
- libredtail-http (RedTail botnet) 3,751 · 6.2%
67 addresses
- Other 2,379 · 3.9%
83 addresses
- Go-http-client 1,636 · 2.7%
111 addresses
- ZGrab 489 · 0.8%
343 addresses
- Other self-identified scanners 344 · 0.6%
48 addresses
- AI crawlers (ClaudeBot, GPTBot…) 262 · 0.4%
47 addresses
- python-requests 109 · 0.2%
71 addresses
- Search & SEO crawlers 60 · 0.1%
28 addresses
- Python (urllib, aiohttp, httpx…) 58 · 0.1%
21 addresses
- masscan 21 · <0.1%
19 addresses
- Nmap 17 · <0.1%
17 addresses
- Googlebot (verified) 14 · <0.1%
6 addresses
- Headless browsers 10 · <0.1%
5 addresses
- Exploit PoC scripts (CVE-named UA) 4 · <0.1%
2 addresses
- Java HTTP clients 3 · 0%
2 addresses
- Node.js clients (axios, node-fetch…) 1 · 0%
1 addresses
SSH brute force: the usernames tried
The 20 most-tried usernames out of 5,201 distinct ones, counted per failed attempt. 68% of all attempts named an account that does not exist on the server.
- root 13,164
339 addresses
- admin 1,340
135 addresses
- ubuntu 814
128 addresses
- user 480
96 addresses
- debian 293
59 addresses
- test 205
71 addresses
- logtriage 157
1 addresses
- deploy 153
39 addresses
- ftpuser 146
62 addresses
- oracle 119
45 addresses
- administrator 115
36 addresses
- postgres 112
44 addresses
- dev 90
44 addresses
- solana 89
15 addresses
- git 87
40 addresses
- user1 87
39 addresses
- developer 85
32 addresses
- testuser 78
51 addresses
- app 77
28 addresses
- mysql 77
40 addresses
Where it comes from
Countries ranked by number of attacking addresses rather than by volume, so a single noisy host cannot top the list. Attribution covers 100% of addresses.
Top countries
- United States 1,709 · 32%
8,197 web requests · 808 SSH attempts
- Netherlands 533 · 10%
6,193 web requests · 30,229 SSH attempts
- United Kingdom 443 · 8.3%
2,066 web requests · 2 SSH attempts
- China 342 · 6.4%
836 web requests · 792 SSH attempts
- Germany 336 · 6.3%
9,534 web requests · 417 SSH attempts
- Belgium 205 · 3.9%
599 web requests · 25 SSH attempts
- Brazil 146 · 2.8%
507 web requests · 151 SSH attempts
- Singapore 145 · 2.7%
1,288 web requests · 311 SSH attempts
- South Korea 129 · 2.4%
526 web requests · 327 SSH attempts
- Hong Kong SAR China 127 · 2.4%
384 web requests · 343 SSH attempts
- France 108 · 2%
6,016 web requests · 78 SSH attempts
- Japan 93 · 1.8%
452 web requests · 11 SSH attempts
- India 88 · 1.7%
383 web requests · 356 SSH attempts
- Taiwan 70 · 1.3%
147 web requests · 121 SSH attempts
- Indonesia 68 · 1.3%
293 web requests · 365 SSH attempts
The heaviest networks by volume
Volume is far more concentrated than addresses: a handful of hosting networks produce most of the traffic.
| Network | Addresses | SSH attempts | Web requests |
|---|---|---|---|
| BANATSYNC SRLAS198364 | 108 | 26,21263% | 15<0.1% |
| TC DATACENTER LIMITEDAS218785 | 22 | 00% | 7,37512% |
| TECHOFF SRV LIMITEDAS48090 | 32 | 3,4278.2% | 2,8964.8% |
| Bucklog SARLAS211590 | 6 | 00% | 5,1698.5% |
| Google LLCAS396982 | 433 | 14<0.1% | 3,8876.4% |
Top networks by number of addresses
- Google LLC (AS396982) 433 · 8.2%
3,887 web requests · 14 SSH attempts
- DigitalOcean, LLC (AS14061) 432 · 8.1%
1,578 web requests · 176 SSH attempts
- Microsoft Corporation (AS8075) 409 · 7.7%
588 web requests · 204 SSH attempts
- Hydra Communications Ltd (AS25369) 367 · 6.9%
441 web requests · 0 SSH attempts
- Tencent Building, Kejizhongyi Avenue (AS132203) 325 · 6.1%
821 web requests · 100 SSH attempts
- Hurricane Electric LLC (AS6939) 128 · 2.4%
318 web requests · 0 SSH attempts
- Alibaba (US) Technology Co., Ltd. (AS45102) 121 · 2.3%
428 web requests · 1 SSH attempts
- Akamai Connected Cloud (AS63949) 120 · 2.3%
1,196 web requests · 0 SSH attempts
- BANATSYNC SRL (AS198364) 108 · 2%
15 web requests · 26,212 SSH attempts
- Oracle Corporation (AS31898) 97 · 1.8%
2,646 web requests · 181 SSH attempts
- Amazon.com, Inc. (AS14618) 92 · 1.7%
122 web requests · 0 SSH attempts
- UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED (AS135377) 91 · 1.7%
364 web requests · 183 SSH attempts
- Censys, Inc. (AS398324) 82 · 1.5%
310 web requests · 0 SSH attempts
- CHINANET BACKBONE (AS4134) 59 · 1.1%
34 web requests · 102 SSH attempts
- Korea Telecom (AS4766) 58 · 1.1%
134 web requests · 260 SSH attempts
How the traffic reached the server
The API's domain sits behind Cloudflare, but the server's IP address is reachable directly, and scanners sweep every IPv4 address. 28,011 unsolicited requests (46%) provably went straight to the raw IP — port-80 hits, connections nginx rejected itself, and requests naming the IP; the other 32,566 arrived over HTTPS, through Cloudflare or straight to the IP (the log format does not record which).
| TLS handshake sent to the plain-HTTP port | 1,870 |
| SOCKS proxy handshake | 496 |
| Other non-HTTP or malformed bytes | 317 |
| Connection opened, nothing sent | 68 |
| Remote Desktop (RDP) connection request | 59 |
| HTTP/2 cleartext preface | 53 |
| SSTP VPN handshake | 34 |
| SSH banner sent to a web port | 20 |
| Crypto-mining pool (Stratum) handshake | 8 |
| SIP / VoIP request | 6 |
What this means for defenders
Each finding maps to a free, validated Sigma rule you can drop into your SIEM.
About 1,300 password guesses a day reached one ordinary small server, 68% of them for accounts that do not exist. Use key-only SSH, and alert on failure bursts and invalid-user enumeration rather than on single failures.
Rule: Detect SSH Brute Force and User Enumeration in Linux auth.log →
39% of web probes came from scripted clients and scanners or sent no user agent at all — and most of the rest claimed to be a browser or Googlebot. A scripted client is normal on an API; one probing admin and auth routes is not.
Rule: Detect Vulnerability Scanners and Scripted Clients Hitting Admin/Auth Endpoints →
23% of probes asked for .env files, 3.1% for .git metadata and 1.2% tried path traversal. Make sure none of these can ever be served, and treat a burst of 404s for them as reconnaissance.
Rule: Detect Path Traversal & Sensitive-File Recon →
3,909 requests carried a remote-code-execution payload and 943 targeted router, camera and CGI exploits — the automated first step of exploitation. Network-level HTTP logs catch them even where no application log exists.
Rule: Detect Web Attack Recon and SQL Injection in Zeek HTTP Logs →
Blind internet-wide scanners sent no SQL injection this period: SQLi appears once someone targets your real parameters, which makes it a high-signal alert in your own access logs.
Rule: Detect SQL Injection and Follow-on Data Exfiltration in nginx Access Logs →
Want the same picture for your own server? Drop an access log or auth.log into the free in-browser log analyzer.
Open the free log analyzer →
Would a free blocklist have stopped these attackers? We measure 17 of them against the same server's attackers every month.
Read the IP blocklist report →
Methodology
What was measured. Every request that reached nginx on ports 80 and 443 of LogTriage's API server (a small cloud VM that serves only a JSON API), and every failed SSH login recorded by sshd. A script on the server aggregates the logs once a month and publishes only the totals on this page. Window: 1 Oct – 31 Oct 2026 (SSH for the full window, web traffic for the full window).
Unsolicited vs. legitimate. Requests to LogTriage's real API routes (517 in this window) count as legitimate unless they carry an attack payload; everything else — 60,577 requests — is unsolicited. That includes research scanners such as Censys, which are shown separately under tools.
Our own traffic is excluded: uptime monitoring and synthetic-customer checks (26,282 requests), the server's own addresses, and any address that logged in over SSH with our key during the window (42 operator addresses).
Cloudflare. api.logtriage.app is proxied through Cloudflare. nginx restores each visitor's real address from Cloudflare's CF-Connecting-IP header and trusts that header only from Cloudflare's published ranges, so the addresses counted here are the true clients either way; any address inside Cloudflare's own ranges is excluded rather than counted as an attacker (9 requests). Requests that provably bypassed Cloudflare — port-80 hits on the raw IP, connections nginx rejected itself (non-HTTP bytes, plain HTTP on the TLS port, malformed URLs) and requests naming the IP — are counted as direct; the rest may have come either way, because the default log format does not record the connecting peer. Requests that Cloudflare blocked at its edge never reach the server and are not counted.
SSH. A failed attempt is one "Failed password" (or publickey / keyboard-interactive) event from sshd in the systemd journal; one connection can make several. Usernames are counted per attempt.
Categories and tools. Categories are matched on the URL-decoded request target (and, for Log4Shell, the user agent and referer); a request can match several. Tool families come from the user agent, which clients choose themselves — hence the Googlebot check against Google's published ranges.
Countries and networks come from ipinfo.io, looked up once per /24 network (IPv4) or /48 (IPv6) — 3,468 networks, covering 100% of addresses and 100% of events.
Threat intel. "Already in our threat intel" means the address falls inside one of the 5,212 IP ranges LogTriage uses to enrich customer logs (Spamhaus DROP, FireHOL level 1, Tor exits and ranges from confirmed incident investigations). Those addresses produced 80% of SSH attempts and 37% of web probes.
Privacy. Only aggregates are published. No individual IP address appears on this page or in the data file, and addresses embedded in requested paths are replaced with <ip>.
Caveats for this edition
- The server's log format does not record whether an HTTPS request arrived through Cloudflare, so only provably direct-to-IP requests are split out; client addresses are the true ones either way.
- Only the request line, user agent and referer are logged: payloads in other headers or request bodies (a common place for Log4Shell strings) are invisible here.
- Requests that Cloudflare's edge blocked before they reached the server are not counted.
Get the data
- Download: /reports/server-attacks/2026-10.json (JSON — every number on this page)
- License: Creative Commons Attribution 4.0 — reuse freely, with a link back.
- Cite as: LogTriage, “What Attacks an Internet-Facing Server: October 2026,” 1 Nov 2026, https://logtriage.app/reports/server-attacks/2026-10/
Other editions
Part of the monthly server attack report series — a new edition is published at the start of every month.
Find these attacks in your own logs
LogTriage reads nginx, auth.log and 51 other log formats, enriches every source against threat intelligence and writes an analyst-grade report in minutes. Try the live demo — no signup.