Server traffic

From 13 October 2026 at 00:01 through 26 October 2026, the web server on this machine logged 53,617 requests. Times are the server’s local time, UTC+3. The figures below were taken from the logs as retained on 27 October 2026. This note estimates how those requests split into probes, hack attempts, scrapes, and human visits.

One combined access log covers every site on the machine: divanov.eu, fourth.expedition.lu, layoffco.in, the stock nginx welcome page, and the redirect from plain HTTP to HTTPS. Each request sits in exactly one class. The four shares sum to the whole log. Shares are rounded to one decimal place.

Probes are about five requests in six. Hack attempts, human-looking visits, and scrapes are each about one request in twenty. The comparison is in requests, the unit the log records. A person who opens a page, its icon, and a stylesheet contributes one line per fetch, and so does a crawler.

Human visits, more tightly

The 6.1% row is every line whose user agent looked like a browser and whose path was an ordinary page. Inside those 3,264 lines:

• 564 are the stock nginx welcome page on the default site
• 560 are the short redirect from HTTP to HTTPS
• 816 are fingerprinted as divanov.eu
• 634 are fingerprinted as fourth.expedition.lu
• 77 are fingerprinted as layoffco.in
• 613 have no site fingerprint

Setting aside the welcome page and the redirect leaves 2,140 requests, 4.0% of the log. Of those, 1,527 (2.8% of the log) are tied to one of the three sites, and 613 stay unnamed.

Scanners copy Chrome, Firefox, and Safari strings. A browser-shaped user agent on a single fetch of the homepage can belong to a person, or to a scanner that asked for nothing else. The 4.0% share is an upper bound on human visits. The 2.8% share is the part of that bound that can be named as one of the three sites. The 613 unnamed lines may include people, and they may include scanners, and the log gives no further way to split them.

Among the human-looking lines the user agent was Chrome on 2,178, Firefox on 424, Edge on 222, Chrome on Android on 189, and Safari on 149. A Chrome label also sits on 10,067 probe lines, which is why the label on its own is a weak sign of a person.

How a line was classed

The class comes from the request line, the method, the status, the response size, and the user agent. The rules run in this order.

1. A TLS handshake sent to the HTTP port is a probe. There are 671 such lines. They are bytes on port 80 where an HTTP request would have been.
2. A hack attempt asks the server to read a file outside the site, run a command, open a known webshell path, accept an oversized body, or relay a connection onward (CONNECT, or SSTP).
3. A probe asks for a credential file, a hidden repository, a well-known admin console, or it carries a scanner’s own user agent, or a method this server does not serve. A scanner that receives the public homepage stays a probe.
4. A scrape is a known crawler, or a script client, on an ordinary path. One repeated mobile string, iPhone OS 13.2.3, is counted with the scrapes (610 lines).
5. A human-looking visit is a normal browser user agent on a real path. A browser-labelled fetch of robots.txt stays in this class (185 lines). Some of those are scanners.
6. Where one address sent at least eight requests, at least 60% of them probes or hack attempts, and it never fetched a real asset, its remaining human-looking lines were moved to probes.

Requests issued from the server itself while these logs were being measured are omitted. Lines from the Docker bridge address stay in the counts as separate requests. That address is a shared gateway.

The other user-agent piles, briefly. Scrapes include a mixed set of small clients (1,006), curl (183), PetalBot (174), and Googlebot (173), plus the iPhone OS 13.2.3 string above. Probes include an empty user agent (6,833), curl (4,446), the Ruhr University scanner (2,770), and WebSiphon (1,926), along with the spoofed Chrome already mentioned. Hack attempts are mostly libredtail-http (1,864) or an empty user agent (511).

Across the whole log, whatever the class, the targets look like this. 24,760 lines are a path with an empty query string. 12,765 name a credential or source file. 6,939 name a PHP path. 3,099 look like WordPress. 841 name a known product console. 1,967 targets are exploit-shaped, and 906 ask for a remote command or a directory traversal. Twelve queries are SQL-shaped and two try to place a script in the request. Those last shapes are descriptions of the text in the log. The class of the line still comes from the rules above, so the rows here are a second cut through the same 53,617 requests.

Hack attempts

Of the 3,062 hack-class lines, 2,498 came back 404, 464 came back 400, 42 came back 405, 42 came back 301, 10 came back 413, and 6 came back 200.

The ten status-413 lines are POST bodies nginx refused as too large, about 1 MB each, all from one address. The access log does not fingerprint their site. The error log names divanov.eu as the host for them.

Five of the six status-200 lines were directory-traversal queries, and the body was a public page. Two received the gzipped divanov.eu homepage (2,341 bytes). Three received the 612-byte welcome page. The server returned that public page and ignored the query. One further status-200 line is in this class; only its status was identified.

The paths cluster in a few families: PHPUnit eval-stdin paths, cgi-bin paths that traverse toward a shell, and 155 CONNECT requests that try to open an outbound tunnel, plus the oversized POSTs. In the access log, 3,011 of the 3,062 hack-class lines have no site fingerprint. Three are fingerprinted as divanov.eu. The bodies on the classed lines are a public page, a redirect, or an error page.

Which site

The combined log records the request line, the status, the response size, the referrer, and the user agent. The Host header is absent from this format, so the site name is inferred from the path and from a response size that matches one site.

The sizes used as fingerprints are the divanov.eu homepage (7,953 bytes plain, 2,341 gzip), the layoffco.in homepage (13,573 plain, 4,608 gzip), the fourth.expedition.lu homepage (3,837 plain, 1,581 gzip), the stock welcome page (612 plain, 396 gzip), and the redirect body (178 bytes). Paths under /misc, /img, and /games.html belong to divanov.eu. Expedition paths such as /programme, /mpa, and a successful /login belong to fourth.expedition.lu. A 162-byte 404 is the same body on more than one static site, so those probes stay unnamed. A 1,939-byte 404 is fourth.expedition.lu answering.

On the lines that can be named as divanov.eu, 3,729 are probes (69.2%), 839 are scrapes (15.6%), 816 are human-looking (15.1%), and 3 are hack attempts. That row is the named part. The unnamed row above it is where most probes sit, and many of those were likely aimed here as well. The ten oversized POSTs in the error log are a separate sign that hack-class traffic did reach divanov.eu beyond those three access-log lines.

Browser-like clients that received status 200 on this site, over the same window:

The fourteen days

Human-looking traffic stays between 164 and 363 requests a day. Probe traffic peaks on 16 October (5,441), 17 October (4,716), and 20 October (4,245). The shape of the mix is the same on every day in the window: probes first, and the other three classes far behind.

What the estimate can support

The headline is the whole machine, for these fourteen days: 82.8% probes, 5.7% hack attempts, 5.4% scrapes, and 6.1% human-looking visits. The human-looking share is the upper bound from the rules above. 4.0% is that bound after the welcome page and the redirect hop are set aside. 2.8% is the part tied to a named site. Methods are mostly ordinary: 51,210 of the lines are GET and 1,348 are POST, with HEAD, CONNECT, the TLS handshakes, and a few odd verbs making up the rest.

A careful scanner and a person can send the same browser-labelled GET for /. Where that happens, the line is counted with the human-looking visits, and the true share of people is lower than 4.0%. Where a hack-class body was identified, it was a public page, a redirect, or an error page.