Server traffic

From 17 October 2026 at 00:02 through 30 October 2026, the web server on this machine logged 50,605 requests. Times are the server’s local time, UTC+3. The figures below were taken from the logs as retained just after midnight on 31 October 2026. By then, 13–16 October had rotated off the server, so this count replaces the earlier 13–26 October window. This note estimates how those requests split into probes, hack attempts, scrapes, and human visits.

One combined access log covers every site on the machine: divanov.eu, fourth.expedition.lu, layoffco.in, the stock nginx welcome page, and the redirect from plain HTTP to HTTPS. Each request sits in exactly one class. The four request counts sum to the whole log. Shares are rounded to one decimal place.

Probes are about four requests in five. Human-looking visits are 7.7%, scrapes 6.0%, and hack attempts 5.2%. The comparison is in requests, the unit the log records. A person who opens a page, its icon, and a stylesheet contributes one line per fetch, and so does a crawler.

Human visits, more tightly

The 7.7% row is every line whose user agent looked like a browser and whose path was an ordinary page. Inside those 3,887 lines:

• 535 are the stock nginx welcome page on the default site
• 733 are the short redirect from HTTP to HTTPS
• 1,137 are fingerprinted as divanov.eu
• 728 are fingerprinted as fourth.expedition.lu
• 86 are fingerprinted as layoffco.in
• 668 have no site fingerprint

Setting aside the welcome page and the redirect leaves 2,619 requests, 5.2% of the log. Of those, 1,951 (3.9% of the log) are tied to one of the three sites, and 668 stay unnamed.

Scanners copy Chrome, Firefox, and Safari strings. A browser-shaped user agent on a single fetch of the homepage can belong to a person, or to a scanner that asked for nothing else. The 5.2% share is an upper bound on human visits. The 3.9% share is the part of that bound that can be named as one of the three sites. The 668 unnamed lines may include people, and they may include scanners, and the log gives no further way to split them.

Among the human-looking lines the user agent was Chrome on 2,617, Firefox on 529, Chrome on Android on 310, Edge on 206, and Safari on iOS on 150. A Chrome label also sits on 11,837 probe lines, which is why the label on its own is a weak sign of a person.

How a line was classed

The class comes from the request line, the method, the status, the response size, and the user agent. The rules run in this order.

1. A TLS handshake sent to the HTTP port is a probe. There are 702 such lines. They are bytes on port 80 where an HTTP request would have been.
2. A hack attempt asks the server to read a file outside the site, run a command, open a known webshell path, accept an oversized body, or relay a connection onward (CONNECT, or SSTP).
3. A probe asks for a credential file, a hidden repository, a well-known admin console, or it carries a scanner’s own user agent, or a method this server does not serve. A scanner that receives the public homepage stays a probe.
4. A scrape is a known crawler, or a script client, on an ordinary path. One repeated mobile string, iPhone OS 13.2.3, is counted with the scrapes (631 lines).
5. A human-looking visit is a normal browser user agent on a real path. A browser-labelled fetch of robots.txt stays in this class (216 lines). Some of those are scanners.
6. Where one address sent at least eight requests, at least 60% of them probes or hack attempts, and it never fetched a real asset, its remaining human-looking lines were moved to probes.

Requests issued from the server itself while these logs were being measured are omitted. Lines from the Docker bridge address stay in the counts as separate requests. That address is a shared gateway.

The other user-agent piles, briefly. Scrapes include a mixed set of small clients (1,022), curl (193), PetalBot (172), and Googlebot (140), plus the iPhone OS 13.2.3 string above. Probes include Firefox (3,207), an empty user agent (2,860), WebSiphon (1,926), the Ruhr University scanner (1,882), and curl (1,444), along with the spoofed Chrome already mentioned. Hack attempts are mostly libredtail-http (1,291) or an empty user agent (532).

Across the whole log, whatever the class, the targets look like this. 24,809 lines are a path with an empty query string. 13,049 name a credential or source file. 4,125 name a PHP path. 2,518 look like WordPress. 1,941 carry some other query. 1,417 targets are exploit-shaped, and 973 ask for a remote command or a directory traversal. 690 name a known product console. 702 are the TLS handshakes on port 80. 366 are a language query. Thirteen queries are SQL-shaped and two try to place a script in the request. These counts add up to the same 50,605 requests. The class of each line still comes from the rules above.

Hack attempts

Of the 2,620 hack-class lines, 2,000 came back 404, 515 came back 400, 60 came back 301, 29 came back 405, 10 came back 413, and 6 came back 200.

The ten status-413 lines are POST bodies nginx refused as too large, from three addresses. Eight of them, about 1 MB each, are named divanov.eu in the error log. Two of them, about 10 MB each, hit the default server. The access-log size of those responses does not match a site fingerprint, which is why they sit in the unnamed row below.

All six status-200 lines were directory-traversal queries, and the body was a public page. Two received the gzipped divanov.eu homepage (2,341 bytes). Four received the 612-byte welcome page. The server returned that public page and ignored the query.

The paths cluster in a few families: PHPUnit eval-stdin paths, cgi-bin paths that traverse toward a shell, 191 CONNECT requests that try to open an outbound tunnel, 14 SSTP posts, and the oversized POSTs. In the access log, 2,539 of the 2,620 hack-class lines have no site fingerprint. Two are fingerprinted as divanov.eu. The bodies on the classed lines are a public page, a redirect, or an error page.

Which site

The combined log records the request line, the status, the response size, the referrer, and the user agent. The Host header is absent from this format, so the site name is inferred from the path and from a response size that matches one site.

The sizes used as fingerprints are the divanov.eu homepage, both before the articles link (7,953 bytes plain, 2,341 gzip) and after it went up on 27 October (8,323 plain, 2,386 gzip), the layoffco.in homepage (13,573 plain, 4,608 gzip), the fourth.expedition.lu homepage (3,837 plain, 1,581 gzip), the stock welcome page (612 plain, 396 gzip), and the redirect body (178 bytes). Paths under /misc, /img, /articles, and /games.html belong to divanov.eu. Expedition paths such as /programme, /mpa, and a successful /login belong to fourth.expedition.lu. A 162-byte 404 is the same body on more than one static site, so those probes stay unnamed. A 1,939-byte 404 is fourth.expedition.lu answering.

On the lines that can be named as divanov.eu, 2,917 are probes (57.8%), 1,137 are human-looking (22.5%), 994 are scrapes (19.7%), and 2 are hack attempts. That row is the named part. The unnamed row above it is where most probes sit, and many of those were likely aimed here as well. Eight of the oversized POSTs in the error log name divanov.eu, beyond the two hack-class lines the access log can fingerprint.

Browser-like clients that received status 200 on this site, over the same window:

The fourteen days

Human-looking traffic runs from 149 requests on 29 October to 664 on 30 October. Probe traffic peaks on 30 October (5,018), 17 October (4,542), and 20 October (4,245). The shape of the mix is the same on every day in the window: probes first, and the other three classes far behind.

What the estimate can support

The headline is the whole machine, for these fourteen days: 81.2% probes, 7.7% human-looking visits, 6.0% scrapes, and 5.2% hack attempts. The human-looking share is the upper bound from the rules above. 5.2% is that bound after the welcome page and the redirect hop are set aside. 3.9% is the part tied to a named site. Methods are mostly ordinary: 47,676 of the lines are GET and 1,495 are POST, with HEAD, CONNECT, the TLS handshakes, and a few odd verbs making up the rest.

A careful scanner and a person can send the same browser-labelled GET for /. Where that happens, the line is counted with the human-looking visits, and the true share of people is lower than 5.2%. Where a hack-class body was identified, it was a public page, a redirect, or an error page.