30 days, 50 servers: what a Spanish small-business website receives when nobody is watching

1What we measured and how

Hosteate Solutions hosts and manages servers for Spanish SMEs: restaurants, shops, law firms, agencies. Up to 24 October 2026 we read the local logs of 50 of those servers (29 running nginx, 13 Caddy and 8 other services), spread across data centres in the Netherlands and Madrid. None of them is a honeypot: they are production machines serving real websites.

Three sources, all local to each server: the web server access log (which paths each visitor requests and the response code), the SSH journal (failed login attempts) and the firewall log (connections rejected on closed ports). Each keeps what its rotation allows: the SSH journal covers a full 30 days; the firewall log, 26 days across all machines; and the web server log only 15 days (2026-10-10 to 2026-10-24), which is nginx's default retention. Daily web figures are computed over those 15 days, not 30. We did not touch any third-party system: everything reported here is what others did against our machines.

We call a probe a web request that ends in an error (400, 403, 404 or 405) and asks for a typical reconnaissance path (configuration files, admin panels, backups, shells), or arrives with a non-HTTP method, or comes from a known scanner. We discarded traffic from our own monitoring networks and from legitimate crawlers (Google, Bing, Apple…) even when they hit 404s. Source IPs were grouped by country and network using a public geolocation database; we publish no IP addresses and no customer names.

The aggregated data is available as a downloadable JSON and the collector logic is described at the end.

2The numbers

Probes do not come in waves: they come every day, weekends included. This is how they were spread over the 15 days with complete web logs:

Web probes per day, summed across the 50 servers.

3What they look for: secrets, not WordPress

Popular belief says bots go after WordPress. The data says otherwise: 88% of probes look for configuration files and forgotten backups. Target number one is the .env file, where Laravel, Node, Django and half of the modern web keep database passwords, Stripe keys and AWS credentials. They request it under 42 different path and suffix variants (.env.bak, .env.production, /api/.env…), adding up to 84,978 requests.

Probe families, as a share of the 147,628 probes with a classifiable path.

The fifteen most requested paths:

One detail that matters: 9,897 requests were not even HTTP. They are clients speaking TLS or RDP at port 80, the equivalent of trying every key on the ring in the first lock they see. 48,651 arrived with no identification at all (empty User-Agent), while 119,133 openly announced a scanner name (l9explore, libredtail-http, WebSiphon, "Go Web Pentest Tool"). They don't hide because they don't need to.

4SSH: the difference between closing it and not

Of the 50 servers, 48 have SSH closed to the Internet (reachable only over a private network) and 2 have it open. In 30 days the 48 closed ones received a combined 4 login attempts. A single open one received 18,712, from 54 distinct addresses, peaking at 14,763 in one day (2026-10-07).

It's not that the firewall isn't hit: it logged 305,221 rejected connections to port 22 across the fleet. It's that a closed port turns each of them into a log line instead of an opportunity.

The usernames tried are the usual ones. 66% of attempts target root and ubuntu:

And where they come from, by country of the source address (this measures where the attacking machine sits, usually another victim or a rented server, not who operates it):

By hour (Spanish mainland time), peaking at 21:00:

5What the firewall keeps out

6,256,557 rejected connections in 26 days across 49 servers: 4,911 per machine per day. The most-hit ports map what people leave open by accident: SSH, Telnet (a 1969 protocol still alive in routers and cameras), mail, Windows remote desktop, SIP telephony and printers.

Destination ports of rejected connections.

6Where web traffic comes from

Web probes come almost entirely from data centres, not from home connections: Google Cloud, Oracle Cloud, Microsoft Azure, DigitalOcean and a long tail of small server-rental providers. The country is the data centre's, so the map says more about where renting a machine is cheap than about who uses it. Part of the "United States" and "Netherlands" traffic also enters through Cloudflare, which fronts several of our sites.

Country of origin of the 378,056 probes whose most active addresses we could geolocate (82% of the total).

7What to do about it if you run a website

1. Leave nothing to read. .env, .git and backups must not live inside the public folder. With a modern framework the web root must be public/, not the whole project. Check it yourself by requesting https://your-site/.env: it must return 404 or 403, never content.
2. Close SSH to the Internet. If you manage the server from two or three places, restrict port 22 to those addresses or to a private network (Tailscale, WireGuard). It is the best effort-to-result measure on this list: from thousands of attempts to zero.
3. No passwords on SSH, keys only. And no direct root login. The two most tried users are root and ubuntu: make sure they are not a door.
4. Firewall closed by default. Open 80, 443 and what you actually use. Telnet, RDP, SIP and the printing port have no business on a web server.
5. Make the web server say nothing. Hide the version header, disable directory listings and return a clean 404 for what does not exist.
6. Look at the log once a month. You don't need a SIEM: counting how many 404s ask for .env is a grep. Being probed is not unusual; a 200 on one of those paths would be.

8Limitations of this study

These are 50 servers from a single operator in two data centres, so the sample is biased towards the way we build machines (SSH closed, default-deny firewall, nginx or Caddy). Web logs do not cover the 21 servers without a web server, nor anything beyond the 15 days kept by log rotation; SSH and firewall logs cover all 50. Probe paths and families are counted over all available web logs, which on a few machines reach somewhat further back. Probe classification is pattern-based and misses what it does not recognise: the real figure is higher, not lower. Geolocation is by IP address, done only on the 600 most active web addresses and all SSH ones, with a public database that carries the usual error of such databases. And on sites behind Cloudflare, the logged address is the proxy's when the server is not configured to restore the original.

The collector is a Python script that runs on the server itself, with no network access, reads /var/log/nginx or /var/log/caddy, the sshd journal and ufw.log, and returns counters only. If you want to replicate it on your machines or compare figures, write to us.