Most of your traffic is not a browser
One week of web honeypot traffic, grouped by the client that sent it. A hundred and eighty-five distinct user agent strings arrived, but a single Go HTTP library accounts for more than half of every request logged. Named scanning tools sit further down the list, and a large block sends no user agent at all. On an address with nothing hosted and no domain pointing at it, this is the resting state of the internet, not an attack.
More than half the web traffic hitting this server came from a single program, and it is not a browser.
An access log looks like visitors. Requests, pages, referrers. It reads like an audience showing up.
Group one week of it by the client that sent each request, and the shape changes. A hundred and eighty-five different clients knocked at the door.
The one at the top is a default HTTP library, the kind you get for free when you write a scanner and never bother to set a name. It alone accounts for more than half of everything logged.
Below it: a chunk that sends no client name at all, one commercial crawler, and named scanning tools further down.
Nothing is hosted here and no domain points at it. This is not an attack. This is the resting state of any address that exists.
Read your access log by client, not by page.
#linux#security#selfhosted#infosec#sysadmin
❯ Read your access log by client, not by page.