Explore the data

What attack traffic, edge filtering, and real reader visits look like against a personal site running production-grade infrastructure. Data refreshes about every 10 minutes.

How this system works →

1,266 hostile events for every legitimate pageview, last 30 days.

← Back to site

Events tracked

169,697

Sep 2 - Oct 2

Canary triggers

6,035

Hidden-link / fake-env hits

Trap endpoints

101,413

/admin, /wp-login, .env, etc.

Countries

104

from 1,295 sources

Source IPs are redacted to /24 (IPv4) or /48 (IPv6) before materialization. Raw IPs are never stored or displayed.

The contrast

Attacker volume, edge requests, and real pageviews on one scale.

THE CONTRAST

Hostile vs. legitimate traffic

1,266 hostile events for every legitimate pageview, last 30 days.

Hostile events

169,697

Canary + trap hits

Edge requests

669,056

Cloudflare sampled

Legit pageviews

134

99 unique visitors

THE CONTRAST

Hostile vs. legitimate traffic

Attack traffic

Bots and scanners hitting decoy endpoints. /.env, /admin, /wp-login, and dozens of other canary and trap paths.

ATTACK ORIGIN

Attackers by country

Hostile traffic origin, last 30 days (48 country codes not mapped)

Top 10 countries by hostile traffic in the current window
Rank	Country	Hits
1	India	30,882
2	Singapore	8,968
3	Pakistan	8,819
4	Brazil	6,426
5	Indonesia	4,695
6	United States	4,155
7	Finland	3,256
8	Philippines	2,839
9	Canada	1,780
10	Bangladesh	1,579

ATTACK ORIGIN

Attackers by country

CANARIES

Canary trigger timeline

Canary hits per hour, last 7 days

CANARIES

Canary trigger timeline

ATTACK PATHS

Top attacked paths

Most-hit canary and trap endpoints

ATTACK PATHS

Top attacked paths

USER AGENTS

Top hostile user agents

Most-seen UA fragments in canary and trap hits

USER AGENTS

Top hostile user agents

TIMING

When attackers strike

Day-of-week x hour-of-day heatmap, UTC

Sun

Mon

Tue

Wed

Thu

Fri

Sat

Less

More(max 1708)

Hover a cell for detail

TIMING

When attackers strike

DECEPTION

LLM-generated responses

Paths answered by the Galah adaptive module

/xmlrpc.phpceilingedLast seen 10/2/2026, 3:06:52 AM
79513660 src
/xmlrpc.php<?xml version="1.0" encoding="UTF-8"?> <methodResponse> <fault> <value> <struct> <member> <name>faultCode</name> <value><int>403</int></value> </member> <member> <name>faultString</name> <value><strinLast seen 10/2/2026, 3:05:07 AM
9565443 src
/aZ9xQ7kL3mceilingedLast seen 9/22/2026, 6:54:22 PM
62213 src
/aZ9xQ7kL3mAccess Restricted Access Restricted The page you requested is protected and requires authentication.Last seen 9/13/2026, 1:19:32 AM
52110 src
/.git/HEADref: refs/heads/mainLast seen 10/2/2026, 1:11:44 AM
39139 src
/.env.local# Environment configuration DATABASE_URL="postgres://user:pass@localhost:5432/dbname" API_KEY="12345-abcdef-67890-ghijk" NODE_ENV="production" SECRET_TOKEN="s3cr3t_t0k3n_value" PORT=8080 # Note: For aLast seen 9/13/2026, 1:19:34 AM
33518 src
/.env.production# This file is not accessible for security reasons. # If you found this, try /admin/login for a legitimate access point. APP_ENV=production APP_DEBUG=false APP_KEY=base64:Wm9uZVBsYWNlaG9sZGVyS2V5MTIzNLast seen 9/13/2026, 1:19:43 AM
29715 src
/.dev.vars# Development Environment Variables # Database DB_HOST=localhost DB_USER=dev_user DB_PASS=dev_password123 # API Keys API_KEY=devapikey987654321 API_SECRET=devapisecret123456 # Misc NODE_ENV=developmenLast seen 9/13/2026, 1:19:41 AM
29310 src
/config.json{"database":{"host":"db.galah.internal","port":5432,"user":"admin_user","password":"S3cur3P@ssw0rd!","name":"personal_site_db"},"apiKeys":{"googleMaps":"AIzaSyD4m0Fak3G00gl3K3y12345","sendGrid":"SG.faLast seen 9/13/2026, 1:19:38 AM
2919 src
/.env.backup# Example environment backup file - DO NOT USE IN PRODUCTION DB_HOST=localhost DB_PORT=3306 DB_USER=admin_user DB_PASS=supersecretpassword123 API_KEY=AKIAIOSFODNN7EXAMPLE SESSION_SECRET=7e8f9g0h1i2j3kLast seen 9/13/2026, 1:19:43 AM
28810 src
/wrangler.tomlname = "galah-wrangler" account_id = "1234567890abcdef" workers_dev = true route = "" [vars] API_KEY = "fakeApiKey1234567890" SECRET_TOKEN = "secretTokenHere" # Note: Check /admin/dashboard for more eLast seen 9/13/2026, 1:19:40 AM
2849 src
/actuator/envAccess to environment variables is denied.Last seen 9/13/2026, 1:19:47 AM
26610 src
/.env.dev# Environment configuration file - DO NOT SHARE PORT=3000 DB_HOST=localhost DB_PORT=5432 DB_USER=devuser DB_PASS=devpassword123 API_KEY=devapikey_9876543210 SECRET_TOKEN=devsecret_abcdef123456 # Hint:Last seen 9/13/2026, 1:19:48 AM
25610 src
/config.php<?php // WARNING: Do not expose this file publicly // Database configuration - please edit with care define('DB_NAME', 'wp_personal_site'); define('DB_USER', 'wp_admin'); define('DB_PASSWORD', 'S3cur3Last seen 9/13/2026, 1:19:45 AM
2519 src
/.env.save# Environment Configuration - DO NOT SHARE DATABASE_URL=postgresql://admin_user:Sup3rS3cretP@ssw0rd@dbserver.example.com:5432/production_db API_KEY=AIzaSyD9_fakeAPIkey1234567890 SESSION_SECRET=8f7e6d5Last seen 9/13/2026, 1:19:50 AM
25010 src
/.env.staging# Environment configuration NODE_ENV=staging PORT=3000 DB_HOST=staging-db.internal DB_PORT=5432 DB_USER=staging_user DB_PASS=F4k3St@g1nG_P@ssw0rd! API_KEY=staging_api_key_1234567890abcdef AWS_ACCESS_KLast seen 9/13/2026, 1:19:49 AM
25010 src
/secrets.json{"apiKey":"f3c9b2d4-7a1e-4a2f-9a4e-3b2d1c6e5f7a","dbPassword":"P@ssw0rd123!","sshPrivateKey":"-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAr2JiySdFhF8q5oXw/0J1vYp2W08vG7HylM0E3V9z8Q2o5h+\n+W8v3zfHLast seen 9/13/2026, 1:19:46 AM
2438 src
/.env.development# Development Environment Configuration DATABASE_URL="postgresql://devuser:DevPass123!@localhost:5432/devdb" API_KEY="dev-abc123xyz789" JWT_SECRET="devJwtSecretKey987654321" SMTP_HOST="smtp.devmail.exLast seen 9/13/2026, 1:19:32 AM
23812 src
/.docker/config.json{"error":"Not Found","message":"The requested resource '/.docker/config.json' was not found on this server.","status":404,"timestamp":"2024-06-14T12:34:56Z"}Last seen 9/13/2026, 1:19:47 AM
2347 src
/.vscode/sftp.json{ "host": "sftp.example.com", "username": "techadmin", "remotePath": "/var/www/html", "port": 22, "privateKeyPath": "~/.ssh/id_rsa", "uploadOnSave": true }Last seen 9/13/2026, 1:19:48 AM
23010 src

DECEPTION

LLM-generated responses

Edge

What Cloudflare filters before requests reach the origin.

EDGE ORIGIN

Edge traffic by country

Where edge requests originate, last 30 days (69 unmapped)

Top 10 countries by edge request volume in the current window
Rank	Country	Requests
1	United States	213,441
2	Singapore	104,808
3	India	70,401
4	Netherlands	28,977
5	Finland	25,831
6	Belgium	25,456
7	Brazil	24,232
8	Pakistan	17,879
9	Germany	12,688
10	Indonesia	10,330

EDGE ORIGIN

Edge traffic by country

EDGE VOLUME

Edge volume

Requests per hour across the edge, last 7 days

EDGE VOLUME

Edge volume

BLOCKS

Blocks over time

WAF blocks per hour, last 7 days

BLOCKS

Blocks over time

STATUS

HTTP status codes

Edge response status distribution, last 30 days

STATUS

HTTP status codes

CACHE

Cache status

HIT / MISS / DYNAMIC distribution, last 30 days

CACHE

Cache status

BLOCKED ORIGIN

Top blocked countries

Countries with most WAF blocks, last 30 days

BLOCKED ORIGIN

Top blocked countries

BLOCKED PATHS

Top blocked paths

Paths with most WAF blocks, last 30 days

BLOCKED PATHS

Top blocked paths

FIREWALL

Firewall actions

What Cloudflare did, and why, last 30 days

FIREWALL

Firewall actions

RECENT BLOCKS

Recent blocks

Last 20 blocked events

/admin/.envFR · block · ray a43fd83c08
Oct 2, 01:13 AMrule 23548ee2b36547a1be0…
/.svn/entriesFR · block · ray a43fd5b67a
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/services/api/.envFR · block · ray a43fd56d7c
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/shared/.envFR · block · ray a43fd56d7b
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/www/.envFR · block · ray a43fd56dbb
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/htdocs/.envFR · block · ray a43fd56d88
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/.svn/entriesFR · block · ray a43fd56d7e
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/public/.envFR · block · ray a43fd56d7a
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/apps/api/.envFR · block · ray a43fd56d79
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/application/.envFR · block · ray a43fd56d88
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/apps/web/.envFR · block · ray a43fd56d7d
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/.env.oldFR · block · ray a43fd56d8a
Oct 2, 01:11 AMrule c04705c7adee4ce3a76…
/api/.envFR · block · ray a43fd56d78
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/frontend/.envFR · block · ray a43fd56d88
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/.env.bakFR · block · ray a43fd56d79
Oct 2, 01:11 AMrule c04705c7adee4ce3a76…
/html/.envFR · block · ray a43fd56d7b
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/.svn/wc.dbFR · block · ray a43fd56d7e
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/packages/api/.envFR · block · ray a43fd56d8d
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/current/.envFR · block · ray a43fd56d9c
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…
/symfony/.envFR · block · ray a43fd56d8b
Oct 2, 01:11 AMrule 23548ee2b36547a1be0…

RECENT BLOCKS

Recent blocks

RECENT REQUESTS

Recent requests

Last 20 edge requests (IPs redacted /24 or /48)

/BR · 35.199.126.0/24 · jon.rehagen.net
200dynamic
/healthzUS · 96.230.193.0/24 · n8n.rehagen.net
504miss
/BE · 35.205.234.0/24 · jon.rehagen.net
200dynamic
/about-this-site%5CUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/series/tracking-privacyUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/series/security-opsUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/series/jonbotUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/series/agent-supply-chainUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/series/personal-infraUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/about-this-siteUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/github-skill-registryUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/n8n-cve-wave-2026US · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/iap-single-user-deploymentUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/gcp-sprawl-golden-pathUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/tanstack-did-everything-rightUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/trust-boundary-vector-storeUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/mcp-stateless-specUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/dnssec-consequencesUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/cloud-sql-proxyUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic
/writing/http3-not-automatically-fasterUS · 104.164.126.0/24 · jon.rehagen.net
200dynamic

RECENT REQUESTS

Recent requests

Real visitors

Self-hosted Umami. Counted without cookies or third-party trackers.

VISITOR ORIGIN

Where legitimate visitors come from

Umami visitors by country, last 30 days (hourly uniques, summed)

Top 6 countries by legitimate visitors in the current window
Rank	Country	Visitors	Pageviews
1	United States	93	115
2	China	12	12
3	Canada	1	5
4	Indonesia	1	2
5	India	1	1
6	South Africa	1	1

VISITOR ORIGIN

Where legitimate visitors come from

READS

Most-read pages

Top paths by pageviews, last 30 days

READS