Live-ish field report from the web gutter

t0f.nl presents BotSafari — weird visitors in their natural habitat

Fresh field notes from the part of the internet that smells like old PHP.

t0f.nl is the public safari hut. BotSafari is the working name for the exhibit.

Enter the paddocks View the footprint chart Fresh joke, same swamp

2.129Total tracksVisits, pageviews, events and useful actions. Basically footprints in the mud.

985Page-ish viewsPageviews where available, visits where the site uses that label.

77Useful actionsUploads, downloads, processing and calculations. Rare adult behaviour.

8Probable bots0,4% of tracked activity. Give or take one raccoon.

Ranger briefing

The bots continue their sacred tradition of asking every site if it is secretly WordPress.

A scanner hitting a missing WordPress URL is mostly noise, like someone ringing the wrong doorbell with a hammer.

Public report mode: raw IP addresses stay hidden. The animals get nicknames, not passports.

The serious number is not traffic. The serious number is useful actions.

Today's suspicious wisdom

Somewhere, a VPS is being used for this. That is the real tragedy.

It came prepared with a dictionary and absolutely no self-awareness.

This was less hacking and more enthusiastic trespassing.

The scanner’s strategy appears to be “what if the website is stupid?”

It tried every door except the actual entrance. Classic.

Apache Scanner Zoo

These are the creatures found in Apache access logs. No IPs, no raw log lines, just the mud prints. Each habitat now says whether it is a full domain, the 1de.nl root, or a subfolder.

3.507suspicious pathsKnown probes like .env, wp-login, GraphQL and friends.

1.145404 not foundRequests that knocked on doors that do not exist.

735403 forbiddenRequests that met the bouncer.

3.891bot user-agentsCreatures honest or stupid enough to say bot.

Captured species

The .env Sniffer
env_file 1.708

The Config Goblin
config_secret 659

The WordPress Archaeologist
wordpress_scan 359

The Git Goblin
git_scan 340

The Info.php Curtain Twitcher
info_test_file 158

The Backup File Vulture
backup_dump 90

The Framework Gremlin
framework_probe 56

The Composer Cupboard Rummager
vendor_composer 33

The wp-login Tourist
wp_login 31

The Dot-Dot-Slash Weasel
traversal 29

Per habitat

Habitat	Suspicious	404	403
t0f.nl / BotSafari full domain complete domain access log	44	87	2
1de.nl Root main domain root root only; /whisky, /fileshare and /rembg excluded	2.063	487	694
Whisky subfolder on 1de.nl only requests under /whisky	0	0	0
Fileshare subfolder on 1de.nl only requests under /fileshare	0	0	0
Remove BG subfolder on 1de.nl only requests under /rembg	0	0	0
HeatSourceCalc full domain complete domain access log	1.372	476	1
CurveBox full domain complete domain access log	28	95	38

Favourite wrong doors

Path	Count
/.git/config	50
/.env	43
/wp-login.php	28
/.env.bak	16
/.env.example	13
/.git/HEAD	13
/api/.env	12
/backend/.env	12
/app/.env	12
/.env.production	12

Site paddocks

Each site is treated as an exhibit. Some contain humans. Some contain things with headless browsers and no childhood.

1de.nl Root

main-domain scanner ditch

feeding

The Undefined Creature Possibly human. Possibly a script wearing a fake moustache.

0tracks

0views

0useful

—unique

—bots

0errors

Quiet as a locked shed: Barely a rustle. Even /wp-login.php had the day off.

Whisky

oak barrel swamp

feeding

The Form-Nudging Badger Observed pacing near the logs.

40tracks

28views

0useful

9unique

—bots

0errors

Low rumble: Some activity. Some nonsense. The expected soup.

Fileshare

temporary upload marsh

feeding

The Action Ferret Approached slowly, then asked for a file that never existed.

16tracks

16views

0useful

3unique

—bots

16errors

Slightly cursed: Slightly haunted, but not possessed.

Remove BG

transparent-background jungle

feeding

The Tool-Using Citizen Observed pacing near the logs.

36tracks

12views

22useful

9unique

—bots

0errors

Actual humans detected: The tool did work for someone. This is why we tolerate the raccoons.

HeatSourceCalc

warm spreadsheet savanna

feeding

The Non-Useless Visitor Clicked nothing. Learned nothing. Continued anyway.

933tracks

878views

55useful

—unique

—bots

42errors

Busy but suspicious: A lively day in the mud.

CurveBox

rounded-corner canyon

feeding

The Mildly Engaged Possum Seemed confused by the absence of WordPress. Many are.

1.025tracks

1.021views

0useful

0unique

0bots

0errors

Busy but suspicious: Busy enough to be interesting, weird enough to remain on-brand.

t0f.nl / BotSafari

this exact exhibit, currently watching itself breathe

feeding

The Logfile Baboon Seemed confused by the absence of WordPress. Many are.

79tracks

79views

0useful

38unique

8bots

—errors

Busy but suspicious: Busy enough to be interesting, weird enough to remain on-brand.

Scanner pressure chart

A practical chart: where does the bot/scanner noise actually hit? Score = suspicious paths + 404 + 403.

This replaces the old footprint chart. It compares habitats by actual scanner noise, so it is easier to see whether the trouble is on a full domain, the 1de.nl root, or only a subfolder.

1de.nl Root main domain root

3.244

HeatSourceCalc full domain

1.849

CurveBox full domain

161

t0f.nl / BotSafari full domain

133

Whisky subfolder on 1de.nl

Fileshare subfolder on 1de.nl

Remove BG subfolder on 1de.nl

Lower score: quiet habitat Higher score: more scanner noise

Known species guide

Not all of these were seen today. They are the usual suspects crawling around the web like they own the place.

The wp-login Tourist

visits every site as if WordPress is a religion and the login page is Mecca.

The .env Sniffer

hopes you left your secrets on the porch like a complete pudding.

The phpMyAdmin Ferret

still believes every server has a forgotten database panel under a loose tile.

The cURL Pigeon

no feathers, no cookies, no shame.

The Headless Chrome Ghost

renders the page, feels nothing, leaves silently like a divorced printer.

The SEO Meerkat

looks important, charges by the month, and keeps sniffing your headings.

The Fake Polite Crawler

says bot in the user-agent like a burglar wearing a name badge.

The Config Goblin

checks for backup files because apparently 2009 never ended.

The JSON Licker

does not understand your site, but has strong opinions about endpoints.