Part 1••6 min read
Knock Knock, Who's There?
A static site with no login pages, no forms, and no commercial value still attracts more than twenty thousand unsolicited requests a month. This is what that traffic contains.
Read Part 1Who's Knocking at the Door
completeA 5-part series on Who's Knocking at the Door.
Part 2••5 min read
Why Toronto! and Why, Toronto?
One CloudFront edge location dominated the probe traffic by a factor of six. Pulling that thread led to Azure Canada Central and a particular kind of internet scavenger.
Read Part 2Part 3••4 min read
The Path Not Found Is the Point
This site's robots.txt politely asks crawlers to avoid six paths. None of the six exist. Anyone who asks for one anyway has just introduced themselves.
Read Part 3Part 4••5 min read
What the Canaries Caught
A single thirty-day window made the scanning look like one steady thing. Three months shows the opposite: overlapping campaigns that surge and vanish, an edge that loses its lead and then takes it back, and a curated filter already drifting out of date.
Read Part 4Part 5••6 min read
Who Watches the Watch List?
After three months of noise from one PHP path, the filter changed. The small promotion raised a larger question about how much judgement belongs inside a telemetry system, and who exercises it.
Read Part 5