88 Break-In Attempts, Zero Real Doors
A while back we planted a few fake "broken doors" on our own site: files and paths that sound like a jackpot for an attacker but lead nowhere real. No customers, no other companies, just us watching who comes knocking. This is Log 01.
What Is A Tripwire, Actually
Picture a store owner who puts a fake safe in the back room with a "CASH INSIDE" sign on it. Nobody expects it to actually get robbed, because it is empty. The point is different: anyone who tries the handle has just told you, for free, that they are looking to rob a safe. That is the entire idea. A tripwire is a path on your site that no real visitor would ever type in, guess, or click. If a request lands there anyway, whoever sent it was not browsing. They were checking.
We are not naming which paths, and we are not saying how many strikes it takes before an IP gets shown the door. Publishing the actual trap list would be like a magician explaining the trick to the one heckler in the crowd who is planning to steal it. What we can share is what showed up over a recent 30-day stretch, in aggregate.
The Headline Number
automated probes in 30 days, across 0 separate sessions
For context: this is a small security tool, not a bank or a household name. Nobody sent an email to warn us this was coming. It is just what the open internet does to any site with a pulse, all day, every day, whether anyone is watching or not.
Where They Came From
Singapore takes the top spot this round, with the US, Germany, Australia, and the UK close behind. Before anyone pictures a shadowy figure in Singapore personally hunting for our fake SSH keys: this is almost certainly cloud hosting regions, not passports. Most scanning traffic on the internet runs from rented servers, not someone's home connection.
How They Showed Up
The overwhelming majority came in wearing a regular browser's clothes, the kind of traffic that looks, on paper, like a person with a mouse. A smaller slice did not bother with the disguise at all, showing up as plain curl or a bare Go HTTP client. Refreshing, honestly. At least they were not pretending.
What Kind Of Visit Was It
Almost all of it was background noise: broad, untargeted sweeps that hit every site they can reach, us included, nothing personal. A small handful looked different: the same source coming back more than once, specifically for us, or a request pattern that did not match any of the usual automated scanner signatures at all.
Caught Red-Handed
These are real paths real requests asked for. None of them exist on our site. Think of it as a lost-and-found box for things nobody actually lost.
/.ssh/id_rsaOur SSH private key. Which is not there, because we are not that company.
/database_backup.sqlA full database dump, sitting in the open, for anyone to grab. Also not there.
/dump.sqlSame idea, shorter filename. Bots are efficient like that.
/storage/logs/laravel.logWe do not run Laravel. Someone is running the same 40 checks against every site on earth.
/api/.envThe classic. Every secret you own, one HTTP request away, if you are careless.
/api/adminA guess that an unauthenticated admin panel might just be sitting there. Bold strategy.
The Actual Point
None of this is about us specifically. Swap our domain for any live website and the shape of the story barely changes: constant, automated, mostly impersonal probing, checking for the same handful of careless mistakes, all day, whether or not anyone is logging it. The only variable most sites actually control is the last part.
If you want to see whether any of these doors are open on your own site, run a scan. More Tripwire logs land here as we collect them: tripwire hub.