Usage Analyzer Summary

By Brad Williamson (brad@bradw.dev) ยท buymeacoffee.com/h3Dfhw4ElD

Reads /var/log/apache2/access.log*, expands rotated archives into a temp directory, groups traffic by IP, classifies legitimate website usage versus intrusion-style probes, and plots geolocated IPs on a world map.

Cache refreshes hourly.
Last build: 2026-07-12T21:07:01+00:00

Target website filter

Scope the summary, map, and stats to one inferred website target.

Requests parsed
509,764
5.3 GB transferred
Unique IPs
8,448
64 lines skipped
Legitimate usage IPs
6,691
249,432 requests
Likely intrusion IPs
840
253,901 requests

World map

Green markers are legitimate visitors, amber markers are automation or crawlers, red markers are likely intrusion attempts, and purple markers show mixed signals.

Legitimate usage Automation Intrusion attempt Mixed
80 geolocated markers shown, with legitimate website usage included in green.

Requests by hour

Hourly request volume for the currently selected website scope.

197 hourly buckets shown from 2026-07-04 17:00 through 2026-07-12 21:00.

Traffic patterns

Classification is based on request targets, status outcomes, user agents, referers, and whether an IP behaved more like a browser, a scheduled job, or a probe.

Legitimate usage: 6691 IPs Automation: 166 IPs Intrusion attempts: 840 IPs Mixed: 751 IPs

Target websites

Website Count
bradcentral.net 420,055
bradw.dev 14,140
evergreenhillna.org 48,466
Direct access by IP address 27,103
0 requests could not be tied to a specific site because older shared-log entries did not include the vhost and some requests still lack enough host information to infer the target site.

Top routes

URL Count
//xmlrpc.php 158,609
/xmlrpc.php 24,119
/wp-admin/index.php 17,921
/ 17,672
/wp-login.php?redirect_to=https%3A%2F%2Fbradcentral.net%2Fwp-admin%2Findex.php&reauth=1 14,807
/wp-login.php 12,774
/robots.txt 3,641
/.env 1,447

Top suspicious targets

URL Count
//xmlrpc.php 158,609
/xmlrpc.php 24,119
/wp-admin/index.php 17,921
/wp-login.php?redirect_to=https%3A%2F%2Fbradcentral.net%2Fwp-admin%2Findex.php&reauth=1 14,807
/wp-login.php 12,774
/.env 1,447
/.git/config 1,030
//wp-login.php 846

Top user agents

Agent Count
- 105,976
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 88,471
curl/8.7.1 60,251
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 25,815
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 24,136
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 22,723
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 11,881
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 11,228
Logs analyzed from /var/log/apache2/access.log.8.gz through /var/log/apache2/access.log.
Extracted archives live in /tmp/usage-analyzer/extracted.
Generated at 2026-07-12T21:07:01+00:00.