Le blog de numerunique ☰

numerunique's firewall effectiveness
01/08/2026

Here is a real-life example of a common attack, as revealed in the system's access log:

[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.local … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.backup … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.production … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.prod … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.bak … crusader-worker/1.0
[01/Aug/2026:14:37:50 +0200] 34.101.80.152 … HTTP/1.1 GET /.env.example … crusader-worker/1.0

It's a very basic classic secret-hunt, nothing personal yet still annoying and utterly unwelcome. It was launched from a server at IP address 34.101.80.152 (more about that later) by a bot signing as crusader-worker/1.0.

A closer look at other system logs reveals that:

Thus the firewall reacted in less than 0.9 ms and its ban action took effect in less than 14 ms from the first request to the last one allowed to pass. Seven requests were made in less than 14 ms; that is a 500 hit/s rate.

It must be noted that the targeted server here is a very modest one. A more powerful target would have let the same attacker push more, because higher network bandwidth and faster NVMe would absorb more of the burst before the ban sticks, despite a faster CPU.

Nevertheless, numerunique's firewall reaction time is sub-millisecond while others often lag in seconds.

That is not a secret; hackers can see it for themselves.

Speaking of hackers, 34.101.80.152 (likely a compromised instance, possibly a rented one for that purpose) belongs to Google Cloud, which, like other hosting providers, leaves the bots swarming.

Hosting bot swarms is a juicy business.

Previous