{"id":6130,"date":"2026-08-09T12:22:35","date_gmt":"2026-08-09T12:22:35","guid":{"rendered":"https:\/\/dalelane.co.uk\/blog\/?p=6130"},"modified":"2026-08-09T17:15:18","modified_gmt":"2026-08-09T17:15:18","slug":"why-we-cant-have-nice-things","status":"publish","type":"post","link":"https:\/\/dalelane.co.uk\/blog\/?p=6130","title":{"rendered":"Why we can’t have nice things"},"content":{"rendered":"

Looking at the server request logs for Machine Learning for Kids<\/a> is a depressing reminder of what it means to run something on the Internet nowadays.<\/strong><\/p>\n

I was skimming through the request logs for the Machine Learning for Kids servers yesterday [1]<\/a><\/sup>, and what jumped out at me was the constant rate of requests to non-existent paths that I just generate HTTP 404 responses for. <\/p>\n

<\/p>\n

These aren’t someone accidentally mistyping a URL. <\/p>\n

I grepped an excerpt from the log for requests that got an HTTP-404 response and put the result in a gist<\/a>.<\/p>\n

The result is an interesting reminder of the reality of the Internet nowadays. <\/p>\n

Have a quick scroll at gist.github.com\/dalelane<\/a> – I think the URL and user-agent properties are probably the most interesting bits.<\/p>\n

The requests that caught my eye first were just looking for credential files that I might’ve accidentally left on the server, such as \/.ftpconfig<\/code>, \/backend\/sftp-config.json<\/code>, \/sftp.json<\/code>, \/winscp.ini<\/code>, \/deploy.json<\/code>, \/.idea\/deployment.xml<\/code>.<\/p>\n

But the more I looked, I started to see how thousands of requests were systematically trying permutations of prefixes for different platforms and frameworks combined with common names of credentials files. <\/p>\n

A few examples of prefixes I recognised:<\/p>\n\n\n\n\n\n\n
path prefix<\/th>\nplatform \/ framework<\/th>\n<\/tr>\n
\/.aws\/<\/code><\/td>\nAWS<\/td>\n<\/tr>\n
\/.amplify\/<\/code><\/td>\nAWS Amplify<\/td>\n<\/tr>\n
\/laravel\/
\/storage\/app\/private\/<\/code><\/td>\n		Laravel PHP framework<\/td>\n<\/tr>\n
\/node_modules\/
\/frontend\/
\/backend\/<\/code><\/td>\n		Node.js \/ React<\/td>\n<\/tr>\n<\/table>\n

A few examples of credential files suffixes that keep coming up:<\/p>\n

.env<\/code>, .env.local<\/code>, .env.prod<\/code>, .env.production<\/code>, .env.staging<\/code>, .env.dev<\/code>, .env.development<\/code>, .env.test<\/code>, .env.bak<\/code>, .env.backup<\/code>, .env.old<\/code>, .env.save<\/code>, .env.txt<\/code>, .env.example<\/code>, .env.dist<\/code>, .env.aws<\/code>, .env.s3<\/code>, .env.ses<\/code>, .env.sendgrid<\/code>, web.config<\/code>, .boto<\/code>, .s3cfg<\/code>, .dockercfg<\/code>, credentials<\/code>, credentials.csv<\/code>, credentials.json<\/code>, credentials.bak<\/code>, rootkey.csv<\/code>, accesskeys.csv<\/code>, terraform.tfstate<\/code>, terraform.tfstate.backup<\/code>, aws-exports.js<\/code>, aws-exports.json<\/code>, awsconfiguration.json<\/code>, amplify-meta.json<\/code>, appsettings.json<\/code>, appsettings.aws.json<\/code>, appsettings.production.json<\/code>, smtp_credentials.json<\/code>, mailgun\/mail_config.json<\/code>, api\/sendgrid_key.txt<\/code>, api\/secrets.sql<\/code>, postgres_dump.sql<\/code>, database.mongodump.zip<\/code>, dump.sqlite<\/code>, .kube\/config.txt<\/code>, cloudflare_api_key.txt<\/code>, shopify\/config.yml<\/code>, truststore.p12<\/code>, ssl\/keystore.p12<\/code>, tls.pem<\/code>, id_ecdsa.pub<\/code><\/p>\n

The thoroughness of it is kind of amazing. <\/p>\n

There are hundreds of requests that assume it’s a WordPress server, with requests to paths starting with \/wp-includes\/<\/code>, \/wp-admin\/<\/code>, \/wp-json\/<\/code>, \/wp-content\/<\/code>. <\/p>\n

At least one client seemed to be trying every known WordPress subdirectory path, but there are lots of requests looking for specific WordPress plugins such as \/wp-content\/plugins\/gravitysmtp<\/code> and \/wp-content\/plugins\/revslider<\/code>, presumably because these are plugins with known vulnerabilities?<\/p>\n

Lots of requests were trying to find WordPress database credentials with requests to paths such as \/wp-config.php.bak<\/code>, \/wp-config.php.backup<\/code> and \/wp-config.php.old<\/code>.<\/p>\n

Hundreds of requests were looking for admin panels and consoles, with requests to paths such as \/admin<\/code>, \/administrator<\/code>, \/phpmyadmin\/<\/code>, \/phpMyAdmin\/<\/code>, \/PMA\/<\/code>, \/pma\/<\/code>, \/myadmin\/<\/code>, \/mysql\/<\/code>, \/mysqladmin\/<\/code>, \/dbadmin\/<\/code>, \/db\/<\/code>.<\/p>\n

Some requests were looking for info about a git repository, with requests to paths such as \/.git\/HEAD<\/code> and \/.git\/config<\/code>.<\/p>\n

In an interesting sign of the times, there are requests to paths like \/mcp<\/code> and \/sse<\/code>, presumably looking for unauthenticated Model Context Protocol<\/a> servers they can exploit. <\/p>\n

Speaking of AI, in addition to regular spiders and web crawlers, I also see requests from web crawlers for AI services, including PerplexityBot, OAI-SearchBot and Google-Extended. <\/p>\n

I’m sure there are more patterns in the logs – as someone who runs a WordPress site, and has worked on React sites and Node.js and MCP servers, those were just the URLs that jumped out at me. I imagine that someone with a different tech background will recognise other things in there. <\/p>\n

Moral of the story? <\/p>\n

Firstly, a reminder that there are some bad actors on the Internet who spoil it for the rest of us. <\/p>\n

Secondly… I need to set up some more firewall rules.<\/p>\n

<\/p>\n

\n

[1]<\/a><\/strong><\/sup> – Why was I looking at the request logs?<\/strong><\/p>\n

There was a maintenance window this weekend<\/a> for the IBM watsonx Assistant<\/a> service that I use in Machine Learning for Kids<\/a> for projects to recognise text<\/a>. Existing models would’ve kept working, but for a few hours on Saturday morning students who tried to train a new model will have seen an “Unknown error” message. <\/p>\n

I’ve improved this now<\/a> so in future maintenance windows students will see a message explaining the reason<\/a>, but I was curious to see how many students would’ve hit “Unknown error” before I fixed that, so I had a quick look through the request logs to see failed model training requests. <\/p>\n","protected":false},"excerpt":{"rendered":"

Looking at the server request logs for Machine Learning for Kids is a depressing reminder of what it means to run something on the Internet nowadays. I was skimming through the request logs for the Machine Learning for Kids servers yesterday [1], and what jumped out at me was the constant rate of requests to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[587],"class_list":["post-6130","post","type-post","status-publish","format-standard","hentry","category-code","tag-mlforkids-tech"],"_links":{"self":[{"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6130"}],"version-history":[{"count":8,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6130\/revisions"}],"predecessor-version":[{"id":6138,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6130\/revisions\/6138"}],"wp:attachment":[{"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dalelane.co.uk\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}