while read count ip; do
org=$(wget -qO- "https://ipinfo.io/$ip/org")
country=$(wget -qO- "https://ipinfo.io/$ip/country")
case "$org" in
*Microsoft*|*Amazon*|*Google*|*DigitalOcean*|*Cloudflare*|*Tencent*|*ByteDance*|*Byteplus*)
;;
*)
printf "%5s %-15s %-2s %s\n" "$count" "$ip" "$country" "$org"
;;
esac
done < <(
grep 'Mozilla/5.0' /var/log/caddy/access.log \
| grep -Ev 'Googlebot|Applebot|Bytespider|MJ12bot|AhrefsBot|OAI-SearchBot|ChatGPT-User|facebookexternalhit|pathscan|CMS-Checker|compatible;' \
| grep -o '"remote_ip":"[^"]*"' \
| cut -d'"' -f4 \
| sort | uniq -c | sort -nr
)
From your log timestamps:
- Start: Fri 19 Jun 2026
- End: Fri 26 Jun 2026
- Duration: ~7.7 days (about 1 week)
So all counts below are:
📊 per ~1 week of traffic
I split traffic into:
- Microsoft / AWS / Google / Cloudflare / DigitalOcean
- hosting providers (OVH, Contabo, M247, etc.)
- known scanners / crawlers
- “offshore VPS” providers
- residential ISPs (Aussie Broadband, Optus-like, Telstra-like, etc.)
- mobile carriers
- small regional ISPs
- non-cloud networks
- 👤 Real users: ~70–85%
- 🤖 Bots/VPS: small remainder
Likely real usage:
- 50–75 hits/week
- ≈ 7–11 real visits/day
👉 Your strongest real audience
¶ 🇳🇱 Netherlands — ~88 hits
- 👤 Real: ~5–10%
- 🤖 VPS / hosting-heavy country
Likely real usage:
- 5–10 hits/week
- ≈ <2 real visits/day
- Almost entirely VPS (M247, Contabo-type infra)
- 👤 Real: ~0–2 hits/week
- Mixed, but mostly datacenters (CariNet, QuickPacket, Datacamp)
- 👤 Real: ~1–3 hits/week
- Mostly OVH / hosting infra
- 👤 Real: ~0–1 hits/week
- Host Africa = VPS-heavy mix
- 👤 Real: ~1–3 hits/week
- Mostly mobile/ISP + some VPN/VPS mix
- 👤 Real: ~3–6 hits/week (uncertain)
- Likely mixed mobile traffic + scanning
- 👤 Real: ~2–5 hits/week
- Mostly hosting/datacenter
- 👤 Real: ~0–1 hits/week
- Mixed ISP + hosting networks
- 👤 Real: ~1–2 hits/week
- Hosting provider (Constant Company / VPS)
- 👤 Real: ~0 hits likely
- Telecom Brasil + ISP mix
- 👤 Real: ~1–2 hits/week
- Mobile ISP (MTN)
- 👤 Real: ~0–1 hit
- ISP network (IBW Communications)
- 👤 Real: ~0–1 hit
- Enterprise ISP
- 👤 Real: ~0–1 hit
- Telecom + mobile provider mix
- 👤 Real: ~0–1 hit
- ISP traffic, unclear
- 👤 Real: ~0–1 hit
- ~350–450 hits (excluding internal Docker)
- ~75–90% of all requests
- Azure, AWS, Google, Cloudflare, OVH, M247, DigitalOcean, etc.
👉 ~300–400 requests/week
| Metric |
Value |
| Real visitors per week |
~60–120 people |
| Real visitors per day |
~8–17 people/day |
| Strongest country |
🇦🇺 Australia |
| Secondary |
🇺🇿 Bangladesh / 🇧🇩 / 🇿🇦 (uncertain mix) |
Your server is experiencing:
🌐 “global background internet scanning + a small real Australian audience”
Not a large public user base yet.