My WordPress blog hosted on https://adib.express/ was deployed on a Kubernetes on-premise cluster by the end of December 2025, but it was not until January 1, 2026, that I secured it and opened the firewalls to make it publicly accessible.
As a frontend, I have HAProxy which serves on both ports 80 and 443.
Typical HAProxy log entry shows as follows:
2026-01-03T21:29:10.939487+00:00 vps-2153e875 haproxy[351604]: 79.116.218.196:58439 [03/Jan/2026:21:29:10.793] all~ wordpress_80/kube-service-web 0/0/7/ki/145 200 12740 - - ---- 2/2/0/0/0 0/0 "GET https://adib.express/ HTTP/2.0"The current log file is ‘/var/log/haproxy.log’ and it’s rotated daily, and by the time I was collecting this information it was January 3, 2026, so the file ‘haproxy.log.1’ had all the events from January 2, 2026. Let’s check this log, and extract the requests which experienced 404 (Not Found) error responses, most of them generated by requests from bots/botnets/attackers.
(more…)