Probed within two hours of launch. Nothing there to break into.
When a CloudHorizon-hosted client site went live, automated scanners arrived within two hours and kept coming. Here is what its first 15 days looked like, measured from the site's own CloudFront metrics.
September 2026 · 3 min read · Client identity withheld
1h 47m
from the site's first visitor to the first automated probe burst
~50%
of all traffic failed: 4,021 of 8,097 requests asked for things that don't exist
219/min
largest single burst, and every request in it failed
0
server errors in all 15 days: the site never faltered
View daily data
| Day | Requests | Failed (4xx) |
|---|---|---|
| Sep 14 | 508 | 283 |
| Sep 15 | 385 | 14 |
| Sep 16 | 841 | 445 |
| Sep 17 | 575 | 367 |
| Sep 18 | 1,407 | 912 |
| Sep 19 | 446 | 286 |
| Sep 20 | 485 | 337 |
| Sep 21 | 378 | 269 |
| Sep 22 | 883 | 324 |
| Sep 23 | 178 | 2 |
| Sep 24 | 533 | 282 |
| Sep 25 | 480 | 59 |
| Sep 26 | 302 | 155 |
| Sep 27 | 289 | 146 |
| Sep 28 | 407 | 140 |
| Total | 8,097 | 4,021 |
What the numbers show
The site's first visitor arrived on launch evening. An hour and 47 minutes later the first automated burst hit: dozens of requests a minute for pages that don't exist, every one of them failing. Over the next two weeks there were 49 minutes like that. Together they account for 89% of all failed requests, and for roughly half of everything the site served.
None of it touched anything real. Across all 15 days the site did not return a single server error, and regular visitors kept getting their pages the whole time.
This is normal. What they find is the difference.
Every public website is discovered and probed by automated scanners within hours of going live. They work through lists of common weaknesses: admin logins, leftover configuration files, unpatched plugins. The question isn't whether your site gets probed, but whether there is anything there for a scanner to find.
Why the scanners came up empty.
No server to exploit
Pages are pre-built static files. No operating system, web server or application runtime is answering requests, so there is nothing to patch, overload or break into.
No login, admin panel or database
The admin consoles, configuration files and CMS logins that scanners hunt for simply don't exist. Every probe gets a plain "not found" and the scanner moves on.
A locked-down delivery path
Files sit in a private, versioned S3 bucket that only CloudFront can read, served over TLS 1.2 or newer. Deployments use short-lived credentials, never stored keys.
Want your site to be this boring to attackers?
We build, host and monitor static sites on this architecture for small businesses and nonprofits.
Method. Amazon CloudWatch per-minute metrics for the site's CloudFront distribution, September 14–28, 2026. A probe burst is a minute with 20 or more failed requests in which every request failed; 89% of failed requests fell in those minutes. Probe intent is inferred from that pattern, since individual URLs were not logged. The client's identity is withheld.