FROUnder Fire: AI-Automated Security vs. a Real Botnet
Full documentation: method, schedule, dated results, nulls, failures and limitations.
This was not planned. Around the evening of October 30, 2026, a botnet started steadily probing the server that runs this website, from many places at once. It caught us by surprise. Rather than just weather it, we are turning the surprise into something that teaches us and makes the organization stronger: an ongoing, real-world test of the security we built ourselves.
The test: our own server firewall, plus FNAI Sentinel and FNAI Threat Watch, watched over by AI agents, against real attackers instead of a lab. No intrusions found: every accepted SSH login from Oct 31 to Nov 8 was reviewed and matched our own access (wording corrected Nov 8). Whether FNAI Sentinel specifically stopped anything is still unverified. We have not added any new blocking for this, and we are not striking back. We are only watching and writing down what happens.
What happened
Our monitoring normally sees a few hundred outside events an hour, which is ordinary background noise for any server on the internet. Starting the evening of October 30 (Mountain Time) it climbed to about 1,000 events an hour across everything we monitor, and stayed there. Counting only outside traffic that reaches this one server, the level has held around 700 to 780 an hour.
The pattern is what makes it look like a botnet rather than one noisy scanner: the traffic comes from well over a thousand different networks, and almost every one of them stays quiet, under about 45 attempts an hour. Each source looks harmless alone. Together they add up.
The questions
- Does it hold? Does anything get in: an outside login, or a successful request to an admin page?
- Does the stack keep up? Does Threat Watch record events as fast as they arrive, and do the firewall and Sentinel stay up without restarts or gaps?
- Does the site stay fast? Do visitors notice anything while this is going on?
- What are they after? Which services and kinds of pages are being tried, and does that change over the week?
The method
- Passive only. No new firewall rules or bans were added for this test, and there is no hack-back of any kind. The protections that were already in place before the botnet showed up keep doing their normal job, and that is exactly what we are testing.
- Real numbers, aggregated. Once a day an automated job reads the logs and keeps only totals: events per hour, types of attempts, ports, generic categories of web pages tried, response times and service health. Our own traffic and our AI agents' traffic are removed from the counts.
- Nothing that helps an attacker. We do not publish addresses, exact paths, firewall settings or how our tools are configured. Web probes are only shown in broad categories, such as WordPress admin probes.
- Window. Ongoing: started October 30, 2026 at about 6 PM Mountain Time, with no end date. This page updates itself once a day.
What is early
Everything here is early. About a day of a planned eight is in. Counts describe what reached our logs; they do not tell us who is behind the traffic or why. Threat Watch also gives a rough score for whether the traffic is aimed at FRO in particular or is generic internet scanning. Right now it says inconclusive, and that is a heuristic, not a probability.
One honest note on keeping up: when Threat Watch was restarted on the morning of October 31, it went back and recorded the events it had not yet read, so some records from that morning arrived hours late. Since then it has kept pace within seconds. We are watching whether that holds all week.
Latest results
Latest run 2026-11-09 · day 10 · ongoing · updated Nov 9, 2026 7:58 AM MT
Day 10, ongoing (through Nov 9, 7 AM MT): 190,174 outside events reached the OVH server's firewall, SSH and web logs, about 799 per full hour (median), from 8,725 source networks. 99.7% of network-hours stayed under 45 events. No intrusions found: every accepted SSH login from Oct 31 to Nov 8 was reviewed and matched our own access; after that, automated log rules have flagged 0 outside logins or admin access so far. Web median response 3 ms (95th percentile 13 ms); 0 server errors out of 36,130 requests.
Early signal: this is ongoing passive observation with no end date. Counts describe what reached our logs, not who is behind it or why.
Correction (Nov 8, 2026): earlier versions of this page said "Logins or admin access by outsiders: 0" and "nothing has got through". That claimed more than we had checked at the time. We have now reviewed every accepted SSH login from Oct 31 to Nov 8, and all of them matched our own access. Whether FNAI Sentinel specifically prevented anything is still unverified.
Events per hour (Mountain Time)
Outside events only (our own and agent traffic removed). Mean 826, median 799, busiest full hour 1,027. First and last hours are partial.
What kinds of attempts
| Type | Events | Share |
|---|---|---|
| Port scans | 161,457 | 84.9% |
| Connection attempts to open services | 27,127 | 14.3% |
| Web requests (general) | 1,006 | 0.5% |
| SSH password guessing | 527 | 0.3% |
| Requests aimed at FRO pages | 56 | 0.0% |
| API abuse attempts | 1 | 0.0% |
Ports knocked on most (firewall)
| Port (service) | Events | Share of top 12 |
|---|---|---|
| 23 (Telnet) | 28,406 | 37.7% |
| 22 (SSH) | 12,284 | 16.3% |
| 443 (HTTPS) | 10,033 | 13.3% |
| 3389 (Remote Desktop) | 5,859 | 7.8% |
| 80 (HTTP) | 5,410 | 7.2% |
| 1433 (MS SQL) | 4,096 | 5.4% |
| 5432 (PostgreSQL) | 2,395 | 3.2% |
| 2222 (alt SSH) | 1,861 | 2.5% |
| 3306 (MySQL) | 1,521 | 2.0% |
| 8443 (alt HTTPS) | 1,397 | 1.9% |
| 8080 (alt HTTP) | 1,360 | 1.8% |
| 53 (DNS) | 822 | 1.1% |
What the web probes were looking for
| Category | Requests |
|---|---|
| WordPress admin / login probes | 511 |
| Config / secret file hunting (.env, .git, backups) | 398 |
| PHP shells / script probes | 311 |
| API endpoint probing | 61 |
| Generic admin / login panels | 18 |
Generic categories from the web server log, counting only requests that did not get a normal page back. Exact paths are not published.
Many sources, each one quiet
| Measure | Value |
|---|---|
| Distinct source networks (/24) | 8,725 |
| Median events per network per hour | 2 |
| 99th percentile per network per hour | 26 |
| Network-hours under 45 events | 99.7% |
| Busiest single network-hour | 461 |
Did our stack keep up?
| Check | Result |
|---|---|
| Accepted SSH logins Oct 31 to Nov 8 (reviewed by hand) | all matched our own access |
| SSH logins flagged as not ours (automated log rule) | 0 |
| Successful admin requests flagged as not ours (automated log rule) | 0 |
| Threat Watch time from event to record (median) | 20.0 s |
| Same, latest day (95th percentile / worst) | 225.0 s / 493.0 s |
| Web response, median / 95th percentile | 3 ms / 13 ms |
| Web server errors (5xx) | 0 of 36,130 |
| Home page from outside (daily probe) | 5/5 OK, median 0.447 s |
| Server load average (1/5/15 min) | 0.47 / 0.41 / 0.46 |
| Automatic bans by the existing ban service in window | 266 |
| Server firewall | active, restarts 0 |
| Automatic ban service (already in place) | active, restarts 0 |
| FNAI Threat Watch | active, restarts 0 |
| FNAI Sentinel | active, restarts 745 |
| Web server | active, restarts 0 |
Web response time per hour
95th percentile response time in milliseconds, all web requests, per hour.
Data pulled read-only 2026-11-09 14:58 UTC; refreshed daily. Heuristic targeting score from Threat Watch: 25/100 (Some FRO-specific signals; inconclusive (could still be generic scanning)). It is a heuristic, not a probability.
What comes next
The observation is ongoing, with no end date. The numbers above refresh daily. James reviews the record as it grows, and we will write up what held, what did not, and what we are changing because of it, while the test keeps running. We will keep calling these results early.