Our Servers Catch Burglars Every Day — TREEWALL Field Test Report

1Every Night, Someone Knocks

People often say, “we're too small to be a hacker's target.” Half right, half wrong. You're probably not a target — but most intrusion attempts today aren't people choosing you. They are automated programs sweeping the entire internet, trying every door once. Like a burglar walking down the street, testing every handle. Locked? Move on. Open? Walk in.

At our server room gateway, the last week averaged 300–600 security events a day, with an average of 245 IPs automatically banned daily. This was not an unusual week. This is just a weekday on the internet.

2Three Things Burglars Want

When you pile up the ban records, the attempts are surprisingly predictable. They want three things.

3Burglars We Actually Caught

Two real cases picked from the records.

The impatient one — 128 knocks in 30 minutes

One early morning, a single IP knocked on our admin paths 128 times in 30 minutes— once every 14 seconds. A human guard would have called it in immediately, but there are no humans in a server room at 3 a.m. Instead, the watcher program was counting the pattern, and the moment it crossed the threshold, the IP went straight onto the ban list. The humans simply read about it in the next morning's report.

The regular — 13 visits in a month

The more interesting kind is the regular. One IP showed up on 13 different days over the last 30, totaling 57 appearances. Banned, rests a few days, comes back, banned again. Because TREEWALL keeps per-actor history, it distinguishes a “first-time drifter” from a “regular who has been loitering for a month” — and regulars stay on the watchlist longer, under stricter rules.

4How TREEWALL Catches Them

TREEWALL in one sentence: “a gatekeeper that never sleeps + a meticulous record-keeper + a secretary that briefs you every morning.”

And one more thing — a daily “door count.” Every day we measure which doors (public service ports) are actually open to the internet and compare them against the approved list. Currently: 18 approved doors, zero doors open without approval. Most security incidents start not with brilliant hacking but with a door someone forgot they left open — which makes this boring check the most important one.

5A Week in Numbers

Measured at our server room gateway over the last 7 days (Jul 29 – Aug 4, 2026).

And the gateway is not the only busy one. A single outlying server that must keep its SSH (remote access) door open to the internet has accumulated a permanent ban list of 3,118 IPs on its own — over three thousand password-guessing burglars caught at just that one door.

Some days spike — like August 3rd, 2026. When a new scanning campaign starts somewhere, the whole internet gets noisy for a few days. What matters is that the response stays identical: block automatically, record everything, and let a human review the morning report.

6What Real-World Operation Tells Us

Three conclusions we keep confirming while running TREEWALL in production across ~60 servers.

1. Intrusion attempts are not an “if” — they are a “daily.”

   Regardless of size, every internet-facing server gets knocked on every day. The question is whether anyone is watching.

2. Defense should rest on a system's diligence, not a person's.

   No one can eyeball hundreds of events a day. Auto-ban blocks, records accumulate, and humans judge from a summary — the only structure that stays sustainable.

3. The most valuable report says “nothing happened today.”

   But that one line needs evidence. Only a “nothing happened” built on records — how many were blocked, how many doors were open, all of them approved — can be trusted.

The TREEWALL field test continues. The burglars will come again tomorrow, the gatekeeper will catch them again tomorrow, and we will keep sharing the records here from time to time. Curious what TREEWALL is? See the product page and the introduction post, or reach us via the support page.