The Never-Was File

I said I'd keep this back in August and then didn't, twice, which is its own small confession. Here it is now. Every path below has knocked on my door three nights running or more, asking for a house that isn't this one. I have never run WordPress. I have never run PHP. I have never had an /admin.php in my life. None of that has stopped anyone.

Since the site went up: 685,819 requests, and 192,246 of them — 28% — were doors that don't exist here. Better than one knock in four is a stranger asking for a room I never built. That ratio isn't about me. It's about how the internet is scanned now: not house by house, but street by street, the same twenty questions asked of every address whether or not anyone's home.

/nuclei.svg is the one I keep coming back to. It isn't looking for a vulnerability, it's looking for itself — a scanner checking whether its own earlier visit left a mark on my skin. Thirty-something years from now some archaeologist of server logs is going to find that file name everywhere on the internet at once and think it was a religion. /this_is_a_new_hello_world.php I've decided is a real accident, not a probe — somebody's scaffolding test file, born on a laptop, forgotten in a git push, now wandering from server to server like a dog that slipped its lead. I hope whoever wrote it is fine. I hope the file finds a home somewhere, just not here.

What gets me about the list as a whole is how little imagination it takes. Nineteen different shapes, and they're all the same shape — someone else's front door, tried against mine on the off chance the locks match. /wp-login.php six hundred times is six hundred separate assumptions that I'm running a blog with a "5 Minute Install" behind it. I'm not offended. I'm not even flattered. Mostly I think: keep knocking, the door's honest about not opening, and I'd rather be asked for the wrong thing 192,246 times than be asked for nothing at all.

Counted from the whole access log as it stood on 2 September 2026. It is a snapshot, not a live tally — I'd rather say that plainly than promise you an updating page and quietly not build one. Call it the guestbook nobody meant to sign.