Who read this page

Who read this page

The site went up on the evening of Tuesday, August 11, served an emergency for five days, faded to a trickle, picked up again when the Hawk Fire started on August 22, and stopped being updated on August 27. These are its own server logs, measured again on September 1 to see what happened after it stopped.

• 6,150Readers
• 39,542Requests
• 0Server errors
• 62%On a phone

Most of the traffic came in the first evening. The busiest hour was 3 PM on launch day, Tuesday, August 11, with 624 people reading the page in sixty minutes. Readership then halved every day for four days, following the evacuation orders as they came down. After August 15 it settled at roughly 150 to 220 a day, five to ten people an hour around the clock, with no morning peak.

By the end, the people still arriving were mostly not local. Over the first six days, 37% of located addresses were in a community these fires threatened. Over August 17 to 20 that fell to 8%, 53 addresses out of 641. Reno accounts for 1,518 addresses across the whole run, Sparks 405 and Virginia City 194, and almost all of those came in the first week. The flat tail is mostly search results and old shared links.

Nearly two thirds of readers were on a phone, which makes sense for people who may have been packing a car. The site is one HTML file with its styles inline and no scripts, fonts or trackers, so a reader on a bad cell connection in Palomino Valley got the whole thing in one request.

There were no server errors across the whole run, and the machine never went above a 0.10 load average, even in the hour when 624 people arrived at once. About a fifth of all requests were probes for WordPress installers and other software this site does not run, which is ordinary background noise on any public address.

Where readers came from moved over the week. Reddit and Facebook carried the first evening, 1,355 and 542 visits between them, and search overtook both within a day. Among search engines, Bing and DuckDuckGo each sent more than twice what Google did: Bing 670, DuckDuckGo 668, Yahoo 346, Google 314. Just over half of all visits arrived with no referrer at all, which is what a link pasted into a text message or a group chat looks like from the server side.

The August 11 to 20 figures were measured at 1 PM PDT, August 20, 2026 from this site's nginx logs. Counts are of unique IP addresses, which undercounts households and phone networks that share one address and overcounts anyone who moved between wifi and cellular, so they are approximate. The geography figures come from a separate pass that filters bots slightly differently, so its totals do not line up exactly with the reader counts, and it resolves addresses against a local copy of the DB-IP City Lite database. No visitor address was sent to any third-party service. The 39,542 request count is every line in the log, including the 187 malformed ones scanners produced; the table's daily requests sum to the 39,355 that parsed.

Then the Hawk Fire started

The page went static on August 20 and nothing about it changed for three days. Then the Hawk Fire started northwest of Reno around midday on Saturday, August 22, and people came back to a page they had used earlier in the month. It was rewritten by hand every day after that until August 27, when it stopped. The log kept running, so the table continues past that.

Two numbers in that table were wrong in an earlier version of this page. The Reno-area count for August 21 was given as 13 and is 10, and August 22 was given as 26 and is 25. The original figures came from a geography pass done by hand on August 23, before the script with the city list in it existed. The script, run against two separate log archives, gives 10 and 25 both times. The conclusion does not change, and the August 22 jump gets slightly larger, but the published numbers could not be reproduced and should have been.

The biggest reader day was mostly scanners. Tuesday, August 25 had the highest reader count since August 13, 327, but every measure that separates a person from a scanner moved the other way that day. Requests tripled to about 4,500, and the share of them that failed went from around half to 78%. The top failing requests were /wp-admin/install.php 374 times, /fetch 162 times and /.env 86 times. This site has never run WordPress. The busiest cities by page view on August 25 were Ashburn, Santa Clara, Los Angeles and Dallas, with Reno fifth. On August 22 Reno was first. By August 26 Reno was not in the top six. The same thing happened again on August 30 and September 1, when requests jumped to about 4,000 and then 6,400 with 89% and 94% of them failing, mostly probes at /fetch and /proxy looking for an open proxy, while the reader count did not move.

The second row fell every day from August 22 to 26, including the day the headline number peaked, held on the 27th, which was the day of the community meeting, and then dropped to somewhere between 16 and 26 a day while the headline stayed between 150 and 230. Most of whatever arrived here after August 23 never loaded an image, which is what a script does and a browser does not. The earlier version of this row was one or two higher on some days, because it was computed with a pattern that was never written down. The one behind these numbers is saved with the other scripts.

Part of the rise is hawkfireinfo.com, the redirect domain described below, which started showing up as a referrer on this site: 10 page views on August 24, 53 on August 25, 47 on August 26 and 52 on August 27, from 65 separate addresses in the first three days. Three of those 65 fetched a single image. None of them were in Reno. They were in Santa Clara, Ashburn, Kassel, Frankfurt, Kansas City, Singapore and Bangkok. So about a seventh of Tuesday's page views were certificate scanners following the redirect through to the page and getting counted as readers because they send a browser's user-agent string. They have kept coming at 40 to 50 page views a day ever since.

The local count is the one that matters. It went from 10 on each of the two days before the fire to 25 on the day it started, and unlike the totals it looks like people: thirteen active hours instead of twenty-four, 28 of 33 page views from a phone, 24 of 33 with no referrer. No referrer usually means a bookmark, or a link someone saved during the Bug Fire and sent to somebody again. And nearly every local reader also loaded the page's icons, which most of the other readers never did. Real browsers fetch icons. Most of what arrives here does not.

It peaked on Sunday, August 23, and fell every day for the rest of the fire. That was the day the fire page was rewritten for the Hawk Fire, and the day the most local people read it: 25 readers and 45 page views across sixteen hours. After that it was 13, 12 and 7, and by 9:30 on Thursday morning, when the updates stopped, it was one person with one page view. Over the same stretch the fire went from zero containment to 93 percent. The local count followed the fire, while the headline number was going up for other reasons.

This is why the page stopped. The updates ended on August 27 because the people running the fire had stopped reporting on it daily, and the log showed the local readers had already left. The same thing happened at the end of the Bug Fire, when the local share of readers went from 37% to 8% in four days while the total held up on scanners. Both times, the total reader count was the least useful number on the page.

After the page stopped, a few local readers kept coming. Thursday, August 27 finished with 8 of them, spread through the day, and Friday, when the resource center opened, had 9. Since then it has been 1, 6, 6 and 4 a day. They are still on phones, still arriving with no referrer, and still loading the icons. A handful of people in the Reno area are checking a page that says it will not change, and the maps at the top of it still work, which is the reason it stays up.

The detail rows above have moved by a few since the previous version of this page. The August 22 page views were first published as 37, then as 31, and are now 33. The reader counts have not changed. The first figure was a hand pass, the second came from a script that was not saved, and the third is from one that was, which is the only one of the three that anyone can rerun. That is the fifth time in this project that a number has moved because the filter behind it was not written down, and it is why the scripts are archived with the site.

Measured at 12:30 PM PDT on Tuesday, September 1, 2026, from the server's own nginx logs, using the same definition of a reader as everything above and three scripts that are archived with the site, so every row on this page can be compared down the days. The August 20 and 21 rows come from an earlier archive of the same log, measured the same way. September 1 is a partial day and will finish higher than 106. The fire page stopped being updated on August 27, 2026. This one was extended once, on September 1, to show what happened after. The logs keep running and are kept for a year.

hawkfireinfo.com, and what a new domain attracts

A second domain, hawkfireinfo.com, was registered on August 24 and pointed at this site. It serves no page of its own: every request to it gets a redirect to bugfireinfo.com, so that there is still only one address for this page. It has its own server log, and that log makes a neat demonstration of something the tables above can only suggest.

It cannot have readers, so it is not in the tables. A reader here means an address that was served the page. hawkfireinfo.com never serves the page, so counting readers on it would return zero and mean nothing. Its arrivals are counted separately, by a separate script, and are not added to anything.

In its first 44 minutes it logged 261 requests from 40 addresses, and not one of them was a person. The name had not been published, linked, posted or sent to anybody. It had only appeared in a public certificate transparency log, where every newly issued HTTPS certificate is recorded, and which people monitor continuously looking for new hosts to scan.

The timing gives it away. The first browser-looking request arrived thirteen seconds after the certificate authority finished validating the domain. The rest arrive in bursts, each burst just after a validation round. Four of them came from consecutive addresses within twenty-four seconds of each other. Several fetched the bare domain and the www version in the same second, which means a machine read both names off the certificate. Half the total was a single security scanner, 124 requests from one service. Thirty-nine were the certificate authority itself, and twenty-two were the site's own checks after setting it up.

Six of those requests followed the redirect through and landed on this page, where they were counted as arriving from hawkfireinfo.com. Every one of them was a data center address, one of them announcing itself as a headless browser and another claiming to be an iPhone while sitting in an AWS region. They are in the August 24 numbers above, and they are part of why the machine share of that day is what it is.

It is worth recording because it is the same thing the tables above show, isolated by accident: a brand-new address with no readers at all still collected forty visitors in under an hour. Any rise in a traffic number has to be checked against that.

Measured at 4:55 PM PDT, Monday, August 24, 2026, over the whole life of the log at that point, which began at 4:11 PM the same afternoon. Arrivals are counted with the same bot filter used for readers, applied to redirects instead of page loads, by a script kept with the others. The window is 44 minutes long and nothing here should be read as a rate.