Who read this page

Who read this page

The site went up on the evening of Tuesday, August 11, served an emergency for five days, faded to a trickle, picked up again when the Hawk Fire started on August 22, and stopped being updated on August 27. These are its own server logs, measured for the last time that morning.

• 6,150Readers
• 39,542Requests
• 0Server errors
• 62%On a phone

The first evening was the whole event. The busiest hour was 3 PM on launch day, Tuesday, August 11, with 624 people reading the page in sixty minutes. Readership then halved every day for four days, tracking the evacuation orders coming down rather than anything the site did. After August 15 it stopped halving and settled at roughly 150 to 220 a day, five to ten people an hour around the clock, with no morning peak.

By the end, the people still arriving were not local. Over the first six days, 37% of located addresses were in a community these fires threatened. Over August 17 to 20 that fell to 8%, 53 addresses out of 641. Reno accounts for 1,518 addresses across the whole run, Sparks 405 and Virginia City 194, and almost all of those came in the first week. That flat tail was search results and old shared links rather than anyone checking on a fire, and it is the clearest evidence that the operational job was finished.

Nearly two thirds of readers were on a phone, which is what a page written for people who may be packing a car ought to expect. The site is one HTML file with its styles inline and no scripts, fonts or trackers, so a reader on a bad cell connection in Palomino Valley got the whole thing in one request.

It never failed. Zero server errors across the entire run, and the machine serving it never went above 0.10 load average, including the hour 624 people arrived at once. About a fifth of all requests were probes for WordPress installers and other software this site does not run, which is ordinary background noise on any public address.

Where readers came from moved over the week. Reddit and Facebook carried the first evening, 1,355 and 542 visits between them, and search overtook both within a day. Among search engines, Bing and DuckDuckGo each sent more than twice what Google did: Bing 670, DuckDuckGo 668, Yahoo 346, Google 314. Just over half of all visits arrived with no referrer at all, which is what a link pasted into a text message or a group chat looks like from the server side.

The August 11 to 20 figures were measured at 1 PM PDT, August 20, 2026 from this site's nginx logs. Counts are of unique IP addresses, which undercounts households and phone networks that share one address and overcounts anyone who moved between wifi and cellular, so treat them as directional rather than exact. The geography figures come from a separate pass that filters bots slightly differently, so its totals do not line up exactly with the reader counts, and it resolves addresses against a local copy of the DB-IP City Lite database. No visitor address was sent to any third-party service. The 39,542 request count is every line in the log, including the 187 malformed ones scanners produced; the table's daily requests sum to the 39,355 that parsed.

Then the Hawk Fire started

The page went static on August 20 and nothing about it changed for three days. What changed was the fire situation: the Hawk Fire started northwest of Reno around midday on Saturday, August 22, and people came back to a page they had used earlier in the month. It was rewritten by hand every day after that until August 27, when it stopped.

Two numbers in that table were published wrong here and are corrected. The Reno-area count for August 21 was 13 and is 10; for August 22 it was 26 and is 25. Both of the original figures came from a geography pass done by hand on August 23, before there was a script with the city list written down in it. The script now exists, and run against two separate log archives it gives 10 and 25 both times. Three smaller figures from that same hand pass are superseded below for the same reason. Nothing about the conclusion changes, and the August 22 jump gets slightly larger, but the arithmetic behind a published number should be reproducible, and that one was not.

The biggest reader day is the least human day. Tuesday, August 25 is the highest reader count since August 13, 327, and every measure that separates a person from a scanner moved the other way on the same day. Requests tripled to about 4,500, and the share of them that failed went from around half to 78%, which is the actual explanation: the top failing requests are /wp-admin/install.php 374 times, /fetch 162 times, /.env 86 times. This site has never run WordPress. The busiest cities by page view on August 25 are Ashburn, Santa Clara, Los Angeles and Dallas, with Reno fifth. On August 22 Reno was first. By August 26 and 27 Reno is not in the top six at all.

That second row is the whole argument. It falls every single day, through the day the headline number peaked and through the day it fell again. Whatever arrived here after August 23 mostly did not load an image.

Some of the rise has a name. hawkfireinfo.com, the redirect domain described below, has started showing up as a referrer on this site: 10 page views on August 24, 53 on August 25, 47 on August 26 and 20 on August 27, from 65 separate addresses in the first three days alone. Three of those 65 fetched a single image. None of them are in Reno. They are in Santa Clara, Ashburn, Kassel, Frankfurt, Kansas City, Singapore and Bangkok. So a seventh of Tuesday's page views are the certificate scanners from the experiment below, walking the redirect through to the page and being counted as readers because they arrive wearing a browser's name.

The local count is the one worth reading, and it says the fire is over. It went from 10 on each of the two days before the fire to 25 on the day it started, which is two and a half times, and it is shaped like people where the rest is not: twelve active hours instead of twenty-four, 26 of 31 page views from a phone, 23 of 31 arriving with no referrer at all. No referrer means a bookmark, or a link someone saved during the Bug Fire and sent to somebody again.

It peaked on Sunday, August 23, and fell every day after. That is the day the fire page was rewritten by hand for the Hawk Fire, and it is the day the most local people read it: 25 readers and 42 page views across fifteen hours. Then 13, then 12, then 7, and on Thursday morning one person, one page view, in one hour of the day. Over the same stretch the fire went from zero containment to 93 percent. The local count tracked the fire coming under control rather than tracking the headline number, which was going up at the time.

That is the argument for stopping. The fire page went static on August 27 because the people running the fire had stopped reporting on it daily. This log says the people reading it had stopped too, and had stopped first. The same thing happened at the end of the Bug Fire: the local share of readers went from 37% to 8% in four days while the total held up on machines. Two fires, the same shape, and in both cases the traffic number that looked healthiest was the one worth trusting least.

The earlier version of this page put the August 22 local figures at 37 page views, 29 of them from a phone and 29 with no referrer. The recorded script gives 31, 26 and 23. Same finding, different arithmetic, and the second set is the one that can be reproduced. This is the fourth time in this project that a number measured by hand has failed to reproduce later, which is why the scripts and their filters are described here at all.

Measured in one pass at 9:35 AM PDT on Thursday, August 27, 2026, from the server's own nginx logs, using the same two scripts and the same definition of a reader as everything above, so every row on this page can be compared directly. The August 20 and 21 rows come from an earlier archive of the same log, measured the same way. August 27 is a partial day and will finish higher than 89. This is the last measurement. The fire page stopped being updated on August 27, 2026 and so does this one. The logs keep running and are kept for a year, so the numbers can be extended later by anyone with the scripts, which are archived with the site.

hawkfireinfo.com, and what a new domain actually attracts

A second domain, hawkfireinfo.com, was registered on August 24 and pointed at this site. It serves no page of its own: every request to it gets a redirect to bugfireinfo.com, so that there is still one address for this page rather than two. It has its own server log, and that log turns out to be a small, clean demonstration of something the tables above only assert.

It cannot have readers, so it is not in the tables. A reader here means an address that was served the page. hawkfireinfo.com never serves the page, so counting readers on it would return zero and mean nothing. Its arrivals are counted separately, by a separate script, and are not added to anything.

In its first 44 minutes it logged 261 requests from 40 addresses, and not one of them was a person. The name had been published nowhere. It had never been linked, posted or sent to anybody. What it had done was appear in a public certificate transparency log, which is where every newly issued HTTPS certificate is recorded, and which is monitored continuously by people looking for new hosts to scan.

The timing settles it. The first browser-looking request arrived thirteen seconds after the certificate authority finished validating the domain. The rest arrive in bursts, each burst just after a validation round. Four of them came from consecutive addresses within twenty-four seconds of each other. Several fetched the bare domain and the www version in the same second, which is a machine reading the two names off the certificate rather than anyone typing. Half the total was a single security scanner, 124 requests from one service. Thirty-nine were the certificate authority itself, and twenty-two were the operator checking his own work.

Six of those requests followed the redirect through and landed on this page, where they were counted as arriving from hawkfireinfo.com. Every one of them was a data center address, one of them announcing itself as a headless browser and another claiming to be an iPhone while sitting in an AWS region. They are in the August 24 numbers above, and they are part of why the machine share of that day is what it is.

None of this is a complaint. It is worth writing down because it is the same phenomenon the tables above describe, isolated by accident: a brand-new address with no readers at all still collected forty visitors in under an hour. When a traffic number rises, the first question is which of those two things moved.

Measured at 4:55 PM PDT, Monday, August 24, 2026, over the whole life of the log at that point, which began at 4:11 PM the same afternoon. Arrivals are counted with the same bot filter used for readers, applied to redirects instead of page loads, by a script kept with the others. The window is 44 minutes long and nothing here should be read as a rate.