srjecsSRJECSSRJECS2788-9408https://doi.org/10.47310/srjecs.2026.v06i01.006Predictive Security Analytics for Large-Scale Multi-Tenant Linux Shared Hosting Environments: An Empirical StudyBackground: Security attacks on large multi-tenant shared hosting sites, such as Linux based web servers, are rampant, severe and ongoing. These sites provide shared resources and are attacked constantly. Current reactive security products that usually notify of an attack hour after the fact are completely ineffective. This leaves hundreds of websites hosted on a server that have been compromised and not yet discovered. Methods: In this work, we perform an empirical study on five production Linux shared hosting servers hosting 707 websites over a 30-day time period (February 15 - March 17, 2026). We have collated and analysed authentication logs from all the five servers to measure attack volume, sources of attacks, and the types of credentials being attacked, as well as the current preventative measures deployed. A predictive security analytics framework is further proposed and validated against the measured attack landscape. Results: Failed SSH login attempts on all 5 servers for the period: 1,460,787 attempts originating from 1,674 IP addresses None of the servers had Fail2Ban engaged and there were no DROP rules on the firewalls. The most common username attempted was the root account along with a whole host of generic usernames (admin, user, ubuntu & test) The attack intensity on each server over the period of time was quite varied with a high of 170,936 attempts in a single week on one server. Conclusions: We have demonstrated a significant and lasting vulnerability in shared hosting platforms using common configurations and lacking any preventative or proactive protection mechanisms. We showed a possible security approach for shared hosting based on log anomaly detection and associated remediation steps, and demonstrated steps towards more proactive and resilient security for shared hosting platforms.