12°

Live lab

Risk on real traffic

Rules and model watching this site, the VPS authentication log and public mentions of the name. It records itself; nothing here is edited afterwards.

Days recorded22026-09-10 → 2026-09-11
Events processed1,706web 1,644 · ssh 45 · tls 17
Flagged1599.32%
Flagged by the model alone119

Every run

One bar per collection run: how much traffic went through and how much of it got flagged.

events flagged

What fired

  • R2_RUTA_SENSIBLEPath nobody browses · .env, wp-login, .git32
  • R4_ERROR_SERVIDORThe edge answered 5xx on a static site7
  • R6_SONDEO_MTLSHandshake without a valid certificate against an mTLS endpoint1

Most flagged keys

Web addresses arrive masked to /24 from Caddy itself, so a subnet is as far as this goes.

  • 179.60.72.038
  • 100.80.252.08
  • 104.23.221.07
  • 81.65.94.06
  • 66.249.65.05
  • 3.142.129.05
  • 74.7.241.05
  • 57.141.22.05

Latest detections

Time (UTC)SourceKeyDetailRule
9/11/26, 1:13 AMtls179.60.72.0tls: client didn't provide a certificateR6_SONDEO_MTLS
9/11/26, 1:11 AMtls194.24.161.0no certificate available for '172.18.0.6'model
9/11/26, 12:56 AMtls216.81.245.0no certificate available for 'files.phantom-dash.com'model
9/11/26, 12:43 AMweb139.59.31.0/model
9/11/26, 12:36 AMweb69.171.230.0/robots.txtmodel
9/11/26, 12:25 AMtls194.24.161.0no certificate available for '172.18.0.6'model
9/10/26, 11:58 PMweb118.171.147.0/media/post-cuantico-chile-medido-reel.mp4model
9/10/26, 11:47 PMweb104.23.221.0/wp-admin/install.phpR2_RUTA_SENSIBLE
9/10/26, 11:47 PMweb104.23.221.0/wp-admin/install.phpR2_RUTA_SENSIBLE
9/10/26, 11:24 PMweb118.31.112.0/model
9/10/26, 11:19 PMtls194.24.161.0no certificate available for '172.18.0.6'model
9/10/26, 11:10 PMtls179.60.72.0tls: client didn't provide a certificatemodel

Watch it happen

A page the server holds open and keeps writing: every decision appears the moment the pipeline makes it, with no JavaScript on the page.

Open the live stream

What this measures, and what it does not

The article behind this measured recall against injected, labeled anomalies. Here nobody labels anything, so recall cannot be computed. What can: how much each rule fires, over how many distinct keys, and whether the forest ever flags something the rules missed. A zero in that last number does not prove the model useless, it says the traffic has not brought anything outside its distribution yet.

Read the measurement behind it

Updated on every deploy from the registry the scheduled job commits.