30°

Live lab

no run in the last 12 h · last run Oct 21, 12:40 AM UTC

Risk on real traffic

Rules and model watching this site, the VPS authentication log and public mentions of the name. It records itself; nothing here is edited afterwards.

Events processed237,148web 191,695 · tls 45,407 · ssh 45 · mention 1
Flagged34,11614.39% of events
Flagged by the model alone14,31942% of flagged
Days recorded402026-09-10 → 2026-10-21 · 156 runs
The pipeline, with this period’s numbers on itEvery box is a process that is running. The dots are the traffic, in proportion to each source; amber is what a rule flagged, teal what only the forest saw.
01 / Sources02 / Kafka03 / Flink04 / DecisionCaddy55 sites · every request191,695TLS handshakebefore HTTP exists45,407sshdaccepted or failed45Mentionsnews · HN · GitHub0efg_events237,148 eventsRules R1–R6per key · thresholds22,431 firedRandom Cut Forestglobal + one per host14,319 model aloneefg_decisions34,116flagged · 14.4%
Every runOne bar per collection run: how much traffic went through and how much of it got flagged.
  • not flagged
  • flagged
View as table
Run (UTC)EventsFlaggedFlagged by the model alone
Oct 09, 12:40 AM8293831
Oct 09, 06:40 AM83321641
Oct 09, 12:40 PM75010646
Oct 09, 06:40 PM83733757
Oct 10, 12:40 AM8856354
Oct 10, 06:40 AM6773730
Oct 10, 12:40 PM5,076540233
Oct 10, 06:40 PM1,43024984
Oct 11, 12:40 AM1,191114103
Oct 11, 06:40 AM6814938
Oct 11, 12:40 PM73018286
Oct 11, 06:40 PM1,09912433
Oct 12, 12:40 AM1,02417786
Oct 12, 06:40 AM1,30025780
Oct 12, 12:40 PM1,1638361
Oct 12, 06:40 PM1,1588067
Oct 13, 12:40 AM1,28221351
Oct 13, 06:40 AM1,25220176
Oct 13, 12:40 PM1,548337113
Oct 13, 06:40 PM5,066274218
Oct 14, 12:40 AM1,36537547
Oct 14, 06:40 AM2,130360120
Oct 14, 12:40 PM1,14913181
Oct 14, 06:40 PM5,129348294
Oct 15, 12:40 AM1,38138059
Oct 15, 06:40 AM1,32713573
Oct 15, 12:40 PM1,77937896
Oct 15, 06:40 PM1,31741074
Oct 16, 12:40 AM2,00565497
Oct 16, 06:40 AM1,14414182
Oct 16, 12:40 PM1,11511152
Oct 16, 06:40 PM74611467
Oct 17, 12:40 AM98327069
Oct 17, 06:40 AM1,11826857
Oct 17, 12:40 PM78915261
Oct 20, 12:40 AM1,37273464
Oct 20, 06:42 AM1,21631479
Oct 20, 12:40 PM1,566212109
Oct 20, 06:40 PM77312530
Oct 21, 12:40 AM5,146954439
The last 24 hours, replayedEach dot is one detection at its minute (UTC). The playhead sweeps the window every 16 seconds and lights them up as it passes.
  • a rule · 948
  • model alone · 666
What fired
  • R2_RUTA_SENSIBLEPath nobody browses · .env, wp-login, .git12,470
  • R1_RAFAGABurst · 120 requests in 60 s from one /248,811
  • R6_SONDEO_MTLSHandshake without a valid certificate against an mTLS endpoint999
  • R4_ERROR_SERVIDORThe edge answered 5xx on a static site150
  • R5_FUENTE_NUEVAA source never seen before naming him1
Traffic by hostEvery site behind the edge logs into the same pipeline, including the ones nobody links to.
  • efraingaray.com168,545
  • mentesenvoz.com5,456
  • www.efraingaray.com3,458
  • webmail.efraingaray.com3,219
  • 76.13.231.180:801,480
  • relay.phantom-dash.com1,382
  • login.phantom-dash.com1,028
  • workflow.mentesenvoz.com879
Most flagged keysWeb addresses arrive masked to /24 from Caddy itself, so a subnet is as far as this goes.
  • 179.60.72.02,260
  • 143.110.164.0762
  • 46.62.170.0627
  • 168.119.191.0624
  • 34.39.42.0517
  • 104.23.221.0509
  • 104.23.229.0400
  • 172.68.151.0323
Latest detections
Time (UTC)SourceKeyDetailRule
10/21/26, 12:37 AMweb104.23.239.0/wp-admin/install.phpR2_RUTA_SENSIBLE
10/21/26, 12:37 AMweb104.23.239.0/wp-admin/install.phpR2_RUTA_SENSIBLE
10/21/26, 12:21 AMweb143.110.164.0/administrator/components/com_jce/jce.xmlR2_RUTA_SENSIBLE
10/21/26, 12:21 AMtls143.110.164.0no certificate available for 'mentesenvoz.com'model
10/21/26, 12:09 AMweb185.13.43.0/model
10/20/26, 11:58 PMweb151.252.25.0/model
10/20/26, 11:53 PMweb143.110.164.0/administrator/components/com_jce/jce.xmlR2_RUTA_SENSIBLE
10/20/26, 11:53 PMtls143.110.164.0no certificate available for 'mentesenvoz.com'model
10/20/26, 11:45 PMweb162.159.114.0/smtp/phpinfo.phpR1_RAFAGA
10/20/26, 11:45 PMweb162.159.114.0/webmail/phpinfo.phpR1_RAFAGA
10/20/26, 11:45 PMweb162.159.114.0/hosting/phpinfo.phpR1_RAFAGA
10/20/26, 11:45 PMweb162.159.114.0/cpanel/phpinfo.phpR1_RAFAGA

Watch it happen

A page the server holds open and keeps writing: every decision appears the moment the pipeline makes it, with no JavaScript on the page.

Open the live stream

What this measures, and what it does not

The article behind this measured recall against injected, labeled anomalies. Here nobody labels anything, so recall cannot be computed. What can: how much each rule fires, over how many distinct keys, and whether the forest ever flags something the rules missed. A zero in that last number does not prove the model useless, it says the traffic has not brought anything outside its distribution yet.

Read the measurement behind it

Updated on every deploy from the registry the scheduled job commits.