passive traffic classification · homelab security
Every public IP address gets scanned constantly — WordPress exploit probes, leaked credential hunts, router-botnet checks — none of it personal, all of it automated. This turns that noise into a classified, queryable public record instead of letting it rot in a log file that rotates out after a few days.
Any server with a public IP gets probed constantly, whether or not there's anything worth finding — WordPress login paths, leaked .env/.git files, router-botnet exploit strings, all automated, all indifferent to what's actually running. Most self-hosted setups either don't log this at all, or it sits in a file that rotates out in a few days and nobody ever actually reads.
And from the raw log alone, there's no way to tell which of it is a real visitor and which is a bot claiming to be one — a lot of "Googlebot" traffic isn't Google at all.
Every request already lands in this server's own SQLite log; a classifier reads it and sorts each one into scanner, verified_crawler, vpn_datacenter, or residential — a self-incriminating path or user-agent signature wins outright, a search-engine crawler claim has to survive a real reverse-then-forward DNS check, and everything else falls back to a hosting-network lookup before landing on residential by default. Roughly 30 named exploit/scanner signatures are tracked by name, not just counted anonymously.
This is a classifier and a public record, not a firewall — nothing here blocks a single request. It's built to answer "what is this," not to stop it.
That 91% counts collapsed (IP, minute) groups, not raw hits — one 500-request scanner burst in a single minute still counts once, so the real noise-to-signal ratio by raw request count is worse than this figure suggests.
A plain status ledger, not a sales sheet — this is what's verified, what's degraded, and what's still open.
The hosting/VPN lookup currently runs on a keyword match against ASN names — swapping in GreyNoise's scanner-intent database would give more authoritative labels than a name-string guess. The classification itself is also reusable outside Telegram and the dashboard: nothing stops the same signal from feeding an actual defense later (Cloudflare's managed WAF ruleset, CrowdSec) if that ever becomes the goal — it deliberately isn't today.
"Every server on the internet gets knocked on, all day, by things that don't care what's behind the door. I wanted to actually see who — or what — was doing it, instead of just trusting a log file I was never going to read." — Ray, designer & builder of Who's Knocking