THE INTERNET, OBSERVED

Watch protection
happen.

Real web traffic. Native ban confirmations.
An open window into fail2zig at work.

Explore incoming requests, inspect an address, and see the protection the daemon actually reports.

Enter the observation console
Observer feedConnectingRead-only demo observer
Native protectionChecking…Awaiting status sample
Native readinessChecking…Awaiting health sample
Running version—Reported by the demo
Live observationOriginal event times · UTC
—requests in this view
—confirmations in this view
—current ban records LIVE

Observations show what arrived.
Confirmations show native decisions.

01 / OBSERVE

Incoming activity

nginx access
TIME / SOURCE ADDRESSREQUEST / RESPONSE
    Waiting for activity.

    Requests appear as the observer sees them.
    A quiet feed can still be healthy.

    Latest 200 retained events · select an address to inspectWaiting for activity.
    02 / VERIFY

    Confirmed protection

    native

    Authoritative current snapshot · checking…

      Checking current protection…

      Confirmation and enforcement are reported independently.

      Expiry is based on your browser clock.
      FOLLOW AN ADDRESS

      Every observation has context.

      Select an address in either panel to bring its requests, native confirmations and current protection together.

      03 / CHECK

      Protection has a health signal.

      Live native samples, independent of the activity view.
      Status and readiness are sampled separately.

      Storage—
      Sources—
      Enforcement—
      Clock—
      Effects—
      Expiry—
      Uptime—
      Active jails—

      Checking native status and readiness…

      Technical details Runtime, component states & worker diagnostics
      THE DEPLOYMENT

      A real surface.
      An inert target.

      Web probes reach static decoys. Authentication attempts meet an empty password file. fail2zig reads the service logs and confirms enforcement through the kernel.

      How confirmation works
      01SSH authenticationsshd
      02Web probesnginx-botsearch
      03HTTP authenticationnginx-http-auth
      04Request limitsnginx-limit-req
      05Repeat bansrecidive
      Deployed policy Documented September 16, 2026
      Documented configuration; these are not live per-attempt counters.
      Jail Threshold / window Initial ban Repeat behavior
      sshd 3 / 10 min 15 min Increases up to 24 hours
      nginx-botsearch 2 / 5 min 15 min Contributes to recidive
      nginx-http-auth 3 / 5 min 15 min Contributes to recidive
      nginx-limit-req 2 / 1 min 15 min Contributes to recidive
      recidive 3 / 24 hours 1 hour Separate repeat-offender policy