Every website I host sits behind Cloudflare, and something is always knocking on the door. This globe shows where it came from. Each arc is a real request that Cloudflare blocked or challenged on one of my sites, flying in to the UK, replayed from the last 24 hours.
- blocked or challenged in the last 24 hours
- exploit attempts -
- bad bots -
- other blocks -
Top sources
replaying
What the colours mean
- Red: exploit attempts. Requests that matched Cloudflare’s managed rules for known attacks, such as probing for old vulnerabilities or trying to sneak code into a form.
- Blue: bad bots. Automated traffic that failed Cloudflare’s bot checks.
- Amber: other blocks. Everything else Cloudflare stopped before it reached my servers.
Thicker arcs mean more requests from that country in that 15 minutes.
Where an attack “comes from”
The country is where Cloudflare saw the request come from, not where the person behind it lives. Most of this traffic comes from rented cloud servers and VPNs, so a big arc from the Netherlands usually means a scanner running in a data centre there, not a Dutch hacker. “Tor network” means it came through Tor, so there’s no country at all.
What it leaves out, on purpose
A map like this could easily help the people it’s showing, so it only shares the bare minimum:
- No IP addresses, networks or URLs. Just a country, a type and a count.
- No site names. It adds up every site I host, so you can’t tell which one was hit.
- It runs behind. The data is at least 15 minutes old and grouped into 15-minute blocks, so nobody can use it to check whether their own probe just got blocked.
How it works
The web server asks Cloudflare’s Analytics API every five minutes for the requests it blocked or challenged, using a read-only token that never leaves the server. It keeps only the country, type and count, and the page loads that small summary. The globe is drawn in your browser from a dot map of the world, with no third-party scripts or trackers.
More tools and guides
total 5
Related projects
total 3