feat(reports): store and browse report artifacts

B001 change caused 'unsupported operand type(s) for -: list and set' during a
full consolidated scan: _db_complete_blocklist returned split_cidr_versions()
output, which is tuple[list, list], but write_blocklist_report()/blocklist_delta()
expect set operands. Return set(v4), set(v6) to match cumulative_blocklist's
contract. Reproduced the exact report path with a populated ledger and
verified it no longer crashes.

.env.example

@@ -1,85 +1,90 @@
-# ---------------------------------------------------------------------------
-# Intrusion Detection System — environment template
-# ---------------------------------------------------------------------------
-# Copy this file to `.env` for local development and fill in your values:
-#
-#     copy .env.example .env
-#
-# Precedence: real system environment variables win over values in `.env`,
-# so production deployments can set these via the OS and skip `.env`.
-# `.env` is git-ignored — never commit real secrets to it.
-
-# --- Web server (localhost only) -------------------------------------------------
-
-# The Flask web UI binds to localhost so it is only reachable from this machine. 
-# Do not expose WEB_HOST beyond 127.0.0.1!
-WEB_HOST=127.0.0.1
-# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
-WEB_PORT=54666
-
-# --- Log sources -----------------------------------------------------------
-
-# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
-COPYPARTY_LOG_PATH=P:\copyparty
-
-# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
-NPM_LOG_PATH=Y:\npm\logs
-
-# --- MikroTik RouterOS connection -----------------------------------------
-
-# IP/hostname of the router to sync the blocklist to.
-ROUTER_IP=192.168.88.1
-
-# SSH user for the router.
-ROUTER_USER=admin
-
-# SSH password for the router (required when --update-firewall is used).
-ROUTER_PASSWORD=change-me
-
-# Address list on the router that holds blocked IPs/subnets.
-BLOCKLIST_NAME=Blocked
-
-# Comma-separated address lists that are treated as whitelisted (never blocked).
-WHITELIST_NAMES=Cloudflare,Openfactory
-
-# --- WHOIS subnet consolidation --------------------------------------------
-
-WHOIS_SERVER=whois.radb.net
-WHOIS_PORT=43
-WHOIS_TIMEOUT=3.0
-
-# Minimum number of same-subnet IPs before blocking the whole subnet.
-SUBNET_THRESHOLD=3
-
-# --- Report retention ------------------------------------------------------
-
-# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
-# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
-# are pruned automatically after each consolidated scan. The blocklist files
-# in reports/app/data/ are always protected.
-REPORT_RETENTION_DAYS=30
-REPORT_RETENTION_MAX_FILES=10
-
-# --- Scan / flagging defaults ----------------------------------------------
-
-# Rows in the top-IP report tables.
-DEFAULT_TOP=30
-
-# copyparty: minimum denied hits before flagging an IP.
-DEFAULT_MIN_DENIED=1
-
-# npm: minimum error responses before flagging an IP.
-DEFAULT_MIN_ERRORS=5
-
-# npm: minimum error ratio before flagging an IP.
-DEFAULT_ERROR_RATIO=0.5
-
-# Rows in the "top error paths" report section.
-DEFAULT_TOP_PATHS=20
-
-# --- Whitelist sources -----------------------------------------------------
-
-OPENFACTORY_URL=https://openfactory.net/geofeed.csv
-CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
-CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
+# ---------------------------------------------------------------------------
+# Intrusion Detection System — environment template
+# ---------------------------------------------------------------------------
+# Copy this file to `.env` for local development and fill in your values:
+#
+#     copy .env.example .env
+#
+# Precedence: real system environment variables win over values in `.env`,
+# so production deployments can set these via the OS and skip `.env`.
+# `.env` is git-ignored — never commit real secrets to it.
+
+# --- Web server (localhost only) -------------------------------------------------
+
+# The Flask web UI binds to localhost so it is only reachable from this machine. 
+# Do not expose WEB_HOST beyond 127.0.0.1!
+WEB_HOST=127.0.0.1
+# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
+WEB_PORT=54666
+
+# --- Log sources -----------------------------------------------------------
+
+# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
+COPYPARTY_LOG_PATH=P:\copyparty
+
+# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
+NPM_LOG_PATH=Y:\npm\logs
+
+# --- MikroTik RouterOS connection -----------------------------------------
+
+# IP/hostname of the router to sync the blocklist to.
+ROUTER_IP=192.168.88.1
+
+# SSH user for the router.
+ROUTER_USER=admin
+
+# SSH password for the router (required when --update-firewall is used).
+ROUTER_PASSWORD=change-me
+
+# Address list on the router that holds blocked IPs/subnets.
+BLOCKLIST_NAME=Blocked
+
+# Comma-separated address lists that are treated as whitelisted (never blocked).
+WHITELIST_NAMES=Cloudflare,Init7
+
+# --- WHOIS subnet consolidation --------------------------------------------
+
+WHOIS_SERVER=whois.radb.net
+WHOIS_PORT=43
+WHOIS_TIMEOUT=3.0
+
+# Minimum number of same-subnet IPs before blocking the whole subnet.
+SUBNET_THRESHOLD=3
+
+# --- Report retention ------------------------------------------------------
+
+# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
+# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
+# are pruned automatically after each consolidated scan. The blocklist files
+# in reports/app/data/ are always protected.
+REPORT_RETENTION_DAYS=30
+REPORT_RETENTION_MAX_FILES=10
+
+# --- SQLite store ---------------------------------------------------------
+
+# Local SQLite database canonical store (logs, scans, blocklist/whitelist and
+# firewall history). Created automatically on first run. Default: data/ids.db
+#IDS_DB_PATH=/absolute/path/to/ids.db
+
+# --- Scan / flagging defaults ----------------------------------------------
+
+# Rows in the top-IP report tables.
+DEFAULT_TOP=30
+
+# copyparty: minimum denied hits before flagging an IP.
+DEFAULT_MIN_DENIED=1
+
+# npm: minimum error responses before flagging an IP.
+DEFAULT_MIN_ERRORS=5
+
+# npm: minimum error ratio before flagging an IP.
+DEFAULT_ERROR_RATIO=0.5
+
+# Rows in the "top error paths" report section.
+DEFAULT_TOP_PATHS=20
+
+# --- Whitelist sources -----------------------------------------------------
+
+CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
+CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
 PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity

.gitignore

@@ -8,13 +8,24 @@ skills-lock.json
 
 # python cache
 __pycache__/
+.mypy_cache/
 
-# incremental-scan state (regenerated each run)
-data/scan_state.json
+# python virtual environment
+.venv/
 
-# reports data
-reports/copyparty/
-reports/mikrotik/
-reports/npm/
-# timestamped app blocklist change reports (reports/app/data/ stays tracked)
-reports/app/*.json
+# app runtime data (feeds, caches, scan state - regenerated each run).
+# All of this must stay UNTRACKED so ``git pull`` never conflicts with files a
+# scan has written since the last pull (see .github/instructions/DEPLOYMENT.md).
+# The single allowed tracked seed is the read-only PaloAlto scanner-ips.txt
+# (never rewritten at runtime); the Cloudflare ips-*.txt are runtime-refreshed
+# downloads, so they are NOT tracked and are re-downloaded if absent.
+app/data/*
+!app/data/paloalto/scanner-ips.txt
+
+# SQLite database (canonical store) + WAL/SHM sidecars
+app/data/*.db
+app/data/*.db-wal
+app/data/*.db-shm
+
+# generated reports
+app/reports/

README.md

@@ -49,6 +49,10 @@ intrusion-detection/
 │   ├── scan/            scan pipeline
 │   │   ├── __init__.py  consolidated scanner (run_scan, ScanParams, ScanResult)
 │   │   └── scan_state.py incremental log scan state (load/save)
+│   ├── db/              SQLite store (see .github/instructions/DATABASE.md)
+│   │   ├── __init__.py     connection factory + migrations runner
+│   │   ├── schema.py       DDL for all tables (PRAGMA user_version migrations)
+│   │   └── repositories.py  queries: logs, scans, blocklist, whitelist, firewall
 │   ├── utils/           shared utilities
 │   │   ├── constants.py     all config constants (paths, env vars, thresholds)
 │   │   ├── files.py         read_lines, find_logs, write_csv/json/lines
@@ -63,13 +67,13 @@ intrusion-detection/
 │   ├── static/          style.css + app.js (dark-theme UI)
 │   └── templates/       Jinja2 page templates (dashboard, scan, reports, …)
 ├── data/                whitelist source files (cached locally)
-│   ├── openfactory/
-│   │   └── geofeed.csv
+│   ├── init7/           (ranges built into app/utils/whitelists.py — no geofeed)
 │   ├── cloudflare/
 │   │   ├── ips-v4.txt
 │   │   └── ips-v6.txt
-│   └── paloalto/
-│       └── scanner-ips.txt
+│   ├── paloalto/
+│   │   └── scanner-ips.txt
+│   └── ids.db           local SQLite store (log/scan/blocklist/whitelist history; auto-created)
 ├── reports/             generated reports (per-run + per-source)
 │   ├── copyparty/
 │   ├── npm/
@@ -135,13 +139,26 @@ production can set the same variables via the OS and skip `.env` entirely.
 | `ROUTER_USER`        | `admin`                  | MikroTik connection   |
 | `ROUTER_PASSWORD`    | _(set in .env)_          | MikroTik connection   |
 | `BLOCKLIST_NAME`     | `Blocked`                | MikroTik address list |
-| `WHITELIST_NAMES`    | `Cloudflare,Openfactory` | MikroTik whitelists   |
+| `WHITELIST_NAMES`    | `Cloudflare,Init7`       | MikroTik whitelists   |
 | `WEB_HOST`           | `127.0.0.1`              | web UI bind host      |
 | `WEB_PORT`           | `54666`                  | web UI port           |
 
 See `.env.example` for the complete list of supported variables (WHOIS
 tuning, scan thresholds, whitelist source URLs, and more).
 
+### Network context (2026-09-08)
+
+Connectivity provider switched Openfactory → Init7 on 2026-09-08:
+
+- WAN IPv4: `77.74.80.159/32` (init7 `77.74.80.0/24`, "Hybrid7-NET").
+- IPv6: delegated `/48` `2001:1620:549f::/48` (init7 allocation `2001:1620::/30`).
+- Upstream DNS: `77.109.128.2`, `213.144.129.20`.
+
+The `Openfactory` whitelist (old AS58299 geofeed) is obsolete and must be
+replaced with an `Init7` whitelist — see
+[`.github/instructions/TODO.md`](.github/instructions/TODO.md) for the
+switchover plan and the verified init7 CIDR ranges.
+
 ## Usage
 
 ```powershell
@@ -155,6 +172,11 @@ python app.py scan --quiet
 python app.py scan --update-firewall --dry-run
 python app.py scan --update-firewall
 
+# detailed log-analysis report from the SQLite store (needs scans run first)
+python app.py analyze                  # top IPs + cross-source + blocklist
+python app.py analyze --ip 1.2.3.4     # drill into one IP's request history
+python app.py analyze --json           # machine-readable output
+
 # individual scanners (still runnable directly)
 python -m app.copyparty
 python -m app.npm
@@ -197,29 +219,36 @@ time and is never trimmed automatically.
   it stops appearing in recent logs (for example after it leaves the NPM
   ~30-day log-retention window, or once WHOIS subnet consolidation groups it
   into a larger range).
-- The **source of truth** for "all blocked IPs" is the git history of the
-  consolidated blocklist files `reports/app/data/blocklist_ipv4.txt` and
-  `blocklist_ipv6.txt` (these files are git-tracked). After each scan the
-  updated blocklist files should be committed so the history keeps growing.
+- The **source of truth** for "all blocked IPs" is the **SQLite blocklist
+  ledger** (`app.db` → `blocklist_entries` / `blocklist_events`), not git
+  history. Each scan syncs the desired blocklist into the ledger; the router's
+  cumulative state is derived from it. `app/utils/blocklist_history.py` is a
+  read-only fallback only.
 - The sync only ever **adds** entries. The only automatic removals are router
-  entries that were never blocked by the system — i.e. absent from every git
-  version of the blocklist files (manual / rogue entries).
+  entries that were never blocked by the system — i.e. absent from the ledger
+  (manual / rogue entries).
 - To explicitly unblock an IP, remove it manually via the web UI
   (`/blocklist` → remove) or directly on the router; the automated sync will
   not re-add entries that are not part of a scan.
 
+> **Deployment note:** runtime data (blocklists, reports, the DB) is **never
+> committed to git**. Keeping it untracked is what makes `git pull` updates
+> conflict-free — see [`DEPLOYMENT.md`](.github/instructions/DEPLOYMENT.md)
+> and the `deploy/` scripts.
+
 Each consolidated scan with `--update-firewall` also writes a timestamped
 change report to `reports/app/YYYY-MM-DD-hh-mm-ss.json`: the number and list
 of entries added / removed (complete-set delta), the full cumulative blocked
-list, and the router sync changes.
+list, and the router sync changes. It also persists a firewall snapshot into
+the `firewall_snapshots` SQLite tables for long-term audit (F001).
 
 ### Report retention
 
 Generated files under `reports/` are pruned automatically after each
 consolidated scan: every subdirectory keeps at most
 `REPORT_RETENTION_MAX_FILES` files (default 10), all newer than
-`REPORT_RETENTION_DAYS` days (default 30). The blocklist source of truth
-(`reports/app/data/blocklist_ipv4.txt` / `blocklist_ipv6.txt`) is always
+`REPORT_RETENTION_DAYS` days (default 30). The blocklist files
+(`reports/app/data/blocklist_ipv4.txt` / `blocklist_ipv6.txt`) are always
 protected and never pruned. Tune via `REPORT_RETENTION_DAYS` /
 `REPORT_RETENTION_MAX_FILES`; `--dry-run` previews the cleanup without
 deleting.
@@ -241,6 +270,8 @@ Pages:
 | `/blocklist` | view the consolidated blocklist, add/remove entries   |
 | `/firewall`  | view address lists + rules, preview/apply a sync      |
 | `/whitelist` | view/manage provider whitelist CIDRs                  |
+| `/graph`      | visualize the 0.0.0.0/8 address space (blocked/whitelisted pixels) |
+| `/analysis`   | detailed persisted-log analysis (top IPs, drill-down, cross-source) |
 
 Scans run in a background thread (only one at a time) and report progress via
 the JSON API, so the UI never blocks. Firewall sync is **dry-run by default**
@@ -249,6 +280,35 @@ from the UI — applying changes is an explicit action. The main JSON endpoints
 `/api/firewall/*`, `/api/whitelist`) are also usable directly from a REST
 client.
 
+## Deployment & updating (`git pull`)
+
+The app runs scans continuously (web UI + cron + CLI), and all of it is
+intended to be updated on the server with a plain `git pull`. To make that
+**safe** — i.e. never conflict with a file a scan wrote since the last pull —
+runtime data is strictly **never committed to git**:
+
+- `app/data/*`, `app/reports/*` and the SQLite DB (`app/data/ids.db`) are
+gitignored. The only tracked file under `data/` is the read-only
+`app/data/paloalto/scanner-ips.txt` seed.
+- The Cloudflare `ips-*.txt` whitelist seeds are **not** tracked: they are
+runtime-refreshed downloads and are re-fetched if absent (built-in ranges are
+the fallback).
+- History that must survive — the cumulative blocklist and firewall audit —
+lives in the SQLite store, not in git revisions.
+
+Update a deployed instance with:
+
+```sh
+sudo deploy/deploy.sh
+```
+
+See [`DEPLOYMENT.md`](.github/instructions/DEPLOYMENT.md) for the full plan,
+and `deploy/` for the scripts (`deploy.sh`, `restart-service.sh`,
+`check_runtime_git.sh`, `ids.service` systemd template). The wrapper
+fast-forwards only (`git pull --ff-only`), refuses to run on an unclean tree,
+reinstalls deps if `requirements.txt` changed, applies DB migrations
+(`python -m app.db --migrate`), and restarts the `ids` unit.
+
 ## Output
 
 Each script writes to its own report directory. `app.py` also writes
@@ -299,9 +359,11 @@ reports/
 ```
 
 The current router state (address lists + firewall rules) is also mirrored to
-`data/mikrotik/` on every `--update-firewall` run. Those files are overwritten
-each run and are **git-visible**, so `git diff` shows how the firewall rules
-and address lists change over time.
+`data/mikrotik/` on every `--update-firewall` run as a scratch pointer to the
+latest snapshot. Those files are overwritten each run and are **not** tracked;
+the long-term audit trail is the SQLite `firewall_snapshots` tables plus the
+timestamped reports under `reports/mikrotik/`. `git pull` is therefore never
+blocked by firewall-state files.
 
 ## Detection
 

REPORTS.md

@@ -0,0 +1,142 @@
+# Report Inventory
+
+This inventory records the current report surface before moving report reads
+or writes into SQLite. Generated paths are rooted at `REPORT_DIR` (normally
+`reports/`). The SQLite tables listed below already exist in schema v1 unless
+noted otherwise.
+
+## Artifacts
+
+| Area | Producer and formats | Current role and consumers | Classification |
+| --- | --- | --- | --- |
+| `copyparty/` | `Analyzer.write_report()` creates timestamped `.txt`; `write_data()` creates per-IP CSV/JSON, denied-path CSV, flagged/banned IP TXT, `requests.csv`, `authed_users.json`, and `mikrotik-block.rsc`. | Reports API serves top-level text reports. `requests.csv` is imported by `app.db.backfill`; per-run data supports inspection and legacy workflows. Retention prunes generated files. | Request rows and per-scan IP stats are canonical in `requests` and `ip_stats`; rendered summaries and exports are derived. |
+| `npm/` | Same analyzer outputs, plus user-agent and host summary CSV files. | Same consumers as copyparty. `requests.csv` is a legacy backfill input; retention prunes generated files. | Request rows and per-scan IP stats are canonical in `requests` and `ip_stats`; summaries and exports are derived. |
+| `app/data/` | Consolidated scan writes `blocklist_ipv4.txt` and `blocklist_ipv6.txt`. | Blocklist UI/API reads these files; scan history reconstruction and firewall sync use them as current/compatibility inputs. Retention explicitly protects them. | Operational compatibility exports. Canonical blocked targets and events belong in `blocklist_entries` and `blocklist_events`; keep files until every consumer uses the DB and git-history contract is replaced. |
+| `app/` timestamped JSON | `write_blocklist_report()` emits scan/firewall change reports when the router is reachable. | Human-readable audit trail containing run delta, cumulative targets, router changes, dry-run state, and errors; retained under report retention. | Derived audit artifact. Preserve structured fields and source scan association in the DB before considering file retirement. |
+| `mikrotik/` | `MikrotikFirewall.save_state_report()` writes timestamped JSON snapshots and report data; latest state is also written to `data/mikrotik/*.json`. | Firewall UI/API displays current state and snapshot history. `app.db.backfill` currently imports only the latest `data/mikrotik` snapshot; runtime snapshot persistence uses `firewall_snapshots`, `firewall_address_list_entries`, and `firewall_rule_entries`. | Firewall rows and snapshots are canonical in the DB once persisted. Keep JSON exports during migration and retain any git-diff inputs required by deployment/audit. |
+
+## Consumers
+
+- `GET /api/reports/<source>` lists top-level files in the selected report
+  directory; `GET /api/reports/<source>/<path>` reads a file below it.
+- The reports page consumes those endpoints. Scan status and dashboard helpers
+  select the newest source and MikroTik report files for display.
+- `/api/blocklist` reads the consolidated IPv4/IPv6 text files. Scan history
+  reconstruction and firewall sync also consume those files alongside the
+  SQLite ledger and git history.
+- RouterOS `.rsc` exports and firewall synchronization consume generated
+  targets; these are operational outputs, not disposable presentation files.
+- `app.db.backfill` imports per-source `requests.csv`, blocklist history, and
+  the latest common MikroTik JSON snapshot. It does not currently import all
+  timestamped reports or all historical MikroTik snapshots.
+- Report retention removes old generated artifacts after consolidated scans,
+  subject to configured age/file-count limits; the consolidated blocklist
+  files are protected.
+
+## Restructuring Implications
+
+- Keep `requests`, `ip_stats`, blocklist tables, and firewall snapshot tables
+  as the queryable source of truth for facts they already represent. Avoid
+  copying those facts into a generic report blob.
+- A future report-artifact record should store metadata and structured fields
+  that have no canonical home yet. Rendered text/CSV/JSON should be generated
+  from those records or remain an explicit export.
+- Preserve source paths, generated timestamps, scan IDs, and hashes during
+  import so DB records can be traced back to original files.
+- Do not retire blocklist exports, RouterOS scripts, or source logs until
+  their consumers and audit requirements have explicit replacements.
+
+## Database and API Design
+
+### Canonical Data
+
+Continue treating normalized domain tables as canonical for facts they
+already represent:
+
+- `requests` for parsed request events.
+- `ip_stats` for per-IP/per-scan aggregates.
+- `scans` and `scans_sources` for run status, parameters, and source counts.
+- `blocklist_entries`, `blocklist_reasons`, and `blocklist_events` for block
+  decisions and history.
+- `firewall_snapshots`, `firewall_address_list_entries`, and
+  `firewall_rule_entries` for router state.
+
+Add a `report_artifacts` table only for report-specific summaries that cannot
+be reconstructed from those canonical rows. Proposed columns:
+
+| Column | Purpose |
+| --- | --- |
+| `id` | Integer primary key. |
+| `source` | `copyparty`, `npm`, `app`, or `mikrotik`. Keep as text because `log_sources` currently covers only request sources. |
+| `scan_id` | Nullable link to the generating scan; legacy imports may not have a known scan. |
+| `report_type` | Stable type such as `analyzer_summary`, `blocklist_change`, or `firewall_snapshot_summary`. |
+| `generated_at` | Original generation timestamp when known; otherwise import time plus an explicit unknown/original-time flag in metadata. |
+| `schema_version` | Version of the structured payload shape. |
+| `payload_json` | Structured report-specific summary, not a duplicate of requests or raw logs. |
+| `original_path` | Relative source path for provenance and legacy lookup. |
+| `content_sha256` | Hash of imported source content for integrity and idempotent import. |
+| `created_at` | Database import/creation timestamp. |
+
+Use a unique index on `(original_path, content_sha256)` for idempotent file
+imports. Keep payload schemas type-specific and versioned. Do not copy
+`requests.csv`, `ips.json`, firewall rows, or blocklists wholesale into
+`payload_json`; query their canonical tables and generate exports from those
+tables. If a rendered text report is retained as a database artifact, store
+its report-specific structured inputs and render text on demand rather than
+using opaque text as the only source of truth.
+
+### API Transition Contract
+
+- Add `GET /api/reports` with optional `source`, `type`, `since`, `until`,
+  `limit`, and opaque `cursor` filters. Return a stable list of artifact
+  metadata: `id`, `source`, `scan_id`, `type`, `generated_at`, and available
+  export formats. Enforce a bounded default and maximum page size.
+- Add `GET /api/report-artifacts/<artifact_id>` for the structured payload and
+  provenance metadata. Use a distinct path because `/api/reports/<source>`
+  already owns the one-segment route shape.
+- Add `GET /api/report-artifacts/<artifact_id>/export` for supported report types and formats
+  (initially JSON and, where useful, CSV/TXT). Generate exports from canonical
+  tables and versioned artifact payloads; do not accept filesystem paths from
+  a database-backed export request.
+- Preserve the current source/path routes as a read-only compatibility
+  fallback while files remain. The reports page should consume DB metadata
+  first, then offer legacy files when no imported artifact exists. Return
+  stable JSON errors for unknown IDs, unsupported formats, and unavailable
+  DB state.
+- Keep ordering deterministic (`generated_at DESC`, then `id DESC`), validate
+  filter values, and use cursor pagination for large histories. Do not expose
+  absolute server paths in list responses.
+
+### Sensitive and Large Content
+
+Do not include raw request lines or full request histories in report payloads;
+those belong in the dedicated log-storage design and require separate access
+and retention controls. Keep high-volume CSV exports generated on demand. Treat
+IP addresses, paths/query strings, user names, user agents, and firewall state
+as sensitive operational data: the existing web server must remain
+localhost-only, payloads should include only fields needed by the report, and
+new endpoints must not expose raw log data by default. Backups and exported
+files inherit the same access and retention requirements as the database.
+
+## Migration Implementation Status
+
+- Schema v2 adds `report_artifacts` with source, scan link, report type,
+  generation time, payload version, original relative path, and SHA-256 hash.
+- `python -m app.db.backfill --dry-run --reports-only` inventories supported
+  report files by source and format. The importer is idempotent, preserves
+  malformed JSON as text with a parse error, reports unreadable/oversized
+  files, and never modifies source files. It skips exports owned by canonical
+  tables (for example `requests.csv` and current blocklists).
+- New analyzer text summaries and consolidated blocklist change reports are
+  written to SQLite and their existing files. Firewall snapshots continue to
+  be persisted in the normalized firewall tables.
+- The Reports page lists database artifacts first, supports cursor pagination
+  and JSON/CSV/TXT downloads, and retains the existing file-backed routes as a
+  fallback for unmigrated files.
+- Validation covers idempotency, malformed/oversized inputs, source/format
+  counts, backup/restore, dual-write payloads, and API fallback. A workspace
+  dry-run found 76 files: 60 eligible, 16 canonical exports skipped, and none
+  unmappable at the time of the check.
+- No report files have been retired. Keep this gate closed until every listed
+  consumer has moved or has an explicit compatibility requirement, and a
+  production backup/restore and parity review has been approved.

app.py

@@ -1,55 +1,65 @@
-#!/usr/bin/env python3
-"""Intrusion Detection System — unified entry point.
-
-By default this starts the localhost-only Flask web UI. Pass ``scan`` to
-run the consolidated CLI scan instead.
-
-Usage:
-    python app.py                          # start the web UI (default)
-    python app.py --web-port 54666         # web UI with a custom port
-    python app.py scan [options]           # run the consolidated CLI scan
-"""
-
-from __future__ import annotations
-
-import argparse
-import sys
-
-from app.utils.constants import WEB_HOST, WEB_PORT
-
-
-def _web_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(
-        prog="app.py",
-        description="Intrusion Detection System: web UI (default) or 'scan' subcommand.",
-    )
-    parser.add_argument("--web-host", default=WEB_HOST,
-                        help=f"web UI bind host (default: {WEB_HOST})")
-    parser.add_argument("--web-port", type=int, default=WEB_PORT,
-                        help=f"web UI port (default: {WEB_PORT})")
-    return parser
-
-
-def _run_web(host: str, port: int) -> None:
-    from app.web import serve
-    serve(host=host, port=port)
-
-
-def _run_scan(argv: list[str]) -> None:
-    from app.scan import main as scan_main
-    scan_main(argv)
-
-
-def main() -> None:
-    # `python app.py scan ...` runs the consolidated CLI scan.
-    if len(sys.argv) > 1 and sys.argv[1] == "scan":
-        _run_scan(sys.argv[2:])
-        return
-
-    # Default: start the web UI (parse_known_args tolerates stray flags).
-    args, _ = _web_parser().parse_known_args()
-    _run_web(args.web_host, args.web_port)
-
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""Intrusion Detection System — unified entry point.
+
+By default this starts the localhost-only Flask web UI. Pass ``scan`` to
+run the consolidated CLI scan instead.
+
+Usage:
+    python app.py                          # start the web UI (default)
+    python app.py --web-port 54666         # web UI with a custom port
+    python app.py scan [options]           # run the consolidated CLI scan
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from app.utils.constants import WEB_HOST, WEB_PORT
+
+
+def _web_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="app.py",
+        description="Intrusion Detection System: web UI (default) or 'scan' subcommand.",
+    )
+    parser.add_argument("--web-host", default=WEB_HOST,
+                        help=f"web UI bind host (default: {WEB_HOST})")
+    parser.add_argument("--web-port", type=int, default=WEB_PORT,
+                        help=f"web UI port (default: {WEB_PORT})")
+    return parser
+
+
+def _run_web(host: str, port: int) -> None:
+    from app.web import serve
+    serve(host=host, port=port)
+
+
+def _run_scan(argv: list[str]) -> None:
+    from app.scan import main as scan_main
+    scan_main(argv)
+
+
+def _run_analyze(argv: list[str]) -> None:
+    from app.analyze import main as analyze_main
+    analyze_main(argv)
+
+
+def main() -> None:
+    # `python app.py scan ...` runs the consolidated CLI scan.
+    if len(sys.argv) > 1 and sys.argv[1] == "scan":
+        _run_scan(sys.argv[2:])
+        return
+
+    # `python app.py analyze ...` prints a detailed report from the SQLite store.
+    if len(sys.argv) > 1 and sys.argv[1] == "analyze":
+        _run_analyze(sys.argv[2:])
+        return
+
+    # Default: start the web UI (parse_known_args tolerates stray flags).
+    args, _ = _web_parser().parse_known_args()
+    _run_web(args.web_host, args.web_port)
+
+
+if __name__ == "__main__":
+    main()

app/__init__.py

@@ -1,9 +1,9 @@
-# Intrusion Detection System — app package
-#
-# Package structure:
-#   app/          core domain (analyzers, firewall, detection rules)
-#   app/web/      Flask web UI (app factory, routes, background scan runner)
-#   app/scan/     consolidated scan pipeline + incremental scan state
-#   app/utils/    shared utilities (constants, I/O, models, whitelists, etc.)
-#   app/static/   static assets (CSS, JS)
-#   app/templates/ Jinja2 templates
+# Intrusion Detection System — app package
+#
+# Package structure:
+#   app/          core domain (analyzers, firewall, detection rules)
+#   app/web/      Flask web UI (app factory, routes, background scan runner)
+#   app/scan/     consolidated scan pipeline + incremental scan state
+#   app/utils/    shared utilities (constants, I/O, models, whitelists, etc.)
+#   app/static/   static assets (CSS, JS)
+#   app/templates/ Jinja2 templates

app/analyze.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""CLI detailed log-analysis report (L002).
+
+``python app.py analyze [--ip IP] [--since ISO] [--top N] [--json]`` reads the
+persisted SQLite store (request history, per-IP aggregates, blocklist ledger)
+and prints a detailed, interactive analysis. It complements the web UI's
+``/analysis`` page for use on a headless server or in scripts.
+
+No scan is run here: this only queries what ``scan`` has already persisted.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from datetime import datetime
+
+
+def _fmt_ts(epoch: float | None, default: str = "-") -> str:
+    if not epoch:
+        return default
+    try:
+        return datetime.fromtimestamp(epoch).isoformat(timespec="seconds")
+    except (ValueError, OverflowError, OSError):
+        return default
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="python app.py analyze",
+        description="Detailed log-analysis report from the SQLite store.")
+    p.add_argument("--ip", metavar="IP", default=None,
+                   help="focus the report on a single IP (drill-down)")
+    p.add_argument("--since", metavar="ISO", default=None,
+                   help="only analyse requests at/after this ISO timestamp")
+    p.add_argument("--top", type=int, default=20,
+                   help="rows in the top-IP / threat tables (default: 20)")
+    p.add_argument("--json", action="store_true",
+                   help="emit raw JSON instead of a human-readable report")
+    return p
+
+
+def _report(conn, opts) -> dict:
+    from .db import repositories as repo
+
+    data: dict = {}
+    data["scans"] = repo.latest_scans(conn, limit=10)
+    data["totals"] = {
+        "requests": repo.count_requests(conn),
+        "scans": repo.count_scans(conn),
+    }
+
+    if opts.ip:
+        data["ip"] = {
+            "ip": opts.ip,
+            "timeline": repo.ip_timeline(conn, ip=opts.ip),
+            "active_blocklist": [e for e in repo.active_blocklist(conn)
+                                 if e["cidr"].startswith(opts.ip)],
+        }
+    else:
+        data["top_ips"] = repo.top_ips(conn, since=opts.since, limit=opts.top)
+        data["cross_source"] = repo.correlate_across_sources(
+            conn, limit=opts.top)
+        data["blocklist"] = repo.active_blocklist(conn)
+        data["recent_errors"] = repo.query_requests(
+            conn, since=opts.since, limit=opts.top)
+    return data
+
+
+def _render_text(data: dict, opts) -> str:
+    lines = ["Detailed log analysis", "=" * 40, ""]
+    totals = data["totals"]
+    lines.append(f"SQLite store: {totals['requests']} requests across "
+                 f"{totals['scans']} scan(s)")
+    if data["scans"]:
+        lines.append("Latest scans:")
+        for s in data["scans"]:
+            lines.append(f"  #{s['id']:<4} {s['kind']:<8} {s['status']:<7} "
+                         f"{s.get('started') or s.get('started_at') or '-'}")
+    lines.append("")
+
+    if "ip" in data:
+        ip = data["ip"]
+        lines.append(f"== Request history for {ip['ip']} ==")
+        bl = ip["active_blocklist"]
+        if bl:
+            lines.append(f"  (source: active blocklist entries "
+                         f"{', '.join(e['cidr'] for e in bl)})")
+        lines.append(f"{'time':<24} {'src':<9} {'method':<8} {'status':<6} path")
+        for r in ip["timeline"][:opts.top]:
+            lines.append(
+                f"{r.get('ts') or '-':<24} {str(r.get('source')):<9} "
+                f"{str(r.get('method') or '-'):<8} "
+                f"{str(r.get('status') or '-'):<6} {r.get('path') or '-'}")
+    else:
+        lines.append("== Top IPs ==")
+        lines.append(
+            f"{'ip':<18} {'ver':<3} {'reqs':<6} {'err':<5} {'mal':<5} "
+            f"{'first':<22} last")
+        for r in data["top_ips"]:
+            lines.append(
+                f"{str(r['ip']):<18} {r.get('version') or '-':<3} "
+                f"{r['total']:<6} {r['errors']:<5} {r['malicious_hits']:<5} "
+                f"{_fmt_ts(r['first_epoch']):<22} {_fmt_ts(r['last_epoch'])}")
+        lines.append("")
+
+        lines.append("== Cross-source IPs ==")
+        if data["cross_source"]:
+            for r in data["cross_source"]:
+                lines.append(
+                    f"  {r['ip']:<18} sources={r['sources']} "
+                    f"({r['source_list']}) total={r['total']}")
+        else:
+            lines.append("  (none — no IP seen in more than one log source)")
+
+        lines.append("")
+        lines.append("== Active blocklist (ledger) ==")
+        if data["blocklist"]:
+            for e in data["blocklist"]:
+                lines.append(f"  {e['cidr']:<22} added={e['added_at']}")
+        else:
+            lines.append("  (empty)")
+    return "\n".join(lines)
+
+
+def main(argv: list[str] | None = None) -> None:
+    opts = _build_parser().parse_args(argv)
+    try:
+        from .db import get_connection
+        conn = get_connection()
+        data = _report(conn, opts)
+    except Exception as exc:
+        print(f"error: could not read SQLite store ({exc}); "
+              f"run a scan first so data exists.", file=sys.stderr)
+        sys.exit(1)
+
+    if opts.json:
+        print(json.dumps(data, indent=2, sort_keys=True, default=str))
+    else:
+        print(_render_text(data, opts))
+
+
+if __name__ == "__main__":
+    main()

app/analyzer.py

@@ -1,290 +1,378 @@
-#!/usr/bin/env python3
-"""Analysis pipeline for the intrusion-detection system.
-
-`Analyzer` is the log-source-agnostic base class.  Subclasses implement
-`parse_line()` and `flag()`.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-from collections import Counter
-from datetime import datetime
-from typing import Any, Sequence
-
-from .utils.files import ensure_dirs, find_logs, read_lines, read_lines_from, validate_dir, write_csv, write_json, write_lines
-from .flags import by_total, flag_malicious_patterns
-from .utils.ip_utils import is_whitelisted, split_versions
-from .mikrotik import write_mikrotik
-from .utils.models import IPStats, Request, aggregate
-from .utils.reporting import Column, columns_header, columns_row, render_kv, render_table, timestamp_name
-from .utils.constants import DEFAULT_TOP, DEFAULT_TOP_PATHS
-from .scan import scan_state
-from .utils.whitelists import refresh_whitelists
-
-
-class Analyzer:
-    """Log-source-agnostic analysis pipeline.
-
-    Subclasses must set the class attributes below and implement
-    `parse_line()` and `flag()`.
-    """
-
-    name = "ids"                       # short id, used in file names / tags
-    title = "IDS log analysis report"
-    log_pattern: re.Pattern | None = None
-    log_suffixes: tuple[str, ...] = ()
-    exclude_prefixes: tuple[str, ...] = ()
-    ip_columns: Sequence[Column] = ()
-    request_columns: Sequence[Column] = ()
-    paths_file = "error_paths.csv"
-    paths_label = "error paths"
-    flag_files = ("flagged_ips.txt", "flagged_ipv6.txt")
-    flag_label = "Flagged IPs"
-    flag_note = ""
-
-    def __init__(self, log_path: str, report_dir: str, top: int = DEFAULT_TOP,
-                 quiet: bool = False, write_rsc: bool = True,
-                 full: bool = False):
-        self.log_path = log_path
-        self.report_dir = report_dir
-        self.data_dir = os.path.join(report_dir, "data")
-        self.top = top
-        self.quiet = quiet
-        self.write_rsc = write_rsc
-        self.full = full
-        self.files: list[str] = []
-        self.requests: list[Request] = []
-        self.stats: dict[str, IPStats] = {}
-        self.flagged: dict[str, IPStats] = {}
-        self.per_file: dict[str, int] = {}
-
-    # --- hooks -------------------------------------------------------------
-
-    def parse_line(self, line: str) -> Request | None:
-        raise NotImplementedError
-
-    def flag(self, stats: dict[str, IPStats]) -> dict[str, IPStats]:
-        raise NotImplementedError
-
-    def flag_comment(self, s: IPStats) -> str:
-        return (f"errors={s.errors} total={s.total} ratio={s.error_ratio} "
-                f"first={s.first} last={s.last}")
-
-    def block_candidates(self) -> set[str]:
-        malicious = flag_malicious_patterns(self.stats)
-        return set(self.flagged) | set(malicious)
-
-    def extra_summary_rows(self) -> list[tuple[str, Any]]:
-        return []
-
-    def write_extra(self, data_dir: str) -> list[str]:
-        return []
-
-    # --- pipeline ----------------------------------------------------------
-
-    def discover(self) -> list[str]:
-        self.files = find_logs(self.log_path, self.log_pattern,
-                               self.log_suffixes, self.exclude_prefixes)
-        if not self.files:
-            raise FileNotFoundError(f"no log files found in: {self.log_path}")
-        return self.files
-
-    def load(self) -> list[Request]:
-        """Read log entries, resuming from the last processed offset.
-
-        Non-gzip logs are read incrementally (only new bytes since the last
-        scan) unless ``full`` is set; gzip archives are always fully read
-        because they cannot be seeked.
-        """
-        state: dict[str, int] = {}
-        if not self.full:
-            state = scan_state.load_state()
-            # Prune entries whose log file no longer exists (safe across
-            # analyzers: only removes dead keys, keeps live ones).
-            state = {k: v for k, v in state.items() if os.path.exists(k)}
-        for name in self.files:
-            full_path = os.path.join(self.log_path, name)
-            count = 0
-            if self.full or full_path.endswith(".gz"):
-                for line in read_lines(full_path):
-                    req = self.parse_line(line)
-                    if req is not None:
-                        self.requests.append(req)
-                        count += 1
-            else:
-                try:
-                    size = os.path.getsize(full_path)
-                except OSError:
-                    size = 0
-                recorded = state.get(full_path, 0)
-                # Reset to the start if the file shrank or was truncated.
-                start = recorded if 0 < recorded <= size else 0
-                last_resume = start
-                for line, resume in read_lines_from(full_path, start):
-                    req = self.parse_line(line)
-                    if req is not None:
-                        self.requests.append(req)
-                        count += 1
-                    last_resume = resume
-                state[full_path] = last_resume
-            self.per_file[name] = count
-        if not self.full:
-            scan_state.save_state(state)
-        return self.requests
-
-    def analyze(self) -> dict[str, IPStats]:
-        self.stats = aggregate(self.requests)
-        self.flagged = self.flag(self.stats)
-        return self.stats
-
-    # --- derived data ------------------------------------------------------
-
-    def error_paths(self) -> Counter:
-        return Counter(r.path for r in self.requests if r.is_error and r.path)
-
-    def flagged_split(self) -> tuple[list[IPStats], list[IPStats]]:
-        v4 = [s for s in self.flagged.values() if s.version == 4]
-        v6 = [s for s in self.flagged.values() if s.version == 6]
-        def key(s): return (-s.errors, s.ip)
-        return sorted(v4, key=key), sorted(v6, key=key)
-
-    def summary_rows(self) -> list[tuple[str, Any]]:
-        v4, v6 = split_versions(self.stats)
-        rows = [
-            ("log path", self.log_path),
-            ("log files", len(self.files)),
-            ("total requests", len(self.requests)),
-            ("unique IPs",
-             f"{len(self.stats)} (IPv4 {len(v4)} / IPv6 {len(v6)})"),
-            ("error requests", sum(1 for r in self.requests if r.is_error)),
-            (f"unique {self.paths_label}", len(self.error_paths())),
-        ]
-        rows += self.extra_summary_rows()
-        rows += [
-            (self.flag_label.lower(), len(self.flagged)),
-            ("whitelisted IPs seen",
-             sum(1 for ip in self.stats if is_whitelisted(ip))),
-            ("block candidates", len(self.block_candidates())),
-        ]
-        return rows
-
-    # --- reporting ---------------------------------------------------------
-
-    def text_report(self) -> str:
-        out = [self.title,
-               f"generated: {datetime.now().isoformat(timespec='seconds')}",
-               "",
-               render_kv(self.summary_rows()), ""]
-
-        out.append(f"== top {self.top} IPs ==")
-        rows = [columns_row(self.ip_columns, s)
-                for s in by_total(self.stats)[:self.top]]
-        out.append(render_table(columns_header(self.ip_columns), rows))
-        if len(self.stats) > self.top:
-            out.append(f"... {len(self.stats) - self.top} more IPs omitted")
-        out.append("")
-
-        out.append(f"== top {DEFAULT_TOP_PATHS} {self.paths_label} ==")
-        for path, n in self.error_paths().most_common(DEFAULT_TOP_PATHS):
-            out.append(f"  {n:>5}  {path}")
-        out.append("")
-
-        v4, v6 = self.flagged_split()
-        out.append(f"== {self.flag_label} ({len(self.flagged)}) ==")
-        if self.flag_note:
-            out.append(self.flag_note)
-        for label, group in (("IPv4", v4), ("IPv6", v6)):
-            if not group:
-                continue
-            out.append(f"-- {label} ({len(group)}) --")
-            rows = [columns_row(self.ip_columns, s) for s in group]
-            out.append(render_table(columns_header(self.ip_columns), rows))
-        out.append("")
-        return "\n".join(out)
-
-    # --- writing -----------------------------------------------------------
-
-    def write_data(self) -> list[str]:
-        ensure_dirs(self.report_dir, self.data_dir)
-        written: list[str] = []
-        d = self.data_dir
-        header = columns_header(self.ip_columns)
-        ordered = by_total(self.stats)
-
-        for version, fname in ((4, "ips_ipv4.csv"), (6, "ips_ipv6.csv")):
-            rows = [columns_row(self.ip_columns, s)
-                    for s in ordered if s.version == version]
-            written.append(write_csv(os.path.join(d, fname), header, rows))
-
-        written.append(write_json(
-            os.path.join(d, "ips.json"),
-            {s.ip: s.to_dict() for s in ordered}))
-
-        written.append(write_csv(
-            os.path.join(d, self.paths_file), ["path", "count"],
-            self.error_paths().most_common()))
-
-        v4, v6 = self.flagged_split()
-        for group, fname in zip((v4, v6), self.flag_files):
-            written.append(write_lines(
-                os.path.join(d, fname),
-                [f"{s.ip}  # {self.flag_comment(s)}" for s in group]))
-
-        blocked_v4, blocked_v6 = split_versions(
-            ip for ip in self.block_candidates() if not is_whitelisted(ip))
-        written.append(write_lines(
-            os.path.join(d, "blocked_ipv4.txt"), blocked_v4))
-        written.append(write_lines(
-            os.path.join(d, "blocked_ipv6.txt"), blocked_v6))
-
-        written.append(write_csv(
-            os.path.join(d, "requests.csv"),
-            columns_header(self.request_columns),
-            (columns_row(self.request_columns, r) for r in self.requests)))
-
-        written += self.write_extra(d)
-        return written
-
-    def write_report(self) -> str:
-        ensure_dirs(self.report_dir)
-        path = os.path.join(self.report_dir, f"{timestamp_name()}.txt")
-        with open(path, "w", encoding="utf-8") as f:
-            f.write(self.text_report())
-        return path
-
-    def write_rsc_file(self) -> tuple[str, int, int]:
-        ensure_dirs(self.data_dir)
-        return write_mikrotik(
-            os.path.join(self.data_dir, "mikrotik-block.rsc"),
-            f"{self.name}-ids", self.block_candidates())
-
-    # --- entrypoint --------------------------------------------------------
-
-    def run(self) -> dict[str, Any]:
-        validate_dir(self.log_path)
-        ensure_dirs(self.report_dir, self.data_dir)
-        refresh_whitelists()
-        self.discover()
-        self.load()
-        self.analyze()
-
-        if not self.quiet:
-            print(self.text_report())
-
-        self.write_data()
-        report_path = self.write_report()
-        print(f"data files:     {self.data_dir}")
-        print(f"summary report: {report_path}")
-
-        result: dict[str, Any] = {"report": report_path,
-                                  "data_dir": self.data_dir}
-        if self.write_rsc:
-            rsc, n_blocked, n_whitelisted = self.write_rsc_file()
-            print(f"mikrotik script: {rsc}")
-            print(f"  {n_blocked} IPs blocked, "
-                  f"{n_whitelisted} CIDR ranges whitelisted")
-            result.update(rsc=rsc, blocked=n_blocked,
-                          whitelisted=n_whitelisted)
-        return result
+#!/usr/bin/env python3
+"""Analysis pipeline for the intrusion-detection system.
+
+`Analyzer` is the log-source-agnostic base class.  Subclasses implement
+`parse_line()` and `flag()`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import re
+from collections import Counter
+from datetime import datetime
+from typing import Any, Sequence
+
+from .utils.files import ensure_dirs, find_logs, read_lines, read_lines_from, validate_dir, write_csv, write_json, write_lines
+from .flags import by_total, flag_malicious_patterns
+from .utils.ip_utils import is_whitelisted, split_versions
+from .mikrotik import write_mikrotik
+from .utils.models import IPStats, Request, aggregate
+from .utils.reporting import Column, columns_header, columns_row, render_kv, render_table, timestamp_name
+from .utils.constants import DEFAULT_TOP, DEFAULT_TOP_PATHS
+from .scan import scan_state
+from .utils.whitelists import refresh_whitelists
+
+
+class Analyzer:
+    """Log-source-agnostic analysis pipeline.
+
+    Subclasses must set the class attributes below and implement
+    `parse_line()` and `flag()`.
+    """
+
+    name = "ids"                       # short id, used in file names / tags
+    title = "IDS log analysis report"
+    log_pattern: re.Pattern | None = None
+    log_suffixes: tuple[str, ...] = ()
+    exclude_prefixes: tuple[str, ...] = ()
+    ip_columns: Sequence[Column] = ()
+    request_columns: Sequence[Column] = ()
+    paths_file = "error_paths.csv"
+    paths_label = "error paths"
+    flag_files = ("flagged_ips.txt", "flagged_ipv6.txt")
+    flag_label = "Flagged IPs"
+    flag_note = ""
+
+    def __init__(self, log_path: str, report_dir: str, top: int = DEFAULT_TOP,
+                 quiet: bool = False, write_rsc: bool = True,
+                 full: bool = False):
+        self.log_path = log_path
+        self.report_dir = report_dir
+        self.data_dir = os.path.join(report_dir, "data")
+        self.top = top
+        self.quiet = quiet
+        self.write_rsc = write_rsc
+        self.full = full
+        self.files: list[str] = []
+        self.requests: list[Request] = []
+        self.stats: dict[str, IPStats] = {}
+        self.flagged: dict[str, IPStats] = {}
+        self.per_file: dict[str, int] = {}
+
+    # --- sqlite persistence ------------------------------------------------
+
+    def persist_to_db(self, scan_id: int | None = None) -> None:
+        """Ingest this analyzer's requests + per-IP stats into SQLite.
+
+        Lazily imported to avoid cycles. When ``scan_id`` is None a standalone
+        scan record is created for this analyzer so individual
+        (non-consolidated) runs are still tracked. Never raises: a DB failure
+        logs a warning but does not break the scan.
+        """
+        if not self.requests and not self.stats:
+            return
+        try:
+            from .db import get_connection
+            from .db import repositories as repo
+            from .utils.ip_utils import ip_version as _ip_ver
+            conn = get_connection()
+            if scan_id is None:
+                scan_id = repo.start_scan(conn, self.name,
+                                          params={"full": self.full})
+            source = self.name
+            rows: list[dict] = []
+            for r in self.requests:
+                rows.append({
+                    "source": source, "scan_id": scan_id,
+                    "log_file": ((r.extra or {}).get("log_file")
+                                  or (self.files[0] if self.files else None)),
+                    "ts": r.ts, "ip": r.ip,
+                    "version": _ip_ver(r.ip) or 0,
+                    "method": r.method, "path": r.path,
+                    "status": r.status,
+                    "upstream_status": r.upstream_status,
+                    "host": r.host, "user": r.user, "ua": r.ua,
+                    "referer": r.referer, "denied": r.denied,
+                    "banned": r.banned, "is_error": r.is_error,
+                    "extra": r.extra,
+                })
+            repo.insert_requests(conn, rows)
+            repo.insert_ip_stats(conn, scan_id,
+                                 list(self.stats.values()),
+                                 set(self.block_candidates()))
+            repo.set_scan_source_counts(
+                conn, scan_id, source, len(self.requests), len(self.files))
+            repo.finish_scan(conn, scan_id, status="done",
+                             log_files=len(self.files),
+                             request_count=len(self.requests))
+        except Exception as exc:  # never break the scan because of DB issues
+            if not self.quiet:
+                print(f"WARN: sqlite ingest skipped ({exc})")
+    # --- hooks -------------------------------------------------------------
+
+    def parse_line(self, line: str) -> Request | None:
+        raise NotImplementedError
+
+    def attr_source(self, req: Request, log_file: str) -> None:
+        """Record the originating log file onto a parsed request."""
+        if req.extra is None:
+            req.extra = {}
+        req.extra["log_file"] = req.extra.get("log_file", log_file)
+
+    def flag(self, stats: dict[str, IPStats]) -> dict[str, IPStats]:
+        raise NotImplementedError
+
+    def flag_comment(self, s: IPStats) -> str:
+        return (f"errors={s.errors} total={s.total} ratio={s.error_ratio} "
+                f"first={s.first} last={s.last}")
+
+    def block_candidates(self) -> set[str]:
+        malicious = flag_malicious_patterns(self.stats)
+        return set(self.flagged) | set(malicious)
+
+    def extra_summary_rows(self) -> list[tuple[str, Any]]:
+        return []
+
+    def write_extra(self, data_dir: str) -> list[str]:
+        return []
+
+    # --- pipeline ----------------------------------------------------------
+
+    def discover(self) -> list[str]:
+        self.files = find_logs(self.log_path, self.log_pattern,
+                               self.log_suffixes, self.exclude_prefixes)
+        if not self.files:
+            raise FileNotFoundError(f"no log files found in: {self.log_path}")
+        return self.files
+
+    def load(self) -> list[Request]:
+        """Read log entries, resuming from the last processed offset.
+
+        Non-gzip logs are read incrementally (only new bytes since the last
+        scan) unless ``full`` is set; gzip archives are always fully read
+        because they cannot be seeked.
+        """
+        state: dict[str, int] = {}
+        if not self.full:
+            state = scan_state.load_state()
+            # Prune entries whose log file no longer exists (safe across
+            # analyzers: only removes dead keys, keeps live ones).
+            state = {k: v for k, v in state.items() if os.path.exists(k)}
+        for name in self.files:
+            full_path = os.path.join(self.log_path, name)
+            count = 0
+            if self.full or full_path.endswith(".gz"):
+                for line in read_lines(full_path):
+                    req = self.parse_line(line)
+                    if req is not None:
+                        self.attr_source(req, name)
+                        self.requests.append(req)
+                        count += 1
+            else:
+                try:
+                    size = os.path.getsize(full_path)
+                except OSError:
+                    size = 0
+                recorded = state.get(full_path, 0)
+                # Reset to the start if the file shrank or was truncated.
+                start = recorded if 0 < recorded <= size else 0
+                last_resume = start
+                for line, resume in read_lines_from(full_path, start):
+                    req = self.parse_line(line)
+                    if req is not None:
+                        self.attr_source(req, name)
+                        self.requests.append(req)
+                        count += 1
+                    last_resume = resume
+                state[full_path] = last_resume
+            self.per_file[name] = count
+        if not self.full:
+            scan_state.save_state(state)
+        return self.requests
+
+    def analyze(self) -> dict[str, IPStats]:
+        self.stats = aggregate(self.requests)
+        self.flagged = self.flag(self.stats)
+        return self.stats
+
+    # --- derived data ------------------------------------------------------
+
+    def error_paths(self) -> Counter:
+        return Counter(r.path for r in self.requests if r.is_error and r.path)
+
+    def flagged_split(self) -> tuple[list[IPStats], list[IPStats]]:
+        v4 = [s for s in self.flagged.values() if s.version == 4]
+        v6 = [s for s in self.flagged.values() if s.version == 6]
+        def key(s): return (-s.errors, s.ip)
+        return sorted(v4, key=key), sorted(v6, key=key)
+
+    def summary_rows(self) -> list[tuple[str, Any]]:
+        v4, v6 = split_versions(self.stats)
+        rows = [
+            ("log path", self.log_path),
+            ("log files", len(self.files)),
+            ("total requests", len(self.requests)),
+            ("unique IPs",
+             f"{len(self.stats)} (IPv4 {len(v4)} / IPv6 {len(v6)})"),
+            ("error requests", sum(1 for r in self.requests if r.is_error)),
+            (f"unique {self.paths_label}", len(self.error_paths())),
+        ]
+        rows += self.extra_summary_rows()
+        rows += [
+            (self.flag_label.lower(), len(self.flagged)),
+            ("whitelisted IPs seen",
+             sum(1 for ip in self.stats if is_whitelisted(ip))),
+            ("block candidates", len(self.block_candidates())),
+        ]
+        return rows
+
+    # --- reporting ---------------------------------------------------------
+
+    def text_report(self) -> str:
+        out = [self.title,
+               f"generated: {datetime.now().isoformat(timespec='seconds')}",
+               "",
+               render_kv(self.summary_rows()), ""]
+
+        out.append(f"== top {self.top} IPs ==")
+        rows = [columns_row(self.ip_columns, s)
+                for s in by_total(self.stats)[:self.top]]
+        out.append(render_table(columns_header(self.ip_columns), rows))
+        if len(self.stats) > self.top:
+            out.append(f"... {len(self.stats) - self.top} more IPs omitted")
+        out.append("")
+
+        out.append(f"== top {DEFAULT_TOP_PATHS} {self.paths_label} ==")
+        for path, n in self.error_paths().most_common(DEFAULT_TOP_PATHS):
+            out.append(f"  {n:>5}  {path}")
+        out.append("")
+
+        v4, v6 = self.flagged_split()
+        out.append(f"== {self.flag_label} ({len(self.flagged)}) ==")
+        if self.flag_note:
+            out.append(self.flag_note)
+        for label, group in (("IPv4", v4), ("IPv6", v6)):
+            if not group:
+                continue
+            out.append(f"-- {label} ({len(group)}) --")
+            rows = [columns_row(self.ip_columns, s) for s in group]
+            out.append(render_table(columns_header(self.ip_columns), rows))
+        out.append("")
+        return "\n".join(out)
+
+    # --- writing -----------------------------------------------------------
+
+    def write_data(self) -> list[str]:
+        ensure_dirs(self.report_dir, self.data_dir)
+        written: list[str] = []
+        d = self.data_dir
+        header = columns_header(self.ip_columns)
+        ordered = by_total(self.stats)
+
+        for version, fname in ((4, "ips_ipv4.csv"), (6, "ips_ipv6.csv")):
+            rows = [columns_row(self.ip_columns, s)
+                    for s in ordered if s.version == version]
+            written.append(write_csv(os.path.join(d, fname), header, rows))
+
+        written.append(write_json(
+            os.path.join(d, "ips.json"),
+            {s.ip: s.to_dict() for s in ordered}))
+
+        written.append(write_csv(
+            os.path.join(d, self.paths_file), ["path", "count"],
+            self.error_paths().most_common()))
+
+        v4, v6 = self.flagged_split()
+        for group, fname in zip((v4, v6), self.flag_files):
+            written.append(write_lines(
+                os.path.join(d, fname),
+                [f"{s.ip}  # {self.flag_comment(s)}" for s in group]))
+
+        blocked_v4, blocked_v6 = split_versions(
+            ip for ip in self.block_candidates() if not is_whitelisted(ip))
+        written.append(write_lines(
+            os.path.join(d, "blocked_ipv4.txt"), blocked_v4))
+        written.append(write_lines(
+            os.path.join(d, "blocked_ipv6.txt"), blocked_v6))
+
+        written.append(write_csv(
+            os.path.join(d, "requests.csv"),
+            columns_header(self.request_columns),
+            (columns_row(self.request_columns, r) for r in self.requests)))
+
+        written += self.write_extra(d)
+        return written
+
+    def write_report(self) -> str:
+        ensure_dirs(self.report_dir)
+        path = os.path.join(self.report_dir, f"{timestamp_name()}.txt")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(self.text_report())
+        return path
+
+    def write_rsc_file(self) -> tuple[str, int, int]:
+        ensure_dirs(self.data_dir)
+        return write_mikrotik(
+            os.path.join(self.data_dir, "mikrotik-block.rsc"),
+            f"{self.name}-ids", self.block_candidates())
+
+    # --- entrypoint --------------------------------------------------------
+
+    def run(self, db_scan_id: int | None = None) -> dict[str, Any]:
+        validate_dir(self.log_path)
+        ensure_dirs(self.report_dir, self.data_dir)
+        refresh_whitelists()
+        self.discover()
+        self.load()
+        self.analyze()
+
+        if not self.quiet:
+            print(self.text_report())
+
+        # Ingest into the SQLite store (creates its own scan record when no
+        # consolidated ``db_scan_id`` is supplied).
+        self.persist_to_db(scan_id=db_scan_id)
+
+        self.write_data()
+        report_path = self.write_report()
+        self.persist_report_artifact(report_path, db_scan_id)
+        print(f"data files:     {self.data_dir}")
+        print(f"summary report: {report_path}")
+
+        result: dict[str, Any] = {"report": report_path,
+                                  "data_dir": self.data_dir}
+        if self.write_rsc:
+            rsc, n_blocked, n_whitelisted = self.write_rsc_file()
+            print(f"mikrotik script: {rsc}")
+            print(f"  {n_blocked} IPs blocked, "
+                  f"{n_whitelisted} CIDR ranges whitelisted")
+            result.update(rsc=rsc, blocked=n_blocked,
+                          whitelisted=n_whitelisted)
+        return result
+
+    def persist_report_artifact(self, path: str,
+                                scan_id: int | None = None) -> None:
+        """Store the rendered summary in SQLite while keeping its file export."""
+        try:
+            from .db import get_connection
+            from .db import repositories as repo
+            with open(path, "rb") as file:
+                content = file.read()
+            stat = os.stat(path)
+            relative = os.path.relpath(path, self.report_dir).replace(os.sep, "/")
+            repo.insert_report_artifact(
+                get_connection(), source=self.name,
+                report_type="analyzer_summary",
+                generated_at=datetime.fromtimestamp(
+                    stat.st_mtime).astimezone().isoformat(timespec="seconds"),
+                payload={"format": "text",
+                         "content": content.decode("utf-8", errors="replace")},
+                original_path=f"{self.name}/{relative}",
+                content_sha256=hashlib.sha256(content).hexdigest(),
+                scan_id=scan_id,
+            )
+        except Exception as exc:
+            if not self.quiet:
+                print(f"WARN: report artifact DB write skipped ({exc})")

app/bad_patterns.py

@@ -1,190 +1,190 @@
-#!/usr/bin/env python3
-"""Malicious-pattern detection rules for the intrusion-detection system.
-
-Defines compiled regex patterns and classifiers that identify
-probing/scanning URLs (e.g. env files, wp-admin, webshells) and
-suspicious file names.  Imported by analyzers to flag IPs hitting
-these patterns as blocklist candidates.
-"""
-
-from __future__ import annotations
-
-import re
-from dataclasses import dataclass, field
-from typing import ClassVar, Pattern
-
-# ---------------------------------------------------------------------------
-# Pattern categories
-# ---------------------------------------------------------------------------
-
-
-@dataclass(frozen=True)
-class BadPattern:
-    """A single detection rule.
-
-    Attributes:
-        name: Short identifier (e.g. "env_file", "wp_admin").
-        label: Human-readable description for reports.
-        regex: Compiled regex matched against the request path.
-        severity: 1 = moderate, 2 = high, 3 = critical (auto-block).
-    """
-
-    name: str
-    label: str
-    regex: Pattern[str]
-    severity: int = 2
-
-    def matches(self, path: str) -> bool:
-        return bool(self.regex.search(path))
-
-
-# ---------------------------------------------------------------------------
-# Compiled pattern bank
-# ---------------------------------------------------------------------------
-
-# -- env / config file probes -------------------------------------------------
-
-ENV_FILE = BadPattern(
-    "env_file",
-    "env/config file probe (.env, .aws/credentials, config.json)",
-    re.compile(
-        r"/\.(?:env|config)(?:\.\w+)*|"
-        r"/\.aws/credentials|"
-        r"/config\.json",
-        re.IGNORECASE,
-    ),
-    severity=3,
-)
-
-# -- version control probes ---------------------------------------------------
-
-VCS_PROBE = BadPattern(
-    "vcs_probe",
-    "version-control probe (.git, .svn)",
-    re.compile(
-        r"/\.(?:git|svn)(?:/|$)",
-        re.IGNORECASE,
-    ),
-    severity=3,
-)
-
-# -- WordPress / CMS probes ---------------------------------------------------
-
-WP_PROBE = BadPattern(
-    "wp_probe",
-    "WordPress/CMS probe (wp-admin, wp-login, wp-content, wp-includes)",
-    re.compile(
-        r"/wp-(?:admin|login|content|includes|load|cron|xmlrpc)(?:/|\.php)",
-        re.IGNORECASE,
-    ),
-    severity=2,
-)
-
-# -- well-known / common probe paths ------------------------------------------
-
-WELL_KNOWN_PROBE = BadPattern(
-    "well_known_probe",
-    ".well-known probe",
-    re.compile(
-        r"/\.well-known/",
-        re.IGNORECASE,
-    ),
-    severity=1,
-)
-
-# -- webshell / backdoor probes -----------------------------------------------
-
-WEBSHELL_PROBE = BadPattern(
-    "webshell_probe",
-    "webshell/backdoor probe (known shell filenames, phpinfo, file managers)",
-    re.compile(
-        r"/(?:"
-        r"phpinfo|info|shell|cmd|upload|"
-        r"wp_filemanager|filemanager|"
-        r"xstelth|adminfuns|hellopress|"
-        r"fpwch|crgio|coffexium|"
-        r"ccou|biufile|"
-        r"ms-edit|classwithtostring|"
-        r"this_is_a_new_hello_world|"
-        r"chosen|ops|simple|inputs"
-        r")\.php",
-        re.IGNORECASE,
-    ),
-    severity=3,
-)
-
-# -- suspicious generic PHP file requests -------------------------------------
-
-GENERIC_PHP_PROBE = BadPattern(
-    "generic_php_probe",
-    "generic/random PHP file probe (single-char, numeric names)",
-    re.compile(
-        r"/(?:"
-        r"[a-z]\.php|"  # single letter: a.php, k.php, x.php
-        r"\d{1,3}\.php|"  # numeric: 1.php, 222.php, 155.php
-        r"[a-z]{2}\.php|"  # two-letter: aa.php, dx.php
-        r"a\d\.php|"  # a1.php
-        r"\w+\.php"  # generic: anything.php
-        r")",
-        re.IGNORECASE,
-    ),
-    severity=1,
-)
-
-# -- sensitive file probes ----------------------------------------------------
-
-SENSITIVE_FILE = BadPattern(
-    "sensitive_file",
-    "sensitive file probe (id_rsa, id_dsa, .pem, .key)",
-    re.compile(
-        r"/(?:id_rsa|id_dsa|id_ecdsa|id_ed25519|.*\.(?:pem|key|ppk|pfx|p12))",
-        re.IGNORECASE,
-    ),
-    severity=3,
-)
-
-# -- suspicious user-agent (optional, path-based only for now) -----------------
-
-
-# ---------------------------------------------------------------------------
-# All active patterns (ordered by severity, highest first)
-# ---------------------------------------------------------------------------
-
-ALL_PATTERNS: list[BadPattern] = [
-    ENV_FILE,
-    VCS_PROBE,
-    SENSITIVE_FILE,
-    WEBSHELL_PROBE,
-    WP_PROBE,
-    GENERIC_PHP_PROBE,
-    WELL_KNOWN_PROBE,
-]
-
-# Quick lookup by name
-PATTERNS_BY_NAME: dict[str, BadPattern] = {p.name: p for p in ALL_PATTERNS}
-
-
-# ---------------------------------------------------------------------------
-# Classification API
-# ---------------------------------------------------------------------------
-
-
-def classify_path(path: str) -> list[BadPattern]:
-    """Return all patterns that match a given request path."""
-    return [p for p in ALL_PATTERNS if p.matches(path)]
-
-
-def is_malicious(path: str) -> bool:
-    """Return True if any pattern matches the path."""
-    return any(p.matches(path) for p in ALL_PATTERNS)
-
-
-def malicious_severity(path: str) -> int:
-    """Return the highest severity among matching patterns, or 0 if none."""
-    matched = classify_path(path)
-    return max((p.severity for p in matched), default=0)
-
-
-def pattern_names(path: str) -> list[str]:
-    """Return names of all patterns matching the path."""
-    return [p.name for p in classify_path(path)]
+#!/usr/bin/env python3
+"""Malicious-pattern detection rules for the intrusion-detection system.
+
+Defines compiled regex patterns and classifiers that identify
+probing/scanning URLs (e.g. env files, wp-admin, webshells) and
+suspicious file names.  Imported by analyzers to flag IPs hitting
+these patterns as blocklist candidates.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import ClassVar, Pattern
+
+# ---------------------------------------------------------------------------
+# Pattern categories
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class BadPattern:
+    """A single detection rule.
+
+    Attributes:
+        name: Short identifier (e.g. "env_file", "wp_admin").
+        label: Human-readable description for reports.
+        regex: Compiled regex matched against the request path.
+        severity: 1 = moderate, 2 = high, 3 = critical (auto-block).
+    """
+
+    name: str
+    label: str
+    regex: Pattern[str]
+    severity: int = 2
+
+    def matches(self, path: str) -> bool:
+        return bool(self.regex.search(path))
+
+
+# ---------------------------------------------------------------------------
+# Compiled pattern bank
+# ---------------------------------------------------------------------------
+
+# -- env / config file probes -------------------------------------------------
+
+ENV_FILE = BadPattern(
+    "env_file",
+    "env/config file probe (.env, .aws/credentials, config.json)",
+    re.compile(
+        r"/\.(?:env|config)(?:\.\w+)*|"
+        r"/\.aws/credentials|"
+        r"/config\.json",
+        re.IGNORECASE,
+    ),
+    severity=3,
+)
+
+# -- version control probes ---------------------------------------------------
+
+VCS_PROBE = BadPattern(
+    "vcs_probe",
+    "version-control probe (.git, .svn)",
+    re.compile(
+        r"/\.(?:git|svn)(?:/|$)",
+        re.IGNORECASE,
+    ),
+    severity=3,
+)
+
+# -- WordPress / CMS probes ---------------------------------------------------
+
+WP_PROBE = BadPattern(
+    "wp_probe",
+    "WordPress/CMS probe (wp-admin, wp-login, wp-content, wp-includes)",
+    re.compile(
+        r"/wp-(?:admin|login|content|includes|load|cron|xmlrpc)(?:/|\.php)",
+        re.IGNORECASE,
+    ),
+    severity=2,
+)
+
+# -- well-known / common probe paths ------------------------------------------
+
+WELL_KNOWN_PROBE = BadPattern(
+    "well_known_probe",
+    ".well-known probe",
+    re.compile(
+        r"/\.well-known/",
+        re.IGNORECASE,
+    ),
+    severity=1,
+)
+
+# -- webshell / backdoor probes -----------------------------------------------
+
+WEBSHELL_PROBE = BadPattern(
+    "webshell_probe",
+    "webshell/backdoor probe (known shell filenames, phpinfo, file managers)",
+    re.compile(
+        r"/(?:"
+        r"phpinfo|info|shell|cmd|upload|"
+        r"wp_filemanager|filemanager|"
+        r"xstelth|adminfuns|hellopress|"
+        r"fpwch|crgio|coffexium|"
+        r"ccou|biufile|"
+        r"ms-edit|classwithtostring|"
+        r"this_is_a_new_hello_world|"
+        r"chosen|ops|simple|inputs"
+        r")\.php",
+        re.IGNORECASE,
+    ),
+    severity=3,
+)
+
+# -- suspicious generic PHP file requests -------------------------------------
+
+GENERIC_PHP_PROBE = BadPattern(
+    "generic_php_probe",
+    "generic/random PHP file probe (single-char, numeric names)",
+    re.compile(
+        r"/(?:"
+        r"[a-z]\.php|"  # single letter: a.php, k.php, x.php
+        r"\d{1,3}\.php|"  # numeric: 1.php, 222.php, 155.php
+        r"[a-z]{2}\.php|"  # two-letter: aa.php, dx.php
+        r"a\d\.php|"  # a1.php
+        r"\w+\.php"  # generic: anything.php
+        r")",
+        re.IGNORECASE,
+    ),
+    severity=1,
+)
+
+# -- sensitive file probes ----------------------------------------------------
+
+SENSITIVE_FILE = BadPattern(
+    "sensitive_file",
+    "sensitive file probe (id_rsa, id_dsa, .pem, .key)",
+    re.compile(
+        r"/(?:id_rsa|id_dsa|id_ecdsa|id_ed25519|.*\.(?:pem|key|ppk|pfx|p12))",
+        re.IGNORECASE,
+    ),
+    severity=3,
+)
+
+# -- suspicious user-agent (optional, path-based only for now) -----------------
+
+
+# ---------------------------------------------------------------------------
+# All active patterns (ordered by severity, highest first)
+# ---------------------------------------------------------------------------
+
+ALL_PATTERNS: list[BadPattern] = [
+    ENV_FILE,
+    VCS_PROBE,
+    SENSITIVE_FILE,
+    WEBSHELL_PROBE,
+    WP_PROBE,
+    GENERIC_PHP_PROBE,
+    WELL_KNOWN_PROBE,
+]
+
+# Quick lookup by name
+PATTERNS_BY_NAME: dict[str, BadPattern] = {p.name: p for p in ALL_PATTERNS}
+
+
+# ---------------------------------------------------------------------------
+# Classification API
+# ---------------------------------------------------------------------------
+
+
+def classify_path(path: str) -> list[BadPattern]:
+    """Return all patterns that match a given request path."""
+    return [p for p in ALL_PATTERNS if p.matches(path)]
+
+
+def is_malicious(path: str) -> bool:
+    """Return True if any pattern matches the path."""
+    return any(p.matches(path) for p in ALL_PATTERNS)
+
+
+def malicious_severity(path: str) -> int:
+    """Return the highest severity among matching patterns, or 0 if none."""
+    matched = classify_path(path)
+    return max((p.severity for p in matched), default=0)
+
+
+def pattern_names(path: str) -> list[str]:
+    """Return names of all patterns matching the path."""
+    return [p.name for p in classify_path(path)]

app/copyparty.py

@@ -1,182 +1,182 @@
-#!/usr/bin/env python3
-"""copyparty access-log analyzer.
-
-Parses copyparty server logs, aggregates per-IP behaviour and flags
-"denied-only" clients: IPs that never authenticated and only ever hit
-`@* has no access to '...'`. Those plus copyparty's own auto-bans become
-the MikroTik block list.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-
-from .analyzer import Analyzer
-from .utils.constants import (
-    COPYPARTY_LOG_PATH,
-    COPYPARTY_REPORT_DIR,
-    DEFAULT_MIN_DENIED,
-)
-from .utils.ip_utils import split_versions
-from .utils.files import write_json, write_lines
-from .flags import flag_denied_only
-from .utils.models import IPStats, Request
-from .utils.utils import arg_parser
-
-# "HH:MM:SS.mmm  <ip>  <port>  LEVEL: message"
-# System lines ("hsrv", "root", ...) have no port and are skipped.
-LINE_RE = re.compile(
-    r"^(\d{2}:\d{2}:\d{2}\.\d{3})\s+"                 # timestamp
-    r"(\S+)\s+"                                        # ip
-    r"(\d+)\s+"                                        # port
-    r"(LOG|WARN|CRIT|BTW|INFO|ERR|DEBUG):\s"           # level
-    r"(.*)$"                                           # message
-)
-
-METHOD_RE = re.compile(
-    r"^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|PROPFIND|PROPPATCH|MKCOL|"
-    r"MOVE|COPY|LOCK|UNLOCK)\s+(\S+)(?:\s+@(\S+))?")
-DENY_RE = re.compile(r"^@(\S+) has no access to '([^']+)'")
-CLIENT_BAN_RE = re.compile(r"client banned")
-BAN_SECS_RE = re.compile(r"banned for (\d+) sec")
-
-
-class CopypartyAnalyzer(Analyzer):
-    name = "copyparty"
-    title = "copyparty log analysis report"
-    log_pattern = re.compile(r"\d{4}-\d{2}-\d{2}\.txt(\.\d+)?$")
-    paths_file = "denied_paths.csv"
-    paths_label = "denied paths"
-    flag_files = ("denied_ips.txt", "denied_ipv6.txt")
-    flag_label = "Denied-only IPs"
-    flag_note = "never authenticated -- ban candidates"
-
-    ip_columns = (
-        ("ip", lambda s: s.ip),
-        ("total", lambda s: s.total),
-        ("denied", lambda s: s.denied),
-        ("banned", lambda s: s.banned),
-        ("first", lambda s: s.first),
-        ("last", lambda s: s.last),
-        ("users", lambda s: s.users_str),
-        ("whitelist", lambda s: s.whitelist),
-    )
-
-    request_columns = (
-        ("time", lambda r: r.ts),
-        ("ip", lambda r: r.ip),
-        ("port", lambda r: r.extra.get("port")),
-        ("level", lambda r: r.extra.get("level")),
-        ("method", lambda r: r.method),
-        ("path", lambda r: r.path),
-        ("user", lambda r: r.user),
-        ("denied", lambda r: r.denied),
-        ("banned", lambda r: r.banned),
-        ("ban_secs", lambda r: r.extra.get("ban_secs")),
-    )
-
-    def __init__(self, *args, min_denied: int = DEFAULT_MIN_DENIED, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.min_denied = min_denied
-
-    # --- parsing -----------------------------------------------------------
-
-    def parse_line(self, line: str) -> Request | None:
-        if not line:
-            return None
-        m = LINE_RE.match(line)
-        if not m:
-            return None
-        ts, ip, port, level, msg = m.groups()
-        req = Request(ts=ts, ip=ip, user=None,
-                      extra={"port": int(port), "level": level})
-
-        mm = METHOD_RE.match(msg)
-        if mm:
-            req.method, req.path, user = mm.groups()
-            req.user = user or "*"
-            return req
-
-        dm = DENY_RE.match(msg)
-        if dm:
-            req.user, req.path = dm.groups()
-            req.denied = True
-            return req
-
-        if CLIENT_BAN_RE.search(msg):
-            req.banned = True
-            bs = BAN_SECS_RE.search(msg)
-            if bs:
-                req.extra["ban_secs"] = int(bs.group(1))
-            return req
-
-        bs = BAN_SECS_RE.search(msg)
-        if bs:
-            req.banned = True
-            req.extra["ban_secs"] = int(bs.group(1))
-        return req
-
-    # --- flagging ----------------------------------------------------------
-
-    def flag(self, stats):
-        return flag_denied_only(stats, min_denied=self.min_denied)
-
-    def flag_comment(self, s):
-        return (f"denied={s.denied} total={s.total} "
-                f"first={s.first} last={s.last}")
-
-    def block_candidates(self) -> set[str]:
-        banned = {ip for ip, s in self.stats.items() if s.banned}
-        return set(self.flagged) | banned
-
-    # --- extras ------------------------------------------------------------
-
-    def banned_ips(self) -> dict[str, IPStats]:
-        return {ip: s for ip, s in self.stats.items() if s.banned}
-
-    def authed_users(self) -> dict[str, int]:
-        counts: dict[str, int] = {}
-        for r in self.requests:
-            if r.user and r.user != "*":
-                counts[r.user] = counts.get(r.user, 0) + 1
-        return dict(sorted(counts.items(), key=lambda kv: -kv[1]))
-
-    def extra_summary_rows(self):
-        return [("denied requests",
-                 sum(1 for r in self.requests if r.denied)),
-                ("banned IPs", len(self.banned_ips())),
-                ("authenticated users", self.authed_users() or "{}")]
-
-    def write_extra(self, data_dir: str) -> list[str]:
-        v4, v6 = split_versions(self.banned_ips())
-        return [
-            write_lines(os.path.join(data_dir, "banned_ips.txt"), v4),
-            write_lines(os.path.join(data_dir, "banned_ipv6.txt"), v6),
-            write_json(os.path.join(data_dir, "authed_users.json"),
-                       self.authed_users()),
-        ]
-
-
-def main() -> None:
-    parser = arg_parser(
-        "analyze copyparty logs, flag denied-only IPs, export MikroTik rules",
-        COPYPARTY_LOG_PATH, COPYPARTY_REPORT_DIR)
-    parser.add_argument("--min-denied", type=int, default=DEFAULT_MIN_DENIED,
-                        help=f"minimum denied hits before flagging (default: {DEFAULT_MIN_DENIED})")
-    parser.add_argument("--full", action="store_true",
-                        help="rescan all logs from the start (ignore incremental state)")
-    args = parser.parse_args()
-
-    CopypartyAnalyzer(
-        log_path=args.log_path,
-        report_dir=args.report_dir,
-        top=args.top,
-        quiet=args.quiet,
-        full=args.full,
-        min_denied=args.min_denied,
-    ).run()
-
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""copyparty access-log analyzer.
+
+Parses copyparty server logs, aggregates per-IP behaviour and flags
+"denied-only" clients: IPs that never authenticated and only ever hit
+`@* has no access to '...'`. Those plus copyparty's own auto-bans become
+the MikroTik block list.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+
+from .analyzer import Analyzer
+from .utils.constants import (
+    COPYPARTY_LOG_PATH,
+    COPYPARTY_REPORT_DIR,
+    DEFAULT_MIN_DENIED,
+)
+from .utils.ip_utils import split_versions
+from .utils.files import write_json, write_lines
+from .flags import flag_denied_only
+from .utils.models import IPStats, Request
+from .utils.utils import arg_parser
+
+# "HH:MM:SS.mmm  <ip>  <port>  LEVEL: message"
+# System lines ("hsrv", "root", ...) have no port and are skipped.
+LINE_RE = re.compile(
+    r"^(\d{2}:\d{2}:\d{2}\.\d{3})\s+"                 # timestamp
+    r"(\S+)\s+"                                        # ip
+    r"(\d+)\s+"                                        # port
+    r"(LOG|WARN|CRIT|BTW|INFO|ERR|DEBUG):\s"           # level
+    r"(.*)$"                                           # message
+)
+
+METHOD_RE = re.compile(
+    r"^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|PROPFIND|PROPPATCH|MKCOL|"
+    r"MOVE|COPY|LOCK|UNLOCK)\s+(\S+)(?:\s+@(\S+))?")
+DENY_RE = re.compile(r"^@(\S+) has no access to '([^']+)'")
+CLIENT_BAN_RE = re.compile(r"client banned")
+BAN_SECS_RE = re.compile(r"banned for (\d+) sec")
+
+
+class CopypartyAnalyzer(Analyzer):
+    name = "copyparty"
+    title = "copyparty log analysis report"
+    log_pattern = re.compile(r"\d{4}-\d{2}-\d{2}\.txt(\.\d+)?$")
+    paths_file = "denied_paths.csv"
+    paths_label = "denied paths"
+    flag_files = ("denied_ips.txt", "denied_ipv6.txt")
+    flag_label = "Denied-only IPs"
+    flag_note = "never authenticated -- ban candidates"
+
+    ip_columns = (
+        ("ip", lambda s: s.ip),
+        ("total", lambda s: s.total),
+        ("denied", lambda s: s.denied),
+        ("banned", lambda s: s.banned),
+        ("first", lambda s: s.first),
+        ("last", lambda s: s.last),
+        ("users", lambda s: s.users_str),
+        ("whitelist", lambda s: s.whitelist),
+    )
+
+    request_columns = (
+        ("time", lambda r: r.ts),
+        ("ip", lambda r: r.ip),
+        ("port", lambda r: r.extra.get("port")),
+        ("level", lambda r: r.extra.get("level")),
+        ("method", lambda r: r.method),
+        ("path", lambda r: r.path),
+        ("user", lambda r: r.user),
+        ("denied", lambda r: r.denied),
+        ("banned", lambda r: r.banned),
+        ("ban_secs", lambda r: r.extra.get("ban_secs")),
+    )
+
+    def __init__(self, *args, min_denied: int = DEFAULT_MIN_DENIED, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.min_denied = min_denied
+
+    # --- parsing -----------------------------------------------------------
+
+    def parse_line(self, line: str) -> Request | None:
+        if not line:
+            return None
+        m = LINE_RE.match(line)
+        if not m:
+            return None
+        ts, ip, port, level, msg = m.groups()
+        req = Request(ts=ts, ip=ip, user=None,
+                      extra={"port": int(port), "level": level})
+
+        mm = METHOD_RE.match(msg)
+        if mm:
+            req.method, req.path, user = mm.groups()
+            req.user = user or "*"
+            return req
+
+        dm = DENY_RE.match(msg)
+        if dm:
+            req.user, req.path = dm.groups()
+            req.denied = True
+            return req
+
+        if CLIENT_BAN_RE.search(msg):
+            req.banned = True
+            bs = BAN_SECS_RE.search(msg)
+            if bs:
+                req.extra["ban_secs"] = int(bs.group(1))
+            return req
+
+        bs = BAN_SECS_RE.search(msg)
+        if bs:
+            req.banned = True
+            req.extra["ban_secs"] = int(bs.group(1))
+        return req
+
+    # --- flagging ----------------------------------------------------------
+
+    def flag(self, stats):
+        return flag_denied_only(stats, min_denied=self.min_denied)
+
+    def flag_comment(self, s):
+        return (f"denied={s.denied} total={s.total} "
+                f"first={s.first} last={s.last}")
+
+    def block_candidates(self) -> set[str]:
+        banned = {ip for ip, s in self.stats.items() if s.banned}
+        return set(self.flagged) | banned
+
+    # --- extras ------------------------------------------------------------
+
+    def banned_ips(self) -> dict[str, IPStats]:
+        return {ip: s for ip, s in self.stats.items() if s.banned}
+
+    def authed_users(self) -> dict[str, int]:
+        counts: dict[str, int] = {}
+        for r in self.requests:
+            if r.user and r.user != "*":
+                counts[r.user] = counts.get(r.user, 0) + 1
+        return dict(sorted(counts.items(), key=lambda kv: -kv[1]))
+
+    def extra_summary_rows(self):
+        return [("denied requests",
+                 sum(1 for r in self.requests if r.denied)),
+                ("banned IPs", len(self.banned_ips())),
+                ("authenticated users", self.authed_users() or "{}")]
+
+    def write_extra(self, data_dir: str) -> list[str]:
+        v4, v6 = split_versions(self.banned_ips())
+        return [
+            write_lines(os.path.join(data_dir, "banned_ips.txt"), v4),
+            write_lines(os.path.join(data_dir, "banned_ipv6.txt"), v6),
+            write_json(os.path.join(data_dir, "authed_users.json"),
+                       self.authed_users()),
+        ]
+
+
+def main() -> None:
+    parser = arg_parser(
+        "analyze copyparty logs, flag denied-only IPs, export MikroTik rules",
+        COPYPARTY_LOG_PATH, COPYPARTY_REPORT_DIR)
+    parser.add_argument("--min-denied", type=int, default=DEFAULT_MIN_DENIED,
+                        help=f"minimum denied hits before flagging (default: {DEFAULT_MIN_DENIED})")
+    parser.add_argument("--full", action="store_true",
+                        help="rescan all logs from the start (ignore incremental state)")
+    args = parser.parse_args()
+
+    CopypartyAnalyzer(
+        log_path=args.log_path,
+        report_dir=args.report_dir,
+        top=args.top,
+        quiet=args.quiet,
+        full=args.full,
+        min_denied=args.min_denied,
+    ).run()
+
+
+if __name__ == "__main__":
+    main()

app/data/README.md

@@ -1,15 +0,0 @@
-# Data directory for allucanget-ids
-
-This directory contains data files used by the `allucanget-ids` Intrusion Detection System application, including whitelists, blocklists, and other configuration files. The data files are organized into subdirectories for easier management and maintenance.
-
-## Data files
-
-- [whois cache](./whois_cache.json): Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
-- [Cloudflare IPv4 list](./cloudflare/ips-v4.txt): Contains a list of Cloudflare IPv4 addresses from `https://www.cloudflare.com/ips-v4`, used for whitelisting traffic from Cloudflare services.
-- [Cloudflare IPv6 list](./cloudflare/ips-v6.txt): Contains a list of Cloudflare IPv6 addresses from `https://www.cloudflare.com/ips-v6`, used for whitelisting traffic from Cloudflare services.
-- [MikroTik RouterOS IPv4 Firewall rules](./mikrotik/firewall_ipv4.json): Current MikroTik RouterOS IPv4 firewall rules.
-- [MikroTik RouterOS IPv6 Firewall rules](./mikrotik/firewall_ipv6.json): Current MikroTik RouterOS IPv6 firewall rules.
-- [MikroTik RouterOS IPv4 address list](./mikrotik/address_list_ipv4.json): Current MikroTik RouterOS IPv4 address list.
-- [MikroTik RouterOS IPv6 address list](./mikrotik/address_list_ipv6.json): Current MikroTik RouterOS IPv6 address list.
-- [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
-- [PaloAlto Scanner IP list](./paloalto/scanner-ips.txt): List of known PaloAlto scanner IP addresses from `https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity`, used for whitelisting traffic from PaloAlto scanners. !NOTE: This list can not be scraped easily (Javascript-based), so it is maintained manually and may be outdated. Please verify the list against the official source if needed.

app/data/cloudflare/.gitkeep

@@ -1 +0,0 @@
-$ = cloudflare

app/data/cloudflare/ips-v4.txt

@@ -1,15 +0,0 @@
-173.245.48.0/20
-103.21.244.0/22
-103.22.200.0/22
-103.31.4.0/22
-141.101.64.0/18
-108.162.192.0/18
-190.93.240.0/20
-188.114.96.0/20
-197.234.240.0/22
-198.41.128.0/17
-162.158.0.0/15
-104.16.0.0/13
-104.24.0.0/14
-172.64.0.0/13
-131.0.72.0/22

app/data/cloudflare/ips-v6.txt

@@ -1,7 +0,0 @@
-2400:cb00::/32
-2606:4700::/32
-2803:f800::/32
-2405:b500::/32
-2405:8100::/32
-2a06:98c0::/29
-2c0f:f248::/32

app/data/mikrotik/address_list_ipv6.json

@@ -1,384 +0,0 @@
-[
-  {
-    "address": "::/128",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::1/128",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "fec0::/10",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::ffff:0.0.0.0/96",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::/96",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "100::/64",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2001:db8::/32",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2001:10::/28",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "3ffe::/16",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2a0e:8f04::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f05::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f06::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f07::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2080::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2001:67c:2648::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:200::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:600::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:800::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2400:cb00::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2606:4700::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2803:f800::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2405:b500::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2405:8100::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2a06:98c0::/29",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2c0f:f248::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2604:a940:300:5b6::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2604:a940:301:225::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2604:a940:302:118::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2001:4ca0:108:42::24/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2400:8901::2000:62ff:fe9a:e1c2/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3000::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c09::2000:5cff:fe99:c802/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::2000:53ff:fe31:8c0b/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2602:fa59:10:a3a::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a01:2a8:a0dd:1::1012/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:e000:0:d09:97ab:43b1:a59a/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:c300::/29",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5:9443:3af::5e:4d/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5:9443:3af::5e:88/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2001:ba0:24c:a500::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2406:da18:525:0:a23e:e8f6:3ea1:4c2c/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::2000:9cff:fef0:8ad6/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2602:fa59::/40",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:64cc:9116:beb2:1931/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:be24:11ff:fe3b:4058/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:be24:11ff:fe82:2775/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a01:4f8:c014:7f9e::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:4400:0:537:cdd2:7250:95db/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:e000::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a05:4140:3::37cd/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a06:a880:5:7fb3::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac1:76c0:460::5e:6a/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a13:adc0::2ed:89ff:fe58:19c5/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2400:8901::2000:beff:fea3:5a44/128",
-    "creation-time": "2026-08-05",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340::/32",
-    "creation-time": "2026-08-06",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2017:3810::/64",
-    "comment": "hosting",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2001:8d8:5ff:5f:82:165:82:154/128",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::/32",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2001:448a:a071:520:e18f:3d1f:944e:174d/128",
-    "creation-time": "2026-08-08",
-    "dynamic": "no",
-    "list": "Blocked"
-  }
-]

app/data/mikrotik/firewall_ipv4.json

@@ -1,137 +0,0 @@
-[
-  {
-    "action": "passthrough",
-    "chain": "forward",
-    "comment": "special"
-  },
-  {
-    "action": "fasttrack-connection",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related",
-    "hw-offload": "yes",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "invalid",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "Allow",
-    "connection-nat-state": "dstnat"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "allow",
-    "connection-state": "new",
-    "dst-address": "192.168.88.25",
-    "dst-port": "6667",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "tcp"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-nat-state": "!dstnat",
-    "connection-state": "new",
-    "in-interface-list": "WAN",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "allow",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "icmp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "accept",
-    "connection-state": "established",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "allow",
-    "dst-port": "500",
-    "protocol": "udp"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "Block",
-    "dst-port": "80,443",
-    "in-interface-list": "WAN",
-    "protocol": "tcp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "Allow",
-    "dst-port": "80,443",
-    "in-interface-list": "LAN",
-    "protocol": "tcp",
-    "src-address": "192.168.88.0/24"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Cloudflare"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "PaloAlto"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "drop",
-    "in-interface": "pppoe-out1",
-    "log": "no",
-    "log-prefix": ""
-  }
-]

app/data/mikrotik/firewall_ipv6.json

@@ -1,186 +0,0 @@
-[
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "connection-state": "established,related,untracked"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "defconf:",
-    "connection-state": "invalid"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "port": "33434-33534",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "dst-port": "546",
-    "protocol": "udp",
-    "src-address": "fe80::/10"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "dst-port": "500,4500",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "ipsec-ah"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "ipsec-esp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "ipsec-policy": "in,ipsec"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "defconf:",
-    "in-interface-list": "!LAN"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related,untracked"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "invalid"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "src-address-list": "bad_ipv6"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "dst-address-list": "bad_ipv6"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "hop-limit": "equal:1",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "ids",
-    "log": "no",
-    "log-prefix": "",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "139"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "dst-port": "500,4500",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "ipsec-ah"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "ipsec-esp"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "ipsec-policy": "in,ipsec"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "in-interface-list": "!LAN"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Cloudflare"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "PaloAlto"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  }
-]

app/data/openfactory/.gitkeep

@@ -1 +0,0 @@
-$ = openfactory

app/data/openfactory/geofeed.csv

@@ -1,46 +0,0 @@
-45.11.248.0/23,DE,DE-HE,Frankfurt Am Main,
-45.11.250.0/24,NL,NL-NH,Amsterdam,
-45.11.251.0/24,AT,AT-9,Vienna,
-2a0e:8f04::/32,DE,DE-HE,Frankfurt Am Main,
-2a0e:8f05::/32,GB,GB-LND,London,
-2a0e:8f06::/32,NL,NL-NH,Amsterdam,
-2a0e:8f07::/32,AT,AT-9,Vienna,
-5.226.144.0/21,CH,CH-TG,Frauenfeld,
-5.226.144.192/26,CH,CH-ZH,Winterthur,
-5.226.145.0/26,CH,CH-ZH,Wangen-Bruettisellen,
-5.226.145.64/26,LI,LI-07,Schaan,
-5.226.145.128/25,CH,CH-ZH,Kloten,
-5.226.148.0/29,CH,CH-ZH,Zurich,
-5.226.148.8/29,CH,CH-ZH,Kloten,
-5.226.148.16/28,CH,CH-ZH,Zurich,
-5.226.148.32/27,CH,CH-ZH,Kloten,
-5.226.148.64/26,CH,CH-ZH,Zurich,
-5.226.148.96/27,CH,CH-ZH,Zurich,
-5.226.148.128/25,CH,CH-ZH,Zurich,
-5.226.149.0/26,CH,CH-ZH,Zurich,
-5.226.149.64/28,CH,CH-LU,Lutzern,
-5.226.149.128/26,CH,CH-ZH,Glattfelden,
-5.226.149.240/30,CH,CH-SZ,Wollerau,
-5.226.150.0/27,CH,CH-ZH,Glattfelden,
-5.226.150.32/27,CH,CH-BE,Biel,
-5.226.150.152/29,LI,LI-07,Schaan,
-5.226.150.160/28,CH,CH-ZH,Winterthur,
-5.226.150.224/27,CH,CH-BE,Bern,
-5.226.151.0/26,NL,NL-NH,Amsterdam,
-5.226.151.64/27,CH,CH-ZH,Ruemlang,
-185.86.228.0/23,CH,CH-ZH,Zurich,
-195.138.203.0/24,CH,CH-ZH,Zurich,
-2a00:6340::/32,CH,CH-TG,Frauenfeld,
-2a00:6340:2080::/48,NL,NL-NH,Amsterdam,
-2001:67c:2648::/48,CH,CH-ZH,Winterthur,
-
-# Customer geofeed details on request
-# Having issues with your geolocation? send us a ticket!
-
-45.11.248.94/32,DE,DE-NW,Dortmund,
-2a00:6340:2044:200::/56,DE,DE-NW,Dortmund,
-2a00:6340:2044:600::/56,DE,DE-BW,Stuttgart,
-45.11.248.96/32,DE,DE-BW,Stuttgart,
-45.11.248.37/32,DE,DE-BE,Berlin,
-2a00:6340:2044:800::/56,DE,DE-BE,Berlin,
-5.226.146.49/32,CH,CH-ZH,Winterthur,8405,47.472502,8.779930

app/data/paloalto/.gitkeep

@@ -1 +0,0 @@
-$ = paloalto

app/data/paloalto/scanner-ips.txt

@@ -1,12 +1,12 @@
-35.203.210.0/23
-144.86.173.0/24
-147.185.132.0/23
-162.216.149.0/24
-162.216.150.0/24
-172.105.147.0/24
-198.235.24.0/24
-205.210.31.0/24
-216.25.88.0/21
-2604:a940:300:5b6:0:0:0:0/64 
-2604:a940:301:225:0:0:0:0/64 
+35.203.210.0/23
+144.86.173.0/24
+147.185.132.0/23
+162.216.149.0/24
+162.216.150.0/24
+172.105.147.0/24
+198.235.24.0/24
+205.210.31.0/24
+216.25.88.0/21
+2604:a940:300:5b6:0:0:0:0/64 
+2604:a940:301:225:0:0:0:0/64 
 2604:a940:302:118:0:0:0:0/64

app/data/scan_state.json

@@ -1,233 +0,0 @@
-{
-  "P:\\copyparty\\2026-07-11.txt": 7403,
-  "P:\\copyparty\\2026-07-11.txt.1": 84622,
-  "P:\\copyparty\\2026-07-12.txt": 99031,
-  "P:\\copyparty\\2026-07-13.txt": 92896,
-  "P:\\copyparty\\2026-07-14.txt": 191781,
-  "P:\\copyparty\\2026-07-15.txt": 55394,
-  "P:\\copyparty\\2026-07-15.txt.1": 8770,
-  "P:\\copyparty\\2026-07-15.txt.2": 9606,
-  "P:\\copyparty\\2026-07-16.txt": 35715,
-  "P:\\copyparty\\2026-07-17.txt": 102469,
-  "P:\\copyparty\\2026-07-17.txt.1": 35820,
-  "P:\\copyparty\\2026-07-18.txt": 1784,
-  "P:\\copyparty\\2026-07-19.txt": 273815,
-  "P:\\copyparty\\2026-07-20.txt": 572443,
-  "P:\\copyparty\\2026-07-21.txt": 56055,
-  "P:\\copyparty\\2026-07-22.txt": 135922,
-  "P:\\copyparty\\2026-07-23.txt": 2468,
-  "P:\\copyparty\\2026-07-23.txt.1": 349125,
-  "P:\\copyparty\\2026-07-23.txt.2": 199809,
-  "P:\\copyparty\\2026-07-23.txt.3": 1023,
-  "P:\\copyparty\\2026-07-23.txt.4": 1023,
-  "P:\\copyparty\\2026-07-23.txt.5": 1041,
-  "P:\\copyparty\\2026-07-23.txt.6": 114042,
-  "P:\\copyparty\\2026-07-23.txt.7": 19621,
-  "P:\\copyparty\\2026-07-23.txt.8": 29806,
-  "P:\\copyparty\\2026-07-23.txt.9": 15526221,
-  "P:\\copyparty\\2026-07-24.txt": 99348,
-  "P:\\copyparty\\2026-07-25.txt": 63410,
-  "P:\\copyparty\\2026-07-26.txt": 217801,
-  "P:\\copyparty\\2026-07-27.txt": 66457,
-  "P:\\copyparty\\2026-07-28.txt": 59236,
-  "P:\\copyparty\\2026-07-29.txt": 153562,
-  "P:\\copyparty\\2026-07-29.txt.1": 24147,
-  "P:\\copyparty\\2026-07-30.txt": 1212354,
-  "P:\\copyparty\\2026-07-31.txt": 49026,
-  "P:\\copyparty\\2026-08-01.txt": 298970,
-  "P:\\copyparty\\2026-08-01.txt.1": 274541,
-  "P:\\copyparty\\2026-08-02.txt": 45372,
-  "P:\\copyparty\\2026-08-03.txt": 34302,
-  "P:\\copyparty\\2026-08-04.txt": 33282,
-  "P:\\copyparty\\2026-08-05.txt": 75013,
-  "P:\\copyparty\\2026-08-06.txt": 64948,
-  "P:\\copyparty\\2026-08-07.txt": 38873,
-  "Y:\\npm\\logs\\fallback_error.log": 20586,
-  "Y:\\npm\\logs\\fallback_http_access.log": 1966362,
-  "Y:\\npm\\logs\\fallback_http_error.log": 2930280,
-  "Y:\\npm\\logs\\fallback_stream_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-10_access.log": 495244,
-  "Y:\\npm\\logs\\proxy-host-10_error.log": 316,
-  "Y:\\npm\\logs\\proxy-host-11_access.log": 2618795,
-  "Y:\\npm\\logs\\proxy-host-11_error.log": 53360,
-  "Y:\\npm\\logs\\proxy-host-12_access.log": 3171885,
-  "Y:\\npm\\logs\\proxy-host-12_error.log": 40987,
-  "Y:\\npm\\logs\\proxy-host-13_access.log": 1032922,
-  "Y:\\npm\\logs\\proxy-host-13_error.log": 160173,
-  "Y:\\npm\\logs\\proxy-host-14_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-14_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-15_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-15_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-16_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-16_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-17_access.log": 249525,
-  "Y:\\npm\\logs\\proxy-host-17_error.log": 45568,
-  "Y:\\npm\\logs\\proxy-host-18_access.log": 210292,
-  "Y:\\npm\\logs\\proxy-host-18_error.log": 45944,
-  "Y:\\npm\\logs\\proxy-host-19_access.log": 56437,
-  "Y:\\npm\\logs\\proxy-host-19_error.log": 41305,
-  "Y:\\npm\\logs\\proxy-host-1_access.log": 421346,
-  "Y:\\npm\\logs\\proxy-host-1_error.log": 46031,
-  "Y:\\npm\\logs\\proxy-host-20_access.log": 2074017,
-  "Y:\\npm\\logs\\proxy-host-20_error.log": 50956,
-  "Y:\\npm\\logs\\proxy-host-21_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-21_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-22_access.log": 263312,
-  "Y:\\npm\\logs\\proxy-host-22_error.log": 3733,
-  "Y:\\npm\\logs\\proxy-host-23_access.log": 4268,
-  "Y:\\npm\\logs\\proxy-host-23_error.log": 4454,
-  "Y:\\npm\\logs\\proxy-host-24_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-24_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-25_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-25_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-26_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-26_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-27_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-27_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-28_access.log": 107302,
-  "Y:\\npm\\logs\\proxy-host-28_error.log": 116208,
-  "Y:\\npm\\logs\\proxy-host-29_access.log": 158185,
-  "Y:\\npm\\logs\\proxy-host-29_error.log": 90709,
-  "Y:\\npm\\logs\\proxy-host-2_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-2_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-30_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-30_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-31_access.log": 3846085,
-  "Y:\\npm\\logs\\proxy-host-31_error.log": 282448,
-  "Y:\\npm\\logs\\proxy-host-3_access.log": 658178,
-  "Y:\\npm\\logs\\proxy-host-3_error.log": 46739,
-  "Y:\\npm\\logs\\proxy-host-4_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-4_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-5_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-5_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-6_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-6_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-7_access.log": 0,
-  "Y:\\npm\\logs\\proxy-host-7_error.log": 0,
-  "Y:\\npm\\logs\\proxy-host-8_access.log": 558598,
-  "Y:\\npm\\logs\\proxy-host-8_error.log": 45468,
-  "Y:\\npm\\logs\\proxy-host-9_access.log": 34788693,
-  "Y:\\npm\\logs\\proxy-host-9_error.log": 292624,
-  "Y:\\npm\\logs\\stream-1_access.log": 0,
-  "Y:\\npm\\logs\\stream-1_error.log": 0,
-  "Y:\\npm\\logs\\stream-2_access.log": 0,
-  "Y:\\npm\\logs\\stream-2_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\fallback_error.log": 2342,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\fallback_http_access.log": 444743,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\fallback_http_error.log": 507761,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\fallback_stream_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-10_access.log": 131738,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-10_error.log": 314,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-11_access.log": 1345373,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-11_error.log": 11526,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-12_access.log": 692484,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-12_error.log": 13649,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-13_access.log": 907343,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-13_error.log": 31479,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-14_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-14_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-15_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-15_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-16_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-16_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-17_access.log": 18521,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-17_error.log": 11333,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-18_access.log": 610146,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-18_error.log": 12622,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-19_access.log": 2708,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-19_error.log": 1937,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-1_access.log": 87903,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-1_error.log": 11003,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-20_access.log": 827861,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-20_error.log": 11032,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-21_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-21_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-22_access.log": 200379,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-22_error.log": 1052,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-23_access.log": 453,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-23_error.log": 525,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-24_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-24_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-25_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-25_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-26_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-26_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-27_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-27_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-28_access.log": 2104,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-28_error.log": 2174,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-29_access.log": 9608,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-29_error.log": 2462,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-2_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-2_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-30_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-30_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-31_access.log": 41817,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-31_error.log": 1547,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-3_access.log": 277282,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-3_error.log": 10645,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-4_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-4_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-5_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-5_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-6_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-6_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-7_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-7_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-8_access.log": 163769,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-8_error.log": 10207,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-9_access.log": 2603446,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\proxy-host-9_error.log": 55751,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\stream-1_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\stream-1_error.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\stream-2_access.log": 0,
-  "\\\\naspve\\nas\\backups\\npm\\logs\\stream-2_error.log": 0,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-11.txt": 7403,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-11.txt.1": 84622,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-12.txt": 99031,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-13.txt": 92896,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-14.txt": 191781,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-15.txt": 55394,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-15.txt.1": 8770,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-15.txt.2": 9606,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-16.txt": 35715,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-17.txt": 102469,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-17.txt.1": 35820,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-18.txt": 1784,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-19.txt": 273815,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-20.txt": 572443,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-21.txt": 56055,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-22.txt": 135922,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt": 2468,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.1": 349125,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.2": 199809,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.3": 1023,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.4": 1023,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.5": 1041,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.6": 114042,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.7": 19621,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.8": 29806,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-23.txt.9": 15526221,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-24.txt": 99348,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-25.txt": 63410,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-26.txt": 217801,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-27.txt": 66457,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-28.txt": 59236,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-29.txt": 153562,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-29.txt.1": 24147,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-30.txt": 1212354,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-07-31.txt": 49026,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-01.txt": 298970,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-01.txt.1": 274541,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-02.txt": 45372,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-03.txt": 34302,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-04.txt": 33282,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-05.txt": 75013,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-06.txt": 64948,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-07.txt": 48371,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-08.txt": 39365,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-09.txt": 154216,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-09.txt.1": 12568,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-10.txt": 85753,
-  "\\\\naspve\\nas\\projects\\copyparty\\2026-08-11.txt": 6042
-}

app/db/__init__.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Local SQLite database layer for the intrusion-detection system.
+
+Owns the shared connection factory (WAL mode, busy timeout, single mutable
+connection reused across the background-scan thread and web readers) and
+applies schema migrations on open. Query helpers live in :mod:`repositories`.
+"""
+
+from __future__ import annotations
+
+import os
+import sqlite3
+import threading
+
+from ..utils.constants import DATA_DB_PATH
+from .schema import apply_migrations
+
+_connection: sqlite3.Connection | None = None
+_lock = threading.RLock()
+
+
+def connect(path: str | None = None) -> sqlite3.Connection:
+    """Open an initialized SQLite connection at ``path``.
+
+    Enables WAL for concurrent readers during the single-writer background
+    scan and sets a busy timeout so short write contention does not raise.
+    Foreign keys are on and migrations are applied.
+    """
+    db_path = path or DATA_DB_PATH
+    os.makedirs(os.path.dirname(os.path.abspath(db_path)) or ".", exist_ok=True)
+    conn = sqlite3.connect(
+        db_path,
+        check_same_thread=False,  # background scan thread + web handlers
+        isolation_level=None,     # autocommit; use explicit BEGIN for batches
+    )
+    conn.execute("PRAGMA journal_mode=WAL")
+    conn.execute("PRAGMA busy_timeout=5000")
+    conn.execute("PRAGMA synchronous=NORMAL")
+    conn.row_factory = sqlite3.Row
+    apply_migrations(conn)
+    return conn
+
+
+def get_connection() -> sqlite3.Connection:
+    """Return the shared, lazily-created connection (thread-safe)."""
+    global _connection
+    with _lock:
+        if _connection is None:
+            _connection = connect()
+        return _connection
+
+
+def close() -> None:
+    """Close the shared connection, if any."""
+    global _connection
+    with _lock:
+        if _connection is not None:
+            try:
+                _connection.close()
+            except sqlite3.Error:
+                pass
+            _connection = None

app/db/__main__.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""CLI entry point for the SQLite store.
+
+Usage:
+    python -m app.db --migrate        applies pending migrations (idempotent)
+    python -m app.db --info           prints schema version + table counts, exits
+    python -m app.db --path           prints the resolved DB path, exits
+
+Used by ``deploy.sh`` (D004) to ensure the DB is up to date after a ``git pull``
+without needing the web server up.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from ..utils.constants import DATA_DB_PATH
+from .schema import SCHEMA_VERSION, apply_migrations
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="python -m app.db",
+        description="Intrusion-detection SQLite store utilities.")
+    parser.add_argument("--migrate", action="store_true",
+                        help="apply pending schema migrations (idempotent)")
+    parser.add_argument("--info", action="store_true",
+                        help="print schema version + table/row counts")
+    parser.add_argument("--path", action="store_true",
+                        help="print the resolved DB path and exit")
+    args = parser.parse_args(argv)
+
+    if args.path:
+        print(DATA_DB_PATH)
+        return 0
+
+    from . import get_connection
+
+    conn = get_connection()
+    current = conn.execute("PRAGMA user_version").fetchone()[0]
+
+    if args.info:
+        counts = {}
+        tables = conn.execute(
+            "SELECT name FROM sqlite_master WHERE type='table' "
+            "AND name NOT LIKE 'sqlite_%' ORDER BY name").fetchall()
+        for t in tables:
+            name = t["name"]
+            try:
+                counts[name] = conn.execute(
+                    f"SELECT COUNT(*) FROM \"{name}\"").fetchone()[0]
+            except Exception:
+                counts[name] = None
+        print(f"db_path:  {DATA_DB_PATH}")
+        print(f"version:  {current} (latest {SCHEMA_VERSION})")
+        print("tables:")
+        for name, n in counts.items():
+            print(f"  {name:<32} {n} rows")
+        return 0
+
+    if args.migrate or current < SCHEMA_VERSION:
+        before = current
+        apply_migrations(conn)
+        print(f"schema version {before} -> "
+              f"{conn.execute('PRAGMA user_version').fetchone()[0]}")
+        return 0
+
+    print(f"schema is already up to date (version {current})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

app/db/backfill.py

@@ -0,0 +1,361 @@
+#!/usr/bin/env python3
+"""R001 — one-time backfill of legacy runtime data into the SQLite store.
+
+Imports existing JSON/CSV/git-history data so the DB becomes the authoritative
+source without losing anything already accumulated on a deployed instance:
+
+- cumulative blocklist from the git-history reconstruction (old source of
+  truth) -> ``blocklist_entries`` (grow-only ledger)
+- firewall snapshots from ``data/mikrotik/*.json`` -> ``firewall_snapshots``
+- per-source requests from ``reports/<source>/data/requests.csv`` (best effort)
+
+Idempotent: skips rows already present. Safe to run repeatedly.
+
+Usage:
+    python -m app.db.backfill [--dry-run]
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import hashlib
+import json
+import os
+import re
+import sys
+from datetime import datetime, timezone
+
+from ..utils.constants import (
+    APP_REPORT_DIR,
+    APP_REPORT_DATA_DIR,
+    DATA_DIR,
+    MIKROTIK_DATA_DIR,
+    MIKROTIK_REPORT_DIR,
+    NPM_REPORT_DIR,
+    COPYPARTY_REPORT_DIR,
+)
+
+MAX_REPORT_ARTIFACT_BYTES = 10 * 1024 * 1024
+CANONICAL_REPORT_EXPORTS = {
+    "requests.csv", "ips.json", "ips_ipv4.csv", "ips_ipv6.csv",
+    "blocked_ipv4.txt", "blocked_ipv6.txt", "address_list_ipv4.json",
+    "address_list_ipv6.json", "firewall_ipv4.json", "firewall_ipv6.json",
+}
+
+
+def utcnow() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+def _read_cidr_lines(path: str) -> set[str]:
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return {line.strip() for line in f if line.strip()}
+    except OSError:
+        return set()
+
+
+def backfill_blocklist(conn, dry_run: bool = False) -> dict:
+    """Import the legacy cumulative blocklist into the ledger."""
+    from . import repositories as repo
+    from ..utils.blocklist_history import (
+        committed_lines, current_file_lines,
+    )
+
+    v4_path = os.path.join(APP_REPORT_DATA_DIR, "blocklist_ipv4.txt")
+    v6_path = os.path.join(APP_REPORT_DATA_DIR, "blocklist_ipv6.txt")
+    # Legacy source of truth: union of all git revisions + working file +
+    # (there is no earlier scan target to add here).
+    complete_v4 = committed_lines(v4_path) | current_file_lines(v4_path)
+    complete_v6 = committed_lines(v6_path) | current_file_lines(v6_path)
+    cidrs = sorted(complete_v4 | complete_v6)
+    if not cidrs:
+        return {"blocklist": {"cidrs": 0, "added": 0}}
+    if dry_run:
+        return {"blocklist": {"cidrs": len(cidrs), "added": None, "dry_run": True}}
+    result = repo.record_blocklist(conn, cidrs, added_by="backfill")
+    return {"blocklist": result}
+
+
+def backfill_firewall(conn, dry_run: bool = False) -> dict:
+    """Import the latest firewall snapshot from ``data/mikrotik/*.json``."""
+    from . import repositories as repo
+
+    def _load(name: str) -> list:
+        try:
+            with open(os.path.join(MIKROTIK_DATA_DIR, name), "r",
+                      encoding="utf-8") as f:
+                data = json.load(f)
+            return data if isinstance(data, list) else []
+        except (OSError, ValueError):
+            return []
+
+    addr_v4 = _load("address_list_ipv4.json")
+    addr_v6 = _load("address_list_ipv6.json")
+    fw_v4 = _load("firewall_ipv4.json")
+    fw_v6 = _load("firewall_ipv6.json")
+    if not (addr_v4 or addr_v6 or fw_v4 or fw_v6):
+        return {"firewall": {"dry_run": dry_run, "snapshot": None}}
+    # Idempotent: if a firewall snapshot already exists (previous backfill),
+    # don't create another copy of the same latest state.
+    n = conn.execute(
+        "SELECT COUNT(*) FROM firewall_snapshots").fetchone()[0]
+    if n:
+        return {"firewall": {"dry_run": dry_run, "snapshot": "exists",
+                             "skipped": True}}
+    if dry_run:
+        return {"firewall": {"dry_run": True, "snapshot": None}}
+    sid = repo.save_firewall_snapshot(
+        conn, address_lists_v4=addr_v4, address_lists_v6=addr_v6,
+        rules_v4=fw_v4, rules_v6=fw_v6)
+    return {"firewall": {"snapshot": sid}}
+
+
+def backfill_requests(conn, dry_run: bool = False) -> dict:
+    """Best-effort import of per-source ``requests.csv`` files.
+
+    Only ingests rows that don't already exist (keyed on source+log_file+ts+ip).
+    Legacy CSV columns vary by source; we keep a conservative mapping and never
+    fail the whole backfill over a single bad file.
+    """
+    from . import repositories as repo
+
+    seen = set()
+    for r in conn.execute(
+            "SELECT source, log_file, ts, ip FROM requests"):
+        seen.add((r["source"], r["log_file"], r["ts"], r["ip"]))
+
+    candidates = [
+        (os.path.join(COPYPARTY_REPORT_DIR, "data", "requests.csv"), "copyparty"),
+        (os.path.join(NPM_REPORT_DIR, "data", "requests.csv"), "npm"),
+    ]
+    total = 0
+    for path, source in candidates:
+        if not os.path.exists(path):
+            continue
+        try:
+            with open(path, "r", encoding="utf-8", errors="replace") as f:
+                reader = csv.DictReader(f)
+                rows = []
+                for row in reader:
+                    ip = (row.get("ip") or "").strip()
+                    ts = row.get("ts") or row.get("timestamp") or ""
+                    log_file = row.get("log_file") or row.get("file") or ""
+                    if not ip:
+                        continue
+                    key = (source, log_file, ts, ip)
+                    if key in seen:
+                        continue
+                    seen.add(key)
+                    rows.append({
+                        "source": source, "scan_id": None, "log_file": log_file,
+                        "ts": ts, "ip": ip,
+                        "version": 4 if ":" not in ip else 6,
+                        "method": row.get("method"), "path": row.get("path"),
+                        "status": _int_or_none(row.get("status")),
+                        "upstream_status": _int_or_none(
+                            row.get("upstream_status")),
+                        "host": row.get("host"), "user": row.get("user"),
+                        "ua": row.get("ua") or row.get("user_agent"),
+                        "referer": row.get("referer"),
+                        "denied": _bool_str(row.get("denied")),
+                        "banned": _bool_str(row.get("banned")),
+                        "is_error": _bool_str(row.get("is_error")),
+                        "extra": None,
+                    })
+                    total += 1
+            if not dry_run and total:
+                repo.insert_requests(conn, rows)
+        except Exception as exc:
+            print(f"  WARN: requests.csv backfill {source}: {exc}")
+    return {"requests": {"imported": total, "dry_run": dry_run}}
+
+
+def backfill_report_artifacts(conn, dry_run: bool = False,
+                              roots: dict[str, str] | None = None) -> dict:
+    """Import supported report files as versioned, hash-addressed artifacts.
+
+    Canonical event exports and current firewall/blocklist data are skipped;
+    those belong in their normalized tables. Original files are never changed
+    or removed. Oversized or unreadable files are reported for manual review.
+    """
+    from . import repositories as repo
+
+    roots = roots or {
+        "copyparty": COPYPARTY_REPORT_DIR,
+        "npm": NPM_REPORT_DIR,
+        "app": APP_REPORT_DIR,
+        "mikrotik": MIKROTIK_REPORT_DIR,
+    }
+    result = {
+        "discovered": 0, "imported": 0, "would_import": 0,
+        "already_imported": 0, "skipped_canonical": [], "unmapped": [],
+        "by_source": {}, "by_format": {}, "dry_run": dry_run,
+    }
+
+    def count(bucket: str, key: str, field: str) -> None:
+        stats = result[bucket].setdefault(key, {})
+        stats[field] = stats.get(field, 0) + 1
+
+    for source, root in roots.items():
+        if not os.path.isdir(root):
+            continue
+        for directory, _, filenames in os.walk(root):
+            for filename in sorted(filenames):
+                path = os.path.join(directory, filename)
+                suffix = os.path.splitext(filename)[1].lower()
+                if suffix not in (".txt", ".json", ".csv", ".rsc"):
+                    continue
+                relative = os.path.relpath(path, root).replace(os.sep, "/")
+                result["discovered"] += 1
+                report_format = suffix.lstrip(".")
+                count("by_source", source, "discovered")
+                count("by_format", report_format, "discovered")
+                if filename.lower() in CANONICAL_REPORT_EXPORTS:
+                    result["skipped_canonical"].append(
+                        {"source": source, "path": relative})
+                    count("by_source", source, "skipped_canonical")
+                    count("by_format", report_format, "skipped_canonical")
+                    continue
+
+                try:
+                    size = os.path.getsize(path)
+                    if size > MAX_REPORT_ARTIFACT_BYTES:
+                        raise ValueError(
+                            f"file exceeds {MAX_REPORT_ARTIFACT_BYTES} bytes")
+                    with open(path, "rb") as file:
+                        raw = file.read()
+                    text = raw.decode("utf-8", errors="replace")
+                    payload = _report_payload(suffix, text)
+                    digest = hashlib.sha256(raw).hexdigest()
+                    modified = datetime.fromtimestamp(
+                        os.path.getmtime(path), timezone.utc)
+                    generated_at = _report_generated_at(filename, modified)
+                except (OSError, ValueError) as exc:
+                    result["unmapped"].append(
+                        {"source": source, "path": relative,
+                         "reason": str(exc)})
+                    count("by_source", source, "unmapped")
+                    count("by_format", report_format, "unmapped")
+                    continue
+
+                original_path = f"{source}/{relative}"
+                exists = conn.execute(
+                    "SELECT 1 FROM report_artifacts "
+                    "WHERE original_path=? AND content_sha256=?",
+                    (original_path, digest),
+                ).fetchone()
+                if exists:
+                    result["already_imported"] += 1
+                    count("by_source", source, "already_imported")
+                    count("by_format", report_format, "already_imported")
+                    continue
+                if dry_run:
+                    result["would_import"] += 1
+                    count("by_source", source, "would_import")
+                    count("by_format", report_format, "would_import")
+                    continue
+
+                try:
+                    repo.insert_report_artifact(
+                        conn, source=source,
+                        report_type=_report_type(suffix),
+                        generated_at=generated_at, payload=payload,
+                        original_path=original_path,
+                        content_sha256=digest,
+                    )
+                    result["imported"] += 1
+                    count("by_source", source, "imported")
+                    count("by_format", report_format, "imported")
+                except (OSError, ValueError, TypeError) as exc:
+                    result["unmapped"].append(
+                        {"source": source, "path": relative,
+                         "reason": str(exc)})
+                    count("by_source", source, "unmapped")
+                    count("by_format", report_format, "unmapped")
+    return {"reports": result}
+
+
+def _report_payload(suffix: str, text: str) -> dict:
+    if suffix == ".json":
+        try:
+            return {"format": "json", "data": json.loads(text)}
+        except ValueError as exc:
+            return {"format": "json", "content": text,
+                    "parse_error": str(exc)}
+    if suffix == ".csv":
+        try:
+            reader = csv.DictReader(text.splitlines())
+            return {"format": "csv", "columns": reader.fieldnames or [],
+                    "rows": list(reader)}
+        except csv.Error as exc:
+            return {"format": "csv", "content": text,
+                    "parse_error": str(exc)}
+    return {"format": "text", "content": text}
+
+
+def _report_type(suffix: str) -> str:
+    return {".json": "json_report", ".csv": "csv_report",
+            ".rsc": "routeros_script"}.get(suffix, "text_report")
+
+
+def _report_generated_at(filename: str, modified: datetime) -> str:
+    match = re.search(
+        r"(?P<date>\d{4}-\d{2}-\d{2})(?:[-_T](?P<hour>\d{2})[-_:]"
+        r"(?P<minute>\d{2})[-_:](?P<second>\d{2}))?", filename)
+    if not match:
+        return modified.isoformat(timespec="seconds")
+    values = match.groupdict()
+    hour = int(values["hour"] or 0)
+    minute = int(values["minute"] or 0)
+    second = int(values["second"] or 0)
+    try:
+        parsed = datetime.strptime(values["date"], "%Y-%m-%d").replace(
+            hour=hour, minute=minute, second=second, tzinfo=timezone.utc)
+    except ValueError:
+        return modified.isoformat(timespec="seconds")
+    return parsed.isoformat(timespec="seconds")
+
+
+def _int_or_none(v):
+    try:
+        if v in (None, "", "-"):
+            return None
+        return int(v)
+    except (TypeError, ValueError):
+        return None
+
+
+def _bool_str(v):
+    if isinstance(v, str):
+        return int(v.strip().lower() in ("1", "true", "yes", "t"))
+    return int(bool(v))
+
+
+def main(argv: list[str] | None = None) -> None:
+    p = argparse.ArgumentParser(prog="python -m app.db.backfill",
+                                description="Backfill legacy runtime data into SQLite.")
+    p.add_argument("--dry-run", action="store_true",
+                   help="report what would be imported without writing")
+    p.add_argument("--reports-only", action="store_true",
+                   help="import legacy report artifacts only")
+    opts = p.parse_args(argv)
+
+    from . import get_connection
+    conn = get_connection()
+    print(f"== backfill (dry_run={opts.dry_run}) ==")
+    if opts.reports_only:
+        print("reports :", backfill_report_artifacts(
+            conn, dry_run=opts.dry_run))
+        print("== done ==")
+        return
+    print("blocklist:", backfill_blocklist(conn, dry_run=opts.dry_run))
+    print("firewall :", backfill_firewall(conn, dry_run=opts.dry_run))
+    print("requests :", backfill_requests(conn, dry_run=opts.dry_run))
+    print("reports  :", backfill_report_artifacts(conn, dry_run=opts.dry_run))
+    print("== done ==")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

app/db/repositories.py

@@ -0,0 +1,690 @@
+#!/usr/bin/env python3
+"""Query helpers for the intrusion-detection SQLite store.
+
+Functions are grouped by domain and take an explicit ``sqlite3.Connection`` so
+callers control transaction boundaries. Bulk inserts are batched with
+``executemany`` inside a single transaction for speed.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+import base64
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+import ipaddress
+from typing import Any, Iterator, Sequence
+
+from ..utils.models import IPStats
+
+
+def utcnow() -> str:
+    """ISO-8601 timestamp with seconds precision (UTC)."""
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+@contextmanager
+def transaction(conn: sqlite3.Connection) -> Iterator[sqlite3.Connection]:
+    """Context manager for an explicit transaction (commit or rollback)."""
+    conn.execute("BEGIN")
+    try:
+        yield conn
+    except Exception:
+        conn.execute("ROLLBACK")
+        raise
+    else:
+        conn.execute("COMMIT")
+
+
+# ---------------------------------------------------------------------------
+# Scans
+# ---------------------------------------------------------------------------
+
+def start_scan(conn: sqlite3.Connection, kind: str, *,
+               params: dict[str, Any] | None = None,
+               full: bool = False, dry_run: bool = False) -> int:
+    """Record a scan start and return its id."""
+    cur = conn.execute(
+        "INSERT INTO scans (kind, started_at, status, full, dry_run, params_json) "
+        "VALUES (?, ?, 'running', ?, ?, ?)",
+        (kind, utcnow(), int(full), int(dry_run),
+         json.dumps(params) if params is not None else None))
+    return int(cur.lastrowid)
+
+
+def finish_scan(conn: sqlite3.Connection, scan_id: int, *,
+                status: str, result: dict[str, Any] | None = None,
+                log_files: int = 0, request_count: int = 0,
+                error: str | None = None) -> None:
+    """Mark a scan complete with outcome counters."""
+    conn.execute(
+        "UPDATE scans SET finished_at=?, status=?, result_json=?, "
+        "log_files=?, request_count=?, error=? WHERE id=?",
+        (utcnow(), status,
+         json.dumps(result) if result is not None else None,
+         log_files, request_count, error, scan_id))
+
+
+def set_scan_source_counts(conn: sqlite3.Connection, scan_id: int,
+                           source: str, requests: int, files: int) -> None:
+    """Record per-source request/file counts for a scan."""
+    conn.execute(
+        "INSERT INTO scans_sources (scan_id, source, requests, files) "
+        "VALUES (?, ?, ?, ?) "
+        "ON CONFLICT(scan_id, source) DO UPDATE SET "
+        "requests=excluded.requests, files=excluded.files",
+        (scan_id, source, requests, files))
+
+
+def latest_scans(conn: sqlite3.Connection, limit: int = 10) -> list[dict[str, Any]]:
+    """Most recent scan metadata rows."""
+    rows = conn.execute(
+        "SELECT id, kind, started_at, finished_at, status, full, dry_run, "
+        "log_files, request_count, error FROM scans "
+        "ORDER BY id DESC LIMIT ?", (limit,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def get_scan(conn: sqlite3.Connection, scan_id: int) -> dict[str, Any] | None:
+    row = conn.execute(
+        "SELECT id, kind, started_at, finished_at, status, full, dry_run, "
+        "params_json, result_json, log_files, request_count, error "
+        "FROM scans WHERE id=?", (scan_id,)).fetchone()
+    return dict(row) if row is not None else None
+
+
+# ---------------------------------------------------------------------------
+# Logs + raw requests
+# ---------------------------------------------------------------------------
+
+def _parse_ts(ts: str) -> tuple[str, float | None]:
+    """Best-effort ISO timestamp extraction from a log line timestamp string."""
+    if not ts:
+        return (ts, None)
+    epoch = None
+    cleaned = ts.strip()
+    # Accept a trailing timezone like +HH:MM or Z; fall back to naive parse.
+    try:
+        epoch = datetime.fromisoformat(
+            cleaned.replace("Z", "+00:00")).timestamp()
+    except ValueError:
+        try:
+            epoch = datetime.fromisoformat(cleaned).timestamp()
+        except ValueError:
+            epoch = None
+    return (ts, epoch)
+
+
+def insert_requests(conn: sqlite3.Connection, rows: Sequence[dict[str, Any]]) -> int:
+    """Bulk-insert ``requests`` rows. Returns inserted count.
+
+    Each ``row`` maps keys: source, scan_id, log_file, ts, ip, version,
+    method, path, status, upstream_status, host, user, ua, referer, denied,
+    banned, is_error, malicious_hits, extra(dict|None) — matching
+    :mod:`app.utils.models.Request` plus provenance fields.
+    """
+    if not rows:
+        return 0
+    created = utcnow()
+    tuples: list[tuple] = []
+    for r in rows:
+        ts, epoch = _parse_ts(r.get("ts") or "")
+        extra = r.get("extra")
+        tuples.append((
+            r.get("source"), r.get("scan_id"), r.get("log_file"), ts, epoch,
+            r.get("ip"), r.get("version"),
+            r.get("method"), r.get("path"),
+            r.get("status"), r.get("upstream_status"),
+            r.get("host"), r.get("user"), r.get("ua"), r.get("referer"),
+            int(bool(r.get("denied"))), int(bool(r.get("banned"))),
+            int(bool(r.get("is_error"))),
+            int(r.get("malicious_hits") or 0),
+            json.dumps(extra) if extra is not None else None,
+            created,
+        ))
+    with transaction(conn):
+        conn.executemany(
+            "INSERT INTO requests (source, scan_id, log_file, ts, ts_epoch, ip, "
+            "version, method, path, status, upstream_status, host, user, ua, "
+            "referer, denied, banned, is_error, malicious_hits, extra, created_at) "
+            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+            tuples)
+    return len(tuples)
+
+
+def query_requests(conn: sqlite3.Connection, *,
+                   ip: str | None = None, source: str | None = None,
+                   since: str | None = None, until: str | None = None,
+                   path: str | None = None, limit: int = 500) -> list[dict[str, Any]]:
+    """Return matching request rows (optionally filtered), newest last."""
+    clauses: list[str] = []
+    args: list[Any] = []
+    if ip:
+        clauses.append("ip = ?")
+        args.append(ip)
+    if source:
+        clauses.append("source = ?")
+        args.append(source)
+    if since:
+        clauses.append("COALESCE(ts, '') >= ?")
+        args.append(since)
+    if until:
+        clauses.append("COALESCE(ts, '') <= ?")
+        args.append(until)
+    if path:
+        clauses.append("path LIKE ?")
+        args.append(path)
+    sql = "SELECT * FROM requests"
+    if clauses:
+        sql += " WHERE " + " AND ".join(clauses)
+    sql += " ORDER BY id LIMIT ?"
+    args.append(int(limit))
+    return [dict(r) for r in conn.execute(sql, args).fetchall()]
+
+
+# ---------------------------------------------------------------------------
+# IP aggregates
+# ---------------------------------------------------------------------------
+
+def insert_ip_stats(conn: sqlite3.Connection, scan_id: int,
+                    stats: Sequence[IPStats],
+                    blocked: set[str]) -> int:
+    """Persist per-IP aggregates for a scan. ``blocked`` are direct blocked IPs."""
+    if not stats:
+        return 0
+    tuples: list[tuple] = []
+    for s in stats:
+        tuples.append((
+            scan_id, s.ip, s.version, s.total, s.errors, s.c4xx, s.c5xx,
+            s.denied, s.banned, s.first, s.last, s.malicious_hits,
+            json.dumps(dict(s.paths)), json.dumps(dict(s.methods)),
+            json.dumps(dict(s.hosts)), json.dumps(dict(s.uas)),
+            json.dumps(sorted(s.users)), s.whitelist or None,
+            int(s.ip in blocked),
+        ))
+    with transaction(conn):
+        conn.executemany(
+            "INSERT INTO ip_stats (scan_id, ip, version, total, errors, c4xx, "
+            "c5xx, denied, banned, first_ts, last_ts, malicious_hits, paths_json, "
+            "methods_json, hosts_json, uas_json, users_json, whitelist, blocked) "
+            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+            tuples)
+    return len(tuples)
+
+
+def ip_timeline(conn: sqlite3.Connection, ip: str,
+                limit: int = 2000) -> list[dict[str, Any]]:
+    """Chronological request history for one IP across all sources."""
+    rows = conn.execute(
+        "SELECT source, log_file, ts, ts_epoch, method, path, status, host, "
+        "ua, denied, banned, is_error, malicious_hits FROM requests "
+        "WHERE ip = ? ORDER BY COALESCE(ts_epoch, 0), id LIMIT ?",
+        (ip, limit)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def count_requests(conn: sqlite3.Connection) -> int:
+    """Total persisted request records."""
+    return int(conn.execute("SELECT COUNT(*) FROM requests").fetchone()[0])
+
+
+def count_scans(conn: sqlite3.Connection) -> int:
+    """Total persisted scan records."""
+    return int(conn.execute("SELECT COUNT(*) FROM scans").fetchone()[0])
+
+
+# ---------------------------------------------------------------------------
+# Report artifacts
+# ---------------------------------------------------------------------------
+
+def insert_report_artifact(conn: sqlite3.Connection, *, source: str,
+                           report_type: str, generated_at: str,
+                           payload: Any, original_path: str,
+                           content_sha256: str, scan_id: int | None = None,
+                           schema_version: int = 1) -> int:
+    """Insert a structured report artifact, idempotent by path and hash."""
+    with transaction(conn):
+        conn.execute(
+            "INSERT OR IGNORE INTO report_artifacts "
+            "(source, scan_id, report_type, generated_at, schema_version, "
+            "payload_json, original_path, content_sha256, created_at) "
+            "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            (source, scan_id, report_type, generated_at, schema_version,
+             json.dumps(payload, ensure_ascii=False), original_path,
+             content_sha256, utcnow()),
+        )
+        row = conn.execute(
+            "SELECT id FROM report_artifacts "
+            "WHERE original_path=? AND content_sha256=?",
+            (original_path, content_sha256),
+        ).fetchone()
+    return int(row["id"])
+
+
+def list_report_artifacts(conn: sqlite3.Connection, *,
+                          source: str | None = None,
+                          report_type: str | None = None,
+                          since: str | None = None,
+                          until: str | None = None,
+                          limit: int = 50,
+                          cursor: str | None = None) -> dict[str, Any]:
+    """List report metadata using bounded keyset pagination."""
+    limit = min(max(int(limit), 1), 200)
+    clauses: list[str] = []
+    args: list[Any] = []
+    if source:
+        clauses.append("source=?")
+        args.append(source)
+    if report_type:
+        clauses.append("report_type=?")
+        args.append(report_type)
+    if since:
+        clauses.append("generated_at>=?")
+        args.append(since)
+    if until:
+        clauses.append("generated_at<=?")
+        args.append(until)
+    if cursor:
+        generated_at, artifact_id = _decode_report_cursor(cursor)
+        clauses.append("(generated_at<? OR (generated_at=? AND id<?))")
+        args.extend((generated_at, generated_at, artifact_id))
+
+    sql = (
+        "SELECT id, source, scan_id, report_type, generated_at, "
+        "schema_version, original_path, content_sha256 "
+        "FROM report_artifacts"
+    )
+    if clauses:
+        sql += " WHERE " + " AND ".join(clauses)
+    sql += " ORDER BY generated_at DESC, id DESC LIMIT ?"
+    rows = [dict(row) for row in conn.execute(sql, (*args, limit + 1))]
+    has_more = len(rows) > limit
+    rows = rows[:limit]
+    next_cursor = (
+        _encode_report_cursor(rows[-1]["generated_at"], rows[-1]["id"])
+        if has_more and rows else None
+    )
+    return {"items": rows, "next_cursor": next_cursor}
+
+
+def get_report_artifact(conn: sqlite3.Connection,
+                        artifact_id: int) -> dict[str, Any] | None:
+    """Fetch one artifact and decode its structured payload."""
+    row = conn.execute(
+        "SELECT id, source, scan_id, report_type, generated_at, "
+        "schema_version, payload_json, original_path, content_sha256, created_at "
+        "FROM report_artifacts WHERE id=?", (artifact_id,)).fetchone()
+    if row is None:
+        return None
+    artifact = dict(row)
+    artifact["payload"] = json.loads(artifact.pop("payload_json"))
+    return artifact
+
+
+def _encode_report_cursor(generated_at: str, artifact_id: int) -> str:
+    raw = f"{generated_at}\n{artifact_id}".encode("utf-8")
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _decode_report_cursor(cursor: str) -> tuple[str, int]:
+    try:
+        padded = cursor + "=" * (-len(cursor) % 4)
+        generated_at, artifact_id = base64.urlsafe_b64decode(
+            padded.encode("ascii")).decode("utf-8").split("\n", 1)
+        return generated_at, int(artifact_id)
+    except (ValueError, UnicodeError) as exc:
+        raise ValueError("invalid report cursor") from exc
+
+
+def correlate_across_sources(conn: sqlite3.Connection,
+                             limit: int = 100) -> list[dict[str, Any]]:
+    """IPs seen in more than one log source, with per-source counts."""
+    rows = conn.execute(
+        "SELECT ip, COUNT(DISTINCT source) AS sources, "
+        "GROUP_CONCAT(DISTINCT source) AS source_list, COUNT(*) AS total "
+        "FROM requests WHERE ip IS NOT NULL AND ip != '' "
+        "GROUP BY ip HAVING sources > 1 "
+        "ORDER BY total DESC LIMIT ?", (limit,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def top_ips(conn: sqlite3.Connection, since: str | None = None,
+            limit: int = 50) -> list[dict[str, Any]]:
+    """Top IPs by request count within an optional time window."""
+    rows = conn.execute(
+        "SELECT ip, version, COUNT(*) AS total, "
+        "SUM(is_error) AS errors, SUM(malicious_hits) AS malicious_hits, "
+        "MIN(COALESCE(ts_epoch, 0)) AS first_epoch, "
+        "MAX(COALESCE(ts_epoch, 0)) AS last_epoch "
+        "FROM requests WHERE ip IS NOT NULL AND ip != '' "
+        + ("AND COALESCE(ts, '') >= ? " if since else "")
+        + "GROUP BY ip ORDER BY total DESC LIMIT ?",
+        ((since,) if since else ()) + (limit,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+# ---------------------------------------------------------------------------
+# Blocklist ledger
+# ---------------------------------------------------------------------------
+
+def active_blocklist(conn: sqlite3.Connection) -> list[dict[str, Any]]:
+    rows = conn.execute(
+        "SELECT id, cidr, version, added_at, added_by, last_seen "
+        "FROM blocklist_entries WHERE status='active' ORDER BY cidr").fetchall()
+    return [dict(r) for r in rows]
+
+
+def block_entry(conn: sqlite3.Connection, cidr: str, *,
+                added_by: str | None = None, last_seen: str | None = None,
+                reasons: list[dict[str, Any]] | None = None) -> None:
+    """Add a CIDR to the grow-only ledger (idempotent when already active).
+
+    Manages its own transaction for standalone use."""
+    with transaction(conn):
+        _block_entry_inner(conn, cidr, added_by=added_by,
+                           last_seen=last_seen, reasons=reasons)
+
+
+def _block_entry_inner(conn: sqlite3.Connection, cidr: str, *,
+                       added_by: str | None = None,
+                       last_seen: str | None = None,
+                       reasons: list[dict[str, Any]] | None = None) -> None:
+    """Low-level block insert; caller owns the transaction."""
+    now = utcnow()
+    version = _cidr_version(cidr)
+    existing = conn.execute(
+        "SELECT id FROM blocklist_entries WHERE cidr = ? AND status='active'",
+        (cidr,)).fetchone()
+    if existing is not None:
+        entry_id = int(existing["id"])
+        conn.execute(
+            "UPDATE blocklist_entries SET last_seen = COALESCE(?, last_seen) "
+            "WHERE id = ?", (last_seen, entry_id))
+        if reasons:
+            insert_reasons(conn, entry_id, last_seen or "", reasons)
+        return
+    cur = conn.execute(
+        "INSERT INTO blocklist_entries (cidr, version, status, added_at, "
+        "added_by, last_seen) VALUES (?, ?, 'active', ?, ?, ?)",
+        (cidr, version, now, added_by, last_seen))
+    entry_id = int(cur.lastrowid)
+    if reasons:
+        insert_reasons(conn, entry_id, last_seen or "", reasons)
+
+
+def unblock_entry(conn: sqlite3.Connection, cidr: str, *,
+                  actor: str | None = None) -> bool:
+    """Remove a CIDR from active blocklist (idempotent). Returns True if removed."""
+    now = utcnow()
+    cur = conn.execute(
+        "UPDATE blocklist_entries SET status='removed', removed_at=? "
+        "WHERE cidr=? AND status='active'", (now, cidr))
+    removed = cur.rowcount > 0
+    conn.execute(
+        "INSERT INTO blocklist_events (action, cidr, actor, fired_at, detail) "
+        "VALUES ('remove', ?, ?, ?, ?)",
+        (cidr, actor, now, None))
+    return removed
+
+
+def record_blocklist(conn: sqlite3.Connection, cidrs: Sequence[str], *,
+                     added_by: str | None = None, reasons=None) -> dict[str, Any]:
+    """Grow-only record: add any ``cidrs`` not already active to the ledger.
+
+    Unlike :func:`sync_blocklist`, this **never removes** entries. It mirrors
+    the router's cumulative model: once an IP/subnet has ever been blocked it
+    stays active even after it leaves the scan window (e.g. NPM ~30-day log
+    retention), exactly like the old git-history backfill. Returns the added
+    delta and the resulting active count.
+    """
+    cidr_set = set(cidrs)
+    before = {r["cidr"] for r in active_blocklist(conn)}
+    to_add = sorted(cidr_set - before)
+    now = utcnow()
+    with transaction(conn):
+        for cidr in to_add:
+            _block_entry_inner(conn, cidr, added_by=added_by, last_seen=now,
+                               reasons=reasons)
+        # Refresh last_seen on entries that are still desired so the ledger
+        # reflects recency for existing rows too.
+        conn.executemany(
+            "UPDATE blocklist_entries SET last_seen=? WHERE cidr=? AND status='active'",
+            [(now, cidr) for cidr in cidr_set.intersection(before)])
+    return {"added": to_add, "active": len(before) + len(to_add)}
+
+
+def prune_old_single_ip_blocks(conn: sqlite3.Connection, *,
+                               older_than_days: int = 30,
+                               actor: str | None = "retention") -> list[str]:
+    """Remove active single-host entries older than ``older_than_days``.
+
+    Keeps CIDR ranges/subnets intact. Host entries are detected via
+    ``ipaddress.ip_network(..., strict=False)`` and only removed when the
+    network is exactly one address (/32 for IPv4, /128 for IPv6).
+    """
+    cutoff = datetime.now(timezone.utc) - \
+        timedelta(days=max(0, older_than_days))
+    rows = conn.execute(
+        "SELECT cidr, added_at, last_seen FROM blocklist_entries "
+        "WHERE status='active'").fetchall()
+
+    to_remove: list[str] = []
+    for row in rows:
+        cidr = str(row["cidr"])
+        if not _is_single_host_cidr(cidr):
+            continue
+        seen = _parse_iso_ts(
+            row["last_seen"]) or _parse_iso_ts(row["added_at"])
+        if seen is None:
+            continue
+        if seen < cutoff:
+            to_remove.append(cidr)
+
+    if not to_remove:
+        return []
+
+    now = utcnow()
+    with transaction(conn):
+        conn.executemany(
+            "UPDATE blocklist_entries SET status='removed', removed_at=? "
+            "WHERE cidr=? AND status='active'",
+            [(now, cidr) for cidr in to_remove],
+        )
+        conn.executemany(
+            "INSERT INTO blocklist_events (action, cidr, actor, fired_at, detail) "
+            "VALUES ('remove', ?, ?, ?, ?)",
+            [(cidr, actor, now, f"single-ip-retention>{older_than_days}d")
+             for cidr in to_remove],
+        )
+    return sorted(to_remove)
+
+
+def sync_blocklist(conn: sqlite3.Connection, desired_cidrs: Sequence[str], *,
+                   added_by: str | None = None) -> dict[str, Any]:
+    """Reconcile active blocklist to ``desired_cidrs``.
+
+    Adds missing entries; marks active entries absent from ``desired_cidrs``
+    as removed (only ones the system added) so the ledger stays grow-only but
+    reflects the current policy. Returns the add/remove delta.
+    """
+    desired = set(desired_cidrs)
+    current = {r["cidr"] for r in active_blocklist(conn)}
+    added = sorted(desired - current)
+    removed = sorted(current - desired)
+    now = utcnow()
+    with transaction(conn):
+        for cidr in added:
+            _block_entry_inner(conn, cidr, added_by=added_by, last_seen=now)
+        conn.executemany(
+            "UPDATE blocklist_entries SET status='removed', removed_at=? "
+            "WHERE cidr=? AND status='active'",
+            [(now, cidr) for cidr in removed])
+    return {"added": added, "removed": removed}
+
+
+def insert_reasons(conn: sqlite3.Connection, entry_id: int, scan_session: str,
+                   reasons: list[dict[str, Any]]) -> None:
+    tuples = [
+        (entry_id, r.get("scan_id"), r.get("ip") or "", r.get("reason"),
+         r.get("pattern"), r.get("severity"), r.get("sample_path"),
+         int(r.get("hits") or 0))
+        for r in reasons
+    ]
+    conn.executemany(
+        "INSERT INTO blocklist_reasons (entry_id, scan_id, ip, reason, pattern, "
+        "severity, sample_path, hits) VALUES (?,?,?,?,?,?,?,?)",
+        tuples)
+
+
+def blocklist_history(conn: sqlite3.Connection, limit: int = 500) -> list[dict[str, Any]]:
+    rows = conn.execute(
+        "SELECT id, cidr, version, status, added_at, removed_at, added_by, "
+        "last_seen FROM blocklist_entries ORDER BY id DESC LIMIT ?",
+        (limit,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def _cidr_version(cidr: str) -> int:
+    try:
+        import ipaddress
+        net = ipaddress.ip_network(cidr, strict=False)
+        return net.version
+    except ValueError:
+        return 4 if ":" not in str(cidr) else 6
+
+
+def _is_single_host_cidr(cidr: str) -> bool:
+    try:
+        net = ipaddress.ip_network(cidr, strict=False)
+        return net.num_addresses == 1
+    except ValueError:
+        return False
+
+
+def _parse_iso_ts(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+# ---------------------------------------------------------------------------
+# Whitelists
+# ---------------------------------------------------------------------------
+
+def set_whitelist(conn: sqlite3.Connection, provider: str,
+                  cidrs: Sequence[str], source: str | None = None) -> None:
+    """Replace the CIDR set for a provider (mark old inactive, upsert new)."""
+    now = utcnow()
+    with transaction(conn):
+        conn.execute(
+            "UPDATE whitelist_entries SET active=0 WHERE provider=?", (provider,))
+        for cidr in cidrs:
+            version = _cidr_version(cidr)
+            conn.execute(
+                "INSERT INTO whitelist_entries (provider, cidr, version, source, "
+                "active, updated_at) VALUES (?,?,?,?,1,?) "
+                "ON CONFLICT(provider, cidr) DO UPDATE SET active=1, "
+                "source=excluded.source, updated_at=excluded.updated_at",
+                (provider, cidr, version, source, now))
+        conn.execute(
+            "INSERT INTO whitelist_sources (provider, source_type, last_refresh_at, "
+            "entry_count) VALUES (?, ?, ?, ?) ON CONFLICT(provider) DO UPDATE SET "
+            "source_type=excluded.source_type, last_refresh_at=excluded.last_refresh_at, "
+            "entry_count=excluded.entry_count",
+            (provider, source, now, len(cidrs)))
+
+
+def is_whitelisted_db(conn: sqlite3.Connection, ip: str) -> bool:
+    """Check whether an IP falls in any active whitelist CIDR."""
+    import ipaddress
+    try:
+        addr = ipaddress.ip_address(ip)
+    except ValueError:
+        return False
+    rows = conn.execute(
+        "SELECT cidr FROM whitelist_entries WHERE active=1").fetchall()
+    for r in rows:
+        try:
+            net = ipaddress.ip_network(r["cidr"], strict=False)
+        except ValueError:
+            continue
+        if addr.version == net.version and addr in net:
+            return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Firewall snapshots
+# ---------------------------------------------------------------------------
+
+def save_firewall_snapshot(conn: sqlite3.Connection, *,
+                           address_lists_v4: list[dict],
+                           address_lists_v6: list[dict],
+                           rules_v4: list[dict], rules_v6: list[dict]) -> int:
+    """Persist a full firewall snapshot; returns the snapshot id."""
+    now = utcnow()
+    cur = conn.execute(
+        "INSERT INTO firewall_snapshots (captured_at, kind, trigger) "
+        "VALUES (?, 'snapshot', 'scan')", (now,))
+    snapshot_id = int(cur.lastrowid)
+    with transaction(conn):
+        tuples = [
+            (snapshot_id, "ipv4", e.get("list"), e.get("address"),
+             int(bool(e.get("dynamic"))), e.get("timeout"))
+            for e in address_lists_v4
+        ] + [
+            (snapshot_id, "ipv6", e.get("list"), e.get("address"),
+             int(bool(e.get("dynamic"))), e.get("timeout"))
+            for e in address_lists_v6
+        ]
+        conn.executemany(
+            "INSERT INTO firewall_address_list_entries (snapshot_id, network, "
+            "list, address, dynamic, timeout) VALUES (?,?,?,?,?,?)", tuples)
+        rule_tuples = [
+            (snapshot_id, "ipv4", idx, e.get("chain"), e.get("action"),
+             e.get("dst-list"), None, e.get("comment"), json.dumps(e))
+            for idx, e in enumerate(rules_v4)
+        ] + [
+            (snapshot_id, "ipv6", idx, e.get("chain"), e.get("action"),
+             e.get("dst-list"), None, e.get("comment"), json.dumps(e))
+            for idx, e in enumerate(rules_v6)
+        ]
+        conn.executemany(
+            "INSERT INTO firewall_rule_entries (snapshot_id, network, rule_index, "
+            "chain, action, dst_list, proto_port, comment, raw_json) "
+            "VALUES (?,?,?,?,?,?,?,?,?)", rule_tuples)
+    return snapshot_id
+
+
+def recent_firewall_snapshots(conn: sqlite3.Connection,
+                              limit: int = 10) -> list[dict[str, Any]]:
+    """Most recent firewall snapshots with entry counts (F001)."""
+    rows = conn.execute(
+        "SELECT fs.id, fs.captured_at, fs.kind, fs.trigger, "
+        "(SELECT COUNT(*) FROM firewall_address_list_entries e "
+        " WHERE e.snapshot_id = fs.id) AS addr_entries, "
+        "(SELECT COUNT(*) FROM firewall_rule_entries r "
+        " WHERE r.snapshot_id = fs.id) AS rule_entries "
+        "FROM firewall_snapshots fs ORDER BY fs.id DESC LIMIT ?",
+        (limit,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+# ---------------------------------------------------------------------------
+# WHOIS cache
+# ---------------------------------------------------------------------------
+
+def set_whois(conn: sqlite3.Connection, ip: str, name: str | None,
+              cidr: str | None) -> None:
+    conn.execute(
+        "INSERT INTO whois_info (ip, name, cidr, fetched_at) VALUES (?,?,?,?) "
+        "ON CONFLICT(ip) DO UPDATE SET name=excluded.name, cidr=excluded.cidr, "
+        "fetched_at=excluded.fetched_at",
+        (ip, name, cidr, utcnow()))

app/db/schema.py

@@ -0,0 +1,284 @@
+#!/usr/bin/env python3
+"""SQLite schema and migrations for the intrusion-detection system.
+
+Definitions live here as the single source of truth and are applied through
+``PRAGMA user_version`` migrations (see ``apply_migrations``). Each entry is an
+ordered list of DDL statements; the version is bumped in lock-step so the
+migrations are idempotent.
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+from typing import Iterable
+
+#: Latest schema version. Bump by one whenever a new migration is appended.
+SCHEMA_VERSION = 2
+
+#: Ordered migrations: index -> list of DDL statements. A migration N upgrades a
+#: database from user_version N-1 to N. Never edit an older migration in place;
+#: append a new one instead.
+MIGRATIONS: dict[int, list[str]] = {
+    1: [
+        # ------------------------------------------------------------------
+        # log_sources — canonical provenance
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS log_sources (
+            id INTEGER PRIMARY KEY,
+            name TEXT UNIQUE NOT NULL,
+            log_path TEXT,
+            enabled INTEGER NOT NULL DEFAULT 1
+        )
+        """
+    ],
+
+    2: [
+        """
+        CREATE TABLE IF NOT EXISTS report_artifacts (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            source TEXT NOT NULL,
+            scan_id INTEGER,
+            report_type TEXT NOT NULL,
+            generated_at TEXT NOT NULL,
+            schema_version INTEGER NOT NULL DEFAULT 1,
+            payload_json TEXT NOT NULL,
+            original_path TEXT NOT NULL,
+            content_sha256 TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            UNIQUE (original_path, content_sha256)
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_report_artifacts_source_time "
+        "ON report_artifacts (source, generated_at DESC, id DESC)",
+        "CREATE INDEX IF NOT EXISTS idx_report_artifacts_type_time "
+        "ON report_artifacts (report_type, generated_at DESC, id DESC)",
+        """
+        CREATE TABLE IF NOT EXISTS requests (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            source TEXT NOT NULL,
+            scan_id INTEGER,
+            log_file TEXT,
+            ts TEXT,
+            ts_epoch REAL,
+            ip TEXT NOT NULL,
+            version INTEGER,
+            method TEXT,
+            path TEXT,
+            status INTEGER,
+            upstream_status INTEGER,
+            host TEXT,
+            user TEXT,
+            ua TEXT,
+            referer TEXT,
+            denied INTEGER NOT NULL DEFAULT 0,
+            banned INTEGER NOT NULL DEFAULT 0,
+            is_error INTEGER NOT NULL DEFAULT 0,
+            malicious_hits INTEGER NOT NULL DEFAULT 0,
+            extra TEXT,
+            created_at TEXT NOT NULL
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_requests_ip_ts ON requests (ip, ts)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_source_ts ON requests (source, ts)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_ts_epoch ON requests (ts_epoch)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_path ON requests (path)",
+        "CREATE INDEX IF NOT EXISTS idx_requests_scan ON requests (scan_id)",
+        # ------------------------------------------------------------------
+        # ip_stats — per-IP aggregate per scan
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS ip_stats (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            scan_id INTEGER,
+            ip TEXT NOT NULL,
+            version INTEGER,
+            total INTEGER NOT NULL DEFAULT 0,
+            errors INTEGER NOT NULL DEFAULT 0,
+            c4xx INTEGER NOT NULL DEFAULT 0,
+            c5xx INTEGER NOT NULL DEFAULT 0,
+            denied INTEGER NOT NULL DEFAULT 0,
+            banned INTEGER NOT NULL DEFAULT 0,
+            first_ts TEXT,
+            last_ts TEXT,
+            malicious_hits INTEGER NOT NULL DEFAULT 0,
+            paths_json TEXT,
+            methods_json TEXT,
+            hosts_json TEXT,
+            uas_json TEXT,
+            users_json TEXT,
+            whitelist TEXT,
+            blocked INTEGER NOT NULL DEFAULT 0
+        )
+        """,
+        "CREATE UNIQUE INDEX IF NOT EXISTS idx_ip_stats_scan_ip ON ip_stats (scan_id, ip)",
+        # ------------------------------------------------------------------
+        # scans + scans_sources — one row per analysis run
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS scans (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            kind TEXT NOT NULL,
+            started_at TEXT NOT NULL,
+            finished_at TEXT,
+            status TEXT NOT NULL DEFAULT 'running',
+            full INTEGER NOT NULL DEFAULT 0,
+            dry_run INTEGER NOT NULL DEFAULT 0,
+            params_json TEXT,
+            result_json TEXT,
+            log_files INTEGER NOT NULL DEFAULT 0,
+            request_count INTEGER NOT NULL DEFAULT 0,
+            error TEXT
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_scans_started ON scans (started_at)",
+        """
+        CREATE TABLE IF NOT EXISTS scans_sources (
+            scan_id INTEGER NOT NULL,
+            source TEXT NOT NULL,
+            requests INTEGER NOT NULL DEFAULT 0,
+            files INTEGER NOT NULL DEFAULT 0,
+            PRIMARY KEY (scan_id, source)
+        )
+        """,
+        # ------------------------------------------------------------------
+        # blocklist — grow-only ledger + reasons + audit events
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS blocklist_entries (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            cidr TEXT NOT NULL,
+            version INTEGER,
+            status TEXT NOT NULL DEFAULT 'active',
+            added_at TEXT NOT NULL,
+            removed_at TEXT,
+            added_by TEXT,
+            last_seen TEXT
+        )
+        """,
+        """CREATE UNIQUE INDEX IF NOT EXISTS
+           idx_blocklist_active_cidr ON blocklist_entries (cidr) WHERE status='active'""",
+        """
+        CREATE TABLE IF NOT EXISTS blocklist_reasons (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            entry_id INTEGER,
+            scan_id INTEGER,
+            ip TEXT NOT NULL,
+            reason TEXT,
+            pattern TEXT,
+            severity INTEGER,
+            sample_path TEXT,
+            hits INTEGER NOT NULL DEFAULT 0
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_blereasons_ip ON blocklist_reasons (ip)",
+        """
+        CREATE TABLE IF NOT EXISTS blocklist_events (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            action TEXT NOT NULL,
+            cidr TEXT NOT NULL,
+            actor TEXT,
+            fired_at TEXT NOT NULL,
+            detail TEXT
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_blevents_cidr ON blocklist_events (cidr)",
+        # ------------------------------------------------------------------
+        # whitelist — current entries + source refresh tracking
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS whitelist_entries (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            provider TEXT NOT NULL,
+            cidr TEXT NOT NULL,
+            version INTEGER,
+            source TEXT,
+            active INTEGER NOT NULL DEFAULT 1,
+            updated_at TEXT
+        )
+        """,
+        "CREATE UNIQUE INDEX IF NOT EXISTS idx_wl_provider_cidr ON whitelist_entries (provider, cidr)",
+        """
+        CREATE TABLE IF NOT EXISTS whitelist_sources (
+            provider TEXT PRIMARY KEY,
+            source_type TEXT,
+            url TEXT,
+            file TEXT,
+            last_refresh_at TEXT,
+            entry_count INTEGER NOT NULL DEFAULT 0,
+            refresh_error TEXT
+        )
+        """,
+        # ------------------------------------------------------------------
+        # firewall — snapshots of address lists + rules
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS firewall_snapshots (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            captured_at TEXT NOT NULL,
+            kind TEXT NOT NULL DEFAULT 'snapshot',
+            trigger TEXT NOT NULL DEFAULT 'scan'
+        )
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS firewall_address_list_entries (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            snapshot_id INTEGER,
+            network TEXT,
+            list TEXT,
+            address TEXT,
+            dynamic INTEGER NOT NULL DEFAULT 0,
+            timeout INTEGER
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_fwal_snapshot ON firewall_address_list_entries (snapshot_id)",
+        "CREATE INDEX IF NOT EXISTS idx_fwal_list_addr ON firewall_address_list_entries (list, address)",
+        """
+        CREATE TABLE IF NOT EXISTS firewall_rule_entries (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            snapshot_id INTEGER,
+            network TEXT,
+            rule_index INTEGER,
+            chain TEXT,
+            action TEXT,
+            dst_list TEXT,
+            proto_port TEXT,
+            comment TEXT,
+            raw_json TEXT
+        )
+        """,
+        "CREATE INDEX IF NOT EXISTS idx_fwr_snapshot ON firewall_rule_entries (snapshot_id)",
+        # ------------------------------------------------------------------
+        # whois — structured cache
+        # ------------------------------------------------------------------
+        """
+        CREATE TABLE IF NOT EXISTS whois_info (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            ip TEXT UNIQUE NOT NULL,
+            name TEXT,
+            cidr TEXT,
+            fetched_at TEXT NOT NULL
+        )
+        """,
+    ],
+}
+
+
+def apply_migrations(conn: sqlite3.Connection) -> None:
+    """Apply all pending migrations, bumping ``user_version`` in lock-step.
+
+    Safe to call on every process start: it only runs migrations whose version
+    is greater than the current ``PRAGMA user_version``.
+    """
+    conn.execute("PRAGMA foreign_keys=ON")
+    current = conn.execute("PRAGMA user_version").fetchone()[0]
+    for version in range(current + 1, SCHEMA_VERSION + 1):
+        statements = MIGRATIONS.get(version)
+        if statements is None:
+            raise RuntimeError(
+                f"missing migration for schema version {version}")
+        with conn:
+            for ddl in statements:
+                conn.execute(ddl)
+            conn.execute(f"PRAGMA user_version={version}")

app/firewall.py

@@ -1,364 +1,388 @@
-"""
-firewall.py -
-Module for interacting with the Mikrotik routeros shell to manage firewall rules and IP address lists.
-Provides functions to read the current firewall configuration, add and remove IPs from the blocklist.
-Reads the latest report from the IDS scan, reads the current firewall configuration, and updates the router's blocklist accordingly.
-"""
-
-from __future__ import annotations
-
-import os
-import json
-import paramiko
-from datetime import datetime
-import shlex
-from typing import Iterable
-from .utils.constants import (
-    BLOCKLIST_NAME,
-    MIKROTIK_DATA_DIR,
-    REPORT_DIR,
-    ROUTER_IP,
-    ROUTER_PASSWORD,
-    ROUTER_USER,
-    SSH_PORT,
-    SSH_TIMEOUT,
-    WHITELIST_NAMES,
-)
-from .utils.files import write_lines
-from .utils.ip_utils import is_whitelisted
-from .utils.blocklist_history import compute_changes, cumulative_blocklist
-
-
-class MikrotikFirewall:
-    """
-    Class to manage Mikrotik firewall rules and IP address lists.
-    Provides methods to read the current blocklist, add/remove IPs, and update the blocklist based on IDS scan reports.
-    """
-
-    def __init__(self, router_ip: str = ROUTER_IP, username: str = ROUTER_USER,
-                 password: str = ROUTER_PASSWORD):
-        self.router_ip = router_ip
-        self.username = username
-        self.password = password
-        self.client: paramiko.SSHClient | None = None
-
-    def connect(self) -> None:
-        """Establish an SSH connection to the Mikrotik router."""
-        client = paramiko.SSHClient()
-        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-        try:
-            # RouterOS 7.20.x exposes an RSA host key and classic SSH ciphers.
-            client.connect(
-                self.router_ip,
-                port=SSH_PORT,
-                username=self.username,
-                password=self.password,
-                timeout=SSH_TIMEOUT,
-                banner_timeout=SSH_TIMEOUT,
-                auth_timeout=SSH_TIMEOUT,
-                allow_agent=False,
-                look_for_keys=False,
-                compress=False,
-                disabled_algorithms={"pubkeys": ["rsa-sha2-512"]},
-            )
-        except Exception:
-            client.close()
-            raise
-        self.client = client
-
-    def disconnect(self) -> None:
-        """Close the SSH connection."""
-        if self.client:
-            self.client.close()
-            self.client = None
-
-    def execute_command(self, command: str) -> str:
-        """Execute a command on the Mikrotik router via SSH and return the output."""
-        if not self.client:
-            raise RuntimeError("SSH client is not connected.")
-        stdin, stdout, stderr = self.client.exec_command(command)
-        output = stdout.read().decode("utf-8")
-        error = stderr.read().decode("utf-8")
-        if error:
-            raise RuntimeError(f"Error executing command '{command}': {error}")
-        return output
-
-    def get_address_list_ipv4(self, name: str) -> set[str]:
-        """Retrieve the current IPv4 address list from the Mikrotik router."""
-        output = self.execute_command("/ip firewall address-list print")
-        ips = set()
-        for line in output.splitlines():
-            parts = line.split()
-            if len(parts) >= 3 and parts[1] == "list" and parts[2] == name:
-                ip = parts[0]
-                ips.add(ip)
-        return ips
-
-    def get_address_list_ipv6(self, name: str) -> set[str]:
-        """Retrieve the current IPv6 address list from the Mikrotik router."""
-        output = self.execute_command("/ipv6 firewall address-list print")
-        ips = set()
-        for line in output.splitlines():
-            parts = line.split()
-            if len(parts) >= 3 and parts[1] == "list" and parts[2] == name:
-                ip = parts[0]
-                ips.add(ip)
-        return ips
-
-    @staticmethod
-    def _parse_terse_output(output: str) -> list[dict[str, str]]:
-        """Parse RouterOS `print terse` records into key/value dictionaries."""
-        records = []
-        for line in output.splitlines():
-            fields = {}
-            for field in shlex.split(line):
-                key, separator, value = field.partition("=")
-                if separator:
-                    fields[key] = value
-            if fields:
-                records.append(fields)
-        return records
-
-    def get_address_lists(self, ipv6: bool = False) -> list[dict[str, str]]:
-        """Retrieve all address-list entries in structured form."""
-        path = "/ipv6" if ipv6 else "/ip"
-        output = self.execute_command(
-            f"{path} firewall address-list print terse")
-        return self._parse_terse_output(output)
-
-    def get_firewall_rules(self, ipv6: bool = False) -> list[dict[str, str]]:
-        """Retrieve all firewall filter rules in structured form."""
-        path = "/ipv6" if ipv6 else "/ip"
-        output = self.execute_command(
-            f"{path} firewall filter print terse")
-        return self._parse_terse_output(output)
-
-    @staticmethod
-    def _write_json(path: str, obj) -> None:
-        with open(path, "w", encoding="utf-8") as file:
-            json.dump(obj, file, indent=2, sort_keys=True)
-
-    def save_state_report(self, report_dir: str = REPORT_DIR,
-                          changes: dict | None = None) -> str:
-        """Save current address lists and firewall rules for auditing.
-
-        Writes structured snapshots to ``<report_dir>/mikrotik/data/`` and to
-        the common ``data/mikrotik/`` directory (overwritten every run so git
-        can diff changes to the firewall state over time), plus a timestamped
-        JSON report under ``<report_dir>/mikrotik/``.
-        """
-        state = {
-            "router": self.router_ip,
-            "collected_at": datetime.now().astimezone().isoformat(),
-            "address_lists": {
-                "ipv4": self.get_address_lists(),
-                "ipv6": self.get_address_lists(ipv6=True),
-            },
-            "firewall_rules": {
-                "ipv4": self.get_firewall_rules(),
-                "ipv6": self.get_firewall_rules(ipv6=True),
-            },
-        }
-        if changes is not None:
-            state["changes"] = changes
-
-        report_data_dir = os.path.join(report_dir, "mikrotik", "data")
-        os.makedirs(report_data_dir, exist_ok=True)
-        os.makedirs(MIKROTIK_DATA_DIR, exist_ok=True)
-        for version in ("ipv4", "ipv6"):
-            for data_dir in (report_data_dir, MIKROTIK_DATA_DIR):
-                self._write_json(
-                    os.path.join(data_dir, f"address_list_{version}.json"),
-                    state["address_lists"][version])
-                self._write_json(
-                    os.path.join(data_dir, f"firewall_{version}.json"),
-                    state["firewall_rules"][version])
-
-        timestamp = datetime.now().strftime("%Y-%m-%d-%H-%M-%S")
-        report_path = os.path.join(report_dir, "mikrotik", f"{timestamp}.json")
-        self._write_json(report_path, state)
-        return report_path
-
-    def sync_blocklist(self, blocked_ipv4: Iterable[str],
-                       blocked_ipv6: Iterable[str],
-                       dry_run: bool = False,
-                       report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
-        """Synchronize the Blocked list cumulatively and audit the result.
-
-        The blocklist is grow-only: targets are added when present in the
-        complete set (all git history of the blocklist files + the current
-        working files + this scan's targets) and never removed automatically.
-        Only router entries absent from the complete set — i.e. never blocked
-        by the system — are pruned. See ``app.blocklist_history``.
-        """
-
-        desired_ipv4 = set(blocked_ipv4)
-        desired_ipv6 = set(blocked_ipv6)
-        current_ipv4 = self.get_address_list_ipv4(BLOCKLIST_NAME)
-        current_ipv6 = self.get_address_list_ipv6(BLOCKLIST_NAME)
-        whitelisted_ipv4 = set()
-        whitelisted_ipv6 = set()
-        for name in WHITELIST_NAMES:
-            whitelisted_ipv4.update(self.get_address_list_ipv4(name))
-            whitelisted_ipv6.update(self.get_address_list_ipv6(name))
-
-        v4_path = os.path.join(
-            report_dir, "app", "data", "blocklist_ipv4.txt")
-        v6_path = os.path.join(
-            report_dir, "app", "data", "blocklist_ipv6.txt")
-        complete_v4, complete_v6 = cumulative_blocklist(
-            v4_path, v6_path, desired_ipv4, desired_ipv6)
-
-        changes = compute_changes(
-            current_ipv4, current_ipv6,
-            complete_v4, complete_v6,
-            whitelisted_ipv4, whitelisted_ipv6)
-        changes["dry_run"] = dry_run
-
-        if not dry_run:
-            for ip in changes["removed_ipv4"]:
-                self.execute_command(
-                    f"/ip firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
-            for ip in changes["removed_ipv6"]:
-                self.execute_command(
-                    f"/ipv6 firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
-            self.write_address_list_ipv4(BLOCKLIST_NAME, changes["added_ipv4"])
-            self.write_address_list_ipv6(BLOCKLIST_NAME, changes["added_ipv6"])
-        self.save_state_report(report_dir, changes)
-        return changes
-
-    def write_address_list_ipv4(self, name: str, ips: Iterable[str]) -> None:
-        """Write a list of IPv4 addresses to the Mikrotik router's address list."""
-        for ip in ips:
-            if is_whitelisted(ip):
-                continue  # Skip whitelisted IPs
-            self.execute_command(
-                f"/ip firewall address-list add list={name} address={ip}")
-
-    def write_address_list_ipv6(self, name: str, ips: Iterable[str]) -> None:
-        """Write a list of IPv6 addresses to the Mikrotik router's address list."""
-        for ip in ips:
-            if is_whitelisted(ip):
-                continue  # Skip whitelisted IPs
-            self.execute_command(
-                f"/ipv6 firewall address-list add list={name} address={ip}")
-
-
-def write_blocklist_files(blocked_ipv4: Iterable[str],
-                          blocked_ipv6: Iterable[str],
-                          report_dir: str = REPORT_DIR) -> tuple[str, str]:
-    """Write the final consolidated blocklist to ``<report_dir>/app/data/``.
-
-    Returns the paths of the IPv4 and IPv6 blocklist files
-    (``blocklist_ipv4.txt`` / ``blocklist_ipv6.txt``).
-    """
-    data_dir = os.path.join(report_dir, "app", "data")
-    os.makedirs(data_dir, exist_ok=True)
-    v4_path = os.path.join(data_dir, "blocklist_ipv4.txt")
-    v6_path = os.path.join(data_dir, "blocklist_ipv6.txt")
-    write_lines(v4_path, sorted(blocked_ipv4))
-    write_lines(v6_path, sorted(blocked_ipv6))
-    return v4_path, v6_path
-
-
-def get_scan_report(report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
-    """Read the latest scan report `mikrotik-block.rsc` from the report directory and return the list of blocked IPs."""
-    report_path = os.path.join(report_dir, "mikrotik-block.rsc")
-    if not os.path.exists(report_path):
-        raise FileNotFoundError(f"Scan report not found: {report_path}")
-
-    # add sections, they start with `/ip firewall address-list` or `/ipv6 firewall address-list` and end with a blank line or EOF
-    sections = {
-        "/ip firewall address-list": [],
-        "/ipv6 firewall address-list": [],
-    }
-    # add list=Cloudflare or list=Openfactory to whitelist sections, list=Blocked to blocked section
-    with open(report_path, "r", encoding="utf-8") as f:
-        current_section = None
-        for line in f:
-            line = line.strip()
-            if not line:
-                current_section = None
-                continue
-            if line.startswith("/ip firewall address-list"):
-                current_section = "/ip firewall address-list"
-                continue
-            if line.startswith("/ipv6 firewall address-list"):
-                current_section = "/ipv6 firewall address-list"
-                continue
-            if current_section:
-                sections[current_section].append(line)
-
-    return sections
-
-
-def main():
-    """Legacy entry point for applying the latest generated RouterOS report."""
-    # Read the latest scan report
-    scan_report = get_scan_report(REPORT_DIR)
-
-    # Connect to the Mikrotik router
-    firewall = MikrotikFirewall()
-    firewall.connect()
-
-    # read current blocked IPs from the router
-    current_blocked_ipv4 = firewall.get_address_list_ipv4(BLOCKLIST_NAME)
-    current_blocked_ipv6 = firewall.get_address_list_ipv6(BLOCKLIST_NAME)
-
-    # read whitelisted IPs from the router
-    whitelisted_ipv4 = set()
-    whitelisted_ipv6 = set()
-    for wl_name in WHITELIST_NAMES:
-        whitelisted_ipv4.update(firewall.get_address_list_ipv4(wl_name))
-        whitelisted_ipv6.update(firewall.get_address_list_ipv6(wl_name))
-
-    # read blocked IPs from the scan report
-    blocked_ipv4 = set()
-    blocked_ipv6 = set()
-    for line in scan_report["/ip firewall address-list"]:
-        if "list=Blocked" in line:
-            parts = line.split()
-            for part in parts:
-                if part.startswith("address="):
-                    ip = part.split("=")[1]
-                    blocked_ipv4.add(ip)
-    for line in scan_report["/ipv6 firewall address-list"]:
-        if "list=Blocked" in line:
-            parts = line.split()
-            for part in parts:
-                if part.startswith("address="):
-                    ip = part.split("=")[1]
-                    blocked_ipv6.add(ip)
-
-    # Determine which IPs to add and remove
-    to_add_ipv4 = blocked_ipv4 - current_blocked_ipv4 - whitelisted_ipv4
-    to_add_ipv6 = blocked_ipv6 - current_blocked_ipv6 - whitelisted_ipv6
-    to_remove_ipv4 = current_blocked_ipv4 - blocked_ipv4
-    to_remove_ipv6 = current_blocked_ipv6 - blocked_ipv6
-
-    # Remove old blocked IPs
-    for ip in to_remove_ipv4:
-        firewall.execute_command(
-            f"/ip firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
-    for ip in to_remove_ipv6:
-        firewall.execute_command(
-            f"/ipv6 firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
-
-    # Add new blocked IPs
-    firewall.write_address_list_ipv4(BLOCKLIST_NAME, to_add_ipv4)
-    firewall.write_address_list_ipv6(BLOCKLIST_NAME, to_add_ipv6)
-
-    firewall.save_state_report(REPORT_DIR)
-
-    # Disconnect from the router
-    firewall.disconnect()
-
-    # Print summary
-    print(
-        f"Removed {len(to_remove_ipv4)} IPv4 and {len(to_remove_ipv6)} IPv6 addresses from the blocklist.")
-    print(
-        f"Added {len(to_add_ipv4)} IPv4 and {len(to_add_ipv6)} IPv6 addresses to the blocklist.")
-
-
-if __name__ == "__main__":
-    main()
+"""
+firewall.py -
+Module for interacting with the Mikrotik routeros shell to manage firewall rules and IP address lists.
+Provides functions to read the current firewall configuration, add and remove IPs from the blocklist.
+Reads the latest report from the IDS scan, reads the current firewall configuration, and updates the router's blocklist accordingly.
+"""
+
+from __future__ import annotations
+
+import os
+import json
+import paramiko
+from datetime import datetime
+import shlex
+from typing import Iterable
+from .utils.constants import (
+    BLOCKLIST_NAME,
+    MIKROTIK_DATA_DIR,
+    REPORT_DIR,
+    ROUTER_IP,
+    ROUTER_PASSWORD,
+    ROUTER_USER,
+    SSH_PORT,
+    SSH_TIMEOUT,
+    WHITELIST_NAMES,
+)
+from .utils.files import write_lines
+from .utils.ip_utils import is_whitelisted
+from .utils.blocklist_history import compute_changes, cumulative_blocklist
+
+
+class MikrotikFirewall:
+    """
+    Class to manage Mikrotik firewall rules and IP address lists.
+    Provides methods to read the current blocklist, add/remove IPs, and update the blocklist based on IDS scan reports.
+    """
+
+    def __init__(self, router_ip: str = ROUTER_IP, username: str = ROUTER_USER,
+                 password: str = ROUTER_PASSWORD):
+        self.router_ip = router_ip
+        self.username = username
+        self.password = password
+        self.client: paramiko.SSHClient | None = None
+
+    def connect(self) -> None:
+        """Establish an SSH connection to the Mikrotik router."""
+        client = paramiko.SSHClient()
+        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        try:
+            # RouterOS 7.20.x exposes an RSA host key and classic SSH ciphers.
+            client.connect(
+                self.router_ip,
+                port=SSH_PORT,
+                username=self.username,
+                password=self.password,
+                timeout=SSH_TIMEOUT,
+                banner_timeout=SSH_TIMEOUT,
+                auth_timeout=SSH_TIMEOUT,
+                allow_agent=False,
+                look_for_keys=False,
+                compress=False,
+                disabled_algorithms={"pubkeys": ["rsa-sha2-512"]},
+            )
+        except Exception:
+            client.close()
+            raise
+        self.client = client
+
+    def disconnect(self) -> None:
+        """Close the SSH connection."""
+        if self.client:
+            self.client.close()
+            self.client = None
+
+    def execute_command(self, command: str) -> str:
+        """Execute a command on the Mikrotik router via SSH and return the output."""
+        if not self.client:
+            raise RuntimeError("SSH client is not connected.")
+        stdin, stdout, stderr = self.client.exec_command(command)
+        output = stdout.read().decode("utf-8")
+        error = stderr.read().decode("utf-8")
+        if error:
+            raise RuntimeError(f"Error executing command '{command}': {error}")
+        return output
+
+    def get_address_list_ipv4(self, name: str) -> set[str]:
+        """Retrieve the current IPv4 address list from the Mikrotik router."""
+        output = self.execute_command("/ip firewall address-list print")
+        ips = set()
+        for line in output.splitlines():
+            parts = line.split()
+            if len(parts) >= 3 and parts[1] == "list" and parts[2] == name:
+                ip = parts[0]
+                ips.add(ip)
+        return ips
+
+    def get_address_list_ipv6(self, name: str) -> set[str]:
+        """Retrieve the current IPv6 address list from the Mikrotik router."""
+        output = self.execute_command("/ipv6 firewall address-list print")
+        ips = set()
+        for line in output.splitlines():
+            parts = line.split()
+            if len(parts) >= 3 and parts[1] == "list" and parts[2] == name:
+                ip = parts[0]
+                ips.add(ip)
+        return ips
+
+    @staticmethod
+    def _parse_terse_output(output: str) -> list[dict[str, str]]:
+        """Parse RouterOS `print terse` records into key/value dictionaries."""
+        records = []
+        for line in output.splitlines():
+            fields = {}
+            for field in shlex.split(line):
+                key, separator, value = field.partition("=")
+                if separator:
+                    fields[key] = value
+            if fields:
+                records.append(fields)
+        return records
+
+    def get_address_lists(self, ipv6: bool = False) -> list[dict[str, str]]:
+        """Retrieve all address-list entries in structured form."""
+        path = "/ipv6" if ipv6 else "/ip"
+        output = self.execute_command(
+            f"{path} firewall address-list print terse")
+        return self._parse_terse_output(output)
+
+    def get_firewall_rules(self, ipv6: bool = False) -> list[dict[str, str]]:
+        """Retrieve all firewall filter rules in structured form."""
+        path = "/ipv6" if ipv6 else "/ip"
+        output = self.execute_command(
+            f"{path} firewall filter print terse")
+        return self._parse_terse_output(output)
+
+    @staticmethod
+    def _write_json(path: str, obj) -> None:
+        with open(path, "w", encoding="utf-8") as file:
+            json.dump(obj, file, indent=2, sort_keys=True)
+
+    def save_state_report(self, report_dir: str = REPORT_DIR,
+                          changes: dict | None = None) -> str:
+        """Save current address lists and firewall rules for auditing.
+
+        Writes structured snapshots to ``<report_dir>/mikrotik/data/`` and to
+        the common ``data/mikrotik/`` directory (scratch mirror for debugging;
+        **not** a git audit trail), plus a timestamped JSON report under
+        ``<report_dir>/mikrotik/``. The authoritative long-term audit trail is
+        the SQLite ``firewall_snapshots`` tables (see ``app.db``), which are
+        appended here regardless of the file writes.
+        """
+        state = {
+            "router": self.router_ip,
+            "collected_at": datetime.now().astimezone().isoformat(),
+            "address_lists": {
+                "ipv4": self.get_address_lists(),
+                "ipv6": self.get_address_lists(ipv6=True),
+            },
+            "firewall_rules": {
+                "ipv4": self.get_firewall_rules(),
+                "ipv6": self.get_firewall_rules(ipv6=True),
+            },
+        }
+        if changes is not None:
+            state["changes"] = changes
+
+        report_data_dir = os.path.join(report_dir, "mikrotik", "data")
+        os.makedirs(report_data_dir, exist_ok=True)
+        os.makedirs(MIKROTIK_DATA_DIR, exist_ok=True)
+        for version in ("ipv4", "ipv6"):
+            for data_dir in (report_data_dir, MIKROTIK_DATA_DIR):
+                self._write_json(
+                    os.path.join(data_dir, f"address_list_{version}.json"),
+                    state["address_lists"][version])
+                self._write_json(
+                    os.path.join(data_dir, f"firewall_{version}.json"),
+                    state["firewall_rules"][version])
+
+        # Persist a SQLite snapshot (authoritative audit trail, independent of
+        # git). Best-effort: never breaks a router sync if the DB is down.
+        self._persist_snapshot_to_db(state)
+
+        timestamp = datetime.now().strftime("%Y-%m-%d-%H-%M-%S")
+        report_path = os.path.join(report_dir, "mikrotik", f"{timestamp}.json")
+        self._write_json(report_path, state)
+        return report_path
+
+    @staticmethod
+    def _persist_snapshot_to_db(state: dict) -> None:
+        """Write the firewall snapshot into the SQLite store (best-effort)."""
+        try:
+            from .db import get_connection
+            from .db import repositories as repo
+            repo.save_firewall_snapshot(
+                get_connection(),
+                address_lists_v4=state["address_lists"]["ipv4"],
+                address_lists_v6=state["address_lists"]["ipv6"],
+                rules_v4=state["firewall_rules"]["ipv4"],
+                rules_v6=state["firewall_rules"]["ipv6"],
+            )
+        except Exception as exc:
+            print(f"WARN: could not persist firewall snapshot to db ({exc})")
+
+    def sync_blocklist(self, blocked_ipv4: Iterable[str],
+                       blocked_ipv6: Iterable[str],
+                       dry_run: bool = False,
+                       report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
+        """Synchronize the Blocked list cumulatively and audit the result.
+
+        The blocklist is grow-only: targets are added when present in the
+        complete cumulative set (git history of the blocklist files + the
+        current working files + this scan's targets) and never removed
+        automatically. Only router entries absent from the complete set — i.e.
+        never blocked by the system — are pruned. The history now lives in the
+        SQLite blocklist ledger (``app.db`` ``blocklist_entries``); git history
+        remains a read-only fallback. See ``app.blocklist_history``.
+        """
+
+        desired_ipv4 = set(blocked_ipv4)
+        desired_ipv6 = set(blocked_ipv6)
+        current_ipv4 = self.get_address_list_ipv4(BLOCKLIST_NAME)
+        current_ipv6 = self.get_address_list_ipv6(BLOCKLIST_NAME)
+        whitelisted_ipv4 = set()
+        whitelisted_ipv6 = set()
+        for name in WHITELIST_NAMES:
+            whitelisted_ipv4.update(self.get_address_list_ipv4(name))
+            whitelisted_ipv6.update(self.get_address_list_ipv6(name))
+
+        v4_path = os.path.join(
+            report_dir, "app", "data", "blocklist_ipv4.txt")
+        v6_path = os.path.join(
+            report_dir, "app", "data", "blocklist_ipv6.txt")
+        complete_v4, complete_v6 = cumulative_blocklist(
+            v4_path, v6_path, desired_ipv4, desired_ipv6)
+
+        changes = compute_changes(
+            current_ipv4, current_ipv6,
+            complete_v4, complete_v6,
+            whitelisted_ipv4, whitelisted_ipv6)
+        changes["dry_run"] = dry_run
+
+        if not dry_run:
+            for ip in changes["removed_ipv4"]:
+                self.execute_command(
+                    f"/ip firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
+            for ip in changes["removed_ipv6"]:
+                self.execute_command(
+                    f"/ipv6 firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
+            self.write_address_list_ipv4(BLOCKLIST_NAME, changes["added_ipv4"])
+            self.write_address_list_ipv6(BLOCKLIST_NAME, changes["added_ipv6"])
+        self.save_state_report(report_dir, changes)
+        return changes
+
+    def write_address_list_ipv4(self, name: str, ips: Iterable[str]) -> None:
+        """Write a list of IPv4 addresses to the Mikrotik router's address list."""
+        for ip in ips:
+            if is_whitelisted(ip):
+                continue  # Skip whitelisted IPs
+            self.execute_command(
+                f"/ip firewall address-list add list={name} address={ip}")
+
+    def write_address_list_ipv6(self, name: str, ips: Iterable[str]) -> None:
+        """Write a list of IPv6 addresses to the Mikrotik router's address list."""
+        for ip in ips:
+            if is_whitelisted(ip):
+                continue  # Skip whitelisted IPs
+            self.execute_command(
+                f"/ipv6 firewall address-list add list={name} address={ip}")
+
+
+def write_blocklist_files(blocked_ipv4: Iterable[str],
+                          blocked_ipv6: Iterable[str],
+                          report_dir: str = REPORT_DIR) -> tuple[str, str]:
+    """Write the final consolidated blocklist to ``<report_dir>/app/data/``.
+
+    Returns the paths of the IPv4 and IPv6 blocklist files
+    (``blocklist_ipv4.txt`` / ``blocklist_ipv6.txt``).
+    """
+    data_dir = os.path.join(report_dir, "app", "data")
+    os.makedirs(data_dir, exist_ok=True)
+    v4_path = os.path.join(data_dir, "blocklist_ipv4.txt")
+    v6_path = os.path.join(data_dir, "blocklist_ipv6.txt")
+    write_lines(v4_path, sorted(blocked_ipv4))
+    write_lines(v6_path, sorted(blocked_ipv6))
+    return v4_path, v6_path
+
+
+def get_scan_report(report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
+    """Read the latest scan report `mikrotik-block.rsc` from the report directory and return the list of blocked IPs."""
+    report_path = os.path.join(report_dir, "mikrotik-block.rsc")
+    if not os.path.exists(report_path):
+        raise FileNotFoundError(f"Scan report not found: {report_path}")
+
+    # add sections, they start with `/ip firewall address-list` or `/ipv6 firewall address-list` and end with a blank line or EOF
+    sections = {
+        "/ip firewall address-list": [],
+        "/ipv6 firewall address-list": [],
+    }
+    # add list=Cloudflare or list=Init7 to whitelist sections, list=Blocked to blocked section
+    with open(report_path, "r", encoding="utf-8") as f:
+        current_section = None
+        for line in f:
+            line = line.strip()
+            if not line:
+                current_section = None
+                continue
+            if line.startswith("/ip firewall address-list"):
+                current_section = "/ip firewall address-list"
+                continue
+            if line.startswith("/ipv6 firewall address-list"):
+                current_section = "/ipv6 firewall address-list"
+                continue
+            if current_section:
+                sections[current_section].append(line)
+
+    return sections
+
+
+def main():
+    """Legacy entry point for applying the latest generated RouterOS report."""
+    # Read the latest scan report
+    scan_report = get_scan_report(REPORT_DIR)
+
+    # Connect to the Mikrotik router
+    firewall = MikrotikFirewall()
+    firewall.connect()
+
+    # read current blocked IPs from the router
+    current_blocked_ipv4 = firewall.get_address_list_ipv4(BLOCKLIST_NAME)
+    current_blocked_ipv6 = firewall.get_address_list_ipv6(BLOCKLIST_NAME)
+
+    # read whitelisted IPs from the router
+    whitelisted_ipv4 = set()
+    whitelisted_ipv6 = set()
+    for wl_name in WHITELIST_NAMES:
+        whitelisted_ipv4.update(firewall.get_address_list_ipv4(wl_name))
+        whitelisted_ipv6.update(firewall.get_address_list_ipv6(wl_name))
+
+    # read blocked IPs from the scan report
+    blocked_ipv4 = set()
+    blocked_ipv6 = set()
+    for line in scan_report["/ip firewall address-list"]:
+        if "list=Blocked" in line:
+            parts = line.split()
+            for part in parts:
+                if part.startswith("address="):
+                    ip = part.split("=")[1]
+                    blocked_ipv4.add(ip)
+    for line in scan_report["/ipv6 firewall address-list"]:
+        if "list=Blocked" in line:
+            parts = line.split()
+            for part in parts:
+                if part.startswith("address="):
+                    ip = part.split("=")[1]
+                    blocked_ipv6.add(ip)
+
+    # Determine which IPs to add and remove
+    to_add_ipv4 = blocked_ipv4 - current_blocked_ipv4 - whitelisted_ipv4
+    to_add_ipv6 = blocked_ipv6 - current_blocked_ipv6 - whitelisted_ipv6
+    to_remove_ipv4 = current_blocked_ipv4 - blocked_ipv4
+    to_remove_ipv6 = current_blocked_ipv6 - blocked_ipv6
+
+    # Remove old blocked IPs
+    for ip in to_remove_ipv4:
+        firewall.execute_command(
+            f"/ip firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
+    for ip in to_remove_ipv6:
+        firewall.execute_command(
+            f"/ipv6 firewall address-list remove [find list={BLOCKLIST_NAME} address={ip}]")
+
+    # Add new blocked IPs
+    firewall.write_address_list_ipv4(BLOCKLIST_NAME, to_add_ipv4)
+    firewall.write_address_list_ipv6(BLOCKLIST_NAME, to_add_ipv6)
+
+    firewall.save_state_report(REPORT_DIR)
+
+    # Disconnect from the router
+    firewall.disconnect()
+
+    # Print summary
+    print(
+        f"Removed {len(to_remove_ipv4)} IPv4 and {len(to_remove_ipv6)} IPv6 addresses from the blocklist.")
+    print(
+        f"Added {len(to_add_ipv4)} IPv4 and {len(to_add_ipv6)} IPv6 addresses to the blocklist.")
+
+
+if __name__ == "__main__":
+    main()

app/flags.py

@@ -1,47 +1,47 @@
-#!/usr/bin/env python3
-"""Flagging rules for the intrusion-detection system.
-
-Detection functions that identify hostile IPs based on aggregated stats.
-"""
-
-from __future__ import annotations
-
-from . import bad_patterns
-from .utils.constants import DEFAULT_ERROR_RATIO, DEFAULT_MIN_DENIED, DEFAULT_MIN_ERRORS
-from .utils.models import IPStats
-
-
-def flag_scanners(stats: dict[str, IPStats], min_errors: int = DEFAULT_MIN_ERRORS,
-                  min_ratio: float = DEFAULT_ERROR_RATIO) -> dict[str, IPStats]:
-    """IPs with many errors AND a high error ratio."""
-    return {
-        ip: s for ip, s in stats.items()
-        if s.errors >= min_errors and s.error_ratio >= min_ratio
-    }
-
-
-def flag_denied_only(stats: dict[str, IPStats],
-                     min_denied: int = DEFAULT_MIN_DENIED) -> dict[str, IPStats]:
-    """IPs that only ever hit denied paths and never authenticated."""
-    return {
-        ip: s for ip, s in stats.items()
-        if s.denied >= min_denied and not s.authenticated
-    }
-
-
-def flag_malicious_patterns(stats: dict[str, IPStats],
-                            min_severity: int = 2,
-                            min_hits: int = 1) -> dict[str, IPStats]:
-    """IPs with hits against malicious path patterns at or above severity threshold."""
-    return {
-        ip: s for ip, s in stats.items()
-        if s.malicious_hits >= min_hits and any(
-            bad_patterns.PATTERNS_BY_NAME[name].severity >= min_severity
-            for name in s.malicious_patterns
-        )
-    }
-
-
-def by_total(stats: dict[str, IPStats]) -> list[IPStats]:
-    """Stats sorted by request count, descending."""
-    return sorted(stats.values(), key=lambda s: (-s.total, s.ip))
+#!/usr/bin/env python3
+"""Flagging rules for the intrusion-detection system.
+
+Detection functions that identify hostile IPs based on aggregated stats.
+"""
+
+from __future__ import annotations
+
+from . import bad_patterns
+from .utils.constants import DEFAULT_ERROR_RATIO, DEFAULT_MIN_DENIED, DEFAULT_MIN_ERRORS
+from .utils.models import IPStats
+
+
+def flag_scanners(stats: dict[str, IPStats], min_errors: int = DEFAULT_MIN_ERRORS,
+                  min_ratio: float = DEFAULT_ERROR_RATIO) -> dict[str, IPStats]:
+    """IPs with many errors AND a high error ratio."""
+    return {
+        ip: s for ip, s in stats.items()
+        if s.errors >= min_errors and s.error_ratio >= min_ratio
+    }
+
+
+def flag_denied_only(stats: dict[str, IPStats],
+                     min_denied: int = DEFAULT_MIN_DENIED) -> dict[str, IPStats]:
+    """IPs that only ever hit denied paths and never authenticated."""
+    return {
+        ip: s for ip, s in stats.items()
+        if s.denied >= min_denied and not s.authenticated
+    }
+
+
+def flag_malicious_patterns(stats: dict[str, IPStats],
+                            min_severity: int = 2,
+                            min_hits: int = 1) -> dict[str, IPStats]:
+    """IPs with hits against malicious path patterns at or above severity threshold."""
+    return {
+        ip: s for ip, s in stats.items()
+        if s.malicious_hits >= min_hits and any(
+            bad_patterns.PATTERNS_BY_NAME[name].severity >= min_severity
+            for name in s.malicious_patterns
+        )
+    }
+
+
+def by_total(stats: dict[str, IPStats]) -> list[IPStats]:
+    """Stats sorted by request count, descending."""
+    return sorted(stats.values(), key=lambda s: (-s.total, s.ip))

app/mikrotik.py

@@ -1,111 +1,111 @@
-#!/usr/bin/env python3
-"""MikroTik RouterOS script generation."""
-
-from __future__ import annotations
-
-import ipaddress
-from datetime import datetime
-from typing import Iterable
-
-from .utils.ip_utils import is_ipv4, is_ipv6, is_whitelisted, parse_ip
-from .utils.whitelists import WHITELISTS
-from .utils.constants import BLOCKLIST_NAME
-
-
-def split_cidr_versions(targets: Iterable[str]) -> tuple[list[str], list[str]]:
-    """Split target CIDRs/IPs into (sorted IPv4 list, sorted IPv6 list)."""
-    v4 = []
-    v6 = []
-    for t in targets:
-        ip = t.split("/")[0]
-        if is_ipv4(ip):
-            v4.append(t)
-        elif is_ipv6(ip):
-            v6.append(t)
-
-    def key_cidr(cidr: str):
-        ip = cidr.split("/")[0]
-        addr = parse_ip(ip)
-        if addr is None:
-            return (9, b"", cidr)
-        return (addr.version, addr.packed, cidr)
-
-    return sorted(v4, key=key_cidr), sorted(v6, key=key_cidr)
-
-
-def mikrotik_script(tag: str, blocked_ips_or_subnets: Iterable[str],
-                    whitelists: dict[str, list[str]] | None = None,
-                    generated: str | None = None) -> tuple[str, int, int]:
-    """Build a RouterOS .rsc script.
-
-    Whitelisted ranges become `accept` rules placed above the `drop` rules.
-    Blocked targets can be individual IPs (e.g. 1.2.3.4/32) or CIDR blocks
-    (e.g. 1.2.3.0/24).
-
-    Returns (script_text, blocked_count, whitelisted_cidr_count).
-    """
-    whitelists = WHITELISTS if whitelists is None else whitelists
-    generated = generated or datetime.now().isoformat(timespec="seconds")
-
-    def clean_blocked(targets: Iterable[str]) -> list[str]:
-        cleaned = []
-        for t in targets:
-            ip = t.split("/")[0]
-            if not is_whitelisted(ip):
-                cleaned.append(t)
-        return cleaned
-
-    blocked = clean_blocked(set(blocked_ips_or_subnets))
-    block_v4, block_v6 = split_cidr_versions(blocked)
-
-    lines: list[str] = [f"# {tag} firewall export - generated {generated}", ""]
-    wl_count = 0
-
-    for name, cidrs in whitelists.items():
-        nets = [ipaddress.ip_network(c) for c in cidrs]
-        wl_count += len(nets)
-        for version, cmd in ((4, "/ip firewall address-list"),
-                             (6, "/ipv6 firewall address-list")):
-            chunk = [n for n in nets if n.version == version]
-            if not chunk:
-                continue
-            lines.append(f"# {name} IPv{version} ranges (whitelisted)")
-            lines.append(cmd)
-            lines += [f"add list={name} address={n}" for n in chunk]
-            lines.append("")
-
-    if block_v4:
-        lines.append(f"# Blocked IPv4 ({len(block_v4)}, non-whitelisted)")
-        lines.append("/ip firewall address-list")
-        lines += [f"add list={BLOCKLIST_NAME} address={t}" for t in block_v4]
-        lines.append("")
-    if block_v6:
-        lines.append(f"# Blocked IPv6 ({len(block_v6)}, non-whitelisted)")
-        lines.append("/ipv6 firewall address-list")
-        lines += [f"add list={BLOCKLIST_NAME} address={t}" for t in block_v6]
-        lines.append("")
-
-    for version, cmd, blocks in ((4, "/ip firewall filter", block_v4),
-                                 (6, "/ipv6 firewall filter", block_v6)):
-        lines.append(cmd)
-        for name in whitelists:
-            lines.append(
-                f"add chain=input action=accept src-address-list={name} "
-                f'comment="{tag} {name.lower()} whitelist (v{version})"')
-        if blocks:
-            for chain in ("input", "forward"):
-                lines.append(
-                    f"add chain={chain} action=drop src-address-list={BLOCKLIST_NAME} "
-                    f'comment="{tag} blocked (v{version})"')
-        lines.append("")
-
-    return "\n".join(lines), len(blocked), wl_count
-
-
-def write_mikrotik(path: str, tag: str,
-                   blocked_ips_or_subnets: Iterable[str]) -> tuple[str, int, int]:
-    text, n_blocked, n_whitelisted = mikrotik_script(
-        tag, blocked_ips_or_subnets)
-    with open(path, "w", encoding="utf-8") as f:
-        f.write(text)
-    return path, n_blocked, n_whitelisted
+#!/usr/bin/env python3
+"""MikroTik RouterOS script generation."""
+
+from __future__ import annotations
+
+import ipaddress
+from datetime import datetime
+from typing import Iterable
+
+from .utils.ip_utils import is_ipv4, is_ipv6, is_whitelisted, parse_ip
+from .utils.whitelists import WHITELISTS
+from .utils.constants import BLOCKLIST_NAME
+
+
+def split_cidr_versions(targets: Iterable[str]) -> tuple[list[str], list[str]]:
+    """Split target CIDRs/IPs into (sorted IPv4 list, sorted IPv6 list)."""
+    v4 = []
+    v6 = []
+    for t in targets:
+        ip = t.split("/")[0]
+        if is_ipv4(ip):
+            v4.append(t)
+        elif is_ipv6(ip):
+            v6.append(t)
+
+    def key_cidr(cidr: str):
+        ip = cidr.split("/")[0]
+        addr = parse_ip(ip)
+        if addr is None:
+            return (9, b"", cidr)
+        return (addr.version, addr.packed, cidr)
+
+    return sorted(v4, key=key_cidr), sorted(v6, key=key_cidr)
+
+
+def mikrotik_script(tag: str, blocked_ips_or_subnets: Iterable[str],
+                    whitelists: dict[str, list[str]] | None = None,
+                    generated: str | None = None) -> tuple[str, int, int]:
+    """Build a RouterOS .rsc script.
+
+    Whitelisted ranges become `accept` rules placed above the `drop` rules.
+    Blocked targets can be individual IPs (e.g. 1.2.3.4/32) or CIDR blocks
+    (e.g. 1.2.3.0/24).
+
+    Returns (script_text, blocked_count, whitelisted_cidr_count).
+    """
+    whitelists = WHITELISTS if whitelists is None else whitelists
+    generated = generated or datetime.now().isoformat(timespec="seconds")
+
+    def clean_blocked(targets: Iterable[str]) -> list[str]:
+        cleaned = []
+        for t in targets:
+            ip = t.split("/")[0]
+            if not is_whitelisted(ip):
+                cleaned.append(t)
+        return cleaned
+
+    blocked = clean_blocked(set(blocked_ips_or_subnets))
+    block_v4, block_v6 = split_cidr_versions(blocked)
+
+    lines: list[str] = [f"# {tag} firewall export - generated {generated}", ""]
+    wl_count = 0
+
+    for name, cidrs in whitelists.items():
+        nets = [ipaddress.ip_network(c) for c in cidrs]
+        wl_count += len(nets)
+        for version, cmd in ((4, "/ip firewall address-list"),
+                             (6, "/ipv6 firewall address-list")):
+            chunk = [n for n in nets if n.version == version]
+            if not chunk:
+                continue
+            lines.append(f"# {name} IPv{version} ranges (whitelisted)")
+            lines.append(cmd)
+            lines += [f"add list={name} address={n}" for n in chunk]
+            lines.append("")
+
+    if block_v4:
+        lines.append(f"# Blocked IPv4 ({len(block_v4)}, non-whitelisted)")
+        lines.append("/ip firewall address-list")
+        lines += [f"add list={BLOCKLIST_NAME} address={t}" for t in block_v4]
+        lines.append("")
+    if block_v6:
+        lines.append(f"# Blocked IPv6 ({len(block_v6)}, non-whitelisted)")
+        lines.append("/ipv6 firewall address-list")
+        lines += [f"add list={BLOCKLIST_NAME} address={t}" for t in block_v6]
+        lines.append("")
+
+    for version, cmd, blocks in ((4, "/ip firewall filter", block_v4),
+                                 (6, "/ipv6 firewall filter", block_v6)):
+        lines.append(cmd)
+        for name in whitelists:
+            lines.append(
+                f"add chain=input action=accept src-address-list={name} "
+                f'comment="{tag} {name.lower()} whitelist (v{version})"')
+        if blocks:
+            for chain in ("input", "forward"):
+                lines.append(
+                    f"add chain={chain} action=drop src-address-list={BLOCKLIST_NAME} "
+                    f'comment="{tag} blocked (v{version})"')
+        lines.append("")
+
+    return "\n".join(lines), len(blocked), wl_count
+
+
+def write_mikrotik(path: str, tag: str,
+                   blocked_ips_or_subnets: Iterable[str]) -> tuple[str, int, int]:
+    text, n_blocked, n_whitelisted = mikrotik_script(
+        tag, blocked_ips_or_subnets)
+    with open(path, "w", encoding="utf-8") as f:
+        f.write(text)
+    return path, n_blocked, n_whitelisted

app/npm.py

@@ -1,170 +1,170 @@
-#!/usr/bin/env python3
-"""Nginx Proxy Manager access-log analyzer.
-
-Parses NPM proxy access logs (plain + gzipped), aggregates per-IP
-behaviour and flags scanner IPs: clients with many error responses and a
-high error ratio. Flagged IPs become the MikroTik block list.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-from collections import Counter
-
-from .analyzer import Analyzer
-from .utils.constants import (
-    DEFAULT_ERROR_RATIO,
-    DEFAULT_MIN_ERRORS,
-    NPM_LOG_PATH,
-    NPM_REPORT_DIR,
-)
-from .utils.files import write_csv
-from .flags import flag_scanners
-from .utils.models import Request
-from .utils.utils import arg_parser
-
-# [02/Aug/2026:05:01:31 +0200] - 401 401 - GET https host "/path"
-# [Client IP] [Length N] [Gzip X] [Sent-to IP] "UA" "Referer"
-LINE_RE = re.compile(
-    r"^\[(\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}\s+[+-]\d{4})\]\s+"  # [datetime]
-    r"-\s+"
-    r"(\d+|-)\s+"                                                  # upstream
-    r"(\d+)\s+"                                                    # status
-    r"-\s+"
-    r"(\S+)\s+"                                                    # method
-    r"(\S+)\s+"                                                    # scheme
-    r"(\S+)\s+"                                                    # host
-    r'"([^"]*)"\s+'                                                # "path"
-    r"\[Client\s+(\S+)\]\s+"
-    r"\[Length\s+(\d+|-)\]\s+"
-    r"\[Gzip\s+(\S+)\]\s+"
-    r"\[Sent-to\s+(\S+)\]\s+"
-    r'"([^"]*)"\s+'                                                # "UA"
-    r'"([^"]*)"'                                                   # "Referer"
-)
-
-
-class NpmAnalyzer(Analyzer):
-    name = "npm"
-    title = "Nginx Proxy Manager log analysis report"
-    log_suffixes = (".log", ".gz")
-    exclude_prefixes = ("letsencrypt",)
-    paths_file = "error_paths.csv"
-    paths_label = "error paths"
-    flag_files = ("scanner_ips.txt", "scanner_ipv6.txt")
-    flag_label = "Scanner IPs"
-    flag_note = "high error rate -- probable scanners/attackers"
-
-    ip_columns = (
-        ("ip", lambda s: s.ip),
-        ("total", lambda s: s.total),
-        ("4xx", lambda s: s.c4xx),
-        ("5xx", lambda s: s.c5xx),
-        ("ratio", lambda s: s.error_ratio),
-        ("first", lambda s: s.first),
-        ("last", lambda s: s.last),
-        ("methods", lambda s: s.methods_str),
-        ("whitelist", lambda s: s.whitelist),
-    )
-
-    request_columns = (
-        ("datetime", lambda r: r.ts),
-        ("ip", lambda r: r.ip),
-        ("method", lambda r: r.method),
-        ("scheme", lambda r: r.extra.get("scheme")),
-        ("host", lambda r: r.host),
-        ("path", lambda r: r.path),
-        ("status", lambda r: r.status),
-        ("upstream_status", lambda r: r.upstream_status),
-        ("length", lambda r: r.extra.get("length")),
-        ("gzip", lambda r: r.extra.get("gzip")),
-        ("sent_to", lambda r: r.extra.get("sent_to")),
-        ("referer", lambda r: r.referer),
-        ("ua", lambda r: r.ua),
-    )
-
-    def __init__(self, *args, min_errors: int = DEFAULT_MIN_ERRORS,
-                 error_ratio: float = DEFAULT_ERROR_RATIO, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.min_errors = min_errors
-        self.min_ratio = error_ratio
-
-    # --- parsing -----------------------------------------------------------
-
-    def parse_line(self, line: str) -> Request | None:
-        if not line:
-            return None
-        m = LINE_RE.match(line)
-        if not m:
-            return None
-        (ts, upstream, status, method, scheme, host, path, ip,
-         length, gz, sent_to, ua, referer) = m.groups()
-        return Request(
-            ts=ts,
-            ip=ip,
-            method=method,
-            path=path,
-            status=int(status),
-            upstream_status=int(upstream) if upstream.isdigit() else None,
-            host=host,
-            ua=ua,
-            referer=referer,
-            extra={"scheme": scheme, "length": length,
-                   "gzip": gz, "sent_to": sent_to},
-        )
-
-    # --- flagging ----------------------------------------------------------
-
-    def flag(self, stats):
-        return flag_scanners(stats, min_errors=self.min_errors,
-                             min_ratio=self.min_ratio)
-
-    # --- extras ------------------------------------------------------------
-
-    def extra_summary_rows(self):
-        c4 = sum(1 for r in self.requests if r.is_client_error)
-        c5 = sum(1 for r in self.requests if r.is_server_error)
-        return [
-            ("4xx / 5xx", f"{c4} / {c5}"),
-            ("hosts seen", len({r.host for r in self.requests if r.host})),
-            ("scanner threshold",
-             f">= {self.min_errors} errors and ratio >= {self.min_ratio}"),
-        ]
-
-    def write_extra(self, data_dir: str) -> list[str]:
-        uas = Counter(r.ua for r in self.requests if r.ua and r.ua != "-")
-        hosts = Counter(r.host for r in self.requests if r.host)
-        return [
-            write_csv(os.path.join(data_dir, "ua_summary.csv"),
-                      ["user_agent", "count"], uas.most_common()),
-            write_csv(os.path.join(data_dir, "host_summary.csv"),
-                      ["host", "count"], hosts.most_common()),
-        ]
-
-
-def main() -> None:
-    parser = arg_parser(
-        "analyze NPM proxy logs, flag scanner IPs, export MikroTik rules",
-        NPM_LOG_PATH, NPM_REPORT_DIR)
-    parser.add_argument("--min-errors", type=int, default=DEFAULT_MIN_ERRORS,
-                        help=f"minimum error responses to flag (default: {DEFAULT_MIN_ERRORS})")
-    parser.add_argument("--error-ratio", type=float, default=DEFAULT_ERROR_RATIO,
-                        help=f"minimum error ratio to flag (default: {DEFAULT_ERROR_RATIO})")
-    parser.add_argument("--full", action="store_true",
-                        help="rescan all logs from the start (ignore incremental state)")
-    args = parser.parse_args()
-
-    NpmAnalyzer(
-        log_path=args.log_path,
-        report_dir=args.report_dir,
-        top=args.top,
-        quiet=args.quiet,
-        full=args.full,
-        min_errors=args.min_errors,
-        error_ratio=args.error_ratio,
-    ).run()
-
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""Nginx Proxy Manager access-log analyzer.
+
+Parses NPM proxy access logs (plain + gzipped), aggregates per-IP
+behaviour and flags scanner IPs: clients with many error responses and a
+high error ratio. Flagged IPs become the MikroTik block list.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from collections import Counter
+
+from .analyzer import Analyzer
+from .utils.constants import (
+    DEFAULT_ERROR_RATIO,
+    DEFAULT_MIN_ERRORS,
+    NPM_LOG_PATH,
+    NPM_REPORT_DIR,
+)
+from .utils.files import write_csv
+from .flags import flag_scanners
+from .utils.models import Request
+from .utils.utils import arg_parser
+
+# [02/Aug/2026:05:01:31 +0200] - 401 401 - GET https host "/path"
+# [Client IP] [Length N] [Gzip X] [Sent-to IP] "UA" "Referer"
+LINE_RE = re.compile(
+    r"^\[(\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}\s+[+-]\d{4})\]\s+"  # [datetime]
+    r"-\s+"
+    r"(\d+|-)\s+"                                                  # upstream
+    r"(\d+)\s+"                                                    # status
+    r"-\s+"
+    r"(\S+)\s+"                                                    # method
+    r"(\S+)\s+"                                                    # scheme
+    r"(\S+)\s+"                                                    # host
+    r'"([^"]*)"\s+'                                                # "path"
+    r"\[Client\s+(\S+)\]\s+"
+    r"\[Length\s+(\d+|-)\]\s+"
+    r"\[Gzip\s+(\S+)\]\s+"
+    r"\[Sent-to\s+(\S+)\]\s+"
+    r'"([^"]*)"\s+'                                                # "UA"
+    r'"([^"]*)"'                                                   # "Referer"
+)
+
+
+class NpmAnalyzer(Analyzer):
+    name = "npm"
+    title = "Nginx Proxy Manager log analysis report"
+    log_suffixes = (".log", ".gz")
+    exclude_prefixes = ("letsencrypt",)
+    paths_file = "error_paths.csv"
+    paths_label = "error paths"
+    flag_files = ("scanner_ips.txt", "scanner_ipv6.txt")
+    flag_label = "Scanner IPs"
+    flag_note = "high error rate -- probable scanners/attackers"
+
+    ip_columns = (
+        ("ip", lambda s: s.ip),
+        ("total", lambda s: s.total),
+        ("4xx", lambda s: s.c4xx),
+        ("5xx", lambda s: s.c5xx),
+        ("ratio", lambda s: s.error_ratio),
+        ("first", lambda s: s.first),
+        ("last", lambda s: s.last),
+        ("methods", lambda s: s.methods_str),
+        ("whitelist", lambda s: s.whitelist),
+    )
+
+    request_columns = (
+        ("datetime", lambda r: r.ts),
+        ("ip", lambda r: r.ip),
+        ("method", lambda r: r.method),
+        ("scheme", lambda r: r.extra.get("scheme")),
+        ("host", lambda r: r.host),
+        ("path", lambda r: r.path),
+        ("status", lambda r: r.status),
+        ("upstream_status", lambda r: r.upstream_status),
+        ("length", lambda r: r.extra.get("length")),
+        ("gzip", lambda r: r.extra.get("gzip")),
+        ("sent_to", lambda r: r.extra.get("sent_to")),
+        ("referer", lambda r: r.referer),
+        ("ua", lambda r: r.ua),
+    )
+
+    def __init__(self, *args, min_errors: int = DEFAULT_MIN_ERRORS,
+                 error_ratio: float = DEFAULT_ERROR_RATIO, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.min_errors = min_errors
+        self.min_ratio = error_ratio
+
+    # --- parsing -----------------------------------------------------------
+
+    def parse_line(self, line: str) -> Request | None:
+        if not line:
+            return None
+        m = LINE_RE.match(line)
+        if not m:
+            return None
+        (ts, upstream, status, method, scheme, host, path, ip,
+         length, gz, sent_to, ua, referer) = m.groups()
+        return Request(
+            ts=ts,
+            ip=ip,
+            method=method,
+            path=path,
+            status=int(status),
+            upstream_status=int(upstream) if upstream.isdigit() else None,
+            host=host,
+            ua=ua,
+            referer=referer,
+            extra={"scheme": scheme, "length": length,
+                   "gzip": gz, "sent_to": sent_to},
+        )
+
+    # --- flagging ----------------------------------------------------------
+
+    def flag(self, stats):
+        return flag_scanners(stats, min_errors=self.min_errors,
+                             min_ratio=self.min_ratio)
+
+    # --- extras ------------------------------------------------------------
+
+    def extra_summary_rows(self):
+        c4 = sum(1 for r in self.requests if r.is_client_error)
+        c5 = sum(1 for r in self.requests if r.is_server_error)
+        return [
+            ("4xx / 5xx", f"{c4} / {c5}"),
+            ("hosts seen", len({r.host for r in self.requests if r.host})),
+            ("scanner threshold",
+             f">= {self.min_errors} errors and ratio >= {self.min_ratio}"),
+        ]
+
+    def write_extra(self, data_dir: str) -> list[str]:
+        uas = Counter(r.ua for r in self.requests if r.ua and r.ua != "-")
+        hosts = Counter(r.host for r in self.requests if r.host)
+        return [
+            write_csv(os.path.join(data_dir, "ua_summary.csv"),
+                      ["user_agent", "count"], uas.most_common()),
+            write_csv(os.path.join(data_dir, "host_summary.csv"),
+                      ["host", "count"], hosts.most_common()),
+        ]
+
+
+def main() -> None:
+    parser = arg_parser(
+        "analyze NPM proxy logs, flag scanner IPs, export MikroTik rules",
+        NPM_LOG_PATH, NPM_REPORT_DIR)
+    parser.add_argument("--min-errors", type=int, default=DEFAULT_MIN_ERRORS,
+                        help=f"minimum error responses to flag (default: {DEFAULT_MIN_ERRORS})")
+    parser.add_argument("--error-ratio", type=float, default=DEFAULT_ERROR_RATIO,
+                        help=f"minimum error ratio to flag (default: {DEFAULT_ERROR_RATIO})")
+    parser.add_argument("--full", action="store_true",
+                        help="rescan all logs from the start (ignore incremental state)")
+    args = parser.parse_args()
+
+    NpmAnalyzer(
+        log_path=args.log_path,
+        report_dir=args.report_dir,
+        top=args.top,
+        quiet=args.quiet,
+        full=args.full,
+        min_errors=args.min_errors,
+        error_ratio=args.error_ratio,
+    ).run()
+
+
+if __name__ == "__main__":
+    main()

app/reports/app/data/blocklist_ipv4.txt

@@ -1,529 +0,0 @@
-102.37.110.74/32
-103.153.183.126/32
-103.168.66.237/32
-103.177.150.66/32
-103.215.75.19/32
-103.215.75.66/32
-103.221.220.62/32
-103.76.88.36/32
-103.76.88.37/32
-103.86.108.230/32
-104.168.93.75/32
-104.196.62.35/32
-104.199.182.104/32
-104.208.119.209/32
-104.208.94.19/32
-104.234.19.67/32
-104.234.53.122/32
-104.234.53.134/32
-104.238.222.26/32
-104.248.5.228/32
-104.251.181.106/32
-104.28.215.219/32
-104.28.215.220/32
-104.28.222.131/32
-104.28.240.0/24
-104.28.247.219/32
-104.28.247.220/32
-104.28.254.131/32
-104.28.254.134/32
-106.63.0.0/17
-107.170.9.103/32
-107.173.254.55/32
-108.130.204.104/32
-110.176.0.0/13
-111.113.89.107/32
-112.94.252.15/32
-113.57.186.101/32
-117.14.153.168/32
-118.194.253.208/32
-118.212.120.78/32
-118.81.196.142/32
-118.81.207.202/32
-123.158.61.179/32
-123.160.175.254/32
-123.178.210.228/32
-124.117.194.69/32
-124.88.113.10/32
-128.199.182.152/32
-128.199.182.55/32
-128.90.128.13/32
-128.90.141.10/32
-129.212.237.196/32
-13.126.86.18/32
-13.221.106.198/32
-13.57.15.41/32
-13.83.161.80/32
-130.12.180.126/32
-130.12.180.39/32
-130.12.182.12/32
-130.12.182.254/32
-130.131.231.171/32
-132.196.11.13/32
-132.196.83.33/32
-134.122.94.138/32
-134.199.148.147/32
-134.199.149.209/32
-134.209.162.128/32
-134.209.185.72/32
-135.119.63.61/32
-135.119.74.228/32
-135.225.93.215/32
-135.232.177.160/32
-136.107.208.33/32
-136.107.61.46/32
-136.108.11.195/32
-136.109.135.10/32
-136.109.87.37/32
-136.110.80.8/32
-136.115.17.125/32
-136.117.218.95/32
-136.144.19.51/32
-136.144.33.102/32
-136.144.35.201/32
-136.144.43.127/32
-136.64.51.224/32
-136.66.128.85/32
-136.66.153.34/32
-136.70.149.147/32
-138.124.103.234/32
-138.197.104.211/32
-138.197.191.87/32
-138.197.34.12/32
-139.28.219.68/32
-139.28.219.70/32
-139.59.118.17/32
-139.59.231.238/32
-142.111.152.16/32
-142.111.152.57/32
-142.93.155.36/32
-142.93.62.168/32
-143.110.178.165/32
-143.110.217.244/32
-143.198.25.99/32
-143.198.6.225/32
-143.20.64.236/32
-143.244.168.161/32
-143.244.56.0/23
-143.244.57.123/32
-144.126.207.57/32
-144.172.101.168/32
-144.172.114.107/32
-144.172.93.117/32
-144.172.97.164/32
-144.76.19.27/32
-145.132.103.19/32
-146.190.63.248/32
-146.190.63.48/32
-146.190.83.166/32
-146.70.194.0/24
-146.70.40.68/32
-147.182.149.75/32
-147.93.168.91/32
-147.93.169.103/32
-147.93.171.188/32
-148.251.182.79/32
-149.56.150.98/32
-150.255.94.250/32
-152.39.198.115/32
-152.42.137.175/32
-152.53.242.93/32
-155.2.215.98/32
-157.143.3.35/32
-157.245.105.107/32
-157.245.113.227/32
-157.245.197.36/32
-157.245.204.205/32
-157.245.63.62/32
-158.101.144.198/32
-158.158.0.0/16
-159.203.13.62/32
-159.223.132.86/32
-159.65.144.72/32
-159.89.117.109/32
-159.89.12.166/32
-159.89.123.252/32
-159.89.174.87/32
-159.89.46.165/32
-159.89.97.19/32
-16.146.99.254/32
-160.179.166.222/32
-161.118.192.206/32
-161.118.251.181/32
-162.141.167.14/32
-162.243.79.174/32
-163.7.11.71/32
-163.7.13.115/32
-163.7.13.205/32
-164.90.169.163/32
-165.22.147.152/32
-165.22.24.78/32
-165.245.185.158/32
-165.245.190.205/32
-167.172.192.26/32
-167.172.31.131/32
-167.172.53.28/32
-167.71.0.47/32
-167.71.39.61/32
-167.86.82.167/32
-167.99.181.249/32
-167.99.182.39/32
-167.99.210.137/32
-168.144.100.227/32
-168.144.106.212/32
-168.144.167.238/32
-168.144.174.42/32
-168.144.83.150/32
-168.62.180.116/32
-169.58.42.242/32
-170.64.144.116/32
-171.104.81.195/32
-172.160.0.0/11
-172.196.32.64/32
-172.200.0.0/13
-172.208.0.0/13
-172.213.216.126/32
-172.232.175.132/32
-172.245.102.64/32
-172.86.122.106/32
-172.98.33.251/32
-173.239.240.222/32
-173.249.34.197/32
-176.227.240.17/32
-176.227.240.61/32
-176.65.132.38/32
-178.128.176.132/32
-178.16.54.137/32
-178.62.196.238/32
-179.43.134.114/32
-18.142.90.109/32
-18.191.56.164/32
-18.227.73.7/32
-18.236.136.230/32
-180.95.231.78/32
-185.151.21.124/32
-185.177.72.0/24
-185.177.72.29/32
-185.192.71.0/24
-185.223.152.0/24
-185.238.231.167/32
-185.251.19.30/32
-185.34.70.228/32
-185.93.89.147/32
-185.93.89.167/32
-188.166.245.173/32
-188.213.202.0/24
-190.2.142.78/32
-191.232.0.0/13
-191.96.11.173/32
-192.133.76.0/23
-192.133.77.15/32
-192.253.248.142/32
-192.253.248.7/32
-192.34.61.236/32
-193.143.1.112/32
-193.148.56.148/32
-193.148.57.33/32
-193.149.176.55/32
-193.19.109.0/24
-193.31.28.80/32
-193.36.225.0/24
-193.37.32.0/24
-193.37.33.0/24
-193.47.62.167/32
-193.47.62.168/32
-194.156.79.68/32
-194.233.91.21/32
-194.26.192.156/32
-194.32.120.151/32
-194.5.82.0/24
-195.178.110.0/24
-195.178.110.211/32
-195.178.110.223/32
-198.98.52.229/32
-199.16.157.0/24
-2.57.122.173/32
-2.58.56.101/32
-20.0.0.0/11
-20.150.0.0/15
-20.160.0.0/12
-20.184.150.240/32
-20.192.0.0/10
-20.215.189.213/32
-20.46.252.52/32
-20.48.0.0/12
-20.64.0.0/10
-200.162.144.0/20
-201.78.128.89/32
-203.159.90.217/32
-203.159.90.218/32
-206.189.19.19/32
-206.189.95.232/32
-206.81.12.187/32
-206.81.24.227/32
-207.154.197.113/32
-207.175.159.248/32
-207.175.20.232/32
-207.241.173.229/32
-208.84.102.195/32
-209.126.2.173/32
-209.87.169.142/32
-209.87.169.148/32
-209.99.184.0/21
-212.32.69.236/32
-213.111.158.220/32
-213.35.113.47/32
-216.24.210.46/32
-216.24.212.0/24
-216.73.163.0/24
-216.73.216.0/22
-216.73.217.176/32
-216.81.248.20/32
-217.156.123.33/32
-217.217.252.197/32
-220.202.112.100/32
-223.199.187.171/32
-23.102.123.231/32
-23.161.169.127/32
-23.161.169.62/32
-23.178.112.0/24
-23.180.120.134/32
-23.180.120.147/32
-23.234.98.171/32
-23.94.155.57/32
-23.95.226.104/32
-24.144.85.55/32
-3.101.54.4/32
-3.107.107.18/32
-3.148.191.150/32
-3.237.185.144/32
-3.250.52.216/32
-3.27.206.50/32
-3.77.92.222/32
-3.79.41.12/32
-31.184.236.8/32
-31.56.58.0/24
-31.58.51.130/32
-31.58.51.184/32
-31.59.129.193/32
-34.105.30.251/32
-34.11.108.163/32
-34.11.127.22/32
-34.116.255.65/32
-34.118.184.2/32
-34.12.130.245/32
-34.125.42.15/32
-34.139.141.56/32
-34.140.123.172/32
-34.145.62.28/32
-34.148.8.63/32
-34.154.122.183/32
-34.156.98.72/32
-34.158.83.192/32
-34.16.184.1/32
-34.17.159.73/32
-34.171.75.208/32
-34.175.82.8/32
-34.18.38.137/32
-34.181.134.189/32
-34.186.83.134/32
-34.187.20.70/32
-34.187.200.119/32
-34.187.82.183/32
-34.21.144.169/32
-34.23.104.90/32
-34.242.226.103/32
-34.244.177.56/32
-34.26.191.118/32
-34.31.88.250/32
-34.39.210.94/32
-34.47.183.174/32
-34.47.194.183/32
-34.55.200.45/32
-34.64.173.205/32
-34.65.138.195/32
-34.65.14.246/32
-34.65.18.71/32
-34.69.107.154/32
-34.7.160.235/32
-34.7.193.250/32
-34.72.34.156/32
-34.73.128.17/32
-34.74.20.101/32
-34.75.4.161/32
-34.82.10.34/32
-34.85.55.146/32
-34.86.126.198/32
-34.86.217.208/32
-34.88.208.176/32
-34.9.173.20/32
-34.90.87.32/32
-34.90.88.37/32
-34.91.243.226/32
-34.95.239.96/32
-35.157.251.190/32
-35.182.17.8/32
-35.184.157.121/32
-35.187.9.30/32
-35.192.232.168/32
-35.196.22.146/32
-35.198.180.224/32
-35.199.111.12/32
-35.199.115.51/32
-35.199.183.190/32
-35.201.159.247/32
-35.204.141.252/32
-35.204.88.252/32
-35.205.50.183/32
-35.230.52.27/32
-35.231.100.82/32
-35.231.140.112/32
-35.231.41.225/32
-35.233.191.179/32
-35.237.138.104/32
-35.237.178.50/32
-35.243.173.211/32
-35.243.223.147/32
-35.255.40.65/32
-35.95.56.230/32
-36.106.166.223/32
-36.106.166.92/32
-37.140.223.58/32
-37.140.223.6/32
-4.176.0.0/12
-4.192.0.0/12
-4.208.0.0/12
-4.224.0.0/12
-4.246.70.112/32
-40.80.90.100/32
-41.143.154.1/32
-43.228.157.0/24
-43.98.201.177/32
-44.248.34.34/32
-44.251.113.120/32
-45.130.203.154/32
-45.130.203.177/32
-45.131.193.139/32
-45.131.195.0/24
-45.134.20.116/32
-45.134.20.128/32
-45.134.79.95/32
-45.138.16.114/32
-45.139.104.172/32
-45.146.54.137/32
-45.146.54.80/32
-45.146.55.11/32
-45.146.55.48/32
-45.148.10.0/24
-45.153.34.16/32
-45.153.34.182/32
-45.153.34.43/32
-45.154.138.181/32
-45.154.138.232/32
-45.154.98.0/24
-45.45.237.0/24
-45.61.150.67/32
-45.61.187.30/32
-45.67.85.190/32
-45.8.196.200/32
-45.88.138.44/32
-5.161.225.116/32
-5.161.62.209/32
-5.253.247.16/32
-5.255.119.161/32
-51.103.133.211/32
-51.103.152.96/32
-51.107.190.246/32
-51.116.233.22/32
-51.120.79.193/32
-51.120.83.160/32
-51.143.162.98/32
-51.79.208.246/32
-52.139.36.144/32
-52.160.0.0/11
-52.224.0.0/11
-54.163.186.39/32
-54.169.103.174/32
-54.179.129.22/32
-54.206.147.115/32
-54.210.219.163/32
-54.216.227.171/32
-54.82.69.43/32
-58.212.237.231/32
-62.60.130.128/32
-62.93.179.146/32
-64.225.63.129/32
-64.226.123.37/32
-64.23.218.208/32
-64.89.161.82/32
-64.89.161.85/32
-65.0.122.218/32
-66.187.5.228/32
-66.187.6.102/32
-66.228.38.221/32
-66.249.74.164/32
-66.249.74.165/32
-68.183.180.73/32
-68.183.9.16/32
-68.220.0.0/15
-69.164.220.232/32
-69.164.220.85/32
-69.30.85.194/32
-72.146.20.230/32
-74.248.0.0/15
-74.248.33.172/32
-74.7.0.0/16
-77.90.185.230/32
-8.221.104.113/32
-8.229.1.130/32
-8.229.130.50/32
-8.231.78.19/32
-8.234.207.247/32
-8.234.214.152/32
-8.235.114.162/32
-80.91.86.169/32
-80.94.92.167/32
-80.94.92.206/32
-81.171.72.135/32
-81.171.72.93/32
-82.102.18.0/24
-82.102.18.190/32
-82.165.82.154/32
-82.39.206.154/32
-84.17.60.251/32
-85.11.167.225/32
-85.121.54.40/32
-85.204.70.0/24
-87.121.79.42/32
-88.151.32.7/32
-88.184.210.4/32
-9.205.16.190/32
-91.124.88.29/32
-91.124.88.36/32
-91.134.35.95/32
-91.148.244.131/32
-91.148.245.81/32
-91.192.10.86/32
-91.193.232.0/24
-91.224.92.159/32
-91.224.92.190/32
-91.230.225.0/24
-91.239.157.185/32
-91.239.79.146/32
-91.92.241.196/32
-91.92.243.245/32
-91.92.40.175/32
-91.92.41.115/32
-91.92.42.86/32
-91.92.47.101/32
-91.92.47.153/32
-92.118.39.126/32
-92.118.39.29/32
-92.119.121.196/32
-93.123.109.0/24
-93.152.221.13/32
-94.154.43.0/24
-95.85.238.18/32
-96.126.130.210/32
-98.159.36.147/32
-98.159.37.147/32

app/reports/app/data/blocklist_ipv6.txt

@@ -1,21 +0,0 @@
-2001:4ca0:108:42::24/128
-2001:ba0:24c:a500::1/128
-2400:8901::2000:62ff:fe9a:e1c2/128
-2406:da18:525:0:a23e:e8f6:3ea1:4c2c/128
-2600:3000::/32
-2600:3c09::2000:5cff:fe99:c802/128
-2600:3c15::2000:53ff:fe31:8c0b/128
-2600:3c15::2000:9cff:fef0:8ad6/128
-2602:fa59::/40
-2a00:6340:2008:ec80:64cc:9116:beb2:1931/128
-2a00:6340:2008:ec80:be24:11ff:fe3b:4058/128
-2a00:6340:2008:ec80:be24:11ff:fe82:2775/128
-2a01:2a8:a0dd:1::1012/128
-2a01:4f8:c014:7f9e::1/128
-2a04:4e40:e000::/48
-2a04:c300::/29
-2a05:4140:3::37cd/128
-2a09:bac1:76c0:460::5e:6a/128
-2a09:bac5::/32
-2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9/128
-2a13:adc0::2ed:89ff:fe58:19c5/128

app/reports/copyparty/2026-08-06-11-51-47.txt

@@ -1,191 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-06T11:51:47
-
-log path:              P:\copyparty
-log files:             42
-total requests:        25295
-unique IPs:            246 (IPv4 202 / IPv6 44)
-error requests:        6581
-unique denied paths:   2002
-denied requests:       6581
-banned IPs:            26
-authenticated users:   {'admin': 519, 'corky': 78}
-denied-only ips:       110
-whitelisted IPs seen:  19
-block candidates:      112
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-... 216 more IPs omitted
-
-== top 20 denied paths ==
-     52  /admin.php
-     51  /.env
-     44  /wp-content/plugins/hellopress/wp_filemanager.php
-     44  /this_is_a_new_hello_world.php
-     35  /1.php
-     34  /.git/config
-     33  /classwithtostring.php
-     33  /222.php
-     33  /wp-content/uploads
-     32  /wp-content/admin.php
-     29  /8.php
-     27  /file.php
-     27  /mac.php
-     26  /wp.php
-     26  /edit.php
-     26  /aa.php
-     25  /images.php
-     25  /ops.php
-     24  /f35.php
-     24  /x.php
-
-== Denied-only IPs (110) ==
-never authenticated -- ban candidates
--- IPv4 (107) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-4.223.73.90        106      53       0  19:50:04.916  19:50:11.164  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-91.92.241.196       11       5       0  13:55:12.175  13:05:16.007  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-157.245.63.62        2       1       0  08:13:33.142  08:13:33.142  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-06-13-03-30.txt

@@ -1,24 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-06T13:03:30
-
-log path:              P:\copyparty
-log files:             42
-total requests:        0
-unique IPs:            0 (IPv4 0 / IPv6 0)
-error requests:        0
-unique denied paths:   0
-denied requests:       0
-banned IPs:            0
-authenticated users:   {}
-denied-only ips:       0
-whitelisted IPs seen:  0
-block candidates:      0
-
-== top 30 IPs ==
-ip  total  denied  banned  first  last  users  whitelist
---------------------------------------------------------
-
-== top 20 denied paths ==
-
-== Denied-only IPs (0) ==
-never authenticated -- ban candidates

app/reports/copyparty/2026-08-06-13-21-41.txt

@@ -1,191 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-06T13:21:41
-
-log path:              P:\copyparty
-log files:             42
-total requests:        25295
-unique IPs:            246 (IPv4 202 / IPv6 44)
-error requests:        6581
-unique denied paths:   2002
-denied requests:       6581
-banned IPs:            26
-authenticated users:   {'admin': 519, 'corky': 78}
-denied-only ips:       110
-whitelisted IPs seen:  19
-block candidates:      112
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-... 216 more IPs omitted
-
-== top 20 denied paths ==
-     52  /admin.php
-     51  /.env
-     44  /wp-content/plugins/hellopress/wp_filemanager.php
-     44  /this_is_a_new_hello_world.php
-     35  /1.php
-     34  /.git/config
-     33  /classwithtostring.php
-     33  /222.php
-     33  /wp-content/uploads
-     32  /wp-content/admin.php
-     29  /8.php
-     27  /file.php
-     27  /mac.php
-     26  /wp.php
-     26  /edit.php
-     26  /aa.php
-     25  /images.php
-     25  /ops.php
-     24  /f35.php
-     24  /x.php
-
-== Denied-only IPs (110) ==
-never authenticated -- ban candidates
--- IPv4 (107) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-4.223.73.90        106      53       0  19:50:04.916  19:50:11.164  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-91.92.241.196       11       5       0  13:55:12.175  13:05:16.007  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-157.245.63.62        2       1       0  08:13:33.142  08:13:33.142  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-06-14-43-58.txt

@@ -1,24 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-06T14:43:58
-
-log path:              P:\copyparty
-log files:             42
-total requests:        0
-unique IPs:            0 (IPv4 0 / IPv6 0)
-error requests:        0
-unique denied paths:   0
-denied requests:       0
-banned IPs:            0
-authenticated users:   {}
-denied-only ips:       0
-whitelisted IPs seen:  0
-block candidates:      0
-
-== top 30 IPs ==
-ip  total  denied  banned  first  last  users  whitelist
---------------------------------------------------------
-
-== top 20 denied paths ==
-
-== Denied-only IPs (0) ==
-never authenticated -- ban candidates

app/reports/copyparty/2026-08-06-15-09-10.txt

@@ -1,192 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-06T15:09:10
-
-log path:              P:\copyparty
-log files:             42
-total requests:        25297
-unique IPs:            246 (IPv4 202 / IPv6 44)
-error requests:        6582
-unique denied paths:   2002
-denied requests:       6582
-banned IPs:            26
-authenticated users:   {'admin': 519, 'corky': 78}
-denied-only ips:       111
-whitelisted IPs seen:  19
-block candidates:      113
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-... 216 more IPs omitted
-
-== top 20 denied paths ==
-     52  /.env
-     52  /admin.php
-     44  /wp-content/plugins/hellopress/wp_filemanager.php
-     44  /this_is_a_new_hello_world.php
-     35  /1.php
-     34  /.git/config
-     33  /classwithtostring.php
-     33  /222.php
-     33  /wp-content/uploads
-     32  /wp-content/admin.php
-     29  /8.php
-     27  /file.php
-     27  /mac.php
-     26  /wp.php
-     26  /edit.php
-     26  /aa.php
-     25  /images.php
-     25  /ops.php
-     24  /f35.php
-     24  /x.php
-
-== Denied-only IPs (111) ==
-never authenticated -- ban candidates
--- IPv4 (108) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-4.223.73.90        106      53       0  19:50:04.916  19:50:11.164  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-91.92.241.196       11       5       0  13:55:12.175  13:05:16.007  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-157.245.63.62        2       1       0  08:13:33.142  08:13:33.142  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
-94.154.43.229        4       1       0  14:35:26.801  12:53:30.198  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-07-19-48-03.txt

@@ -1,70 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-07T19:48:03
-
-log path:              P:\copyparty
-log files:             43
-total requests:        1227
-unique IPs:            14 (IPv4 14 / IPv6 0)
-error requests:        279
-unique denied paths:   182
-denied requests:       279
-banned IPs:            3
-authenticated users:   {}
-denied-only ips:       9
-whitelisted IPs seen:  0
-block candidates:      9
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-35.196.132.85        6       0       0  14:20:00.708  16:50:00.731  *
-91.92.241.196        4       2       0  15:50:20.187  15:50:21.628  *
-157.245.63.62        2       1       0  13:04:56.122  13:04:56.122  *
-35.227.62.178        2       0       0  15:20:01.556  15:20:01.557  *
-35.237.169.55        2       0       0  13:53:04.249  13:53:04.250  *
-94.154.43.229        2       1       0  12:53:30.198  12:53:30.198  *
-34.85.209.183        1       0       0  15:59:40.864  15:59:40.864  *
-94.154.43.178        1       0       0  16:14:12.910  16:14:12.910  *
-
-== top 20 denied paths ==
-      5  /admin.php
-      3  /wp-content/plugins/hellopress/wp_filemanager.php
-      3  /this_is_a_new_hello_world.php
-      3  /av.php
-      3  /media.php
-      3  /images.php
-      3  /222.php
-      3  /mac.php
-      3  /ops.php
-      3  /8.php
-      3  /biufile.php
-      3  /coffexium.php
-      3  /1.php
-      3  /classwithtostring.php
-      3  /wp-ws68.php
-      3  /mgrr.php
-      3  /yj09.php
-      3  /3PJcpMFsD8B.php
-      3  /BDKR28WP.php
-      3  /shiny.php
-
-== Denied-only IPs (9) ==
-never authenticated -- ban candidates
--- IPv4 (9) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-91.92.241.196        4       2       0  15:50:20.187  15:50:21.628  *
-157.245.63.62        2       1       0  13:04:56.122  13:04:56.122  *
-94.154.43.229        2       1       0  12:53:30.198  12:53:30.198  *

app/reports/copyparty/2026-08-07-19-48-44.txt

@@ -1,198 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-07T19:48:44
-
-log path:              P:\copyparty
-log files:             43
-total requests:        26522
-unique IPs:            253 (IPv4 209 / IPv6 44)
-error requests:        6860
-unique denied paths:   2022
-denied requests:       6860
-banned IPs:            29
-authenticated users:   {'admin': 519, 'corky': 78}
-denied-only ips:       117
-whitelisted IPs seen:  19
-block candidates:      119
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-... 223 more IPs omitted
-
-== top 20 denied paths ==
-     57  /admin.php
-     52  /.env
-     47  /wp-content/plugins/hellopress/wp_filemanager.php
-     47  /this_is_a_new_hello_world.php
-     38  /1.php
-     36  /.git/config
-     36  /classwithtostring.php
-     36  /222.php
-     34  /wp-content/uploads
-     33  /wp-content/admin.php
-     32  /8.php
-     30  /mac.php
-     28  /aa.php
-     28  /images.php
-     28  /ops.php
-     27  /wp.php
-     27  /file.php
-     27  /edit.php
-     26  /coffexium.php
-     25  /f35.php
-
-== Denied-only IPs (117) ==
-never authenticated -- ban candidates
--- IPv4 (114) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-4.223.73.90        106      53       0  19:50:04.916  19:50:11.164  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-91.92.241.196       15       7       0  13:55:12.175  15:50:21.628  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-157.245.63.62        4       2       0  08:13:33.142  13:04:56.122  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
-94.154.43.229        4       1       0  14:35:26.801  12:53:30.198  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-08-14-31-22.txt

@@ -1,201 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-08T14:31:22
-
-log path:              P:\copyparty
-log files:             44
-total requests:        26784
-unique IPs:            263 (IPv4 218 / IPv6 45)
-error requests:        6976
-unique denied paths:   2059
-denied requests:       6976
-banned IPs:            30
-authenticated users:   {'admin': 523, 'corky': 78}
-denied-only ips:       120
-whitelisted IPs seen:  21
-block candidates:      122
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-... 233 more IPs omitted
-
-== top 20 denied paths ==
-     58  /admin.php
-     53  /.env
-     49  /wp-content/plugins/hellopress/wp_filemanager.php
-     49  /this_is_a_new_hello_world.php
-     39  /1.php
-     37  /classwithtostring.php
-     37  /222.php
-     36  /.git/config
-     34  /wp-content/uploads
-     33  /8.php
-     33  /wp-content/admin.php
-     31  /mac.php
-     29  /aa.php
-     29  /images.php
-     29  /ops.php
-     28  /wp.php
-     28  /edit.php
-     27  /file.php
-     27  /coffexium.php
-     25  /f35.php
-
-== Denied-only IPs (120) ==
-never authenticated -- ban candidates
--- IPv4 (117) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-172.213.227.73     108      54       0  03:00:13.592  03:00:18.810  *
-4.223.73.90        106      53       0  19:50:04.916  19:50:11.164  *
-4.232.185.87       110      53       0  21:23:31.012  21:23:33.019  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-107.173.254.55      29       9       9  07:04:56.768  07:05:17.755  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-91.92.241.196       15       7       0  13:55:12.175  15:50:21.628  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-157.245.63.62        4       2       0  08:13:33.142  13:04:56.122  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
-94.154.43.229        4       1       0  14:35:26.801  12:53:30.198  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-11-11-43-46.txt

@@ -1,210 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-11T11:43:46
-
-log path:              \\naspve\nas\projects\copyparty
-log files:             48
-total requests:        30034
-unique IPs:            277 (IPv4 230 / IPv6 47)
-error requests:        7738
-unique denied paths:   2126
-denied requests:       7738
-banned IPs:            32
-authenticated users:   {'admin': 537, 'corky': 78}
-denied-only ips:       129
-whitelisted IPs seen:  23
-block candidates:      131
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-192.168.88.8      1736       0       0  13:31:27.246  09:40:39.082  -
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-172.213.227.73     382     191       0  03:00:13.592  01:13:37.755  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.52.171.102      292     146       0  20:01:30.635  20:01:36.800  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-... 247 more IPs omitted
-
-== top 20 denied paths ==
-     67  /admin.php
-     56  /wp-content/plugins/hellopress/wp_filemanager.php
-     56  /this_is_a_new_hello_world.php
-     54  /.env
-     46  /1.php
-     44  /classwithtostring.php
-     42  /222.php
-     38  /8.php
-     37  /.git/config
-     37  /wp-content/uploads
-     37  /wp-content/admin.php
-     35  /mac.php
-     34  /aa.php
-     34  /images.php
-     33  /ops.php
-     32  /wp.php
-     31  /edit.php
-     31  /coffexium.php
-     29  /file.php
-     29  /inputs.php
-
-== Denied-only IPs (129) ==
-never authenticated -- ban candidates
--- IPv4 (126) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-172.213.227.73     382     191       0  03:00:13.592  01:13:37.755  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.52.171.102      292     146       0  20:01:30.635  20:01:36.800  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-51.107.190.246     274     137       0  01:44:18.242  01:44:28.832  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-74.248.97.169      231     115       0  13:25:17.217  13:25:31.602  *
-20.251.112.224     215     107       0  06:52:51.081  06:53:05.602  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-4.223.73.90        204     102       0  19:50:04.916  18:12:09.187  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-4.232.185.87       110      53       0  21:23:31.012  21:23:33.019  *
-20.218.73.95        98      49       0  04:39:44.907  04:39:46.708  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-107.173.254.55      29       9       9  07:04:56.768  07:05:17.755  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-82.102.18.116       30       9      10  04:49:33.098  04:49:34.184  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-88.151.32.7         88       9      69  18:43:38.911  19:04:03.160  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-91.92.241.196       15       7       0  13:55:12.175  15:50:21.628  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-45.148.10.119       11       3       0  02:36:55.008  07:16:27.585  *
-157.245.63.62        4       2       0  08:13:33.142  13:04:56.122  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-176.65.132.38        3       1       0  20:33:22.070  05:08:32.533  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
-94.154.43.229        4       1       0  14:35:26.801  12:53:30.198  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/2026-08-11-11-44-39.txt

@@ -1,210 +0,0 @@
-copyparty log analysis report
-generated: 2026-08-11T11:44:39
-
-log path:              \\naspve\nas\projects\copyparty
-log files:             48
-total requests:        30034
-unique IPs:            277 (IPv4 230 / IPv6 47)
-error requests:        7738
-unique denied paths:   2126
-denied requests:       7738
-banned IPs:            32
-authenticated users:   {'admin': 537, 'corky': 78}
-denied-only ips:       129
-whitelisted IPs seen:  23
-block candidates:      131
-
-== top 30 IPs ==
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-192.168.88.8      1736       0       0  13:31:27.246  09:40:39.082  -
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-172.213.227.73     382     191       0  03:00:13.592  01:13:37.755  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.52.171.102      292     146       0  20:01:30.635  20:01:36.800  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-... 247 more IPs omitted
-
-== top 20 denied paths ==
-     67  /admin.php
-     56  /wp-content/plugins/hellopress/wp_filemanager.php
-     56  /this_is_a_new_hello_world.php
-     54  /.env
-     46  /1.php
-     44  /classwithtostring.php
-     42  /222.php
-     38  /8.php
-     37  /.git/config
-     37  /wp-content/uploads
-     37  /wp-content/admin.php
-     35  /mac.php
-     34  /aa.php
-     34  /images.php
-     33  /ops.php
-     32  /wp.php
-     31  /edit.php
-     31  /coffexium.php
-     29  /file.php
-     29  /inputs.php
-
-== Denied-only IPs (129) ==
-never authenticated -- ban candidates
--- IPv4 (126) --
-ip               total  denied  banned  first         last          users  whitelist
-------------------------------------------------------------------------------------
-195.178.110.199   1258     621       0  03:02:41.078  03:02:42.924  *
-45.148.10.67      1258     621       0  20:49:39.003  20:49:41.111  *
-20.251.48.208      612     306       0  23:50:43.575  17:01:41.376  *
-20.215.216.94      516     257       0  16:16:39.439  15:21:39.387  *
-20.215.218.234     504     252       0  02:46:27.628  05:35:25.304  *
-20.198.120.225     428     214       0  10:07:52.191  10:09:25.008  *
-172.213.227.73     382     191       0  03:00:13.592  01:13:37.755  *
-20.197.178.120     374     186       0  14:54:24.411  14:54:52.938  *
-74.249.245.134     354     177       0  21:27:53.575  21:29:06.182  *
-20.151.10.161      325     162       0  17:31:38.451  17:32:27.663  *
-20.205.229.184     323     161       0  12:17:54.322  12:18:41.173  *
-4.185.41.66        323     161       0  18:18:18.046  18:18:24.319  *
-52.184.96.217      323     161       0  20:02:55.760  20:03:44.824  *
-172.213.225.181    321     160       0  13:48:04.161  13:48:11.331  *
-20.48.236.161      321     160       0  15:11:59.817  15:12:31.060  *
-158.158.32.229     316     158       0  12:33:51.566  12:34:03.712  *
-20.63.63.128       315     157       0  16:04:22.373  16:04:50.675  *
-20.206.67.15       313     156       0  05:56:36.144  05:57:20.412  *
-20.215.185.25      300     150       0  08:18:05.984  08:19:09.190  *
-20.203.243.122     294     147       0  03:58:39.580  03:58:55.359  *
-20.52.171.102      292     146       0  20:01:30.635  20:01:36.800  *
-20.226.26.5        286     143       0  06:33:33.891  06:34:07.483  *
-68.221.130.241     278     139       0  08:28:43.979  08:28:50.496  *
-20.100.172.153     275     137       0  09:10:06.751  09:10:17.835  *
-51.107.190.246     274     137       0  01:44:18.242  01:44:28.832  *
-74.248.33.172      257     128       0  23:32:36.049  23:32:42.718  *
-20.203.179.12      250     125       0  17:33:20.484  17:33:29.742  *
-20.113.142.140     231     115       0  07:47:47.716  07:48:00.044  *
-74.248.97.169      231     115       0  13:25:17.217  13:25:31.602  *
-20.251.112.224     215     107       0  06:52:51.081  06:53:05.602  *
-158.158.105.63     208     104       0  11:24:12.912  23:00:49.043  *
-4.223.71.149       209     104       0  00:26:55.320  00:27:19.244  *
-4.223.73.90        204     102       0  19:50:04.916  18:12:09.187  *
-135.225.93.215     203     101       0  02:32:24.496  02:32:32.326  *
-20.9.85.55         203     101       0  15:43:36.450  15:44:20.170  *
-20.91.208.34       203     101       0  22:07:01.428  22:07:20.883  *
-52.238.192.78      203     101       0  00:04:31.589  00:05:07.114  *
-172.213.208.13     192      96       0  13:27:56.743  19:14:00.938  *
-172.213.244.85     165      82       0  17:01:49.042  17:01:52.331  *
-20.206.105.145     157      78       0  04:06:08.085  04:06:29.772  *
-51.120.83.160      144      72       0  15:40:29.699  15:40:39.446  *
-172.213.153.79     114      57       0  18:40:13.799  18:40:20.149  *
-20.91.239.158      114      57       0  13:42:20.392  13:42:24.986  *
-4.232.185.87       110      53       0  21:23:31.012  21:23:33.019  *
-20.218.73.95        98      49       0  04:39:44.907  04:39:46.708  *
-20.91.203.45        94      47       0  16:27:01.288  16:27:10.455  *
-20.197.192.193      88      44       0  13:45:32.377  13:45:43.108  *
-74.248.24.145       74      37       0  09:21:37.839  09:21:43.127  *
-172.213.144.209     70      35       0  07:52:16.066  07:52:17.778  *
-35.198.180.224      46      22       0  14:14:37.617  14:14:48.930  *
-45.148.10.62        98      22      40  07:53:03.360  03:15:12.651  *
-45.148.10.244      109      18      70  04:53:37.585  09:56:59.103  *
-45.148.10.120       33      16       0  14:24:06.542  17:06:11.688  *
-34.39.210.94        24      12       0  19:31:07.030  19:31:07.101  *
-195.178.110.31      49      11      20  02:27:56.164  02:27:58.425  *
-195.178.110.223     37      10      13  01:31:40.464  01:56:49.503  *
-34.95.239.96        20      10       0  11:25:18.487  11:25:18.532  *
-107.173.254.55      29       9       9  07:04:56.768  07:05:17.755  *
-136.108.11.195      25       9       7  08:33:11.182  08:33:13.921  *
-139.59.118.17      180       9     157  08:21:30.247  08:22:03.812  *
-146.70.40.68        30       9      10  18:55:47.310  18:55:48.145  *
-147.182.149.75      40       9      21  21:50:17.837  21:50:45.474  *
-16.146.99.254      279       9     256  12:11:20.725  12:12:09.790  *
-163.7.11.71         93       9      72  07:24:55.235  07:25:05.144  *
-167.99.181.249      40       9      21  21:50:26.091  21:51:01.239  *
-18.142.90.109      279       9     256  17:06:23.216  17:07:15.117  *
-18.227.73.7        392       9     363  22:00:31.465  22:01:33.982  *
-207.175.159.248     25       9       7  03:52:06.643  03:52:07.542  *
-207.175.20.232      25       9       7  09:43:00.775  09:43:03.604  *
-209.99.189.190      77       9      59  17:04:48.190  09:53:52.093  *
-3.79.41.12         286       9     263  04:20:16.234  04:20:22.797  *
-34.105.30.251       29       9       9  15:55:43.824  15:55:49.547  *
-34.23.104.90        25       9       7  14:40:59.025  14:41:01.713  *
-34.242.226.103     286       9     263  06:52:40.299  06:52:54.689  *
-34.9.173.20        245       9     224  16:55:22.164  16:55:30.344  *
-45.67.85.190        32       9      11  19:41:44.132  19:41:46.806  *
-54.163.186.39      286       9     263  01:39:29.740  01:40:00.874  *
-82.102.18.116       30       9      10  04:49:33.098  04:49:34.184  *
-85.204.70.100       30       9      10  13:55:11.862  13:55:12.567  *
-88.151.32.7         88       9      69  18:43:38.911  19:04:03.160  *
-91.192.10.86        31       9      10  13:38:54.986  13:38:56.159  *
-93.123.109.101    4320       9    4264  00:35:05.539  00:40:32.578  *
-185.93.89.147     3762       8       0  19:07:14.620  08:52:41.657  *
-195.178.110.155     57       8       0  09:10:16.072  09:10:19.329  *
-45.148.10.194       58       8       0  15:46:42.822  15:46:45.473  *
-45.148.10.247       57       8       0  00:58:56.398  00:58:59.599  *
-72.146.20.230       14       7       0  03:01:31.244  03:01:31.427  *
-91.92.241.196       15       7       0  13:55:12.175  15:50:21.628  *
-209.99.189.152      13       6       0  18:03:04.845  18:03:12.906  *
-34.140.123.172     434       6     411  21:34:17.485  21:35:45.084  *
-162.243.79.174      11       5       0  12:20:28.790  12:20:40.350  *
-51.79.208.246       10       5       0  13:50:27.669  13:50:29.418  *
-94.154.43.184       10       5       0  11:23:26.214  09:31:40.319  *
-195.178.110.211      8       4       0  19:35:03.504  20:22:13.338  *
-45.148.10.119       11       3       0  02:36:55.008  07:16:27.585  *
-157.245.63.62        4       2       0  08:13:33.142  13:04:56.122  *
-163.7.13.115         5       2       0  14:06:27.842  14:06:29.745  *
-45.138.16.114        5       2       0  03:09:59.971  03:10:00.217  *
-45.148.10.95         4       2       0  21:05:26.356  14:40:26.566  *
-91.92.41.115         8       2       0  14:44:48.975  14:44:54.158  *
-94.154.43.179        5       2       0  13:27:23.753  04:38:17.921  *
-107.170.9.103        2       1       0  00:19:26.062  00:19:26.062  *
-129.212.237.196      2       1       0  09:23:08.470  09:23:08.471  *
-134.209.162.128      2       1       0  00:43:12.731  00:43:12.731  *
-158.101.144.198      2       1       0  14:30:06.125  14:30:06.125  *
-165.245.185.158      2       1       0  09:20:47.477  09:20:47.477  *
-176.65.132.38        3       1       0  20:33:22.070  05:08:32.533  *
-195.178.110.159      2       1       0  20:41:43.691  20:41:43.691  *
-2.57.122.173         2       1       0  12:10:19.177  12:10:19.177  *
-23.180.120.147       4       1       0  13:53:30.303  13:53:30.473  *
-31.58.51.184         4       1       0  15:07:53.176  15:07:58.514  *
-34.125.42.15         2       1       0  21:39:44.709  21:39:44.709  *
-34.91.243.226        2       1       0  19:51:57.606  19:51:57.606  *
-35.231.100.82        2       1       0  15:36:23.715  15:36:23.715  *
-35.233.191.179       2       1       0  00:16:07.188  00:16:07.199  *
-35.95.56.230         3       1       0  02:29:40.010  02:29:40.562  *
-43.98.201.177        2       1       0  01:01:05.988  01:01:05.988  *
-45.139.104.172       2       1       0  03:14:49.950  03:14:49.950  *
-64.226.123.37        2       1       0  21:33:32.148  21:33:32.148  *
-8.229.130.50         2       1       0  19:23:37.001  19:23:37.002  *
-93.123.109.167       2       1       0  04:39:35.474  04:39:35.474  *
-94.154.43.183        3       1       0  21:50:39.582  00:01:42.127  *
-94.154.43.185        3       1       0  01:40:53.903  04:02:34.085  *
-94.154.43.186        3       1       0  21:07:26.439  13:43:18.923  *
-94.154.43.188        5       1       0  02:45:01.636  11:09:54.264  *
-94.154.43.229        4       1       0  14:35:26.801  12:53:30.198  *
--- IPv6 (3) --
-ip                                   total  denied  banned  first         last          users  whitelist
---------------------------------------------------------------------------------------------------------
-2a04:4e40:e000:0:d09:97ab:43b1:a59a      4       2       0  14:41:30.905  14:41:30.922  *
-2600:3c15::2000:53ff:fe31:8c0b           2       1       0  12:35:18.643  12:35:18.643  *
-2602:fa59:10:a3a::1                      2       1       0  02:10:02.531  02:10:02.532  *

app/reports/copyparty/data/authed_users.json

@@ -1,4 +0,0 @@
-{
-  "admin": 537,
-  "corky": 78
-}

app/reports/copyparty/data/banned_ips.txt

@@ -1,32 +0,0 @@
-3.79.41.12
-16.146.99.254
-18.142.90.109
-18.227.73.7
-34.9.173.20
-34.23.104.90
-34.105.30.251
-34.140.123.172
-34.242.226.103
-45.67.85.190
-45.148.10.62
-45.148.10.244
-54.163.186.39
-82.102.18.116
-85.204.70.100
-88.151.32.7
-91.192.10.86
-93.123.109.101
-107.173.254.55
-136.108.11.195
-139.59.118.17
-146.70.40.68
-147.182.149.75
-163.7.11.71
-167.99.181.249
-195.178.110.31
-195.178.110.104
-195.178.110.135
-195.178.110.223
-207.175.20.232
-207.175.159.248
-209.99.189.190

app/reports/copyparty/data/blocked_ipv4.txt

@@ -1,128 +0,0 @@
-2.57.122.173
-3.79.41.12
-4.185.41.66
-4.223.71.149
-4.223.73.90
-4.232.185.87
-8.229.130.50
-16.146.99.254
-18.142.90.109
-18.227.73.7
-20.9.85.55
-20.48.236.161
-20.52.171.102
-20.63.63.128
-20.91.203.45
-20.91.208.34
-20.91.239.158
-20.100.172.153
-20.113.142.140
-20.151.10.161
-20.197.178.120
-20.197.192.193
-20.198.120.225
-20.203.179.12
-20.203.243.122
-20.205.229.184
-20.206.67.15
-20.206.105.145
-20.215.185.25
-20.215.216.94
-20.215.218.234
-20.218.73.95
-20.226.26.5
-20.251.48.208
-20.251.112.224
-23.180.120.147
-31.58.51.184
-34.9.173.20
-34.23.104.90
-34.39.210.94
-34.91.243.226
-34.95.239.96
-34.105.30.251
-34.125.42.15
-34.140.123.172
-34.242.226.103
-35.95.56.230
-35.198.180.224
-35.231.100.82
-35.233.191.179
-43.98.201.177
-45.67.85.190
-45.138.16.114
-45.139.104.172
-45.148.10.62
-45.148.10.67
-45.148.10.95
-45.148.10.119
-45.148.10.120
-45.148.10.194
-45.148.10.244
-45.148.10.247
-51.79.208.246
-51.107.190.246
-51.120.83.160
-52.184.96.217
-52.238.192.78
-54.163.186.39
-64.226.123.37
-68.221.130.241
-72.146.20.230
-74.248.24.145
-74.248.33.172
-74.248.97.169
-74.249.245.134
-82.102.18.116
-85.204.70.100
-88.151.32.7
-91.92.41.115
-91.92.241.196
-91.192.10.86
-93.123.109.101
-93.123.109.167
-94.154.43.179
-94.154.43.183
-94.154.43.184
-94.154.43.185
-94.154.43.186
-94.154.43.188
-94.154.43.229
-107.170.9.103
-107.173.254.55
-129.212.237.196
-134.209.162.128
-135.225.93.215
-136.108.11.195
-139.59.118.17
-146.70.40.68
-147.182.149.75
-157.245.63.62
-158.101.144.198
-158.158.32.229
-158.158.105.63
-162.243.79.174
-163.7.11.71
-163.7.13.115
-165.245.185.158
-167.99.181.249
-172.213.144.209
-172.213.153.79
-172.213.208.13
-172.213.225.181
-172.213.227.73
-172.213.244.85
-176.65.132.38
-185.93.89.147
-195.178.110.31
-195.178.110.104
-195.178.110.135
-195.178.110.155
-195.178.110.159
-195.178.110.199
-195.178.110.211
-195.178.110.223
-207.175.20.232
-207.175.159.248
-209.99.189.152
-209.99.189.190

app/reports/copyparty/data/blocked_ipv6.txt

@@ -1,3 +0,0 @@
-2600:3c15::2000:53ff:fe31:8c0b
-2602:fa59:10:a3a::1
-2a04:4e40:e000:0:d09:97ab:43b1:a59a

app/reports/copyparty/data/denied_ips.txt

@@ -1,126 +0,0 @@
-195.178.110.199  # denied=621 total=1258 first=03:02:41.078 last=03:02:42.924
-45.148.10.67  # denied=621 total=1258 first=20:49:39.003 last=20:49:41.111
-20.251.48.208  # denied=306 total=612 first=23:50:43.575 last=17:01:41.376
-20.215.216.94  # denied=257 total=516 first=16:16:39.439 last=15:21:39.387
-20.215.218.234  # denied=252 total=504 first=02:46:27.628 last=05:35:25.304
-20.198.120.225  # denied=214 total=428 first=10:07:52.191 last=10:09:25.008
-172.213.227.73  # denied=191 total=382 first=03:00:13.592 last=01:13:37.755
-20.197.178.120  # denied=186 total=374 first=14:54:24.411 last=14:54:52.938
-74.249.245.134  # denied=177 total=354 first=21:27:53.575 last=21:29:06.182
-20.151.10.161  # denied=162 total=325 first=17:31:38.451 last=17:32:27.663
-20.205.229.184  # denied=161 total=323 first=12:17:54.322 last=12:18:41.173
-4.185.41.66  # denied=161 total=323 first=18:18:18.046 last=18:18:24.319
-52.184.96.217  # denied=161 total=323 first=20:02:55.760 last=20:03:44.824
-172.213.225.181  # denied=160 total=321 first=13:48:04.161 last=13:48:11.331
-20.48.236.161  # denied=160 total=321 first=15:11:59.817 last=15:12:31.060
-158.158.32.229  # denied=158 total=316 first=12:33:51.566 last=12:34:03.712
-20.63.63.128  # denied=157 total=315 first=16:04:22.373 last=16:04:50.675
-20.206.67.15  # denied=156 total=313 first=05:56:36.144 last=05:57:20.412
-20.215.185.25  # denied=150 total=300 first=08:18:05.984 last=08:19:09.190
-20.203.243.122  # denied=147 total=294 first=03:58:39.580 last=03:58:55.359
-20.52.171.102  # denied=146 total=292 first=20:01:30.635 last=20:01:36.800
-20.226.26.5  # denied=143 total=286 first=06:33:33.891 last=06:34:07.483
-68.221.130.241  # denied=139 total=278 first=08:28:43.979 last=08:28:50.496
-20.100.172.153  # denied=137 total=275 first=09:10:06.751 last=09:10:17.835
-51.107.190.246  # denied=137 total=274 first=01:44:18.242 last=01:44:28.832
-74.248.33.172  # denied=128 total=257 first=23:32:36.049 last=23:32:42.718
-20.203.179.12  # denied=125 total=250 first=17:33:20.484 last=17:33:29.742
-20.113.142.140  # denied=115 total=231 first=07:47:47.716 last=07:48:00.044
-74.248.97.169  # denied=115 total=231 first=13:25:17.217 last=13:25:31.602
-20.251.112.224  # denied=107 total=215 first=06:52:51.081 last=06:53:05.602
-158.158.105.63  # denied=104 total=208 first=11:24:12.912 last=23:00:49.043
-4.223.71.149  # denied=104 total=209 first=00:26:55.320 last=00:27:19.244
-4.223.73.90  # denied=102 total=204 first=19:50:04.916 last=18:12:09.187
-135.225.93.215  # denied=101 total=203 first=02:32:24.496 last=02:32:32.326
-20.9.85.55  # denied=101 total=203 first=15:43:36.450 last=15:44:20.170
-20.91.208.34  # denied=101 total=203 first=22:07:01.428 last=22:07:20.883
-52.238.192.78  # denied=101 total=203 first=00:04:31.589 last=00:05:07.114
-172.213.208.13  # denied=96 total=192 first=13:27:56.743 last=19:14:00.938
-172.213.244.85  # denied=82 total=165 first=17:01:49.042 last=17:01:52.331
-20.206.105.145  # denied=78 total=157 first=04:06:08.085 last=04:06:29.772
-51.120.83.160  # denied=72 total=144 first=15:40:29.699 last=15:40:39.446
-172.213.153.79  # denied=57 total=114 first=18:40:13.799 last=18:40:20.149
-20.91.239.158  # denied=57 total=114 first=13:42:20.392 last=13:42:24.986
-4.232.185.87  # denied=53 total=110 first=21:23:31.012 last=21:23:33.019
-20.218.73.95  # denied=49 total=98 first=04:39:44.907 last=04:39:46.708
-20.91.203.45  # denied=47 total=94 first=16:27:01.288 last=16:27:10.455
-20.197.192.193  # denied=44 total=88 first=13:45:32.377 last=13:45:43.108
-74.248.24.145  # denied=37 total=74 first=09:21:37.839 last=09:21:43.127
-172.213.144.209  # denied=35 total=70 first=07:52:16.066 last=07:52:17.778
-35.198.180.224  # denied=22 total=46 first=14:14:37.617 last=14:14:48.930
-45.148.10.62  # denied=22 total=98 first=07:53:03.360 last=03:15:12.651
-45.148.10.244  # denied=18 total=109 first=04:53:37.585 last=09:56:59.103
-45.148.10.120  # denied=16 total=33 first=14:24:06.542 last=17:06:11.688
-34.39.210.94  # denied=12 total=24 first=19:31:07.030 last=19:31:07.101
-195.178.110.31  # denied=11 total=49 first=02:27:56.164 last=02:27:58.425
-195.178.110.223  # denied=10 total=37 first=01:31:40.464 last=01:56:49.503
-34.95.239.96  # denied=10 total=20 first=11:25:18.487 last=11:25:18.532
-107.173.254.55  # denied=9 total=29 first=07:04:56.768 last=07:05:17.755
-136.108.11.195  # denied=9 total=25 first=08:33:11.182 last=08:33:13.921
-139.59.118.17  # denied=9 total=180 first=08:21:30.247 last=08:22:03.812
-146.70.40.68  # denied=9 total=30 first=18:55:47.310 last=18:55:48.145
-147.182.149.75  # denied=9 total=40 first=21:50:17.837 last=21:50:45.474
-16.146.99.254  # denied=9 total=279 first=12:11:20.725 last=12:12:09.790
-163.7.11.71  # denied=9 total=93 first=07:24:55.235 last=07:25:05.144
-167.99.181.249  # denied=9 total=40 first=21:50:26.091 last=21:51:01.239
-18.142.90.109  # denied=9 total=279 first=17:06:23.216 last=17:07:15.117
-18.227.73.7  # denied=9 total=392 first=22:00:31.465 last=22:01:33.982
-207.175.159.248  # denied=9 total=25 first=03:52:06.643 last=03:52:07.542
-207.175.20.232  # denied=9 total=25 first=09:43:00.775 last=09:43:03.604
-209.99.189.190  # denied=9 total=77 first=17:04:48.190 last=09:53:52.093
-3.79.41.12  # denied=9 total=286 first=04:20:16.234 last=04:20:22.797
-34.105.30.251  # denied=9 total=29 first=15:55:43.824 last=15:55:49.547
-34.23.104.90  # denied=9 total=25 first=14:40:59.025 last=14:41:01.713
-34.242.226.103  # denied=9 total=286 first=06:52:40.299 last=06:52:54.689
-34.9.173.20  # denied=9 total=245 first=16:55:22.164 last=16:55:30.344
-45.67.85.190  # denied=9 total=32 first=19:41:44.132 last=19:41:46.806
-54.163.186.39  # denied=9 total=286 first=01:39:29.740 last=01:40:00.874
-82.102.18.116  # denied=9 total=30 first=04:49:33.098 last=04:49:34.184
-85.204.70.100  # denied=9 total=30 first=13:55:11.862 last=13:55:12.567
-88.151.32.7  # denied=9 total=88 first=18:43:38.911 last=19:04:03.160
-91.192.10.86  # denied=9 total=31 first=13:38:54.986 last=13:38:56.159
-93.123.109.101  # denied=9 total=4320 first=00:35:05.539 last=00:40:32.578
-185.93.89.147  # denied=8 total=3762 first=19:07:14.620 last=08:52:41.657
-195.178.110.155  # denied=8 total=57 first=09:10:16.072 last=09:10:19.329
-45.148.10.194  # denied=8 total=58 first=15:46:42.822 last=15:46:45.473
-45.148.10.247  # denied=8 total=57 first=00:58:56.398 last=00:58:59.599
-72.146.20.230  # denied=7 total=14 first=03:01:31.244 last=03:01:31.427
-91.92.241.196  # denied=7 total=15 first=13:55:12.175 last=15:50:21.628
-209.99.189.152  # denied=6 total=13 first=18:03:04.845 last=18:03:12.906
-34.140.123.172  # denied=6 total=434 first=21:34:17.485 last=21:35:45.084
-162.243.79.174  # denied=5 total=11 first=12:20:28.790 last=12:20:40.350
-51.79.208.246  # denied=5 total=10 first=13:50:27.669 last=13:50:29.418
-94.154.43.184  # denied=5 total=10 first=11:23:26.214 last=09:31:40.319
-195.178.110.211  # denied=4 total=8 first=19:35:03.504 last=20:22:13.338
-45.148.10.119  # denied=3 total=11 first=02:36:55.008 last=07:16:27.585
-157.245.63.62  # denied=2 total=4 first=08:13:33.142 last=13:04:56.122
-163.7.13.115  # denied=2 total=5 first=14:06:27.842 last=14:06:29.745
-45.138.16.114  # denied=2 total=5 first=03:09:59.971 last=03:10:00.217
-45.148.10.95  # denied=2 total=4 first=21:05:26.356 last=14:40:26.566
-91.92.41.115  # denied=2 total=8 first=14:44:48.975 last=14:44:54.158
-94.154.43.179  # denied=2 total=5 first=13:27:23.753 last=04:38:17.921
-107.170.9.103  # denied=1 total=2 first=00:19:26.062 last=00:19:26.062
-129.212.237.196  # denied=1 total=2 first=09:23:08.470 last=09:23:08.471
-134.209.162.128  # denied=1 total=2 first=00:43:12.731 last=00:43:12.731
-158.101.144.198  # denied=1 total=2 first=14:30:06.125 last=14:30:06.125
-165.245.185.158  # denied=1 total=2 first=09:20:47.477 last=09:20:47.477
-176.65.132.38  # denied=1 total=3 first=20:33:22.070 last=05:08:32.533
-195.178.110.159  # denied=1 total=2 first=20:41:43.691 last=20:41:43.691
-2.57.122.173  # denied=1 total=2 first=12:10:19.177 last=12:10:19.177
-23.180.120.147  # denied=1 total=4 first=13:53:30.303 last=13:53:30.473
-31.58.51.184  # denied=1 total=4 first=15:07:53.176 last=15:07:58.514
-34.125.42.15  # denied=1 total=2 first=21:39:44.709 last=21:39:44.709
-34.91.243.226  # denied=1 total=2 first=19:51:57.606 last=19:51:57.606
-35.231.100.82  # denied=1 total=2 first=15:36:23.715 last=15:36:23.715
-35.233.191.179  # denied=1 total=2 first=00:16:07.188 last=00:16:07.199
-35.95.56.230  # denied=1 total=3 first=02:29:40.010 last=02:29:40.562
-43.98.201.177  # denied=1 total=2 first=01:01:05.988 last=01:01:05.988
-45.139.104.172  # denied=1 total=2 first=03:14:49.950 last=03:14:49.950
-64.226.123.37  # denied=1 total=2 first=21:33:32.148 last=21:33:32.148
-8.229.130.50  # denied=1 total=2 first=19:23:37.001 last=19:23:37.002
-93.123.109.167  # denied=1 total=2 first=04:39:35.474 last=04:39:35.474
-94.154.43.183  # denied=1 total=3 first=21:50:39.582 last=00:01:42.127
-94.154.43.185  # denied=1 total=3 first=01:40:53.903 last=04:02:34.085
-94.154.43.186  # denied=1 total=3 first=21:07:26.439 last=13:43:18.923
-94.154.43.188  # denied=1 total=5 first=02:45:01.636 last=11:09:54.264
-94.154.43.229  # denied=1 total=4 first=14:35:26.801 last=12:53:30.198

app/reports/copyparty/data/denied_ipv6.txt

@@ -1,3 +0,0 @@
-2a04:4e40:e000:0:d09:97ab:43b1:a59a  # denied=2 total=4 first=14:41:30.905 last=14:41:30.922
-2600:3c15::2000:53ff:fe31:8c0b  # denied=1 total=2 first=12:35:18.643 last=12:35:18.643
-2602:fa59:10:a3a::1  # denied=1 total=2 first=02:10:02.531 last=02:10:02.532

app/reports/copyparty/data/mikrotik-block.rsc

@@ -1,202 +0,0 @@
-# copyparty-ids firewall export - generated 2026-08-11T11:44:39
-
-# Openfactory IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=Openfactory address=5.226.144.0/21
-
-# Cloudflare IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=Cloudflare address=173.245.48.0/20
-add list=Cloudflare address=103.21.244.0/22
-add list=Cloudflare address=103.22.200.0/22
-add list=Cloudflare address=103.31.4.0/22
-add list=Cloudflare address=141.101.64.0/18
-add list=Cloudflare address=108.162.192.0/18
-add list=Cloudflare address=190.93.240.0/20
-add list=Cloudflare address=188.114.96.0/20
-add list=Cloudflare address=197.234.240.0/22
-add list=Cloudflare address=198.41.128.0/17
-add list=Cloudflare address=162.158.0.0/15
-add list=Cloudflare address=104.16.0.0/13
-add list=Cloudflare address=104.24.0.0/14
-add list=Cloudflare address=172.64.0.0/13
-add list=Cloudflare address=131.0.72.0/22
-
-# Cloudflare IPv6 ranges (whitelisted)
-/ipv6 firewall address-list
-add list=Cloudflare address=2400:cb00::/32
-add list=Cloudflare address=2606:4700::/32
-add list=Cloudflare address=2803:f800::/32
-add list=Cloudflare address=2405:b500::/32
-add list=Cloudflare address=2405:8100::/32
-add list=Cloudflare address=2a06:98c0::/29
-add list=Cloudflare address=2c0f:f248::/32
-
-# PaloAlto IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=PaloAlto address=35.203.210.0/23
-add list=PaloAlto address=144.86.173.0/24
-add list=PaloAlto address=147.185.132.0/23
-add list=PaloAlto address=162.216.149.0/24
-add list=PaloAlto address=162.216.150.0/24
-add list=PaloAlto address=172.105.147.0/24
-add list=PaloAlto address=198.235.24.0/24
-add list=PaloAlto address=205.210.31.0/24
-add list=PaloAlto address=216.25.88.0/21
-
-# PaloAlto IPv6 ranges (whitelisted)
-/ipv6 firewall address-list
-add list=PaloAlto address=2604:a940:300:5b6::/64
-add list=PaloAlto address=2604:a940:301:225::/64
-add list=PaloAlto address=2604:a940:302:118::/64
-
-# Blocked IPv4 (128, non-whitelisted)
-/ip firewall address-list
-add list=Blocked address=2.57.122.173
-add list=Blocked address=3.79.41.12
-add list=Blocked address=4.185.41.66
-add list=Blocked address=4.223.71.149
-add list=Blocked address=4.223.73.90
-add list=Blocked address=4.232.185.87
-add list=Blocked address=8.229.130.50
-add list=Blocked address=16.146.99.254
-add list=Blocked address=18.142.90.109
-add list=Blocked address=18.227.73.7
-add list=Blocked address=20.9.85.55
-add list=Blocked address=20.48.236.161
-add list=Blocked address=20.52.171.102
-add list=Blocked address=20.63.63.128
-add list=Blocked address=20.91.203.45
-add list=Blocked address=20.91.208.34
-add list=Blocked address=20.91.239.158
-add list=Blocked address=20.100.172.153
-add list=Blocked address=20.113.142.140
-add list=Blocked address=20.151.10.161
-add list=Blocked address=20.197.178.120
-add list=Blocked address=20.197.192.193
-add list=Blocked address=20.198.120.225
-add list=Blocked address=20.203.179.12
-add list=Blocked address=20.203.243.122
-add list=Blocked address=20.205.229.184
-add list=Blocked address=20.206.67.15
-add list=Blocked address=20.206.105.145
-add list=Blocked address=20.215.185.25
-add list=Blocked address=20.215.216.94
-add list=Blocked address=20.215.218.234
-add list=Blocked address=20.218.73.95
-add list=Blocked address=20.226.26.5
-add list=Blocked address=20.251.48.208
-add list=Blocked address=20.251.112.224
-add list=Blocked address=23.180.120.147
-add list=Blocked address=31.58.51.184
-add list=Blocked address=34.9.173.20
-add list=Blocked address=34.23.104.90
-add list=Blocked address=34.39.210.94
-add list=Blocked address=34.91.243.226
-add list=Blocked address=34.95.239.96
-add list=Blocked address=34.105.30.251
-add list=Blocked address=34.125.42.15
-add list=Blocked address=34.140.123.172
-add list=Blocked address=34.242.226.103
-add list=Blocked address=35.95.56.230
-add list=Blocked address=35.198.180.224
-add list=Blocked address=35.231.100.82
-add list=Blocked address=35.233.191.179
-add list=Blocked address=43.98.201.177
-add list=Blocked address=45.67.85.190
-add list=Blocked address=45.138.16.114
-add list=Blocked address=45.139.104.172
-add list=Blocked address=45.148.10.62
-add list=Blocked address=45.148.10.67
-add list=Blocked address=45.148.10.95
-add list=Blocked address=45.148.10.119
-add list=Blocked address=45.148.10.120
-add list=Blocked address=45.148.10.194
-add list=Blocked address=45.148.10.244
-add list=Blocked address=45.148.10.247
-add list=Blocked address=51.79.208.246
-add list=Blocked address=51.107.190.246
-add list=Blocked address=51.120.83.160
-add list=Blocked address=52.184.96.217
-add list=Blocked address=52.238.192.78
-add list=Blocked address=54.163.186.39
-add list=Blocked address=64.226.123.37
-add list=Blocked address=68.221.130.241
-add list=Blocked address=72.146.20.230
-add list=Blocked address=74.248.24.145
-add list=Blocked address=74.248.33.172
-add list=Blocked address=74.248.97.169
-add list=Blocked address=74.249.245.134
-add list=Blocked address=82.102.18.116
-add list=Blocked address=85.204.70.100
-add list=Blocked address=88.151.32.7
-add list=Blocked address=91.92.41.115
-add list=Blocked address=91.92.241.196
-add list=Blocked address=91.192.10.86
-add list=Blocked address=93.123.109.101
-add list=Blocked address=93.123.109.167
-add list=Blocked address=94.154.43.179
-add list=Blocked address=94.154.43.183
-add list=Blocked address=94.154.43.184
-add list=Blocked address=94.154.43.185
-add list=Blocked address=94.154.43.186
-add list=Blocked address=94.154.43.188
-add list=Blocked address=94.154.43.229
-add list=Blocked address=107.170.9.103
-add list=Blocked address=107.173.254.55
-add list=Blocked address=129.212.237.196
-add list=Blocked address=134.209.162.128
-add list=Blocked address=135.225.93.215
-add list=Blocked address=136.108.11.195
-add list=Blocked address=139.59.118.17
-add list=Blocked address=146.70.40.68
-add list=Blocked address=147.182.149.75
-add list=Blocked address=157.245.63.62
-add list=Blocked address=158.101.144.198
-add list=Blocked address=158.158.32.229
-add list=Blocked address=158.158.105.63
-add list=Blocked address=162.243.79.174
-add list=Blocked address=163.7.11.71
-add list=Blocked address=163.7.13.115
-add list=Blocked address=165.245.185.158
-add list=Blocked address=167.99.181.249
-add list=Blocked address=172.213.144.209
-add list=Blocked address=172.213.153.79
-add list=Blocked address=172.213.208.13
-add list=Blocked address=172.213.225.181
-add list=Blocked address=172.213.227.73
-add list=Blocked address=172.213.244.85
-add list=Blocked address=176.65.132.38
-add list=Blocked address=185.93.89.147
-add list=Blocked address=195.178.110.31
-add list=Blocked address=195.178.110.104
-add list=Blocked address=195.178.110.135
-add list=Blocked address=195.178.110.155
-add list=Blocked address=195.178.110.159
-add list=Blocked address=195.178.110.199
-add list=Blocked address=195.178.110.211
-add list=Blocked address=195.178.110.223
-add list=Blocked address=207.175.20.232
-add list=Blocked address=207.175.159.248
-add list=Blocked address=209.99.189.152
-add list=Blocked address=209.99.189.190
-
-# Blocked IPv6 (3, non-whitelisted)
-/ipv6 firewall address-list
-add list=Blocked address=2600:3c15::2000:53ff:fe31:8c0b
-add list=Blocked address=2602:fa59:10:a3a::1
-add list=Blocked address=2a04:4e40:e000:0:d09:97ab:43b1:a59a
-
-/ip firewall filter
-add chain=input action=accept src-address-list=Openfactory comment="copyparty-ids openfactory whitelist (v4)"
-add chain=input action=accept src-address-list=Cloudflare comment="copyparty-ids cloudflare whitelist (v4)"
-add chain=input action=accept src-address-list=PaloAlto comment="copyparty-ids paloalto whitelist (v4)"
-add chain=input action=drop src-address-list=Blocked comment="copyparty-ids blocked (v4)"
-add chain=forward action=drop src-address-list=Blocked comment="copyparty-ids blocked (v4)"
-
-/ipv6 firewall filter
-add chain=input action=accept src-address-list=Openfactory comment="copyparty-ids openfactory whitelist (v6)"
-add chain=input action=accept src-address-list=Cloudflare comment="copyparty-ids cloudflare whitelist (v6)"
-add chain=input action=accept src-address-list=PaloAlto comment="copyparty-ids paloalto whitelist (v6)"
-add chain=input action=drop src-address-list=Blocked comment="copyparty-ids blocked (v6)"
-add chain=forward action=drop src-address-list=Blocked comment="copyparty-ids blocked (v6)"

app/reports/mikrotik/data/address_list_ipv6.json

@@ -1,384 +0,0 @@
-[
-  {
-    "address": "::/128",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::1/128",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "fec0::/10",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::ffff:0.0.0.0/96",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "::/96",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "100::/64",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2001:db8::/32",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2001:10::/28",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "3ffe::/16",
-    "comment": "defconf:",
-    "creation-time": "2025-11-21",
-    "dynamic": "no",
-    "list": "bad_ipv6"
-  },
-  {
-    "address": "2a0e:8f04::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f05::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f06::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a0e:8f07::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2080::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2001:67c:2648::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:200::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:600::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2a00:6340:2044:800::/56",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2400:cb00::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2606:4700::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2803:f800::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2405:b500::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2405:8100::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2a06:98c0::/29",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2c0f:f248::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Cloudflare"
-  },
-  {
-    "address": "2604:a940:300:5b6::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2604:a940:301:225::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2604:a940:302:118::/64",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "PaloAlto"
-  },
-  {
-    "address": "2001:4ca0:108:42::24/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2400:8901::2000:62ff:fe9a:e1c2/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3000::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c09::2000:5cff:fe99:c802/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::2000:53ff:fe31:8c0b/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2602:fa59:10:a3a::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a01:2a8:a0dd:1::1012/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:e000:0:d09:97ab:43b1:a59a/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:c300::/29",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5:9443:3af::5e:4d/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5:9443:3af::5e:88/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2001:ba0:24c:a500::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2406:da18:525:0:a23e:e8f6:3ea1:4c2c/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::2000:9cff:fef0:8ad6/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2602:fa59::/40",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:64cc:9116:beb2:1931/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:be24:11ff:fe3b:4058/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2008:ec80:be24:11ff:fe82:2775/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a01:4f8:c014:7f9e::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:4400:0:537:cdd2:7250:95db/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a04:4e40:e000::/48",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a05:4140:3::37cd/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a06:a880:5:7fb3::1/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac1:76c0:460::5e:6a/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a09:bac5::/32",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a13:adc0::2ed:89ff:fe58:19c5/128",
-    "creation-time": "2026-08-03",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2400:8901::2000:beff:fea3:5a44/128",
-    "creation-time": "2026-08-05",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340::/32",
-    "creation-time": "2026-08-06",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2a00:6340:2017:3810::/64",
-    "comment": "hosting",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Openfactory"
-  },
-  {
-    "address": "2001:8d8:5ff:5f:82:165:82:154/128",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2600:3c15::/32",
-    "creation-time": "2026-08-07",
-    "dynamic": "no",
-    "list": "Blocked"
-  },
-  {
-    "address": "2001:448a:a071:520:e18f:3d1f:944e:174d/128",
-    "creation-time": "2026-08-08",
-    "dynamic": "no",
-    "list": "Blocked"
-  }
-]

app/reports/mikrotik/data/firewall_ipv4.json

@@ -1,137 +0,0 @@
-[
-  {
-    "action": "passthrough",
-    "chain": "forward",
-    "comment": "special"
-  },
-  {
-    "action": "fasttrack-connection",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related",
-    "hw-offload": "yes",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "invalid",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "Allow",
-    "connection-nat-state": "dstnat"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "allow",
-    "connection-state": "new",
-    "dst-address": "192.168.88.25",
-    "dst-port": "6667",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "tcp"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-nat-state": "!dstnat",
-    "connection-state": "new",
-    "in-interface-list": "WAN",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "allow",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "icmp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "accept",
-    "connection-state": "established",
-    "log": "no",
-    "log-prefix": ""
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "allow",
-    "dst-port": "500",
-    "protocol": "udp"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "Block",
-    "dst-port": "80,443",
-    "in-interface-list": "WAN",
-    "protocol": "tcp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "Allow",
-    "dst-port": "80,443",
-    "in-interface-list": "LAN",
-    "protocol": "tcp",
-    "src-address": "192.168.88.0/24"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Cloudflare"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "PaloAlto"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "drop",
-    "in-interface": "pppoe-out1",
-    "log": "no",
-    "log-prefix": ""
-  }
-]

app/reports/mikrotik/data/firewall_ipv6.json

@@ -1,186 +0,0 @@
-[
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "connection-state": "established,related,untracked"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "defconf:",
-    "connection-state": "invalid"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "port": "33434-33534",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "dst-port": "546",
-    "protocol": "udp",
-    "src-address": "fe80::/10"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "dst-port": "500,4500",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "ipsec-ah"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "protocol": "ipsec-esp"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "ipsec-policy": "in,ipsec"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "defconf:",
-    "in-interface-list": "!LAN"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "established,related,untracked"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "connection-state": "invalid"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "src-address-list": "bad_ipv6"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "dst-address-list": "bad_ipv6"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "hop-limit": "equal:1",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "ids",
-    "log": "no",
-    "log-prefix": "",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "defconf:",
-    "log": "no",
-    "log-prefix": "",
-    "protocol": "icmpv6"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "139"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "dst-port": "500,4500",
-    "protocol": "udp"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "ipsec-ah"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "protocol": "ipsec-esp"
-  },
-  {
-    "action": "accept",
-    "chain": "forward",
-    "comment": "defconf:",
-    "ipsec-policy": "in,ipsec"
-  },
-  {
-    "action": "drop",
-    "chain": "forward",
-    "comment": "defconf:",
-    "in-interface-list": "!LAN"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Openfactory"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Cloudflare"
-  },
-  {
-    "action": "accept",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "PaloAlto"
-  },
-  {
-    "action": "drop",
-    "chain": "input",
-    "comment": "ids",
-    "src-address-list": "Blocked"
-  }
-]

app/reports/npm/data/blocked_ipv4.txt

@@ -1,847 +0,0 @@
-2.57.122.173
-2.58.56.101
-3.27.206.50
-3.77.92.222
-3.79.41.12
-3.101.54.4
-3.107.107.18
-3.148.191.150
-3.237.185.144
-3.250.52.216
-4.184.121.217
-4.184.185.91
-4.184.238.149
-4.185.41.66
-4.193.178.28
-4.194.24.143
-4.204.201.85
-4.223.65.51
-4.223.71.149
-4.223.73.90
-4.223.77.241
-4.223.140.16
-4.223.171.122
-4.223.226.192
-4.225.166.222
-4.225.203.146
-4.232.147.36
-4.232.185.206
-4.232.188.49
-4.246.70.112
-5.161.62.209
-5.161.225.116
-5.253.247.16
-5.255.119.161
-8.221.104.113
-8.229.1.130
-8.229.130.50
-8.231.78.19
-8.234.207.247
-8.234.214.152
-8.235.114.162
-9.205.16.190
-13.57.15.41
-13.83.161.80
-13.126.86.18
-13.221.106.198
-16.146.99.254
-18.191.56.164
-18.227.73.7
-18.236.136.230
-20.9.4.9
-20.9.15.100
-20.9.44.210
-20.9.85.55
-20.12.214.177
-20.46.252.52
-20.48.234.177
-20.48.236.161
-20.52.54.143
-20.52.125.110
-20.55.86.49
-20.63.10.215
-20.63.63.128
-20.79.29.209
-20.91.140.156
-20.91.208.34
-20.91.239.158
-20.100.169.152
-20.100.173.28
-20.100.176.141
-20.100.178.92
-20.100.186.69
-20.100.187.246
-20.100.193.33
-20.100.203.84
-20.104.16.169
-20.104.18.253
-20.104.22.47
-20.104.96.117
-20.106.182.98
-20.113.56.22
-20.116.62.111
-20.119.205.224
-20.125.176.178
-20.127.18.0
-20.151.10.161
-20.151.200.100
-20.151.205.204
-20.151.225.23
-20.170.16.216
-20.171.55.167
-20.172.218.20
-20.184.150.240
-20.195.181.10
-20.196.209.159
-20.197.178.120
-20.197.192.193
-20.197.195.24
-20.198.114.210
-20.199.136.34
-20.199.181.219
-20.199.183.73
-20.200.216.126
-20.203.133.142
-20.203.135.57
-20.203.148.31
-20.203.200.218
-20.203.208.53
-20.203.209.227
-20.203.219.190
-20.203.221.142
-20.205.229.184
-20.206.67.15
-20.206.89.130
-20.206.105.145
-20.207.199.205
-20.208.40.114
-20.214.106.237
-20.215.69.57
-20.215.70.187
-20.215.186.32
-20.215.189.213
-20.215.191.139
-20.215.211.30
-20.215.211.95
-20.215.216.94
-20.215.218.234
-20.218.73.95
-20.220.15.170
-20.220.150.193
-20.220.225.223
-20.220.227.237
-20.226.5.174
-20.226.26.5
-20.226.60.151
-20.226.83.28
-20.226.90.242
-20.226.114.112
-20.230.47.94
-20.230.87.222
-20.240.44.115
-20.250.24.46
-20.251.48.84
-20.251.48.208
-20.251.58.190
-20.251.112.224
-23.94.155.57
-23.95.226.104
-23.102.123.231
-23.161.169.62
-23.161.169.127
-23.178.112.103
-23.178.112.104
-23.178.112.105
-23.178.112.106
-23.178.112.107
-23.178.112.108
-23.178.112.210
-23.178.112.211
-23.178.112.212
-23.178.112.213
-23.178.112.219
-23.180.120.134
-23.234.98.171
-24.144.85.55
-31.56.58.122
-31.56.58.124
-31.56.58.129
-31.56.58.134
-31.58.51.130
-31.59.129.193
-31.184.236.8
-34.7.160.235
-34.7.193.250
-34.11.108.163
-34.11.127.22
-34.12.130.245
-34.16.184.1
-34.17.159.73
-34.18.38.137
-34.21.144.169
-34.26.191.118
-34.31.88.250
-34.47.183.174
-34.47.194.183
-34.55.200.45
-34.64.173.205
-34.65.14.246
-34.65.18.71
-34.65.138.195
-34.69.107.154
-34.72.34.156
-34.73.128.17
-34.74.20.101
-34.75.4.161
-34.82.10.34
-34.85.55.146
-34.86.126.198
-34.86.217.208
-34.88.208.176
-34.90.87.32
-34.90.88.37
-34.91.243.226
-34.95.239.96
-34.105.30.251
-34.116.255.65
-34.118.184.2
-34.139.141.56
-34.145.62.28
-34.148.8.63
-34.154.122.183
-34.156.98.72
-34.158.83.192
-34.171.75.208
-34.175.82.8
-34.181.134.189
-34.186.83.134
-34.187.20.70
-34.187.82.183
-34.187.200.119
-34.242.226.103
-34.244.177.56
-35.157.251.190
-35.182.17.8
-35.184.157.121
-35.187.9.30
-35.192.232.168
-35.196.22.146
-35.198.180.224
-35.199.111.12
-35.199.115.51
-35.199.183.190
-35.201.159.247
-35.204.88.252
-35.204.141.252
-35.205.50.183
-35.230.52.27
-35.231.41.225
-35.231.100.82
-35.231.140.112
-35.237.138.104
-35.237.178.50
-35.243.173.211
-35.243.223.147
-35.255.40.65
-36.106.166.92
-36.106.166.223
-37.140.223.6
-37.140.223.58
-40.80.90.100
-41.143.154.1
-43.98.201.177
-43.228.157.102
-43.228.157.178
-43.228.157.191
-44.248.34.34
-44.251.113.120
-45.8.196.200
-45.45.237.69
-45.45.237.186
-45.45.237.214
-45.61.150.67
-45.61.187.30
-45.67.85.190
-45.88.138.44
-45.130.203.154
-45.130.203.177
-45.131.193.139
-45.131.195.127
-45.131.195.153
-45.131.195.175
-45.134.20.116
-45.134.20.128
-45.134.79.95
-45.139.104.172
-45.146.54.80
-45.146.54.137
-45.146.55.11
-45.146.55.48
-45.148.10.21
-45.148.10.62
-45.148.10.67
-45.148.10.95
-45.148.10.119
-45.148.10.120
-45.148.10.166
-45.148.10.194
-45.148.10.244
-45.148.10.247
-45.153.34.16
-45.153.34.43
-45.153.34.182
-45.154.98.52
-45.154.98.101
-45.154.98.134
-45.154.138.181
-45.154.138.232
-51.79.208.246
-51.103.133.211
-51.103.152.96
-51.107.190.246
-51.116.233.22
-51.120.79.193
-51.120.83.160
-51.143.162.98
-52.139.36.144
-52.165.196.84
-52.165.250.117
-52.167.144.160
-52.184.96.217
-52.225.25.48
-52.238.192.78
-52.242.193.144
-52.253.111.48
-54.82.69.43
-54.163.186.39
-54.169.103.174
-54.179.129.22
-54.206.147.115
-54.210.219.163
-54.216.227.171
-58.212.237.231
-62.60.130.128
-62.93.179.146
-64.23.218.208
-64.89.161.82
-64.89.161.85
-64.225.63.129
-65.0.122.218
-66.187.5.228
-66.187.6.102
-66.228.38.221
-66.249.74.164
-66.249.74.165
-68.183.9.16
-68.183.180.73
-68.221.69.72
-68.221.130.241
-68.221.137.211
-68.221.186.136
-69.30.85.194
-69.164.220.85
-69.164.220.232
-72.146.20.230
-74.7.227.43
-74.7.230.46
-74.7.241.46
-74.7.241.170
-74.248.20.32
-74.248.24.145
-74.248.35.25
-74.248.96.101
-74.248.97.169
-74.248.139.103
-74.249.245.134
-77.90.185.230
-80.91.86.169
-80.94.92.167
-80.94.92.206
-81.171.72.93
-81.171.72.135
-82.39.206.154
-82.102.18.116
-82.102.18.180
-82.102.18.182
-82.102.18.188
-82.102.18.190
-82.165.82.154
-84.17.60.251
-85.11.167.225
-85.121.54.40
-85.204.70.90
-85.204.70.92
-85.204.70.96
-85.204.70.98
-85.204.70.100
-85.204.70.102
-85.204.70.106
-85.204.70.112
-85.204.70.114
-85.204.70.116
-85.204.70.118
-87.121.79.42
-88.151.32.7
-88.184.210.4
-91.92.40.175
-91.92.41.115
-91.92.42.86
-91.92.47.101
-91.92.47.153
-91.92.241.196
-91.92.243.245
-91.124.88.29
-91.124.88.36
-91.134.35.95
-91.148.244.131
-91.148.245.81
-91.192.10.86
-91.193.232.61
-91.193.232.155
-91.193.232.168
-91.224.92.159
-91.224.92.190
-91.230.225.2
-91.230.225.186
-91.230.225.189
-91.230.225.192
-91.239.79.146
-91.239.157.185
-92.118.39.29
-92.118.39.126
-92.119.121.196
-93.123.109.10
-93.123.109.101
-93.123.109.152
-93.123.109.163
-93.123.109.165
-93.123.109.166
-93.123.109.167
-93.123.109.178
-93.152.221.13
-94.154.43.177
-94.154.43.178
-94.154.43.179
-94.154.43.183
-94.154.43.184
-94.154.43.185
-94.154.43.186
-94.154.43.187
-94.154.43.188
-94.154.43.229
-95.85.238.18
-96.126.130.210
-98.159.36.147
-98.159.37.147
-102.37.110.74
-103.76.88.36
-103.76.88.37
-103.86.108.230
-103.153.183.126
-103.168.66.237
-103.177.150.66
-103.215.75.19
-103.215.75.66
-103.221.220.62
-104.28.215.219
-104.28.215.220
-104.28.222.131
-104.28.240.187
-104.28.240.188
-104.28.240.189
-104.28.247.219
-104.28.247.220
-104.28.254.131
-104.28.254.134
-104.168.93.75
-104.196.62.35
-104.199.182.104
-104.208.94.19
-104.208.119.209
-104.234.19.67
-104.234.53.122
-104.234.53.134
-104.238.222.26
-104.248.5.228
-104.251.181.106
-106.63.26.7
-106.63.26.8
-106.63.26.21
-106.63.26.22
-107.170.9.103
-108.130.204.104
-110.179.80.63
-110.179.80.213
-110.179.81.90
-111.113.89.107
-112.94.252.15
-113.57.186.101
-117.14.153.168
-118.81.196.142
-118.81.207.202
-118.194.253.208
-118.212.120.78
-123.158.61.179
-123.160.175.254
-123.178.210.228
-124.88.113.10
-124.117.194.69
-128.90.128.13
-128.90.141.10
-128.199.182.55
-128.199.182.152
-130.12.180.39
-130.12.180.126
-130.12.182.12
-130.12.182.254
-130.131.231.171
-132.196.11.13
-132.196.83.33
-134.122.94.138
-134.199.148.147
-134.199.149.209
-134.209.185.72
-135.119.63.61
-135.119.74.228
-135.225.93.215
-135.232.177.160
-136.64.51.224
-136.66.128.85
-136.66.153.34
-136.70.149.147
-136.107.61.46
-136.107.208.33
-136.108.11.195
-136.109.87.37
-136.109.135.10
-136.110.80.8
-136.115.17.125
-136.117.218.95
-136.144.19.51
-136.144.33.102
-136.144.35.201
-136.144.43.127
-138.124.103.234
-138.197.34.12
-138.197.104.211
-138.197.191.87
-139.28.219.68
-139.28.219.70
-139.59.118.17
-139.59.231.238
-142.93.62.168
-142.93.155.36
-142.111.152.16
-142.111.152.57
-143.20.64.236
-143.110.178.165
-143.110.217.244
-143.198.6.225
-143.198.25.99
-143.244.57.84
-143.244.57.90
-143.244.57.92
-143.244.57.120
-143.244.57.121
-143.244.57.123
-143.244.168.161
-144.76.19.27
-144.126.207.57
-144.172.93.117
-144.172.97.164
-144.172.101.168
-144.172.114.107
-145.132.103.19
-146.70.40.68
-146.70.194.220
-146.70.194.228
-146.70.194.230
-146.70.194.252
-146.70.194.254
-146.190.63.48
-146.190.63.248
-146.190.83.166
-147.93.168.91
-147.93.169.103
-147.93.171.188
-147.182.149.75
-148.251.182.79
-149.56.150.98
-150.255.94.250
-152.39.198.115
-152.42.137.175
-152.53.242.93
-155.2.215.98
-157.143.3.35
-157.245.105.107
-157.245.113.227
-157.245.197.36
-157.245.204.205
-158.101.144.198
-158.158.32.226
-158.158.32.229
-158.158.36.150
-158.158.41.78
-158.158.41.79
-158.158.45.224
-158.158.76.106
-158.158.96.17
-158.158.105.63
-159.65.144.72
-159.89.12.166
-159.89.46.165
-159.89.97.19
-159.89.117.109
-159.89.123.252
-159.89.174.87
-159.203.13.62
-159.223.132.86
-160.179.166.222
-161.118.192.206
-161.118.251.181
-162.141.167.14
-162.243.79.174
-163.7.13.205
-164.90.169.163
-165.22.24.78
-165.22.147.152
-165.245.190.205
-167.71.0.47
-167.71.39.61
-167.86.82.167
-167.99.181.249
-167.99.182.39
-167.99.210.137
-167.172.31.131
-167.172.53.28
-167.172.192.26
-168.62.180.116
-168.144.83.150
-168.144.100.227
-168.144.106.212
-168.144.167.238
-168.144.174.42
-169.58.42.242
-170.64.144.116
-171.104.81.195
-172.86.122.106
-172.98.33.251
-172.161.0.2
-172.161.1.105
-172.170.254.20
-172.171.198.214
-172.196.32.64
-172.202.29.124
-172.202.37.160
-172.202.44.182
-172.202.95.21
-172.204.17.66
-172.212.171.144
-172.213.8.106
-172.213.27.135
-172.213.144.209
-172.213.155.173
-172.213.208.13
-172.213.208.20
-172.213.216.126
-172.213.225.181
-172.213.227.73
-172.213.232.128
-172.213.244.85
-172.232.175.132
-172.245.102.64
-173.239.240.222
-173.249.34.197
-176.65.132.38
-176.227.240.17
-176.227.240.61
-178.16.54.137
-178.62.196.238
-178.128.176.132
-179.43.134.114
-180.95.231.78
-185.34.70.228
-185.93.89.147
-185.93.89.167
-185.151.21.124
-185.177.72.5
-185.177.72.9
-185.177.72.10
-185.177.72.12
-185.177.72.13
-185.177.72.17
-185.177.72.22
-185.177.72.23
-185.177.72.24
-185.177.72.29
-185.177.72.30
-185.177.72.31
-185.177.72.38
-185.177.72.49
-185.177.72.52
-185.177.72.53
-185.177.72.54
-185.177.72.56
-185.177.72.58
-185.177.72.67
-185.177.72.68
-185.177.72.69
-185.177.72.70
-185.177.72.81
-185.177.72.100
-185.177.72.205
-185.192.71.2
-185.192.71.3
-185.192.71.5
-185.192.71.6
-185.192.71.13
-185.192.71.16
-185.192.71.76
-185.192.71.247
-185.223.152.40
-185.223.152.60
-185.223.152.103
-185.223.152.112
-185.223.152.126
-185.223.152.222
-185.238.231.167
-185.251.19.30
-188.166.245.173
-188.213.202.84
-188.213.202.113
-188.213.202.116
-188.213.202.121
-190.2.142.78
-191.96.11.173
-191.232.199.39
-191.235.102.147
-191.235.105.17
-191.237.250.106
-192.34.61.236
-192.133.77.14
-192.133.77.15
-192.133.77.16
-192.133.77.17
-192.133.77.18
-192.253.248.7
-192.253.248.142
-193.19.109.68
-193.19.109.122
-193.19.109.151
-193.31.28.80
-193.36.225.117
-193.36.225.133
-193.36.225.180
-193.37.32.17
-193.37.32.28
-193.37.32.45
-193.37.32.149
-193.37.32.157
-193.37.32.159
-193.37.33.55
-193.37.33.117
-193.37.33.251
-193.47.62.167
-193.47.62.168
-193.143.1.112
-193.148.56.148
-193.148.57.33
-193.149.176.55
-194.5.82.59
-194.5.82.61
-194.5.82.63
-194.5.82.87
-194.5.82.89
-194.5.82.92
-194.5.82.95
-194.5.82.98
-194.5.82.100
-194.5.82.104
-194.5.82.123
-194.5.82.141
-194.5.82.153
-194.26.192.156
-194.32.120.151
-194.156.79.68
-194.233.91.21
-195.178.110.31
-195.178.110.48
-195.178.110.72
-195.178.110.100
-195.178.110.104
-195.178.110.135
-195.178.110.155
-195.178.110.159
-195.178.110.199
-195.178.110.211
-195.178.110.223
-195.178.110.241
-198.98.52.229
-199.16.157.180
-199.16.157.181
-199.16.157.182
-199.16.157.183
-200.162.145.50
-200.162.145.220
-200.162.152.170
-201.78.128.89
-203.159.90.217
-203.159.90.218
-206.81.12.187
-206.81.24.227
-206.189.19.19
-206.189.95.232
-207.154.197.113
-207.241.173.229
-208.84.102.195
-209.87.169.142
-209.87.169.148
-209.99.189.152
-209.99.189.160
-209.99.189.190
-209.99.190.99
-209.99.190.126
-209.126.2.173
-212.32.69.236
-213.35.113.47
-213.111.158.220
-216.24.210.46
-216.24.212.14
-216.24.212.43
-216.24.212.45
-216.24.212.233
-216.24.212.243
-216.73.163.119
-216.73.163.122
-216.73.163.132
-216.73.163.138
-216.73.163.148
-216.73.216.10
-216.73.216.24
-216.73.216.25
-216.73.216.41
-216.73.216.52
-216.73.216.66
-216.73.216.67
-216.73.216.91
-216.73.216.98
-216.73.216.114
-216.73.216.133
-216.73.216.140
-216.73.216.209
-216.73.216.229
-216.73.216.230
-216.73.216.244
-216.73.217.11
-216.73.217.13
-216.73.217.54
-216.73.217.87
-216.73.217.121
-216.73.217.145
-216.73.217.173
-216.73.217.176
-216.81.248.20
-217.156.123.33
-217.217.252.197
-220.202.112.100
-223.199.187.171

app/reports/npm/data/blocked_ipv6.txt

@@ -1,41 +0,0 @@
-2001:ba0:24c:a500::1
-2001:4ca0:108:42::24
-2400:8901::2000:62ff:fe9a:e1c2
-2406:da18:525:0:a23e:e8f6:3ea1:4c2c
-2600:3000:1305:4212::81
-2600:3000:1305:4212::82
-2600:3000:1305:4212::83
-2600:3000:1305:4212::84
-2600:3000:1305:4212::85
-2600:3000:2710:200::81
-2600:3000:2710:200::82
-2600:3000:2710:200::83
-2600:3000:2710:200::84
-2600:3000:2710:200::85
-2600:3000:2710:200::86
-2600:3c09::2000:5cff:fe99:c802
-2600:3c15::2000:53ff:fe31:8c0b
-2600:3c15::2000:9cff:fef0:8ad6
-2602:fa59:10:4c9::1
-2602:fa59:10:a3a::1
-2602:fa59:10:e70::1
-2a00:6340:2008:ec80:64cc:9116:beb2:1931
-2a00:6340:2008:ec80:be24:11ff:fe3b:4058
-2a00:6340:2008:ec80:be24:11ff:fe82:2775
-2a01:2a8:a0dd:1::1012
-2a01:4f8:c014:7f9e::1
-2a04:4e40:e000:0:33c:a689:be95:5a4
-2a04:4e40:e000:0:566:f8d7:adbe:f536
-2a04:4e40:e000:0:954:9789:20b1:d5fc
-2a04:4e40:e000:0:bfc:4b0:174b:d52d
-2a04:c300::3ce
-2a04:c300:400::58
-2a04:c300:400::5d
-2a04:c300:400::99
-2a05:4140:3::37cd
-2a09:bac1:76c0:460::5e:6a
-2a09:bac5:55fb:18c8::278:a7
-2a09:bac5:9443:3af::5e:4d
-2a09:bac5:9443:3af::5e:88
-2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9
-2a13:adc0::2ed:89ff:fe58:19c5

app/reports/npm/data/host_summary.csv

@@ -1,23 +0,0 @@
-host,count
-pbs.allucanget.biz,43743
-s.allucanget.biz,42014
-coolify.allucanget.biz,41829
-wagnerloibner.com,37046
-git.allucanget.biz,25376
-openmicodyssey.com,25325
-copyparty.allucanget.biz,18117
-openwebui.allucanget.biz,14539
-contact.allucanget.biz,10770
-ai.allucanget.biz,9799
-contact.wagnerloibner.com,9592
-admin.openmicodyssey.com,8974
-www.openmicodyssey.com,8386
-api.openmicodyssey.com,4598
-tcv.allucanget.biz,2557
-cam.openmicodyssey.com,2468
-linearvoid.tv,1951
-lounge.allucanget.biz,1745
-code.allucanget.biz,788
-www.wagnerloibner.com,326
-m.allucanget.biz,242
-postiz.allucanget.biz,78

app/reports/npm/data/mikrotik-block.rsc

@@ -1,959 +0,0 @@
-# npm-ids firewall export - generated 2026-08-11T11:44:47
-
-# Openfactory IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=Openfactory address=5.226.144.0/21
-
-# Cloudflare IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=Cloudflare address=173.245.48.0/20
-add list=Cloudflare address=103.21.244.0/22
-add list=Cloudflare address=103.22.200.0/22
-add list=Cloudflare address=103.31.4.0/22
-add list=Cloudflare address=141.101.64.0/18
-add list=Cloudflare address=108.162.192.0/18
-add list=Cloudflare address=190.93.240.0/20
-add list=Cloudflare address=188.114.96.0/20
-add list=Cloudflare address=197.234.240.0/22
-add list=Cloudflare address=198.41.128.0/17
-add list=Cloudflare address=162.158.0.0/15
-add list=Cloudflare address=104.16.0.0/13
-add list=Cloudflare address=104.24.0.0/14
-add list=Cloudflare address=172.64.0.0/13
-add list=Cloudflare address=131.0.72.0/22
-
-# Cloudflare IPv6 ranges (whitelisted)
-/ipv6 firewall address-list
-add list=Cloudflare address=2400:cb00::/32
-add list=Cloudflare address=2606:4700::/32
-add list=Cloudflare address=2803:f800::/32
-add list=Cloudflare address=2405:b500::/32
-add list=Cloudflare address=2405:8100::/32
-add list=Cloudflare address=2a06:98c0::/29
-add list=Cloudflare address=2c0f:f248::/32
-
-# PaloAlto IPv4 ranges (whitelisted)
-/ip firewall address-list
-add list=PaloAlto address=35.203.210.0/23
-add list=PaloAlto address=144.86.173.0/24
-add list=PaloAlto address=147.185.132.0/23
-add list=PaloAlto address=162.216.149.0/24
-add list=PaloAlto address=162.216.150.0/24
-add list=PaloAlto address=172.105.147.0/24
-add list=PaloAlto address=198.235.24.0/24
-add list=PaloAlto address=205.210.31.0/24
-add list=PaloAlto address=216.25.88.0/21
-
-# PaloAlto IPv6 ranges (whitelisted)
-/ipv6 firewall address-list
-add list=PaloAlto address=2604:a940:300:5b6::/64
-add list=PaloAlto address=2604:a940:301:225::/64
-add list=PaloAlto address=2604:a940:302:118::/64
-
-# Blocked IPv4 (847, non-whitelisted)
-/ip firewall address-list
-add list=Blocked address=2.57.122.173
-add list=Blocked address=2.58.56.101
-add list=Blocked address=3.27.206.50
-add list=Blocked address=3.77.92.222
-add list=Blocked address=3.79.41.12
-add list=Blocked address=3.101.54.4
-add list=Blocked address=3.107.107.18
-add list=Blocked address=3.148.191.150
-add list=Blocked address=3.237.185.144
-add list=Blocked address=3.250.52.216
-add list=Blocked address=4.184.121.217
-add list=Blocked address=4.184.185.91
-add list=Blocked address=4.184.238.149
-add list=Blocked address=4.185.41.66
-add list=Blocked address=4.193.178.28
-add list=Blocked address=4.194.24.143
-add list=Blocked address=4.204.201.85
-add list=Blocked address=4.223.65.51
-add list=Blocked address=4.223.71.149
-add list=Blocked address=4.223.73.90
-add list=Blocked address=4.223.77.241
-add list=Blocked address=4.223.140.16
-add list=Blocked address=4.223.171.122
-add list=Blocked address=4.223.226.192
-add list=Blocked address=4.225.166.222
-add list=Blocked address=4.225.203.146
-add list=Blocked address=4.232.147.36
-add list=Blocked address=4.232.185.206
-add list=Blocked address=4.232.188.49
-add list=Blocked address=4.246.70.112
-add list=Blocked address=5.161.62.209
-add list=Blocked address=5.161.225.116
-add list=Blocked address=5.253.247.16
-add list=Blocked address=5.255.119.161
-add list=Blocked address=8.221.104.113
-add list=Blocked address=8.229.1.130
-add list=Blocked address=8.229.130.50
-add list=Blocked address=8.231.78.19
-add list=Blocked address=8.234.207.247
-add list=Blocked address=8.234.214.152
-add list=Blocked address=8.235.114.162
-add list=Blocked address=9.205.16.190
-add list=Blocked address=13.57.15.41
-add list=Blocked address=13.83.161.80
-add list=Blocked address=13.126.86.18
-add list=Blocked address=13.221.106.198
-add list=Blocked address=16.146.99.254
-add list=Blocked address=18.191.56.164
-add list=Blocked address=18.227.73.7
-add list=Blocked address=18.236.136.230
-add list=Blocked address=20.9.4.9
-add list=Blocked address=20.9.15.100
-add list=Blocked address=20.9.44.210
-add list=Blocked address=20.9.85.55
-add list=Blocked address=20.12.214.177
-add list=Blocked address=20.46.252.52
-add list=Blocked address=20.48.234.177
-add list=Blocked address=20.48.236.161
-add list=Blocked address=20.52.54.143
-add list=Blocked address=20.52.125.110
-add list=Blocked address=20.55.86.49
-add list=Blocked address=20.63.10.215
-add list=Blocked address=20.63.63.128
-add list=Blocked address=20.79.29.209
-add list=Blocked address=20.91.140.156
-add list=Blocked address=20.91.208.34
-add list=Blocked address=20.91.239.158
-add list=Blocked address=20.100.169.152
-add list=Blocked address=20.100.173.28
-add list=Blocked address=20.100.176.141
-add list=Blocked address=20.100.178.92
-add list=Blocked address=20.100.186.69
-add list=Blocked address=20.100.187.246
-add list=Blocked address=20.100.193.33
-add list=Blocked address=20.100.203.84
-add list=Blocked address=20.104.16.169
-add list=Blocked address=20.104.18.253
-add list=Blocked address=20.104.22.47
-add list=Blocked address=20.104.96.117
-add list=Blocked address=20.106.182.98
-add list=Blocked address=20.113.56.22
-add list=Blocked address=20.116.62.111
-add list=Blocked address=20.119.205.224
-add list=Blocked address=20.125.176.178
-add list=Blocked address=20.127.18.0
-add list=Blocked address=20.151.10.161
-add list=Blocked address=20.151.200.100
-add list=Blocked address=20.151.205.204
-add list=Blocked address=20.151.225.23
-add list=Blocked address=20.170.16.216
-add list=Blocked address=20.171.55.167
-add list=Blocked address=20.172.218.20
-add list=Blocked address=20.184.150.240
-add list=Blocked address=20.195.181.10
-add list=Blocked address=20.196.209.159
-add list=Blocked address=20.197.178.120
-add list=Blocked address=20.197.192.193
-add list=Blocked address=20.197.195.24
-add list=Blocked address=20.198.114.210
-add list=Blocked address=20.199.136.34
-add list=Blocked address=20.199.181.219
-add list=Blocked address=20.199.183.73
-add list=Blocked address=20.200.216.126
-add list=Blocked address=20.203.133.142
-add list=Blocked address=20.203.135.57
-add list=Blocked address=20.203.148.31
-add list=Blocked address=20.203.200.218
-add list=Blocked address=20.203.208.53
-add list=Blocked address=20.203.209.227
-add list=Blocked address=20.203.219.190
-add list=Blocked address=20.203.221.142
-add list=Blocked address=20.205.229.184
-add list=Blocked address=20.206.67.15
-add list=Blocked address=20.206.89.130
-add list=Blocked address=20.206.105.145
-add list=Blocked address=20.207.199.205
-add list=Blocked address=20.208.40.114
-add list=Blocked address=20.214.106.237
-add list=Blocked address=20.215.69.57
-add list=Blocked address=20.215.70.187
-add list=Blocked address=20.215.186.32
-add list=Blocked address=20.215.189.213
-add list=Blocked address=20.215.191.139
-add list=Blocked address=20.215.211.30
-add list=Blocked address=20.215.211.95
-add list=Blocked address=20.215.216.94
-add list=Blocked address=20.215.218.234
-add list=Blocked address=20.218.73.95
-add list=Blocked address=20.220.15.170
-add list=Blocked address=20.220.150.193
-add list=Blocked address=20.220.225.223
-add list=Blocked address=20.220.227.237
-add list=Blocked address=20.226.5.174
-add list=Blocked address=20.226.26.5
-add list=Blocked address=20.226.60.151
-add list=Blocked address=20.226.83.28
-add list=Blocked address=20.226.90.242
-add list=Blocked address=20.226.114.112
-add list=Blocked address=20.230.47.94
-add list=Blocked address=20.230.87.222
-add list=Blocked address=20.240.44.115
-add list=Blocked address=20.250.24.46
-add list=Blocked address=20.251.48.84
-add list=Blocked address=20.251.48.208
-add list=Blocked address=20.251.58.190
-add list=Blocked address=20.251.112.224
-add list=Blocked address=23.94.155.57
-add list=Blocked address=23.95.226.104
-add list=Blocked address=23.102.123.231
-add list=Blocked address=23.161.169.62
-add list=Blocked address=23.161.169.127
-add list=Blocked address=23.178.112.103
-add list=Blocked address=23.178.112.104
-add list=Blocked address=23.178.112.105
-add list=Blocked address=23.178.112.106
-add list=Blocked address=23.178.112.107
-add list=Blocked address=23.178.112.108
-add list=Blocked address=23.178.112.210
-add list=Blocked address=23.178.112.211
-add list=Blocked address=23.178.112.212
-add list=Blocked address=23.178.112.213
-add list=Blocked address=23.178.112.219
-add list=Blocked address=23.180.120.134
-add list=Blocked address=23.234.98.171
-add list=Blocked address=24.144.85.55
-add list=Blocked address=31.56.58.122
-add list=Blocked address=31.56.58.124
-add list=Blocked address=31.56.58.129
-add list=Blocked address=31.56.58.134
-add list=Blocked address=31.58.51.130
-add list=Blocked address=31.59.129.193
-add list=Blocked address=31.184.236.8
-add list=Blocked address=34.7.160.235
-add list=Blocked address=34.7.193.250
-add list=Blocked address=34.11.108.163
-add list=Blocked address=34.11.127.22
-add list=Blocked address=34.12.130.245
-add list=Blocked address=34.16.184.1
-add list=Blocked address=34.17.159.73
-add list=Blocked address=34.18.38.137
-add list=Blocked address=34.21.144.169
-add list=Blocked address=34.26.191.118
-add list=Blocked address=34.31.88.250
-add list=Blocked address=34.47.183.174
-add list=Blocked address=34.47.194.183
-add list=Blocked address=34.55.200.45
-add list=Blocked address=34.64.173.205
-add list=Blocked address=34.65.14.246
-add list=Blocked address=34.65.18.71
-add list=Blocked address=34.65.138.195
-add list=Blocked address=34.69.107.154
-add list=Blocked address=34.72.34.156
-add list=Blocked address=34.73.128.17
-add list=Blocked address=34.74.20.101
-add list=Blocked address=34.75.4.161
-add list=Blocked address=34.82.10.34
-add list=Blocked address=34.85.55.146
-add list=Blocked address=34.86.126.198
-add list=Blocked address=34.86.217.208
-add list=Blocked address=34.88.208.176
-add list=Blocked address=34.90.87.32
-add list=Blocked address=34.90.88.37
-add list=Blocked address=34.91.243.226
-add list=Blocked address=34.95.239.96
-add list=Blocked address=34.105.30.251
-add list=Blocked address=34.116.255.65
-add list=Blocked address=34.118.184.2
-add list=Blocked address=34.139.141.56
-add list=Blocked address=34.145.62.28
-add list=Blocked address=34.148.8.63
-add list=Blocked address=34.154.122.183
-add list=Blocked address=34.156.98.72
-add list=Blocked address=34.158.83.192
-add list=Blocked address=34.171.75.208
-add list=Blocked address=34.175.82.8
-add list=Blocked address=34.181.134.189
-add list=Blocked address=34.186.83.134
-add list=Blocked address=34.187.20.70
-add list=Blocked address=34.187.82.183
-add list=Blocked address=34.187.200.119
-add list=Blocked address=34.242.226.103
-add list=Blocked address=34.244.177.56
-add list=Blocked address=35.157.251.190
-add list=Blocked address=35.182.17.8
-add list=Blocked address=35.184.157.121
-add list=Blocked address=35.187.9.30
-add list=Blocked address=35.192.232.168
-add list=Blocked address=35.196.22.146
-add list=Blocked address=35.198.180.224
-add list=Blocked address=35.199.111.12
-add list=Blocked address=35.199.115.51
-add list=Blocked address=35.199.183.190
-add list=Blocked address=35.201.159.247
-add list=Blocked address=35.204.88.252
-add list=Blocked address=35.204.141.252
-add list=Blocked address=35.205.50.183
-add list=Blocked address=35.230.52.27
-add list=Blocked address=35.231.41.225
-add list=Blocked address=35.231.100.82
-add list=Blocked address=35.231.140.112
-add list=Blocked address=35.237.138.104
-add list=Blocked address=35.237.178.50
-add list=Blocked address=35.243.173.211
-add list=Blocked address=35.243.223.147
-add list=Blocked address=35.255.40.65
-add list=Blocked address=36.106.166.92
-add list=Blocked address=36.106.166.223
-add list=Blocked address=37.140.223.6
-add list=Blocked address=37.140.223.58
-add list=Blocked address=40.80.90.100
-add list=Blocked address=41.143.154.1
-add list=Blocked address=43.98.201.177
-add list=Blocked address=43.228.157.102
-add list=Blocked address=43.228.157.178
-add list=Blocked address=43.228.157.191
-add list=Blocked address=44.248.34.34
-add list=Blocked address=44.251.113.120
-add list=Blocked address=45.8.196.200
-add list=Blocked address=45.45.237.69
-add list=Blocked address=45.45.237.186
-add list=Blocked address=45.45.237.214
-add list=Blocked address=45.61.150.67
-add list=Blocked address=45.61.187.30
-add list=Blocked address=45.67.85.190
-add list=Blocked address=45.88.138.44
-add list=Blocked address=45.130.203.154
-add list=Blocked address=45.130.203.177
-add list=Blocked address=45.131.193.139
-add list=Blocked address=45.131.195.127
-add list=Blocked address=45.131.195.153
-add list=Blocked address=45.131.195.175
-add list=Blocked address=45.134.20.116
-add list=Blocked address=45.134.20.128
-add list=Blocked address=45.134.79.95
-add list=Blocked address=45.139.104.172
-add list=Blocked address=45.146.54.80
-add list=Blocked address=45.146.54.137
-add list=Blocked address=45.146.55.11
-add list=Blocked address=45.146.55.48
-add list=Blocked address=45.148.10.21
-add list=Blocked address=45.148.10.62
-add list=Blocked address=45.148.10.67
-add list=Blocked address=45.148.10.95
-add list=Blocked address=45.148.10.119
-add list=Blocked address=45.148.10.120
-add list=Blocked address=45.148.10.166
-add list=Blocked address=45.148.10.194
-add list=Blocked address=45.148.10.244
-add list=Blocked address=45.148.10.247
-add list=Blocked address=45.153.34.16
-add list=Blocked address=45.153.34.43
-add list=Blocked address=45.153.34.182
-add list=Blocked address=45.154.98.52
-add list=Blocked address=45.154.98.101
-add list=Blocked address=45.154.98.134
-add list=Blocked address=45.154.138.181
-add list=Blocked address=45.154.138.232
-add list=Blocked address=51.79.208.246
-add list=Blocked address=51.103.133.211
-add list=Blocked address=51.103.152.96
-add list=Blocked address=51.107.190.246
-add list=Blocked address=51.116.233.22
-add list=Blocked address=51.120.79.193
-add list=Blocked address=51.120.83.160
-add list=Blocked address=51.143.162.98
-add list=Blocked address=52.139.36.144
-add list=Blocked address=52.165.196.84
-add list=Blocked address=52.165.250.117
-add list=Blocked address=52.167.144.160
-add list=Blocked address=52.184.96.217
-add list=Blocked address=52.225.25.48
-add list=Blocked address=52.238.192.78
-add list=Blocked address=52.242.193.144
-add list=Blocked address=52.253.111.48
-add list=Blocked address=54.82.69.43
-add list=Blocked address=54.163.186.39
-add list=Blocked address=54.169.103.174
-add list=Blocked address=54.179.129.22
-add list=Blocked address=54.206.147.115
-add list=Blocked address=54.210.219.163
-add list=Blocked address=54.216.227.171
-add list=Blocked address=58.212.237.231
-add list=Blocked address=62.60.130.128
-add list=Blocked address=62.93.179.146
-add list=Blocked address=64.23.218.208
-add list=Blocked address=64.89.161.82
-add list=Blocked address=64.89.161.85
-add list=Blocked address=64.225.63.129
-add list=Blocked address=65.0.122.218
-add list=Blocked address=66.187.5.228
-add list=Blocked address=66.187.6.102
-add list=Blocked address=66.228.38.221
-add list=Blocked address=66.249.74.164
-add list=Blocked address=66.249.74.165
-add list=Blocked address=68.183.9.16
-add list=Blocked address=68.183.180.73
-add list=Blocked address=68.221.69.72
-add list=Blocked address=68.221.130.241
-add list=Blocked address=68.221.137.211
-add list=Blocked address=68.221.186.136
-add list=Blocked address=69.30.85.194
-add list=Blocked address=69.164.220.85
-add list=Blocked address=69.164.220.232
-add list=Blocked address=72.146.20.230
-add list=Blocked address=74.7.227.43
-add list=Blocked address=74.7.230.46
-add list=Blocked address=74.7.241.46
-add list=Blocked address=74.7.241.170
-add list=Blocked address=74.248.20.32
-add list=Blocked address=74.248.24.145
-add list=Blocked address=74.248.35.25
-add list=Blocked address=74.248.96.101
-add list=Blocked address=74.248.97.169
-add list=Blocked address=74.248.139.103
-add list=Blocked address=74.249.245.134
-add list=Blocked address=77.90.185.230
-add list=Blocked address=80.91.86.169
-add list=Blocked address=80.94.92.167
-add list=Blocked address=80.94.92.206
-add list=Blocked address=81.171.72.93
-add list=Blocked address=81.171.72.135
-add list=Blocked address=82.39.206.154
-add list=Blocked address=82.102.18.116
-add list=Blocked address=82.102.18.180
-add list=Blocked address=82.102.18.182
-add list=Blocked address=82.102.18.188
-add list=Blocked address=82.102.18.190
-add list=Blocked address=82.165.82.154
-add list=Blocked address=84.17.60.251
-add list=Blocked address=85.11.167.225
-add list=Blocked address=85.121.54.40
-add list=Blocked address=85.204.70.90
-add list=Blocked address=85.204.70.92
-add list=Blocked address=85.204.70.96
-add list=Blocked address=85.204.70.98
-add list=Blocked address=85.204.70.100
-add list=Blocked address=85.204.70.102
-add list=Blocked address=85.204.70.106
-add list=Blocked address=85.204.70.112
-add list=Blocked address=85.204.70.114
-add list=Blocked address=85.204.70.116
-add list=Blocked address=85.204.70.118
-add list=Blocked address=87.121.79.42
-add list=Blocked address=88.151.32.7
-add list=Blocked address=88.184.210.4
-add list=Blocked address=91.92.40.175
-add list=Blocked address=91.92.41.115
-add list=Blocked address=91.92.42.86
-add list=Blocked address=91.92.47.101
-add list=Blocked address=91.92.47.153
-add list=Blocked address=91.92.241.196
-add list=Blocked address=91.92.243.245
-add list=Blocked address=91.124.88.29
-add list=Blocked address=91.124.88.36
-add list=Blocked address=91.134.35.95
-add list=Blocked address=91.148.244.131
-add list=Blocked address=91.148.245.81
-add list=Blocked address=91.192.10.86
-add list=Blocked address=91.193.232.61
-add list=Blocked address=91.193.232.155
-add list=Blocked address=91.193.232.168
-add list=Blocked address=91.224.92.159
-add list=Blocked address=91.224.92.190
-add list=Blocked address=91.230.225.2
-add list=Blocked address=91.230.225.186
-add list=Blocked address=91.230.225.189
-add list=Blocked address=91.230.225.192
-add list=Blocked address=91.239.79.146
-add list=Blocked address=91.239.157.185
-add list=Blocked address=92.118.39.29
-add list=Blocked address=92.118.39.126
-add list=Blocked address=92.119.121.196
-add list=Blocked address=93.123.109.10
-add list=Blocked address=93.123.109.101
-add list=Blocked address=93.123.109.152
-add list=Blocked address=93.123.109.163
-add list=Blocked address=93.123.109.165
-add list=Blocked address=93.123.109.166
-add list=Blocked address=93.123.109.167
-add list=Blocked address=93.123.109.178
-add list=Blocked address=93.152.221.13
-add list=Blocked address=94.154.43.177
-add list=Blocked address=94.154.43.178
-add list=Blocked address=94.154.43.179
-add list=Blocked address=94.154.43.183
-add list=Blocked address=94.154.43.184
-add list=Blocked address=94.154.43.185
-add list=Blocked address=94.154.43.186
-add list=Blocked address=94.154.43.187
-add list=Blocked address=94.154.43.188
-add list=Blocked address=94.154.43.229
-add list=Blocked address=95.85.238.18
-add list=Blocked address=96.126.130.210
-add list=Blocked address=98.159.36.147
-add list=Blocked address=98.159.37.147
-add list=Blocked address=102.37.110.74
-add list=Blocked address=103.76.88.36
-add list=Blocked address=103.76.88.37
-add list=Blocked address=103.86.108.230
-add list=Blocked address=103.153.183.126
-add list=Blocked address=103.168.66.237
-add list=Blocked address=103.177.150.66
-add list=Blocked address=103.215.75.19
-add list=Blocked address=103.215.75.66
-add list=Blocked address=103.221.220.62
-add list=Blocked address=104.28.215.219
-add list=Blocked address=104.28.215.220
-add list=Blocked address=104.28.222.131
-add list=Blocked address=104.28.240.187
-add list=Blocked address=104.28.240.188
-add list=Blocked address=104.28.240.189
-add list=Blocked address=104.28.247.219
-add list=Blocked address=104.28.247.220
-add list=Blocked address=104.28.254.131
-add list=Blocked address=104.28.254.134
-add list=Blocked address=104.168.93.75
-add list=Blocked address=104.196.62.35
-add list=Blocked address=104.199.182.104
-add list=Blocked address=104.208.94.19
-add list=Blocked address=104.208.119.209
-add list=Blocked address=104.234.19.67
-add list=Blocked address=104.234.53.122
-add list=Blocked address=104.234.53.134
-add list=Blocked address=104.238.222.26
-add list=Blocked address=104.248.5.228
-add list=Blocked address=104.251.181.106
-add list=Blocked address=106.63.26.7
-add list=Blocked address=106.63.26.8
-add list=Blocked address=106.63.26.21
-add list=Blocked address=106.63.26.22
-add list=Blocked address=107.170.9.103
-add list=Blocked address=108.130.204.104
-add list=Blocked address=110.179.80.63
-add list=Blocked address=110.179.80.213
-add list=Blocked address=110.179.81.90
-add list=Blocked address=111.113.89.107
-add list=Blocked address=112.94.252.15
-add list=Blocked address=113.57.186.101
-add list=Blocked address=117.14.153.168
-add list=Blocked address=118.81.196.142
-add list=Blocked address=118.81.207.202
-add list=Blocked address=118.194.253.208
-add list=Blocked address=118.212.120.78
-add list=Blocked address=123.158.61.179
-add list=Blocked address=123.160.175.254
-add list=Blocked address=123.178.210.228
-add list=Blocked address=124.88.113.10
-add list=Blocked address=124.117.194.69
-add list=Blocked address=128.90.128.13
-add list=Blocked address=128.90.141.10
-add list=Blocked address=128.199.182.55
-add list=Blocked address=128.199.182.152
-add list=Blocked address=130.12.180.39
-add list=Blocked address=130.12.180.126
-add list=Blocked address=130.12.182.12
-add list=Blocked address=130.12.182.254
-add list=Blocked address=130.131.231.171
-add list=Blocked address=132.196.11.13
-add list=Blocked address=132.196.83.33
-add list=Blocked address=134.122.94.138
-add list=Blocked address=134.199.148.147
-add list=Blocked address=134.199.149.209
-add list=Blocked address=134.209.185.72
-add list=Blocked address=135.119.63.61
-add list=Blocked address=135.119.74.228
-add list=Blocked address=135.225.93.215
-add list=Blocked address=135.232.177.160
-add list=Blocked address=136.64.51.224
-add list=Blocked address=136.66.128.85
-add list=Blocked address=136.66.153.34
-add list=Blocked address=136.70.149.147
-add list=Blocked address=136.107.61.46
-add list=Blocked address=136.107.208.33
-add list=Blocked address=136.108.11.195
-add list=Blocked address=136.109.87.37
-add list=Blocked address=136.109.135.10
-add list=Blocked address=136.110.80.8
-add list=Blocked address=136.115.17.125
-add list=Blocked address=136.117.218.95
-add list=Blocked address=136.144.19.51
-add list=Blocked address=136.144.33.102
-add list=Blocked address=136.144.35.201
-add list=Blocked address=136.144.43.127
-add list=Blocked address=138.124.103.234
-add list=Blocked address=138.197.34.12
-add list=Blocked address=138.197.104.211
-add list=Blocked address=138.197.191.87
-add list=Blocked address=139.28.219.68
-add list=Blocked address=139.28.219.70
-add list=Blocked address=139.59.118.17
-add list=Blocked address=139.59.231.238
-add list=Blocked address=142.93.62.168
-add list=Blocked address=142.93.155.36
-add list=Blocked address=142.111.152.16
-add list=Blocked address=142.111.152.57
-add list=Blocked address=143.20.64.236
-add list=Blocked address=143.110.178.165
-add list=Blocked address=143.110.217.244
-add list=Blocked address=143.198.6.225
-add list=Blocked address=143.198.25.99
-add list=Blocked address=143.244.57.84
-add list=Blocked address=143.244.57.90
-add list=Blocked address=143.244.57.92
-add list=Blocked address=143.244.57.120
-add list=Blocked address=143.244.57.121
-add list=Blocked address=143.244.57.123
-add list=Blocked address=143.244.168.161
-add list=Blocked address=144.76.19.27
-add list=Blocked address=144.126.207.57
-add list=Blocked address=144.172.93.117
-add list=Blocked address=144.172.97.164
-add list=Blocked address=144.172.101.168
-add list=Blocked address=144.172.114.107
-add list=Blocked address=145.132.103.19
-add list=Blocked address=146.70.40.68
-add list=Blocked address=146.70.194.220
-add list=Blocked address=146.70.194.228
-add list=Blocked address=146.70.194.230
-add list=Blocked address=146.70.194.252
-add list=Blocked address=146.70.194.254
-add list=Blocked address=146.190.63.48
-add list=Blocked address=146.190.63.248
-add list=Blocked address=146.190.83.166
-add list=Blocked address=147.93.168.91
-add list=Blocked address=147.93.169.103
-add list=Blocked address=147.93.171.188
-add list=Blocked address=147.182.149.75
-add list=Blocked address=148.251.182.79
-add list=Blocked address=149.56.150.98
-add list=Blocked address=150.255.94.250
-add list=Blocked address=152.39.198.115
-add list=Blocked address=152.42.137.175
-add list=Blocked address=152.53.242.93
-add list=Blocked address=155.2.215.98
-add list=Blocked address=157.143.3.35
-add list=Blocked address=157.245.105.107
-add list=Blocked address=157.245.113.227
-add list=Blocked address=157.245.197.36
-add list=Blocked address=157.245.204.205
-add list=Blocked address=158.101.144.198
-add list=Blocked address=158.158.32.226
-add list=Blocked address=158.158.32.229
-add list=Blocked address=158.158.36.150
-add list=Blocked address=158.158.41.78
-add list=Blocked address=158.158.41.79
-add list=Blocked address=158.158.45.224
-add list=Blocked address=158.158.76.106
-add list=Blocked address=158.158.96.17
-add list=Blocked address=158.158.105.63
-add list=Blocked address=159.65.144.72
-add list=Blocked address=159.89.12.166
-add list=Blocked address=159.89.46.165
-add list=Blocked address=159.89.97.19
-add list=Blocked address=159.89.117.109
-add list=Blocked address=159.89.123.252
-add list=Blocked address=159.89.174.87
-add list=Blocked address=159.203.13.62
-add list=Blocked address=159.223.132.86
-add list=Blocked address=160.179.166.222
-add list=Blocked address=161.118.192.206
-add list=Blocked address=161.118.251.181
-add list=Blocked address=162.141.167.14
-add list=Blocked address=162.243.79.174
-add list=Blocked address=163.7.13.205
-add list=Blocked address=164.90.169.163
-add list=Blocked address=165.22.24.78
-add list=Blocked address=165.22.147.152
-add list=Blocked address=165.245.190.205
-add list=Blocked address=167.71.0.47
-add list=Blocked address=167.71.39.61
-add list=Blocked address=167.86.82.167
-add list=Blocked address=167.99.181.249
-add list=Blocked address=167.99.182.39
-add list=Blocked address=167.99.210.137
-add list=Blocked address=167.172.31.131
-add list=Blocked address=167.172.53.28
-add list=Blocked address=167.172.192.26
-add list=Blocked address=168.62.180.116
-add list=Blocked address=168.144.83.150
-add list=Blocked address=168.144.100.227
-add list=Blocked address=168.144.106.212
-add list=Blocked address=168.144.167.238
-add list=Blocked address=168.144.174.42
-add list=Blocked address=169.58.42.242
-add list=Blocked address=170.64.144.116
-add list=Blocked address=171.104.81.195
-add list=Blocked address=172.86.122.106
-add list=Blocked address=172.98.33.251
-add list=Blocked address=172.161.0.2
-add list=Blocked address=172.161.1.105
-add list=Blocked address=172.170.254.20
-add list=Blocked address=172.171.198.214
-add list=Blocked address=172.196.32.64
-add list=Blocked address=172.202.29.124
-add list=Blocked address=172.202.37.160
-add list=Blocked address=172.202.44.182
-add list=Blocked address=172.202.95.21
-add list=Blocked address=172.204.17.66
-add list=Blocked address=172.212.171.144
-add list=Blocked address=172.213.8.106
-add list=Blocked address=172.213.27.135
-add list=Blocked address=172.213.144.209
-add list=Blocked address=172.213.155.173
-add list=Blocked address=172.213.208.13
-add list=Blocked address=172.213.208.20
-add list=Blocked address=172.213.216.126
-add list=Blocked address=172.213.225.181
-add list=Blocked address=172.213.227.73
-add list=Blocked address=172.213.232.128
-add list=Blocked address=172.213.244.85
-add list=Blocked address=172.232.175.132
-add list=Blocked address=172.245.102.64
-add list=Blocked address=173.239.240.222
-add list=Blocked address=173.249.34.197
-add list=Blocked address=176.65.132.38
-add list=Blocked address=176.227.240.17
-add list=Blocked address=176.227.240.61
-add list=Blocked address=178.16.54.137
-add list=Blocked address=178.62.196.238
-add list=Blocked address=178.128.176.132
-add list=Blocked address=179.43.134.114
-add list=Blocked address=180.95.231.78
-add list=Blocked address=185.34.70.228
-add list=Blocked address=185.93.89.147
-add list=Blocked address=185.93.89.167
-add list=Blocked address=185.151.21.124
-add list=Blocked address=185.177.72.5
-add list=Blocked address=185.177.72.9
-add list=Blocked address=185.177.72.10
-add list=Blocked address=185.177.72.12
-add list=Blocked address=185.177.72.13
-add list=Blocked address=185.177.72.17
-add list=Blocked address=185.177.72.22
-add list=Blocked address=185.177.72.23
-add list=Blocked address=185.177.72.24
-add list=Blocked address=185.177.72.29
-add list=Blocked address=185.177.72.30
-add list=Blocked address=185.177.72.31
-add list=Blocked address=185.177.72.38
-add list=Blocked address=185.177.72.49
-add list=Blocked address=185.177.72.52
-add list=Blocked address=185.177.72.53
-add list=Blocked address=185.177.72.54
-add list=Blocked address=185.177.72.56
-add list=Blocked address=185.177.72.58
-add list=Blocked address=185.177.72.67
-add list=Blocked address=185.177.72.68
-add list=Blocked address=185.177.72.69
-add list=Blocked address=185.177.72.70
-add list=Blocked address=185.177.72.81
-add list=Blocked address=185.177.72.100
-add list=Blocked address=185.177.72.205
-add list=Blocked address=185.192.71.2
-add list=Blocked address=185.192.71.3
-add list=Blocked address=185.192.71.5
-add list=Blocked address=185.192.71.6
-add list=Blocked address=185.192.71.13
-add list=Blocked address=185.192.71.16
-add list=Blocked address=185.192.71.76
-add list=Blocked address=185.192.71.247
-add list=Blocked address=185.223.152.40
-add list=Blocked address=185.223.152.60
-add list=Blocked address=185.223.152.103
-add list=Blocked address=185.223.152.112
-add list=Blocked address=185.223.152.126
-add list=Blocked address=185.223.152.222
-add list=Blocked address=185.238.231.167
-add list=Blocked address=185.251.19.30
-add list=Blocked address=188.166.245.173
-add list=Blocked address=188.213.202.84
-add list=Blocked address=188.213.202.113
-add list=Blocked address=188.213.202.116
-add list=Blocked address=188.213.202.121
-add list=Blocked address=190.2.142.78
-add list=Blocked address=191.96.11.173
-add list=Blocked address=191.232.199.39
-add list=Blocked address=191.235.102.147
-add list=Blocked address=191.235.105.17
-add list=Blocked address=191.237.250.106
-add list=Blocked address=192.34.61.236
-add list=Blocked address=192.133.77.14
-add list=Blocked address=192.133.77.15
-add list=Blocked address=192.133.77.16
-add list=Blocked address=192.133.77.17
-add list=Blocked address=192.133.77.18
-add list=Blocked address=192.253.248.7
-add list=Blocked address=192.253.248.142
-add list=Blocked address=193.19.109.68
-add list=Blocked address=193.19.109.122
-add list=Blocked address=193.19.109.151
-add list=Blocked address=193.31.28.80
-add list=Blocked address=193.36.225.117
-add list=Blocked address=193.36.225.133
-add list=Blocked address=193.36.225.180
-add list=Blocked address=193.37.32.17
-add list=Blocked address=193.37.32.28
-add list=Blocked address=193.37.32.45
-add list=Blocked address=193.37.32.149
-add list=Blocked address=193.37.32.157
-add list=Blocked address=193.37.32.159
-add list=Blocked address=193.37.33.55
-add list=Blocked address=193.37.33.117
-add list=Blocked address=193.37.33.251
-add list=Blocked address=193.47.62.167
-add list=Blocked address=193.47.62.168
-add list=Blocked address=193.143.1.112
-add list=Blocked address=193.148.56.148
-add list=Blocked address=193.148.57.33
-add list=Blocked address=193.149.176.55
-add list=Blocked address=194.5.82.59
-add list=Blocked address=194.5.82.61
-add list=Blocked address=194.5.82.63
-add list=Blocked address=194.5.82.87
-add list=Blocked address=194.5.82.89
-add list=Blocked address=194.5.82.92
-add list=Blocked address=194.5.82.95
-add list=Blocked address=194.5.82.98
-add list=Blocked address=194.5.82.100
-add list=Blocked address=194.5.82.104
-add list=Blocked address=194.5.82.123
-add list=Blocked address=194.5.82.141
-add list=Blocked address=194.5.82.153
-add list=Blocked address=194.26.192.156
-add list=Blocked address=194.32.120.151
-add list=Blocked address=194.156.79.68
-add list=Blocked address=194.233.91.21
-add list=Blocked address=195.178.110.31
-add list=Blocked address=195.178.110.48
-add list=Blocked address=195.178.110.72
-add list=Blocked address=195.178.110.100
-add list=Blocked address=195.178.110.104
-add list=Blocked address=195.178.110.135
-add list=Blocked address=195.178.110.155
-add list=Blocked address=195.178.110.159
-add list=Blocked address=195.178.110.199
-add list=Blocked address=195.178.110.211
-add list=Blocked address=195.178.110.223
-add list=Blocked address=195.178.110.241
-add list=Blocked address=198.98.52.229
-add list=Blocked address=199.16.157.180
-add list=Blocked address=199.16.157.181
-add list=Blocked address=199.16.157.182
-add list=Blocked address=199.16.157.183
-add list=Blocked address=200.162.145.50
-add list=Blocked address=200.162.145.220
-add list=Blocked address=200.162.152.170
-add list=Blocked address=201.78.128.89
-add list=Blocked address=203.159.90.217
-add list=Blocked address=203.159.90.218
-add list=Blocked address=206.81.12.187
-add list=Blocked address=206.81.24.227
-add list=Blocked address=206.189.19.19
-add list=Blocked address=206.189.95.232
-add list=Blocked address=207.154.197.113
-add list=Blocked address=207.241.173.229
-add list=Blocked address=208.84.102.195
-add list=Blocked address=209.87.169.142
-add list=Blocked address=209.87.169.148
-add list=Blocked address=209.99.189.152
-add list=Blocked address=209.99.189.160
-add list=Blocked address=209.99.189.190
-add list=Blocked address=209.99.190.99
-add list=Blocked address=209.99.190.126
-add list=Blocked address=209.126.2.173
-add list=Blocked address=212.32.69.236
-add list=Blocked address=213.35.113.47
-add list=Blocked address=213.111.158.220
-add list=Blocked address=216.24.210.46
-add list=Blocked address=216.24.212.14
-add list=Blocked address=216.24.212.43
-add list=Blocked address=216.24.212.45
-add list=Blocked address=216.24.212.233
-add list=Blocked address=216.24.212.243
-add list=Blocked address=216.73.163.119
-add list=Blocked address=216.73.163.122
-add list=Blocked address=216.73.163.132
-add list=Blocked address=216.73.163.138
-add list=Blocked address=216.73.163.148
-add list=Blocked address=216.73.216.10
-add list=Blocked address=216.73.216.24
-add list=Blocked address=216.73.216.25
-add list=Blocked address=216.73.216.41
-add list=Blocked address=216.73.216.52
-add list=Blocked address=216.73.216.66
-add list=Blocked address=216.73.216.67
-add list=Blocked address=216.73.216.91
-add list=Blocked address=216.73.216.98
-add list=Blocked address=216.73.216.114
-add list=Blocked address=216.73.216.133
-add list=Blocked address=216.73.216.140
-add list=Blocked address=216.73.216.209
-add list=Blocked address=216.73.216.229
-add list=Blocked address=216.73.216.230
-add list=Blocked address=216.73.216.244
-add list=Blocked address=216.73.217.11
-add list=Blocked address=216.73.217.13
-add list=Blocked address=216.73.217.54
-add list=Blocked address=216.73.217.87
-add list=Blocked address=216.73.217.121
-add list=Blocked address=216.73.217.145
-add list=Blocked address=216.73.217.173
-add list=Blocked address=216.73.217.176
-add list=Blocked address=216.81.248.20
-add list=Blocked address=217.156.123.33
-add list=Blocked address=217.217.252.197
-add list=Blocked address=220.202.112.100
-add list=Blocked address=223.199.187.171
-
-# Blocked IPv6 (41, non-whitelisted)
-/ipv6 firewall address-list
-add list=Blocked address=2001:ba0:24c:a500::1
-add list=Blocked address=2001:4ca0:108:42::24
-add list=Blocked address=2400:8901::2000:62ff:fe9a:e1c2
-add list=Blocked address=2406:da18:525:0:a23e:e8f6:3ea1:4c2c
-add list=Blocked address=2600:3000:1305:4212::81
-add list=Blocked address=2600:3000:1305:4212::82
-add list=Blocked address=2600:3000:1305:4212::83
-add list=Blocked address=2600:3000:1305:4212::84
-add list=Blocked address=2600:3000:1305:4212::85
-add list=Blocked address=2600:3000:2710:200::81
-add list=Blocked address=2600:3000:2710:200::82
-add list=Blocked address=2600:3000:2710:200::83
-add list=Blocked address=2600:3000:2710:200::84
-add list=Blocked address=2600:3000:2710:200::85
-add list=Blocked address=2600:3000:2710:200::86
-add list=Blocked address=2600:3c09::2000:5cff:fe99:c802
-add list=Blocked address=2600:3c15::2000:53ff:fe31:8c0b
-add list=Blocked address=2600:3c15::2000:9cff:fef0:8ad6
-add list=Blocked address=2602:fa59:10:4c9::1
-add list=Blocked address=2602:fa59:10:a3a::1
-add list=Blocked address=2602:fa59:10:e70::1
-add list=Blocked address=2a00:6340:2008:ec80:64cc:9116:beb2:1931
-add list=Blocked address=2a00:6340:2008:ec80:be24:11ff:fe3b:4058
-add list=Blocked address=2a00:6340:2008:ec80:be24:11ff:fe82:2775
-add list=Blocked address=2a01:2a8:a0dd:1::1012
-add list=Blocked address=2a01:4f8:c014:7f9e::1
-add list=Blocked address=2a04:4e40:e000:0:33c:a689:be95:5a4
-add list=Blocked address=2a04:4e40:e000:0:566:f8d7:adbe:f536
-add list=Blocked address=2a04:4e40:e000:0:954:9789:20b1:d5fc
-add list=Blocked address=2a04:4e40:e000:0:bfc:4b0:174b:d52d
-add list=Blocked address=2a04:c300::3ce
-add list=Blocked address=2a04:c300:400::58
-add list=Blocked address=2a04:c300:400::5d
-add list=Blocked address=2a04:c300:400::99
-add list=Blocked address=2a05:4140:3::37cd
-add list=Blocked address=2a09:bac1:76c0:460::5e:6a
-add list=Blocked address=2a09:bac5:55fb:18c8::278:a7
-add list=Blocked address=2a09:bac5:9443:3af::5e:4d
-add list=Blocked address=2a09:bac5:9443:3af::5e:88
-add list=Blocked address=2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9
-add list=Blocked address=2a13:adc0::2ed:89ff:fe58:19c5
-
-/ip firewall filter
-add chain=input action=accept src-address-list=Openfactory comment="npm-ids openfactory whitelist (v4)"
-add chain=input action=accept src-address-list=Cloudflare comment="npm-ids cloudflare whitelist (v4)"
-add chain=input action=accept src-address-list=PaloAlto comment="npm-ids paloalto whitelist (v4)"
-add chain=input action=drop src-address-list=Blocked comment="npm-ids blocked (v4)"
-add chain=forward action=drop src-address-list=Blocked comment="npm-ids blocked (v4)"
-
-/ipv6 firewall filter
-add chain=input action=accept src-address-list=Openfactory comment="npm-ids openfactory whitelist (v6)"
-add chain=input action=accept src-address-list=Cloudflare comment="npm-ids cloudflare whitelist (v6)"
-add chain=input action=accept src-address-list=PaloAlto comment="npm-ids paloalto whitelist (v6)"
-add chain=input action=drop src-address-list=Blocked comment="npm-ids blocked (v6)"
-add chain=forward action=drop src-address-list=Blocked comment="npm-ids blocked (v6)"

app/reports/npm/data/scanner_ips.txt

@@ -1,943 +0,0 @@
-195.178.110.199  # errors=9488 total=14443 ratio=0.657 first=29/Jul/2026:05:02:41 +0200 last=29/Jul/2026:06:23:08 +0200
-185.177.72.17  # errors=5044 total=5079 ratio=0.993 first=12/Jul/2026:16:24:12 +0200 last=09/Aug/2026:22:25:00 +0200
-185.177.72.22  # errors=4977 total=5007 ratio=0.994 first=30/Jul/2026:03:49:51 +0200 last=10/Aug/2026:23:22:40 +0200
-82.165.82.154  # errors=4952 total=4952 ratio=1.0 first=09/Aug/2026:19:20:34 +0200 last=18/Jul/2026:23:42:32 +0200
-185.177.72.53  # errors=3316 total=3383 ratio=0.98 first=24/Jul/2026:07:45:47 +0200 last=30/Jul/2026:03:45:26 +0200
-5.226.149.150  # errors=3153 total=3308 ratio=0.953 first=09/Aug/2026:18:45:27 +0200 last=18/Jul/2026:23:36:31 +0200
-185.177.72.49  # errors=2492 total=2516 ratio=0.99 first=12/Jul/2026:16:47:48 +0200 last=18/Jul/2026:08:23:11 +0200
-185.177.72.9  # errors=2484 total=2498 ratio=0.994 first=01/Aug/2026:00:17:19 +0200 last=01/Aug/2026:00:28:54 +0200
-185.177.72.24  # errors=2482 total=2504 ratio=0.991 first=12/Jul/2026:16:48:55 +0200 last=25/Jul/2026:11:07:59 +0200
-20.206.105.145  # errors=2188 total=3181 ratio=0.688 first=24/Jul/2026:06:06:08 +0200 last=22/Jul/2026:08:36:32 +0200
-20.226.26.5  # errors=1418 total=2125 ratio=0.667 first=21/Jul/2026:00:46:09 +0200 last=16/Jul/2026:16:39:13 +0200
-52.165.196.84  # errors=1314 total=1660 ratio=0.792 first=29/Jul/2026:19:20:27 +0200 last=25/Jul/2026:13:52:06 +0200
-20.63.63.128  # errors=1206 total=1654 ratio=0.729 first=20/Jul/2026:18:04:22 +0200 last=14/Jul/2026:03:47:22 +0200
-20.206.67.15  # errors=1177 total=1449 ratio=0.812 first=21/Jul/2026:07:56:36 +0200 last=28/Jul/2026:09:20:21 +0200
-20.197.195.24  # errors=1165 total=1623 ratio=0.718 first=27/Jul/2026:06:06:45 +0200 last=23/Jul/2026:05:37:53 +0200
-172.213.225.181  # errors=1071 total=1456 ratio=0.736 first=30/Jul/2026:15:48:04 +0200 last=01/Aug/2026:01:54:44 +0200
-45.134.20.116  # errors=1000 total=1000 ratio=1.0 first=27/Jul/2026:17:40:51 +0200 last=27/Jul/2026:17:49:00 +0200
-91.124.88.29  # errors=1000 total=1000 ratio=1.0 first=21/Jul/2026:13:10:26 +0200 last=21/Jul/2026:13:20:00 +0200
-34.47.183.174  # errors=868 total=923 ratio=0.94 first=19/Jul/2026:16:38:44 +0200 last=19/Jul/2026:20:49:14 +0200
-20.171.55.167  # errors=814 total=1810 ratio=0.45 first=02/Aug/2026:07:48:34 +0200 last=01/Aug/2026:09:21:30 +0200
-20.151.10.161  # errors=799 total=1077 ratio=0.742 first=20/Jul/2026:19:31:38 +0200 last=21/Jul/2026:21:43:51 +0200
-185.177.72.67  # errors=796 total=822 ratio=0.968 first=21/Jul/2026:21:36:12 +0200 last=18/Jul/2026:08:32:56 +0200
-4.194.24.143  # errors=787 total=829 ratio=0.949 first=17/Jul/2026:00:19:47 +0200 last=18/Jul/2026:19:51:36 +0200
-20.226.5.174  # errors=727 total=1006 ratio=0.723 first=02/Aug/2026:11:17:26 +0200 last=01/Aug/2026:20:44:43 +0200
-68.221.69.72  # errors=651 total=1058 ratio=0.615 first=02/Aug/2026:05:16:47 +0200 last=28/Jul/2026:18:22:31 +0200
-45.148.10.67  # errors=633 total=1272 ratio=0.498 first=12/Jul/2026:23:29:10 +0200 last=12/Jul/2026:23:29:31 +0200
-185.177.72.81  # errors=630 total=631 ratio=0.998 first=29/Jul/2026:07:49:32 +0200 last=29/Jul/2026:07:50:36 +0200
-162.158.217.140  # errors=613 total=709 ratio=0.865 first=12/Jul/2026:06:32:52 +0200 last=13/Jul/2026:16:48:17 +0200
-52.139.36.144  # errors=588 total=727 ratio=0.809 first=28/Jul/2026:08:15:04 +0200 last=24/Jul/2026:23:19:11 +0200
-20.100.203.84  # errors=573 total=956 ratio=0.599 first=26/Jul/2026:19:15:42 +0200 last=26/Jul/2026:14:13:44 +0200
-20.215.216.94  # errors=561 total=663 ratio=0.846 first=26/Jul/2026:17:21:30 +0200 last=25/Jul/2026:08:56:58 +0200
-34.244.177.56  # errors=546 total=546 ratio=1.0 first=29/Jul/2026:08:18:23 +0200 last=29/Jul/2026:08:58:55 +0200
-54.216.227.171  # errors=546 total=546 ratio=1.0 first=27/Jul/2026:02:57:33 +0200 last=27/Jul/2026:03:04:29 +0200
-20.215.218.234  # errors=544 total=544 ratio=1.0 first=28/Jul/2026:04:46:27 +0200 last=27/Jul/2026:04:14:44 +0200
-68.221.130.241  # errors=538 total=538 ratio=1.0 first=25/Jul/2026:10:28:43 +0200 last=26/Jul/2026:03:28:22 +0200
-45.154.138.232  # errors=536 total=536 ratio=1.0 first=18/Jul/2026:16:52:29 +0200 last=18/Jul/2026:16:54:21 +0200
-54.179.129.22  # errors=532 total=532 ratio=1.0 first=27/Jul/2026:14:32:31 +0200 last=27/Jul/2026:16:35:54 +0200
-74.249.245.134  # errors=523 total=760 ratio=0.688 first=17/Jul/2026:23:27:53 +0200 last=23/Jul/2026:01:40:54 +0200
-185.177.72.54  # errors=513 total=523 ratio=0.981 first=30/Jul/2026:03:54:30 +0200 last=10/Aug/2026:23:03:27 +0200
-20.195.181.10  # errors=509 total=636 ratio=0.8 first=26/Jul/2026:16:26:24 +0200 last=25/Jul/2026:04:07:51 +0200
-20.220.150.193  # errors=486 total=486 ratio=1.0 first=22/Jul/2026:10:01:53 +0200 last=22/Jul/2026:08:38:08 +0200
-4.204.201.85  # errors=486 total=648 ratio=0.75 first=26/Jul/2026:19:23:27 +0200 last=22/Jul/2026:05:47:48 +0200
-20.48.236.161  # errors=484 total=484 ratio=1.0 first=16/Jul/2026:17:11:59 +0200 last=17/Jul/2026:19:59:45 +0200
-45.148.10.244  # errors=478 total=656 ratio=0.729 first=26/Jul/2026:06:53:37 +0200 last=27/Jul/2026:23:19:01 +0200
-74.248.97.169  # errors=468 total=468 ratio=1.0 first=10/Aug/2026:15:25:17 +0200 last=11/Aug/2026:04:26:43 +0200
-20.197.178.120  # errors=465 total=465 ratio=1.0 first=24/Jul/2026:16:54:24 +0200 last=30/Jul/2026:09:20:18 +0200
-158.158.41.79  # errors=452 total=806 ratio=0.561 first=01/Aug/2026:12:51:25 +0200 last=02/Aug/2026:12:50:30 +0200
-45.88.138.44  # errors=451 total=488 ratio=0.924 first=21/Jul/2026:21:26:56 +0200 last=27/Jul/2026:14:52:27 +0200
-93.123.109.165  # errors=449 total=463 ratio=0.97 first=17/Jul/2026:16:31:08 +0200 last=17/Jul/2026:16:30:48 +0200
-20.91.208.34  # errors=422 total=422 ratio=1.0 first=28/Jul/2026:00:07:01 +0200 last=28/Jul/2026:19:56:48 +0200
-20.119.205.224  # errors=420 total=420 ratio=1.0 first=19/Jul/2026:23:11:58 +0200 last=20/Jul/2026:00:27:08 +0200
-162.158.217.141  # errors=417 total=467 ratio=0.893 first=14/Jul/2026:09:53:03 +0200 last=12/Jun/2026:11:42:49 +0200
-20.203.209.227  # errors=408 total=408 ratio=1.0 first=25/Jul/2026:14:20:22 +0200 last=24/Jul/2026:20:43:18 +0200
-4.223.77.241  # errors=408 total=677 ratio=0.603 first=26/Jul/2026:03:55:30 +0200 last=24/Jul/2026:20:10:31 +0200
-172.213.155.173  # errors=400 total=400 ratio=1.0 first=25/Jul/2026:14:35:37 +0200 last=25/Jul/2026:00:28:09 +0200
-45.148.10.62  # errors=399 total=559 ratio=0.714 first=27/Jul/2026:05:15:02 +0200 last=27/Jul/2026:08:33:02 +0200
-51.116.233.22  # errors=399 total=399 ratio=1.0 first=25/Jul/2026:13:34:16 +0200 last=26/Jul/2026:03:29:20 +0200
-20.9.4.9  # errors=392 total=691 ratio=0.567 first=30/Jul/2026:07:32:08 +0200 last=31/Jul/2026:00:44:10 +0200
-195.178.110.155  # errors=329 total=402 ratio=0.818 first=01/Aug/2026:11:10:16 +0200 last=31/Jul/2026:13:31:18 +0200
-20.206.89.130  # errors=329 total=657 ratio=0.501 first=20/Jul/2026:13:27:31 +0200 last=15/Jul/2026:19:00:47 +0200
-136.107.61.46  # errors=328 total=561 ratio=0.585 first=09/Aug/2026:21:42:07 +0200 last=09/Aug/2026:22:20:41 +0200
-51.103.133.211  # errors=325 total=325 ratio=1.0 first=27/Jul/2026:16:51:19 +0200 last=25/Jul/2026:07:46:46 +0200
-20.100.169.152  # errors=324 total=324 ratio=1.0 first=31/Jul/2026:05:59:29 +0200 last=31/Jul/2026:07:08:27 +0200
-172.161.0.2  # errors=323 total=323 ratio=1.0 first=10/Aug/2026:03:12:08 +0200 last=11/Aug/2026:02:10:28 +0200
-20.151.205.204  # errors=322 total=644 ratio=0.5 first=16/Jul/2026:17:00:12 +0200 last=16/Jul/2026:14:50:47 +0200
-135.119.63.61  # errors=320 total=455 ratio=0.703 first=28/Jul/2026:20:36:57 +0200 last=01/Aug/2026:07:10:52 +0200
-23.178.112.103  # errors=318 total=636 ratio=0.5 first=10/Aug/2026:19:53:54 +0200 last=17/Jul/2026:17:22:48 +0200
-4.232.188.49  # errors=318 total=748 ratio=0.425 first=01/Aug/2026:17:31:43 +0200 last=31/Jul/2026:04:44:55 +0200
-51.120.79.193  # errors=318 total=355 ratio=0.896 first=02/Aug/2026:16:02:01 +0200 last=30/Jul/2026:06:26:43 +0200
-20.250.24.46  # errors=316 total=502 ratio=0.629 first=10/Aug/2026:03:23:35 +0200 last=10/Aug/2026:06:02:06 +0200
-20.203.133.142  # errors=315 total=315 ratio=1.0 first=28/Jul/2026:03:10:55 +0200 last=30/Jul/2026:10:07:00 +0200
-20.203.148.31  # errors=314 total=314 ratio=1.0 first=02/Aug/2026:13:59:44 +0200 last=01/Aug/2026:20:25:54 +0200
-45.148.10.247  # errors=311 total=311 ratio=1.0 first=01/Aug/2026:04:48:36 +0200 last=01/Aug/2026:04:49:14 +0200
-4.185.41.66  # errors=309 total=309 ratio=1.0 first=24/Jul/2026:20:18:18 +0200 last=27/Jul/2026:00:43:15 +0200
-172.71.6.237  # errors=307 total=307 ratio=1.0 first=14/Jul/2026:03:24:29 +0200 last=15/Jul/2026:07:38:12 +0200
-23.178.112.107  # errors=306 total=612 ratio=0.5 first=10/Aug/2026:10:30:53 +0200 last=17/Jul/2026:17:22:23 +0200
-20.104.18.253  # errors=303 total=668 ratio=0.454 first=02/Aug/2026:08:52:08 +0200 last=31/Jul/2026:13:19:26 +0200
-172.213.208.20  # errors=301 total=711 ratio=0.423 first=24/Jul/2026:01:16:51 +0200 last=24/Jul/2026:12:03:08 +0200
-20.251.48.84  # errors=291 total=582 ratio=0.5 first=09/Aug/2026:21:59:36 +0200 last=10/Aug/2026:08:56:21 +0200
-20.251.58.190  # errors=291 total=457 ratio=0.637 first=28/Jul/2026:07:19:44 +0200 last=01/Aug/2026:23:49:59 +0200
-45.134.20.128  # errors=288 total=288 ratio=1.0 first=27/Jul/2026:17:49:02 +0200 last=27/Jul/2026:17:51:21 +0200
-91.124.88.36  # errors=288 total=288 ratio=1.0 first=21/Jul/2026:13:20:01 +0200 last=21/Jul/2026:13:22:47 +0200
-20.230.87.222  # errors=280 total=414 ratio=0.676 first=18/Jul/2026:19:22:32 +0200 last=19/Jul/2026:08:24:45 +0200
-34.16.184.1  # errors=279 total=279 ratio=1.0 first=11/Aug/2026:00:29:51 +0200 last=11/Aug/2026:00:30:27 +0200
-3.77.92.222  # errors=275 total=276 ratio=0.996 first=27/Jul/2026:11:23:29 +0200 last=27/Jul/2026:11:23:37 +0200
-13.221.106.198  # errors=273 total=273 ratio=1.0 first=29/Jul/2026:08:25:41 +0200 last=29/Jul/2026:08:26:12 +0200
-209.99.189.190  # errors=273 total=359 ratio=0.76 first=27/Jul/2026:19:04:48 +0200 last=28/Jul/2026:06:42:38 +0200
-3.101.54.4  # errors=272 total=273 ratio=0.996 first=29/Jul/2026:09:04:55 +0200 last=29/Jul/2026:09:05:52 +0200
-3.250.52.216  # errors=272 total=273 ratio=0.996 first=26/Jul/2026:05:45:51 +0200 last=26/Jul/2026:05:46:04 +0200
-35.157.251.190  # errors=272 total=273 ratio=0.996 first=27/Jul/2026:03:40:01 +0200 last=27/Jul/2026:03:40:08 +0200
-44.248.34.34  # errors=272 total=276 ratio=0.986 first=27/Jul/2026:14:02:11 +0200 last=27/Jul/2026:14:02:59 +0200
-44.251.113.120  # errors=272 total=273 ratio=0.996 first=26/Jul/2026:05:42:51 +0200 last=26/Jul/2026:05:43:57 +0200
-65.0.122.218  # errors=272 total=273 ratio=0.996 first=29/Jul/2026:10:10:22 +0200 last=29/Jul/2026:10:11:48 +0200
-3.79.41.12  # errors=271 total=273 ratio=0.993 first=26/Jul/2026:06:20:16 +0200 last=26/Jul/2026:06:20:22 +0200
-34.242.226.103  # errors=271 total=273 ratio=0.993 first=29/Jul/2026:08:52:40 +0200 last=29/Jul/2026:08:52:54 +0200
-54.163.186.39  # errors=271 total=273 ratio=0.993 first=27/Jul/2026:03:39:29 +0200 last=27/Jul/2026:03:40:00 +0200
-54.206.147.115  # errors=268 total=269 ratio=0.996 first=24/Jul/2026:15:49:52 +0200 last=24/Jul/2026:15:51:03 +0200
-108.130.204.104  # errors=265 total=266 ratio=0.996 first=28/Jul/2026:04:34:13 +0200 last=28/Jul/2026:04:34:25 +0200
-13.57.15.41  # errors=265 total=266 ratio=0.996 first=27/Jul/2026:13:10:42 +0200 last=27/Jul/2026:13:11:40 +0200
-20.113.56.22  # errors=265 total=319 ratio=0.831 first=01/Aug/2026:11:28:00 +0200 last=28/Jul/2026:17:35:07 +0200
-54.169.103.174  # errors=265 total=269 ratio=0.985 first=24/Jul/2026:18:16:59 +0200 last=24/Jul/2026:18:17:45 +0200
-16.146.99.254  # errors=264 total=266 ratio=0.992 first=27/Jul/2026:14:11:20 +0200 last=27/Jul/2026:14:12:09 +0200
-3.107.107.18  # errors=264 total=265 ratio=0.996 first=27/Jul/2026:13:28:34 +0200 last=27/Jul/2026:13:31:03 +0200
-172.213.8.106  # errors=262 total=262 ratio=1.0 first=02/Aug/2026:18:08:57 +0200 last=28/Jul/2026:16:25:37 +0200
-45.148.10.194  # errors=261 total=261 ratio=1.0 first=02/Aug/2026:20:05:31 +0200 last=02/Aug/2026:20:06:07 +0200
-20.100.178.92  # errors=260 total=260 ratio=1.0 first=25/Jul/2026:18:27:46 +0200 last=25/Jul/2026:16:18:56 +0200
-20.215.189.213  # errors=257 total=264 ratio=0.973 first=02/Aug/2026:04:57:51 +0200 last=02/Aug/2026:11:40:23 +0200
-135.119.74.228  # errors=244 total=515 ratio=0.474 first=26/Jul/2026:19:57:06 +0200 last=25/Jul/2026:15:14:23 +0200
-195.178.110.72  # errors=244 total=525 ratio=0.465 first=01/Aug/2026:23:26:33 +0200 last=02/Aug/2026:06:21:15 +0200
-45.154.138.181  # errors=239 total=239 ratio=1.0 first=18/Jul/2026:16:54:31 +0200 last=18/Jul/2026:16:55:12 +0200
-51.143.162.98  # errors=238 total=430 ratio=0.553 first=10/Aug/2026:07:41:29 +0200 last=10/Aug/2026:08:27:11 +0200
-104.23.172.51  # errors=233 total=233 ratio=1.0 first=12/Jul/2026:22:49:39 +0200 last=12/Jul/2026:22:49:41 +0200
-20.104.16.169  # errors=233 total=316 ratio=0.737 first=01/Aug/2026:18:23:53 +0200 last=01/Aug/2026:19:11:32 +0200
-34.171.75.208  # errors=232 total=239 ratio=0.971 first=29/Jul/2026:15:26:48 +0200 last=29/Jul/2026:15:26:53 +0200
-195.178.110.31  # errors=230 total=312 ratio=0.737 first=25/Jul/2026:04:27:56 +0200 last=25/Jul/2026:06:23:50 +0200
-31.59.129.193  # errors=229 total=234 ratio=0.979 first=09/Aug/2026:18:56:21 +0200 last=31/Jul/2026:16:02:43 +0200
-209.99.190.126  # errors=225 total=245 ratio=0.918 first=27/Jul/2026:03:18:42 +0200 last=27/Jul/2026:08:08:39 +0200
-4.223.71.149  # errors=221 total=275 ratio=0.804 first=29/Jul/2026:02:26:55 +0200 last=01/Aug/2026:16:21:30 +0200
-158.158.32.229  # errors=220 total=220 ratio=1.0 first=01/Aug/2026:14:33:51 +0200 last=01/Aug/2026:13:35:07 +0200
-20.100.187.246  # errors=220 total=220 ratio=1.0 first=30/Jul/2026:14:09:00 +0200 last=01/Aug/2026:20:33:27 +0200
-20.91.140.156  # errors=215 total=323 ratio=0.666 first=02/Aug/2026:12:51:06 +0200 last=01/Aug/2026:07:33:25 +0200
-4.223.171.122  # errors=213 total=320 ratio=0.666 first=11/Aug/2026:11:00:51 +0200 last=11/Aug/2026:03:12:59 +0200
-162.158.108.124  # errors=212 total=212 ratio=1.0 first=14/Jul/2026:19:06:36 +0200 last=14/Jul/2026:19:07:14 +0200
-172.171.198.214  # errors=210 total=210 ratio=1.0 first=20/Jul/2026:00:57:50 +0200 last=20/Jul/2026:00:58:17 +0200
-172.71.141.140  # errors=207 total=433 ratio=0.478 first=13/Jul/2026:21:28:19 +0200 last=11/Jun/2026:07:58:31 +0200
-20.220.15.170  # errors=202 total=255 ratio=0.792 first=29/Jul/2026:23:32:23 +0200 last=30/Jul/2026:02:39:20 +0200
-139.59.118.17  # errors=195 total=470 ratio=0.415 first=29/Jul/2026:10:21:30 +0200 last=29/Jul/2026:02:37:09 +0200
-20.104.22.47  # errors=194 total=271 ratio=0.716 first=30/Jul/2026:01:46:03 +0200 last=30/Jul/2026:04:01:53 +0200
-20.151.225.23  # errors=192 total=312 ratio=0.615 first=18/Jul/2026:17:58:19 +0200 last=18/Jul/2026:14:38:54 +0200
-191.235.105.17  # errors=188 total=188 ratio=1.0 first=23/Jul/2026:19:15:31 +0200 last=23/Jul/2026:19:57:48 +0200
-172.71.141.141  # errors=186 total=346 ratio=0.538 first=12/Jul/2026:19:13:09 +0200 last=11/Jun/2026:12:25:56 +0200
-172.71.98.94  # errors=181 total=184 ratio=0.984 first=12/Jul/2026:22:49:33 +0200 last=13/Jul/2026:16:48:16 +0200
-93.123.109.101  # errors=172 total=201 ratio=0.856 first=23/Jul/2026:13:15:45 +0200 last=23/Jul/2026:13:15:46 +0200
-23.178.112.108  # errors=170 total=340 ratio=0.5 first=10/Aug/2026:21:05:36 +0200 last=17/Jul/2026:17:26:06 +0200
-158.158.96.17  # errors=169 total=169 ratio=1.0 first=29/Jul/2026:21:22:47 +0200 last=29/Jul/2026:21:23:01 +0200
-172.213.216.126  # errors=169 total=338 ratio=0.5 first=29/Jul/2026:12:51:42 +0200 last=29/Jul/2026:12:52:11 +0200
-172.71.99.207  # errors=169 total=270 ratio=0.626 first=12/Jul/2026:22:49:33 +0200 last=12/Jul/2026:23:23:32 +0200
-23.178.112.104  # errors=169 total=338 ratio=0.5 first=10/Aug/2026:17:06:14 +0200 last=17/Jul/2026:17:27:05 +0200
-104.23.168.9  # errors=167 total=169 ratio=0.988 first=12/Jul/2026:22:49:31 +0200 last=12/Jul/2026:22:49:33 +0200
-172.69.130.238  # errors=167 total=167 ratio=1.0 first=14/Jul/2026:05:19:07 +0200 last=14/Jul/2026:05:19:37 +0200
-20.170.16.216  # errors=167 total=203 ratio=0.823 first=24/Jul/2026:23:22:40 +0200 last=25/Jul/2026:21:31:26 +0200
-188.166.245.173  # errors=166 total=167 ratio=0.994 first=29/Jul/2026:17:39:30 +0200 last=29/Jul/2026:17:40:05 +0200
-20.215.211.95  # errors=166 total=166 ratio=1.0 first=01/Aug/2026:09:14:45 +0200 last=01/Aug/2026:10:13:08 +0200
-172.68.174.240  # errors=165 total=165 ratio=1.0 first=14/Jul/2026:23:35:51 +0200 last=14/Jul/2026:23:36:21 +0200
-20.48.234.177  # errors=164 total=311 ratio=0.527 first=27/Jul/2026:19:34:24 +0200 last=29/Jul/2026:14:22:07 +0200
-172.213.27.135  # errors=163 total=163 ratio=1.0 first=25/Jul/2026:17:50:57 +0200 last=25/Jul/2026:17:51:04 +0200
-20.151.200.100  # errors=163 total=163 ratio=1.0 first=14/Jul/2026:14:13:15 +0200 last=14/Jul/2026:14:13:32 +0200
-20.198.114.210  # errors=163 total=163 ratio=1.0 first=22/Jul/2026:01:52:06 +0200 last=22/Jul/2026:01:53:10 +0200
-191.235.102.147  # errors=162 total=324 ratio=0.5 first=22/Jul/2026:14:54:06 +0200 last=22/Jul/2026:14:55:16 +0200
-20.205.229.184  # errors=162 total=162 ratio=1.0 first=24/Jul/2026:14:17:54 +0200 last=24/Jul/2026:14:18:41 +0200
-20.214.106.237  # errors=162 total=324 ratio=0.5 first=24/Jul/2026:17:46:47 +0200 last=24/Jul/2026:17:48:48 +0200
-52.184.96.217  # errors=162 total=162 ratio=1.0 first=21/Jul/2026:22:02:55 +0200 last=21/Jul/2026:22:03:44 +0200
-172.71.10.89  # errors=157 total=157 ratio=1.0 first=14/Jul/2026:12:45:45 +0200 last=14/Jul/2026:12:46:24 +0200
-20.215.191.139  # errors=157 total=392 ratio=0.401 first=02/Aug/2026:17:33:15 +0200 last=01/Aug/2026:10:42:18 +0200
-216.73.216.24  # errors=157 total=157 ratio=1.0 first=02/Aug/2026:06:15:30 +0200 last=18/Jul/2026:16:31:03 +0200
-172.69.63.116  # errors=154 total=155 ratio=0.994 first=12/Jul/2026:11:51:39 +0200 last=12/Jul/2026:11:52:28 +0200
-132.196.11.13  # errors=150 total=150 ratio=1.0 first=18/Jul/2026:01:03:41 +0200 last=18/Jul/2026:01:04:13 +0200
-172.202.29.124  # errors=150 total=150 ratio=1.0 first=17/Jul/2026:20:43:39 +0200 last=17/Jul/2026:20:44:13 +0200
-23.178.112.106  # errors=148 total=296 ratio=0.5 first=10/Aug/2026:17:56:13 +0200 last=15/Jul/2026:18:28:50 +0200
-104.23.172.42  # errors=147 total=148 ratio=0.993 first=12/Jul/2026:22:49:39 +0200 last=14/Jul/2026:21:49:21 +0200
-195.178.110.223  # errors=147 total=243 ratio=0.605 first=27/Jul/2026:03:56:48 +0200 last=15/Jul/2026:18:38:56 +0200
-104.23.168.113  # errors=145 total=147 ratio=0.986 first=13/Jul/2026:18:13:16 +0200 last=12/Jul/2026:22:49:33 +0200
-172.70.80.181  # errors=145 total=145 ratio=1.0 first=14/Jul/2026:05:45:08 +0200 last=14/Jul/2026:05:45:38 +0200
-104.208.94.19  # errors=144 total=182 ratio=0.791 first=27/Jul/2026:00:13:24 +0200 last=27/Jul/2026:00:14:34 +0200
-158.158.32.226  # errors=144 total=288 ratio=0.5 first=28/Jul/2026:06:16:49 +0200 last=28/Jul/2026:06:17:11 +0200
-35.231.41.225  # errors=144 total=149 ratio=0.966 first=31/Jul/2026:20:45:23 +0200 last=31/Jul/2026:20:46:00 +0200
-172.69.138.8  # errors=143 total=286 ratio=0.5 first=15/Jul/2026:09:21:57 +0200 last=15/Jul/2026:09:23:04 +0200
-35.205.50.183  # errors=143 total=150 ratio=0.953 first=10/Aug/2026:03:02:05 +0200 last=10/Aug/2026:03:02:21 +0200
-20.196.209.159  # errors=142 total=284 ratio=0.5 first=15/Jul/2026:18:07:17 +0200 last=15/Jul/2026:18:08:31 +0200
-52.253.111.48  # errors=142 total=284 ratio=0.5 first=15/Jul/2026:21:31:10 +0200 last=15/Jul/2026:21:32:46 +0200
-172.213.144.209  # errors=140 total=234 ratio=0.598 first=26/Jul/2026:09:52:16 +0200 last=27/Jul/2026:18:40:27 +0200
-191.237.250.106  # errors=140 total=182 ratio=0.769 first=17/Jul/2026:10:00:49 +0200 last=17/Jul/2026:10:01:31 +0200
-4.223.65.51  # errors=140 total=140 ratio=1.0 first=02/Aug/2026:14:06:46 +0200 last=01/Aug/2026:21:33:35 +0200
-172.71.99.208  # errors=139 total=245 ratio=0.567 first=12/Jul/2026:22:49:33 +0200 last=13/Jul/2026:16:48:17 +0200
-20.9.15.100  # errors=138 total=276 ratio=0.5 first=20/Jul/2026:02:07:11 +0200 last=20/Jul/2026:02:07:59 +0200
-172.213.227.73  # errors=137 total=137 ratio=1.0 first=10/Aug/2026:03:13:26 +0200 last=10/Aug/2026:03:13:37 +0200
-51.107.190.246  # errors=137 total=137 ratio=1.0 first=10/Aug/2026:03:44:18 +0200 last=10/Aug/2026:03:44:28 +0200
-172.69.138.200  # errors=134 total=134 ratio=1.0 first=15/Jul/2026:08:33:33 +0200 last=15/Jul/2026:08:34:07 +0200
-20.200.216.126  # errors=133 total=133 ratio=1.0 first=11/Aug/2026:00:22:54 +0200 last=11/Aug/2026:00:24:00 +0200
-20.207.199.205  # errors=133 total=133 ratio=1.0 first=11/Aug/2026:05:07:25 +0200 last=11/Aug/2026:05:08:02 +0200
-20.215.211.30  # errors=133 total=133 ratio=1.0 first=10/Aug/2026:18:12:28 +0200 last=10/Aug/2026:18:12:34 +0200
-20.240.44.115  # errors=133 total=133 ratio=1.0 first=10/Aug/2026:03:15:03 +0200 last=10/Aug/2026:03:15:15 +0200
-172.69.130.53  # errors=132 total=132 ratio=1.0 first=14/Jul/2026:05:10:14 +0200 last=14/Jul/2026:05:10:57 +0200
-104.23.172.50  # errors=128 total=129 ratio=0.992 first=12/Jul/2026:22:49:39 +0200 last=12/Jul/2026:22:49:41 +0200
-20.199.183.73  # errors=122 total=189 ratio=0.646 first=26/Jul/2026:12:13:27 +0200 last=26/Jul/2026:15:14:04 +0200
-104.23.168.112  # errors=121 total=126 ratio=0.96 first=14/Jul/2026:18:00:35 +0200 last=14/Jul/2026:21:49:21 +0200
-93.123.109.10  # errors=121 total=122 ratio=0.992 first=02/Aug/2026:19:02:03 +0200 last=02/Aug/2026:19:03:44 +0200
-4.232.185.206  # errors=119 total=234 ratio=0.509 first=10/Aug/2026:02:20:08 +0200 last=10/Aug/2026:11:23:02 +0200
-130.131.231.171  # errors=118 total=118 ratio=1.0 first=20/Jul/2026:22:28:05 +0200 last=20/Jul/2026:22:28:31 +0200
-20.230.47.94  # errors=117 total=230 ratio=0.509 first=20/Jul/2026:21:59:15 +0200 last=20/Jul/2026:23:46:24 +0200
-130.12.180.126  # errors=116 total=134 ratio=0.866 first=02/Aug/2026:07:43:21 +0200 last=31/Jul/2026:07:47:45 +0200
-168.62.180.116  # errors=115 total=115 ratio=1.0 first=22/Jul/2026:19:39:48 +0200 last=22/Jul/2026:19:40:02 +0200
-20.79.29.209  # errors=115 total=116 ratio=0.991 first=29/Jul/2026:23:25:01 +0200 last=02/Aug/2026:00:24:42 +0200
-20.197.192.193  # errors=111 total=111 ratio=1.0 first=22/Jul/2026:15:45:32 +0200 last=20/Jul/2026:10:12:07 +0200
-103.215.75.66  # errors=109 total=213 ratio=0.512 first=02/Aug/2026:10:56:35 +0200 last=02/Aug/2026:10:57:18 +0200
-172.69.39.115  # errors=109 total=148 ratio=0.736 first=13/Jul/2026:12:06:42 +0200 last=15/Jul/2026:07:35:06 +0200
-20.251.112.224  # errors=108 total=108 ratio=1.0 first=10/Aug/2026:08:52:51 +0200 last=10/Aug/2026:08:53:05 +0200
-20.251.48.208  # errors=108 total=216 ratio=0.5 first=01/Aug/2026:10:25:47 +0200 last=01/Aug/2026:10:25:55 +0200
-51.103.152.96  # errors=108 total=108 ratio=1.0 first=31/Jul/2026:18:15:25 +0200 last=31/Jul/2026:18:15:30 +0200
-162.158.235.79  # errors=105 total=105 ratio=1.0 first=15/Jul/2026:12:08:39 +0200 last=15/Jul/2026:12:09:25 +0200
-20.203.219.190  # errors=105 total=105 ratio=1.0 first=27/Jul/2026:09:43:28 +0200 last=26/Jul/2026:21:35:13 +0200
-135.225.93.215  # errors=103 total=204 ratio=0.505 first=26/Jul/2026:04:32:24 +0200 last=25/Jul/2026:03:31:50 +0200
-158.158.36.150  # errors=103 total=204 ratio=0.505 first=24/Jul/2026:17:25:42 +0200 last=25/Jul/2026:09:36:44 +0200
-162.158.217.80  # errors=103 total=120 ratio=0.858 first=12/Jul/2026:13:21:30 +0200 last=12/Jun/2026:09:48:20 +0200
-162.158.235.80  # errors=102 total=102 ratio=1.0 first=15/Jul/2026:12:07:52 +0200 last=15/Jul/2026:12:08:37 +0200
-20.226.90.242  # errors=102 total=102 ratio=1.0 first=31/Jul/2026:13:29:41 +0200 last=31/Jul/2026:13:30:13 +0200
-52.238.192.78  # errors=102 total=102 ratio=1.0 first=29/Jul/2026:02:04:31 +0200 last=29/Jul/2026:02:05:07 +0200
-172.69.63.117  # errors=100 total=100 ratio=1.0 first=12/Jul/2026:11:52:29 +0200 last=12/Jul/2026:11:53:01 +0200
-195.178.110.104  # errors=100 total=100 ratio=1.0 first=31/Jul/2026:03:27:46 +0200 last=30/Jul/2026:07:22:26 +0200
-104.23.168.8  # errors=99 total=99 ratio=1.0 first=12/Jul/2026:22:49:31 +0200 last=12/Jul/2026:22:49:33 +0200
-185.93.89.167  # errors=98 total=135 ratio=0.726 first=10/Aug/2026:07:37:36 +0200 last=16/Jul/2026:08:16:48 +0200
-4.225.166.222  # errors=97 total=157 ratio=0.618 first=31/Jul/2026:12:43:59 +0200 last=01/Aug/2026:22:19:14 +0200
-81.171.72.135  # errors=97 total=102 ratio=0.951 first=18/Jul/2026:05:25:58 +0200 last=28/Jul/2026:17:53:17 +0200
-20.218.73.95  # errors=96 total=96 ratio=1.0 first=10/Aug/2026:06:39:44 +0200 last=10/Aug/2026:12:33:05 +0200
-172.213.208.13  # errors=94 total=94 ratio=1.0 first=10/Aug/2026:21:10:27 +0200 last=11/Aug/2026:00:17:20 +0200
-20.104.96.117  # errors=94 total=188 ratio=0.5 first=23/Jul/2026:23:19:39 +0200 last=23/Jul/2026:23:20:02 +0200
-172.68.174.241  # errors=92 total=93 ratio=0.989 first=14/Jul/2026:23:35:31 +0200 last=14/Jul/2026:23:35:50 +0200
-23.161.169.62  # errors=92 total=102 ratio=0.902 first=27/Jul/2026:18:19:57 +0200 last=19/Jul/2026:21:59:40 +0200
-172.70.80.180  # errors=91 total=91 ratio=1.0 first=13/Jul/2026:22:27:46 +0200 last=13/Jul/2026:22:28:05 +0200
-45.154.98.101  # errors=90 total=102 ratio=0.882 first=17/Jul/2026:19:01:13 +0200 last=25/Jul/2026:22:23:22 +0200
-216.73.217.121  # errors=89 total=89 ratio=1.0 first=26/Jul/2026:08:50:17 +0200 last=16/Jul/2026:06:59:32 +0200
-20.226.60.151  # errors=86 total=164 ratio=0.524 first=23/Jul/2026:22:10:13 +0200 last=23/Jul/2026:08:37:58 +0200
-172.69.130.130  # errors=85 total=85 ratio=1.0 first=15/Jul/2026:05:10:26 +0200 last=15/Jul/2026:05:10:44 +0200
-4.184.121.217  # errors=85 total=160 ratio=0.531 first=27/Jul/2026:04:29:45 +0200 last=23/Jul/2026:21:12:12 +0200
-162.158.217.79  # errors=83 total=114 ratio=0.728 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:05:33:18 +0200
-172.213.244.85  # errors=83 total=83 ratio=1.0 first=31/Jul/2026:19:01:49 +0200 last=31/Jul/2026:19:01:52 +0200
-20.203.135.57  # errors=83 total=166 ratio=0.5 first=30/Jul/2026:01:33:05 +0200 last=31/Jul/2026:13:03:39 +0200
-20.220.227.237  # errors=83 total=83 ratio=1.0 first=29/Jul/2026:19:34:09 +0200 last=29/Jul/2026:19:34:25 +0200
-45.148.10.120  # errors=83 total=99 ratio=0.838 first=27/Jul/2026:11:57:56 +0200 last=16/Jul/2026:19:21:42 +0200
-91.224.92.159  # errors=82 total=82 ratio=1.0 first=17/Jul/2026:12:36:19 +0200 last=17/Jul/2026:12:36:30 +0200
-172.71.98.95  # errors=81 total=95 ratio=0.853 first=12/Jul/2026:22:49:33 +0200 last=13/Jul/2026:16:48:17 +0200
-195.178.110.135  # errors=80 total=80 ratio=1.0 first=28/Jul/2026:06:10:46 +0200 last=27/Jul/2026:11:44:20 +0200
-92.118.39.126  # errors=80 total=94 ratio=0.851 first=18/Jul/2026:11:29:34 +0200 last=18/Jul/2026:11:29:36 +0200
-20.100.176.141  # errors=75 total=75 ratio=1.0 first=24/Jul/2026:05:17:00 +0200 last=24/Jul/2026:05:17:07 +0200
-146.70.40.68  # errors=74 total=81 ratio=0.914 first=15/Jul/2026:20:55:47 +0200 last=15/Jul/2026:16:09:29 +0200
-74.248.35.25  # errors=74 total=74 ratio=1.0 first=02/Aug/2026:16:07:14 +0200 last=02/Aug/2026:16:24:21 +0200
-162.158.217.81  # errors=73 total=94 ratio=0.777 first=12/Jul/2026:11:21:31 +0200 last=12/Jul/2026:22:49:34 +0200
-199.16.157.181  # errors=73 total=99 ratio=0.737 first=11/Aug/2026:04:39:56 +0200 last=01/Aug/2026:23:56:40 +0200
-20.203.221.142  # errors=72 total=72 ratio=1.0 first=02/Aug/2026:09:56:46 +0200 last=02/Aug/2026:09:56:49 +0200
-23.161.169.127  # errors=72 total=90 ratio=0.8 first=21/Jul/2026:05:33:30 +0200 last=16/Jul/2026:11:39:39 +0200
-4.193.178.28  # errors=72 total=72 ratio=1.0 first=20/Jul/2026:00:27:56 +0200 last=20/Jul/2026:05:29:31 +0200
-51.120.83.160  # errors=72 total=72 ratio=1.0 first=02/Aug/2026:17:40:29 +0200 last=02/Aug/2026:17:40:39 +0200
-91.92.42.86  # errors=72 total=144 ratio=0.5 first=13/Jul/2026:16:45:11 +0200 last=16/Jul/2026:10:18:35 +0200
-91.92.47.101  # errors=72 total=144 ratio=0.5 first=26/Jul/2026:12:23:03 +0200 last=24/Jul/2026:13:08:34 +0200
-45.45.237.214  # errors=71 total=74 ratio=0.959 first=28/Jul/2026:14:26:24 +0200 last=28/Jul/2026:14:26:26 +0200
-159.89.174.87  # errors=69 total=125 ratio=0.552 first=28/Jul/2026:20:38:51 +0200 last=27/Jul/2026:14:51:05 +0200
-20.127.18.0  # errors=68 total=134 ratio=0.507 first=20/Jul/2026:03:56:50 +0200 last=20/Jul/2026:06:37:39 +0200
-23.102.123.231  # errors=67 total=67 ratio=1.0 first=20/Jul/2026:01:40:16 +0200 last=20/Jul/2026:01:40:23 +0200
-35.199.111.12  # errors=67 total=72 ratio=0.931 first=22/Jul/2026:00:02:46 +0200 last=22/Jul/2026:00:02:50 +0200
-192.253.248.142  # errors=65 total=69 ratio=0.942 first=26/Jul/2026:08:47:19 +0200 last=29/Jul/2026:21:42:37 +0200
-20.203.208.53  # errors=64 total=64 ratio=1.0 first=10/Aug/2026:20:15:15 +0200 last=10/Aug/2026:20:15:17 +0200
-4.232.147.36  # errors=64 total=128 ratio=0.5 first=10/Aug/2026:12:56:49 +0200 last=10/Aug/2026:12:56:51 +0200
-91.148.244.131  # errors=64 total=72 ratio=0.889 first=18/Jul/2026:16:14:29 +0200 last=18/Jul/2026:16:14:20 +0200
-162.158.217.78  # errors=63 total=85 ratio=0.741 first=12/Jul/2026:05:02:29 +0200 last=12/Jul/2026:23:23:03 +0200
-81.171.72.93  # errors=63 total=68 ratio=0.926 first=27/Jul/2026:14:54:37 +0200 last=31/Jul/2026:11:36:58 +0200
-157.143.3.35  # errors=62 total=81 ratio=0.765 first=18/Jul/2026:15:30:42 +0200 last=10/Aug/2026:12:55:47 +0200
-162.158.108.94  # errors=62 total=67 ratio=0.925 first=12/Jul/2026:12:50:33 +0200 last=14/Jul/2026:06:05:56 +0200
-209.99.189.152  # errors=62 total=68 ratio=0.912 first=27/Jul/2026:20:03:04 +0200 last=27/Jul/2026:14:14:48 +0200
-136.109.135.10  # errors=61 total=61 ratio=1.0 first=09/Aug/2026:20:05:19 +0200 last=09/Aug/2026:20:05:41 +0200
-91.148.245.81  # errors=60 total=65 ratio=0.923 first=02/Aug/2026:16:17:20 +0200 last=09/Aug/2026:22:55:53 +0200
-139.59.231.238  # errors=59 total=63 ratio=0.937 first=23/Jul/2026:23:50:22 +0200 last=23/Jul/2026:23:51:33 +0200
-199.16.157.183  # errors=59 total=80 ratio=0.738 first=10/Aug/2026:12:44:20 +0200 last=01/Aug/2026:23:17:21 +0200
-20.208.40.114  # errors=59 total=59 ratio=1.0 first=31/Jul/2026:04:54:00 +0200 last=31/Jul/2026:04:54:10 +0200
-104.22.20.111  # errors=58 total=89 ratio=0.652 first=08/Jun/2026:08:49:07 +0200 last=14/Jul/2026:22:15:03 +0200
-146.190.63.248  # errors=58 total=63 ratio=0.921 first=14/Jul/2026:11:35:54 +0200 last=23/Jul/2026:23:51:15 +0200
-209.99.189.160  # errors=58 total=85 ratio=0.682 first=29/Jul/2026:21:27:11 +0200 last=11/Aug/2026:10:33:54 +0200
-104.23.172.43  # errors=57 total=61 ratio=0.934 first=12/Jul/2026:22:49:39 +0200 last=14/Jul/2026:17:07:58 +0200
-172.71.95.72  # errors=57 total=58 ratio=0.983 first=14/Jul/2026:16:07:16 +0200 last=14/Jul/2026:16:07:19 +0200
-45.45.237.186  # errors=56 total=66 ratio=0.848 first=09/Aug/2026:19:04:48 +0200 last=09/Aug/2026:19:05:01 +0200
-199.16.157.180  # errors=55 total=69 ratio=0.797 first=10/Aug/2026:21:23:58 +0200 last=01/Aug/2026:21:54:11 +0200
-20.116.62.111  # errors=55 total=110 ratio=0.5 first=02/Jun/2026:13:53:47 +0200 last=02/Jun/2026:13:53:59 +0200
-34.139.141.56  # errors=55 total=55 ratio=1.0 first=25/Jul/2026:08:39:25 +0200 last=22/Jul/2026:11:01:03 +0200
-194.26.192.156  # errors=54 total=63 ratio=0.857 first=10/Aug/2026:02:04:53 +0200 last=10/Aug/2026:22:24:54 +0200
-216.73.217.54  # errors=54 total=57 ratio=0.947 first=16/Jul/2026:17:32:53 +0200 last=18/Jul/2026:21:33:09 +0200
-45.154.98.134  # errors=54 total=126 ratio=0.429 first=12/Jul/2026:07:19:06 +0200 last=22/Jul/2026:01:41:32 +0200
-93.152.221.13  # errors=54 total=118 ratio=0.458 first=20/Jul/2026:13:51:17 +0200 last=20/Jul/2026:13:51:55 +0200
-172.213.232.128  # errors=53 total=53 ratio=1.0 first=02/Aug/2026:13:35:20 +0200 last=02/Aug/2026:13:35:22 +0200
-162.158.217.102  # errors=52 total=80 ratio=0.65 first=12/Jul/2026:16:32:36 +0200 last=12/Jul/2026:23:23:28 +0200
-77.90.185.230  # errors=52 total=54 ratio=0.963 first=26/Jul/2026:22:04:36 +0200 last=26/Jul/2026:22:06:01 +0200
-91.92.241.196  # errors=52 total=82 ratio=0.634 first=30/Jul/2026:21:10:49 +0200 last=18/Jul/2026:22:15:09 +0200
-104.22.20.4  # errors=51 total=72 ratio=0.708 first=12/Jul/2026:04:43:33 +0200 last=14/Jul/2026:20:54:36 +0200
-45.153.34.182  # errors=51 total=91 ratio=0.56 first=19/Jul/2026:12:54:33 +0200 last=01/Aug/2026:16:01:14 +0200
-104.22.20.109  # errors=50 total=72 ratio=0.694 first=12/Jul/2026:07:26:02 +0200 last=14/Jul/2026:20:54:35 +0200
-162.158.217.105  # errors=50 total=96 ratio=0.521 first=12/Jul/2026:06:17:48 +0200 last=14/Jul/2026:22:25:31 +0200
-45.153.34.16  # errors=50 total=50 ratio=1.0 first=21/Jul/2026:08:31:13 +0200 last=30/Jul/2026:03:57:50 +0200
-20.215.186.32  # errors=49 total=98 ratio=0.5 first=10/Aug/2026:07:15:57 +0200 last=10/Aug/2026:07:16:01 +0200
-199.16.157.182  # errors=48 total=57 ratio=0.842 first=11/Aug/2026:05:59:14 +0200 last=01/Aug/2026:19:11:05 +0200
-4.184.238.149  # errors=47 total=47 ratio=1.0 first=10/Aug/2026:21:57:40 +0200 last=10/Aug/2026:21:57:44 +0200
-162.158.217.104  # errors=46 total=96 ratio=0.479 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:22:59 +0200
-104.28.240.187  # errors=45 total=45 ratio=1.0 first=29/Jul/2026:05:34:35 +0200 last=27/Jul/2026:18:39:03 +0200
-172.70.142.120  # errors=45 total=49 ratio=0.918 first=14/Jul/2026:17:56:38 +0200 last=14/Jul/2026:17:56:57 +0200
-40.80.90.100  # errors=45 total=45 ratio=1.0 first=11/Aug/2026:08:00:31 +0200 last=11/Aug/2026:08:00:37 +0200
-66.187.5.228  # errors=45 total=64 ratio=0.703 first=31/Jul/2026:19:43:04 +0200 last=21/Jul/2026:10:22:39 +0200
-162.158.217.143  # errors=44 total=69 ratio=0.638 first=12/Jul/2026:04:15:03 +0200 last=12/Jul/2026:23:22:53 +0200
-169.58.42.242  # errors=44 total=44 ratio=1.0 first=10/Aug/2026:11:46:36 +0200 last=10/Aug/2026:11:47:10 +0200
-172.71.81.181  # errors=44 total=45 ratio=0.978 first=14/Jul/2026:09:24:55 +0200 last=14/Jul/2026:09:25:05 +0200
-91.224.92.190  # errors=44 total=44 ratio=1.0 first=16/Jul/2026:18:16:54 +0200 last=16/Jul/2026:18:16:57 +0200
-162.158.217.125  # errors=43 total=75 ratio=0.573 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:22:49:34 +0200
-162.158.217.19  # errors=43 total=67 ratio=0.642 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:23:21 +0200
-162.158.217.38  # errors=43 total=84 ratio=0.512 first=12/Jul/2026:22:49:40 +0200 last=13/Jul/2026:16:48:17 +0200
-104.22.20.112  # errors=42 total=65 ratio=0.646 first=12/Jul/2026:05:26:40 +0200 last=14/Jul/2026:22:15:03 +0200
-162.158.217.110  # errors=42 total=98 ratio=0.429 first=12/Jul/2026:04:16:03 +0200 last=12/Jun/2026:08:25:00 +0200
-216.73.216.25  # errors=42 total=42 ratio=1.0 first=24/Jul/2026:03:04:35 +0200 last=25/Jul/2026:22:49:24 +0200
-5.253.247.16  # errors=42 total=75 ratio=0.56 first=19/Jul/2026:11:29:20 +0200 last=19/Jul/2026:11:29:21 +0200
-104.22.20.113  # errors=41 total=61 ratio=0.672 first=12/Jul/2026:04:43:33 +0200 last=14/Jul/2026:21:44:51 +0200
-162.158.217.85  # errors=41 total=63 ratio=0.651 first=12/Jul/2026:05:22:34 +0200 last=12/Jun/2026:12:19:58 +0200
-162.158.217.103  # errors=40 total=74 ratio=0.541 first=12/Jul/2026:05:43:39 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.5  # errors=40 total=68 ratio=0.588 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:03:45:49 +0200
-162.158.217.97  # errors=40 total=90 ratio=0.444 first=12/Jul/2026:05:55:42 +0200 last=12/Jul/2026:23:23:23 +0200
-185.177.72.205  # errors=40 total=40 ratio=1.0 first=21/Jul/2026:04:53:51 +0200 last=18/Jul/2026:08:26:02 +0200
-104.22.17.65  # errors=39 total=55 ratio=0.709 first=12/Jul/2026:16:03:23 +0200 last=14/Jul/2026:20:12:28 +0200
-104.23.239.80  # errors=39 total=39 ratio=1.0 first=13/Jul/2026:00:42:34 +0200 last=13/Jul/2026:00:43:09 +0200
-146.70.194.230  # errors=39 total=62 ratio=0.629 first=20/Jul/2026:13:04:20 +0200 last=20/Jul/2026:17:00:48 +0200
-162.158.217.116  # errors=39 total=94 ratio=0.415 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:22:49:34 +0200
-104.22.20.5  # errors=38 total=66 ratio=0.576 first=12/Jul/2026:07:05:58 +0200 last=14/Jul/2026:22:15:03 +0200
-162.158.217.41  # errors=38 total=78 ratio=0.487 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:23:22 +0200
-162.158.217.57  # errors=38 total=68 ratio=0.559 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:23:21 +0200
-192.133.77.17  # errors=38 total=47 ratio=0.809 first=02/Aug/2026:13:14:30 +0200 last=01/Aug/2026:23:27:07 +0200
-85.204.70.118  # errors=38 total=41 ratio=0.927 first=01/Aug/2026:18:01:17 +0200 last=20/Jul/2026:02:09:55 +0200
-104.22.20.108  # errors=37 total=58 ratio=0.638 first=12/Jul/2026:05:38:42 +0200 last=14/Jul/2026:20:54:34 +0200
-104.22.20.110  # errors=37 total=65 ratio=0.569 first=12/Jul/2026:04:16:28 +0200 last=14/Jul/2026:22:16:30 +0200
-143.110.217.244  # errors=37 total=82 ratio=0.451 first=12/May/2026:11:42:14 +0200 last=12/May/2026:11:42:55 +0200
-158.158.45.224  # errors=37 total=37 ratio=1.0 first=01/Aug/2026:17:38:36 +0200 last=01/Aug/2026:17:38:40 +0200
-162.158.217.95  # errors=37 total=91 ratio=0.407 first=12/Jul/2026:04:36:07 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.224  # errors=37 total=43 ratio=0.86 first=12/Jul/2026:11:51:31 +0200 last=11/Jun/2026:16:44:43 +0200
-192.133.77.16  # errors=37 total=47 ratio=0.787 first=10/Aug/2026:01:37:03 +0200 last=01/Aug/2026:22:20:37 +0200
-4.184.185.91  # errors=37 total=74 ratio=0.5 first=01/Aug/2026:19:12:01 +0200 last=02/Aug/2026:15:28:03 +0200
-74.248.24.145  # errors=37 total=37 ratio=1.0 first=01/Aug/2026:19:47:32 +0200 last=01/Aug/2026:19:47:35 +0200
-104.22.17.146  # errors=36 total=50 ratio=0.72 first=12/Jul/2026:16:27:28 +0200 last=14/Jul/2026:23:09:08 +0200
-143.244.57.123  # errors=36 total=42 ratio=0.857 first=22/Jul/2026:10:57:08 +0200 last=12/Jul/2026:13:35:04 +0200
-146.70.194.220  # errors=36 total=40 ratio=0.9 first=21/Jul/2026:19:16:21 +0200 last=22/Jul/2026:10:23:16 +0200
-146.70.194.228  # errors=36 total=62 ratio=0.581 first=26/Jul/2026:18:59:13 +0200 last=11/Aug/2026:00:15:36 +0200
-162.158.217.21  # errors=36 total=80 ratio=0.45 first=12/Jul/2026:07:57:21 +0200 last=12/Jun/2026:10:57:26 +0200
-85.204.70.90  # errors=36 total=42 ratio=0.857 first=25/Jul/2026:12:35:51 +0200 last=11/Aug/2026:10:53:21 +0200
-104.22.17.64  # errors=35 total=48 ratio=0.729 first=12/Jul/2026:17:19:36 +0200 last=14/Jul/2026:22:15:02 +0200
-158.158.76.106  # errors=35 total=35 ratio=1.0 first=27/Jul/2026:20:08:52 +0200 last=27/Jul/2026:20:09:07 +0200
-162.158.217.25  # errors=35 total=59 ratio=0.593 first=12/Jul/2026:09:20:02 +0200 last=12/Jul/2026:23:23:23 +0200
-162.158.217.62  # errors=35 total=81 ratio=0.432 first=14/Jul/2026:13:23:08 +0200 last=14/Jul/2026:00:31:53 +0200
-192.133.77.15  # errors=35 total=45 ratio=0.778 first=02/Aug/2026:05:36:57 +0200 last=01/Aug/2026:21:32:11 +0200
-74.248.139.103  # errors=35 total=70 ratio=0.5 first=27/Jul/2026:06:44:21 +0200 last=27/Jul/2026:06:44:32 +0200
-162.158.217.118  # errors=34 total=72 ratio=0.472 first=12/Jul/2026:04:34:07 +0200 last=12/Jun/2026:12:40:07 +0200
-162.158.217.36  # errors=34 total=61 ratio=0.557 first=12/Jul/2026:05:08:31 +0200 last=12/Jul/2026:23:23:30 +0200
-162.158.217.77  # errors=34 total=79 ratio=0.43 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:12:27:00 +0200
-162.158.217.90  # errors=34 total=81 ratio=0.42 first=12/Jul/2026:06:53:01 +0200 last=12/Jul/2026:22:49:35 +0200
-162.158.217.91  # errors=34 total=71 ratio=0.479 first=12/Jul/2026:22:49:40 +0200 last=13/Jul/2026:16:48:17 +0200
-185.177.72.30  # errors=34 total=34 ratio=1.0 first=09/Aug/2026:22:50:55 +0200 last=31/Jul/2026:07:32:23 +0200
-162.158.108.125  # errors=33 total=34 ratio=0.971 first=14/Jul/2026:19:06:23 +0200 last=14/Jul/2026:19:07:15 +0200
-162.158.217.101  # errors=33 total=69 ratio=0.478 first=12/Jul/2026:04:33:07 +0200 last=12/Jun/2026:10:19:26 +0200
-162.158.217.147  # errors=33 total=66 ratio=0.5 first=12/Jul/2026:04:38:13 +0200 last=12/Jun/2026:12:04:54 +0200
-162.158.217.17  # errors=33 total=60 ratio=0.55 first=12/Jul/2026:22:49:40 +0200 last=14/Jul/2026:10:42:17 +0200
-162.158.217.7  # errors=33 total=73 ratio=0.452 first=14/Jul/2026:13:23:07 +0200 last=12/Jul/2026:22:49:35 +0200
-172.71.144.153  # errors=33 total=33 ratio=1.0 first=12/Jul/2026:06:18:07 +0200 last=15/Jul/2026:12:38:32 +0200
-172.71.148.15  # errors=33 total=35 ratio=0.943 first=12/Jul/2026:06:17:59 +0200 last=15/Jul/2026:08:26:27 +0200
-192.34.61.236  # errors=33 total=33 ratio=1.0 first=24/Jul/2026:01:44:09 +0200 last=24/Jul/2026:01:47:44 +0200
-104.22.20.76  # errors=32 total=33 ratio=0.97 first=12/Jul/2026:07:13:57 +0200 last=14/Jul/2026:17:18:52 +0200
-162.158.217.114  # errors=32 total=71 ratio=0.451 first=12/Jul/2026:05:38:38 +0200 last=12/Jun/2026:12:47:08 +0200
-162.158.217.39  # errors=32 total=77 ratio=0.416 first=12/Jul/2026:05:24:35 +0200 last=12/Jul/2026:23:23:27 +0200
-162.158.217.52  # errors=32 total=51 ratio=0.627 first=12/Jul/2026:22:49:39 +0200 last=12/Jul/2026:23:23:23 +0200
-162.158.217.88  # errors=32 total=58 ratio=0.552 first=12/Jul/2026:22:49:40 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.164.214  # errors=32 total=34 ratio=0.941 first=12/Jul/2026:13:21:34 +0200 last=15/Jul/2026:13:38:49 +0200
-64.23.218.208  # errors=32 total=32 ratio=1.0 first=28/Jul/2026:17:33:28 +0200 last=28/Jul/2026:17:33:59 +0200
-128.199.182.55  # errors=31 total=32 ratio=0.969 first=23/Jul/2026:23:50:44 +0200 last=23/Jul/2026:23:51:17 +0200
-162.158.217.106  # errors=31 total=50 ratio=0.62 first=12/Jul/2026:04:31:06 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.127  # errors=31 total=52 ratio=0.596 first=12/Jul/2026:07:12:06 +0200 last=12/Jul/2026:22:49:33 +0200
-162.158.217.20  # errors=31 total=67 ratio=0.463 first=12/Jul/2026:22:49:40 +0200 last=13/Jul/2026:16:48:14 +0200
-162.158.217.58  # errors=31 total=69 ratio=0.449 first=12/Jul/2026:05:49:41 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.69  # errors=31 total=44 ratio=0.705 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:12:34:06 +0200
-162.158.217.99  # errors=31 total=61 ratio=0.508 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:10:57:26 +0200
-185.177.72.58  # errors=31 total=41 ratio=0.756 first=12/Jul/2026:16:49:09 +0200 last=18/Jul/2026:08:30:07 +0200
-104.196.62.35  # errors=30 total=31 ratio=0.968 first=17/Jul/2026:11:00:24 +0200 last=17/Jul/2026:11:00:44 +0200
-162.158.111.131  # errors=30 total=33 ratio=0.909 first=12/Jul/2026:13:21:35 +0200 last=15/Jul/2026:08:26:24 +0200
-162.158.217.3  # errors=30 total=61 ratio=0.492 first=12/Jul/2026:04:45:15 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.67  # errors=30 total=57 ratio=0.526 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:10:57:26 +0200
-162.158.217.9  # errors=30 total=64 ratio=0.469 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:10:57:26 +0200
-194.5.82.104  # errors=30 total=32 ratio=0.938 first=17/Jul/2026:01:48:18 +0200 last=17/Jul/2026:12:55:52 +0200
-5.255.119.161  # errors=30 total=31 ratio=0.968 first=27/Jul/2026:11:36:31 +0200 last=27/Jul/2026:09:36:33 +0200
-147.182.149.75  # errors=29 total=31 ratio=0.935 first=23/Jul/2026:23:50:18 +0200 last=23/Jul/2026:23:50:45 +0200
-162.158.217.115  # errors=29 total=60 ratio=0.483 first=12/Jul/2026:04:54:22 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.137  # errors=29 total=66 ratio=0.439 first=12/Jul/2026:06:15:48 +0200 last=12/Jul/2026:22:49:33 +0200
-162.158.217.145  # errors=29 total=68 ratio=0.426 first=12/Jul/2026:16:37:38 +0200 last=12/Jul/2026:22:49:34 +0200
-162.158.217.2  # errors=29 total=48 ratio=0.604 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:23:22 +0200
-162.158.217.37  # errors=29 total=48 ratio=0.604 first=12/Jul/2026:04:50:16 +0200 last=12/Jul/2026:22:49:34 +0200
-162.158.217.74  # errors=29 total=69 ratio=0.42 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:23:23:22 +0200
-162.158.217.82  # errors=29 total=47 ratio=0.617 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:08:57:08 +0200
-167.99.181.249  # errors=29 total=31 ratio=0.935 first=23/Jul/2026:23:50:26 +0200 last=23/Jul/2026:23:51:01 +0200
-172.69.135.193  # errors=29 total=31 ratio=0.935 first=12/Jul/2026:06:50:53 +0200 last=14/Jul/2026:21:42:24 +0200
-172.69.155.26  # errors=29 total=29 ratio=1.0 first=15/Jul/2026:11:56:49 +0200 last=15/Jul/2026:11:56:55 +0200
-192.133.77.18  # errors=29 total=38 ratio=0.763 first=02/Aug/2026:07:45:28 +0200 last=28/Jul/2026:03:59:29 +0200
-104.22.17.147  # errors=28 total=45 ratio=0.622 first=12/Jul/2026:15:42:21 +0200 last=15/Jul/2026:02:59:10 +0200
-104.23.239.81  # errors=28 total=30 ratio=0.933 first=13/Jul/2026:14:25:38 +0200 last=15/Jul/2026:06:32:25 +0200
-104.23.243.188  # errors=28 total=28 ratio=1.0 first=12/Jul/2026:08:40:27 +0200 last=15/Jul/2026:14:02:55 +0200
-138.197.191.87  # errors=28 total=31 ratio=0.903 first=21/Jul/2026:21:25:41 +0200 last=21/Jul/2026:21:26:07 +0200
-146.190.63.48  # errors=28 total=31 ratio=0.903 first=21/Jul/2026:21:25:41 +0200 last=21/Jul/2026:21:26:08 +0200
-162.158.167.143  # errors=28 total=30 ratio=0.933 first=12/Jul/2026:08:31:09 +0200 last=14/Jul/2026:19:06:10 +0200
-162.158.217.107  # errors=28 total=48 ratio=0.583 first=12/Jul/2026:22:49:39 +0200 last=12/Jul/2026:22:49:33 +0200
-162.158.217.139  # errors=28 total=58 ratio=0.483 first=12/Jul/2026:06:39:54 +0200 last=12/Jun/2026:10:57:26 +0200
-162.158.217.16  # errors=28 total=59 ratio=0.475 first=14/Jul/2026:13:23:20 +0200 last=13/Jul/2026:16:48:16 +0200
-162.158.217.22  # errors=28 total=62 ratio=0.452 first=12/Jul/2026:10:38:30 +0200 last=12/Jun/2026:12:15:57 +0200
-162.158.217.42  # errors=28 total=53 ratio=0.528 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:06:43:38 +0200
-162.158.217.47  # errors=28 total=64 ratio=0.438 first=12/Jul/2026:08:21:37 +0200 last=12/Jul/2026:23:23:06 +0200
-162.158.217.72  # errors=28 total=51 ratio=0.549 first=12/Jul/2026:04:27:06 +0200 last=12/Jun/2026:11:21:44 +0200
-172.70.46.222  # errors=28 total=33 ratio=0.848 first=14/Jul/2026:09:50:35 +0200 last=14/Jul/2026:09:50:44 +0200
-178.16.54.137  # errors=28 total=64 ratio=0.438 first=13/Jul/2026:20:47:20 +0200 last=21/Jul/2026:04:21:23 +0200
-192.133.77.14  # errors=28 total=37 ratio=0.757 first=02/Aug/2026:16:28:14 +0200 last=01/Aug/2026:19:08:34 +0200
-216.73.216.140  # errors=28 total=30 ratio=0.933 first=27/Jul/2026:09:39:07 +0200 last=01/Aug/2026:19:51:26 +0200
-103.221.220.62  # errors=27 total=27 ratio=1.0 first=19/Jul/2026:13:50:33 +0200 last=19/Jul/2026:08:11:12 +0200
-104.22.17.112  # errors=27 total=37 ratio=0.73 first=12/Jul/2026:16:15:27 +0200 last=15/Jul/2026:02:00:14 +0200
-143.244.168.161  # errors=27 total=31 ratio=0.871 first=18/Jul/2026:16:15:32 +0200 last=18/Jul/2026:16:16:02 +0200
-157.245.105.107  # errors=27 total=31 ratio=0.871 first=29/Jul/2026:10:29:49 +0200 last=29/Jul/2026:10:30:23 +0200
-157.245.204.205  # errors=27 total=31 ratio=0.871 first=14/Jul/2026:11:35:54 +0200 last=14/Jul/2026:11:36:23 +0200
-159.65.144.72  # errors=27 total=31 ratio=0.871 first=02/Aug/2026:08:20:11 +0200 last=02/Aug/2026:08:20:43 +0200
-162.158.167.175  # errors=27 total=59 ratio=0.458 first=12/Jul/2026:20:25:42 +0200 last=14/Jul/2026:21:30:43 +0200
-162.158.217.122  # errors=27 total=60 ratio=0.45 first=12/Jul/2026:04:57:23 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.135  # errors=27 total=53 ratio=0.509 first=12/Jul/2026:05:13:32 +0200 last=14/Jul/2026:05:52:15 +0200
-162.158.217.144  # errors=27 total=54 ratio=0.5 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:11:16:43 +0200
-162.158.217.48  # errors=27 total=62 ratio=0.435 first=12/Jul/2026:06:27:51 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.60  # errors=27 total=63 ratio=0.429 first=12/Jul/2026:04:43:14 +0200 last=12/Jul/2026:22:49:35 +0200
-167.99.182.39  # errors=27 total=31 ratio=0.871 first=27/Jul/2026:14:50:37 +0200 last=27/Jul/2026:14:51:05 +0200
-172.70.80.47  # errors=27 total=27 ratio=1.0 first=13/Jul/2026:22:27:47 +0200 last=14/Jul/2026:05:45:14 +0200
-172.71.141.225  # errors=27 total=38 ratio=0.711 first=12/Jul/2026:10:50:29 +0200 last=11/Jun/2026:07:21:21 +0200
-195.178.110.211  # errors=27 total=38 ratio=0.711 first=19/Jul/2026:21:35:03 +0200 last=22/Jul/2026:17:11:53 +0200
-206.189.19.19  # errors=27 total=31 ratio=0.871 first=24/Jul/2026:11:36:52 +0200 last=24/Jul/2026:11:37:19 +0200
-206.189.95.232  # errors=27 total=31 ratio=0.871 first=23/Jul/2026:23:50:24 +0200 last=23/Jul/2026:23:50:55 +0200
-206.81.12.187  # errors=27 total=31 ratio=0.871 first=31/Jul/2026:07:47:20 +0200 last=31/Jul/2026:07:48:03 +0200
-206.81.24.227  # errors=27 total=31 ratio=0.871 first=18/Jul/2026:16:15:42 +0200 last=18/Jul/2026:16:16:10 +0200
-68.183.180.73  # errors=27 total=31 ratio=0.871 first=24/Jul/2026:11:36:53 +0200 last=24/Jul/2026:11:37:22 +0200
-104.22.17.215  # errors=26 total=33 ratio=0.788 first=12/Jul/2026:16:15:27 +0200 last=14/Jul/2026:22:15:02 +0200
-162.158.167.213  # errors=26 total=49 ratio=0.531 first=12/Jul/2026:04:51:36 +0200 last=14/Jul/2026:18:32:05 +0200
-162.158.167.217  # errors=26 total=54 ratio=0.481 first=12/Jul/2026:05:02:35 +0200 last=15/Jul/2026:02:12:52 +0200
-162.158.217.126  # errors=26 total=33 ratio=0.788 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:12:38:07 +0200
-162.158.217.134  # errors=26 total=57 ratio=0.456 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:12:29:05 +0200
-162.158.217.18  # errors=26 total=54 ratio=0.481 first=12/Jul/2026:06:31:52 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.24  # errors=26 total=53 ratio=0.491 first=12/Jul/2026:07:55:21 +0200 last=13/Jul/2026:16:48:12 +0200
-162.158.217.56  # errors=26 total=57 ratio=0.456 first=12/Jul/2026:07:11:06 +0200 last=12/Jun/2026:12:44:08 +0200
-172.71.155.67  # errors=26 total=26 ratio=1.0 first=12/Jul/2026:07:05:58 +0200 last=15/Jul/2026:00:34:12 +0200
-23.178.112.211  # errors=26 total=52 ratio=0.5 first=10/Aug/2026:10:30:29 +0200 last=31/Jul/2026:02:00:11 +0200
-91.239.79.146  # errors=26 total=26 ratio=1.0 first=20/May/2026:18:42:06 +0200 last=20/May/2026:18:42:25 +0200
-104.22.17.214  # errors=25 total=39 ratio=0.641 first=12/Jul/2026:12:05:45 +0200 last=14/Jul/2026:21:18:40 +0200
-128.199.182.152  # errors=25 total=62 ratio=0.403 first=18/Jul/2026:16:15:31 +0200 last=23/Jul/2026:23:51:35 +0200
-162.158.217.133  # errors=25 total=55 ratio=0.455 first=12/Jul/2026:07:36:17 +0200 last=12/Jul/2026:23:23:21 +0200
-162.158.217.142  # errors=25 total=62 ratio=0.403 first=12/Jul/2026:09:23:03 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.4  # errors=25 total=57 ratio=0.439 first=12/Jul/2026:14:46:51 +0200 last=12/Jun/2026:09:29:55 +0200
-162.158.217.40  # errors=25 total=58 ratio=0.431 first=12/Jul/2026:07:27:10 +0200 last=12/Jul/2026:23:23:22 +0200
-162.158.217.44  # errors=25 total=61 ratio=0.41 first=12/Jul/2026:11:08:58 +0200 last=12/Jul/2026:23:23:21 +0200
-162.158.217.45  # errors=25 total=50 ratio=0.5 first=12/Jul/2026:05:59:43 +0200 last=12/Jul/2026:23:23:23 +0200
-162.158.217.66  # errors=25 total=60 ratio=0.417 first=12/Jul/2026:05:33:37 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.217.83  # errors=25 total=48 ratio=0.521 first=12/Jul/2026:04:47:15 +0200 last=13/Jul/2026:16:48:17 +0200
-162.158.94.43  # errors=25 total=25 ratio=1.0 first=12/Jul/2026:04:45:12 +0200 last=14/Jul/2026:23:33:39 +0200
-167.99.210.137  # errors=25 total=31 ratio=0.806 first=23/Jul/2026:23:51:00 +0200 last=23/Jul/2026:23:51:35 +0200
-172.68.195.231  # errors=25 total=33 ratio=0.758 first=12/Jul/2026:09:25:59 +0200 last=15/Jul/2026:10:37:29 +0200
-172.69.130.52  # errors=25 total=25 ratio=1.0 first=14/Jul/2026:05:10:37 +0200 last=14/Jul/2026:05:10:44 +0200
-172.69.22.184  # errors=25 total=25 ratio=1.0 first=12/Jul/2026:05:02:35 +0200 last=14/Jul/2026:19:18:19 +0200
-3.237.185.144  # errors=25 total=28 ratio=0.893 first=17/Jul/2026:07:25:48 +0200 last=17/Jul/2026:07:26:03 +0200
-45.153.34.43  # errors=25 total=25 ratio=1.0 first=22/Jul/2026:23:57:07 +0200 last=22/Jul/2026:23:59:51 +0200
-54.82.69.43  # errors=25 total=29 ratio=0.862 first=17/Jul/2026:07:54:53 +0200 last=17/Jul/2026:07:55:09 +0200
-104.28.222.131  # errors=24 total=25 ratio=0.96 first=24/Jul/2026:20:20:16 +0200 last=24/Jul/2026:20:20:33 +0200
-162.158.217.84  # errors=24 total=45 ratio=0.533 first=12/Jul/2026:06:47:00 +0200 last=12/Jun/2026:11:29:46 +0200
-162.158.217.96  # errors=24 total=43 ratio=0.558 first=12/Jul/2026:22:49:41 +0200 last=12/Jun/2026:11:25:45 +0200
-130.12.180.39  # errors=23 total=29 ratio=0.793 first=10/Aug/2026:04:47:56 +0200 last=27/Jul/2026:14:49:18 +0200
-162.158.167.214  # errors=23 total=45 ratio=0.511 first=12/Jul/2026:05:02:35 +0200 last=15/Jul/2026:02:59:09 +0200
-162.158.167.218  # errors=23 total=47 ratio=0.489 first=12/Jul/2026:04:16:28 +0200 last=14/Jul/2026:19:43:23 +0200
-162.158.217.111  # errors=23 total=55 ratio=0.418 first=12/Jul/2026:05:36:38 +0200 last=12/Jun/2026:12:35:06 +0200
-162.158.217.32  # errors=23 total=43 ratio=0.535 first=12/Jul/2026:18:59:58 +0200 last=12/Jun/2026:10:57:26 +0200
-162.158.217.89  # errors=23 total=55 ratio=0.418 first=12/Jul/2026:04:26:05 +0200 last=12/Jul/2026:23:23:09 +0200
-172.69.135.194  # errors=23 total=24 ratio=0.958 first=12/Jul/2026:05:26:39 +0200 last=14/Jul/2026:22:16:31 +0200
-172.70.142.121  # errors=23 total=24 ratio=0.958 first=14/Jul/2026:17:56:42 +0200 last=14/Jul/2026:17:56:57 +0200
-172.70.248.75  # errors=23 total=24 ratio=0.958 first=13/Jul/2026:11:50:11 +0200 last=15/Jul/2026:13:44:10 +0200
-172.71.159.76  # errors=23 total=23 ratio=1.0 first=12/Jul/2026:05:51:44 +0200 last=14/Jul/2026:19:30:23 +0200
-172.71.172.155  # errors=23 total=23 ratio=1.0 first=12/Jul/2026:13:38:26 +0200 last=15/Jul/2026:06:12:15 +0200
-64.89.161.85  # errors=23 total=25 ratio=0.92 first=28/Jul/2026:18:21:38 +0200 last=31/Jul/2026:07:49:51 +0200
-104.22.17.113  # errors=22 total=33 ratio=0.667 first=12/Jul/2026:11:26:38 +0200 last=14/Jul/2026:22:15:03 +0200
-104.23.223.6  # errors=22 total=39 ratio=0.564 first=10/Aug/2026:11:31:02 +0200 last=18/Jul/2026:21:36:28 +0200
-162.158.167.32  # errors=22 total=45 ratio=0.489 first=12/Jul/2026:06:14:50 +0200 last=14/Jul/2026:20:12:28 +0200
-162.158.217.136  # errors=22 total=49 ratio=0.449 first=12/Jul/2026:05:46:40 +0200 last=15/Jul/2026:09:47:37 +0200
-162.158.217.33  # errors=22 total=52 ratio=0.423 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:06:30:34 +0200
-162.158.217.94  # errors=22 total=46 ratio=0.478 first=12/Jul/2026:04:48:15 +0200 last=14/Jul/2026:05:52:12 +0200
-162.243.79.174  # errors=22 total=35 ratio=0.629 first=25/Jul/2026:14:20:28 +0200 last=29/Jul/2026:18:28:46 +0200
-172.71.158.111  # errors=22 total=45 ratio=0.489 first=12/Jul/2026:04:43:33 +0200 last=14/Jul/2026:21:44:52 +0200
-172.71.158.223  # errors=22 total=37 ratio=0.595 first=12/Jul/2026:05:23:42 +0200 last=14/Jul/2026:19:30:23 +0200
-35.198.180.224  # errors=22 total=23 ratio=0.957 first=02/Aug/2026:16:14:37 +0200 last=02/Aug/2026:16:14:48 +0200
-45.61.150.67  # errors=22 total=22 ratio=1.0 first=27/Jul/2026:11:56:36 +0200 last=17/Jul/2026:04:13:23 +0200
-162.158.167.31  # errors=21 total=44 ratio=0.477 first=12/Jul/2026:04:16:29 +0200 last=14/Jul/2026:20:42:32 +0200
-162.158.217.23  # errors=21 total=48 ratio=0.438 first=12/Jul/2026:22:49:41 +0200 last=12/Jun/2026:10:57:26 +0200
-162.158.217.61  # errors=21 total=50 ratio=0.42 first=14/Jul/2026:09:24:59 +0200 last=12/Jun/2026:10:57:26 +0200
-66.187.6.102  # errors=21 total=25 ratio=0.84 first=26/Jul/2026:22:59:56 +0200 last=26/Jul/2026:23:00:57 +0200
-103.215.75.19  # errors=20 total=23 ratio=0.87 first=11/Aug/2026:08:23:44 +0200 last=25/Jul/2026:03:38:47 +0200
-111.113.89.107  # errors=20 total=20 ratio=1.0 first=02/Aug/2026:19:58:57 +0200 last=02/Aug/2026:20:00:05 +0200
-118.212.120.78  # errors=20 total=20 ratio=1.0 first=01/Aug/2026:22:00:28 +0200 last=01/Aug/2026:22:01:36 +0200
-118.81.196.142  # errors=20 total=20 ratio=1.0 first=02/Aug/2026:20:00:23 +0200 last=02/Aug/2026:20:01:48 +0200
-139.28.219.68  # errors=20 total=21 ratio=0.952 first=10/Aug/2026:11:27:37 +0200 last=10/Aug/2026:11:27:38 +0200
-143.244.57.120  # errors=20 total=20 ratio=1.0 first=30/Jul/2026:11:36:32 +0200 last=30/Jul/2026:11:37:31 +0200
-143.244.57.92  # errors=20 total=20 ratio=1.0 first=26/Jul/2026:13:56:30 +0200 last=26/Jul/2026:13:56:31 +0200
-171.104.81.195  # errors=20 total=20 ratio=1.0 first=31/Jul/2026:20:00:04 +0200 last=31/Jul/2026:20:01:10 +0200
-172.70.240.158  # errors=20 total=23 ratio=0.87 first=12/Jul/2026:19:56:25 +0200 last=15/Jul/2026:14:28:35 +0200
-2.58.56.101  # errors=20 total=20 ratio=1.0 first=29/Jul/2026:02:15:39 +0200 last=29/Jul/2026:02:15:40 +0200
-220.202.112.100  # errors=20 total=20 ratio=1.0 first=31/Jul/2026:04:01:48 +0200 last=31/Jul/2026:04:02:02 +0200
-223.199.187.171  # errors=20 total=20 ratio=1.0 first=01/Aug/2026:22:01:57 +0200 last=01/Aug/2026:22:03:08 +0200
-36.106.166.92  # errors=20 total=20 ratio=1.0 first=31/Jul/2026:04:02:13 +0200 last=31/Jul/2026:04:02:23 +0200
-82.102.18.188  # errors=20 total=20 ratio=1.0 first=31/Jul/2026:07:37:31 +0200 last=31/Jul/2026:07:38:31 +0200
-85.204.70.106  # errors=20 total=20 ratio=1.0 first=30/Jul/2026:19:29:41 +0200 last=30/Jul/2026:19:30:41 +0200
-85.204.70.98  # errors=20 total=41 ratio=0.488 first=25/Jul/2026:16:33:51 +0200 last=11/Aug/2026:02:41:59 +0200
-93.123.109.166  # errors=20 total=20 ratio=1.0 first=26/Jul/2026:16:49:02 +0200 last=26/Jul/2026:16:49:52 +0200
-94.154.43.177  # errors=20 total=40 ratio=0.5 first=02/Aug/2026:06:08:21 +0200 last=23/Jul/2026:03:03:19 +0200
-104.199.182.104  # errors=19 total=19 ratio=1.0 first=02/Aug/2026:17:10:08 +0200 last=02/Aug/2026:17:10:08 +0200
-104.22.20.77  # errors=19 total=20 ratio=0.95 first=12/Jul/2026:18:14:44 +0200 last=14/Jul/2026:20:30:32 +0200
-104.23.243.189  # errors=19 total=19 ratio=1.0 first=12/Jul/2026:04:33:12 +0200 last=15/Jul/2026:11:01:50 +0200
-110.179.81.90  # errors=19 total=19 ratio=1.0 first=01/Aug/2026:20:58:31 +0200 last=01/Aug/2026:20:58:36 +0200
-123.160.175.254  # errors=19 total=19 ratio=1.0 first=30/Jul/2026:12:08:15 +0200 last=30/Jul/2026:12:08:27 +0200
-123.178.210.228  # errors=19 total=19 ratio=1.0 first=29/Jul/2026:20:20:58 +0200 last=29/Jul/2026:20:21:13 +0200
-124.88.113.10  # errors=19 total=19 ratio=1.0 first=01/Aug/2026:04:17:35 +0200 last=01/Aug/2026:04:17:44 +0200
-162.158.108.82  # errors=19 total=20 ratio=0.95 first=14/Jul/2026:19:06:23 +0200 last=14/Jul/2026:19:06:32 +0200
-162.158.217.53  # errors=19 total=41 ratio=0.463 first=12/Jul/2026:04:28:06 +0200 last=12/Jun/2026:11:34:47 +0200
-172.69.22.185  # errors=19 total=20 ratio=0.95 first=12/Jul/2026:06:02:47 +0200 last=14/Jul/2026:21:30:42 +0200
-172.69.22.77  # errors=19 total=36 ratio=0.528 first=12/Jul/2026:05:23:41 +0200 last=14/Jul/2026:21:18:41 +0200
-172.71.155.68  # errors=19 total=21 ratio=0.905 first=12/Jul/2026:04:27:32 +0200 last=14/Jul/2026:19:42:25 +0200
-172.71.82.119  # errors=19 total=20 ratio=0.95 first=14/Jul/2026:09:24:56 +0200 last=14/Jul/2026:09:25:03 +0200
-172.71.95.71  # errors=19 total=19 ratio=1.0 first=14/Jul/2026:16:07:19 +0200 last=14/Jul/2026:16:07:20 +0200
-23.178.112.213  # errors=19 total=38 ratio=0.5 first=10/Aug/2026:04:01:19 +0200 last=30/Jul/2026:15:45:28 +0200
-34.17.159.73  # errors=19 total=19 ratio=1.0 first=02/Aug/2026:18:25:42 +0200 last=02/Aug/2026:18:25:42 +0200
-35.230.52.27  # errors=19 total=19 ratio=1.0 first=15/Jul/2026:18:19:56 +0200 last=15/Jul/2026:18:20:01 +0200
-138.197.104.211  # errors=18 total=21 ratio=0.857 first=14/Jul/2026:10:46:12 +0200 last=14/Jul/2026:10:46:15 +0200
-139.28.219.70  # errors=18 total=21 ratio=0.857 first=29/Jul/2026:17:00:57 +0200 last=29/Jul/2026:17:00:58 +0200
-143.244.57.121  # errors=18 total=28 ratio=0.643 first=25/Jul/2026:15:54:49 +0200 last=25/Jul/2026:15:32:01 +0200
-143.244.57.84  # errors=18 total=21 ratio=0.857 first=24/Jul/2026:00:21:59 +0200 last=24/Jul/2026:00:22:00 +0200
-143.244.57.90  # errors=18 total=21 ratio=0.857 first=11/Aug/2026:02:17:05 +0200 last=11/Aug/2026:02:17:06 +0200
-146.70.194.252  # errors=18 total=27 ratio=0.667 first=02/Aug/2026:12:45:53 +0200 last=26/Jul/2026:04:19:55 +0200
-146.70.194.254  # errors=18 total=21 ratio=0.857 first=26/Jul/2026:10:44:59 +0200 last=26/Jul/2026:10:45:01 +0200
-162.158.167.144  # errors=18 total=20 ratio=0.9 first=12/Jul/2026:04:43:32 +0200 last=14/Jul/2026:17:54:58 +0200
-172.71.158.180  # errors=18 total=43 ratio=0.419 first=12/Jul/2026:05:38:41 +0200 last=14/Jul/2026:22:16:31 +0200
-172.71.158.9  # errors=18 total=45 ratio=0.4 first=12/Jul/2026:04:27:32 +0200 last=14/Jul/2026:22:15:02 +0200
-20.226.114.112  # errors=18 total=20 ratio=0.9 first=22/Jul/2026:20:25:19 +0200 last=22/Jul/2026:20:25:24 +0200
-20.9.44.210  # errors=18 total=21 ratio=0.857 first=17/Jul/2026:17:39:41 +0200 last=17/Jul/2026:17:39:44 +0200
-203.159.90.217  # errors=18 total=21 ratio=0.857 first=12/Jul/2026:08:14:23 +0200 last=12/Jul/2026:08:14:25 +0200
-34.105.30.251  # errors=18 total=38 ratio=0.474 first=15/Jul/2026:17:55:43 +0200 last=15/Jul/2026:17:53:43 +0200
-45.139.104.172  # errors=18 total=22 ratio=0.818 first=25/Jul/2026:05:14:49 +0200 last=25/Jul/2026:12:18:49 +0200
-45.154.98.52  # errors=18 total=20 ratio=0.9 first=21/Jul/2026:23:13:06 +0200 last=21/Jul/2026:23:13:07 +0200
-82.102.18.116  # errors=18 total=20 ratio=0.9 first=11/Aug/2026:06:49:33 +0200 last=11/Aug/2026:06:49:34 +0200
-82.102.18.180  # errors=18 total=21 ratio=0.857 first=13/Jul/2026:06:17:12 +0200 last=13/Jul/2026:06:17:14 +0200
-82.102.18.182  # errors=18 total=21 ratio=0.857 first=20/Jul/2026:21:23:57 +0200 last=20/Jul/2026:21:24:13 +0200
-82.102.18.190  # errors=18 total=21 ratio=0.857 first=29/Jul/2026:20:04:52 +0200 last=29/Jul/2026:20:04:54 +0200
-84.17.60.251  # errors=18 total=21 ratio=0.857 first=18/Jul/2026:11:53:06 +0200 last=18/Jul/2026:11:53:07 +0200
-85.204.70.100  # errors=18 total=20 ratio=0.9 first=21/Jul/2026:15:55:11 +0200 last=21/Jul/2026:15:55:12 +0200
-85.204.70.112  # errors=18 total=21 ratio=0.857 first=22/Jul/2026:13:14:53 +0200 last=22/Jul/2026:13:14:53 +0200
-85.204.70.114  # errors=18 total=21 ratio=0.857 first=25/Jul/2026:10:54:12 +0200 last=25/Jul/2026:10:54:13 +0200
-85.204.70.116  # errors=18 total=21 ratio=0.857 first=20/Jul/2026:13:07:08 +0200 last=20/Jul/2026:13:07:09 +0200
-85.204.70.96  # errors=18 total=21 ratio=0.857 first=23/Jul/2026:13:02:26 +0200 last=23/Jul/2026:13:02:33 +0200
-91.239.157.185  # errors=18 total=21 ratio=0.857 first=11/Aug/2026:09:42:15 +0200 last=11/Aug/2026:09:42:16 +0200
-94.154.43.187  # errors=18 total=30 ratio=0.6 first=29/Jul/2026:09:28:02 +0200 last=20/Jul/2026:20:23:46 +0200
-104.23.221.57  # errors=17 total=30 ratio=0.567 first=19/Jul/2026:07:42:37 +0200 last=18/Jul/2026:16:56:59 +0200
-112.94.252.15  # errors=17 total=17 ratio=1.0 first=29/Jul/2026:12:04:25 +0200 last=29/Jul/2026:12:05:18 +0200
-136.109.87.37  # errors=17 total=20 ratio=0.85 first=24/Jul/2026:08:09:42 +0200 last=24/Jul/2026:08:09:46 +0200
-136.70.149.147  # errors=17 total=20 ratio=0.85 first=28/Jul/2026:10:22:11 +0200 last=28/Jul/2026:10:22:15 +0200
-161.118.251.181  # errors=17 total=20 ratio=0.85 first=16/Jul/2026:01:24:09 +0200 last=16/Jul/2026:01:24:13 +0200
-162.158.167.176  # errors=17 total=41 ratio=0.415 first=12/Jul/2026:20:25:36 +0200 last=14/Jul/2026:21:18:41 +0200
-172.71.159.75  # errors=17 total=18 ratio=0.944 first=12/Jul/2026:05:23:41 +0200 last=15/Jul/2026:01:23:03 +0200
-185.177.72.12  # errors=17 total=17 ratio=1.0 first=09/Aug/2026:22:51:54 +0200 last=25/Jul/2026:11:40:37 +0200
-216.73.216.66  # errors=17 total=17 ratio=1.0 first=22/Jul/2026:21:22:56 +0200 last=24/Jul/2026:01:04:10 +0200
-23.178.112.219  # errors=17 total=34 ratio=0.5 first=02/Aug/2026:08:40:04 +0200 last=01/Aug/2026:12:05:12 +0200
-34.186.83.134  # errors=17 total=20 ratio=0.85 first=28/Jul/2026:08:14:22 +0200 last=28/Jul/2026:08:14:25 +0200
-34.86.126.198  # errors=17 total=20 ratio=0.85 first=26/Jul/2026:08:44:24 +0200 last=26/Jul/2026:08:44:27 +0200
-35.237.178.50  # errors=17 total=20 ratio=0.85 first=30/Jul/2026:16:33:11 +0200 last=30/Jul/2026:16:33:14 +0200
-35.243.223.147  # errors=17 total=19 ratio=0.895 first=16/Jul/2026:15:07:47 +0200 last=16/Jul/2026:15:07:52 +0200
-94.154.43.178  # errors=17 total=36 ratio=0.472 first=27/Jul/2026:09:18:27 +0200 last=31/Jul/2026:06:26:36 +0200
-94.154.43.183  # errors=17 total=36 ratio=0.472 first=25/Jul/2026:02:01:42 +0200 last=18/Jul/2026:23:07:35 +0200
-103.153.183.126  # errors=16 total=16 ratio=1.0 first=19/May/2026:14:09:34 +0200 last=20/May/2026:14:01:42 +0200
-103.168.66.237  # errors=16 total=16 ratio=1.0 first=19/May/2026:13:59:06 +0200 last=20/May/2026:14:01:47 +0200
-104.23.201.129  # errors=16 total=18 ratio=0.889 first=13/Jul/2026:02:10:14 +0200 last=13/Jul/2026:02:10:17 +0200
-136.108.11.195  # errors=16 total=30 ratio=0.533 first=17/Jul/2026:10:33:11 +0200 last=17/Jul/2026:10:32:14 +0200
-162.158.182.193  # errors=16 total=23 ratio=0.696 first=10/Aug/2026:06:01:07 +0200 last=18/Jul/2026:23:16:57 +0200
-162.158.217.68  # errors=16 total=38 ratio=0.421 first=15/Jul/2026:14:35:56 +0200 last=12/Jun/2026:08:22:00 +0200
-162.159.115.42  # errors=16 total=16 ratio=1.0 first=12/Jul/2026:18:35:41 +0200 last=15/Jul/2026:14:53:46 +0200
-172.69.23.170  # errors=16 total=33 ratio=0.485 first=12/Jul/2026:06:02:47 +0200 last=14/Jul/2026:20:48:33 +0200
-172.69.23.73  # errors=16 total=38 ratio=0.421 first=12/Jul/2026:04:27:32 +0200 last=14/Jul/2026:20:29:31 +0200
-172.69.23.74  # errors=16 total=38 ratio=0.421 first=12/Jul/2026:04:51:36 +0200 last=14/Jul/2026:19:07:13 +0200
-172.70.243.104  # errors=16 total=18 ratio=0.889 first=13/Jul/2026:07:49:15 +0200 last=15/Jul/2026:08:26:17 +0200
-172.71.120.171  # errors=16 total=16 ratio=1.0 first=13/Jul/2026:07:08:11 +0200 last=13/Jul/2026:07:08:15 +0200
-185.177.72.56  # errors=16 total=16 ratio=1.0 first=30/Jul/2026:03:47:45 +0200 last=30/Jul/2026:03:53:59 +0200
-185.177.72.69  # errors=16 total=16 ratio=1.0 first=21/Jul/2026:04:46:49 +0200 last=25/Jul/2026:11:39:28 +0200
-23.178.112.105  # errors=16 total=36 ratio=0.444 first=29/Jul/2026:16:26:02 +0200 last=18/Jul/2026:16:14:14 +0200
-8.229.1.130  # errors=16 total=16 ratio=1.0 first=02/Aug/2026:16:33:14 +0200 last=02/Aug/2026:16:33:14 +0200
-85.204.70.92  # errors=16 total=28 ratio=0.571 first=24/Jul/2026:08:42:05 +0200 last=11/Aug/2026:04:24:01 +0200
-93.123.109.152  # errors=16 total=16 ratio=1.0 first=31/Jul/2026:11:10:59 +0200 last=31/Jul/2026:11:10:59 +0200
-94.154.43.179  # errors=16 total=38 ratio=0.421 first=27/Jul/2026:09:12:43 +0200 last=17/Jul/2026:16:26:21 +0200
-104.23.217.153  # errors=15 total=27 ratio=0.556 first=09/Aug/2026:21:36:31 +0200 last=18/Jul/2026:03:29:07 +0200
-104.23.239.112  # errors=15 total=15 ratio=1.0 first=12/Jul/2026:19:41:08 +0200 last=15/Jul/2026:08:26:03 +0200
-136.107.208.33  # errors=15 total=16 ratio=0.938 first=14/Jul/2026:11:31:44 +0200 last=14/Jul/2026:11:31:47 +0200
-136.64.51.224  # errors=15 total=16 ratio=0.938 first=12/Jul/2026:12:40:24 +0200 last=12/Jul/2026:12:40:26 +0200
-172.69.130.67  # errors=15 total=15 ratio=1.0 first=15/Jul/2026:05:10:26 +0200 last=15/Jul/2026:05:10:30 +0200
-172.69.155.39  # errors=15 total=15 ratio=1.0 first=15/Jul/2026:11:56:49 +0200 last=15/Jul/2026:11:56:54 +0200
-172.71.141.234  # errors=15 total=35 ratio=0.429 first=12/Jul/2026:14:03:31 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.158.181  # errors=15 total=32 ratio=0.469 first=12/Jul/2026:07:15:00 +0200 last=14/Jul/2026:20:31:32 +0200
-172.71.82.118  # errors=15 total=15 ratio=1.0 first=14/Jul/2026:09:24:58 +0200 last=14/Jul/2026:09:25:03 +0200
-193.19.109.122  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:13:11:56 +0200 last=16/Jul/2026:13:12:04 +0200
-193.19.109.151  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:13:57:57 +0200 last=16/Jul/2026:13:58:05 +0200
-193.37.33.117  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:06:14:38 +0200 last=17/Jul/2026:06:14:46 +0200
-194.5.82.100  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:12:45:45 +0200 last=17/Jul/2026:12:45:50 +0200
-194.5.82.123  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:10:11:01 +0200 last=17/Jul/2026:10:11:08 +0200
-194.5.82.141  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:10:21:21 +0200 last=17/Jul/2026:10:21:28 +0200
-194.5.82.153  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:10:00:47 +0200 last=17/Jul/2026:10:00:54 +0200
-194.5.82.59  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:16:56:27 +0200 last=16/Jul/2026:16:56:31 +0200
-194.5.82.61  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:12:04:09 +0200 last=16/Jul/2026:12:04:17 +0200
-194.5.82.63  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:11:45:23 +0200 last=16/Jul/2026:11:45:37 +0200
-194.5.82.87  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:12:45:28 +0200 last=16/Jul/2026:12:45:39 +0200
-194.5.82.89  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:10:15:49 +0200 last=17/Jul/2026:10:15:55 +0200
-194.5.82.92  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:10:56:24 +0200 last=17/Jul/2026:10:56:31 +0200
-194.5.82.95  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:02:21:38 +0200 last=17/Jul/2026:02:21:45 +0200
-194.5.82.98  # errors=15 total=16 ratio=0.938 first=17/Jul/2026:02:05:44 +0200 last=17/Jul/2026:02:05:49 +0200
-216.73.216.41  # errors=15 total=15 ratio=1.0 first=27/Jul/2026:16:13:01 +0200 last=28/Jul/2026:07:23:21 +0200
-216.73.217.145  # errors=15 total=15 ratio=1.0 first=28/Jul/2026:12:53:10 +0200 last=31/Jul/2026:04:12:10 +0200
-217.217.252.197  # errors=15 total=16 ratio=0.938 first=16/Jul/2026:22:49:43 +0200 last=16/Jul/2026:22:49:52 +0200
-23.178.112.212  # errors=15 total=30 ratio=0.5 first=10/Aug/2026:04:04:22 +0200 last=30/Jul/2026:15:44:43 +0200
-34.11.127.22  # errors=15 total=16 ratio=0.938 first=21/Jul/2026:12:08:02 +0200 last=21/Jul/2026:12:08:04 +0200
-34.12.130.245  # errors=15 total=16 ratio=0.938 first=11/Aug/2026:11:19:39 +0200 last=11/Aug/2026:11:19:40 +0200
-34.181.134.189  # errors=15 total=16 ratio=0.938 first=19/Jul/2026:12:24:38 +0200 last=19/Jul/2026:12:24:41 +0200
-34.187.200.119  # errors=15 total=15 ratio=1.0 first=20/Jul/2026:18:19:21 +0200 last=20/Jul/2026:18:19:25 +0200
-34.69.107.154  # errors=15 total=16 ratio=0.938 first=20/Jul/2026:06:09:00 +0200 last=20/Jul/2026:06:09:04 +0200
-34.74.20.101  # errors=15 total=16 ratio=0.938 first=10/Aug/2026:09:30:49 +0200 last=10/Aug/2026:09:30:52 +0200
-34.86.217.208  # errors=15 total=16 ratio=0.938 first=21/Jul/2026:12:34:15 +0200 last=21/Jul/2026:12:34:17 +0200
-35.187.9.30  # errors=15 total=15 ratio=1.0 first=17/Jul/2026:10:56:47 +0200 last=17/Jul/2026:10:56:48 +0200
-35.196.22.146  # errors=15 total=16 ratio=0.938 first=15/Jul/2026:09:40:16 +0200 last=15/Jul/2026:09:40:21 +0200
-35.199.183.190  # errors=15 total=16 ratio=0.938 first=18/Jul/2026:09:09:31 +0200 last=18/Jul/2026:09:09:34 +0200
-35.231.140.112  # errors=15 total=16 ratio=0.938 first=11/Aug/2026:08:58:31 +0200 last=11/Aug/2026:08:58:34 +0200
-35.237.138.104  # errors=15 total=15 ratio=1.0 first=17/Jul/2026:09:00:17 +0200 last=17/Jul/2026:09:00:19 +0200
-35.243.173.211  # errors=15 total=16 ratio=0.938 first=15/Jul/2026:08:37:02 +0200 last=15/Jul/2026:08:37:04 +0200
-45.148.10.21  # errors=15 total=27 ratio=0.556 first=25/Jul/2026:22:06:28 +0200 last=25/Jul/2026:22:06:40 +0200
-69.30.85.194  # errors=15 total=18 ratio=0.833 first=30/Jul/2026:14:08:36 +0200 last=30/Jul/2026:14:18:02 +0200
-93.123.109.163  # errors=15 total=17 ratio=0.882 first=20/Jul/2026:03:16:34 +0200 last=20/Jul/2026:03:19:15 +0200
-94.154.43.184  # errors=15 total=29 ratio=0.517 first=27/Jul/2026:02:58:58 +0200 last=25/Jul/2026:20:54:06 +0200
-94.154.43.185  # errors=15 total=28 ratio=0.536 first=02/Aug/2026:06:02:34 +0200 last=23/Jul/2026:21:43:52 +0200
-162.159.113.8  # errors=14 total=19 ratio=0.737 first=13/Jul/2026:16:48:12 +0200 last=14/Jul/2026:05:52:15 +0200
-172.69.22.76  # errors=14 total=34 ratio=0.412 first=12/Jul/2026:06:37:53 +0200 last=14/Jul/2026:19:30:23 +0200
-172.70.240.159  # errors=14 total=14 ratio=1.0 first=12/Jul/2026:06:17:36 +0200 last=15/Jul/2026:10:14:15 +0200
-172.71.141.111  # errors=14 total=19 ratio=0.737 first=12/Jul/2026:16:33:37 +0200 last=11/Jun/2026:20:18:58 +0200
-172.71.154.154  # errors=14 total=31 ratio=0.452 first=12/Jul/2026:05:51:44 +0200 last=14/Jul/2026:17:42:59 +0200
-172.71.154.26  # errors=14 total=35 ratio=0.4 first=12/Jul/2026:04:16:28 +0200 last=14/Jul/2026:19:30:24 +0200
-172.71.158.8  # errors=14 total=35 ratio=0.4 first=12/Jul/2026:04:43:32 +0200 last=14/Jul/2026:21:18:40 +0200
-180.95.231.78  # errors=14 total=14 ratio=1.0 first=29/Jul/2026:11:57:59 +0200 last=29/Jul/2026:11:58:35 +0200
-194.233.91.21  # errors=14 total=14 ratio=1.0 first=30/Jul/2026:00:40:41 +0200 last=18/Jul/2026:10:56:28 +0200
-72.146.20.230  # errors=14 total=14 ratio=1.0 first=02/Aug/2026:05:01:31 +0200 last=02/Aug/2026:06:27:24 +0200
-94.154.43.186  # errors=14 total=23 ratio=0.609 first=02/Aug/2026:15:43:18 +0200 last=18/Jul/2026:19:16:58 +0200
-104.23.211.198  # errors=13 total=15 ratio=0.867 first=15/Jul/2026:09:50:11 +0200 last=15/Jul/2026:09:50:14 +0200
-104.23.239.113  # errors=13 total=13 ratio=1.0 first=12/Jul/2026:04:44:24 +0200 last=15/Jul/2026:03:36:58 +0200
-134.199.148.147  # errors=13 total=13 ratio=1.0 first=28/Jul/2026:22:52:50 +0200 last=28/Jul/2026:22:52:55 +0200
-170.64.144.116  # errors=13 total=26 ratio=0.5 first=28/Jul/2026:22:45:42 +0200 last=28/Jul/2026:22:45:54 +0200
-172.69.130.208  # errors=13 total=13 ratio=1.0 first=13/Jul/2026:07:08:11 +0200 last=13/Jul/2026:07:08:15 +0200
-172.69.34.147  # errors=13 total=13 ratio=1.0 first=12/Jul/2026:19:41:01 +0200 last=12/Jul/2026:19:41:04 +0200
-172.71.141.131  # errors=13 total=14 ratio=0.929 first=15/Jul/2026:10:00:33 +0200 last=12/Jul/2026:23:23:04 +0200
-172.71.141.215  # errors=13 total=31 ratio=0.419 first=12/Jul/2026:12:55:54 +0200 last=12/Jun/2026:12:00:53 +0200
-172.71.141.221  # errors=13 total=15 ratio=0.867 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:08:10:58 +0200
-172.71.141.65  # errors=13 total=32 ratio=0.406 first=12/Jul/2026:08:12:25 +0200 last=11/Jun/2026:20:21:59 +0200
-172.71.148.98  # errors=13 total=23 ratio=0.565 first=10/Aug/2026:19:02:43 +0200 last=17/Jul/2026:17:23:50 +0200
-216.73.216.114  # errors=13 total=15 ratio=0.867 first=20/Jul/2026:12:30:42 +0200 last=11/Aug/2026:00:48:54 +0200
-216.73.216.52  # errors=13 total=15 ratio=0.867 first=18/Jul/2026:18:53:09 +0200 last=11/Aug/2026:08:51:00 +0200
-45.148.10.95  # errors=13 total=15 ratio=0.867 first=02/Aug/2026:16:40:26 +0200 last=20/Jul/2026:00:03:33 +0200
-66.249.74.165  # errors=13 total=25 ratio=0.52 first=31/May/2026:03:22:34 +0200 last=16/May/2026:04:59:05 +0200
-104.28.247.220  # errors=12 total=12 ratio=1.0 first=31/Jul/2026:19:45:04 +0200 last=31/Jul/2026:19:45:54 +0200
-130.12.182.254  # errors=12 total=19 ratio=0.632 first=28/Jul/2026:17:34:00 +0200 last=31/Jul/2026:07:50:39 +0200
-162.141.167.14  # errors=12 total=24 ratio=0.5 first=25/Jul/2026:10:41:33 +0200 last=25/Jul/2026:10:41:38 +0200
-162.159.115.41  # errors=12 total=12 ratio=1.0 first=12/Jul/2026:09:31:44 +0200 last=15/Jul/2026:06:27:41 +0200
-172.71.126.41  # errors=12 total=12 ratio=1.0 first=13/Jul/2026:18:42:34 +0200 last=15/Jul/2026:14:41:27 +0200
-172.71.141.113  # errors=12 total=14 ratio=0.857 first=14/Jul/2026:02:19:23 +0200 last=12/Jun/2026:04:14:59 +0200
-172.71.141.168  # errors=12 total=18 ratio=0.667 first=15/Jul/2026:14:35:56 +0200 last=12/Jun/2026:10:57:26 +0200
-172.71.141.181  # errors=12 total=14 ratio=0.857 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:06:20:32 +0200
-172.71.141.192  # errors=12 total=27 ratio=0.444 first=14/Jul/2026:13:23:22 +0200 last=12/Jun/2026:09:29:52 +0200
-172.71.141.46  # errors=12 total=23 ratio=0.522 first=12/Jul/2026:05:56:43 +0200 last=12/Jul/2026:23:23:21 +0200
-172.71.141.5  # errors=12 total=16 ratio=0.75 first=12/Jul/2026:04:30:06 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.53  # errors=12 total=17 ratio=0.706 first=12/Jul/2026:04:41:14 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.74  # errors=12 total=18 ratio=0.667 first=13/Jul/2026:15:51:32 +0200 last=13/Jul/2026:16:48:15 +0200
-191.96.11.173  # errors=12 total=29 ratio=0.414 first=10/Aug/2026:20:19:19 +0200 last=10/Aug/2026:20:19:32 +0200
-193.31.28.80  # errors=12 total=19 ratio=0.632 first=10/Aug/2026:23:40:30 +0200 last=10/Aug/2026:23:40:30 +0200
-201.78.128.89  # errors=12 total=19 ratio=0.632 first=19/Jul/2026:08:27:00 +0200 last=19/Jul/2026:08:27:05 +0200
-207.241.173.229  # errors=12 total=29 ratio=0.414 first=15/Jul/2026:09:23:51 +0200 last=15/Jul/2026:09:23:52 +0200
-216.73.216.230  # errors=12 total=21 ratio=0.571 first=21/Jul/2026:22:18:04 +0200 last=21/Jul/2026:23:16:51 +0200
-216.73.216.91  # errors=12 total=12 ratio=1.0 first=11/Aug/2026:02:31:07 +0200 last=11/Aug/2026:11:18:32 +0200
-43.228.157.191  # errors=12 total=12 ratio=1.0 first=28/Jul/2026:17:35:50 +0200 last=28/Jul/2026:17:35:51 +0200
-64.89.161.82  # errors=12 total=13 ratio=0.923 first=28/Jul/2026:20:35:56 +0200 last=24/Jul/2026:11:38:36 +0200
-66.249.74.164  # errors=12 total=26 ratio=0.462 first=31/May/2026:11:00:50 +0200 last=13/May/2026:01:44:41 +0200
-80.91.86.169  # errors=12 total=16 ratio=0.75 first=28/Jul/2026:19:45:37 +0200 last=28/Jul/2026:19:45:38 +0200
-85.121.54.40  # errors=12 total=19 ratio=0.632 first=10/Aug/2026:22:27:32 +0200 last=10/Aug/2026:22:27:50 +0200
-172.232.175.132  # errors=11 total=12 ratio=0.917 first=28/Jul/2026:10:42:25 +0200 last=28/Jul/2026:10:42:25 +0200
-172.71.141.16  # errors=11 total=21 ratio=0.524 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:10:57:27 +0200
-172.71.141.191  # errors=11 total=20 ratio=0.55 first=12/Jul/2026:05:18:33 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.230  # errors=11 total=17 ratio=0.647 first=12/Jul/2026:11:42:24 +0200 last=12/Jul/2026:23:23:15 +0200
-172.71.141.43  # errors=11 total=24 ratio=0.458 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:09:30:01 +0200
-172.71.141.52  # errors=11 total=15 ratio=0.733 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:10:24:27 +0200
-172.71.141.67  # errors=11 total=27 ratio=0.407 first=12/Jul/2026:22:49:40 +0200 last=11/Jun/2026:17:00:52 +0200
-172.71.141.7  # errors=11 total=22 ratio=0.5 first=12/Jul/2026:16:07:27 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.80  # errors=11 total=18 ratio=0.611 first=12/Jul/2026:10:07:17 +0200 last=12/Jun/2026:09:22:13 +0200
-172.71.6.83  # errors=11 total=11 ratio=1.0 first=14/Jul/2026:03:24:30 +0200 last=14/Jul/2026:03:24:35 +0200
-198.98.52.229  # errors=11 total=13 ratio=0.846 first=30/Jul/2026:10:48:51 +0200 last=30/Jul/2026:10:51:51 +0200
-216.73.217.11  # errors=11 total=11 ratio=1.0 first=22/Jul/2026:21:07:19 +0200 last=24/Jul/2026:15:53:43 +0200
-216.73.217.13  # errors=11 total=11 ratio=1.0 first=24/Jul/2026:17:51:48 +0200 last=25/Jul/2026:23:51:24 +0200
-216.73.217.173  # errors=11 total=11 ratio=1.0 first=17/Jul/2026:13:39:29 +0200 last=18/Jul/2026:01:44:04 +0200
-23.178.112.210  # errors=11 total=22 ratio=0.5 first=10/Aug/2026:10:30:35 +0200 last=02/Aug/2026:08:41:16 +0200
-36.106.166.223  # errors=11 total=11 ratio=1.0 first=31/Jul/2026:20:04:14 +0200 last=31/Jul/2026:20:04:51 +0200
-51.79.208.246  # errors=11 total=15 ratio=0.733 first=26/Jul/2026:15:50:27 +0200 last=26/Jul/2026:15:26:10 +0200
-66.228.38.221  # errors=11 total=12 ratio=0.917 first=02/Aug/2026:14:42:54 +0200 last=02/Aug/2026:14:42:55 +0200
-69.164.220.232  # errors=11 total=12 ratio=0.917 first=28/Jul/2026:18:09:07 +0200 last=28/Jul/2026:18:09:08 +0200
-69.164.220.85  # errors=11 total=12 ratio=0.917 first=28/Jul/2026:15:21:54 +0200 last=28/Jul/2026:15:21:55 +0200
-91.92.41.115  # errors=11 total=12 ratio=0.917 first=20/Jul/2026:22:22:04 +0200 last=30/Jul/2026:00:29:34 +0200
-104.23.221.56  # errors=10 total=24 ratio=0.417 first=28/Jul/2026:02:49:00 +0200 last=18/Jul/2026:16:56:59 +0200
-104.23.221.78  # errors=10 total=21 ratio=0.476 first=10/Aug/2026:15:13:48 +0200 last=25/Jul/2026:19:29:01 +0200
-104.23.221.79  # errors=10 total=19 ratio=0.526 first=10/Aug/2026:15:13:48 +0200 last=25/Jul/2026:19:29:00 +0200
-104.23.223.7  # errors=10 total=25 ratio=0.4 first=10/Aug/2026:13:23:21 +0200 last=18/Jul/2026:20:28:10 +0200
-136.110.80.8  # errors=10 total=10 ratio=1.0 first=15/May/2026:09:36:31 +0200 last=15/May/2026:09:36:31 +0200
-146.190.83.166  # errors=10 total=12 ratio=0.833 first=14/Jul/2026:15:37:13 +0200 last=12/Jul/2026:20:47:02 +0200
-162.158.217.28  # errors=10 total=17 ratio=0.588 first=12/Jul/2026:21:29:12 +0200 last=12/Jun/2026:05:47:21 +0200
-168.144.100.227  # errors=10 total=12 ratio=0.833 first=21/Jul/2026:08:29:38 +0200 last=21/Jul/2026:08:13:44 +0200
-172.70.34.40  # errors=10 total=11 ratio=0.909 first=13/Jul/2026:11:36:11 +0200 last=13/Jul/2026:11:36:13 +0200
-172.71.141.15  # errors=10 total=21 ratio=0.476 first=12/Jul/2026:04:21:04 +0200 last=12/Jun/2026:11:02:40 +0200
-172.71.141.166  # errors=10 total=16 ratio=0.625 first=12/Jul/2026:08:00:22 +0200 last=11/Jun/2026:06:52:14 +0200
-172.71.141.167  # errors=10 total=16 ratio=0.625 first=12/Jul/2026:05:32:37 +0200 last=12/Jun/2026:12:13:56 +0200
-172.71.141.204  # errors=10 total=11 ratio=0.909 first=14/Jul/2026:21:22:25 +0200 last=12/Jun/2026:09:57:22 +0200
-172.71.141.206  # errors=10 total=17 ratio=0.588 first=14/Jul/2026:13:23:21 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.219  # errors=10 total=15 ratio=0.667 first=12/Jul/2026:10:00:14 +0200 last=12/Jun/2026:11:05:41 +0200
-172.71.141.220  # errors=10 total=14 ratio=0.714 first=12/Jul/2026:08:51:50 +0200 last=14/Jul/2026:05:52:15 +0200
-172.71.141.239  # errors=10 total=15 ratio=0.667 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:11:10:41 +0200
-172.71.141.40  # errors=10 total=21 ratio=0.476 first=12/Jul/2026:16:10:28 +0200 last=12/Jun/2026:10:57:26 +0200
-172.71.141.51  # errors=10 total=21 ratio=0.476 first=12/Jul/2026:17:47:14 +0200 last=12/Jun/2026:12:32:05 +0200
-172.71.141.56  # errors=10 total=15 ratio=0.667 first=15/Jul/2026:05:25:43 +0200 last=12/Jun/2026:09:01:09 +0200
-172.71.141.58  # errors=10 total=18 ratio=0.556 first=12/Jul/2026:04:42:14 +0200 last=12/Jul/2026:23:23:28 +0200
-172.71.141.68  # errors=10 total=20 ratio=0.5 first=12/Jul/2026:06:16:48 +0200 last=11/Jun/2026:08:20:37 +0200
-172.71.141.71  # errors=10 total=19 ratio=0.526 first=14/Jul/2026:08:37:48 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.81  # errors=10 total=16 ratio=0.625 first=13/Jul/2026:11:02:49 +0200 last=12/Jul/2026:23:23:12 +0200
-172.71.141.82  # errors=10 total=13 ratio=0.769 first=12/Jul/2026:12:50:52 +0200 last=11/Jun/2026:22:32:29 +0200
-172.71.148.14  # errors=10 total=11 ratio=0.909 first=12/Jul/2026:08:00:03 +0200 last=15/Jul/2026:11:05:19 +0200
-172.71.164.215  # errors=10 total=10 ratio=1.0 first=12/Jul/2026:14:17:29 +0200 last=15/Jul/2026:11:43:03 +0200
-185.177.72.100  # errors=10 total=10 ratio=1.0 first=21/Jul/2026:04:47:05 +0200 last=21/Jul/2026:04:47:46 +0200
-193.148.56.148  # errors=10 total=12 ratio=0.833 first=12/Jul/2026:07:40:52 +0200 last=12/Jul/2026:07:41:28 +0200
-193.148.57.33  # errors=10 total=12 ratio=0.833 first=30/Jul/2026:13:45:21 +0200 last=30/Jul/2026:13:45:24 +0200
-216.73.216.244  # errors=10 total=10 ratio=1.0 first=27/Jul/2026:16:00:36 +0200 last=28/Jul/2026:06:58:40 +0200
-23.234.98.171  # errors=10 total=16 ratio=0.625 first=29/Jul/2026:06:30:24 +0200 last=29/Jul/2026:06:30:27 +0200
-34.118.184.2  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:13:50:27 +0200 last=01/Aug/2026:13:50:27 +0200
-34.175.82.8  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:16:54:15 +0200 last=01/Aug/2026:16:54:15 +0200
-34.47.194.183  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:17:00:05 +0200 last=01/Aug/2026:17:00:06 +0200
-34.65.14.246  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:18:13:20 +0200 last=01/Aug/2026:18:13:20 +0200
-34.65.18.71  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:13:34:24 +0200 last=01/Aug/2026:13:34:24 +0200
-34.73.128.17  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:14:20:54 +0200 last=01/Aug/2026:14:20:54 +0200
-34.95.239.96  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:13:25:18 +0200 last=01/Aug/2026:13:25:18 +0200
-74.7.227.43  # errors=10 total=19 ratio=0.526 first=21/Jul/2026:22:08:15 +0200 last=21/Jul/2026:22:08:54 +0200
-74.7.241.46  # errors=10 total=22 ratio=0.455 first=21/Jul/2026:11:24:50 +0200 last=31/Jul/2026:16:26:45 +0200
-8.231.78.19  # errors=10 total=10 ratio=1.0 first=01/Aug/2026:18:58:33 +0200 last=01/Aug/2026:18:58:33 +0200
-95.85.238.18  # errors=10 total=12 ratio=0.833 first=15/Jul/2026:04:45:01 +0200 last=15/Jul/2026:04:45:39 +0200
-104.23.225.189  # errors=9 total=11 ratio=0.818 first=15/Jul/2026:11:38:17 +0200 last=15/Jul/2026:11:38:18 +0200
-104.23.225.23  # errors=9 total=10 ratio=0.9 first=15/Jul/2026:11:38:17 +0200 last=15/Jul/2026:11:38:18 +0200
-104.28.215.219  # errors=9 total=9 ratio=1.0 first=31/Jul/2026:19:45:43 +0200 last=31/Jul/2026:19:45:54 +0200
-141.101.69.111  # errors=9 total=10 ratio=0.9 first=13/Jul/2026:11:55:23 +0200 last=13/Jul/2026:11:55:24 +0200
-141.101.69.85  # errors=9 total=10 ratio=0.9 first=13/Jul/2026:11:55:23 +0200 last=13/Jul/2026:11:55:24 +0200
-172.69.138.107  # errors=9 total=9 ratio=1.0 first=15/Jul/2026:08:33:34 +0200 last=15/Jul/2026:08:33:38 +0200
-172.71.118.142  # errors=9 total=10 ratio=0.9 first=14/Jul/2026:21:10:37 +0200 last=14/Jul/2026:21:10:37 +0200
-172.71.118.246  # errors=9 total=11 ratio=0.818 first=14/Jul/2026:21:10:37 +0200 last=14/Jul/2026:21:10:37 +0200
-172.71.126.254  # errors=9 total=9 ratio=1.0 first=15/Jul/2026:14:41:26 +0200 last=15/Jul/2026:14:41:27 +0200
-172.71.141.108  # errors=9 total=22 ratio=0.409 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:03:42:48 +0200
-172.71.141.110  # errors=9 total=16 ratio=0.562 first=12/Jul/2026:22:49:39 +0200 last=12/Jun/2026:09:29:51 +0200
-172.71.141.137  # errors=9 total=13 ratio=0.692 first=13/Jul/2026:17:37:07 +0200 last=12/Jun/2026:10:30:28 +0200
-172.71.141.147  # errors=9 total=12 ratio=0.75 first=12/Jul/2026:09:59:14 +0200 last=12/Jun/2026:08:37:02 +0200
-172.71.141.164  # errors=9 total=20 ratio=0.45 first=12/Jul/2026:07:34:16 +0200 last=12/Jul/2026:23:23:14 +0200
-172.71.141.187  # errors=9 total=21 ratio=0.429 first=13/Jul/2026:17:26:21 +0200 last=12/Jun/2026:12:31:05 +0200
-172.71.141.194  # errors=9 total=12 ratio=0.75 first=12/Jul/2026:09:52:12 +0200 last=12/Jun/2026:06:27:34 +0200
-172.71.141.226  # errors=9 total=13 ratio=0.692 first=12/Jul/2026:08:45:49 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.228  # errors=9 total=14 ratio=0.643 first=12/Jul/2026:05:42:39 +0200 last=12/Jun/2026:02:16:26 +0200
-172.71.141.28  # errors=9 total=16 ratio=0.562 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.37  # errors=9 total=12 ratio=0.75 first=14/Jul/2026:01:42:20 +0200 last=12/Jul/2026:23:23:03 +0200
-172.71.141.47  # errors=9 total=21 ratio=0.429 first=12/Jul/2026:22:49:40 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.78  # errors=9 total=15 ratio=0.6 first=12/Jul/2026:05:57:43 +0200 last=12/Jun/2026:11:46:50 +0200
-172.71.141.79  # errors=9 total=13 ratio=0.692 first=13/Jul/2026:10:52:55 +0200 last=12/Jun/2026:08:02:56 +0200
-172.71.141.97  # errors=9 total=14 ratio=0.643 first=12/Jul/2026:08:30:40 +0200 last=12/Jun/2026:00:15:55 +0200
-172.71.172.154  # errors=9 total=11 ratio=0.818 first=12/Jul/2026:04:45:03 +0200 last=15/Jul/2026:08:26:19 +0200
-172.71.28.187  # errors=9 total=9 ratio=1.0 first=12/Jul/2026:04:40:47 +0200 last=15/Jul/2026:11:40:21 +0200
-172.71.6.82  # errors=9 total=9 ratio=1.0 first=15/Jul/2026:07:37:36 +0200 last=15/Jul/2026:07:37:39 +0200
-172.71.95.85  # errors=9 total=10 ratio=0.9 first=14/Jul/2026:16:07:16 +0200 last=14/Jul/2026:16:07:20 +0200
-185.177.72.23  # errors=9 total=9 ratio=1.0 first=09/Aug/2026:22:50:10 +0200 last=09/Aug/2026:22:50:10 +0200
-185.177.72.68  # errors=9 total=9 ratio=1.0 first=09/Aug/2026:22:53:30 +0200 last=09/Aug/2026:22:53:30 +0200
-216.73.216.10  # errors=9 total=10 ratio=0.9 first=23/Jul/2026:16:08:41 +0200 last=22/Jul/2026:18:52:05 +0200
-216.73.216.229  # errors=9 total=11 ratio=0.818 first=22/Jul/2026:01:48:55 +0200 last=16/Jul/2026:23:42:34 +0200
-216.73.217.176  # errors=9 total=9 ratio=1.0 first=16/Jul/2026:14:14:06 +0200 last=16/Jul/2026:21:51:02 +0200
-34.31.88.250  # errors=9 total=11 ratio=0.818 first=16/Jul/2026:13:33:04 +0200 last=23/Jul/2026:02:19:30 +0200
-45.45.237.69  # errors=9 total=17 ratio=0.529 first=02/Aug/2026:17:03:40 +0200 last=02/Aug/2026:17:03:59 +0200
-104.168.93.75  # errors=8 total=10 ratio=0.8 first=02/Aug/2026:06:54:31 +0200 last=18/Jul/2026:00:13:42 +0200
-104.22.17.67  # errors=8 total=17 ratio=0.471 first=12/Jul/2026:08:14:10 +0200 last=08/Jun/2026:11:08:00 +0200
-104.23.217.152  # errors=8 total=19 ratio=0.421 first=09/Aug/2026:21:36:31 +0200 last=17/Jul/2026:05:19:01 +0200
-104.23.239.43  # errors=8 total=8 ratio=1.0 first=13/Jul/2026:00:42:35 +0200 last=15/Jul/2026:06:31:00 +0200
-104.28.247.219  # errors=8 total=10 ratio=0.8 first=31/Jul/2026:19:44:53 +0200 last=31/Jul/2026:19:45:54 +0200
-162.158.217.29  # errors=8 total=15 ratio=0.533 first=12/Jul/2026:08:13:25 +0200 last=11/Jun/2026:19:14:42 +0200
-162.158.94.57  # errors=8 total=12 ratio=0.667 first=28/Jul/2026:23:50:53 +0200 last=17/Jul/2026:15:40:52 +0200
-172.68.175.28  # errors=8 total=8 ratio=1.0 first=14/Jul/2026:23:35:34 +0200 last=14/Jul/2026:23:35:37 +0200
-172.70.142.192  # errors=8 total=10 ratio=0.8 first=14/Jul/2026:17:56:39 +0200 last=14/Jul/2026:17:56:47 +0200
-172.70.243.135  # errors=8 total=8 ratio=1.0 first=12/Jul/2026:09:26:28 +0200 last=12/Jul/2026:23:49:22 +0200
-172.70.246.252  # errors=8 total=8 ratio=1.0 first=13/Jul/2026:11:52:38 +0200 last=14/Jul/2026:23:51:08 +0200
-172.70.35.165  # errors=8 total=9 ratio=0.889 first=14/Jul/2026:08:36:25 +0200 last=14/Jul/2026:08:36:28 +0200
-172.71.120.152  # errors=8 total=8 ratio=1.0 first=14/Jul/2026:05:10:15 +0200 last=14/Jul/2026:05:10:18 +0200
-172.71.141.109  # errors=8 total=16 ratio=0.5 first=12/Jul/2026:18:03:25 +0200 last=12/Jun/2026:10:57:26 +0200
-172.71.141.152  # errors=8 total=16 ratio=0.5 first=12/Jul/2026:07:35:16 +0200 last=12/Jul/2026:22:49:33 +0200
-172.71.141.175  # errors=8 total=13 ratio=0.615 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:05:24:17 +0200
-172.71.141.189  # errors=8 total=13 ratio=0.615 first=15/Jul/2026:05:26:02 +0200 last=11/Jun/2026:15:32:14 +0200
-172.71.141.212  # errors=8 total=16 ratio=0.5 first=13/Jul/2026:11:45:51 +0200 last=12/Jun/2026:10:57:26 +0200
-172.71.141.238  # errors=8 total=11 ratio=0.727 first=12/Jul/2026:22:57:04 +0200 last=11/Jun/2026:22:26:28 +0200
-172.71.141.42  # errors=8 total=17 ratio=0.471 first=12/Jul/2026:14:59:57 +0200 last=12/Jul/2026:23:23:28 +0200
-172.71.141.54  # errors=8 total=17 ratio=0.471 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:12:01:53 +0200
-172.71.141.61  # errors=8 total=15 ratio=0.533 first=13/Jul/2026:13:56:47 +0200 last=12/Jul/2026:22:49:33 +0200
-172.71.141.76  # errors=8 total=12 ratio=0.667 first=08/Jun/2026:08:49:03 +0200 last=12/Jun/2026:10:46:32 +0200
-172.71.141.98  # errors=8 total=16 ratio=0.5 first=12/Jul/2026:18:36:48 +0200 last=12/Jul/2026:22:49:33 +0200
-185.177.72.10  # errors=8 total=8 ratio=1.0 first=31/Jul/2026:07:24:31 +0200 last=31/Jul/2026:07:24:32 +0200
-185.177.72.13  # errors=8 total=8 ratio=1.0 first=31/Jul/2026:07:09:03 +0200 last=31/Jul/2026:07:09:03 +0200
-185.177.72.29  # errors=8 total=8 ratio=1.0 first=21/Jul/2026:04:47:44 +0200 last=21/Jul/2026:04:47:44 +0200
-185.177.72.31  # errors=8 total=8 ratio=1.0 first=25/Jul/2026:11:37:16 +0200 last=25/Jul/2026:11:37:17 +0200
-185.177.72.38  # errors=8 total=8 ratio=1.0 first=31/Jul/2026:07:24:52 +0200 last=31/Jul/2026:07:24:53 +0200
-185.177.72.5  # errors=8 total=8 ratio=1.0 first=30/Jul/2026:03:53:46 +0200 last=30/Jul/2026:03:53:46 +0200
-185.177.72.52  # errors=8 total=8 ratio=1.0 first=25/Jul/2026:11:36:38 +0200 last=25/Jul/2026:11:36:38 +0200
-192.253.248.7  # errors=8 total=12 ratio=0.667 first=25/Jul/2026:20:59:34 +0200 last=25/Jul/2026:20:59:36 +0200
-195.178.110.159  # errors=8 total=9 ratio=0.889 first=28/Jul/2026:22:41:43 +0200 last=28/Jul/2026:23:45:27 +0200
-195.178.110.48  # errors=8 total=12 ratio=0.667 first=01/Aug/2026:06:02:17 +0200 last=18/Jul/2026:03:58:58 +0200
-216.73.216.209  # errors=8 total=8 ratio=1.0 first=18/Jul/2026:05:49:51 +0200 last=18/Jul/2026:13:41:42 +0200
-31.58.51.130  # errors=8 total=20 ratio=0.4 first=21/Jul/2026:00:04:53 +0200 last=21/Jul/2026:00:05:38 +0200
-74.7.230.46  # errors=8 total=8 ratio=1.0 first=12/Jul/2026:10:48:58 +0200 last=23/Jul/2026:07:10:28 +0200
-91.134.35.95  # errors=8 total=10 ratio=0.8 first=02/Aug/2026:13:41:48 +0200 last=01/Aug/2026:12:21:48 +0200
-104.22.17.66  # errors=7 total=8 ratio=0.875 first=12/Jul/2026:05:02:36 +0200 last=12/Jun/2026:11:05:10 +0200
-136.115.17.125  # errors=7 total=7 ratio=1.0 first=18/Jul/2026:00:58:19 +0200 last=18/Jul/2026:00:58:21 +0200
-143.110.178.165  # errors=7 total=7 ratio=1.0 first=30/Jul/2026:22:03:04 +0200 last=30/Jul/2026:22:03:46 +0200
-147.93.171.188  # errors=7 total=7 ratio=1.0 first=01/Aug/2026:19:01:36 +0200 last=01/Aug/2026:19:02:11 +0200
-149.56.150.98  # errors=7 total=13 ratio=0.538 first=24/Jul/2026:19:49:49 +0200 last=24/Jul/2026:19:49:55 +0200
-162.158.111.132  # errors=7 total=7 ratio=1.0 first=12/Jul/2026:16:01:20 +0200 last=15/Jul/2026:08:44:41 +0200
-162.158.235.208  # errors=7 total=7 ratio=1.0 first=15/Jul/2026:12:07:53 +0200 last=15/Jul/2026:12:07:56 +0200
-172.70.246.253  # errors=7 total=7 ratio=1.0 first=12/Jul/2026:11:48:08 +0200 last=14/Jul/2026:18:03:01 +0200
-172.70.248.48  # errors=7 total=13 ratio=0.538 first=11/Aug/2026:06:04:43 +0200 last=16/Jul/2026:18:05:30 +0200
-172.70.35.97  # errors=7 total=7 ratio=1.0 first=14/Jul/2026:08:36:26 +0200 last=14/Jul/2026:08:36:27 +0200
-172.71.141.101  # errors=7 total=15 ratio=0.467 first=12/Jul/2026:08:36:41 +0200 last=12/Jun/2026:07:47:54 +0200
-172.71.141.104  # errors=7 total=13 ratio=0.538 first=12/Jul/2026:04:20:04 +0200 last=12/Jun/2026:05:43:20 +0200
-172.71.141.112  # errors=7 total=10 ratio=0.7 first=13/Jul/2026:20:28:23 +0200 last=12/Jul/2026:23:23:23 +0200
-172.71.141.122  # errors=7 total=9 ratio=0.778 first=13/Jul/2026:21:16:38 +0200 last=11/Jun/2026:23:28:44 +0200
-172.71.141.123  # errors=7 total=9 ratio=0.778 first=12/Jul/2026:22:14:39 +0200 last=12/Jun/2026:09:32:15 +0200
-172.71.141.157  # errors=7 total=14 ratio=0.5 first=14/Jul/2026:14:39:28 +0200 last=12/Jun/2026:06:32:35 +0200
-172.71.141.169  # errors=7 total=11 ratio=0.636 first=12/Jul/2026:04:19:04 +0200 last=12/Jun/2026:06:19:32 +0200
-172.71.141.200  # errors=7 total=15 ratio=0.467 first=12/Jul/2026:08:07:24 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.214  # errors=7 total=17 ratio=0.412 first=12/Jul/2026:08:32:40 +0200 last=12/Jun/2026:09:30:00 +0200
-172.71.141.229  # errors=7 total=12 ratio=0.583 first=12/Jul/2026:11:09:58 +0200 last=12/Jul/2026:23:22:53 +0200
-172.71.141.231  # errors=7 total=15 ratio=0.467 first=12/Jul/2026:06:42:59 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.241  # errors=7 total=15 ratio=0.467 first=14/Jul/2026:03:17:07 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.57  # errors=7 total=16 ratio=0.438 first=12/Jul/2026:12:59:55 +0200 last=12/Jun/2026:04:54:07 +0200
-172.71.141.60  # errors=7 total=14 ratio=0.5 first=12/Jul/2026:18:23:37 +0200 last=10/Jun/2026:20:32:59 +0200
-172.71.141.89  # errors=7 total=7 ratio=1.0 first=08/Jun/2026:13:31:01 +0200 last=10/Jun/2026:08:17:19 +0200
-172.71.141.90  # errors=7 total=13 ratio=0.538 first=12/Jul/2026:07:07:05 +0200 last=12/Jun/2026:05:42:20 +0200
-172.71.141.91  # errors=7 total=13 ratio=0.538 first=12/Jul/2026:05:09:31 +0200 last=12/Jun/2026:03:52:51 +0200
-172.71.144.152  # errors=7 total=8 ratio=0.875 first=12/Jul/2026:09:25:26 +0200 last=15/Jul/2026:08:26:08 +0200
-172.71.28.188  # errors=7 total=7 ratio=1.0 first=12/Jul/2026:05:53:59 +0200 last=15/Jul/2026:11:01:51 +0200
-173.249.34.197  # errors=7 total=7 ratio=1.0 first=25/Jul/2026:16:46:44 +0200 last=25/Jul/2026:16:47:25 +0200
-2.57.122.173  # errors=7 total=8 ratio=0.875 first=25/Jul/2026:14:10:19 +0200 last=25/Jul/2026:15:00:21 +0200
-216.73.216.133  # errors=7 total=7 ratio=1.0 first=20/Jul/2026:16:36:23 +0200 last=21/Jul/2026:17:51:20 +0200
-34.11.108.163  # errors=7 total=7 ratio=1.0 first=15/Jul/2026:23:11:05 +0200 last=15/Jul/2026:23:11:06 +0200
-35.192.232.168  # errors=7 total=14 ratio=0.5 first=25/Jul/2026:07:52:55 +0200 last=23/Jul/2026:19:48:06 +0200
-104.22.123.63  # errors=6 total=6 ratio=1.0 first=12/Jul/2026:04:44:40 +0200 last=15/Jul/2026:12:58:17 +0200
-104.23.175.53  # errors=6 total=9 ratio=0.667 first=12/Jul/2026:19:33:44 +0200 last=15/Jul/2026:08:39:52 +0200
-110.179.80.213  # errors=6 total=6 ratio=1.0 first=01/Aug/2026:20:58:40 +0200 last=01/Aug/2026:20:58:44 +0200
-110.179.80.63  # errors=6 total=6 ratio=1.0 first=01/Aug/2026:04:18:01 +0200 last=01/Aug/2026:04:18:15 +0200
-113.57.186.101  # errors=6 total=6 ratio=1.0 first=28/Jul/2026:11:50:34 +0200 last=28/Jul/2026:11:50:40 +0200
-117.14.153.168  # errors=6 total=6 ratio=1.0 first=30/Jul/2026:12:08:29 +0200 last=30/Jul/2026:12:08:33 +0200
-124.117.194.69  # errors=6 total=6 ratio=1.0 first=25/Jul/2026:11:56:35 +0200 last=25/Jul/2026:11:56:39 +0200
-128.90.128.13  # errors=6 total=14 ratio=0.429 first=14/Jul/2026:13:20:06 +0200 last=14/Jul/2026:13:20:07 +0200
-148.251.182.79  # errors=6 total=12 ratio=0.5 first=02/Aug/2026:14:21:36 +0200 last=23/Jul/2026:14:21:35 +0200
-150.255.94.250  # errors=6 total=6 ratio=1.0 first=25/Jul/2026:11:57:02 +0200 last=25/Jul/2026:11:57:07 +0200
-162.158.108.54  # errors=6 total=7 ratio=0.857 first=14/Jul/2026:06:05:44 +0200 last=14/Jul/2026:06:05:48 +0200
-162.158.108.55  # errors=6 total=6 ratio=1.0 first=14/Jul/2026:06:05:45 +0200 last=14/Jul/2026:06:05:47 +0200
-172.71.11.25  # errors=6 total=6 ratio=1.0 first=14/Jul/2026:12:45:46 +0200 last=14/Jul/2026:12:45:48 +0200
-172.71.141.105  # errors=6 total=10 ratio=0.6 first=13/Jul/2026:21:25:03 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.115  # errors=6 total=9 ratio=0.667 first=13/Jul/2026:22:37:09 +0200 last=11/Jun/2026:07:46:29 +0200
-172.71.141.125  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:10:18:21 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.128  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:07:39:17 +0200 last=12/Jul/2026:23:23:10 +0200
-172.71.141.130  # errors=6 total=11 ratio=0.545 first=12/Jul/2026:18:24:37 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.132  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:14:56:56 +0200 last=11/Jun/2026:23:18:43 +0200
-172.71.141.142  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:15:25:06 +0200 last=11/Jun/2026:14:35:40 +0200
-172.71.141.146  # errors=6 total=7 ratio=0.857 first=16/May/2026:17:08:32 +0200 last=12/Jun/2026:01:37:15 +0200
-172.71.141.151  # errors=6 total=8 ratio=0.75 first=13/Jul/2026:21:26:09 +0200 last=12/Jun/2026:12:37:06 +0200
-172.71.141.17  # errors=6 total=13 ratio=0.462 first=12/Jul/2026:20:10:34 +0200 last=11/Jun/2026:23:57:51 +0200
-172.71.141.174  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:07:10:05 +0200 last=11/Jun/2026:14:56:51 +0200
-172.71.141.180  # errors=6 total=14 ratio=0.429 first=12/Jul/2026:15:34:10 +0200 last=12/Jul/2026:23:23:23 +0200
-172.71.141.188  # errors=6 total=11 ratio=0.545 first=12/Jul/2026:12:58:55 +0200 last=11/Jun/2026:11:29:10 +0200
-172.71.141.190  # errors=6 total=11 ratio=0.545 first=12/Jul/2026:22:49:40 +0200 last=12/Jun/2026:09:51:21 +0200
-172.71.141.195  # errors=6 total=12 ratio=0.5 first=14/Jul/2026:10:15:59 +0200 last=12/Jun/2026:12:30:05 +0200
-172.71.141.205  # errors=6 total=10 ratio=0.6 first=12/Jul/2026:08:23:38 +0200 last=12/Jul/2026:22:49:34 +0200
-172.71.141.218  # errors=6 total=9 ratio=0.667 first=12/Jul/2026:05:53:42 +0200 last=12/Jul/2026:23:22:59 +0200
-172.71.141.32  # errors=6 total=9 ratio=0.667 first=12/Jul/2026:06:20:49 +0200 last=12/Jun/2026:08:29:01 +0200
-172.71.141.36  # errors=6 total=12 ratio=0.5 first=14/Jul/2026:22:34:42 +0200 last=13/Jul/2026:16:48:17 +0200
-172.71.141.41  # errors=6 total=15 ratio=0.4 first=12/Jul/2026:16:41:40 +0200 last=11/Jun/2026:23:54:50 +0200
-172.71.141.44  # errors=6 total=12 ratio=0.5 first=12/Jul/2026:11:40:18 +0200 last=12/Jun/2026:01:33:14 +0200
-172.71.141.83  # errors=6 total=11 ratio=0.545 first=12/Jul/2026:22:49:41 +0200 last=12/Jul/2026:23:23:22 +0200
-172.71.141.88  # errors=6 total=6 ratio=1.0 first=08/Jun/2026:10:46:32 +0200 last=09/Jun/2026:19:52:29 +0200
-172.71.141.9  # errors=6 total=9 ratio=0.667 first=12/Jul/2026:09:33:05 +0200 last=12/Jun/2026:12:05:54 +0200
-172.71.141.99  # errors=6 total=11 ratio=0.545 first=12/Jul/2026:10:02:15 +0200 last=12/Jun/2026:11:57:52 +0200
-172.71.148.99  # errors=6 total=15 ratio=0.4 first=10/Aug/2026:19:02:43 +0200 last=17/Jul/2026:17:23:50 +0200
-172.71.164.106  # errors=6 total=12 ratio=0.5 first=09/Aug/2026:23:26:59 +0200 last=16/Jul/2026:05:03:41 +0200
-185.151.21.124  # errors=6 total=6 ratio=1.0 first=18/Jul/2026:16:21:18 +0200 last=18/Jul/2026:16:24:28 +0200
-185.177.72.70  # errors=6 total=14 ratio=0.429 first=12/Jul/2026:16:50:05 +0200 last=12/Jul/2026:16:50:07 +0200
-23.180.120.134  # errors=6 total=6 ratio=1.0 first=12/May/2026:11:42:19 +0200 last=13/May/2026:07:38:32 +0200
-31.56.58.134  # errors=6 total=6 ratio=1.0 first=24/Jul/2026:11:37:15 +0200 last=31/Jul/2026:07:47:04 +0200
-43.228.157.102  # errors=6 total=7 ratio=0.857 first=30/Jul/2026:09:09:19 +0200 last=11/Aug/2026:07:47:03 +0200
-45.134.79.95  # errors=6 total=6 ratio=1.0 first=10/Aug/2026:01:03:48 +0200 last=10/Aug/2026:01:03:54 +0200
-58.212.237.231  # errors=6 total=6 ratio=1.0 first=29/Jul/2026:20:21:40 +0200 last=29/Jul/2026:20:21:47 +0200
-104.22.17.116  # errors=5 total=5 ratio=1.0 first=14/Jul/2026:09:07:15 +0200 last=14/Jul/2026:14:08:06 +0200
-104.22.17.29  # errors=5 total=8 ratio=0.625 first=12/Jul/2026:09:56:24 +0200 last=14/Jul/2026:10:43:30 +0200
-104.22.18.37  # errors=5 total=5 ratio=1.0 first=12/Jul/2026:09:56:24 +0200 last=14/Jul/2026:10:10:24 +0200
-104.23.239.57  # errors=5 total=11 ratio=0.455 first=27/Jul/2026:00:17:06 +0200 last=24/Jul/2026:13:35:19 +0200
-104.28.215.220  # errors=5 total=5 ratio=1.0 first=31/Jul/2026:19:44:44 +0200 last=31/Jul/2026:19:45:54 +0200
-118.81.207.202  # errors=5 total=5 ratio=1.0 first=27/Jul/2026:20:49:23 +0200 last=27/Jul/2026:20:49:27 +0200
-123.158.61.179  # errors=5 total=5 ratio=1.0 first=31/Jul/2026:20:03:09 +0200 last=31/Jul/2026:20:03:24 +0200
-134.122.94.138  # errors=5 total=5 ratio=1.0 first=26/Jul/2026:06:14:31 +0200 last=26/Jul/2026:06:14:40 +0200
-144.76.19.27  # errors=5 total=9 ratio=0.556 first=21/Jul/2026:04:51:04 +0200 last=23/Jul/2026:05:33:29 +0200
-157.245.197.36  # errors=5 total=6 ratio=0.833 first=14/Jul/2026:22:49:24 +0200 last=14/Jul/2026:22:49:25 +0200
-158.101.144.198  # errors=5 total=6 ratio=0.833 first=26/Jul/2026:16:30:06 +0200 last=27/Jul/2026:00:26:04 +0200
-162.158.108.95  # errors=5 total=6 ratio=0.833 first=12/Jul/2026:07:01:25 +0200 last=14/Jul/2026:15:22:00 +0200
-162.158.217.31  # errors=5 total=6 ratio=0.833 first=12/Jul/2026:21:09:00 +0200 last=12/Jun/2026:02:21:27 +0200
-165.245.190.205  # errors=5 total=10 ratio=0.5 first=28/Jul/2026:17:36:28 +0200 last=29/Jul/2026:05:00:54 +0200
-168.144.106.212  # errors=5 total=6 ratio=0.833 first=27/Jul/2026:16:06:38 +0200 last=27/Jul/2026:16:06:40 +0200
-172.69.151.122  # errors=5 total=9 ratio=0.556 first=26/Jul/2026:15:19:20 +0200 last=14/Jul/2026:19:17:57 +0200
-172.70.240.39  # errors=5 total=11 ratio=0.455 first=28/Jul/2026:20:17:22 +0200 last=18/Jul/2026:01:51:29 +0200
-172.70.243.171  # errors=5 total=8 ratio=0.625 first=09/Aug/2026:19:46:09 +0200 last=18/Jul/2026:15:15:45 +0200
-172.70.34.30  # errors=5 total=5 ratio=1.0 first=13/Jul/2026:11:36:11 +0200 last=13/Jul/2026:11:36:13 +0200
-172.71.141.114  # errors=5 total=7 ratio=0.714 first=13/Jul/2026:15:02:53 +0200 last=11/Jun/2026:21:47:19 +0200
-172.71.141.119  # errors=5 total=11 ratio=0.455 first=12/Jul/2026:22:49:40 +0200 last=12/Jul/2026:22:49:33 +0200
-172.71.141.135  # errors=5 total=9 ratio=0.556 first=13/Jul/2026:12:16:50 +0200 last=10/Jun/2026:14:43:00 +0200
-172.71.141.154  # errors=5 total=6 ratio=0.833 first=12/Jul/2026:19:24:13 +0200 last=11/Jun/2026:20:07:55 +0200
-172.71.141.155  # errors=5 total=8 ratio=0.625 first=12/Jul/2026:17:50:15 +0200 last=12/Jun/2026:10:55:34 +0200
-172.71.141.159  # errors=5 total=8 ratio=0.625 first=12/Jul/2026:18:44:52 +0200 last=11/Jun/2026:19:12:42 +0200
-172.71.141.207  # errors=5 total=8 ratio=0.625 first=12/Jul/2026:17:27:05 +0200 last=12/Jul/2026:22:49:33 +0200
-172.71.141.240  # errors=5 total=8 ratio=0.625 first=12/Jul/2026:22:49:40 +0200 last=11/Jun/2026:05:32:50 +0200
-172.71.141.35  # errors=5 total=11 ratio=0.455 first=12/Jul/2026:20:14:36 +0200 last=11/Jun/2026:09:52:17 +0200
-172.71.141.4  # errors=5 total=9 ratio=0.556 first=12/Jul/2026:22:49:40 +0200 last=11/Jun/2026:23:22:44 +0200
-172.71.141.45  # errors=5 total=12 ratio=0.417 first=12/Jul/2026:12:45:50 +0200 last=12/Jun/2026:06:40:37 +0200
-172.71.141.75  # errors=5 total=12 ratio=0.417 first=12/Jul/2026:05:16:33 +0200 last=12/Jun/2026:00:42:03 +0200
-172.71.241.157  # errors=5 total=8 ratio=0.625 first=20/Jul/2026:05:07:11 +0200 last=17/Jul/2026:15:41:51 +0200
-176.65.132.38  # errors=5 total=8 ratio=0.625 first=10/Aug/2026:22:33:22 +0200 last=11/Aug/2026:07:08:35 +0200
-193.47.62.168  # errors=5 total=5 ratio=1.0 first=22/Jul/2026:21:23:55 +0200 last=27/Jul/2026:03:56:56 +0200
-200.162.152.170  # errors=5 total=6 ratio=0.833 first=19/Jul/2026:08:34:16 +0200 last=19/Jul/2026:08:34:18 +0200
-213.111.158.220  # errors=5 total=5 ratio=1.0 first=16/Jul/2026:21:17:10 +0200 last=16/Jul/2026:21:17:12 +0200
-216.73.216.67  # errors=5 total=11 ratio=0.455 first=26/Jul/2026:22:04:05 +0200 last=27/Jul/2026:04:00:12 +0200
-216.73.216.98  # errors=5 total=5 ratio=1.0 first=15/Jul/2026:15:37:14 +0200 last=16/Jul/2026:00:52:15 +0200
-216.73.217.87  # errors=5 total=10 ratio=0.5 first=15/Jul/2026:21:39:32 +0200 last=16/Jul/2026:05:33:48 +0200
-43.98.201.177  # errors=5 total=7 ratio=0.714 first=29/Jul/2026:03:01:05 +0200 last=28/Jul/2026:23:43:51 +0200
-45.148.10.166  # errors=5 total=7 ratio=0.714 first=10/Aug/2026:07:33:18 +0200 last=11/Aug/2026:07:55:53 +0200
-45.61.187.30  # errors=5 total=7 ratio=0.714 first=21/Jul/2026:04:01:28 +0200 last=21/Jul/2026:04:01:30 +0200
-52.167.144.160  # errors=5 total=8 ratio=0.625 first=03/Jun/2026:14:15:12 +0200 last=23/May/2026:23:42:32 +0200
-74.7.241.170  # errors=5 total=5 ratio=1.0 first=12/Jul/2026:11:09:43 +0200 last=15/Jul/2026:03:08:53 +0200
-8.221.104.113  # errors=5 total=5 ratio=1.0 first=11/Aug/2026:02:09:25 +0200 last=11/Aug/2026:10:27:55 +0200
-91.230.225.189  # errors=5 total=5 ratio=1.0 first=18/Jul/2026:07:21:28 +0200 last=18/Jul/2026:07:21:59 +0200

app/reports/npm/data/scanner_ipv6.txt

@@ -1,26 +0,0 @@
-2a01:2a8:a0dd:1::1012  # errors=9517 total=9517 ratio=1.0 first=09/Aug/2026:19:01:21 +0200 last=18/Jul/2026:23:59:49 +0200
-2a0a:4cc0:2000:8528:c4e8:3ff:febb:3ee9  # errors=150 total=150 ratio=1.0 first=27/Jul/2026:14:49:23 +0200 last=27/Jul/2026:14:49:53 +0200
-2a00:6340:2008:ec80:be24:11ff:fe3b:4058  # errors=105 total=120 ratio=0.875 first=31/Jul/2026:18:53:29 +0200 last=17/Jul/2026:17:28:19 +0200
-2a06:98c0:3600::103  # errors=63 total=74 ratio=0.851 first=29/Jul/2026:05:34:01 +0200 last=27/Jul/2026:18:39:05 +0200
-2600:3000:1305:4212::83  # errors=44 total=78 ratio=0.564 first=10/Aug/2026:04:04:22 +0200 last=02/Aug/2026:08:41:15 +0200
-2a09:bac5:9443:3af::5e:4d  # errors=40 total=40 ratio=1.0 first=25/Jul/2026:05:55:27 +0200 last=25/Jul/2026:05:55:39 +0200
-2600:3000:2710:200::85  # errors=37 total=68 ratio=0.544 first=10/Aug/2026:17:56:13 +0200 last=29/Jul/2026:02:00:14 +0200
-2600:3000:2710:200::86  # errors=29 total=49 ratio=0.592 first=10/Aug/2026:17:56:04 +0200 last=17/Jul/2026:17:26:06 +0200
-2600:3000:1305:4212::85  # errors=28 total=48 ratio=0.583 first=10/Aug/2026:02:00:13 +0200 last=10/Aug/2026:21:57:52 +0200
-2600:3000:2710:200::82  # errors=28 total=51 ratio=0.549 first=10/Aug/2026:04:01:19 +0200 last=17/Jul/2026:17:14:39 +0200
-2600:3000:2710:200::83  # errors=28 total=48 ratio=0.583 first=02/Aug/2026:08:43:47 +0200 last=17/Jul/2026:17:27:06 +0200
-2600:3000:1305:4212::81  # errors=24 total=46 ratio=0.522 first=02/Aug/2026:08:41:14 +0200 last=30/Jul/2026:02:00:11 +0200
-2600:3000:2710:200::81  # errors=23 total=38 ratio=0.605 first=25/Jul/2026:02:00:09 +0200 last=15/Jul/2026:18:29:14 +0200
-2600:3000:2710:200::84  # errors=23 total=44 ratio=0.523 first=10/Aug/2026:10:30:53 +0200 last=17/Jul/2026:17:22:50 +0200
-2600:3000:1305:4212::82  # errors=19 total=31 ratio=0.613 first=10/Aug/2026:10:30:34 +0200 last=02/Aug/2026:08:43:51 +0200
-2600:3000:1305:4212::84  # errors=19 total=35 ratio=0.543 first=29/Jul/2026:16:26:16 +0200 last=10/Aug/2026:19:53:10 +0200
-2a04:c300:400::99  # errors=15 total=15 ratio=1.0 first=25/Jul/2026:16:45:35 +0200 last=25/Jul/2026:16:45:40 +0200
-2a00:6340:2008:ec80:be24:11ff:fe82:2775  # errors=14 total=16 ratio=0.875 first=31/Jul/2026:19:10:46 +0200 last=31/Jul/2026:19:11:42 +0200
-2400:8901::2000:62ff:fe9a:e1c2  # errors=9 total=9 ratio=1.0 first=18/Jul/2026:21:57:41 +0200 last=18/Jul/2026:21:57:44 +0200
-2a09:bac5:9443:3af::5e:88  # errors=8 total=8 ratio=1.0 first=16/Jul/2026:10:53:36 +0200 last=16/Jul/2026:10:53:36 +0200
-2001:4ca0:108:42::24  # errors=7 total=8 ratio=0.875 first=09/Aug/2026:19:50:32 +0200 last=19/Jul/2026:09:41:27 +0200
-2a04:c300:400::58  # errors=7 total=8 ratio=0.875 first=20/Jul/2026:23:55:45 +0200 last=29/Jul/2026:17:55:40 +0200
-2a04:c300:400::5d  # errors=7 total=13 ratio=0.538 first=23/Jul/2026:15:28:34 +0200 last=23/Jul/2026:15:28:38 +0200
-2600:3c09::2000:5cff:fe99:c802  # errors=5 total=5 ratio=1.0 first=28/Jul/2026:22:51:11 +0200 last=28/Jul/2026:22:51:14 +0200
-2600:3c15::2000:53ff:fe31:8c0b  # errors=5 total=8 ratio=0.625 first=23/Jul/2026:14:35:18 +0200 last=23/Jul/2026:14:34:55 +0200
-2602:fa59:10:a3a::1  # errors=5 total=7 ratio=0.714 first=28/Jul/2026:04:10:02 +0200 last=28/Jul/2026:05:36:59 +0200

app/scan/__init__.py

@@ -40,6 +40,53 @@ from ..mikrotik import split_cidr_versions
 from ..utils.whois import consolidate_by_subnet
 
 
+def _sync_blocklist_to_db(connected: bool, desired_v4: list[str],
+                          desired_v6: list[str],
+                          added_by: str | None = None) -> dict | None:
+    """Best-effort grow-only sync of block targets into the SQLite ledger.
+
+    Uses ``record_blocklist`` (add-only) so the ledger is the authoritative
+    cumulative record: once an IP is ever blocked it stays active even after it
+    leaves the scan window, matching the router's cumulative model. Returns the
+    added delta or None if the DB is unavailable.
+    """
+    try:
+        from ..db import get_connection
+        from ..db import repositories as repo
+        conn = get_connection()
+        result = repo.record_blocklist(
+            conn, list(desired_v4) + list(desired_v6), added_by=added_by)
+        # Retention policy: expire stale single-host entries after 30 days
+        # while keeping CIDR ranges/subnets intact.
+        pruned = repo.prune_old_single_ip_blocks(conn, older_than_days=30)
+        result["pruned_single_ips"] = pruned
+        return result
+    except Exception as exc:  # never break the scan for a DB issue
+        print(f"WARN: could not sync blocklist to db ({exc})")
+        return None
+
+
+def _db_complete_blocklist(desired_v4: list[str], desired_v6: list[str]):
+    """Complete cumulative blocklist from the DB ledger (B001).
+
+    Returns ``(complete_v4, complete_v6)`` as **sets** (same contract as
+    ``cumulative_blocklist``) derived from the active blocklist ledger plus
+    this scan's newly desired targets (in case the DB write for this scan has
+    not run yet). Falls back to the git-history reconstruction when the DB is
+    unavailable, so nothing regresses.
+    """
+    try:
+        from ..db import get_connection
+        from ..db import repositories as repo
+        conn = get_connection()
+        active = [e["cidr"] for e in repo.active_blocklist(conn)]
+    except Exception:
+        active = []
+    union = set(active) | set(desired_v4) | set(desired_v6)
+    v4, v6 = split_cidr_versions(union)
+    return set(v4), set(v6)
+
+
 @dataclass
 class ScanParams:
     """Configuration for a consolidated scan.
@@ -93,6 +140,24 @@ def run_scan(params: ScanParams) -> ScanResult:
     """
     errors: list[str] = []
 
+    # --- Step 0: open the SQLite store for this consolidated run -------------
+    db_scan_id: int | None = None
+    try:
+        from ..db import get_connection
+        from ..db import repositories as repo
+        from ..utils.whitelists import sync_whitelists_to_db
+        conn = get_connection()
+        sync_whitelists_to_db()
+        params_map = {
+            "full": params.full, "dry_run": params.dry_run,
+            "update_firewall": params.update_firewall,
+            "quiet": params.quiet, "top": params.top,
+        }
+        db_scan_id = repo.start_scan(conn, "ids", params=params_map,
+                                     full=params.full, dry_run=params.dry_run)
+    except Exception as exc:
+        print(f"WARN: sqlite store unavailable ({exc})")
+
     # --- Step 1-3: connect to MikroTik RouterOS and capture current state ---
     # If the router is unreachable we fall back to scan-only mode: still
     # generate reports and blocklists, but skip the firewall sync.
@@ -134,7 +199,7 @@ def run_scan(params: ScanParams) -> ScanResult:
     print("=== Running copyparty scan ===")
     cp_exists = True
     try:
-        cp_analyzer.run()
+        cp_analyzer.run(db_scan_id=db_scan_id)
     except Exception as e:
         errors.append(f"copyparty scan failed: {e}")
         print(f"Error running copyparty scan: {e}")
@@ -143,7 +208,7 @@ def run_scan(params: ScanParams) -> ScanResult:
     print("\n=== Running NPM scan ===")
     npm_exists = True
     try:
-        npm_analyzer.run()
+        npm_analyzer.run(db_scan_id=db_scan_id)
     except Exception as e:
         errors.append(f"NPM scan failed: {e}")
         print(f"Error running NPM scan: {e}")
@@ -155,6 +220,14 @@ def run_scan(params: ScanParams) -> ScanResult:
         print(f"\n{message}")
         if firewall is not None:
             firewall.disconnect()
+        if db_scan_id is not None:
+            try:
+                from ..db import get_connection
+                from ..db import repositories as repo
+                repo.finish_scan(get_connection(), db_scan_id, status="error",
+                                 error="; ".join(errors))
+            except Exception:
+                pass
         return ScanResult(ok=False, errors=errors)
 
     # Consolidate block candidates
@@ -214,9 +287,15 @@ def run_scan(params: ScanParams) -> ScanResult:
               f"{len(firewall_changes['removed_ipv6'])} IPv6 addresses.")
 
         # Timestamped change report — only when the router was reachable.
-        complete_v4, complete_v6 = cumulative_blocklist(
-            blocklist_v4_path, blocklist_v6_path,
+        # Source of truth for the cumulative set: the SQLite |ledger| first
+        # (B001), falling back to the git-history reconstruction only if the
+        # DB is unavailable.
+        complete_v4, complete_v6 = _db_complete_blocklist(
             blocked_ipv4, blocked_ipv6)
+        if not complete_v4 and not complete_v6:
+            complete_v4, complete_v6 = cumulative_blocklist(
+                blocklist_v4_path, blocklist_v6_path,
+                blocked_ipv4, blocked_ipv6)
         blocklist_report_path = write_blocklist_report(
             params.report_dir,
             history_v4=history_v4, history_v6=history_v6,
@@ -224,7 +303,8 @@ def run_scan(params: ScanParams) -> ScanResult:
             complete_v4=complete_v4, complete_v6=complete_v6,
             firewall_changes=firewall_changes,
             dry_run=params.dry_run,
-            errors=errors)
+            errors=errors,
+            scan_id=db_scan_id)
         print(f"blocklist report: {blocklist_report_path}")
 
     # --- Step 8: prune old reports (retention) ------------------------------
@@ -240,6 +320,35 @@ def run_scan(params: ScanParams) -> ScanResult:
           f"(keep {REPORT_RETENTION_DAYS}d / "
           f"max {REPORT_RETENTION_MAX_FILES} per dir)")
 
+    # --- Step 9: persist consolidated results to SQLite ---------------------
+    # Sync the blocklist ledger and close out the scan record regardless of
+    # whether the router sync was attempted.
+    _sync_blocklist_to_db(
+        firewall is not None, blocked_ipv4, blocked_ipv6,
+        added_by=("scan" if db_scan_id is None else f"scan:{db_scan_id}"))
+    if db_scan_id is not None:
+        try:
+            from ..db import get_connection
+            from ..db import repositories as repo
+            conn = get_connection()
+            result_payload = {
+                "ok": True,
+                "cp_candidates": cp_candidates,
+                "npm_candidates": npm_candidates,
+                "blocked_ips": len(final_blocked_ips),
+                "blocked_targets": len(final_blocked_targets),
+                "firewall_connected": firewall is not None,
+            }
+            repo.finish_scan(
+                conn, db_scan_id, status="done",
+                result=result_payload, log_files=0,
+                request_count=(cp_analyzer and len(cp_analyzer.requests) or 0)
+                + (npm_analyzer and len(npm_analyzer.requests) or 0),
+                error="; ".join(errors) or None,
+            )
+        except Exception as exc:
+            print(f"WARN: could not finalize scan in db ({exc})")
+
     return ScanResult(
         ok=True,
         cp_exists=cp_exists,

app/scan/scan_state.py

@@ -1,33 +1,33 @@
-#!/usr/bin/env python3
-"""Persistent state for incremental log scanning.
-
-Tracks the last processed byte offset per absolute log file path so a scan
-only reads new entries instead of re-reading the whole file. The state file
-is written atomically (temp file + rename) to avoid corruption.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-
-from ..utils.constants import SCAN_STATE_PATH
-
-
-def load_state() -> dict[str, int]:
-    """Return ``{absolute log path: byte offset}`` from the scan-state file."""
-    try:
-        with open(SCAN_STATE_PATH, "r", encoding="utf-8") as f:
-            data = json.load(f)
-        return {k: int(v) for k, v in data.items()}
-    except (OSError, ValueError, TypeError):
-        return {}
-
-
-def save_state(state: dict[str, int]) -> None:
-    """Write the scan-state file atomically (temp file + rename)."""
-    os.makedirs(os.path.dirname(SCAN_STATE_PATH), exist_ok=True)
-    tmp = SCAN_STATE_PATH + ".tmp"
-    with open(tmp, "w", encoding="utf-8") as f:
-        json.dump(state, f, indent=2, sort_keys=True)
-    os.replace(tmp, SCAN_STATE_PATH)
+#!/usr/bin/env python3
+"""Persistent state for incremental log scanning.
+
+Tracks the last processed byte offset per absolute log file path so a scan
+only reads new entries instead of re-reading the whole file. The state file
+is written atomically (temp file + rename) to avoid corruption.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+
+from ..utils.constants import SCAN_STATE_PATH
+
+
+def load_state() -> dict[str, int]:
+    """Return ``{absolute log path: byte offset}`` from the scan-state file."""
+    try:
+        with open(SCAN_STATE_PATH, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        return {k: int(v) for k, v in data.items()}
+    except (OSError, ValueError, TypeError):
+        return {}
+
+
+def save_state(state: dict[str, int]) -> None:
+    """Write the scan-state file atomically (temp file + rename)."""
+    os.makedirs(os.path.dirname(SCAN_STATE_PATH), exist_ok=True)
+    tmp = SCAN_STATE_PATH + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as f:
+        json.dump(state, f, indent=2, sort_keys=True)
+    os.replace(tmp, SCAN_STATE_PATH)

app/static/app.js

@@ -1,83 +1,83 @@
-// Shared helpers for the Intrusion Detection web UI.
-
-async function api(path, options = {}) {
-  const opts = { headers: {}, ...options };
-  if (opts.body && typeof opts.body !== "string") {
-    opts.headers["Content-Type"] = "application/json";
-    opts.body = JSON.stringify(opts.body);
-  }
-  const res = await fetch(path, opts);
-  let data = null;
-  try {
-    data = await res.json();
-  } catch (e) {
-    /* non-JSON */
-  }
-  if (!res.ok) {
-    const msg = (data && (data.error || data.message)) || `HTTP ${res.status}`;
-    throw new Error(msg);
-  }
-  return data;
-}
-
-function escapeHtml(s) {
-  return String(s ?? "").replace(
-    /[&<>"']/g,
-    (c) =>
-      ({
-        "&": "&amp;",
-        "<": "&lt;",
-        ">": "&gt;",
-        '"': "&quot;",
-        "'": "&#39;",
-      })[c],
-  );
-}
-
-function toast(message, type = "info") {
-  const box = document.getElementById("toasts");
-  if (!box) return;
-  const node = document.createElement("div");
-  node.className = `toast toast-${type}`;
-  node.textContent = message;
-  box.appendChild(node);
-  setTimeout(() => node.remove(), 4000);
-}
-
-function fmtTime(s) {
-  if (!s) return "—";
-  const d = new Date(s);
-  return isNaN(d) ? s : d.toLocaleString();
-}
-
-function badge(state) {
-  const node = document.createElement("span");
-  node.className = `badge ${state}`;
-  node.textContent = state;
-  return node;
-}
-
-function el(tag, attrs = {}, ...children) {
-  const node = document.createElement(tag);
-  // Allow el("tr", child1, child2, ...): if the 2nd argument is a node or an
-  // array, treat it as the first child instead of an attributes object.
-  if (attrs && (attrs.nodeType === 1 || Array.isArray(attrs))) {
-    children.unshift(attrs);
-    attrs = {};
-  }
-  for (const [k, v] of Object.entries(attrs || {})) {
-    if (k === "class") node.className = v;
-    else if (k === "text") node.textContent = v;
-    else if (k === "html") node.innerHTML = v;
-    else if (k.startsWith("on")) node.addEventListener(k.slice(2), v);
-    else node.setAttribute(k, v);
-  }
-  for (const c of children) {
-    node.append(c == null ? "" : c);
-  }
-  return node;
-}
-
-async function startScan(kind, params) {
-  return api(`/api/scan/${kind}`, { method: "POST", body: params });
-}
+// Shared helpers for the Intrusion Detection web UI.
+
+async function api(path, options = {}) {
+  const opts = { headers: {}, ...options };
+  if (opts.body && typeof opts.body !== "string") {
+    opts.headers["Content-Type"] = "application/json";
+    opts.body = JSON.stringify(opts.body);
+  }
+  const res = await fetch(path, opts);
+  let data = null;
+  try {
+    data = await res.json();
+  } catch (e) {
+    /* non-JSON */
+  }
+  if (!res.ok) {
+    const msg = (data && (data.error || data.message)) || `HTTP ${res.status}`;
+    throw new Error(msg);
+  }
+  return data;
+}
+
+function escapeHtml(s) {
+  return String(s ?? "").replace(
+    /[&<>"']/g,
+    (c) =>
+      ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;",
+      })[c],
+  );
+}
+
+function toast(message, type = "info") {
+  const box = document.getElementById("toasts");
+  if (!box) return;
+  const node = document.createElement("div");
+  node.className = `toast toast-${type}`;
+  node.textContent = message;
+  box.appendChild(node);
+  setTimeout(() => node.remove(), 4000);
+}
+
+function fmtTime(s) {
+  if (!s) return "—";
+  const d = new Date(s);
+  return isNaN(d) ? s : d.toLocaleString();
+}
+
+function badge(state) {
+  const node = document.createElement("span");
+  node.className = `badge ${state}`;
+  node.textContent = state;
+  return node;
+}
+
+function el(tag, attrs = {}, ...children) {
+  const node = document.createElement(tag);
+  // Allow el("tr", child1, child2, ...): if the 2nd argument is a node or an
+  // array, treat it as the first child instead of an attributes object.
+  if (attrs && (attrs.nodeType === 1 || Array.isArray(attrs))) {
+    children.unshift(attrs);
+    attrs = {};
+  }
+  for (const [k, v] of Object.entries(attrs || {})) {
+    if (k === "class") node.className = v;
+    else if (k === "text") node.textContent = v;
+    else if (k === "html") node.innerHTML = v;
+    else if (k.startsWith("on")) node.addEventListener(k.slice(2), v);
+    else node.setAttribute(k, v);
+  }
+  for (const c of children) {
+    node.append(c == null ? "" : c);
+  }
+  return node;
+}
+
+async function startScan(kind, params) {
+  return api(`/api/scan/${kind}`, { method: "POST", body: params });
+}

app/static/style.css

@@ -1,499 +1,499 @@
-:root {
-  --bg: #0f172a;
-  --surface: #1e293b;
-  --surface-2: #263449;
-  --border: #334155;
-  --text: #e2e8f0;
-  --muted: #94a3b8;
-  --accent: #22d3ee;
-  --ok: #34d399;
-  --warn: #fbbf24;
-  --danger: #f87171;
-  --mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-}
-
-* {
-  box-sizing: border-box;
-}
-
-body {
-  margin: 0;
-  font-family:
-    system-ui,
-    -apple-system,
-    "Segoe UI",
-    Roboto,
-    sans-serif;
-  background: var(--bg);
-  color: var(--text);
-  line-height: 1.5;
-}
-
-.topbar {
-  display: flex;
-  align-items: center;
-  gap: 1.5rem;
-  padding: 0.75rem 1.5rem;
-  background: var(--surface);
-  border-bottom: 1px solid var(--border);
-  position: sticky;
-  top: 0;
-  z-index: 10;
-}
-
-.brand {
-  font-weight: 700;
-  letter-spacing: 0.02em;
-  white-space: nowrap;
-}
-
-.topbar nav {
-  display: flex;
-  gap: 0.25rem;
-  flex-wrap: wrap;
-}
-
-.topbar nav a {
-  color: var(--muted);
-  text-decoration: none;
-  padding: 0.4rem 0.75rem;
-  border-radius: 8px;
-  font-size: 0.9rem;
-}
-
-.topbar nav a:hover {
-  color: var(--text);
-  background: var(--surface-2);
-}
-.topbar nav a.active {
-  color: var(--accent);
-  background: var(--surface-2);
-}
-
-.container {
-  max-width: 1100px;
-  margin: 0 auto;
-  padding: 1.5rem;
-}
-
-h1 {
-  font-size: 1.4rem;
-  margin: 0 0 0.25rem;
-}
-h2 {
-  font-size: 1.05rem;
-  margin: 0;
-}
-.muted {
-  color: var(--muted);
-}
-.mono {
-  font-family: var(--mono);
-  font-size: 0.85rem;
-}
-
-.panel {
-  background: var(--surface);
-  border: 1px solid var(--border);
-  border-radius: 12px;
-  padding: 1rem 1.25rem;
-  margin: 1rem 0;
-}
-
-.panel-head {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  margin-bottom: 0.75rem;
-}
-
-.cards {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
-  gap: 1rem;
-  margin: 1rem 0;
-}
-
-.card {
-  background: var(--surface);
-  border: 1px solid var(--border);
-  border-radius: 12px;
-  padding: 1rem 1.25rem;
-}
-
-.card-label {
-  font-size: 0.78rem;
-  text-transform: uppercase;
-  letter-spacing: 0.05em;
-  color: var(--muted);
-}
-.card-value {
-  font-size: 1.5rem;
-  font-weight: 700;
-  margin-top: 0.25rem;
-}
-.card-value.ok {
-  color: var(--ok);
-}
-.card-value.warn {
-  color: var(--warn);
-}
-.card-value.danger {
-  color: var(--danger);
-}
-.card-value.muted {
-  color: var(--muted);
-}
-
-.table {
-  width: 100%;
-  border-collapse: collapse;
-  font-size: 0.88rem;
-}
-
-.table th {
-  text-align: left;
-  color: var(--muted);
-  font-weight: 600;
-  border-bottom: 1px solid var(--border);
-  padding: 0.5rem 0.6rem;
-  font-size: 0.78rem;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-}
-
-.table td {
-  padding: 0.5rem 0.6rem;
-  border-bottom: 1px solid var(--border);
-}
-.table tr:last-child td {
-  border-bottom: none;
-}
-.table .num {
-  text-align: right;
-  font-variant-numeric: tabular-nums;
-}
-
-.badge {
-  display: inline-block;
-  padding: 0.1rem 0.5rem;
-  border-radius: 999px;
-  font-size: 0.72rem;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.03em;
-  background: var(--surface-2);
-  color: var(--muted);
-}
-
-.badge.ok,
-.badge.done {
-  background: rgba(52, 211, 153, 0.15);
-  color: var(--ok);
-}
-.badge.warn,
-.badge.running,
-.badge.queued {
-  background: rgba(251, 191, 36, 0.15);
-  color: var(--warn);
-}
-.badge.danger,
-.badge.error {
-  background: rgba(248, 113, 113, 0.15);
-  color: var(--danger);
-}
-
-.btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-  border: 1px solid var(--border);
-  background: var(--surface-2);
-  color: var(--text);
-  padding: 0.45rem 0.9rem;
-  border-radius: 8px;
-  font-size: 0.88rem;
-  cursor: pointer;
-  text-decoration: none;
-}
-
-.btn:hover {
-  border-color: var(--accent);
-}
-.btn.primary {
-  background: var(--accent);
-  border-color: var(--accent);
-  color: #062a35;
-  font-weight: 600;
-}
-.btn.primary:hover {
-  filter: brightness(1.08);
-}
-.btn.danger {
-  border-color: rgba(248, 113, 113, 0.5);
-  color: var(--danger);
-}
-.btn.danger:hover {
-  background: rgba(248, 113, 113, 0.12);
-}
-.btn.ghost {
-  background: transparent;
-}
-.btn:disabled {
-  opacity: 0.5;
-  cursor: not-allowed;
-}
-
-.panel-actions {
-  display: flex;
-  align-items: center;
-  gap: 1rem;
-  margin-top: 1rem;
-  flex-wrap: wrap;
-}
-
-.form-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
-  gap: 1rem;
-}
-
-label {
-  display: flex;
-  flex-direction: column;
-  gap: 0.3rem;
-  font-size: 0.82rem;
-  color: var(--muted);
-}
-label.check {
-  flex-direction: row;
-  align-items: center;
-  gap: 0.5rem;
-  font-size: 0.88rem;
-  color: var(--text);
-  margin-top: 1.4rem;
-}
-
-input,
-select {
-  background: var(--bg);
-  border: 1px solid var(--border);
-  color: var(--text);
-  border-radius: 8px;
-  padding: 0.45rem 0.6rem;
-  font-size: 0.88rem;
-}
-
-input:focus,
-select:focus {
-  outline: none;
-  border-color: var(--accent);
-}
-
-.job-status {
-  margin-top: 1rem;
-  font-family: var(--mono);
-  font-size: 0.85rem;
-}
-
-#toasts {
-  position: fixed;
-  bottom: 1rem;
-  right: 1rem;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  z-index: 100;
-}
-
-.toast {
-  padding: 0.6rem 1rem;
-  border-radius: 8px;
-  border: 1px solid var(--border);
-  background: var(--surface);
-  box-shadow: 0 6px 20px rgba(0, 0, 0, 0.4);
-  font-size: 0.88rem;
-  max-width: 360px;
-}
-
-.toast-error {
-  border-color: var(--danger);
-  color: var(--danger);
-}
-.toast-ok {
-  border-color: var(--ok);
-  color: var(--ok);
-}
-.toast-warn {
-  border-color: var(--warn);
-  color: var(--warn);
-}
-
-pre.content {
-  background: var(--bg);
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  padding: 1rem;
-  overflow: auto;
-  max-height: 480px;
-  font-family: var(--mono);
-  font-size: 0.8rem;
-  white-space: pre-wrap;
-}
-
-.list {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  max-height: 300px;
-  overflow: auto;
-  padding: 0.25rem;
-}
-.list a {
-  color: var(--accent);
-  text-decoration: none;
-  font-family: var(--mono);
-  font-size: 0.85rem;
-  padding: 0.2rem 0.4rem;
-  border-radius: 6px;
-}
-.list a:hover {
-  background: var(--surface-2);
-}
-
-/* Blocklist display */
-
-.table tbody[id="v4"] td {
-  padding: 0;
-}
-.table tbody[id="v4"] td .btn {
-  border-radius: 0;
-  border: none;
-  padding: 0.25rem 0.5rem;
-}
-
-/* IPv4 graph page */
-
-.graph-controls {
-  display: flex;
-  align-items: center;
-  gap: 1.25rem;
-  flex-wrap: wrap;
-}
-
-.legend {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.5rem;
-  font-size: 0.82rem;
-  color: var(--muted);
-}
-
-.sw {
-  display: inline-block;
-  width: 0.8rem;
-  height: 0.8rem;
-  border-radius: 3px;
-  border: 1px solid var(--border);
-}
-.sw.red {
-  background: #e53935;
-}
-.sw.green {
-  background: #43a047;
-}
-.sw.plain {
-  background: #fff;
-}
-
-.graph-wrap {
-  position: relative;
-  width: 100%;
-  max-width: 920px;
-  margin: 0 auto;
-}
-
-#graph-canvas {
-  display: block;
-  width: 100%;
-  height: auto;
-  aspect-ratio: 1 / 1;
-  background: #fff;
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  image-rendering: pixelated;
-  cursor: crosshair;
-}
-
-.graph-overlay {
-  position: absolute;
-  inset: 0;
-  pointer-events: none;
-}
-
-.g-line {
-  position: absolute;
-  background: rgba(148, 163, 184, 0.55);
-}
-.g-v {
-  top: 0;
-  bottom: 0;
-  width: 1px;
-}
-.g-h {
-  left: 0;
-  right: 0;
-  height: 1px;
-}
-
-.g-label {
-  position: absolute;
-  transform: translate(6px, 4px);
-  font-size: 0.55rem;
-  line-height: 1;
-  color: #475569;
-  white-space: nowrap;
-  user-select: none;
-  text-shadow: 0 0 2px #fff, 0 0 2px #fff;
-}
-
-.graph-tooltip {
-  position: absolute;
-  z-index: 5;
-  background: var(--surface-2);
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  padding: 0.5rem 0.65rem;
-  pointer-events: none;
-  box-shadow: 0 6px 20px rgba(0, 0, 0, 0.45);
-  max-width: 260px;
-}
-.graph-tooltip.hidden {
-  display: none;
-}
-
-.tt-head {
-  font-weight: 600;
-  margin-bottom: 0.2rem;
-}
-.tt-status {
-  font-size: 0.75rem;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  font-weight: 600;
-}
-.tt-status.blocked {
-  color: #e53935;
-}
-.tt-status.whitelisted {
-  color: #43a047;
-}
-.tt-status.unlisted {
-  color: var(--muted);
-}
-.tt-list {
-  margin-top: 0.35rem;
-  font-size: 0.72rem;
-  white-space: pre-line;
-  color: var(--text);
-}
+:root {
+  --bg: #0f172a;
+  --surface: #1e293b;
+  --surface-2: #263449;
+  --border: #334155;
+  --text: #e2e8f0;
+  --muted: #94a3b8;
+  --accent: #22d3ee;
+  --ok: #34d399;
+  --warn: #fbbf24;
+  --danger: #f87171;
+  --mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family:
+    system-ui,
+    -apple-system,
+    "Segoe UI",
+    Roboto,
+    sans-serif;
+  background: var(--bg);
+  color: var(--text);
+  line-height: 1.5;
+}
+
+.topbar {
+  display: flex;
+  align-items: center;
+  gap: 1.5rem;
+  padding: 0.75rem 1.5rem;
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+  position: sticky;
+  top: 0;
+  z-index: 10;
+}
+
+.brand {
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  white-space: nowrap;
+}
+
+.topbar nav {
+  display: flex;
+  gap: 0.25rem;
+  flex-wrap: wrap;
+}
+
+.topbar nav a {
+  color: var(--muted);
+  text-decoration: none;
+  padding: 0.4rem 0.75rem;
+  border-radius: 8px;
+  font-size: 0.9rem;
+}
+
+.topbar nav a:hover {
+  color: var(--text);
+  background: var(--surface-2);
+}
+.topbar nav a.active {
+  color: var(--accent);
+  background: var(--surface-2);
+}
+
+.container {
+  max-width: 1100px;
+  margin: 0 auto;
+  padding: 1.5rem;
+}
+
+h1 {
+  font-size: 1.4rem;
+  margin: 0 0 0.25rem;
+}
+h2 {
+  font-size: 1.05rem;
+  margin: 0;
+}
+.muted {
+  color: var(--muted);
+}
+.mono {
+  font-family: var(--mono);
+  font-size: 0.85rem;
+}
+
+.panel {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 1rem 1.25rem;
+  margin: 1rem 0;
+}
+
+.panel-head {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 0.75rem;
+}
+
+.cards {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 1rem;
+  margin: 1rem 0;
+}
+
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 1rem 1.25rem;
+}
+
+.card-label {
+  font-size: 0.78rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--muted);
+}
+.card-value {
+  font-size: 1.5rem;
+  font-weight: 700;
+  margin-top: 0.25rem;
+}
+.card-value.ok {
+  color: var(--ok);
+}
+.card-value.warn {
+  color: var(--warn);
+}
+.card-value.danger {
+  color: var(--danger);
+}
+.card-value.muted {
+  color: var(--muted);
+}
+
+.table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.88rem;
+}
+
+.table th {
+  text-align: left;
+  color: var(--muted);
+  font-weight: 600;
+  border-bottom: 1px solid var(--border);
+  padding: 0.5rem 0.6rem;
+  font-size: 0.78rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.table td {
+  padding: 0.5rem 0.6rem;
+  border-bottom: 1px solid var(--border);
+}
+.table tr:last-child td {
+  border-bottom: none;
+}
+.table .num {
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+
+.badge {
+  display: inline-block;
+  padding: 0.1rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  background: var(--surface-2);
+  color: var(--muted);
+}
+
+.badge.ok,
+.badge.done {
+  background: rgba(52, 211, 153, 0.15);
+  color: var(--ok);
+}
+.badge.warn,
+.badge.running,
+.badge.queued {
+  background: rgba(251, 191, 36, 0.15);
+  color: var(--warn);
+}
+.badge.danger,
+.badge.error {
+  background: rgba(248, 113, 113, 0.15);
+  color: var(--danger);
+}
+
+.btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  border: 1px solid var(--border);
+  background: var(--surface-2);
+  color: var(--text);
+  padding: 0.45rem 0.9rem;
+  border-radius: 8px;
+  font-size: 0.88rem;
+  cursor: pointer;
+  text-decoration: none;
+}
+
+.btn:hover {
+  border-color: var(--accent);
+}
+.btn.primary {
+  background: var(--accent);
+  border-color: var(--accent);
+  color: #062a35;
+  font-weight: 600;
+}
+.btn.primary:hover {
+  filter: brightness(1.08);
+}
+.btn.danger {
+  border-color: rgba(248, 113, 113, 0.5);
+  color: var(--danger);
+}
+.btn.danger:hover {
+  background: rgba(248, 113, 113, 0.12);
+}
+.btn.ghost {
+  background: transparent;
+}
+.btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.panel-actions {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  margin-top: 1rem;
+  flex-wrap: wrap;
+}
+
+.form-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 1rem;
+}
+
+label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+  font-size: 0.82rem;
+  color: var(--muted);
+}
+label.check {
+  flex-direction: row;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.88rem;
+  color: var(--text);
+  margin-top: 1.4rem;
+}
+
+input,
+select {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-radius: 8px;
+  padding: 0.45rem 0.6rem;
+  font-size: 0.88rem;
+}
+
+input:focus,
+select:focus {
+  outline: none;
+  border-color: var(--accent);
+}
+
+.job-status {
+  margin-top: 1rem;
+  font-family: var(--mono);
+  font-size: 0.85rem;
+}
+
+#toasts {
+  position: fixed;
+  bottom: 1rem;
+  right: 1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  z-index: 100;
+}
+
+.toast {
+  padding: 0.6rem 1rem;
+  border-radius: 8px;
+  border: 1px solid var(--border);
+  background: var(--surface);
+  box-shadow: 0 6px 20px rgba(0, 0, 0, 0.4);
+  font-size: 0.88rem;
+  max-width: 360px;
+}
+
+.toast-error {
+  border-color: var(--danger);
+  color: var(--danger);
+}
+.toast-ok {
+  border-color: var(--ok);
+  color: var(--ok);
+}
+.toast-warn {
+  border-color: var(--warn);
+  color: var(--warn);
+}
+
+pre.content {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 1rem;
+  overflow: auto;
+  max-height: 480px;
+  font-family: var(--mono);
+  font-size: 0.8rem;
+  white-space: pre-wrap;
+}
+
+.list {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+  max-height: 300px;
+  overflow: auto;
+  padding: 0.25rem;
+}
+.list a {
+  color: var(--accent);
+  text-decoration: none;
+  font-family: var(--mono);
+  font-size: 0.85rem;
+  padding: 0.2rem 0.4rem;
+  border-radius: 6px;
+}
+.list a:hover {
+  background: var(--surface-2);
+}
+
+/* Blocklist display */
+
+.table tbody[id="v4"] td {
+  padding: 0;
+}
+.table tbody[id="v4"] td .btn {
+  border-radius: 0;
+  border: none;
+  padding: 0.25rem 0.5rem;
+}
+
+/* IPv4 graph page */
+
+.graph-controls {
+  display: flex;
+  align-items: center;
+  gap: 1.25rem;
+  flex-wrap: wrap;
+}
+
+.legend {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.82rem;
+  color: var(--muted);
+}
+
+.sw {
+  display: inline-block;
+  width: 0.8rem;
+  height: 0.8rem;
+  border-radius: 3px;
+  border: 1px solid var(--border);
+}
+.sw.red {
+  background: #e53935;
+}
+.sw.green {
+  background: #43a047;
+}
+.sw.plain {
+  background: #fff;
+}
+
+.graph-wrap {
+  position: relative;
+  width: 100%;
+  max-width: 920px;
+  margin: 0 auto;
+}
+
+#graph-canvas {
+  display: block;
+  width: 100%;
+  height: auto;
+  aspect-ratio: 1 / 1;
+  background: #fff;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  image-rendering: pixelated;
+  cursor: crosshair;
+}
+
+.graph-overlay {
+  position: absolute;
+  inset: 0;
+  pointer-events: none;
+}
+
+.g-line {
+  position: absolute;
+  background: rgba(148, 163, 184, 0.55);
+}
+.g-v {
+  top: 0;
+  bottom: 0;
+  width: 1px;
+}
+.g-h {
+  left: 0;
+  right: 0;
+  height: 1px;
+}
+
+.g-label {
+  position: absolute;
+  transform: translate(6px, 4px);
+  font-size: 0.55rem;
+  line-height: 1;
+  color: #475569;
+  white-space: nowrap;
+  user-select: none;
+  text-shadow: 0 0 2px #fff, 0 0 2px #fff;
+}
+
+.graph-tooltip {
+  position: absolute;
+  z-index: 5;
+  background: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 0.5rem 0.65rem;
+  pointer-events: none;
+  box-shadow: 0 6px 20px rgba(0, 0, 0, 0.45);
+  max-width: 260px;
+}
+.graph-tooltip.hidden {
+  display: none;
+}
+
+.tt-head {
+  font-weight: 600;
+  margin-bottom: 0.2rem;
+}
+.tt-status {
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  font-weight: 600;
+}
+.tt-status.blocked {
+  color: #e53935;
+}
+.tt-status.whitelisted {
+  color: #43a047;
+}
+.tt-status.unlisted {
+  color: var(--muted);
+}
+.tt-list {
+  margin-top: 0.35rem;
+  font-size: 0.72rem;
+  white-space: pre-line;
+  color: var(--text);
+}

app/templates/analysis.html

@@ -0,0 +1,191 @@
+{% extends "base.html" %} {% block title %}Log Analysis — Intrusion Detection{%
+endblock %} {% block content %}
+<h1>Log Analysis</h1>
+<p class="muted">
+  Detailed analysis of persisted log data from the SQLite store. Select an IP
+  to see its full request history across all log sources.
+</p>
+
+<div class="panel">
+  <div class="panel-head">
+    <h2>Top IPs</h2>
+    <span class="muted" id="top-disclaimer"></span>
+  </div>
+  <table class="table">
+    <thead>
+      <tr>
+        <th>IP</th>
+        <th class="num">Requests</th>
+        <th class="num">Errors</th>
+        <th class="num">Malicious</th>
+        <th></th>
+      </tr>
+    </thead>
+    <tbody id="top-ips"></tbody>
+  </table>
+</div>
+
+<div class="panel">
+  <div class="panel-head">
+    <h2>Cross-source IPs</h2>
+    <span class="muted">Seen in more than one log source</span>
+  </div>
+  <table class="table">
+    <thead>
+      <tr>
+        <th>IP</th>
+        <th class="num">Sources</th>
+        <th>Source list</th>
+        <th class="num">Total</th>
+      </tr>
+    </thead>
+    <tbody id="cross-source"></tbody>
+  </table>
+</div>
+
+<div class="panel" id="ip-panel" hidden>
+  <div class="panel-head">
+    <h2 id="ip-title">Request history</h2>
+    <a class="btn ghost" href="#" id="ip-close">✕ Close</a>
+  </div>
+  <table class="table">
+    <thead>
+      <tr>
+        <th>Time</th>
+        <th>Source</th>
+        <th>Method</th>
+        <th>Path</th>
+        <th class="num">Status</th>
+        <th>UA</th>
+      </tr>
+    </thead>
+    <tbody id="ip-timeline"></tbody>
+  </table>
+</div>
+{% endblock %} {% block scripts %}
+<script>
+  function showIp(ip) {
+    const panel = document.getElementById("ip-panel");
+    const body = document.getElementById("ip-timeline");
+    document.getElementById("ip-title").textContent = `Request history — ${ip}`;
+    panel.hidden = false;
+    body.innerHTML =
+      '<tr><td colspan="6" class="muted">Loading…</td></tr>';
+    api(`/api/analysis/ip/${encodeURIComponent(ip)}`)
+      .then((data) => {
+        body.innerHTML = "";
+        const tl = data.timeline || [];
+        if (!tl.length) {
+          body.innerHTML =
+            '<tr><td colspan="6" class="muted">No persisted requests for this IP.</td></tr>';
+          return;
+        }
+        for (const r of tl) {
+          const status = r.status ?? "—";
+          const row = el(
+            "tr",
+            el("td", {
+              class: "mono",
+              text: r.ts || "—",
+            }),
+            el("td", { text: r.source }),
+            el("td", { text: r.method || "—" }),
+            el("td", { class: "mono", text: r.path || "—" }),
+            el(
+              "td",
+              {
+                class: "num",
+                text: status,
+                style: status >= 400 ? "color:var(--danger)" : "",
+              },
+            ),
+            el("td", { class: "muted", text: r.ua || "—" }),
+          );
+          if (r.is_error) row.classList.add("row-error");
+          body.append(row);
+        }
+      })
+      .catch((e) => toast(e.message, "error"));
+    panel.scrollIntoView({ behavior: "smooth", block: "start" });
+  }
+
+  async function loadTop() {
+    const body = document.getElementById("top-ips");
+    body.innerHTML = "";
+    try {
+      const data = await api("/api/analysis/top-ips?limit=50");
+      body.innerHTML = "";
+      const ips = data.top_ips || [];
+      document.getElementById("top-disclaimer").textContent =
+        `showing top ${ips.length} IPs`;
+      if (!ips.length) {
+        body.innerHTML =
+          '<tr><td colspan="5" class="muted">No persisted requests yet — run a scan to populate the SQLite store.</td></tr>';
+        return;
+      }
+      for (const r of ips) {
+        body.append(
+          el(
+            "tr",
+            el("td", { class: "mono", text: r.ip }),
+            el("td", { class: "num", text: r.total }),
+            el("td", { class: "num", text: r.errors }),
+            el("td", { class: "num", text: r.malicious_hits }),
+            el(
+              "td",
+              el(
+                "button",
+                { class: "btn ghost", onclick: () => showIp(r.ip) },
+                "Detail",
+              ),
+            ),
+          ),
+        );
+      }
+    } catch (e) {
+      body.innerHTML =
+        '<tr><td colspan="5" class="muted b">SQLite analysis unavailable.</td></tr>';
+      toast(e.message, "error");
+    }
+  }
+
+  async function loadCrossSource() {
+    const body = document.getElementById("cross-source");
+    body.innerHTML = "";
+    try {
+      const data = await api("/api/analysis/cross-source?limit=100");
+      const ips = data.ips || [];
+      if (!ips.length) {
+        body.innerHTML =
+          '<tr><td colspan="4" class="muted">No IPs seen across multiple sources yet.</td></tr>';
+        return;
+      }
+      for (const r of ips) {
+        body.append(
+          el(
+            "tr",
+            el("td", { class: "mono", text: r.ip }),
+            el("td", { class: "num", text: r.sources }),
+            el("td", { text: r.source_list }),
+            el("td", { class: "num", text: r.total }),
+          ),
+        );
+      }
+    } catch (e) {
+      body.innerHTML =
+        '<tr><td colspan="4" class="muted b">SQLite analysis unavailable.</td></tr>';
+      toast(e.message, "error");
+    }
+  }
+
+  document
+    .getElementById("ip-close")
+    .addEventListener("click", (e) => {
+      e.preventDefault();
+      document.getElementById("ip-panel").hidden = true;
+    });
+
+  loadTop();
+  loadCrossSource();
+</script>
+{% endblock %}

app/templates/base.html

@@ -1,50 +1,55 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>{% block title %}Intrusion Detection{% endblock %}</title>
-    <link
-      rel="stylesheet"
-      href="{{ url_for('static', filename='style.css') }}"
-    />
-  </head>
-  <body>
-    <header class="topbar">
-      <div class="brand">🛡 Intrusion Detection</div>
-      <nav>
-        <a href="/" class="{{ 'active' if request.path == '/' }}">Dashboard</a>
-        <a href="/scan" class="{{ 'active' if request.path == '/scan' }}"
-          >Scan</a
-        >
-        <a href="/reports" class="{{ 'active' if request.path == '/reports' }}"
-          >Reports</a
-        >
-        <a
-          href="/blocklist"
-          class="{{ 'active' if request.path == '/blocklist' }}"
-          >Blocklist</a
-        >
-        <a
-          href="/firewall"
-          class="{{ 'active' if request.path == '/firewall' }}"
-          >Firewall</a
-        >
-        <a
-          href="/whitelist"
-          class="{{ 'active' if request.path == '/whitelist' }}"
-          >Whitelist</a
-        >
-        <a
-          href="/graph"
-          class="{{ 'active' if request.path == '/graph' }}"
-          >Graph</a
-        >
-      </nav>
-    </header>
-    <main class="container">{% block content %}{% endblock %}</main>
-    <div id="toasts"></div>
-    <script src="{{ url_for('static', filename='app.js') }}"></script>
-    {% block scripts %}{% endblock %}
-  </body>
-</html>
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{% block title %}Intrusion Detection{% endblock %}</title>
+    <link
+      rel="stylesheet"
+      href="{{ url_for('static', filename='style.css') }}"
+    />
+  </head>
+  <body>
+    <header class="topbar">
+      <div class="brand">🛡 Intrusion Detection</div>
+      <nav>
+        <a href="/" class="{{ 'active' if request.path == '/' }}">Dashboard</a>
+        <a href="/scan" class="{{ 'active' if request.path == '/scan' }}"
+          >Scan</a
+        >
+        <a href="/reports" class="{{ 'active' if request.path == '/reports' }}"
+          >Reports</a
+        >
+        <a
+          href="/blocklist"
+          class="{{ 'active' if request.path == '/blocklist' }}"
+          >Blocklist</a
+        >
+        <a
+          href="/firewall"
+          class="{{ 'active' if request.path == '/firewall' }}"
+          >Firewall</a
+        >
+        <a
+          href="/whitelist"
+          class="{{ 'active' if request.path == '/whitelist' }}"
+          >Whitelist</a
+        >
+        <a
+          href="/graph"
+          class="{{ 'active' if request.path == '/graph' }}"
+          >Graph</a
+        >
+        <a
+          href="/analysis"
+          class="{{ 'active' if request.path == '/analysis' }}"
+          >Analysis</a
+        >
+      </nav>
+    </header>
+    <main class="container">{% block content %}{% endblock %}</main>
+    <div id="toasts"></div>
+    <script src="{{ url_for('static', filename='app.js') }}"></script>
+    {% block scripts %}{% endblock %}
+  </body>
+</html>