jcarr.dev

Have a go

The fault on the front page was mine. This one is yours.

This host is probed continuously by people who were not invited. You are invited. Press the button and your browser will make a handful of requests that the detection pipeline treats exactly as it treats the real thing – then watch yourself appear in the feed.

Sandbox no block applied
Path enumeration /probe/path-enumeration
Repeated auth failure /probe/credential-stuffing
Injection pattern /probe/injection-attempt
Rate limit exceeded /probe/rate-burst
Config file probe /probe/config-fetch
Your activity

Nothing recorded against your source in the last hour. Run the probes and this fills within a second or two.

What each one demonstrates

Path enumeration

A real scanner works through a wordlist of paths belonging to common software – /wp-admin, /phpmyadmin, /.env. None of them exist here, so a request for one is unambiguous: not a typo, a sweep.

Repeated auth failure

A run of rejected authentication attempts from one source. One is somebody mistyping a password; a series is somebody trying a list.

Injection pattern

A querystring carrying SQL or script fragments, trying to have input interpreted as code. The querystring is inspected but never stored or rendered back.

Rate limit exceeded

More requests than the allowance permits. Bounds what a single source can cost, whether the excess is deliberate or a bug in someone's client.

Config file probe

Requests for configuration and secrets files left exposed by mistake. Extremely common, because it works often enough to be worth automating.

The rules, stated plainly

Why the paths are fake

A real scanner asks for /wp-admin, /.env, /phpmyadmin. These probes use synthetic stand-ins that run through the identical classifier.

That is deliberate. If you are reading this on a work machine, making your browser reach for exploit-shaped paths could raise an alert in your own organisation's monitoring. Creating an incident in someone else's logs is not a reasonable thing to do to a visitor.

What happens off the range

Sandbox activity never counts toward a block – you cannot lock yourself out of the site you came to look at.

Probing the real paths is a different matter, and is treated as what it is. Keep going and the intrusion filter will drop your traffic at the firewall for a while. There is no page for that state: your packets stop being answered, which is why it is being explained here instead.

Please do not flood it. A small instance cannot win a volumetric fight and there is nothing to learn from watching one lose.

Once recorded, your activity is treated like everything else here: masked to a /24, geolocated against a local database, retained for the standard window, and grouped into a campaign on the adversary page alongside the uninvited traffic.

Connection to the server was lost. Reload 🗙

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please reload the page.