Have a go
This host is probed continuously by people who were not invited. You are invited. Press the button and your browser will make a handful of requests that the detection pipeline treats exactly as it treats the real thing – then watch yourself appear in the feed.
Nothing recorded against your source in the last hour. Run the probes and this fills within a second or two.
A real scanner works through a wordlist of paths belonging to common software – /wp-admin, /phpmyadmin, /.env. None of them exist here, so a request for one is unambiguous: not a typo, a sweep.
A run of rejected authentication attempts from one source. One is somebody mistyping a password; a series is somebody trying a list.
A querystring carrying SQL or script fragments, trying to have input interpreted as code. The querystring is inspected but never stored or rendered back.
More requests than the allowance permits. Bounds what a single source can cost, whether the excess is deliberate or a bug in someone's client.
Requests for configuration and secrets files left exposed by mistake. Extremely common, because it works often enough to be worth automating.
A real scanner asks for /wp-admin, /.env, /phpmyadmin. These probes use synthetic stand-ins that run through the identical classifier.
That is deliberate. If you are reading this on a work machine, making your browser reach for exploit-shaped paths could raise an alert in your own organisation's monitoring. Creating an incident in someone else's logs is not a reasonable thing to do to a visitor.
Sandbox activity never counts toward a block – you cannot lock yourself out of the site you came to look at.
Probing the real paths is a different matter, and is treated as what it is. Keep going and the intrusion filter will drop your traffic at the firewall for a while. There is no page for that state: your packets stop being answered, which is why it is being explained here instead.
Please do not flood it. A small instance cannot win a volumetric fight and there is nothing to learn from watching one lose.
Once recorded, your activity is treated like everything else here: masked to a /24, geolocated against a local database, retained for the standard window, and grouped into a campaign on the adversary page alongside the uninvited traffic.