Every day robots knock on tingsvad.dk with known attacks against software the site does not even run. Cloudflare’s defences stop them in the data centre nearest the attacker, before they reach the thing’s Workers. Here is what the defences have seen in the last 30 days: where the attacks came from, which rules fired and what they were looking for. No IP addresses are fetched or shown.
How it is counted
- Cron Trigger
- GraphQL Analytics API
- D1
- Workers KV
- Workers Cache
- Your browser
The source
Cloudflare’s GraphQL Analytics API for the tingsvad.dk zone: firewall events, all requests and verified bots. The token may only read analytics for this one zone.
Every hour
A Cron Trigger in the thing’s Worker asks for today and yesterday, one day at a time, so Cloudflare does not have to sample over a long period. The rows are kept in D1 for 95 days.
The overview
After each collection the Worker builds the two overviews and puts them in Workers KV. The page fetches them through Workers Cache, which is purged with a cache tag when there are new figures.
What is not kept
IP addresses are neither fetched nor stored. Paths are shown without query strings, long tokens are hidden and email addresses in user agents are removed. Figures over long periods may be sampled by Cloudflare and are therefore approximate.
Raw figures as JSON: /api/ting-ai/vaern. Country centres: world-countries (ODbL). Country outlines: Natural Earth (public domain).
The crawlersWho came to read: search engines, AI crawlers and assistants, and what they read.
Open the crawlersThe family: The defences · The crawlers · The speed · Denmark right now · The archive cabinet · The thing’s door · The infrastructure map · Back to the machine room
