Where traffic comes from, what kind of network it comes from, and what is worth rate-limiting.
| Card | What it shows |
|---|---|
| Totals | The headline counts for the current filter |
| Autonomous systems | A treemap coloured by network type, with its table beneath |
| Network types | Hosting, consumer ISP, mobile, VPN, education, government, unclassified — the whole set, listed on identifiers and labels |
| Netnames | The registry netname, which catches leased ranges |
| Map and countries | One request feeding both |
A residential-proxy operator renting address space inside a consumer ISP shares that ISP’s autonomous system number with thousands of genuine subscribers — so on the ASN table they are invisible. They show up in the registry netname and nowhere else.
The coordinate field in the schema is indexed but has no docValues, so Solr can search it but cannot aggregate or return it. The map is therefore built from country counts plotted at country centroids, and it is labelled as country resolution on screen rather than implying a precision it does not have.
Country facets are wider than the map, deliberately: the country is populated for addresses that have no point at all, because it falls back to the country that arrives free with the network lookup. And a coordinate is absent rather than wrong when the geolocation service returned only a country-level centroid — a false point is worse than no point.
It is a public-domain outline shipped in the repository, about 155 KB, loaded only by this view and only by the card that needs it. A failed load falls back to a plain coordinate grid rather than an empty card. The charting library is self-hosted for the same reason: the panel works on an air-gapped box.
This view carries one pivot, folded into a request it was already making: network type against verdict. It answers one specific operational question — should I rate-limit this address space — and every cell links through to the sessions filtered by both dimensions at once.
Two things to keep in mind while reading it:
- The inner facet is limited, so the cells of a row do not add up to the row total. The shortfall is printed as its own muted cell rather than left to be inferred.
- A network type is classified from the operator’s name, so it can be wrong — and a misclassification is exactly what turns into a batch of false positives on the proxy fleet rule, which excludes mobile networks. If a whole organisation looks like a fleet, check its network type here first.
Geography and network data are third-party and incomplete. A country code the shipped table does not carry renders as itself rather than as a guess, and every one of these lookups can be switched off individually — at the cost of this view going dark and three scoring rules going silent.