Recent occurrences ({issue.samples.length})
diff --git a/otel-ui/src/components/SourceIpsVisualizer.tsx b/otel-ui/src/components/SourceIpsVisualizer.tsx
new file mode 100644
index 0000000..2e1cb76
--- /dev/null
+++ b/otel-ui/src/components/SourceIpsVisualizer.tsx
@@ -0,0 +1,693 @@
+import { useEffect, useMemo, useState } from "react"
+import useSWR from "swr"
+import { Fingerprint, RefreshCw, ShieldAlert, Search, Radio, ShieldBan, ShieldCheck, Flag } from "lucide-react"
+import { useSourceIps, useSourceIpActivity } from "../hooks/useSourceIps"
+import { useDetectedIps, type DetectionKind } from "../hooks/useDetectedIps"
+import { useObservabilityData } from "../hooks/useObservabilityData"
+import { formatRelativeTime } from "../lib/timeUtils"
+import { uaClassLabel } from "../lib/ua-class"
+import { IpInfoPanel } from "./common/IpButton"
+import { Segmented } from "./common/Segmented"
+import { useSubRoute } from "../lib/routes"
+import type { BadActorReason, SourceIp } from "../lib/types"
+import { FilterBar, type FilterChip } from "./FilterBar"
+import { MasterDetail } from "./MasterDetail"
+import { DetailField, SectionLabel } from "./common/DetailField"
+import { authFetch, authSWRFetcher, tokens } from "../lib/auth"
+
+type Scope = "public" | "flagged" | "all"
+type SortMode = "recent" | "requests" | "errors" | "first"
+
+const sorters: Record number> = {
+ recent: (a, b) => ms(b.lastSeen) - ms(a.lastSeen),
+ requests: (a, b) => b.requests - a.requests || ms(b.lastSeen) - ms(a.lastSeen),
+ errors: (a, b) => b.errors - a.errors || ms(b.lastSeen) - ms(a.lastSeen),
+ first: (a, b) => ms(b.firstSeen) - ms(a.firstSeen),
+}
+const sortLabel: Record = { recent: "latest first", requests: "most requests", errors: "most errors", first: "newest addresses" }
+
+const SEEN_WINDOWS: Record = {
+ "1h": { label: "last hour", ms: 3600_000 },
+ "24h": { label: "last 24 hours", ms: 24 * 3600_000 },
+ "7d": { label: "last 7 days", ms: 7 * 24 * 3600_000 },
+}
+
+const detectionLabel: Record = { probing: "probing", "block-candidate": "block candidate", blocked: "blocked" }
+const reasonLabel: Record, string> = {
+ "probe-scanner": "Probe scanner: hit several scanner paths",
+ enumerator: "Enumerator: walked many routes that do not exist",
+ "bot-4xx": "Self-declared bot getting client errors",
+}
+
+/** Critical only for real detections; a hint, not a verdict. */
+const BadActorBadge = ({ label }: { label: string }) => (
+
+
+ {label}
+
+)
+
+const ms = (iso: string) => Date.parse(iso)
+const dateTime = (iso: string) =>
+ new Date(iso).toLocaleString([], { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit", second: "2-digit" })
+
+interface InvestigationRecord {
+ mode: "passive" | "active"
+ status: "running" | "done" | "failed"
+ startedAt: string
+ finishedAt?: string
+ error?: string
+ debug?: ScanDebug
+ passive?: {
+ hostnames?: string[]
+ rdap?: { name?: string; handle?: string; start?: string; end?: string; country?: string; registry?: string; organization?: string; abuseEmail?: string }
+ warnings?: string[]
+ completedAt: string
+ }
+ active?: {
+ services?: { port: number; protocol: string; state: string; name?: string; product?: string; version?: string; scripts?: Record }[]
+ debug?: ScanDebug
+ completedAt: string
+ }
+}
+
+interface ScanDebug {
+ command: string
+ durationMs: number
+ exitError?: string
+ timedOut?: boolean
+ stderr?: string
+ hostState?: string
+ summary?: string
+ partial?: boolean
+}
+
+const DebugPanel = ({ debug }: { debug: ScanDebug }) => (
+
+ Scan details · {(debug.durationMs / 1000).toFixed(1)}s{debug.hostState ? ` · host ${debug.hostState}` : ""}
+
+ - command:
- {debug.command}
+ {debug.summary && nmap: {debug.summary}}
+ {debug.exitError && exit: {debug.exitError}{debug.timedOut ? " (deadline)" : ""}}
+ {debug.stderr && stderr: {debug.stderr}}
+
+
+)
+
+const InvestigationActions = ({ ip }: { ip: string }) => {
+ const [starting, setStarting] = useState<"passive" | "active" | null>(null)
+ const [error, setError] = useState(null)
+ const [errorDebug, setErrorDebug] = useState(null)
+ const [, setNow] = useState(0)
+
+ // Stored results load with the panel; while a job is running we poll.
+ const key = tokens() ? `/api/source-ips/${encodeURIComponent(ip)}/investigation` : null
+ const { data, mutate } = useSWR<{ records: Partial> }>(key, authSWRFetcher, {
+ revalidateOnFocus: false,
+ shouldRetryOnError: false,
+ refreshInterval: (d) => (d && Object.values(d.records ?? {}).some((r) => r?.status === "running") ? 3000 : 0),
+ })
+ const passiveRec = data?.records?.passive
+ const activeRec = data?.records?.active
+ const running = (m: "passive" | "active") => data?.records?.[m]?.status === "running" || starting === m
+ const anyRunning = running("passive") || running("active")
+
+ useEffect(() => {
+ if (!activeRec || activeRec.status !== "running") return
+ const t = setInterval(() => setNow((n) => n + 1), 1000)
+ return () => clearInterval(t)
+ }, [activeRec])
+
+ const investigate = async (mode: "passive" | "active") => {
+ setStarting(mode)
+ setError(null)
+ setErrorDebug(null)
+ try {
+ const response = await authFetch(`/api/source-ips/${encodeURIComponent(ip)}/investigate`, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({ mode }),
+ })
+ if (!response.ok) {
+ const message = await response.text()
+ let parsed: { error?: string } | null = null
+ try { parsed = JSON.parse(message) } catch { /* plain text */ }
+ throw new Error(parsed?.error || message || `HTTP ${response.status}`)
+ }
+ await mutate()
+ } catch (e) {
+ setError(e instanceof Error ? e.message : String(e))
+ } finally {
+ setStarting(null)
+ }
+ }
+
+ const result = { passive: passiveRec?.passive, active: activeRec?.active }
+ const failed = [passiveRec, activeRec].filter((r): r is InvestigationRecord => r?.status === "failed")
+ const elapsed = (r?: InvestigationRecord) => (r ? Math.max(0, Math.round((Date.now() - new Date(r.startedAt).getTime()) / 1000)) : 0)
+ const passive = result.passive
+ const active = result.active
+ const rdap = passive?.rdap
+ return (
+
+
Investigate
+
+
+
+
+
Probing runs in the background (up to a few minutes) and results are saved. It is active network traffic and only available when enabled by the operator.
+ {error &&
Investigation failed: {error}
}
+ {errorDebug &&
}
+ {failed.map((r) => (
+
+
{r.mode === "active" ? "Probe" : "Lookup"} failed: {r.error}
+ {r.debug &&
}
+
+ ))}
+ {(passiveRec?.finishedAt || activeRec?.finishedAt) && (
+
+ Saved results: {[passiveRec, activeRec].filter((r) => r?.status === "done" && r.finishedAt).map((r) => `${r!.mode} ${dateTime(r!.finishedAt!)}`).join(" · ") || "none successful"}
+
+ )}
+ {passive && (
+
+
+
+
+
+
+
+
+
+ )}
+ {passive?.warnings?.map((warning) =>
{warning}
)}
+ {active && (
+
+
Open services
+ {active.services?.length ? (
+
+ {active.services.map((service) => (
+ -
+ {service.port}/{service.protocol} · {service.name || "unknown"}{service.product ? ` · ${service.product}` : ""}{service.version ? ` ${service.version}` : ""}
+
+ ))}
+
+ ) :
No open services found in the top 100 ports{active.debug?.hostState ? ` (host ${active.debug.hostState})` : ""}.
}
+ {active.services?.some((sv) => sv.scripts) && (
+
+ {active.services.flatMap((sv) => Object.entries(sv.scripts ?? {}).map(([id, out]) => (
+ - {sv.port} {id}: {out}
+ )))}
+
+ )}
+ {active.debug &&
}
+
+ )}
+
+
Blocking
+
+
Blocks expire automatically according to the server policy.
+ {message &&
{message}
}
+ {error &&
Block failed: {error}
}
+
+
AbuseIPDB
+
+
+
+
Checks use the last 90 days. Reporting sends this address and your comment to AbuseIPDB.
+ {check && (
+
+
+
+
+
+
+
+ {check.isWhitelisted && }
+
+ )}
+
+
+