Synthetic anomaly detection over the live honeypot stream. Compares the last 1 day to the prior same-length window and surfaces UA-lie surges, country share swings, volume spikes, and newly-observed verified vendors. Configure persistent alert rules →
Traffic surge: 65 events vs 4 prior
2026-05-24T00:27:29.132Z → 2026-05-25T00:27:29.132Z
{
"curTotal": 65,
"prevTotal": 4,
"ratio": 16.25
}US traffic share at 100% (65 events)
2026-05-24T00:27:29.132Z → 2026-05-25T00:27:29.132Z
{
"country": "US",
"curCount": 65,
"prevCount": 3,
"ratio": 21.666666666666668
}New verified-vendor user agent observed
2026-05-24T00:27:29.132Z → 2026-05-25T00:27:29.132Z
{
"count": 1,
"examples": [
"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
]
}