Plugin
A Threat Map plugin that adds a live world threat map to the BunkerWeb web UI. It turns the blocked-request reports BunkerWeb already collects (via the metrics plugin) into an animated, real-time map of attacks against your infrastructure.
Why add it to the official plugins: it gives operators an at-a-glance, SOC-style view of who is attacking their services and how — something the current Reports table doesn't convey visually. It reuses existing data (no new agent or job), is fully self-contained (the dotted world map and country coordinates are pre-generated from public-domain Natural Earth data and embedded in the page — no CDN, CSP-friendly), and reads through the same Redis-backed reports query the official Reports page uses, so history survives reloads.
Features: animated attack arcs from each attacker's country to a configurable home marker; live event feed with country flags; per-country and per-reason statistics; time-window selector (1h/24h/7d/all); attacks-per-interval timeline; country drill-down with one-click bans (duration + scope) via the existing ban API; replay and demo modes; and a fullscreen SOC/wall-monitor mode. Animations respect prefers-reduced-motion.
It's a UI-only plugin: plugin.json + ui/actions.py (data aggregation) + ui/template.html (self-contained canvas renderer). Tested against BunkerWeb 1.6.12.
Settings
{
"USE_THREAT_MAP": { "context": "global", "default": "yes", "type": "check", "help": "Enable the threat map page in the web UI." },
"THREAT_MAP_MAX_EVENTS": { "context": "global", "default": "200", "type": "number", "help": "Max recent blocked requests sent to the browser." },
"THREAT_MAP_HOME_LAT": { "context": "global", "default": "48.86", "type": "text", "help": "Latitude of your infrastructure (target of the attack arcs)." },
"THREAT_MAP_HOME_LON": { "context": "global", "default": "2.35", "type": "text", "help": "Longitude of your infrastructure (target of the attack arcs)." },
"THREAT_MAP_HOME_LABEL": { "context": "global", "default": "BunkerWeb", "type": "text", "help": "Label shown next to the home marker on the map." }
}Implementation ideas
Data comes from bw_instances_utils.get_reports_query (Redis-backed, falls back to per-instance in-memory reports). The page polls a pre_render/action endpoint for live updates and renders everything on a <canvas> with an embedded land-dot bitmask + country centroids. I have a working implementation ready to submit as a PR once this is approved.
I agree to follow this project's Code of Conduct.
Plugin
A Threat Map plugin that adds a live world threat map to the BunkerWeb web UI. It turns the blocked-request reports BunkerWeb already collects (via the metrics plugin) into an animated, real-time map of attacks against your infrastructure.
Why add it to the official plugins: it gives operators an at-a-glance, SOC-style view of who is attacking their services and how — something the current Reports table doesn't convey visually. It reuses existing data (no new agent or job), is fully self-contained (the dotted world map and country coordinates are pre-generated from public-domain Natural Earth data and embedded in the page — no CDN, CSP-friendly), and reads through the same Redis-backed reports query the official Reports page uses, so history survives reloads.
Features: animated attack arcs from each attacker's country to a configurable home marker; live event feed with country flags; per-country and per-reason statistics; time-window selector (1h/24h/7d/all); attacks-per-interval timeline; country drill-down with one-click bans (duration + scope) via the existing ban API; replay and demo modes; and a fullscreen SOC/wall-monitor mode. Animations respect
prefers-reduced-motion.It's a UI-only plugin:
plugin.json+ui/actions.py(data aggregation) +ui/template.html(self-contained canvas renderer). Tested against BunkerWeb 1.6.12.Settings
{ "USE_THREAT_MAP": { "context": "global", "default": "yes", "type": "check", "help": "Enable the threat map page in the web UI." }, "THREAT_MAP_MAX_EVENTS": { "context": "global", "default": "200", "type": "number", "help": "Max recent blocked requests sent to the browser." }, "THREAT_MAP_HOME_LAT": { "context": "global", "default": "48.86", "type": "text", "help": "Latitude of your infrastructure (target of the attack arcs)." }, "THREAT_MAP_HOME_LON": { "context": "global", "default": "2.35", "type": "text", "help": "Longitude of your infrastructure (target of the attack arcs)." }, "THREAT_MAP_HOME_LABEL": { "context": "global", "default": "BunkerWeb", "type": "text", "help": "Label shown next to the home marker on the map." } }Implementation ideas
Data comes from
bw_instances_utils.get_reports_query(Redis-backed, falls back to per-instance in-memory reports). The page polls apre_render/action endpoint for live updates and renders everything on a<canvas>with an embedded land-dot bitmask + country centroids. I have a working implementation ready to submit as a PR once this is approved.I agree to follow this project's Code of Conduct.