Nexus Threat Network

Real security activity. Real containment.

Privacy-preserving aggregate telemetry from active Nexus PRO protection. These counters reflect recorded security activity—not simulated dashboard numbers.

LIVE AGGREGATE Updated 7 min ago
SHARED INTELLIGENCE · LOCAL DECISIONS Network evidence adds context. Each site keeps the final protection decision local.

No public site list, raw IP feed or customer activity is exposed through this Pulse.

Threat Network + Nexus Intelligence

Shared activity shows the pressure. Shared intelligence helps recognize the behavior.

The public Pulse reports privacy-preserving aggregate security activity. Nexus Intelligence separately provides bounded attack-pattern context to participating licensed sites, while every final decision remains local.

Explore Nexus Intelligence →
THREAT NETWORK PULSELIVE AGGREGATE
HEADLINE WINDOWLast 30 days
DATA MODELAggregate only
SIMULATED COUNTERSNone
REFRESHUpdated 7 min ago
Verified activity

What Nexus protection has actually recorded.

Headline totals use last 30 days while the live charts remain rolling 24-hour views. Containment and observation stay separate.

LAST 30 DAYS · CONTAINMENT594.4K

Security actions contained

Recorded protection actions that contained request or commerce pressure.

CONTAINED
EARLY DEFENSE433.1K

Stopped before WordPress

Requests rejected by early protection before normal WordPress execution.

EARLY BLOCK
COMMERCE431.5K

WooCommerce pressure contained

Commerce-specific pressure or automated actions contained by Nexus.

COMMERCE DEFENSE
OBSERVED · CREDENTIAL PRESSURE12.3K

Credential pressure observed

Meaningful distributed or repeated login-pressure signals. Ordinary mistyped passwords are not counted.

ENFORCED · LOGIN GUARD4,507

Login Guard restrictions

Temporary login restrictions or lockouts actually enforced by Nexus.

OBSERVED · NOT NECESSARILY BLOCKED165K

Reconnaissance signals observed

Security-relevant probing, enumeration and reconnaissance observations.

XML-RPC39.7K

XML-RPC restrictions

XML-RPC pressure or abuse restricted by Nexus protection layers.

24-hour containment

Protection activity over time.

Bars are real hourly aggregate counts. The red-lit peaks mark the busiest containment windows—not a different metric.

2026-10-09T03:00:00Z — 1,003 containedPeak activity — 1,0032026-10-09T04:00:00Z — 561 contained2026-10-09T05:00:00Z — 411 contained2026-10-09T06:00:00Z — 144 contained2026-10-09T07:00:00Z — 417 contained2026-10-09T08:00:00Z — 831 containedPeak activity — 8312026-10-09T09:00:00Z — 547 contained2026-10-09T10:00:00Z — 170 contained2026-10-09T11:00:00Z — 507 contained2026-10-09T12:00:00Z — 126 contained2026-10-09T13:00:00Z — 510 contained2026-10-09T14:00:00Z — 235 contained2026-10-09T15:00:00Z — 274 contained2026-10-09T16:00:00Z — 533 contained2026-10-09T17:00:00Z — 700 contained2026-10-09T18:00:00Z — 475 contained2026-10-09T19:00:00Z — 486 contained2026-10-09T20:00:00Z — 474 contained2026-10-09T21:00:00Z — 735 containedPeak activity — 7352026-10-09T22:00:00Z — 200 contained2026-10-09T23:00:00Z — 275 contained2026-10-10T00:00:00Z — 691 contained2026-10-10T01:00:00Z — 194 contained2026-10-10T02:00:00Z — 0 contained
24 hours agoNow
24-hour signal lanes

Where is Nexus seeing pressure—and where is it acting?

Independent counts, scaled against the highest lane. These categories can overlap and are not percentages of one whole.

Early defense285
WooCommerce pressure166
Credential pressure observed340
Login Guard restrictions386
Reconnaissance observed7,781
XML-RPC restrictions3,071
Observation layer

Reconnaissance over time.

Observed probing remains visually separate from containment. Credential pressure and reconnaissance do not become block counts unless Nexus actually enforces a restriction.

2026-10-09T03:00:00Z — 1,006 reconnaissance observations2026-10-09T04:00:00Z — 432 reconnaissance observations2026-10-09T05:00:00Z — 277 reconnaissance observations2026-10-09T06:00:00Z — 171 reconnaissance observations2026-10-09T07:00:00Z — 92 reconnaissance observations2026-10-09T08:00:00Z — 262 reconnaissance observations2026-10-09T09:00:00Z — 406 reconnaissance observations2026-10-09T10:00:00Z — 116 reconnaissance observations2026-10-09T11:00:00Z — 445 reconnaissance observations2026-10-09T12:00:00Z — 151 reconnaissance observations2026-10-09T13:00:00Z — 328 reconnaissance observations2026-10-09T14:00:00Z — 178 reconnaissance observations2026-10-09T15:00:00Z — 277 reconnaissance observations2026-10-09T16:00:00Z — 626 reconnaissance observations2026-10-09T17:00:00Z — 205 reconnaissance observations2026-10-09T18:00:00Z — 210 reconnaissance observations2026-10-09T19:00:00Z — 220 reconnaissance observations2026-10-09T20:00:00Z — 420 reconnaissance observations2026-10-09T21:00:00Z — 819 reconnaissance observations2026-10-09T22:00:00Z — 238 reconnaissance observations2026-10-09T23:00:00Z — 287 reconnaissance observations2026-10-10T00:00:00Z — 323 reconnaissance observations2026-10-10T01:00:00Z — 210 reconnaissance observations
24 hours agoNow
30-day verified trend

Daily contained security activity.

One UTC bar per day across the last 30 days. Peak days are highlighted without changing the metric.

Sep 11 — 5,662Sep 12 — 8,345Sep 13 — 5,927Sep 14 — 5,717Sep 15 — 4,552Sep 16 — 6,539Sep 17 — 87,936Sep 18 — 42,606Sep 19 — 3,467Sep 20 — 5,164Sep 21 — 4,954Sep 22 — 4,421Sep 23 — 4,637Sep 24 — 5,406Sep 25 — 6,017Sep 26 — 5,959Sep 27 — 7,418Sep 28 — 5,482Sep 29 — 25,367Sep 30 — 56,767Oct 1 — 12,756Oct 2 — 24,478Oct 3 — 80,447Oct 4 — 85,239Oct 5 — 21,983Oct 6 — 34,779Oct 7 — 13,331Oct 8 — 8,141Oct 9 — 10,035Oct 10 — 885
30 days agoToday
Verified period context

24-hour activity stays live and precise. Longer headline totals grow only from real daily telemetry, with 30-day comparison enabled after enough history exists.

24H CONTAINMENT10.6K
7-DAY CONTAINMENT248.7K
LAST 30 DAYS · CONTAINED594.4K
LAST 30 DAYS · EARLY BLOCKS433.1K
LAST 30 DAYS · WOO PRESSURE431.5K
30-DAY COMPARISONBuilding history
How to read the Pulse

Action, observation and early containment are different things.

The page is deliberately strict about language. A large number is useful only when the label still describes what Nexus actually recorded.

Contained

Nexus actively restricted or neutralized activity. Red accents are reserved for real containment and high-pressure moments.

Stopped before WordPress

The request was rejected by an early protection layer before normal WordPress execution, reducing avoidable application work.

Observed

Reconnaissance and credential pressure that Nexus recorded as security-relevant. Observation does not automatically mean correlation, compromise or enforcement.

Privacy-preserving by design

Security counts travel. Customer activity does not.

Nexus PRO contributes compact aggregate security telemetry in background batches. The public Pulse receives only sanitized totals prepared by the Controller.

  • No customer content or order data
  • No usernames, cookies or request bodies
  • No public domains, site IDs or reporting-installation count
  • No public raw IP or per-site activity feed
01Nexus PROLocal security activity
→
02ControllerValidate & aggregate
→
03Static snapshotSanitized totals
→
04Public PulseCached presentation
Threat Network

Shared intelligence without surrendered control.

Participating Nexus installations contribute carefully selected security evidence and receive fresh network intelligence while enforcement remains local to each protected site.

Independent contributor context

Network observations are evaluated with contributor independence and freshness rather than treating raw report volume as consensus.

Asynchronous delivery

Qualifying evidence and aggregate telemetry are delivered outside visitor requests, with retry and back-pressure behavior designed to avoid slowing protected websites.

Local final verdict

Downloaded intelligence adds context to local Nexus decisions. A temporary network-service outage does not turn the cloud into a synchronous dependency.

Nexus PRO

Protect locally. Learn collectively.

Threat Network intelligence is included with an active Nexus PRO licence.