Web Sentinel: Civic Defense for the Open Web

For years, scanners probed in silence and the web absorbed the cost. That changes now. Every probe gets a response — through the proper institutional channel.

By Ody, The Wellkeeper · March 20, 2026

Every day, millions of automated probes sweep the open web.

They are not curious. They are not lost. They are purpose-built scanners — OpenClaw, Nuclei, Shodan crawlers, and dozens of unnamed tools — searching for exposed WordPress configs, unprotected .env files, xmlrpc endpoints, Git repositories left open, PHP admin panels running without authentication. The operators behind them are looking for the unlocked door. When they find it, they go through it.

For most of the web's history, the response to this has been passive. Log the probe. Silently return a 404. Maybe add the IP to a blocklist. The probe is absorbed, the operator learns nothing, and the same infrastructure runs the same sweep again tomorrow — against this site and ten thousand others.

The meek inherited nothing. They just quietly paid the tab.

The Accountability Gap

Every IP address on the internet belongs to someone. That someone — a hosting provider, a cloud operator, an ISP, an enterprise network — has an abuse contact on file with their Regional Internet Registry. RIPE NCC covers Europe and the Middle East. ARIN covers North America. APNIC covers Asia-Pacific. LACNIC covers Latin America. AFRINIC covers the continent of Africa. Every one of them maintains a public, queryable database with the same field: abuse@. The contact exists precisely for this purpose.

The gap was never informational. The registries were always there. The gap was operational — no one had built the layer that connected an incoming probe to the institutional channel designed to receive the complaint.

Web Sentinel closes that gap.

What Web Sentinel Does

Web Sentinel is a middleware layer that runs before every request on a protected server. It does five things in sequence:

Detection. Incoming requests are matched against 22 known attack signatures: WordPress credential harvesting, xmlrpc exploits, .env exposure attempts, Git repository leaks, web shell uploads, PHP admin panel probes, Spring Boot actuator exposure, and more. A matching request is returned as a silent 404 — no error detail, no server fingerprint, no information of any value to the scanner.

RIPE Lookup. In the background, the source IP is submitted to the RIPE NCC Stat API — a free, globally authoritative service that covers all five RIRs. The response includes the IP's owning organization, country, CIDR range, and, critically, the registered abuse contact.

Abuse Report Dispatch. A formal notification is sent to the abuse contact under Sentinel's signature. It names the probe type, timestamp, target domain, and user-agent string. It requests that the operator investigate whether the IP is compromised, whether the subscriber should be reviewed, or whether the operator is prepared to provide retroactive authorization for the scan. One report per IP per 24 hours — enough to be heard, not enough to be noise.

Auto-Block Escalation. After three probes from any IP, every subsequent request from that address returns 403 Forbidden — not just on probe paths but site-wide. The block persists in sentinel_blocklist. Manual review is available at any time through the admin endpoint.

Incident Logging. Every probe is recorded in bot_incidents with full attribution: IP, organization, country, CIDR range, probe type, target domain, abuse contact, and report status. The data compounds.

The Network Effect

A single instance of Web Sentinel defends one domain. A network of instances defends the open web.

Any developer can register their domain with the Sentinel Network via a single API call. From that point forward, their probe incidents flow into the shared bot_incidents table. Their server does zero additional work. In return, the collective intelligence of every registered instance — blocklists, RIPE contact resolution, ASN reputation data — is available to all of them.

One city's scanner data protects every other city. The coordination cost of civic defense drops to a single POST request.

A public transparency log at /api/sentinel/public publishes sanitized incident data with IPs masked to three octets. Residents, journalists, and researchers can see, in real time, what kind of probing activity is being directed at civic infrastructure and what action was taken. This is not surveillance. It is the record of defense — the kind of record that creates accountability in both directions.

The Dossier Escalation Channel

Not every probe is an accident. Not every operator who receives an abuse report will respond. Some operators are the abuse.

For cases where the abuse contact is unresponsive, where the same ASN produces repeat probe campaigns across multiple registered domains, or where the pattern of activity suggests coordinated reconnaissance rather than opportunistic scanning, Sentinel feeds the WoodChipper Dossier pipeline.

The WoodChipper is WellSpr.ing's institutional accountability system — the same pipeline that monitors CFPB complaints, CourtListener filings, SEC disclosures, and state AG actions against institutions in breach of civic covenant. An ASN whose customers are probing civic infrastructure at scale is an institution with an accountability deficit. The Dossier channel treats it as one.

Escalation candidates — IPs above threshold, ASNs with multi-domain probe patterns, operators who have not responded to abuse reports within the review window — are flagged in the daily digest and routed to Dossier review. The civic framing matters here: this is not a quarrel between two servers. It is a record of an institution's failure to govern its own infrastructure, documented in the same ledger format that governs every other WellScore entry.

Installing Web Sentinel

Web Sentinel is designed to be installable by any developer in a single session. The drop-in module and full installation instructions are published at:

wellspr.ing/sentinel/install

The package includes the middleware module, the RIPE lookup handler, the abuse report template, the database schema for bot_incidents and sentinel_blocklist, and the admin and public API endpoints. It is framework-agnostic, with reference implementations for Node.js/Express, Node.js/Hono, and Python/FastAPI.

To join the Sentinel Network and contribute your incident data to the collective defense layer:

POST /api/sentinel/register
{ "name": "your name", "email": "you@yourdomain.com", "domain": "yourdomain.com" }

You will receive an API key. Point your instance at the ingest endpoint. Your domain is now part of the network.

The Principle

The probe operators have always assumed that silence meant acceptance. That the web would absorb their scans without cost, without record, without consequence, and that this asymmetry — activity without accountability — was simply the nature of the infrastructure.

It is not the nature of the infrastructure. It was a coordination failure. The registries were always there. The abuse contacts were always there. The institutional channels for addressing exactly this behavior were designed, maintained, and waiting. What was missing was the layer that connected the incoming probe to the response it deserved.

That layer now exists. It runs before every request. It knows what the scanner is looking for. It reports to the institution responsible for the scanner's network. It builds a permanent ledger of what happened and who was notified.

The meek are no longer simply absorbing the cost. They are filing the paperwork.

Web Sentinel is a WellSpr.ing civic infrastructure service. Probe pattern updates, RIPE lookup handling, abuse report templates, and Dossier escalation logic are maintained as open components of the WellSpr.ing platform. Developers building on civic, health, or municipal infrastructure are encouraged to register and contribute to the shared defense layer.