1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
#!/usr/bin/env bun
// Geographic report from the request log. Ties Cloudflare's cf-ipcountry header
// to the authenticated `user` field so we count DISTINCT USERS per country
// (not raw request volume, which is dominated by datacenter/bot traffic).
//
// Usage: bun scripts/analytics-geo.ts [--days N] [--top N]
// Streams ~/coinos-server/req (pino JSONL, multi-GB) — never loads it whole.
import { createInterface } from "readline";
import { createReadStream } from "fs";
const argDays = Number(process.argv[process.argv.indexOf("--days") + 1]) || 30;
const TOP = Number(process.argv[process.argv.indexOf("--top") + 1]) || 25;
const cutoff = Date.now() - argDays * 24 * 60 * 60 * 1000;
// Datacenter IPs that flood /login with many usernames (credential-testing
// bots). Excluded from geo counts. 195.123.220.232 = M247 NL, ~3,971 logins
// for sequential usernames (bugtraq, bugtraqq, ...) in the last 30d.
const BOT_IPS = new Set<string>(["195.123.220.232"]);
const rl = createInterface({
input: createReadStream("/home/adam/coinos-server/req"),
crlfDelay: Infinity,
});
// We only trust /login and /register events for geography: they are real human
// auth actions tied to a username in the body, from the user's actual device.
// Counting ALL authenticated requests pollutes the result massively — e.g.
// nostr/NWC server traffic from a single M247 datacenter IP (195.123.220.232)
// carries a stale `user` field and made NL look like 93% of users. Per-IP-per-
// country dedup on auth events is the honest signal.
// country -> Set<username> (distinct users who logged in / registered there)
const usersByCountry = new Map<string, Set<string>>();
// country -> distinct IPs (sanity: real geography has many IPs per country)
const ipsByCountry = new Map<string, Set<string>>();
let lines = 0;
let authEvents = 0;
const extractUsername = (r: any): string | null => {
// /login and /register carry username in the body (top-level `user` is empty
// on these). Body shape varies: {username} or {user:{username}}.
const b = r.body;
if (!b) return null;
if (typeof b.username === "string") return b.username.toLowerCase();
if (b.user && typeof b.user.username === "string") return b.user.username.toLowerCase();
return null;
};
for await (const line of rl) {
lines++;
// cheap pre-filter: must be an auth event with a country tag
if (!line.includes("cf-ipcountry")) continue;
if (!line.includes('"/login"') && !line.includes('"/register"')) continue;
let r: any;
try {
r = JSON.parse(line);
} catch {
continue;
}
if (!r.time || r.time < cutoff) continue;
if (r.url !== "/login" && r.url !== "/register") continue;
const cc = r.headers?.["cf-ipcountry"];
if (!cc || cc === "XX" || cc.length !== 2) continue;
const ip = r.headers?.["cf-connecting-ip"];
const user = extractUsername(r);
if (!user) continue;
// Drop known bot/proxy egress IPs that fire thousands of logins for many
// usernames from a single datacenter address — these are credential-testing
// bots, not real users, and otherwise dominate the country ranking. Heuristic
// backstop below (users >> ips) catches the rest; this is the worst offender.
if (ip && BOT_IPS.has(ip)) continue;
authEvents++;
let s = usersByCountry.get(cc);
if (!s) usersByCountry.set(cc, (s = new Set()));
s.add(user);
if (ip) {
let is = ipsByCountry.get(cc);
if (!is) ipsByCountry.set(cc, (is = new Set()));
is.add(ip);
}
}
const withCountry = authEvents;
const byUsers = [...usersByCountry.entries()]
.map(([cc, set]) => [cc, set.size, ipsByCountry.get(cc)?.size || 0] as [string, number, number])
.sort((a, b) => b[1] - a[1]);
const totalUsers = byUsers.reduce((s, [, n]) => s + n, 0);
const max = byUsers[0]?.[1] || 1;
const bar = (n: number) =>
"█".repeat(Math.round((n / max) * 24)) + "·".repeat(24 - Math.round((n / max) * 24));
console.log("═".repeat(64));
console.log(` COINOS GEO — last ${argDays} days (login/register events only)`);
console.log(` scanned ${lines.toLocaleString()} log lines, ${withCountry.toLocaleString()} auth events`);
console.log("═".repeat(64));
console.log("\n▏TOP COUNTRIES (distinct users who logged in / registered)");
console.log(" cc distribution users ips share");
byUsers.slice(0, TOP).forEach(([cc, n, ips], i) => {
const pct = ((n / totalUsers) * 100).toFixed(1);
console.log(
` ${String(i + 1).padStart(2)}. ${cc} ${bar(n)} ${String(n).padStart(5)} ${String(ips).padStart(4)} ${pct.padStart(5)}%`,
);
});
console.log(
`\n (ips column = distinct source IPs; a country with users >> ips is likely a proxy/VPN egress, not real geography)`,
);
console.log("\n" + "═".repeat(64));
process.exit(0);
|
