Needs your attention
Three warnings from your own log
- 3
- Rules over your rows
- 30 days, newest 5000 entries
- Window the rules read
- 4 and up
- Profiles on one address
- 5 and up
- Starts inside one minute
What the rules read
Nothing new is collected from you. Two of the three warnings come from sign-ins and profile starts already in your log, over the last thirty days.
The third comes from today's profile list instead, because a cluster on one address is a fact about how your profiles sit right now rather than an event that happened.
Sign-ins
Who signed in and when, with the address they actually came from and the country, where a country is known at all.
Profile starts
A profile you opened through the server. If the server was out of reach, your window opens but nothing lands in the log.
Today's profiles
The name and the exit address of each profile that has not been deleted.
A sign-in from a new country
Either the person travelled or the password is in somebody else's hands. Both are worth the same day rather than the week when profiles start vanishing.
Your usual country is your own, not the team's. A colleague living in Poland does not make an Argentine sign-in normal for you, and a first sign-in never raises anything: a newcomer has no usual country yet.
The country comes from the edge
Four profiles behind one address
Platforms take a cluster of accounts on one address together, and they need no simultaneous logins to find it. Three profiles is still work; four on one exit is where the line sits.
You see profile names for the three heaviest clusters, so thirty identical lines never bury the one worth reading.
| How the address got there | What the rule counts |
|---|---|
| Linked from the shared library | A cluster by the entry's address: protocol, host, port and login |
| Typed into the profile by hand | The same cluster as profiles that store the same address |
| One address saved twice in the library | One cluster if the profiles hold the address itself, not only the link |
| No proxy on the profile at all | Not this rule: those leave from your own address and get their own line |
| A profile in the recycle bin | Nothing: warning about an address nobody opens teaches you to ignore the panel |
Five openings inside one minute
Accounts signing in together read as one script behind all of them, whatever the names on them say. Five starts inside a minute is the count that warns you.
The count alone is not enough, so the pace matters too. A pack is a burst only when the smallest gap between two neighbouring starts falls under two and a half seconds.
- Five starts 300 ms apart
- One line, naming the pack with the most starts in it
- Ten starts 3 seconds apart
- Silent: that spacing is the app's own queue
- Ten starts 10 minutes apart
- Silent: this is how a morning should look
Opening profiles in bulk will not raise it: every opening after the first waits a random 3 to 14 seconds, and the threshold sits below that minimum on purpose. A warning seen every morning is a warning nobody reads by Friday.
Where a warning shows up
The panel heads your dashboard and the app's Members screen, and is absent when there is nothing to say.
A line cannot be dismissed. The cluster line goes when you spread the profiles apart; the other two go on their own when their entries fall out of the window.
Most urgent first
A possible stolen password stands above the housekeeping lines, and equally urgent lines stand newest first.
Admin and owner only
Reading the log is their right. A manager, an operator or a member sees none of these lines, and the panel stays quiet rather than breaking.
Through the interface too
You can pull the same lines through the interface with a key allowed to read logs, and both toolkits carry it.
From a warning to the rows
A line tells you the shape. What actually happened you read in the log, three ways over one set of rows.
- 1
Actions
The whole workspace newest first, with the email of the person instead of an internal id.
- 2
Profile sessions
Only the starts and stops of browser windows: the view behind a burst and behind who was working when.
- 3
IP log
Sign-ins and machine registrations with the address, the country and the machine name.
What each line asks of you
Each of the three asks a different repair, and no browser setting does it for you.
- 1
A new country
Change the password, turn on the second sign-in step and look through the linked machines.
- 2
A cluster on one address
Spread those profiles over more addresses, or keep the cluster knowingly for accounts meant to sit together.
- 3
A burst of openings
Open through the queue or a schedule, so a morning arrives spread out instead of in a row.
What this does not do
- It does not see the platform's side. These rows are your own workspace's, so nothing here can say an account is limited, under review or in a shadow ban.
- It is three rules, not a model. We score nothing, predict nothing, learn nothing: the same rows give you the same answer every time.
- We block nothing. A warning is a line to read: your profiles keep opening and no launch is held back by it.
- Only profiles with an address set land in a cluster. A profile with none leaves through your own connection, which is a separate line in the same panel.
How to check
The rules are arithmetic in one file, and the stand runs that file rather than reading it.
- The thresholds, the window and the per-person country comparison
- apps/server/src/logs/suspicion.ts · apps/server/test/подозрительная-активность.js
- The spacing a bulk launch really uses
- apps/desktop/src/manager/renderer.js · apps/desktop/test/запуск-не-залпом.js
- The address taken from the server, the country only from a trusted edge
- apps/server/src/common/request/client-net.ts
- Reading these rules starts at admin
- apps/server/src/logs/logs.controller.ts
- The panel shows what the server counted and survives a refusal
- apps/web/components/dashboard/AttentionPanel.tsx · apps/server/test/подозрительная-активность.js
Questions
- Does a warning mean an account is already lost?
- No. These are shapes that come before losses, read from your own rows. Whether a platform has acted is visible there and nowhere else.
- Why is my morning batch never flagged?
- Because the app spaces its own openings by three to fourteen seconds inside one window of the app, and a burst needs a gap under two and a half seconds. Two machines starting at once are not spaced by anything.
- Why is the country column empty for me?
- Because the country is only as good as the edge in front of the server. Without that header the field stays empty and no country warning comes.
- Who can see the panel?
- Anyone sees the panel, but these three lines come out of the log, which is open to the owner and an admin only. What they read covers the whole workspace rather than their own profiles.
- Can I change the thresholds?
- Not today. Four profiles, five starts and thirty days are the same in every workspace, and you cannot change them.
Read your own rows
Sign in to ARMANOS, and your history fills from the first profile you open.