Building a Rolling-Baseline HTTP Anomaly Detector (No Fail2Ban)

Every VPS running a public web app gets hit with traffic it didn't ask for, from scrapers, brute-force login attempts, or just someone's misconfigured bot hammering the same endpoint every second. Most tutorials say "install Fail2Ban and move on." But what if you want to understand the traffic before you block it? What if you need thresholds that adapt to your actual load instead of a hardcoded "5 failures in 10 minutes"? That's what I built for the HNG DevOps track: a Python daemon that tails N