01
Problem
AdGuard can block domains, but the raw query log does not explain what happened, why a domain looks suspicious, or how patterns change over time. I wanted a system that made DNS activity easier to review without sending every domain straight to an LLM.
02
Solution
Built a FastAPI service around an AdGuard poller, SQLite-backed domain history, tenant middleware, JWT/API-key authentication, local entropy and anomaly scoring, optional Gemini/Ollama analysis, websocket updates, and a React dashboard for manual scans, stats, usage, and threat review.
03
Role
Full-stack prototype builder · Backend/API and analysis-pipeline implementer · Security dashboard and tenant workflow designer