[BUG] Telegram notifications

[ZMJGMADHPXWT]

Describe the bug
opencanary send alerts to Telegram only during container startup. And keep silence during port connections.

To Reproduce
Steps to reproduce the behavior:

1. Create folders and network

docker network create -d macvlan \
  --subnet=192.168.1.0/24 \
  --gateway=192.168.1.1 \
  -o parent=enp2s0 docker-net-honeypot-opencanary

2. Install opencanary as Docker container

services:
  opencanary:
    image: thinkst/opencanary:latest
    container_name: opencanary-honeypot-container
    restart: unless-stopped
    cap_add:
      - NET_BIND_SERVICE
      - NET_RAW
    mem_limit: 400M
    cpus: 0.4
    tmpfs:
      - /run
    volumes:
      - /blalalalala/docker/docker_services/opencanary/data/.opencanary.conf:/root/.opencanary.conf
    networks:
      docker-net-honeypot-opencanary:
        ipv4_address: 192.168.1.14

networks:
  docker-net-honeypot-opencanary:
    external: true

3. Configure it

{
    "device.node_id": "pc16",
    "ip.ignorelist": [  ],
    "logtype.ignorelist": [  ],
    "git.enabled": true,
    "git.port" : 9418,
    "ftp.enabled": true,
    "ftp.port": 21,
    "ftp.banner": "FTP server ready",
    "ftp.log_auth_attempt_initiated": false,
    "http.banner": "Apache/2.2.22 (Ubuntu)",
    "http.enabled": true,
    "http.port": 80,
    "http.skin": "nasLogin",
    "http.skin.list": [
        {
            "desc": "Plain HTML Login",
            "name": "basicLogin"
        },
        {
            "desc": "Synology NAS Login",
            "name": "nasLogin"
        }
    ],
    "http.log_unimplemented_method_requests": false,
    "http.log_redirect_request": false,
    "https.enabled": true,
    "https.port": 443,
    "https.skin": "nasLogin",
    "https.certificate": "/etc/ssl/opencanary/opencanary.pem",
    "https.key": "/etc/ssl/opencanary/opencanary.key",
    "httpproxy.enabled" : true,
    "httpproxy.port": 8080,
    "httpproxy.skin": "squid",
    "httproxy.skin.list": [
        {
            "desc": "Squid",
            "name": "squid"
        },
        {
            "desc": "Microsoft ISA Server Web Proxy",
            "name": "ms-isa"
        }
    ],
    "llmnr.enabled": false,
    "llmnr.query_interval": 60,
    "llmnr.query_splay": 5,
    "llmnr.hostname": "DC03",
    "llmnr.port": 5355,
    "logger": {
        "class": "PyLogger",
        "kwargs": {
            "formatters": {
                "plain": {
                    "format": "%(message)s"
                },
                "syslog_rfc": {
                    "format": "opencanaryd[%(process)-5s:%(thread)d]: %(name)s %(levelname)-5s %(message)s"
                }
            },
            "handlers": {
                "console": {
                    "class": "logging.StreamHandler",
                    "stream": "ext://sys.stdout"
                },
                "file": {
                    "class": "logging.FileHandler",
                    "filename": "/var/tmp/opencanary.log"
                },
                "telegram": {
                    "class": "opencanary.logger.WebhookHandler",
                    "url": "https://api.telegram.org/botBBBBBBBBBBB:CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC/sendMessage",
                    "method": "POST",
                    "data": {
                        "chat_id": "-AAAAAAAAAAAAAAA",
                        "text": "🚨 Alert!\n\n Honeypot detection!!!\n\nDetails: \n\n Take a look at the file in Docker /var/tmp/opencanary.log"
                    }
                }
                
            }
        }
    },
    "portscan.enabled": true,
    "portscan.ignore_localhost": false,
    "portscan.logfile":"/var/log/kern.log",
    "portscan.synrate": 5,
    "portscan.nmaposrate": 5,
    "portscan.lorate": 3,
    "portscan.ignore_ports": [ ],
    "smb.auditfile": "/var/log/samba-audit.log",
    "smb.enabled": true,
    "mysql.enabled": true,
    "mysql.port": 3306,
    "mysql.banner": "5.5.43-0ubuntu0.14.04.1",
    "mysql.log_connection_made": false,
    "ssh.enabled": false,
    "ssh.port": 22,
    "ssh.version": "SSH-2.0-OpenSSH_5.1p1 Debian-4",
    "redis.enabled": true,
    "redis.port": 6379,
    "rdp.enabled": true,
    "rdp.port": 3389,
    "sip.enabled": true,
    "sip.port": 5060,
    "snmp.enabled": true,
    "snmp.port": 161,
    "ntp.enabled": false,
    "ntp.port": 123,
    "tftp.enabled": false,
    "tftp.port": 69,
    "tcpbanner.maxnum":10,
    "tcpbanner.enabled": false,
    "tcpbanner_1.enabled": false,
    "tcpbanner_1.port": 8001,
    "tcpbanner_1.datareceivedbanner": "",
    "tcpbanner_1.initbanner": "",
    "tcpbanner_1.alertstring.enabled": false,
    "tcpbanner_1.alertstring": "",
    "tcpbanner_1.keep_alive.enabled": false,
    "tcpbanner_1.keep_alive_secret": "",
    "tcpbanner_1.keep_alive_probes": 11,
    "tcpbanner_1.keep_alive_interval":300,
    "tcpbanner_1.keep_alive_idle": 300,
    "telnet.enabled": false,
    "telnet.port": 23,
    "telnet.banner": "",
    "telnet.honeycreds": [
        {
            "username": "admin",
            "password": "$pbkdf2-sha512$19000$bG1NaY3xvjdGyBlj7N37Xw$dGrmBqqWa1okTCpN3QEmeo9j5DuV2u1EuVFD8Di0GxNiM64To5O/Y66f7UASvnQr8.LCzqTm6awC8Kj/aGKvwA"
        },
        {
            "username": "admin",
            "password": "admin1"
        }
    ],
    "telnet.log_tcp_connection": false,
    "mssql.enabled": true,
    "mssql.version": "2012",
    "mssql.port":1433,
    "vnc.enabled": true,
    "vnc.port":5000,
    "mongodb.enabled": true,
    "mongodb.port": 27017,
    "mongodb.version": "4.4.6"
}

4. Restart your container and make a connection from other host in LAN, curl http://192.168.1.14

Expected behavior
I expect to get an alert right after connection. And not only during the container restart.
In the Docker logs I see these connections

2026-08-28T11:03:44+0000 [twisted.python.log#info] "192.168.36.57" - - [28/Aug/2026:11:03:43 +0000] "GET / HTTP/1.1" 302 625 "-" "curl/8.14.1"
2026-08-28T11:03:51+0000 [twisted.python.log#info] "192.168.36.57" - - [28/Aug/2026:11:03:50 +0000] "GET / HTTP/1.1" 302 625 "-" "curl/8.14.1"

Desktop (please complete the following information):

• OS: Debian 13 host, Docker version 29.7.2

Thanks in advance for your help.