Siege Report — November 1, 2026

One hour on the Dojo’s WAN front, 07:00-08:00 on November 1, 2026, told minute by minute. The sniffer sits on the mirror, ahead of the firewall: it sees everything that knocks, including what will never get in.

An honest preamble. In this window the sniffer saw 320,508 packets reaching our public address. Most of it isn’t an attack: it’s the return traffic of normal browsing. The siege is the unsolicited slice, the part that knocks on the router and the firewall throws away — and here it is.

The play-by-play, minute by minute

07:01 — Window opens. 186 DNS hits dropped immediately; the pace is already high.

07:11 — Hourly peak: 423 hits in one minute. The machine holds steady with CPU at 2.2%.

07:59 — Close. Total 14.571 unsolicited DNS queries dropped, 1.838 other attempts blocked.

07:00-08:00 — Seven days ago, at the same hour, 7.646 DNS queries were dropped.

07:00-08:00 — JA3: 3 fingerprints from 5 sources, the most hit 720 times. Same tool hammering away.

07:00-08:00 — JA4: 3 fingerprints, the most hit 374 times. More precise than JA3, distinguishes TLS versions. 2 match Sliver Agent (FoxIO).

07:00-08:00 — Clear-text HTTP: 18 requests. Most frequent «GET /» (14). User-agent: «visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/[ip] Safari/537.36».

07:00-08:00 — The bouncer who lets no one in: with low CPU, nothing came in or went out.

Where they come from (with a pinch of salt)

Geolocation tells you where the address is registered, not where the person is: behind it there may be a VPN, an anonymizer, a rented server or someone else’s machine. And it has to be read per category.

• DNS amplification — the “sources” (US 9,853, AE 5,093, CN 4) are forged: they aren’t attacking, they’re the victims the attacker wants the replies rained on. Same as last Sunday, the Dojo would be used above all against US, two times the hits (9,853 against 4,990).
• Bandwidth test (port 2000) — 0 hits, from —.
• SYN scans — real source: IT 720, RU 458, BG 309, NL 269, US 268. Same as last Sunday, IT leads the scans, much as they were then (720 against 644).

The hour’s scoreboard

Suricata’s verdict

Suricata inspected the stream: 200 alerts, all of a single kind (“SURICATA STREAM 3way handshake excessive different SYNs”) — scan noise. No exploit, malware or intrusion signature: nothing hostile got in.

Compared to last Sunday

The report of Sunday, October 25 covered the same hour of siege. The volume fell: 320,508 packets against 1,794,432, with dropped DNS amplification queries going from 7,646 to 14,571 — sharply up. The CPU stays calm: 2,2% on average against 3,1% then, still trivial numbers. Suricata closes as it did then: no intrusion.

And the machine?

Average CPU 2,2% (never above 4%). Free memory from 1,548 to 1,549 MB. Active connections between 155 and 203. No queue, no alarm.