Siege Report — October 25, 2026

One hour on the Dojo’s WAN front, 07:00-08:01 on October 25, 2026, told minute by minute. The sniffer sits on the mirror, ahead of the firewall: it sees everything that knocks, including what will never get in.

An honest preamble. In this window the sniffer saw 1,794,432 packets reaching our public address. Most of it isn’t an attack: it’s the return traffic of normal browsing. The siege is the unsolicited slice, the part that knocks on the router and the firewall throws away — and here it is.

The play-by-play, minute by minute

07:01 — Window opens: 697 DNS hits dropped in one minute. The target is hbtbank.com, ANY queries. The machine holds steady: average CPU at 3,1%.

07:13 — Sudden spike: 240 hits. Followed by a wave of traffic reaching 256 at 07:14. No exploits detected by Suricata, only alerts for excessive handshakes.

07:30 — Second wave: 161 hits, then 255 at 07:31. The pattern repeats: short peaks, then a drop. Total DNS drops climbing toward 7.646.

07:53 — Last significant peak: 300 hits. At 08:00 the pace slows to 161. The session closes with 7.646 unsolicited DNS queries dropped and 1.278 other attempts blocked.

Seven days ago, at the same time, dropped DNS queries stood at 464.107.

TLS signatures show 10 distinct JA3 fingerprints from 6 sources; the most frequent was repeated 632 times, indicating a single tool hammering away.

JA4 signatures, more precise than JA3 as they distinguish TLS versions, record 9 distinct fingerprints from 6 sources, with a maximum of 340 repetitions for the same signature.

13 suspicious plaintext HTTP requests: the most frequent is «GET /» (12 times), with user-agent «Mozila/5.0» (1). IPs in the payloads are masked as [ip].

The shutter stayed down: with low CPU, nothing useful for the attacker got in or out.

Where they come from (with a pinch of salt)

Geolocation tells you where the address is registered, not where the person is: behind it there may be a VPN, an anonymizer, a rented server or someone else’s machine. And it has to be read per category.

• DNS amplification — the “sources” (US 4,990, AE 2,200, CN 6, UA 1) are forged: they aren’t attacking, they’re the victims the attacker wants the replies rained on. Same as last Sunday, the Dojo would be used above all against US, more timid (4,990 against 225,115). BN drops out of the top, AE comes in.
• Bandwidth test (port 2000) — 0 hits, from US 1.
• SYN scans — real source: IT 644, NL 239, US 227, BG 129, GB 76.

The hour’s scoreboard

Suricata’s verdict

Suricata inspected the stream: 203 alerts, all of a single kind (“SURICATA STREAM 3way handshake excessive different SYNs”) — scan noise. No exploit, malware or intrusion signature: nothing hostile got in.

Compared to last Sunday

The report of Sunday, October 18 covered the same hour of siege. The volume grew: 1,794,432 packets against 1,727,165, with dropped DNS amplification queries going from 464,107 to 7,646 — less than a third. The CPU stays calm: 3,1% on average against 3% then, still trivial numbers. Suricata closes as it did then: no intrusion.

And the machine?

Average CPU 3,1% (never above 7%). Free memory from 1,574 to 1,575 MB. Active connections between 187 and 331. No queue, no alarm.