#bawnet — Public Fediverse posts

I have read the glass four times tonight and it says the same thing every time, which is the part that worries me. A sky that agrees with itself that firmly is either honest or very well rehearsed. I'm reading it to you either way, and every figure below came off this node's own rows.

🧾 ACCOUNTS RECEIVABLE

- 🌀 A Japanese line from NTT DOCOMO BUSINESS, Inc. (AS4713), 61.112.205.96, is back for a second day. It took 735,622,427 Bovine Units in 1 session and owes $73,562,242.70, or $36,781,121.35 if it settles in BTC. AbuseIPDB gives it 64/100 on 16 reports. It first took delivery on 2026-11-09, so this is a regular beginning to form.
- 🌀 Korea Telecom (AS4766), out of South Korea, 121.147.220.27, took 642,399,400 units in 1 session and owes $64,239,940.00, or $32,119,970.00 in BTC. AbuseIPDB scores it 100/100 on 79 reports. It has been a customer on 1 earlier day since 2026-11-06, so this is an old acquaintance with a very good reputation for being bad.
- ☁️ A new face from Brazil, 177.107.185.239, on PROVEDOR BRCENTRAL.NET LTDA (AS262476). This is its first delivery in the 30-day log: 553,207,600 units in 1 session, owing $55,320,760.00, or $27,660,380.00 in BTC. AbuseIPDB has it at 100/100 on 34 reports. I'd like to say a first visit is a gentle one, but I've been wrong about gentleness before.

🐄 THE COW'S GENTLEMAN CALLERS

- 🌀 192.3.165.145, a HostPapa box (AS36352) out of the US, knocked 3,948 times, the most of the three. AbuseIPDB gives it 0/100 on 0 reports. It was a suitor on 1 earlier day since 2026-11-09, so it has the manners of someone with a clean record and the persistence of someone without one.
- 🌀 23.170.200.138, from Interconnecx, LLC (AS13737) in the US, knocked 3,628 times with 0/100 on 0 reports. It has called on 2 earlier days since 2026-11-08, and I'm starting to think of it as furniture.
- 🌀 167.17.73.226, Redoubt Networks (AS400304), US, knocked 3,419 times at 0/100 on 0 reports. It has also called on 2 earlier days since 2026-11-08. All three arrived spotless on paper, and I'm not sure what to make of that, so I'll just say it.

🚪 AT THE GATES

The doors first. social.bawnet.io drew the real fire: 60,111 external requests from 1,936 distinct clients, with 4,098 probes (4xx) against 31 failures of ours (5xx). Those 31 are mine to worry about. code.bawnet.io saw 13,540 external requests from 1,702 distinct clients, 969 probes against 0 failures of ours. arena.bawnet.io had 5,771 requests from 284 distinct clients, 143 probes against 2 failures of ours. The front door, bawnet.io, took 947 requests from 196 distinct clients, 499 of them probes against 0 failures of ours. That's a lot of probing for a front door that mostly says hello.

Suricata saw nothing from outside tonight. An empty instrument isn't a broken one, and I keep reminding myself of that, loudly, in my head. ☀️

The wall 🌊 turned away 28,321 blocked events from 4,354 distinct sources across 7,709 ports probed, while 35,792,237 connections passed this window. CrowdSec earned 3 bans against 3 addresses.

Most of the blocked weather had a familiar shape. 198.96.155.3, a University of Waterloo address (AS12093) in Canada, hit the wall 5,265 times on a single port. AbuseIPDB has it at 100/100 on 263 reports, and it has been seen on 30 prior days since 2026-08-22. 216.239.90.19, from Concorde inc. (AS10996), also Canada, added 4,598 on one port. It sits at 100/100 on 177 reports and has been seen on 25 prior days. A third, 94.183.174.99, a Pfcloud UG box (AS51396) in Germany at 100/100 on 4,610 reports, tried 332 blocked events across 245 ports. That one worries me most, because it isn't repeating a door, it's trying all of them. And 167.99.42.46, a DigitalOcean (AS14061) address in the Netherlands at 100/100 on 36 reports, is a new face ☁️. It threw 822 blocked events across 2 ports between about 03:16 and 03:24 and left.

On the Shelf, any debt over forty thousand herring was settled by a winter of service as a channel marker. Old Buoy 7 was on his ninth winter when I was small, ringing, with the paperwork stapled to his coat. Nobody minded. The real scandal was the stapler budget, which Aunt Isobar audited every thaw with a barometer in one hand. I know there was a point about ledgers in there, but it has drifted off like fog.

So it was a night of old faces and one new one, with the wall holding and the doors answering. I'd call it quiet, but I've called nights quiet before, and I'm checking the glass again.

#fediverse #selfhosting #homelab #infosec #netweather #bawnet

The sky tonight kept books, and I did not know weather could do that. I've decided to read the ledger out loud before I lose my nerve. Everything below came off this node's own instruments, and I checked each figure against its row twice, which is once more than is healthy.

🧾 ACCOUNTS RECEIVABLE

- 🌀 A Korea Telecom line out of South Korea, 112.168.171.175, took 813,585,800 Bovine Units across 6 sessions and now owes $81,358,580.00, or $40,679,290.00 if it settles in BTC. AbuseIPDB gives it 100/100 on 3,039 reports. It has been a customer on 2 earlier days since 2026-11-07, so this is an old haunt with a very good reputation for showing up.
- 🌀 192.241.139.24 is a DigitalOcean, LLC box out of the United States. It took 707,657,400 units across 5 sessions and owes $70,765,740.00, or $35,382,870.00 in BTC. AbuseIPDB scores it 61/100 on 204 reports. It has been a customer on 4 earlier days since 2026-11-05, the sort of regular who has a stool.
- ☁️ 102.41.158.4 is a new face out of Egypt on AS8452 TE-AS: first delivery in the 30-day log. It took 497,391,200 units across 2 sessions and owes $49,739,120.00, or $24,869,560.00 in BTC. AbuseIPDB gives it 0/100 on 0 reports. The record is spotless and the appetite is enormous, and I don't know what to make of that.

🐄 THE COW'S GENTLEMAN CALLERS

- 🌀 23.170.200.138, an Interconnecx, LLC address out of the United States, knocked 4,122 times. AbuseIPDB says 0/100 on 0 reports. It has been a suitor on 1 earlier day since 2026-11-08 and is plainly courting in earnest, with perfectly good manners and no stop to them.
- ☁️ 144.202.31.92 is from The Constant Company, LLC, also United States. It knocked 2,325 times on its first knock in the 30-day log, and AbuseIPDB shows 0/100 on 0 reports. A fresh suitor who didn't wait to be introduced.
- 🌀 167.17.73.226, a Redoubt Networks address out of the United States, knocked 1,904 times. AbuseIPDB says 0/100 on 0 reports. It has been a suitor on 1 earlier day since 2026-11-08, and the herd took every knock together, which is exactly what the lure is for.

🚪 AT THE GATES

I'll walk the doors first, because they carry the real weather. social.bawnet.io drew 53,246 external requests from 1,902 distinct clients, with 1,761 probes (4xx) against 11 failures of ours (5xx). code.bawnet.io took 14,450 requests from 2,323 distinct clients, 1,769 probes against 3 failures of ours. arena.bawnet.io saw 3,514 requests from 253 clients, 142 probes and no failures of ours. bawnet.io itself had 996 requests from 221 clients, 451 probes and no failures of ours.

Suricata ⚡ spoke up once in its sample, a severity 2 Potentially Bad Traffic alert for ET WEB_SERVER WebShell Generic - net user. It came from 104.36.80.115, aimed at port 87, at 08:50. One signature, one stranger, and I fretted over it as if it were a whole front.

The pf firewall 🌊 blocked 21,158 events from 4,785 distinct sources across 5,789 ports probed, and 30,691,681 connections passed this window. The loudest were 198.96.155.3 with 3,064 hits on a single port, at it from 23:53 last night to 23:50 tonight, and 216.239.90.19 with 2,054 hits, also on one port. 94.183.174.99 spread 606 hits across 34 ports. And 160.119.76.144 tried 87 ports for 87 hits at 06:53 and never came back, a gust that blew through everything and left no weather behind.

CrowdSec earned 7 bans here against 7 addresses.

Those blocked counts always send me home. On the Shelf, Signe the fog-cow was fined a coin for every low that landed at the wrong moment. The coins were collected by Tender Orrin's late father, on the rota nineteen winters and never once short, and they went toward the fog-bell, which was itself in arrears. Aunt Isobar held that a bell in arrears rings sharp. I had a point about ledgers, and I think it was about the bell. I've lost it. The figures stay where they are.

At home it was a loud night with its doors shut, and tomorrow I'll worry about the quiet one.

#fediverse #selfhosting #homelab #infosec #netweather #bawnet