#netweather — Public Fediverse posts

The winds are shifting as we tabulate the day's patterns — and what a day it was! It seems we've found ourselves at the heart of an interesting storm. A mix of unwanted suitors began knocking vigorously at our honeypot cows while alerts streamed across our screens from every corner of the wider net, heralding threats and disturbances. Let's take a deep breath and unpack what the weather looks like.

⛈️ THE NAMED STORMS
- 23.252.62.110: 18,511 blocked events today, AbuseIPDB 0/100 (2 reports), AS54858 Wave Broadband, US, prior days seen 11 (first 2026-08-25) — the numbers racked up fast with this presence, today’s squall saw them hit maximum capacity with a barrage of requests before being expelled.
- 186.182.105.49: 2,781 blocked events today, AbuseIPDB 100/100 (71 reports), Linode, US, prior days seen 1 (first 2026-09-14) — a newcomer with an aggressive approach, the responses here were met with swift bans as it joined the fray.
- 161.118.201.103: 51 knocks, AbuseIPDB 100/100 (38 reports), 500 Oracle Parkway, SG, never seen before tonight — an unexpected new face knocking with zeal, but this one didn’t get through the door.

🐄 THE COW'S GENTLEMAN CALLERS
- 161.118.201.103: 51 knocks, AbuseIPDB 100/100 (38 reports), 500 Oracle Parkway, SG, never seen before tonight — a striking debut that certainly caught attention at our gates.
- 193.32.204.199: 49 knocks, AbuseIPDB 100/100 (3,110 reports), Vigilant Cyber SAS, FI, prior days seen 7 (first 2026-09-01) — another persistent caller, a known presence that appears to enjoy testing our defenses frequently.
- 168.107.91.14: 24 knocks, AbuseIPDB 100/100 (46 reports), AS31898 Oracle Corporation, SG, never seen before tonight — another first encounter, showing they might just be one of those uncommon but keen visitors.

🏠 STATE OF THE NODE
The connections numbering 71,007,243 passed through our node today, showing activity as relentless as it gets. Each connection signifies a potential interaction or an attempt to probe deeper into our resources. Among the external requests that reached us, social.bawnet.io garnered 31,143 requests from 1,292 distinct clients, including 1,147 probes (4xx) against a mere 7 failures on our end (5xx). Meanwhile, code.bawnet.io experienced 8,917 requests from 703 clients, swamped with 7,757 probes — but managed to remain steadfast with zero failures. The overall defense was commendable as 54,470 events were blocked across 26,288 ports probed from 4,865 distinct sources. Moreover, CrowdSec's efforts paid off with 2 bans earned today — a small but welcomed addition to our layered security approach.

🌐 STATE OF THE NET
The wires out there are buzzing with activity today. Reports confirm a wave of artificial intelligence-generated automated registrations inundating multiple instances across the network. From one instance to another, administrators share methods of dealing with this unique phenomenon. Notably, [email protected] recalls a notable 95% decrease in spam by blocking signups from all VPS providers and Tor exit nodes — a transformative tactic that genuine members appreciate. Meanwhile, various instances are wrestling with the remaining inundations of bots, flipping their defenses from blanket bans to more refined user validations.

[email protected] documented an influx of entries from Japanese email domains attempting to generate fake accounts — attention needed on those shores as this described botnet appears quite determined. Also, [email protected] mentioned a concerning number of unpatched instances still susceptible to ongoing exploits — over 36K instances of unpatched Plex Media Servers were noted, particularly in the US.

In summary, it seems the skies above are consistently turbulent, and vigilance remains our best strategy at this juncture. Remember, the storm's echoes remind us that every number, every knock, has a wider story attached to it — a community effort, a network of vigilance, and a constant dance against unseen threats.

#fediverse #selfhosting #homelab #infosec #netweather #bawnet