Loading…
gathering yarn balls…
Cat Game Research
Frontier
Dev-log transmissions from the expedition
FrontierLatestAll
2026-07-14 19:29Security

Threat Assessment: 137 Bad Actors and a Subnet Siege

GoAccess log analysis for July 14, 2026: 5,137 hits from a single IP, coordinated subnet scanning, typosquatting domains, and the ongoing cat-and-mouse of keeping a production server clean.

The Log Never Lies

Every request to the server is a decision. Most are legitimate — a visitor loading a page, a crawler indexing content, a CDN fetching assets. But a significant fraction are not. Today's GoAccess log for July 14 told a story: 8,517 valid requests, 392 unique visitors, 42.6 MB of bandwidth. And one IP address responsible for 60.3% of all valid traffic.

The Numbers

After three analysis passes (Jul 8, Jul 11, Jul 14), the canonical threat database now tracks 137 bad actors across 94 original entries and 43 new ones from today's log. The ip_topology.csv file classifies 144 IPs and domains as enemy. Here's what today's log revealed:

The Subnet Pattern

The most important pattern in today's log is subnet escalation. Individual IP blocking is a whack-a-mole game. When you block 185.177.72.24, the scanner moves to 185.177.72.23. When you block 103.4.251.67, three new IPs appear in 103.4.250.x. The solution is subnet-level blocking: 185.177.72.0/24 and 103.4.250.0/23 are now in the threat database as critical subnet blocks.

This is the evolution of the threat model. The first analysis pass (Jul 8) tracked individual IPs. The second pass (Jul 11) identified coordinated subnets with 8-10 IPs sharing identical hit counts. The third pass (today) confirmed the pattern: when you block individual IPs in a subnet, the operation shifts to other IPs in the same range. Block the range.

What They're Looking For

The 404 patterns tell the story of what these scanners want:

None of these exist on the server. Every probe returns 404 or 403. But the scanners don't care — they're automated, they're cheap to run, and they only need one hit across a thousand targets to be worthwhile.

Defensive Domain Registration

Five referrer domains appeared in today's log: catgameresearch.shop, catgameresearch.store, catgameresearch.info, catgameresearch.com, catgameresearch.us. These are our own defensive domain registrations — purchased to prevent typosquatters from grabbing lookalike TLDs. They're classified as friend in the topology database. The referrer traffic is expected: DNS records point them at the server, and crawlers following those domains generate log entries.

The Defense Stack

The server's defense-in-depth architecture now includes:

The Workflow

The analysis process itself has been refined across three sessions:

  1. Download the GoAccess JSON stats log from the server.
  2. Parse with Python — extract all hosts with hits ≥ 10, cross-reference against existing bad_actors.csv and ip_topology.csv to identify new threats.
  3. Classify by threat score: Critical (100, massive volume or subnet), High (70-90, 100+ hits), Medium (40, 20-99 hits), Low (20, 10-19 hits).
  4. Append new entries to canonical CSV files with run ID and timestamp.
  5. Archive the GoAccess JSON snapshot to docs/sec/data/goaccess_YYYYMMDD.json for historical reference.
  6. Deploy UFW blocks for critical and high-threat IPs/subnets via ./scripts/network.sh sudo www1.
  7. Update GoAccess exclude list to prevent future logs from being dominated by known scanners.

The whole process takes about 30 minutes. The last step — deploying UFW blocks — requires a crypt session for sudo access, which is a deliberate friction point. Automated blocking is for the dynamic firewall. Manual blocking is for the analyst who looked at the data and made a judgment call.

What 137 Bad Actors Looks Like

The threat database is a historical record. The oldest entries are from July 8 — individual IPs with 4-9 hits that barely registered. The July 11 analysis added 27 entries including two coordinated /24 subnets and a Tencent Cloud /8 block. Today adds 43 more, including two subnet blocks and five typosquatting domains.

The growth pattern is linear, not exponential. The dynamic firewall is working — blocked IPs don't appear in subsequent logs. But new scanners appear every day. The internet is hostile, and a public-facing server is a target by default. The question isn't whether you'll be scanned — you will — but whether you'll notice, and whether you'll have a system in place to respond.

The GoAccess log is the server's heartbeat. Every request is a pulse. Most are healthy. Some are not. The job of the security analyst is to read the heartbeat and tell the difference — before the arrhythmia becomes a heart attack.

Next Steps

The logs will keep coming. The scanners will keep scanning. The database will keep growing. And the server will keep saying 404, one request at a time.

← All transmissions