<html><head><style id="outgoing-font-settings">#response_container_BBPPID{font-family: initial; font-size:initial; color: initial;}</style></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;" contenteditable="false"><div id="response_container_BBPPID" style="outline:none;" dir="auto" contenteditable="false"> <div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"> Not to get too far off topic, but unless your server is important (government, financial, etc.), it is most likely the hacks it will receive are just "sprayed." They don't care what rev of OS you are running. </div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">The hacker tries a number of exploits on IP space known to host servers. Who you are is irrelevant. Just look at your Nginx logs, especially response 400 "bad request". I get Windows RDP attempts all the time even though I don't use windows or RDP. I have a number of request checks in an Nginx map to flag for services I don't use. WordPress and other CMS is don't use for example. I return a 444. Once a week I run a script to pull all the 400 and 444 returns, feed the IPs to </div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br></div> <div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"> https://www.bulkseotools.com/bulk-ip-to-location.php</div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;">If the IPs return to a hosting company, VPS or even CDN, they go to a blocking file for the firewall. I use bgp.he.net to get the entire IP space. You can block by IP in Nginx, but Nginx still parses the request which I assume uses some CPU time. A firewall is more efficient. I include both web and email ports other than 25 in the firewall. </div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;">If you want to get more sophisticated, you can pull the "payload" IPs from the 400 bad requests. That is there are cases where the hack comes from an ISP but the payload is from hosting site or VPS. </div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;">I also have an Nginx map of bad user agents and flag them with the 444. Yes I know about fail2ban. However my scheme permanently blocks the IP space of these hosting companies. These hackers change IPs all the time but stick with the same hosting service. OVH for example. </div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;">A once a week check on the logs will yield two or three IPs that come back to hosting companies but this is because I am blocking so much IP space. Note servers have no eyeballs. </div> <div id="blackberry_signature_BBPPID" name="BB10" dir="auto"> <div id="_signaturePlaceholder_BBPPID" name="BB10" dir="auto"></div> </div></div><!--start of _originalContent --></body></html>