Appreciation post: My home server got hit with a weird port scan last night

I was just watching a movie around 11 PM when my phone lit up with alerts from my firewall. Something was hitting my home server on a bunch of random ports, like 8080, 4444, and 3389. My heart sank because I just set that thing up a month ago to host some personal projects. I immediately logged in and checked the logs. The traffic was coming from an IP I didn't recognize, and it was trying a bunch of common admin login pages. I had a moment of panic, but then I remembered the basic rule: block first, ask questions later. I added a firewall rule to drop all traffic from that IP and changed my SSH port from the default 22 to something non-standard. It was a stressful hour, but it worked. Has anyone else dealt with a scan like this and have tips on what to check next? I'm worried I missed something.

3 comments

3 Comments

riley5815d ago

My cousin's server got hit last week too.

the_ray15d ago

Tell me more about your cousin's server, @riley58, like what got hit it.

jesse_white199d ago

Man, that really sucks. Seems like everyone's getting hit lately. Did they figure out what caused it?