Hit 1000 blocked login attempts on my home server, here is what surprised me

I set up fail2ban on a old laptop running my NAS about 3 months ago. Last week I checked the logs and saw 1,000 blocked IPs, most from scans hitting port 22 every few minutes. The surprise wasn't the number, it was that 90% of those came from just 12 IP addresses that cycle through the same patterns. I never patched my SSH config before, now I moved it to a non-standard port and disabled password auth. Anyone else track their block counts and notice a handful of repeat offenders?

1 comments

1 Comment

olivia_murphy24d ago

Moving SSH to another port helps but those bots find it anyway, they scan everything.