<div style="font-family: Arial, sans-serif; font-size: 14px;">Not hacked, not invaded, AFAIK it's ok fine except for periodic massive DDOSing. It's an ongoing problem for a lot of webmasters -- a desultory DDG search yields hits like this one ( <span><a target="_blank" rel="noreferrer nofollow noopener" href="https://webmasters.stackexchange.com/questions/126781/why-is-my-regional-website-being-hit-by-thousands-of-chinese-ip-addresses">https://webmasters.stackexchange.com/questions/126781/why-is-my-regional-website-being-hit-by-thousands-of-chinese-ip-addresses</a></span> ) and this one ( <span><a target="_blank" rel="noreferrer nofollow noopener" href="https://blog.talosintelligence.com/chinese-online-ddos-platforms/">https://blog.talosintelligence.com/chinese-online-ddos-platforms/</a></span> ) . It's unlikely that anyone is targeting my site on purpose -- I'm just by-blow for some other idiots fighting each other I suspect.<br></div><div style="font-family: Arial, sans-serif; font-size: 14px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><div><ul style="margin-top: 0px; margin-bottom: 0px;" data-editing-info="{"orderedStyleType":1,"unorderedStyleType":3}"><li style="list-style-type: "∎ ";"><span>CHS<br></span></li></ul></div><div><br></div></div><div style="font-family: Arial, sans-serif; font-size: 14px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div>
<div style="font-family: Arial, sans-serif; font-size: 14px;" class="protonmail_signature_block protonmail_signature_block-empty">
<div class="protonmail_signature_block-user protonmail_signature_block-empty">
</div>
<div class="protonmail_signature_block-proton protonmail_signature_block-empty">
</div>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div class="protonmail_quote">
On Thursday, August 14th, 2025 at 12:50 PM, Raj Wurttemberg via Ale <ale@ale.org> wrote:<br>
<blockquote class="protonmail_quote" type="cite">
<div class="WordSection1"><p class="MsoNormal">Sorry to hear that your system got (possibly?) hacked. Yeah, fail2ban is an amazing tool. If I absolutely must have ssh open to the outside, I usually move ssh to a different port (yeah, you could still find it easily with a port scan), and I configure fail2ban. </p><p class="MsoNormal"> </p><p class="MsoNormal">/Raj</p><p class="MsoNormal"> </p><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:black">From: </span></b><span style="font-family:"Calibri",sans-serif;color:black">Ale <ale-bounces@ale.org> on behalf of lollipopman691 via Ale <ale@ale.org><br><b>Reply-To: </b>Atlanta Linux Enthusiasts <ale@ale.org><br><b>Date: </b>Thursday, August 14, 2025 at 11:24 AM<br><b>To: </b>Atlanta Linux Enthusiasts <ale@ale.org><br><b>Cc: </b>lollipopman691 <lollipopman691@pm.me><br><b>Subject: </b>[ale] Ouch goddamnit</span></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">More assholes from China bringing my site down. When I rebooted, I couldn't help but notice that my uptime(1) stats were spiking into the double-digit range and the system was becoming unresponsive.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">I wrote a quick and simple script to figure out who these guys are so I can block them at the AWS firewall. If anyone else can use it, here ( <a href="https://tomshiro.org/foswiki/ALE/BadActorScript" target="_blank" rel="noreferrer nofollow noopener">https://tomshiro.org/foswiki/ALE/BadActorScript</a> ) 'tis.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Looks like if I am _really_ clever I might-could figure out a way to let fail2ban(1) handle this automagically. A project for another day.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">-- CHS</p></div><div><p class="MsoNormal">_______________________________________________</p></div><div><p class="MsoNormal">Ale mailing list</p></div><div><p class="MsoNormal"><a href="mailto:Ale@ale.org" rel="noreferrer nofollow noopener">Ale@ale.org</a></p></div><div><p class="MsoNormal"><a href="https://mail.ale.org/mailman/listinfo/ale" target="_blank" rel="noreferrer nofollow noopener">https://mail.ale.org/mailman/listinfo/ale</a></p></div><div><p class="MsoNormal">See JOBS, ANNOUNCE and SCHOOLS lists at</p></div><div><p class="MsoNormal"><a href="http://mail.ale.org/mailman/listinfo" target="_blank" rel="noreferrer nofollow noopener">http://mail.ale.org/mailman/listinfo</a></p></div><div><p class="MsoNormal"> </p></div></div>
</blockquote><br>
</div>