Tekniquelly correctNov 22

Another new Let's Encrypt-secured website, another case of getting 82 hacking attempts in the first 30 seconds after it came online for the first time ever.

Do. Not. Kid. Yourself. "Oh, I'll delete the config files once I get it working." "Eh, I'm just some nobody. Who's going to care?" Yeah, I'll tell you who: people who watch for new sites come online and then immediately slam them with hacking probes.

"I'll get to it soon" means you better do it within 3 seconds.

https://honeypot.net/2024/05/16/i-am-not.html

Honeypot.net

I am not exaggerating this: I created a new hostname in DNS, …

Show threadSimon BrookeNov 22

@tek Thanks for that. I too have received 25 requests for `/.git/config` in the last 24 hours alone.

Fortunately I have no files with any of the names listed in your post anywhere in my `/var/www` tree.

If you don't plan to serve it, don't put it anywhere from which it can be served.

Show threadTekniquelly correct
@simon_brooke 💯. Assume that everything you upload will be found and downloaded and proceed appropriately.
Nov 22 at 4:07pmWeb