Over the past few days, we observed an increased number of access attempts targeting our infrastructure — including automated SSH brute‑force attacks from botnets as well as scanners specifically searching for vulnerabilities in web applications.
What we identified:
-
All attacks were fully mitigated. No unauthorized access, no compromise.
-
The website remained online — the noticeable loading delays had a different cause: a misconfigured PHP‑FPM instance with too low capacity, which we analyzed and fixed.
-
All scanner and exploit attempts failed and were logged accordingly.
What we implemented:
-
Restricted SSH access to two predefined IP addresses
-
fail2ban with progressive ban times for SSH and nginx
-
Rate‑limiting for suspicious endpoints
-
Doubled to quadrupled PHP‑FPM performance
-
Analyzed and resolved DNS and SSH timeout issues
What this means:
Our server isn’t just running — it is actively monitored and systematically secured. We document incidents, analyze them using real data, and fix root causes instead of symptoms. That’s the difference between “running for now” and “running reliably.”
Thank you to everyone who had patience with the loading times over the past days. It wasn’t an attack slowing us down — it was a configuration weakness, and it’s now resolved.
