Bots found my home server in minutes - here’s how I kept them out

Published Aug 16, 2026, 1:00 PM EDT Maker, meme-r, and unabashed geek, Joe has been writing about technology since starting his career in 2018 at KnowTechie. He's covered everything from Apple to apps and crowdfunding and loves getting to the bottom of complicated topics. In that time, he's also written for SlashGear and numerous corporate clients before finding his home at XDA in the spring of 2023. He was the kid who took apart every toy to see how it worked, even if it didn't exactly go back together afterward. That's given him a solid background for explaining how complex systems work together, and he promises he's gotten better at the putting things back together stage since then. If the self-hosting bug has caught you, it’s never too early to think about security. Setting up a new service can feel invigorating — the rush of reducing cloud subscriptions and keeping your data private. Early steps include using your own domain with an HTTPS certificate, but ironically, that’s also the first step attackers take to find your server. In the time it takes to make a cup of coffee, automated scanners have seen your certificate in public transparency logs and found your IP address. That’s the start of a process that ends up with your home lab hosting a botnet, at least if it succeeds. It doesn’t matter if you keep your networking gear updated if you poke holes in your security for services to get through, but keeping your network safe is part of knowing that you will get found, and what to do to make sure there’s nothing worth finding. My server was on a list before my coffee cooled The scanners are faster than you think I could tell you how to secure your network first, but would you read down to the why? It’s time to get shocked into action, because it shocked me, and I deal with this stuff every day. The entire IPv4 internet has roughly 3.7 billion routable addresses, and automated tools like masscan can sweep them all in under five minutes from a single computer. That includes your router, btw. Sophos set up some cloud honeypots in 2019, and one server was attacked within 52 seconds. The average was 13 attempted attacks per minute, and you can bet the tools have improved since then. When our Adam Conway set up a honeypot in 2025 for just over a week, he tracked 29,282 unique interactions. Every week, every month, every year, the internet is being swept in less time than it takes for you to make coffee. If any of those scans come from a botnet trying to spread, your system will be infected next. In the Windows XP days, you didn’t even have time to install security patches after connecting to the internet before your system got compromised. The release of Windows XP SP2 closed that hole by adding a host firewall, but that does nothing for the rest of your network.​​​​​​​ And here’s the thing. Your HTTPS certificate is a beacon to bots, and SANS ISC noticed a scanner hit a new website within one second of the certificate appearing in transparency logs. That’s not enough time for you to respond, so we need to secure things before any public-facing information pops up. Who's actually doing the scanning? Before you assume everything that scans your IP is malicious, remember a large chunk of it is legitimate security firms. Shodan, Censys, and the non-profit Shadowserver Foundation constantly scan the internet and index what they find. That’s an invaluable resource for cybersecurity companies, but the criminals can read the same lists.​​​​​​​ Those lists then become targets for botnets like Mirai or Aisuru, crews that rent out your router as a residential proxy, or state-sponsored groups seeking to hide where their traffic originates. The DeadBolt gang ransomwared over 19,000 QNAP NAS devices because of UPnP forwarding, and these are just the tip of the iceberg.​​​​​​​ You need more defense than you think Think of security like an onion and stack layers Credit: Shekhar Vaidya/XDA Your router already blocks unsolicited inbound traffic by default. It’s not the firewall that the bots are looking for; it’s the ports you have open through it. The first rule is to default to deny, and then I switch off UPnP and NAT-PMP (if they exist) because they let any device on your network open ports without asking you first. On my own firewall, the rule set I like most actually looks the other way. When default-deny is the first thing set up, blocklists on incoming traffic mostly make your logs look cleaner. But adding those blocklists, like Spamhaus DROP, to the outgoing rules means that if something does get into your network, it can't phone home to the control server. GeoIP blocking also cleans up your logs; it doesn’t really stop organized attackers who will be proxying through a VPS or compromised router in your country anyway. That doesn’t mean you shouldn't enable it; the more layers, the better. The other thing I always have running is fail2ban. This reads your firewall logs and bans any IP that fails to log in a few times. The pairing of CrowdSec and ZenArmor is also a good one; this adds an intrusion prevention system and crowd-sourced blocklists from other CrowdSec users, making them a little more personalized than the default lists.​​​​​​​ Not opening ports is the better plan WireGuard won't talk to the scanners Credit: Shekhar Vaidya/XDA Layers of security are wise, but not opening the door in the first place is even smarter. My firewall doesn’t have any forwarded ports anymore, because I use tools like Tailscale, Pangolin, or NetBird that use NAT punching to communicate through my firewall without opening ports. My SSH sessions now live behind Tailscale, as do my LLM API keys, and no amount of port scanning can find them. For things I want to be public, like photo albums shared with family, I put them behind a reverse proxy that has an authentication layer as the first step. Sure, the bots can find the login page, but they can’t get past it, especially since I set up SSO, so there are no passwords to leak. The few things that must stay exposed get a few tweaks to ruin the automated methods used to get access. SSH runs on keys only, with password authentication and root login turned off, and when it’s not running through Tailscale, it’s not running on port 22. Every admin dashboard gets 2FA or passkeys, and both containers and device firmware get daily update checks to close potential routes in. Tailscale Tailscale lets you create a private overlay network for your devices to securely communicate wherever they are. The bots are still knocking but it looks like nobody is home My logs still show thousands of probes a day, and no firewall setting will change that. But those bots only see closed ports now, and a couple of deliberately public services locked behind key-based authentication, not default credentials. The scanning economy is built on volume, and making it harder to get into your system makes their payout not worth it. If you want to see how your network looks right now, put your public IP into Shodan and see what ports it shows. If something appears, you can bet the bots have found them too.