The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The most reliable way to reduce malicious web scans is to combine three controls: reject clearly invalid requests in nginx, rate-limit requests before they reach your application, and use fail2ban with your host firewall to ban addresses that keep probing. Each layer handles a different failure mode. User-agent blocking alone is weak because scanners can impersonate normal browsers, while firewall bans can affect shared networks if they are tuned too aggressively.
What malicious web scans are trying to do
Internet-facing web servers are routinely queried for files and paths that may reveal secrets or expose an unpatched application. Typical requests target .env, .git, backup archives, administration panels, database exports, and software-specific paths such as /wp-login.php. A probe may receive a 404, 403, redirect, or application error; the response itself can tell an attacker which software and routes exist.
The objective is not to make a server invisible. You want to make accidental exposure harder, reduce the work your application must perform, and create a record of repeat offenders that can be blocked at the host firewall. These controls do not replace operating-system updates, dependency patching, secure authentication, or protection of legitimate login endpoints.
Use three layers instead of one blacklist
| Layer | Where it acts | Best use | Main limitation |
|---|---|---|---|
| nginx request filtering | Web server, before application code | Reject dotfiles, known unwanted paths, and obvious scanner signatures | User-agent signatures are easy to spoof; path rules can cause false positives |
| nginx rate limiting | Web server, per client address | Slow floods and protect login or expensive endpoints | Shared NAT, mobile networks, and proxies can put many users behind one address |
| fail2ban plus firewall | Host firewall | Ban addresses that repeatedly trigger bad-request or rate-limit evidence in logs | Requires correct log paths, filters, backend actions, and an unban plan |
Apply the layers in that order. nginx can discard a request without invoking application code; rate limiting then constrains traffic that is otherwise valid; fail2ban handles persistent behavior over a time window. A content-delivery network or web-application firewall can add another edge layer, but it does not remove the need to secure the origin server.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Prepare the server before enabling bans
Confirm what must remain reachable
- Record the public address you will use for administration, including any VPN or proxy address. You will whitelist it before testing.
- List the ports that are genuinely required. A typical web host needs SSH (usually 22), HTTP (80), and HTTPS (443); your SSH port may differ.
- Back up nginx configuration and fail2ban files. Keep a second shell session or out-of-band console available in case a rule blocks you.
- Identify the actual nginx access and error log paths. nginx normally writes flat files rather than the systemd journal.
Check your firewall implementation
fail2ban actions differ between distributions. Older installations commonly use iptables; newer systems may use nftables. Do not copy an action name blindly. Check which command manages rules on your host, and verify that the selected fail2ban action supports that backend.
Block dotfiles and obvious probes in nginx
Protect hidden files
Unless your site intentionally publishes a hidden path, return a denial for dotfiles. The exception for .well-known preserves common certificate-validation and security-contact uses. Put this location in the relevant server block:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
location ~ /.(?!well-known)(?:.*)$ {
return 403;
}This rule prevents direct web access to names such as .env and .git. It does not remove files from the server, and it does not stop an application from accidentally reading a secret internally. Store secrets outside the document root and review file permissions as well.
Drop paths your application never uses
For a site that does not run WordPress, a request for /wp-login.php is a strong indication of an automated probe. You can close the connection with nginx’s non-standard 444 response:
location = /wp-login.php {
return 444;
}Use path rules only when you are certain the route is not legitimate. If the site does use that route, protect it with authentication, multifactor authentication, and a separate rate limit instead of blocking it.
Optionally reject scanner user agents
A user-agent map belongs in the nginx http context, outside a server block:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
map $http_user_agent $scanner_ua {
default 0;
~*sqlmap 1;
~*nikto 1;
~*nmap 1;
}
server {
if ($scanner_ua) {
return 444;
}
# the rest of your server configuration
}The names above are examples of recognizable signatures, not an exhaustive list. Empty, unusual, or forged user-agent strings will bypass this test, and a legitimate client can technically send a matching string. Treat this as a low-cost noise filter, never as authentication or a complete bot defense. Run nginx -t before reloading, and keep the rule narrow enough that ordinary browsers and API clients are unaffected.
Rate-limit requests before they reach the application
Create separate zones for general traffic and login routes
nginx’s request limiter counts by client address and rejects or delays requests before application processing. Define zones in the http context. The following values are starting points, not universal defaults:
limit_req_zone $binary_remote_addr zone=general_per_ip:10m rate=5r/s;
limit_req_zone $binary_remote_addr zone=login_per_ip:10m rate=1r/s;Apply the general zone to normal dynamic traffic and the stricter zone to a login endpoint:
server {
location / {
limit_req zone=general_per_ip burst=20;
try_files $uri $uri/ /index.php?$query_string;
}
location = /login {
limit_req zone=login_per_ip burst=5 nodelay;
proxy_pass http://application_backend;
}
}Adjust the location and upstream syntax to match your application. A burst allows a short queue above the sustained rate; nodelay rejects excess requests immediately instead of spacing them out. For APIs, account for authenticated clients, retries, health checks, and webhook senders before choosing a threshold.
Choose limits using real traffic
- Start with a looser general rate and inspect nginx logs for legitimate clients being limited.
- Use a much stricter limit for password, token, and account-recovery endpoints because those routes are expensive and attractive to attackers.
- Remember that one public address may represent an office, carrier-grade NAT, university, or reverse proxy. IP-only limits can throttle many legitimate people together.
- If nginx is behind a proxy, configure trusted client-address handling correctly before using an address-based zone. Never accept an arbitrary forwarding header from the open internet as the client identity.
Reload only after a syntax check:
sudo nginx -t
sudo systemctl reload nginxWhen a request is limited, nginx records an error such as a request being limited. That log evidence can later feed a fail2ban jail, but do not ban on a single event: busy legitimate clients can briefly exceed a threshold.
Use fail2ban to ban repeat offenders
Install and inspect the service
Install the package supplied by your distribution, then confirm the service and client are available. On Debian- or Ubuntu-style systems, the package command is commonly:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo apt update
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client statusPackage names and service defaults vary. Do not edit the vendor’s main configuration directly; place local overrides in the distribution’s recommended jail.local or jail.d file.
Whitelist administration addresses first
In your local configuration, set ignoreip to include loopback and the address or VPN range from which you administer the host:
Recommended Free Tools
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.25
findtime = 10m
bantime = 10m
maxretry = 5Replace the example address with your real, trusted address. A changing residential address is not a reliable permanent whitelist; a private VPN address or controlled management network is safer.
Enable scanner and rate-limit jails
Many fail2ban releases ship filters for common nginx bot searches and rate-limit messages. Filter names, defaults, and paths differ by release, so inspect the files installed on your system before enabling them. A local jail can look like this:
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 3
findtime = 10m
bantime = 2d
action = iptables-multiport[name=nginx-botsearch, port="http,https", protocol=tcp]
[nginx-limit-req]
enabled = true
port = http,https
filter = nginx-limit-req
logpath = /var/log/nginx/error.log
maxretry = 10
findtime = 10m
bantime = 15m
action = iptables-multiport[name=nginx-limit-req, port="http,https", protocol=tcp]Use an nftables action instead when your distribution uses nftables and the installed fail2ban release provides that action. The exact action name is version-dependent. A short ban for rate-limit events limits collateral damage; a longer ban for repeated scanner probes reflects their more persistent behavior.
Add a high-404 jail only after checking your log format
A high-404 jail can catch an address requesting many nonexistent paths, but a generic regular expression may not match your access-log format. Create a local filter based on several real lines from your own log, then test it. For example, a filter might count 403 and 404 responses:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
[Definition]
failregex = ^<HOST> .* "(?:GET|POST|HEAD) .*" (?:403|404) .*$
ignoreregex =Save it under the filter directory required by your distribution, reference its filename from a jail, and choose conservative values such as a short window and a relatively high retry count. If your log includes a proxy address, JSON fields, or a different order of fields, rewrite the expression rather than assuming this example will work.
Use the right log backend
nginx commonly writes files such as /var/log/nginx/access.log and /var/log/nginx/error.log. If a global fail2ban setting selects a systemd backend, a jail watching flat files may need an explicit polling backend and an explicit logpath. Confirm that fail2ban can read the file and that log rotation does not leave it watching an obsolete path.
Validate filters before turning on bans
Run the filter tester against a copy of the relevant log:
sudo fail2ban-regex /var/log/nginx/access.log nginx-botsearch
sudo fail2ban-regex /var/log/nginx/error.log nginx-limit-reqReview the matched and missed lines. A filter that matches nothing will never ban; one that matches normal traffic can lock out users. After editing a jail, reload and inspect its status:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo fail2ban-client reload
sudo fail2ban-client status nginx-botsearch
sudo fail2ban-client status nginx-limit-reqThe status output should show the monitored log, current failures, and banned addresses. Generate a controlled test request from a non-whitelisted test address only after you understand the thresholds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set a minimal host firewall baseline
fail2ban is most useful when the host firewall already denies everything except required services. With UFW, a conservative baseline is:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseSubstitute your actual SSH port and management source restrictions where possible. Do not enable a default-deny policy until you have allowed your administration path, or you can disconnect yourself. If another firewall manager controls the host, use that system instead of running competing rule managers.
Test the complete setup without locking yourself out
Check nginx behavior
- Request a known dotfile path from a non-sensitive test file and confirm a 403 response.
- Request an intentionally unused probe path and confirm the configured response. A 444 closes the connection and may appear to the client as an empty or reset response rather than a normal HTTP status.
- Send a harmless test user-agent with a command such as
curl -A sqlmap https://example.test/only against a system you control. - Exercise the login route at a controlled pace and confirm that ordinary use succeeds while bursts are limited.
Check bans and remove one immediately if needed
sudo fail2ban-client get nginx-botsearch banip
sudo fail2ban-client set nginx-botsearch unbanip 198.51.100.44Replace the example address and jail name. If you ban your only administration address, use an out-of-band console or another whitelisted route; do not rely on waiting for an unspecified expiry. Keep the unban command in your runbook before enabling a long ban.
Tune false positives and maintenance
Separate severity by ban duration
Use short bans for evidence that may have an innocent explanation, such as a temporary rate-limit burst. Use longer bans for repeated requests for sensitive filenames or large numbers of nonexistent paths. Review ban times after observing real traffic rather than treating a multi-day value as a universal recommendation.
Account for proxies and shared addresses
IP-based bans are stronger than user-agent rules because spoofing the header does not change the source address seen by the firewall. They can still block an entire shared network, and a distributed scan can rotate addresses. If legitimate users are affected, raise thresholds, narrow the protected location, shorten the ban, or move identity-aware controls into the application.
Review logs and configuration after rotation or upgrades
- Check that nginx continues writing to the path fail2ban monitors after log rotation.
- Re-run
fail2ban-regexwhen nginx’s log format, proxy arrangement, or fail2ban package changes. - Verify that the firewall action still creates rules in the backend your distribution uses.
- Inspect banned-address lists and investigate repeated sources rather than accumulating permanent blocks without review.
Troubleshoot common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| nginx refuses to reload | Rule is in the wrong context or contains a syntax error | Run sudo nginx -t; place map and limit_req_zone in http, and request locations inside server |
| Requests are limited but no IP is banned | Wrong error-log path, filter mismatch, or incompatible backend action | Check jail status, run fail2ban-regex against current logs, and verify the firewall action manually |
| Every address appears to be the proxy | nginx is logging the reverse proxy rather than the client | Configure trusted proxy address handling, then retest before using per-IP limits or bans |
| Legitimate users receive 403 or 444 | Path or user-agent rule is too broad | Remove the offending match, narrow the location, and test with normal browser and API requests |
| fail2ban reports no failures | It is reading the journal while nginx writes files, or the regex does not match | Set the jail’s explicit log path and appropriate backend, then validate against real lines |
| You cannot connect after enabling the firewall | Your SSH port or source address was not allowed | Use console access or a whitelisted management route to add the rule and remove the block |
What scan blocking cannot solve
A 403 or 444 response does not patch a vulnerable component, remove a secret already exposed, or stop an attacker who has valid credentials. Keep the operating system, nginx, runtime, framework, plugins, and dependencies updated. Restrict administrative interfaces, require multifactor authentication where available, use strong per-account throttling, and monitor successful logins as well as failed requests. If the application needs broader inspection or volumetric protection, add an appropriately configured edge WAF or CDN while preserving equivalent controls on the origin.
Deployment checklist
- Back up nginx and fail2ban configuration.
- Whitelist your administration address before enabling bans.
- Allow only required firewall ports.
- Block dotfiles while preserving any intentionally public
.well-knownpaths. - Reject application-specific probe paths only when the site does not use them.
- Treat user-agent matching as a noise filter, not a security boundary.
- Use separate, stricter rate limits for login and other expensive endpoints.
- Set explicit nginx log paths in fail2ban jails and confirm the log backend.
- Choose an iptables or nftables action that matches the host.
- Test every filter with
fail2ban-regexand inspect jail status after reload. - Keep a tested unban command and out-of-band recovery path.
- Review false positives, log rotation, and ban lists as part of normal maintenance.
The Bottom Line
Layer narrow nginx filters, endpoint-specific rate limits, and carefully tested fail2ban firewall bans. The combination reduces scan noise and limits repeat abuse, while patching and secure application configuration remain the controls that address the underlying vulnerabilities.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
