Solved: All that fake traffic from China – Why? What’s the endgame?

🚀 Executive Summary TL;DR: Automated scanning from Chinese IPs often generates log noise and consumes resources by probing for common web vulnerabilities. Solutions range from quick WAF geo-blocking to precise, behavior-based IP banning with Fail2Ban, or highly restrictive allow-listing for internal services. 🎯 Key Takeaways Large-scale automated scanning, often from botnets, targets common web vulnerabilities like credential stuffing, unpatched software (e.g., Jenkins, WordPress), and information disclosure (e.g., .env files) across the internet. WAF geo-blocking offers a rapid, edge-level defense to stop high-volume traffic from specific countries, best suited for applications with a clearly defined, limited geographic audience. Fail2Ban provides a precise, behavior-based intrusion prevention method by monitoring server logs for malicious patterns (e.g., repeated 404s on /phpmyadmin) and automatically creating temporary firewall rules to ban offending IPs. Tired of seeing your server