Not a linux novice by any means, so this last year (2019) I had been tracking logs on my server. I'll come back to this article and clean it up but incase I dont these definitely helped me track things until I start using a third party tool. sudo ip6tables -I INPUT -m geoip --src-cc IT,FI,GB,CA,MX,CN,DE,TR,ID,RU,IN,IL,BR -j DROP http://blog.jeshurun.ca/technology/block-countries-ubuntu-iptables-xtables-geoip https://unix.stackexchange.com/questions/92560/list-all-connected-ssh-sessions cat /var/log/auth.log | grep 'Connection closed' | tail -n 40 sudo iptables -L iptables -A INPUT -m state --state INVALID -j DROP Notes http://ipset.netfilter.org/iptables.man.html https://unix.stackexchange.com/questions/345114/how-to-protect-against-port-scanners https://unix.stackexchange.com/questions/318859/how-to-use-watch-command-with-a-piped-chain-of-commands-programs https://daenney.github.io/2017/01/07/geoip-filtering-iptables http://xmodulo.com/block-network-traff...