They are attempting to overload or disrupt my server network.
They are attempting to overload or disrupt my server network.
I have a VNC configured on my server and today I enabled it at 185.56.80.222. When I checked the IP address, I found this link: https://www.abuseipdb.com/check/185.56.80.222. It seems there’s no option to block or blacklist that IP. My router is set to use DDoS protection via `dd`.
Based on the information available at https://www.abuseipdb.com/check/185.56.80.222, it seems likely this is the situation.
They kept attempting to link to VNC multiple times every few minutes.
You created a publicly accessible login page and were caught by a bot attempting access.
Your VNC configurations weren’t secured properly, allowing repeated failed attempts without consequences.
This isn’t a massive DDoS attack—it’s a bot probing for weaknesses, which they’ll likely exploit further.
Never enable RDP or VNC on open networks; it introduces unnecessary risks.
Blocking IPs won’t stop bots if they recognize your open port; consider redirecting traffic through a VPN for safer access.
I wasn’t able to locate a method for blacklisting the IP address. The search results only mentioned parental controls.
It's improved somewhat, though it's not perfect. It seems I overlooked the original VPN option, which would have allowed remote access more effectively.
I also run a web server and frequently face bots trying to access pages like www.mysite.com/admin or /login. Only simple HTML files are hosted there, haha.