I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showi

I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showing me activity on the server, particularly failed http requests and "attempts to use known hacks" (which are just pattern matches on URL requests). I used to get hundreds of lines of logs PER DAY of this stuff.. Then about a year ago I found a list of IP subnets for China and Russia, and blocked all of it at the OS level with the firewall, and now I get almost nothing in my logs anymore (every so often I add a new subnet to the blocklist, usually from eastern Europe). I can't see any reason why my server that hosts personal stuff would need to see traffic from those countries (and I'm fine with blocking false positives - YMMV). I know it's not a foolproof security measure and if anyone was specifically targeting me this would not stop them, but it helps with all the drive-by scanning. There is a TON of automated scan traffic coming out of China and Russia specifically that is constantly scanning IP blocks known to belong to hosting providers.