If the incoming traffic is truly unusual and you are confident in saying that the traffic is spam, consider blocking it at your firewall. The lower in the stack that you can deny the traffic, the better. For example iptables -A INPUT -s 1.1.1.1 -j DROP
. Of course, replace 1.1.1.1
with the IP address in question.
A broader tool to secure your server from suspicious incoming connections would be fail2ban. There are also rules that you can make that are specific to Nginx. Fail2ban protects you from many different attacks and isn't just a solution to your specific question.
For a solution specific to Nginx, it comes with a module named ngx_http_access_module
that allows you to allow or deny access based on IP address. You would open nginx.conf
and add include blockips.conf;
Then create blockips.conf in wherever your Nginx configuration files are. Likely it's /usr/local/nginx/conf/
. Finally, add deny configurations as desired:
deny 1.1.1.1;
deny 2.2.2.0/24;
deny 3.3.0.0/16;