I think my server was hacked

[crusher11 1127]

3 hours ago, Q-Droid said:

Enable SNI (many do by default) so that IP based requests are rejected. 

What's SNI?

[sh0rty 724]

38 minutes ago, crusher11 said:

What's SNI?

Server name indication. Simple: The reverse proxy just reacts when the specified hostname, e.g. emby.yourdomain.com is called by the client. Many simple bots, vulnerability scanners and automated scripts try to connect directly to your public IP address. 

Edited 1 hour ago by sh0rty

[Q-Droid 999]

10 minutes ago, sh0rty said:

Server name indication. Simple: The reverse proxy just reacts when the specified hostname, e.g. emby.yourdomain.com is called by the client. Many simple bots, vulnerability scanners and automated scripts try to connect directly to your public IP address. 

This. And if your domain doesn't have a PTR record for reverse lookups then your IP is all they know and can't complete the TLS handshake to get any more info. Just don't run non-TLS services on the same IP. Most domains wouldn't need a PTR unless running an email server and if someone is then they should know enough to protect their services.