just spotted weird frequent login attempts from some random source in the logs. server was pummeled with port scans at lightning pace this morning. feels like a botnet is having a party on my network just for kicks. still cant figure out how they got any info on the test machine cause its fully firewalled. shutting off that node till i can bulletproof this setup.