IIS only serve requests with hostnames

What is the optimal way to configure IIS to block direct IP access to the server? Direct IP access is only used by malicious scanners that will troll the entire internet by ip looking for vulnerable servers.

I stood up a server only yesterday that is not used anywhere on the internet, and already have '/MyAdmin/scripts/setup.php' was not found in my error logs.

Solution 1:

You can use the Url Rewrite feature of IIS to do that :

1. Open the URL Rewrite feature :

2. Add a rule of type "Request blocking" :

3. Block the requests based on host name :

If you know your IP address, you can use it to block requests which use it :

Or you can block all requests which are not using the domain name :

Hope this helps (It took me ages to find that).

Please note that I have no idea of the performance overhead of this usage.

Solution 2:

This is, frankly, beneath caring about, however...

1. Set up the default site on the server to point to a blank directory, or static files, or something you don't care about getting hammered by "malicious scanners". [booga booga]
2. Don't map any blank host headers to your sites in IIS.