I noticed this weekend that someone was pounding on /rss/catalog/notifystock/ trying to brute force the admin credentials. I've added a line to the nginx vhost.d conf that returns 403 when you attempt to visit /rss/catalog/notifystock/ effectively blocking this attack. I've also blocked /rss/order/new and /rss/catalog/review as I discovered they were vulnerable during my research.
When I check the nginx access log I still see them pounding away. The access log shows it is returning a 301 instead of the 403 they should be seeing. Any ideas on why I might be seeing the 301?