Thirty minutes after going public, my server logs looked like a crime scene.

I deployed to Railway and panicked at the logs. WordPress bots, phishing kit scanners, ID enumeration — and then the real problem hit. It was DNS all along.