> Устройств на базе linux ядра подключенных к сети в разы больше чем виндовых.

да, и с этим давно все ок:

Jun 15 04:00:00 gw newsyslog[57394]: logfile turned over due to size>1024K
Jun 15 04:00:02 gw sshd[57407]: Invalid user ayoub from 134.122.111.243
Jun 15 04:00:02 gw sshd[57407]: input_userauth_request: invalid user ayoub [preauth]
Jun 15 04:00:02 gw sshd[57407]: Received disconnect from 134.122.111.243: 11: Normal Shutdown, Thank you for playing [preauth]
Jun 15 04:00:09 gw sshd[57409]: Invalid user bbbbb from 134.122.111.243
Jun 15 04:00:09 gw sshd[57409]: input_userauth_request: invalid user bbbbb [preauth]
Jun 15 04:00:09 gw sshd[57409]: Received disconnect from 134.122.111.243: 11: Normal Shutdown, Thank you for playing [preauth]
Jun 15 04:00:16 gw sshd[57412]: Invalid user tnsr from 134.122.111.243
Jun 15 04:00:16 gw sshd[57412]: input_userauth_request: invalid user tnsr [preauth]

Ну и в веб-логах:

185.10.17.158 - - [23/Apr/2021:06:50:59 +0300] "GET /.env HTTP/1.1" 404 571 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" http
185.10.17.158 - - [23/Apr/2021:06:50:59 +0300] "POST / HTTP/1.1" 405 575 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" http
185.10.17.158 - - [23/Apr/2021:06:51:00 +0300] "POST / HTTP/1.1" 405 575 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" http
35.198.195.1 - - [23/Apr/2021:07:10:04 +0300] "GET /wp-login.php HTTP/1.1" 404 169 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" http

Винду, небось, ищет, с разрешенным post /....ой, нет "это другое".