Use TLS SNI to hide your servers (incl. Citrix) from IP-based mass exploitation

If applicable you could even use wildcard certificates to avoid having your subdomains domains showing in CT logs.

My personal project web server has done this for years with just some basic nginx configuration.

You only find my webpage if the SNI contains the host name. If you connect using the bare IP, it presents a self-signed certificate. If you accept it, it just returns a bare 404 Not Found.

> Your NetScaler talks to strangers

talk to your servers about stranger danger.