Português
English
The short answer: our network provider watches the traffic. When it sees an attack coming from one of our servers, receives a complaint from someone else, or gets a report from a national incident response team (CERT), it sends us an abuse notice with an identifier, a log of what it saw and a short deadline, often one day, to fix it and reply. We forward it to you as a support ticket in Meu Interweb and ask you for a short report: the cause, what you removed and what you did so it does not happen again. This article is for VPS and dedicated server customers; the notices about websites (phishing, fraud) also apply to hosting plans.
Which notice you got, and where to read about it
| The notice is about | What it means | Where to read |
| Netscan (network scanning) | Your server opened many connections to a range of addresses, on the same ports, within minutes. | Your VPS is scanning other networks |
| DDoS from the server | A flood of traffic is leaving your server towards a target. | A DDoS attack coming from your server |
| Open Redis | Redis answers anyone on the internet and can be used in attacks. | Redis open to the internet |
| Open DNS resolver | The server answers DNS questions from anyone and helps amplify attacks. | An open DNS resolver |
| CLDAP, Portmapper (rpcbind) or another UDP service | An open UDP service used for reflection attacks. | UDP services open to the internet |
| MySQL, MariaDB or PostgreSQL reachable from outside | The database accepts connections from any address. | Databases reachable from the internet |
| Vulnerable n8n or a web application with critical flaws | A version with known flaws is exposed. | A vulnerable n8n or web application |
| Phishing | Pages imitating banks or delivery companies on your site, or phishing e-mails leaving the server. | Phishing pages on your site or server |
| Spam blacklist (Spamhaus, SpamCop) | The server IP was listed for sending spam. | Your server IP is on a spam blacklist |
| Botnet or command and control (C2) | The server is part of a network of machines controlled by someone else. | Botnet activity from your server |
| Fraudulent site | A complaint that a site on your account deceives people (fake investment, fake shop). | A fraud complaint about a site |
| You do not know where to start | The notice does not say the cause, only what was seen from outside. | Is my VPS compromised? |
What happens, from notice to reply
|
|
|
|
|
|
The times in the notice are in UTC
The log uses UTC; your server logs may be in another time zone. Before searching the log files, check the server time zone and the UTC time side by side: timedatectl
date -u If the clock is wrong, fix it first: setting the time zone and the clock on a VPS.
| Do not ignore the notice, or reply only “it is fixed”. Without the cause and what you did, we have nothing to send the provider, and the deadline passes anyway. Deleting the attack file without closing the way in is not enough either: the abuse comes back and the server is switched off again. |
| Reply early, even before you have everything. One line in the ticket saying what you have done and what is left helps us answer the provider in time. If you lost SSH access, say so in the ticket (I have lost SSH access). |
|
Got an abuse notice and cannot make sense of the log? Reply in the ticket itself and we will go through it with you line by line. Open a support ticket |
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from 321,75 MT/mo (3-year plan, with coupon) See plans |
