Attack report from my server?

hosting
1

Just received a warning email from the service provider(Hetzner).

We have indications that there was an attack from your server.
Please take all necessary measures to avoid this in the future and to solve the issue.

We also request that you send a short response to us. This response should contain information about how this could have happened and what you intend to do about it.
In the event that the following steps are not completed successfully, your server can be blocked at any time after the 2021-04-XX XX:XX:XX +0100.

Discourse cannot easily apply Cloudflare as a defense…

Can’t hide the real IP address of my server…

Often under attack. :sob:

2

This says attack from your server.

I would investigate for any software running on the server that should not be, as well as contacting your host and asking for details.

“An attack” is awfully vague and unactionable and could be nothing. Or it could be an indication your server is compromised.

Make sure you have backups.

7 Likes
3

If it has indeed been comprised, then the thing to do is spin up a new server and move to it. And if you’re not sure how to tell, then that’s not a bad idea

3 Likes