Hi, I just got an e-mail that my server has been ‘locked’ because a lot of abuse was coiming from it according to: https://www.abuseipdb.com/check/94.130.237.27 I can now and go and ‘whitelist’ one IP so I can contact the server again, to “solve the problem”. I don’t have a clue as where to start…

AbuseIPDB is only a report, did Hetzner block your access because of it? Their data is submitted, not collected, so could be poisoned by a bad actor? How do they accept anonymous complaints?

Hi, thanks for your ansewer. They did send me a mail before, with a log file (at the end): Dear Mr Lex Thoonen, We have received an abuse report from admin@markom.hu for your IP address 94.130.237.27. We are automatically forwarding this report on to you, for your information. You do not need to …

If you log into your Hetzner account, don’t you have access to some sort of terminal tool to get into your server? Some KVM/Console feature? This should by pass the ip address of your server entirely. Your server seems to have a bad actor/app trying to brute force some WP sites on other servers. …

[image] ID10T: That was the time to do something. Live and learn. along with [image] lex: OS is an old version of Ubuntu keeping up-to-date with everything is one of the primary jobs of running a server along with not spreading spam and such like owning an IP must be taken seriously. …

There is a way for me to log in, by whitelisting my own ip. How do i go about finding the compromised app/website quickly?

[image] lex: How do i go about finding the compromised app/website quickly? That I can’t really tell you. I’d check with the sites that seem to have the largest current log files or other activity.

[image] lex: How do i go about finding the compromised app/website quickly? In order, this is what I’d check: The Postfix mail log. This can be in a variety of locations depending on your OS, version, and configuration. /var/log/maillog, /var/log/mail.log, or journalctl -u postfix. There’s …

[image] Joe: You won’t see those changes unless you’re tracking stuff in git or something similar. Virtualmin WP Workbench plugin has an integrity check feature, so you don’t need to use Git to track it.

Thanks a lot people, you really got on me on the right track! And this was the first time I was able to use AI in a serious way too.

[image] lex: Thanks a lot people, you really got on me on the right track! And what was that track? Did you identify the root of the problem?

Virtualmin Community

Server locked because of abuse from my ip - where to start?

Help! (Home for newbies)