Droplet locked due to DDoS attack from my Droplet

We’re sorry for any confusion. Since this is a public forum we are limited in what we can share here but it does appear that our team opened a ticket related to this issue on your team account.

We are also seeing the ticket you opened which is on your personal account. The reason you were not seeing the ticket is because you were not viewing the team with your droplets.

When a DDoS is detected coming from your droplet this almost always means that your droplet has been compromised (except for the users who purposely launch attacks of course). Our team’s standard operating procedure is to shut down networking on any droplet launching such an attack in order to halt the attack and prevent saturation of the network from causing issues for users whose droplets are on the same physical hypervisor.

When you reach out our team will offer to boot your droplet to a recovery environment which will allow you to log into your droplet, view and modify your files or start up an SFTP service on your droplet to transfer anything needed out to a new clean server. When creating a replacement server (we don’t recommend trying to clean a compromised server if it can be avoided) we recommend following the steps outlined here to help ensure this does not recur:

https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04

The most common reason for a server to be compromised is using a less than ideal password. Instead we recommend using ssh-keys which are not vulnerable to brute force attacks in the same way a password is. If you must use a password based login we recommend installing fail2ban which can prevent brute force attacks by automatically blocking IP addresses after a set number of failed login attempts.

Thanks for the reply here as the ticket remains unanswered. I have requested access through SFTP / reboot of the droplet in order to secure a few things. Initial contact mail was more then unclear to be frank.

I’m a current customer. Digital Ocean’s response to DDOS attacks is unacceptable. They will take your network offline and disable network traffic without sending you ANY notifications whatsoever. Then you will have to file support tickets and tell them what is wrong, just to have to wait over an hour for them to say “Oh yeah, you were right, you were DDOS’d and we took you offline, sorry about that”. Total nonsense. I’m definitely NEVER using Digital Ocean again and cannot recommend them at all. Not only did I not receive a notification of network traffic disabled, this cost thousands of dollars in losses.