Thanks for the reply here as the ticket remains unanswered. I have requested access through SFTP / reboot of the droplet in order to secure a few things. Initial contact mail was more then unclear to be frank.

We’re sorry for any confusion. Since this is a public forum we are limited in what we can share here but it does appear that our team opened a ticket related to this issue on your team account.

We are also seeing the ticket you opened which is on your personal account. The reason you were not seeing the ticket is because you were not viewing the team with your droplets.

When a DDoS is detected coming from your droplet this almost always means that your droplet has been compromised (except for the users who purposely launch attacks of course). Our team’s standard operating procedure is to shut down networking on any droplet launching such an attack in order to halt the attack and prevent saturation of the network from causing issues for users whose droplets are on the same physical hypervisor.

When you reach out our team will offer to boot your droplet to a recovery environment which will allow you to log into your droplet, view and modify your files or start up an SFTP service on your droplet to transfer anything needed out to a new clean server. When creating a replacement server (we don’t recommend trying to clean a compromised server if it can be avoided) we recommend following the steps outlined here to help ensure this does not recur:

https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04

The most common reason for a server to be compromised is using a less than ideal password. Instead we recommend using ssh-keys which are not vulnerable to brute force attacks in the same way a password is. If you must use a password based login we recommend installing fail2ban which can prevent brute force attacks by automatically blocking IP addresses after a set number of failed login attempts.