Hackers and Attackers

Hi @stephenwitheywrightSquid,

The IP 50.108.193.47 doesn’t seem to be one of DigitalOcean’s ranges. Additionally personnel from DigitalOcean will not access your droplet.

As to the methods they’ve used, firstly, confirm what methods of authentication you have. DigitalOcean’s droplets come with enabled only PublicKey authentication however if you’ve enabled your password authentication as well, most likely that was the way they access your droplet.

Additionally, it’s possible the attackers used an exploit on one of your service .

Now, there is no way to know the exact damage they have caused so I’ll recommend the following :

• If you have a backup of the droplet, revert to it and update everything. If you have any outdated service like PHP,Nginx,MySQL and so on, update them to the latest one.

• If you don’t have a backup, you’ll need to built a new droplet. There is no other way around it. Having said that before you put your website/application on your new droplet, make sure to check your website if anything has been put there as a backdoor. Once you are sure there hasn’t you can go ahead and migrate it to your new droplet.

As to check how was your droplet accessed, you can search your /var/log/messages and /var/log/secure. The information is contained there. Unless it has been removed by the people that got access to your droplet.

Regards, KDSys

Hi there,

You can install malware detection software like Linux Malware Detect, also known as Maldet or LMD. It will help you to locate any malicious files on your droplet.

If you’re interested in securing your droplet (everyone should be in general) you can double-check our tutorial - An Introduction to Securing your Linux VPS.

The article will cover the basic and some more advanced steps in website and server security.

You can check the article here:

https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps

Hope that this helps!