By bromokun
Dear guys,
I have a droplet which I use as an email server. Applications that I installed there are:
- iRedmail,
- Phplist,
- MySql,
- Apache httpd
I had been using it for 3 months already, and suddenly I got a ticket from digitalocean support which shows that my droplet has been performing brute force attack against another server’s SSH …
My questions:
- How can I find out that my server does this things?
- How can I clean my server that might already invested by a BOTNET?
Thanks in advance, Bromo
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Start building today
From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.
