my server is attacked by vps

Question

[15/03/2013 06:20:27] IP:198.211.121.169[15/03/2013 06:20:27] IP:198.211.104.108[15/03/2013 06:20:27] IP:198.211.100.115[15/03/2013 06:20:27] IP:198.211.121.244[15/03/2013 06:20:45] IP:198.211.121.236[15/03/2013 06:20:45] IP:198.211.120.123[15/03/2013 06:22:05] IP:192.81.215.124[15/03/2013 06:22:05] IP:198.211.120.70[15/03/2013 06:22:05] IP:198.211.124.48[15/03/2013 06:22:05] IP:198.211.126.208

lesander · Answer

Hey there Kamal,
I’ve forwarded you the email I sent on the 30th of November.
(email: alex at gingerserver dot com)

Thanks in advance.

Kamal Nasser · Answer

@lesander : what email did you send the report from? You can email it to me kamal at digitalocean dot com.

lesander · Answer

Still no reply… And the attack is still going on.

lesander · Answer

Hello there Kamal,
I’ve already sent an email to abuse@digitalocean .com five days ago.
No reply yet.

Kamal Nasser · Answer

Please send an email to abuse@digitalocean .com

rvs · Answer

2013-12-02 16:06:00 1VnYoh-00024O-Ib <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:59707 P=esmtp S=3604 id=06250510b553e1a196fa6051e20f2d2d@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 16:15:24 1VnYxn-0002pX-BO <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:37723 P=esmtp S=3611 id=a68c13211a6f3940b0f67069fca422a5@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 16:16:26 1VnYyn-0002vC-V5 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:38644 P=esmtp S=3611 id=62b33ce8cc2ae5012d64942c4ed1163f@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 16:36:26 1VnZIA-0004Jg-2j <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:54698 P=esmtp S=3648 id=4ac13eacf4eac8abfd00d77196d2b43c@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 16:44:45 1VnZQC-0004qI-My <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:34470 P=esmtp S=3648 id=31cea83a9501f6d722c9ca4e6627051f@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 16:46:58 1VnZSM-0004y2-Bj <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:36496 P=esmtp S=3620 id=e736bc23e265a5bd944c0c59244c74fe@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 17:00:40 1VnZfc-0005op-0U <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:47797 P=esmtp S=3623 id=9aa19d28aa59cb75396f3b7e6bac7739@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-02 17:15:04 1VnZtY-0006gy-9T <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:56688 P=esmtp S=3644 id=706912421dd408002a461fa865940b2c@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 07:05:02 1Vnmqk-00008p-8b <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:46567 P=esmtp S=3512 id=e48c8b40c4e40554aceadae7115b059e@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:06:05 1Vnmrl-00009c-0h <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:47558 P=esmtp S=3524 id=9afe30da6ec3a0e97b8d5a276b488b60@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:13:18 1Vnmyk-0000Ew-3O <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:54252 P=esmtp S=3493 id=2e46815e29e1e45168f4b9d2b11f5b1d@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:16:21 1Vnn1g-0000Hs-OT <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:57202 P=esmtp S=3533 id=834d2d40f1ba57dd76e235cd87972774@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:34:07 1VnnIt-0000Wp-40 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:45511 P=esmtp S=3481 id=5bd84edd50dd84c1839f21e1d3a362e1@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:34:08 1VnnIt-0000Wx-HW <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:45527 P=esmtp S=3485 id=bfbd0c9bc151392280ac2f7186a00527@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:37:01 1VnnLg-0000ai-FD <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:48615 P=esmtp S=3489 id=5137e45946ddf70d3038356c20cb699b@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:41:22 1VnnPu-0000el-70 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:53243 P=esmtp S=3517 id=c82656806b07840143eb69118121ccf6@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:50:38 1VnnYs-0000od-37 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:33326 P=esmtp S=3501 id=9d7cda5976dda701bbe41c3bcfd7c7c4@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 07:55:49 1Vnndt-0000u7-1y <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:37928 P=esmtp S=3505 id=69d34bc9a3277b2dc70644c7e23924da@fidelizandote .com T=“Recursos Humanos Software”
2013-12-03 09:06:40 1VnokR-0003AD-KP <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:42959 P=esmtp S=3575 id=3d5078b4757ba48f4dfe6f81dc210450@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 09:06:43 1VnokU-0003B1-IL <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:43009 P=esmtp S=3571 id=9d37e79ee4eca96e6ea202246bfed42f@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 09:10:09 1Vnonp-0003VI-FO <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:46093 P=esmtp S=3579 id=216b769837743ceea1ac8e14f298f227@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 09:22:50 1Vnp06-0004Cj-7q <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:54394 P=esmtp S=3607 id=93e0ea030e2c71bd0df6608ed8ee1086@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 09:29:02 1Vnp66-0004VY-6C <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:59879 P=esmtp S=3597 id=35f8dde03cb83c55b8c4e43378f9f305@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 09:31:03 1Vnp83-0004f8-1g <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:33230 P=esmtp S=3601 id=32d247cf69e0df630249ee344909bdc2@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:22:01 1VnpvM-0008GQ-T2 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:59206 P=esmtp S=3605 id=e9371ac21bf862b35df7a5cb9fce5322@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:23:50 1Vnpx7-0008Mp-Vt <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:60824 P=esmtp S=3609 id=4c133295a1e849d463c9f27da57edfaa@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:29:33 1Vnq2e-0000Du-OH <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:37468 P=esmtp S=3606 id=c56cf5d8a0eb53a7c4c910fd4db5aa9c@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:35:26 1Vnq8L-0000Z4-TD <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:41665 P=esmtp S=3614 id=9de4b2e8c6b2ed0d19292d86bf75c3fd@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:45:37 1VnqIC-0001Kc-Nq <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:47271 P=esmtp S=3613 id=68c8e60369e80517d416336b95b8c0d6@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 10:55:30 1VnqRl-0001vg-Rn <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:56156 P=esmtp S=3650 id=60c52eca89fee138cae785f98e4323cb@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 11:13:16 1Vnqix-00036J-Do <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:40853 P=esmtp S=3649 id=5f6ce50f78a0675be0758e0d44e7f822@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 11:15:09 1Vnqkm-0003D4-Ge <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:42660 P=esmtp S=3622 id=94f4f2fd2e0511fe173fd2668e8cef6a@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 11:31:46 1Vnr0r-0004Cm-E9 <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:54600 P=esmtp S=3626 id=0662545f99552cb9faf8e5e5ca43fa0f@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-03 11:43:55 1VnrCc-000565-Ez <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:33873 P=esmtp S=3645 id=b9dc3b091d943848c860e8a5e25c6d3d@fidelizandote .com T=“=?UTF-8?B?Q2FtcGHDsWEgVmVyYW5vIERlcm1vZXN0w6l0aWNhIENsw61uaWNhIExvIEN1cnJv?=”
2013-12-04 10:39:27 1VoCfm-0006is-DO <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:54638 P=esmtp S=3587 id=d8e7c6b66ee928c152911e675a5102c2@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 10:40:21 1VoCge-0006m3-IK <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:55467 P=esmtp S=3593 id=77a0200e813ecfeb541c3d143a5a80c8@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 10:41:03 1VoChK-0006oW-RX <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:56127 P=esmtp S=3602 id=96436c16d069455361e0b641e0344df2@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 10:46:22 1VoCmT-000741-OF <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:60743 P=esmtp S=3582 id=3b1db9bde277a492b24d76a1e0984e47@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 10:49:02 1VoCp3-0007C5-2b <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:35038 P=esmtp S=3612 id=848f5bf6af899385b34b3b366695eba8@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 11:01:08 1VoD0l-00086j-Ln <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:45689 P=esmtp S=3573 id=ad1996867a248c6b63cbe386babba8b5@fidelizandote .com T=“Contrate con los Mejores”
2013-12-04 11:05:41 1VoD5A-0008P8-Au <= rebotes@fidelizandote .com H=mail.fidelizandote.com [198.199.108.206]:49048 P=esmtp S=3579 id=bbdc32aa306b0b55b77965648f52cd46@fidelizandote .com T=“Contrate con los Mejores”

lesander · Answer

I’ve sent an email to abuse@digitalocean .com. Thanks in advance.

lesander · Answer

My server also seems to be attacked by your VPS service.
For over three days now, our server is having lag issues due to this attack/port scanning.

2013-11-30 09:20:12 [INFO] /162.243.69.93:43590 lost connection
2013-11-30 09:21:16 [INFO] /162.243.69.93:43803 lost connection
2013-11-30 09:22:19 [INFO] /162.243.69.93:44040 lost connection
2013-11-30 09:23:22 [INFO] /162.243.69.93:44244 lost connection
2013-11-30 09:51:27 [INFO] /162.243.69.93:48949 lost connection
2013-11-30 09:52:29 [INFO] /162.243.69.93:49141 lost connection
2013-11-30 09:53:32 [INFO] /162.243.69.93:49372 lost connection
2013-11-30 09:54:43 [INFO] /162.243.69.93:49543 lost connection
2013-11-30 09:55:45 [INFO] /162.243.69.93:49731 lost connection
2013-11-30 09:56:48 [INFO] /162.243.69.93:49900 lost connection
2013-11-30 09:57:50 [INFO] /162.243.69.93:50086 lost connection

Moisey Uretsky · Answer

Thanks for the notification and we have terminated the abusive customer in the future please email abuse@digitalocean .com with any abuse complaints that may occur.

Question

my server is attacked by vps