Scale up as you grow — whether you're running one virtual machine or ten thousand.

From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.

I created a droplet (OpenVPN 2.8.5 from the marketplace) and after just 2 days I received a message from DigitalOcean that my droplet has been under Bruteforce attack. Surely enough the root password was changed and I had to reset it from the control panel to be able to log in again. After logging in again I see there are suspicious network activity going on to some IP addresses from Japan and other countries. I could not trace down the process ID of these network activities… they all show up as ? in the NetHogs output.
What can/should I do? and if I delete this droplet and create a new one hot to prevent the same scenario from happening again?
NetHogs version 0.8.5-2
PID USER PROGRAM DEV SENT RECEIVED 2100 root sshd: root@pts/1 eth0 0.627 0.087 KB/sec ? root 206.189.60.55:1433-165.3.89.71:50204 0.011 0.022 KB/sec ? root 206.189.60.55:3389-203.137.122.16:54203 0.011 0.022 KB/sec ? root 206.189.60.55:9201-165.227.10.12:42091 0.011 0.011 KB/sec ? root 206.189.60.55:445-144.22.108.247:62540 0.000 0.000 KB/sec ? root 206.189.60.55:13197-202.152.1.89:42052 0.000 0.000 KB/sec ? root 206.189.60.55:23-201.94.227.212:44234 0.000 0.000 KB/sec ? root 206.189.60.55:15448-195.54.161.151:44988 0.000 0.000 KB/sec
? root unknown TCP 0.000 0.000 KB/sec
TOTAL 0.659 0.143 KB/sec
2528527458a540fba5c38cc921bb27
c21c0b00bb284130a0d0cd3b7bdab4
IsaacMvd
Leon Junior
hashembarret@gmail.com
JetForMe
24608ead89f046a8abab394f968f2c
Philipp Mayerhofer
enews
Brian Magnosi
jairunet