Server cut off for abuse: what to do

You have just received an email: one of your servers has been cut off for abusive activity. Don't panic: nothing is deleted automatically. This guide explains what happened, what is kept, how to check whether your server has been hacked and how to reply to us to bring it back into service.

Why your server was cut off

An automatic system watches the traffic leaving each VPS. It only reads its metadata — destination addresses and ports, volumes, rates — and never the content of your exchanges or of your files. Your server was cut off, without notice, because it did one of these things:

• probing hundreds of addresses looking for open ports (scanning);
• sending a massive flood of packets to a single target (denial of service);
• trying passwords on many other servers (brute force);
• connecting to a cryptocurrency mining pool;
• trying to send mass email through port 25, which is blocked.

The email says which one. The cut-off is immediate because every minute of attack damages the reputation of our addresses and can take down the service for all our customers. The activity does not necessarily come from you: a password that is too simple or an application that is not up to date is enough for someone else to make use of the server.

What is kept

• its IP address and its disk are kept, and the data on it stays in place during the cut-off;
• nothing is deleted automatically, however long it takes;
• the server is stopped and no longer billed to you during the cut-off; its snapshots, if it has any, are still billed for as long as they exist;
• your other servers keep running normally.

In the console, the server shows as cut off and cannot be restarted on your side: only our team lifts a cut-off for abuse.

Reply to us within 72 hours

Simply reply to the email you received, or write to us from the Support menu of the console. You have 72 hours to do so; after that, we decide what happens next without your reply. Tell us:

• what was running on the server (website, application, tools);
• whether you recognise the activity observed, or think it is a mistake;
• what you intend to do: check and clean the server, or delete it.

If you think it is a mistake, say so: legitimate use being misread does happen; we review your reply and lift the cut-off if it is justified.

Check whether your server has been hacked

If, after reviewing your reply, we lift the cut-off, the server restarts as it was. Before putting it back in front of your visitors, go through these checks, over SSH or, if it no longer responds, from the Rescue console on the server's page:

# Last logins to the server
last -n 20

# Open network connections and the programs behind them
sudo ss -tunp

# Programs using the most processor time
ps aux --sort=-%cpu | head -n 15

# Scheduled tasks, for root and for users
sudo ls /etc/cron.d /var/spool/cron/crontabs

# Authorised SSH keys
cat ~/.ssh/authorized_keys

A login from an address you do not know, an oddly named program hogging the processor, a scheduled task or an SSH key you did not add: the server has been hacked.

In that case, the safest path is to start again from a clean machine: order a new server, apply the protections from the guide Secure your Linux VPS, copy your data onto it (not the programs), then delete the old one. Failing that, change every password, remove unknown keys, and update the system and your applications.

What happens next

Once the cut-off is lifted, the server goes back to normal, and so does its billing. A new cut-off for abuse within 90 days of the lifting leads to the suspension of your account: access to the console is blocked and your other VPS are cut off in the same way. In the event of a repeat offence or a serious breach, the account can be terminated after formal notice, as provided for in the terms and conditions.

And on a dedicated server?

We do not monitor the traffic of a dedicated server: it is complaints from our supplier that alert us. We forward them to you, and a well-founded complaint can lead to the server's network being cut off. The current month remains due during the cut-off. The steps are the same: check, reply to us, fix.