Vicibox malicious or unwanted traffic

[iboam]

Hi i Got this message from my colocation service

Code: Select all

We have received information indicating that the following VPS is in violation of our Terms of Service/Acceptable Use Policies. Our reports indicate that this VPS is sending malicious or unwanted traffic as described below:

IP Address: 155.138.233.222

Event Description: The high ratio of SYN packets in the TCP traffic linked to your IP address indicates your instance is involved in a SYN flood DDoS type attack.

Event start: Sat, 28 Mar 2020 13:45:00 -0400
Event end: Sat, 28 Mar 2020 13:53:00 -0400
Targeted IPs: 104.31.83.188

If you are unable to correct the issue regarding this malicious traffic, the safest course of action is to destroy and re-deploy your VPS.

This instance has been stopped. Please correct the issue and notify us of the reason for this abuse and how it was corrected before restarting your instance.

Full text of our Terms of Service can be found at the following URLs:

Anyone with same issue on Vivibox 9.0.1 ??

[williamconley]

Likely got infected by a bot. Did you whitelist lockdown the server?

[iboam]

Do you have the steps to do it ???

[williamconley]

Instructions for previous versions: http://viciwiki.com/index.php/DGG

Note that installing DGG is not required. The whitelist instructions precede installation. So you can just stop after the whitelist is done. DGG isn't tested on Vicibox 9 yet (At least I don't think it has been, I haven't checked with that department, lol).