Skip to content
Register

Deciphering this OVHcloud abuse complaint

General Discussion by priya 7 replies 465 views
priya

Member OP

🇮🇳 netops ninja

#1

Dear sir/madam,

Received abuse ticket from OVHcloud itself. I am hosting static site only, no proxy, no mail. Ticket states "malicious network activity originating from IP" and references "command and control communication patterns." Legal language heavy only.

Kindly help me understand what is this meaning. I have replied that my server is clean but they ask for "detailed remediation plan." I do not know what to plan for, sir.

Ticket attached below. Any guidance is appreciated.

Abuse ID: NW-2026-0218-7741
IP: 203.0.113.47
Type: Malware C2
Severity: High
Details: Continuous beaconing to known bad domains
detected by upstream monitoring. Pattern consistent
with Dridex-like behavior. RFC 2142 contact
non-responsive.
Action required: Remediation plan + 48h resolution
or nullroute.
RE

Member

#2

Less moving parts wins
Check who owns the IP

IC

Member

2 #3

Regards, I think you must make a server up with clean install first. But @priya look at IP history maybe? Previous owner can make problem, no?

I had similar with Hetzner, was IP before used for bad things. 😊

NUT

Member

Bangkok

#4

Previous owner C2 is a nightmare, check OVHcloud IP reputation first

gert0

Member

12 #5

SWEdish approach: check WHOIS history. FIKA first, panic later.

My hösting provider had same, IP was "clöud" before I got it. SERver clean but reputation dirty. Umlauts for emphasis önly.

uma

Member

99.99% or bust

#6

I monitor all my IPs with external probes—OVHcloud's status page (https://status.ovhcloud.com) showed 203.0.113.0/24 had a 23-minute nullroute on January 9th. Previous owner likely got burned and they reallocated fast.

Check your allocation date against the abuse date. If the abuse predates your service, the ticket is stale data. I've seen this with three providers now.

436 days. reboot is surrender.
emalite

Member

Lisbon

#7

I had the same stale ticket thing with OVHcloud last year

wilmaethqn44

Member

#8

Which IP and when did OVHcloud allocate it to you

frames, tables, still valid HTML

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft