So I wake up to this abuse notice saying my $3/mo RackNerd VPS DDoSed some IP in Germany lol. I dont even know how to read these logs they attached. Is this common? Should I just trash the server and start over?
Understanding this network abuse notice
A compromised WordPress will cost you your account. Check your access logs for POST requests to wp-admin from IPs that aren't yours. Happened to me in 2024. Provider was CloudCone. Dropped me in 6 hours.
Hey folks, jumping in to keep this on track. @readerkrakw, don't trash the server yet, that's actually destruction of evidence if the target pursues anything. Can you paste the first 20 lines of your auth.log and any recent web access logs? We'll walk through this. 🙂
~be kind or be gone~
tomchan
Member
Here's what you want to grep for:
grep "POST /wp-login.php" /var/log/apache2/access.log | tail -n 50It actually works every time. Outdated plugin, guaranteed.
works on my bench ¯\_(ツ)_/¯
frankfurt_ops
Member
Please to note the Timestamp of the alleged Incident in the Abuse Notice. Please to compare with your own System Clock. The German Data Protection Law requires precise Documentation. I have seen many false Positives from automated Abuse Reporting Systems. Please to check if the IP Address belongs to your Server or to a previous Customer of the IP Block. Best Regards, Klaus Mueller, 2026-03-12T14:33:07Z
The $3 plan from RackNerd? Definitely compromised plugin. Seen it a lot. They dont patch nothing. Save your data nuke it. Get a $2 GreenCloudVPS instead. Im on my 4th abuse ticket this year. Lol.