DEV Community

Daniel Ioni
Daniel Ioni

Posted on

🛡️ MyZubster DDoS Attack Response Guide

#myzubster #ddos #response #guide

🛡️ MyZubster DDoS Attack Response Guide

How we handled a DDoS/brute-force attack on our VPS and are working with our provider to restore services.
🌱 The Situation

On July 26, 2026, the MyZubster VPS became unreachable via SSH. After investigation, we identified:

SSH connection timeouts – The server stopped responding to SSH requests

Suspicious traffic patterns – Indicative of a DDoS attack or brute-force attempt

UFW firewall blocking legitimate access – The security measures we implemented to protect the server were triggered
Enter fullscreen mode Exit fullscreen mode

🔍 What We Found
Symptom Likely Cause
SSH timeout Server overloaded by attack traffic or UFW blocking IPs
High CPU load (suspected) Processing too many malicious requests
Auth logs full of failed attempts Brute-force attack on SSH port 22
API endpoints unreachable Gateway and Marketplace ports also affected
🛡️ Our Response
1️⃣ Immediate Actions Taken

Before the attack, we had implemented:

JWT Authentication – APIs protected with token-based auth

Rate Limiting – Max 100 requests per 15 minutes

UFW Firewall – Only allowing SSH, API access from specific IPs

Security Bot – Automated scanning with DeepSeek AI

Fail2ban (pending installation) – To block repeated attackers
Enter fullscreen mode Exit fullscreen mode

2️⃣ Waiting for Provider Support

Since we cannot access the VPS via SSH, we are working with our hosting provider's support team to:

Verify the attack – Confirm if it's a DDoS or brute-force attempt

Restore SSH access – Via KVM/iDRAC console

Apply DDoS mitigation – Using the provider's infrastructure protection

Analyze logs – To identify the source of the attack
Enter fullscreen mode Exit fullscreen mode

📋 What We Asked Our Provider

Ticket Subject: Suspected DDoS/Brute-Force Attack on VPS

Message:

"Our VPS is experiencing a possible DDoS attack or brute-force attempts on SSH port 22.

Symptoms:

    SSH connection timeouts

    Server unresponsive from multiple IPs

Request:

    Verify incoming traffic on the VPS

    Apply DDoS mitigation measures (if available)

    Assist in restoring SSH access

We are available to provide further details."
Enter fullscreen mode Exit fullscreen mode

🔧 Recovery Plan (Once Access is Restored)
Step 1: Disable UFW via KVM Console
bash

From provider KVM/iDRAC console

sudo ufw disable
sudo ufw status # Should show: Status: inactive

Step 2: Allow SSH Temporarily
bash

sudo ufw allow 22/tcp
sudo systemctl restart ssh

Step 3: Identify Your New Public IP
bash

From your local machine

curl ifconfig.me

OR visit: https://whatismyip.com

Step 4: Reconnect via SSH
bash

ssh root@your-vps-ip

Step 5: Update UFW Rules with Your New IP
bash

On the VPS (after SSH reconnection)

sudo ufw delete allow 22/tcp
sudo ufw allow from YOUR_NEW_IP to any port 22
sudo ufw allow from YOUR_NEW_IP to any port 3001
sudo ufw allow from YOUR_NEW_IP to any port 4000
sudo ufw enable
sudo ufw status verbose

Step 6: Install Fail2ban for Permanent Protection
bash

sudo apt update
sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Configure SSH protection

sudo nano /etc/fail2ban/jail.local

Ensure this section is enabled:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

Step 7: Change SSH Port (Recommended)
bash

sudo nano /etc/ssh/sshd_config

Change Port 22 to Port 2222

Port 2222

sudo systemctl restart ssh

Update UFW

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp
sudo ufw enable

🛡️ Long-Term DDoS Protection Strategy
Measure Status Description
UFW Firewall ✅ Active Restrict access to specific IPs
JWT Authentication ✅ Active Protect API endpoints
Rate Limiting ✅ Active Prevent abuse
Security Bot ✅ Active Automated threat detection
Fail2ban ⏳ Pending Automatic IP banning
Provider W

Top comments (0)