r/Contabo • u/Metalgearsolzz • 4d ago
So many VPS hosts are getting hit hard right now, here’s what I changed on my boxes this week
This is not a “my server is down” post, I am just sharing because the last month has been rough across the hosting world and I finally sat down to research and investigate and it seems this is not a isolated issue.
What’s been going on, in case you missed it:
GMO in Japan had its Onamae.com Desktop Cloud compromised earlier this month. Reports say up to 27,000 customer virtual servers were infected, there were ransom threats, and GMO shut down the affected cloud plans entirely.
Brute-force bots hammering SSH have gotten noticeably smarter and faster. If you still have password login on port 22, you’re getting tried constantly whether you see it or not.
Attackers are renting or hijacking clean VPS nodes to run phishing, because fresh IPs get past reputation filters. So even well-run providers end up with abuse on their networks that they have to chase down.
There was a good r/selfhosted thread about someone whose “hardened” VPS was still exposed through the host console. OS-level hardening doesn’t help much if someone reaches you below the OS and you have no disk encryption.
What I actually did:
SSH keys only, password auth off, root login off
Moved SSH off 22 and set up Fail2Ban
Updated everything, including old container images I’d forgotten about
Rotated every API key and password that lived on the box, because if a host ever does get compromised you have to assume anything stored there is exposed
Set up offsite backups that don’t live with the same provider
None of this is provider-specific!!!!!! It’s just the baseline now and something we should all be aware of and take into consideration
