Hi, To address the issue of your compromised IP address, we need to take the following steps:
Identify the source of the attack:
- Check system logs: Carefully review system logs (firewall logs, server logs, etc.) to look for unusual activity or signs of unauthorized access. These signs may include multiple failed login attempts, access from unfamiliar IP addresses, or unusual requests to resources on your system.
- Analyze network traffic: Use network traffic analysis tools (such as Wireshark) to examine network packets. Look for suspicious traffic patterns, such as connections to unknown servers, packets with malicious content, or other unusual activity.
- Scan the system for malware: Perform a full scan of your entire system (computer, server, network-connected devices) using reputable antivirus and anti-malware software. This will help you detect and remove any malware that may have been installed on your system during the attack.
Improve security to prevent future attacks
- Hardening server
- Config firewall, antivirus
- Config log and backup
- ....
Best regard!