Do these first
- Write down the time and what you saw (high CPU, odd processes, new users, a flood of requests).
- Cut the attacker off: block the source IPs at your firewall or provider, and if the server is compromised, take it off the network or snapshot it first if your provider allows.
- Change SSH keys and passwords, and revoke API tokens and database passwords that were stored on the server.
- Do not restart or wipe yet if you need the logs; copy /var/log and the output of ps, ss and last to a safe place.
Then do these
- Look for new users, new SSH keys in authorized_keys, new cron jobs and systemd services, and changed files in web folders.
- Update the operating system and the application, then close ports you do not need.
- Restore from a clean backup if you cannot prove the server is clean, then re-apply the hardening.
- Turn on alerting so the next attempt is visible quickly.
What not to do
- Do not delete logs to "tidy up".
- Do not reuse the old SSH keys or passwords.
- Do not leave a compromised server attached to your internal network.
Where to report
If customer or financial data was involved, follow your legal and contractual duties and report cyber incidents at cybercrime.gov.in. Call 1930 for money fraud.
How Safeavio Sentinel can help
- ServerGuard agent for Linux: sends metrics, alerts and incidents to the console so unusual behaviour is visible; response actions need the agent to be online.
- The organisation workspace and the Enterprise XDR workspace show alerts, incidents and devices in one place.
- Safeavio helps you see and react; it does not promise to stop every attack, and a flood of traffic usually needs your network provider's help.
Questions people ask
Should I switch the server off?
If it is clearly compromised, isolating it from the network is safer than leaving it running. Take a snapshot first if you can, because a shutdown loses memory evidence.
Can Safeavio stop a DDoS attack?
No tool can promise that. A large flood needs help from your hosting or network provider. Safeavio can show the unusual traffic and alerts so you know it is happening.
This page is general information, not legal or financial advice. Use only the number printed on your card, passbook or the official app of your bank or company.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidHow to get startedWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
More: all recovery steps · safety guides · Safeavio compared with a traditional antivirus