Possibly Compromised VPS

[hakkuo23]

So I just got rate-limited since my VPS was attacking various IPs. How can I check if my server is compromised or what script was launching attacks like that?

Thanks!

[Edge100x]

This would be your best starting point: http://www.nfoservers.com/forums/viewto ... =46&t=5059

[hakkuo23]

I did follow the guide but after reinstalling Gentoo it's happening again. It's probably something with my software but I don't know how to investigate this. What should I do?

[Edge100x]

Logs will usually show you the unusual behavior (Apache logs, for instance, or system logs). If you look through your server's files, you will also usually find the bot being run, such as in the webroot or /tmp or /var/tmp.