How to Detect VPS Abuse: Crypto Mining, Spam, and Bad Bots

[johny899]

Have you ever gone to check your VPS and thought, “What on earth is going on with my server?” Yes, I’ve been there, many times, and in most cases, the answer is simple: abuse of your VPS. Let’s discuss how to detect VPS abuse before it affects you in a significant way.

What is VPS Abuse?​

There are three common ways that you can have abuse of your VPS: crypto mining, spam and bad bots. All three slow your server down, abuse your resources, or may even get your IP address blocked.

Crypto Mining​

Hackers *love* copying the mining to your bill and not theirs! Annoying, right? Here’s what you should look for to make the determination:

• CPU stays extremely high
• Load jumps +0.5 at nonsensical intervals
• Weird or random process running using excessive power.

My usual check is to look at top or htop. Once I see a weird process, that is using an unnecessary amount of CPU, I know it's time to take action.

Spam Attacks​

If someone is using your VPS to disseminate spam emails, your IP address will be blacklisted quickly. I have been through this once, and it was an unfortunate event. You can check for issues:

• Mail queue is growing.
• Emails you did not send.
• Mail logs containing errors.

When I had “failed delivery” messages rolling through in all of my logs, I suspected a spam script was running.

Bad Bots​

Bad bots encompass scrapers, scanners, and bruteforce tools.

You can determine bad bot issues when:

• Start getting large spikes in network traffic.
• Logs fill with odd user agents.
• Requests are continuous and pro-longed on your server.

I always think to myself, "Why do bots like to attack my server?" Your guess is as good as mine.

Simple Ways to Identify Abuse​

Here are some easy checks that always help me:

• Monitor CPU and RAM

If they are consistently high, consider something isn’t right.

• Look for network traffic

Too much outgoing traffic could mean spam or bots.

• Review logs

Logs always tell the truth.

• Look into things like:

• Netdata (live server stats)
• Fail2Ban (blocks bad logins)
• ClamAV (malware checker)

Things like these have saved me countless times.

Why This Is Important​

If you ignore VPS abuse, expect:

• Large bills
• IP blacklisting
• Security issues
• Slow servers

None of these things are good.