Server affected by crypto mining

[lazybut]

Hello Team

I had used 3 times in 3 different servers but from each Server I got notice for crypto mining. What is this can someone tell me

[josephgodwinke]

Hello @lazybut

@josephgodwinke

If you don’t follow the template your topic may be deleted.

It is best practice to search the community for similar topics or issues. Use advanced search to get started - Search results for ‘’ - CyberPanel Community

Removing the cyrptominer malware is more tedious than reinstalling your server os. Rollback to an earlier snapshot or reinstall in a clean os

[lazybut]

[josephgodwinke]

@lazybut

I got notice for crypto mining

I thought you arleady identified the culprit and looking for mitigation ?

[lazybut]

what are you saying i was using cyberpanel and i got notice now website hosted on that
how could this possible

[josephgodwinke]

@josephgodwinke

It is best practice to search the community for similar topics or issues. Use advanced search to get started - Search results for ‘’ - CyberPanel Community

Look for posts like yours here. If its mitigation then the only solution is to do a fresh installation on a clean os. If its trying to identify the use htop and look for suspicious activity or processes

[lazybut]

@josephgodwinke

clean os. If its trying to identify the use htop and look for suspicious activity or processes

i had shared htop snap above please check

[josephgodwinke]

You installed but didnt run it . In ssh run htop wait until you see anything like p2pclient, some form of peer to peer client, docker containers you did not create, raven etc

[Dreamer]

@lazybut

please che

Re-install fresh cyperpanel DO NOT use default password. Also after install change panel default port and create new ssh user with sudo priviliges, then disable root login and ssh password login use only ssh keys.