I have an account for the oracle free tier, and I’ve been using one of the hosts to only host a teamspeak server, nothing else. I had the server running for almost a year, with no issues, until I started getting emails about abuse warning with the following message:
Oracle has received notice of or detected unusual and potentially harmful activity originating from the indicated resource in your tenancy.
Traffic Details: Outbound Port Scanning, Brute-forcing, Web Exploitation, and/or DDoS
I unfortunately do not have a support subscription, so I am unable to log a ticket to inquire about it.
I’ve tried some of the basic security controls they suggest like making sure OS is up to date, disable password login, change ssh port. I also installed sshguard and fail2ban to help make sure my machine is more secure.
They have since disabled the host, but I am able to clone the boot volume and then make a new instance from that clone to still have my vm, but then it’s around a week or two until it gets disabled and I have to repeat this.
I have no idea where to start looking or what to do to address this issue? I would greatly appreciate if anyone has any advice or help on what I can do to resolve this.