Contain the host

Containment protects other systems and users. Do it deliberately so you do not lose the only evidence or recovery path.

Once you believe the host is compromised, the job changes. You are no longer administering a server. You are limiting what it can do next.

Cut access from outside the host

Isolate the host from public traffic or detach it behind provider controls, revoke affected keys and tokens, and block known malicious paths. Prefer the provider’s firewall and console over commands on the machine itself. Do not trust the compromised host to prove it is clean, and do not trust it to isolate itself either. Provider firewall controls can isolate it without trusting commands run inside the suspect host.

Revocation also happens off the host: the deploy token in CI, the database password in the secret store, the API keys the server held in its environment. Anything the machine could read, treat as stolen.

Choose what to preserve

Decide which evidence is time-sensitive before powering down. Memory and active connections disappear, while continued operation may allow more harm, so the incident lead must choose deliberately. Snapshot where policy allows and keep an action timeline:

14:02 UTC  alert: outbound connections to 185.220.101.34 from blog user
14:09 UTC  provider firewall: inbound blocked except admin IP (flavio)
14:15 UTC  disk snapshot taken (id: snap-8842107)
14:21 UTC  deploy token revoked, DATABASE_URL password rotated
14:30 UTC  ss/ps/last captures copied to external storage

Every line has a time and an actor. Memory is unreliable during an incident, and the timeline is what lets you reconstruct decisions afterward — including for the people the incident affects.

Disconnecting the VPS stops public abuse but may also cut off volatile evidence and customer traffic. There is no free option here, only a chosen one.

Write and rehearse the containment order using a disposable VPS and provider-side controls. Prove public traffic stops, affected credentials fail from another machine, and the action timeline and evidence copy remain available.