All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
DMIT VPS received an OpenAI abuse warning — recent widespread issue?
I recently received a security/abuse warning from DMIT regarding one of my VPS instances.
The relevant part of the email says that DMIT Proactive Security detected a publicly accessible proxy or similar application with a serious security issue.
It further states that OpenAI identified activity originating from my service as unauthorized and prohibited, and claims that the detected service was:
“impersonating OpenAI’s infrastructure to steal OpenAI and Cloudflare resources”
DMIT asked me to remove the public proxy and related applications, stop any attempts to bypass or misuse authorization, and review the system for possible compromise.
The services I had running on the VPS were:
- NextChat
- New API
- Caddy
- Xray / VLESS Reality
- x-ui
New API was used as an API gateway for several users who had their own OpenAI API keys. VLESS Reality was primarily used as a private proxy.
I have no evidence at this point that the VPS was compromised, and I did not intentionally deploy anything that impersonates OpenAI infrastructure.
I previously opened a ticket with DMIT asking what exactly was detected. Their response was fairly generic: they suggested checking whether proxy services or other applications were publicly exposed, whether there was any authorization bypass/forgery, and whether the system had been compromised. They also mentioned that configuration errors in certain protocols could potentially turn a VPS into a “free CDN”.
I’m therefore trying to determine whether this is an isolated configuration issue or part of a wider recent incident.
For DMIT customers, particularly LAX users:
- Has anyone received a similar OpenAI/Cloudflare abuse warning recently?
- Has anyone running New API/NewAPI received a similar report?
- Is there currently a known widespread abuse/security incident involving publicly exposed TCP 443 applications on DMIT?
- Does anyone know what DMIT means specifically by “impersonating OpenAI’s infrastructure”?
- Could this potentially be caused by an exposed application being scanned or exploited, rather than the customer intentionally abusing OpenAI?
- If you experienced something similar, how did you identify the actual cause?
I am not posting my VPS IP, domain, API keys, or any user information for security reasons.
I’m mainly trying to understand whether this is a known recent issue affecting multiple DMIT customers and what the actual technical cause was.
Any information from people who have encountered the same situation would be greatly appreciated.
Comments
It's not, this is obviously your fault.
who the fuck is "DMIT Proactive Security"?
DMIT is a popular MJJ provider. I'm guessing "DMIT Proactive Security" is what they call their security system.
Solution: change your Xray REALITY SNI to a niche website domain that does not use any sort of CDN services, easy fix.
LOL LMAO.
Change your REALITY SNI/dest to a niche, self-hosted or non-CDN domain that doesn't route through Cloudflare.