Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DMIT VPS received an OpenAI abuse warning — recent widespread issue?

ugogougogo Member

I recently received a security/abuse warning from DMIT regarding one of my VPS instances.

The relevant part of the email says that DMIT Proactive Security detected a publicly accessible proxy or similar application with a serious security issue.

It further states that OpenAI identified activity originating from my service as unauthorized and prohibited, and claims that the detected service was:

“impersonating OpenAI’s infrastructure to steal OpenAI and Cloudflare resources”

DMIT asked me to remove the public proxy and related applications, stop any attempts to bypass or misuse authorization, and review the system for possible compromise.

The services I had running on the VPS were:

  • NextChat
  • New API
  • Caddy
  • Xray / VLESS Reality
  • x-ui

New API was used as an API gateway for several users who had their own OpenAI API keys. VLESS Reality was primarily used as a private proxy.

I have no evidence at this point that the VPS was compromised, and I did not intentionally deploy anything that impersonates OpenAI infrastructure.

I previously opened a ticket with DMIT asking what exactly was detected. Their response was fairly generic: they suggested checking whether proxy services or other applications were publicly exposed, whether there was any authorization bypass/forgery, and whether the system had been compromised. They also mentioned that configuration errors in certain protocols could potentially turn a VPS into a “free CDN”.

I’m therefore trying to determine whether this is an isolated configuration issue or part of a wider recent incident.

For DMIT customers, particularly LAX users:

  1. Has anyone received a similar OpenAI/Cloudflare abuse warning recently?
  2. Has anyone running New API/NewAPI received a similar report?
  3. Is there currently a known widespread abuse/security incident involving publicly exposed TCP 443 applications on DMIT?
  4. Does anyone know what DMIT means specifically by “impersonating OpenAI’s infrastructure”?
  5. Could this potentially be caused by an exposed application being scanned or exploited, rather than the customer intentionally abusing OpenAI?
  6. If you experienced something similar, how did you identify the actual cause?

I am not posting my VPS IP, domain, API keys, or any user information for security reasons.

I’m mainly trying to understand whether this is a known recent issue affecting multiple DMIT customers and what the actual technical cause was.

Any information from people who have encountered the same situation would be greatly appreciated.

Comments

  • ObelousObelous Member

    @ugogo said: I’m mainly trying to understand whether this is a known recent issue affecting multiple DMIT customers and what the actual technical cause was.

    It's not, this is obviously your fault.

  • FubukiFubuki Member

    who the fuck is "DMIT Proactive Security"?

  • forestforest Member
    edited 2:59AM

    @Fubuki said:
    who the fuck is "DMIT Proactive Security"?

    DMIT is a popular MJJ provider. I'm guessing "DMIT Proactive Security" is what they call their security system.

    Thanked by 3Fubuki rpqu q2019
  • reimuoaoreimuoao Member
    edited 3:35AM

    @ugogo said: Does anyone know what DMIT means specifically by “impersonating OpenAI’s infrastructure”?

    • Your Xray REALITY SNI is configured to a domain hosted on Cloudflare. Thus, anyone can use your VPS to relay traffic to any website hosted on Cloudflare's CDN. No Auth required.
    • OpenAI uses Cloudflare as its CDN.
    • Abusers/AI API proxy providers are exploiting your VPS to relay API requests to OpenAI. They do this to hide their actual source IPs in an effort to bypass OpenAI's anti-abuse system, as they most likely use stolen credit cards/SheerID identity etc. to cut capex.
    • From OpenAI's perspective, these abusive requests originate directly from your VPS.

    Solution: change your Xray REALITY SNI to a niche website domain that does not use any sort of CDN services, easy fix.

  • rpqurpqu Member

    LOL LMAO.

  • ccptwccptw Member

    Change your REALITY SNI/dest to a niche, self-hosted or non-CDN domain that doesn't route through Cloudflare.

Sign In or Register to comment.