Recently on a cPanel/WHM server, all SSLs’ were replaced with self-signed certificates issued by DDoS-Filter.domain
This is an indicator of DDoS protection (mitigation) that was triggered either by a large number of connections to the server/data center or manually by the hosting provider (switching from “Sensor” to “Permanent” mode).
DDoS mitigation has 2 modes:
- Permanent: traffic toward IP is always filtered
- Sensor: the protection is inactive until an attack is detected and mitigation starts
If you notice this SSL contact your hosting provider immediately.
