Recently on a cPanel/WHM server, all SSLs’ were replaced with self-signed certificates issued by DDoS-Filter.domain
![DDoS-Filter.domain DDoS-Filter.domain](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/12/image-1.png?resize=496%2C588&ssl=1)
This is an indicator of DDoS protection (mitigation) that was triggered either by a large number of connections to the server/data center or manually by the hosting provider (switching from “Sensor” to “Permanent” mode).
DDoS mitigation has 2 modes:
- Permanent: traffic toward IP is always filtered
- Sensor: the protection is inactive until an attack is detected and mitigation starts
If you notice this SSL contact your hosting provider immediately.