wordpress - Nginx "502 Bad Gateway" after I recover my vps from a former snapshot and relocate to anther IP -

as title, use nginx/hhvm/wordpress run blog. @ first, guessed there hard-coding in config files. have checked every config files, there no hard-coding @ all. happened?

i did check cpu , memory:

root@vultr:~# mcm              total       used       free     shared    buffers     cached mem:           993        853        140          4        405        118 -/+ buffers/cache:        330        663 swap:            0          0          0 --sort=-pcpu   pid %cpu   rss stime     time cmd 25179  0.6  3568 07:21 00:00:00 -bash 25160  0.5  4300 07:21 00:00:00 sshd: root@pts/4         1  0.0  1708 jul23 00:00:04 /sbin/init     2  0.0     0 jul23 00:00:00 [kthreadd]     3  0.0     0 jul23 00:00:01 [ksoftirqd/0] --sort=-rss   pid %cpu   rss stime     time cmd  1534  0.0 83552 jul23 00:20:27 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=mysql  2040  0.0 10768 jul23 00:07:52 /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf  2313  0.0  8048 jul23 00:18:51 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail   893  0.0  5836 jul23 00:00:19 rsyslogd 25091  0.0  4304 07:14 00:00:00 sshd: root@pts/3  

and nginx log:

root@vultr:~# tail /var/log/nginx/access.log.1 103.205.63.137 - - [16/aug/2017:07:07:40 +0000] "post /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 103.205.63.137 - - [16/aug/2017:07:07:41 +0000] "get /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 103.205.63.137 - - [16/aug/2017:07:07:41 +0000] "post /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 106.121.66.175 - - [16/aug/2017:07:10:36 +0000] "get /favicon.ico http/1.1" 502 172 "-" "mozilla/5.0 (x11; ubuntu; linux x86_64; rv:47.0) gecko/20100101 firefox/47.0" 180.191.111.155 - - [16/aug/2017:07:10:52 +0000] "post /xmlrpc.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 180.191.111.155 - - [16/aug/2017:07:10:53 +0000] "get /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 180.191.111.155 - - [16/aug/2017:07:10:53 +0000] "post /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 180.191.111.155 - - [16/aug/2017:07:10:53 +0000] "get /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 180.191.111.155 - - [16/aug/2017:07:10:53 +0000] "post /wp-login.php http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; wow64; rv:40.0) gecko/20100101 firefox/40.1" 176.31.64.186 - - [16/aug/2017:07:12:06 +0000] "get /2015/11/07/hello-world/ http/1.1" 502 172 "-" "mozilla/5.0 (windows nt 6.1; trident/7.0; rv:11.0) gecko"  root@vultr:~# tail /var/log/nginx/error.log.1 2017/08/16 07:07:40 [error] 3725#0: *38564 connect() failed (111: connection refused) while connecting upstream, client: 103.205.63.137, server: silent.computer, request: "post /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:07:41 [error] 3725#0: *38564 connect() failed (111: connection refused) while connecting upstream, client: 103.205.63.137, server: silent.computer, request: "get /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:07:41 [error] 3725#0: *38564 connect() failed (111: connection refused) while connecting upstream, client: 103.205.63.137, server: silent.computer, request: "post /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:10:36 [error] 3725#0: *38570 connect() failed (111: connection refused) while connecting upstream, client: 106.121.66.175, server: silent.computer, request: "get /favicon.ico http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "silent.computer" 2017/08/16 07:10:52 [error] 3725#0: *38572 connect() failed (111: connection refused) while connecting upstream, client: 180.191.111.155, server: silent.computer, request: "post /xmlrpc.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:10:53 [error] 3725#0: *38572 connect() failed (111: connection refused) while connecting upstream, client: 180.191.111.155, server: silent.computer, request: "get /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:10:53 [error] 3725#0: *38572 connect() failed (111: connection refused) while connecting upstream, client: 180.191.111.155, server: silent.computer, request: "post /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:10:53 [error] 3725#0: *38572 connect() failed (111: connection refused) while connecting upstream, client: 180.191.111.155, server: silent.computer, request: "get /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:10:53 [error] 3725#0: *38572 connect() failed (111: connection refused) while connecting upstream, client: 180.191.111.155, server: silent.computer, request: "post /wp-login.php http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "dominikasite.com" 2017/08/16 07:12:06 [error] 3725#0: *38578 connect() failed (111: connection refused) while connecting upstream, client: 176.31.64.186, server: silent.computer, request: "get /2015/11/07/hello-world/ http/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "silent.computer" 

am getting ddos attack? don't know dominikasite.com, , seems keeps trying login wordpress...