I am seeing for about 10 days now a bunch of EC2 machines (about 30, distributed in all regions) which are attacking a server of mine.
The interesting (or uninteresting, I do not know yet) fact is that
- they target an open web service on a non-descriptive port (which was probably found through an earlier scan)
- this port replies with a
200to a HTTP request
- the queries are only on the root of the URL ...
- ... which brings them an empty page
In other words, they are continuously doing a
GET / on that web service.
It could have been a DDoS, except that
- the number of machines is very limited and well defined
- there are 4 queries per minute, all of them neatly grouped (within ~5 seconds) around the middle of the minute
So this not a DoS (the rate is insignificant), not a DDoS (beside the rate, the population is small), not hacking attempts (the request is stubbornly on one URL, I looked at the traffic and this is the only port targeted).
I will classify it as "rich (many EC2 machines, they may also use the free tier) but dumb not-sure-what" if nobody has an idea about what this is.