2

I'm asking about an error I've got a few times in the past day, outside of the theoretical. I'm wondering what may be actually happening in my case.

The error comes from Sentry, on my ubuntu/nginx/uwsgi/Django via AWS Elastic Beanstalk stack:

Invalid HTTP_HOST header: '54.149.10.254'. You may need to add u'54.149.10.254' to ALLOWED_HOSTS. Exception while resolving variable 'exception_type' in template 'unknown'.

54.149.10.254 is associated with scan-15.shadowserver.org. ALLOWED_HOSTS is there to prevent the HTTP host header attacks.

Should I be concerned? What is going on here in concrete terms?

Thanks

4

Should I be concerned?

Not particularly. You're being scanned by a known non-malicious party called Shadowserver. They're very open about their activities and intent.

Bear in mind that on the Internet you're going to get scanned. A lot. By many people who are outright malicious. While some may have legitimate concerns about 'scan vigilantes' like Shadowserver, Shadowserver is certainly more benign than a lot of other traffic you can expect to receive.

What is going on here in concrete terms?

They are connecting to your web server and sending a request using an invalid Host: header - one that doesn't match your actual site, but actually matches their IP. There are a variety of ways the host header can be abused; Shadowserver is looking for vulnerable IPs. Given their mission statement, they're probably looking for web servers that can be tricked into sending or redirecting traffic to [the IP they used in the Host: header], which would indicate that those web servers can be abused in an amplification attack.

The fact that your server reports Invalid HTTP_HOST header leads me to believe it correctly rejects connections which don't contain a valid Host: header for your site. Good job.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.