As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name with anyone.

If you are not familiar with it the DNS name for EBS is something like this:

{environment-name}.{random 10 character string}.{region}.elasticbeanstalk.com

I have a couple of theories:

  1. There's a script out there guessing the dns name of the application I think that's relatively hard given there is a 10 character random string in the dns name(I assume it’s random) plus the environment name.

  2. There is a script out there keeping a record of some AWS owned IPs and regularly scanning every port.
    Note: I am not using 80 or any other common port.

  3. You can somehow query elasticbeanstalk.com DNS record and get a record of all DNS names under it.

I mean it’s not bad as the admin login page, URL is random and the page is secured.

But it’s just baffling how I am being scanned without having any website linking to my application

Q: Can any security experts explain the reason for this behavior?

Any input is appreciated

  • Do you have any infosec team on the premisses? Was this the first time?
    – user182148
    Commented Dec 13, 2018 at 12:52
  • No. I don't have any infosec team on the premisses. No It happens every time even when I change the environment (and the dns name gets changed as well) Commented Dec 13, 2018 at 12:57
  • Ok. Can you see any logs from where the scan is comming from?
    – user182148
    Commented Dec 13, 2018 at 13:03
  • Yes. for some reason the IPs are mostly coming from China Commented Dec 13, 2018 at 13:13
  • some from South America Commented Dec 13, 2018 at 13:16

1 Answer 1


Any instance/ELB on the public internet will get a public IPv4 address. There are people/bots who constantly scan for vulnerable hosts on the internet, I'm no expert on the tactics they use but its entirely possible that they scan known ranges like AWS more frequently.

A google shows up several articles on the tactics that could be used e.g.: https://www.securitynewspaper.com/2015/10/15/how-to-scan-whole-internet-3-7-billion-ip-addresses-in-few-minutes/

As an example I recently tested this by creating an instance with no DNS name, just an IP address. It was scanned 22 minutes after being created.

Bottom line is if you're concerned about the security of your IP then dont put it on the public internet, if you have to then consider an IP whitelist to just allow your address or alternatively look at AWS WAF for rules to block malicious traffic.

As an aside this is possible because the number of IPv4 addresses is relatively small. The IPv6 range is much bigger so theoretically scanning all addresses will not be possible (or at least not easily)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .