0

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.

I don't have those files on my server, so my server tries to return a 404.html (I should really put one).

my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/add" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /add HT
TP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/404.html" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /a
dd HTTP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"

Upon doing an nslookup of the client, it appears to be an EC2 instance in us-west-2.

$ nslookup 54.71.125.15
Server:         172.31.0.2
Address:        172.31.0.2#53

Non-authoritative answer:
15.125.71.54.in-addr.arpa       name = ec2-54-71-125-15.us-west-2.compute.amazonaws.com.

Am I under some kind of attack? If so, what is the attacker trying to exploit?

  • 4
    If your server has a public IP address, there will almost always be someone knocking on the door to see if anyone's home. Most of the time it's nothing to worry about. The /add endpoint doesn't look like the usual background noise to me though. Could be that someone had that IP before you and their system still think it's theirs. – nbering Feb 11 at 2:09
  • A lot of times, I see botnet attacks on my honeypots begin with an EC2 instance as a C&C... followed by a nice stream of traffic originating from multiple and varied IPs. – RubberStamp Feb 11 at 2:29
0

These appear related to EC2 health checks

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthchecks.html

So I'd say no you are not under any type of recon check

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.