0

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.

I don't have those files on my server, so my server tries to return a 404.html (I should really put one).

my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/add" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /add HT
TP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/404.html" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /a
dd HTTP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"

Upon doing an nslookup of the client, it appears to be an EC2 instance in us-west-2.

$ nslookup 54.71.125.15
Server:         172.31.0.2
Address:        172.31.0.2#53

Non-authoritative answer:
15.125.71.54.in-addr.arpa       name = ec2-54-71-125-15.us-west-2.compute.amazonaws.com.

Am I under some kind of attack? If so, what is the attacker trying to exploit?

  • 1
    If your server has a public IP address, there will almost always be someone knocking on the door to see if anyone's home. Most of the time it's nothing to worry about. The /add endpoint doesn't look like the usual background noise to me though. Could be that someone had that IP before you and their system still think it's theirs. – nbering Feb 11 at 2:09
  • A lot of times, I see botnet attacks on my honeypots begin with an EC2 instance as a C&C... followed by a nice stream of traffic originating from multiple and varied IPs. – RubberStamp Feb 11 at 2:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.