Recently, I started up nginx
on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add
and /health.html
on my server.
I don't have those files on my server, so my server tries to return a 404.html
(I should really put one).
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/add" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /add HT
TP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/404.html" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /a
dd HTTP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
Upon doing an nslookup
of the client, it appears to be an EC2 instance in us-west-2.
$ nslookup 54.71.125.15
Server: 172.31.0.2
Address: 172.31.0.2#53
Non-authoritative answer:
15.125.71.54.in-addr.arpa name = ec2-54-71-125-15.us-west-2.compute.amazonaws.com.
Am I under some kind of attack? If so, what is the attacker trying to exploit?
/add
endpoint doesn't look like the usual background noise to me though. Could be that someone had that IP before you and their system still think it's theirs.