0

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.

I don't have those files on my server, so my server tries to return a 404.html (I should really put one).

my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/add" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /add HT
TP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/404.html" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /a
dd HTTP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"

Upon doing an nslookup of the client, it appears to be an EC2 instance in us-west-2.

$ nslookup 54.71.125.15
Server:         172.31.0.2
Address:        172.31.0.2#53

Non-authoritative answer:
15.125.71.54.in-addr.arpa       name = ec2-54-71-125-15.us-west-2.compute.amazonaws.com.

Am I under some kind of attack? If so, what is the attacker trying to exploit?

  • 2
    If your server has a public IP address, there will almost always be someone knocking on the door to see if anyone's home. Most of the time it's nothing to worry about. The /add endpoint doesn't look like the usual background noise to me though. Could be that someone had that IP before you and their system still think it's theirs. – nbering Feb 11 at 2:09
  • A lot of times, I see botnet attacks on my honeypots begin with an EC2 instance as a C&C... followed by a nice stream of traffic originating from multiple and varied IPs. – RubberStamp Feb 11 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.