1

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.

I don't have those files on my server, so my server tries to return a 404.html (I should really put one).

my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:35:15 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /add HTTP/1.1" 404 153 "-" "-" "-"
my-server | 54.71.125.15 - - [11/Feb/2019:01:36:14 +0000] "GET /health.html HTTP/1.1" 404 153 "-" "-" "-"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/add" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /add HT
TP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"
my-server | 2019/02/11 01:36:14 [error] 7#7: *4106 open() "/usr/share/nginx/html/404.html" failed (2: No such file or directory), client: 54.71.125.15, server: _, request: "GET /a
dd HTTP/1.1", host: "ec2-xx-xx-xx-xx.ap-southeast-1.compute.amazonaws.com"

Upon doing an nslookup of the client, it appears to be an EC2 instance in us-west-2.

$ nslookup 54.71.125.15
Server:         172.31.0.2
Address:        172.31.0.2#53

Non-authoritative answer:
15.125.71.54.in-addr.arpa       name = ec2-54-71-125-15.us-west-2.compute.amazonaws.com.

Am I under some kind of attack? If so, what is the attacker trying to exploit?

Improve this question
2
  • 6
    If your server has a public IP address, there will almost always be someone knocking on the door to see if anyone's home. Most of the time it's nothing to worry about. The /add endpoint doesn't look like the usual background noise to me though. Could be that someone had that IP before you and their system still think it's theirs.
    – nbering
    Feb 11, 2019 at 2:09
  • A lot of times, I see botnet attacks on my honeypots begin with an EC2 instance as a C&C... followed by a nice stream of traffic originating from multiple and varied IPs.
    – RubberStamp
    Feb 11, 2019 at 2:29

1 Answer 1

Reset to default
1

These appear related to EC2 health checks

https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthchecks.html

So I'd say no you are not under any type of recon check

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .