Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format:

sql_error_code = 28000 FATAL:  no pg_hba.conf entry for host "xx.xx.xxx.xx", user "postgres", database "postgres", SSL off

The host address is very different every time; none of the four numbers are consistent. Since "postgres" is commonly the default user and database name for Postgres, this seems like it could be be an attempt to find low-hanging fruit for data theft.

My webapp which uses the database is working fine and isn't reporting any abnormal latency, and I haven't pushed any code changes over the last week, so I'm pretty sure it's not me.

Does this follow the pattern of a hack or DDOS-like attack? If so, what's the likelihood that it's targeting my database specifically?

If it helps, the URL to my EC2 instance is not public, I've never shared it anywhere.

1 Answer 1


I've seen the same behavior in a few of the apps I manage. I also saw this tweet - https://twitter.com/testflyjets/status/1102410441723015168 - so I don't think these are targeted attacks, but rather an un-targeted effort to find vulnerable Postgres databases.

Most of the attempted connections were with the username "postgres", but I also saw attempts with "root", "pgsql" and "pgbouncer".

  • You are correct. Here's the relevant page on Heroku's help site: help.heroku.com/DR0TTWWD/… Mar 7, 2019 at 15:48
  • I am getting it with users stolon and odoo, as well as postgres. And its continuously every rotating all 3 every second. Feb 6, 2020 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .