Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format:
sql_error_code = 28000 FATAL: no pg_hba.conf entry for host "xx.xx.xxx.xx", user "postgres", database "postgres", SSL off
The host address is very different every time; none of the four numbers are consistent. Since "postgres" is commonly the default user and database name for Postgres, this seems like it could be be an attempt to find low-hanging fruit for data theft.
My webapp which uses the database is working fine and isn't reporting any abnormal latency, and I haven't pushed any code changes over the last week, so I'm pretty sure it's not me.
Does this follow the pattern of a hack or DDOS-like attack? If so, what's the likelihood that it's targeting my database specifically?
If it helps, the URL to my EC2 instance is not public, I've never shared it anywhere.