I have a personal service which is deployed on one VPS. The service works based on http requests, and it is due specific goal and handling three types of requests.
The order matters in the requests. Client send requests, it usually takes something between 30s to 6min to get a response (and it's OK).
When I set it to perform short task (30-60 seconds) everything is OK. But when I have longer request (3-4 minutes), it seems someone with another IP replicates the requests I sent after 2(almost) minutes.
Times are in seconds:
- at time 0 I send a request to startup the system from IP1 (my IP)
- at time 15 I send a request to run the system from IP1 (my IP)
- at time 18 I send a request and ask for the result which should take about 500 seconds from IP1 4. at time 130 the system gets a request from another IP (IP2) to startup the system
- at time 154 the system get a request to run the system from IP2
I checked IP2. It's not on any sort of black list, and it seemed to come from Amazon AWS.
My mistake was that I have left the port open and made it possible. I closed it and now I'm using ssh port forwarding. It works fine now. What I don't understand is: "is this something normal? Is this some sort of attack? Am I paranoid?"