2

When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes many times 

Proto ---- local address ---- remote address ---- state

TCP   ---- my_address:port ---- ec2-xx-xx-xx-xx:port ---- ESTABLISHED

When I tried to know the source of this IP address, I've seen that it's an amazon instance, which has this hostname ec2-xx-xx-xx-xx.compute-1.amazonaws.com

I use the browser Chromium Edge, and I don't know if it uses resources on these instances or it can be some dangerous stuff, do you have any idea please what can this be?

Improve this question
6
  • 1
    That refers Amazon Cloud which many vendors use. – user215422 May 23 '20 at 0:10
  • @user215422 Does the browser use it ? – Karam Mohamed May 23 '20 at 0:24
  • 1
    This can be anything. This is cloud and or CDN. The pure existence of this connection is not enough to say what it is used for. – Steffen Ullrich May 23 '20 at 2:31
  • @SteffenUllrich so it's normal to find your computer connected to these instances ? – Karam Mohamed May 23 '20 at 2:33
  • 1
    @KaramMohamed: It is pretty common that software uses AWS for a variety of purposes. There is not enough known to say if this specific connection is normal or not, i.e. it is not clear what application uses it, what data are exchanged etc. In fact, the only thing what we know is that you have some computer where one of the several software installed is Chromium Edge. Thus it could be anything. – Steffen Ullrich May 23 '20 at 2:42
2

Whenever you browse a website, your computer makes a connection to the site itself and to the servers hosting any resources requested by that website. I've seen sites that include literally dozens of 3rd party resources -- fonts, ads, tracking pixels, javascript, stylesheets, and images are just some of these resources. So to visit a site, you may make connections to dozens of different servers.

Of course, those servers won't be named ec2-xx-xx-xx-xx.compute-1.amazonaws.com in the source code. They'll instead have a name like "examplecdn.com". DNS is used to convert the hostname "examplecdn.com" to an IP address, which is what your computer actually connects to. It's like looking up a phone number in an old-school phone book and dialing it.

So how do you get the EC2 name in your netstat output? Well, netstat does something called a reverse DNS lookup. It asks the DNS server to give it a hostname for an IP address. This name does not have to be the same as the "examplecdn.com", it's again just a directory service. For all the big cloud providers, you'll see that this defaults to some hostname based on the cloud provider's name. Under Amazon, it's something under amazonaws.com, (and in fact, the ec2-XX-XX-XX-XX should correspond to the IP of the host), and under Google Cloud it's "googleusercontent.com".

So, in summary, what you're seeing is that some resource requested by your computer is hosted by someone using AWS as their service provider. It's not inherently suspicious.

Improve this answer
-1

While I don't have any connections to amazon at the moment, here's a screenshot of my connections - some of them still irk me - like the 5th one from the bottom: msedge.net domain.

Not only do I never use Edge browser, but I have every possible feature/option to Cortana turned OFF. Yet still... there's that connection.

I sometimes found it interesting to do a tracert on the remote address. A quick tip: use the optional switches or at least the -w switch to make the wait for a response in milliseconds faster. I usually set it to -w 500.

enter image description here

Improve this answer
3
  • 3
    This is not an answer. It could be an answer if you added just a couple lines. – schroeder♦ May 23 '20 at 7:27
  • 1
    msedge.net is not about the Edge browser. Please look up what it is for. You can safely remove that part of your answer and still have a potentially helpful answer. – schroeder♦ May 23 '20 at 7:30
  • If you're using Windows, there are on the order of a dozen different Microsoft servers that get connected to over the course of the day even if your computer is sitting idle and doing nothing. What's more, they can't be blocked in situ via the host file because Microsoft doesn't honor the host file entries for its own servers. – user10216038 May 23 '20 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.