2

When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes many times 

Proto ---- local address ---- remote address ---- state

TCP   ---- my_address:port ---- ec2-xx-xx-xx-xx:port ---- ESTABLISHED

When I tried to know the source of this IP address, I've seen that it's an amazon instance, which has this hostname ec2-xx-xx-xx-xx.compute-1.amazonaws.com

I use the browser Chromium Edge, and I don't know if it uses resources on these instances or it can be some dangerous stuff, do you have any idea please what can this be?

Improve this question
5
  • 1
    That refers Amazon Cloud which many vendors use.
    – user215422
    May 23, 2020 at 0:10
  • @user215422 Does the browser use it ?
    – Karam Mohamed
    May 23, 2020 at 0:24
  • 1
    This can be anything. This is cloud and or CDN. The pure existence of this connection is not enough to say what it is used for.
    – Steffen Ullrich
    May 23, 2020 at 2:31
  • @SteffenUllrich so it's normal to find your computer connected to these instances ?
    – Karam Mohamed
    May 23, 2020 at 2:33
  • 1
    @KaramMohamed: It is pretty common that software uses AWS for a variety of purposes. There is not enough known to say if this specific connection is normal or not, i.e. it is not clear what application uses it, what data are exchanged etc. In fact, the only thing what we know is that you have some computer where one of the several software installed is Chromium Edge. Thus it could be anything.
    – Steffen Ullrich
    May 23, 2020 at 2:42

2 Answers 2

Reset to default
3

Whenever you browse a website, your computer makes a connection to the site itself and to the servers hosting any resources requested by that website. I've seen sites that include literally dozens of 3rd party resources -- fonts, ads, tracking pixels, javascript, stylesheets, and images are just some of these resources. So to visit a site, you may make connections to dozens of different servers.

Of course, those servers won't be named ec2-xx-xx-xx-xx.compute-1.amazonaws.com in the source code. They'll instead have a name like "examplecdn.com". DNS is used to convert the hostname "examplecdn.com" to an IP address, which is what your computer actually connects to. It's like looking up a phone number in an old-school phone book and dialing it.

So how do you get the EC2 name in your netstat output? Well, netstat does something called a reverse DNS lookup. It asks the DNS server to give it a hostname for an IP address. This name does not have to be the same as the "examplecdn.com", it's again just a directory service. For all the big cloud providers, you'll see that this defaults to some hostname based on the cloud provider's name. Under Amazon, it's something under amazonaws.com, (and in fact, the ec2-XX-XX-XX-XX should correspond to the IP of the host), and under Google Cloud it's "googleusercontent.com".

So, in summary, what you're seeing is that some resource requested by your computer is hosted by someone using AWS as their service provider. It's not inherently suspicious.

Improve this answer
0

You can find more information about the aws server by typing the IP address "ec2-..." in a browser URL field and you'll almost certainly get a message from the browser saying your connection is not private. You can click on "proceed anyway" if you are confident in your anti-malware, and what you'll likely see is a message about the browser not finding a certificate. The browser will also provide a domain name for the URL owner. I recently discovered connections to EC2 servers for Zoom.us, Kahoot.com, and Instructure.com when I typed the EC2 URL shown in a netstat -f command.

Improve this answer
2
  • 1
    I'm not sure that this adds anything to the accepted answer. Did you have a unique perspective on this?
    – schroeder ♦
    Nov 24, 2021 at 22:49
  • " The browser will also provide a domain name for the URL owner. " -- how does it do this?
    – schroeder ♦
    Nov 24, 2021 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.