I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log
:
...
open() "/var/www/html/ip_json.php" failed (2: No such file or directory),
client: 179.99.200.39, server: mydomain.com,
request: "GET http://teddybrinkofski.com/ip_json.php HTTP /1.1",
host: "www.teddybrinkofski.com", referrer: "none"
...
Do note that I have no php on this server (especially not a file called ip_json.php
), and I am not (nor am I familiar in any way with) teddybrinkofski.com.
This sounds like bad news to me; possible compromised credentials? But it's also very possible that I've done something silly on this otherwise virgin machine. Whatever it is, I don't like that this foreign domain is on my machine. (grep
'ing for the domain results in nothing meaningful, but I may not know what I should be looking for, so I'm happy to review the results with you.)
Regardless, it feels to me like my server thinks it should be pulling this file from a remote location, which is not too pleasing.
All input welcome, please let me know if I've forgotten something important.