Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Amazon AWS sent me an email about warning that my instance have been behaving like Phising that is against AWS Customer Agreement.

And they noticed that they blocked port 80 and 443 which are for HTTP and HTTPS respectively.

Google Safe Browsing also reported that some code injection was made to one of my websites. After a cleaning, Google stopped blocking my website displaying in the search result.

So, how can I unblock my ports?

share|improve this question
    
Have you checked your security groups? –  bahamat Nov 21 '12 at 10:55

2 Answers 2

If you are using the Elastic IP service which EC2 provides, then then is high chance that the random elastic IP which you got might be used before for phishing. I would suggest you to disassociate the Elastic IP with that box and associate a new EIP. And make all the associated Route 53 changes also.

To confirm that its not your box which is doing the actual phising, you can check the logs of the services running on port 443 and 80

Or you can run tcpdump to check all the outbound connections from your box.

To unblock the ports, use support services provided by AWS:

https://aws.amazon.com/support/

share|improve this answer

Contact AWS Support and tell them that you've resolved the issue and ask them what you need to do to get unblocked. Make sure you reference the original incident e-mail.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.