1

I just had a look at my apache logs, and I see a lot of very similar requests:

GET / HTTP/1.1
User-Agent: curl/7.24.0 (i386-redhat-linux-gnu) libcurl/7.24.0 \
    NSS/3.13.5.0 zlib/1.2.5 libidn/1.18 libssh2/1.2.2
Host: [my_domain].org
Accept: */*
  • there's a steady stream of those, about 2 or 3 per minute;
  • they all request the same domain and resource (there are slight variations in user agent version numbers);
  • they come form a lot of different IPv4 and IPv6 addresses, in blocs that belong to amazon ec2 (in Singapore, Japan, Ireland and the USA).

I tried to look for an explanation online, or even just similar stories, but couldn't find any.

Has anyone got a clue as to what this is? It doesn't look malicious per say, but it's just annoying me, and I couldn't find any more information about it.

I first suspected it could be a bot checking if my server is still up, but:

  1. I don't remember subscribing to such a service;
  2. why would it need to check my site twice every minute;
  3. why doesn't it use a clearly identifying fqdn.

Or, should I send this question to amazon, via their abuse contact?

Thanks!

4
  • Do you have content someone might want to crawl regularly?
    – ceejayoz
    Jun 12, 2013 at 16:26
  • What do you mean by "clearly identifying fqdn" doesn't Host: [my_domain].org count?
    – Ladadadada
    Jun 12, 2013 at 17:00
  • @ceejayoz when querying the root of my domain, the answer is actually a "302 Found" redirection to "/blog/" (caused by a apache RewriteRule), which the curl bot never requests afterwards. Jun 12, 2013 at 17:07
  • @Ladadadada I meant "clearly identifying fqdn" for the curl client. There is no PTR record for these – well, I'm not sure whether EC2 would allow that, but here, neither the User-Agent not the client IP address help me identify who is persistently querying my server. Jun 12, 2013 at 17:10

2 Answers 2

0

If you're seeing unexpected traffic or malicious traffic coming to your servers from AWS, you should submit an abuse case via http://portal.aws.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse so they can get in touch with whoever is sending the traffic.

0

This is actually an ttack being performed on your system. You can use network Acl to block the IP addresses or use a WAF

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .