I just had a look at my apache logs, and I see a lot of very similar requests:

GET / HTTP/1.1
User-Agent: curl/7.24.0 (i386-redhat-linux-gnu) libcurl/7.24.0 \
    NSS/ zlib/1.2.5 libidn/1.18 libssh2/1.2.2
Host: [my_domain].org
Accept: */*
  • there's a steady stream of those, about 2 or 3 per minute;
  • they all request the same domain and resource (there are slight variations in user agent version numbers);
  • they come form a lot of different IPv4 and IPv6 addresses, in blocs that belong to amazon ec2 (in Singapore, Japan, Ireland and the USA).

I tried to look for an explanation online, or even just similar stories, but couldn't find any.

Has anyone got a clue as to what this is? It doesn't look malicious per say, but it's just annoying me, and I couldn't find any more information about it.

I first suspected it could be a bot checking if my server is still up, but:

  1. I don't remember subscribing to such a service;
  2. why would it need to check my site twice every minute;
  3. why doesn't it use a clearly identifying fqdn.

Or, should I send this question to amazon, via their abuse contact?


  • Do you have content someone might want to crawl regularly? – ceejayoz Jun 12 '13 at 16:26
  • What do you mean by "clearly identifying fqdn" doesn't Host: [my_domain].org count? – Ladadadada Jun 12 '13 at 17:00
  • @ceejayoz when querying the root of my domain, the answer is actually a "302 Found" redirection to "/blog/" (caused by a apache RewriteRule), which the curl bot never requests afterwards. – Alexandre Boeglin Jun 12 '13 at 17:07
  • @Ladadadada I meant "clearly identifying fqdn" for the curl client. There is no PTR record for these – well, I'm not sure whether EC2 would allow that, but here, neither the User-Agent not the client IP address help me identify who is persistently querying my server. – Alexandre Boeglin Jun 12 '13 at 17:10

If you're seeing unexpected traffic or malicious traffic coming to your servers from AWS, you should submit an abuse case via http://portal.aws.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse so they can get in touch with whoever is sending the traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.