I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses.
Just now I received the following from Amazon:
We've received a report that your instance(s):
Instance Id: i-XXXXXXX IP Address: XX.XXX.XXX.XXX
has been making illegal intrusion attempts against remote hosts on the Internet; check the information provided below by the abuse reporter.
At 2015-Jun-21 06:52:07 (GMT +8), source IP XX.XXX.XXX.XXX has attempted: * SQL Injection Attempts
So I'm a little taken back by this. I have gone through all the sites and cannot see anything that would indicate a site has been compromised, or that anyone has compromised the server?
Could this be just a mistake or someone has masked their own IP address and used my servers? Any other ideas or tools that I could use to investigate this further to see if there has been a compromise?
Any help appreciated. Thanks.
I have gone through ALL the IIS logs and there is the following
However, it's trying to append to the querystring d=9 on that page. But I have double checked that code for that site, and if has a numeric check and cast. And if it fails that (Which it does for the above query), it just returns nothing - Which is what the site is doing, and that SQL would not have been executed.
So even more stumped now! Any other pointers appreciated.