From: "Massimo S." <ecs-isp@2rosenthals.com>
Reply-To: ml@ecomstation.it
Subject: Re: [eCS-ISP] pings from AWS IPs/servers
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-413321@2rosenthals.com> <list-413881@2rosenthals.com>
Organization: eComStation dot it
Message-ID: <024963e1-d9f6-d222-2df1-f70da7437fff@ecomstation.it>
Date: Wed, 5 Feb 2020 20:45:00 +0100
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424
 Thunderbird/1.0.8 Mnenhy/0.7.4.0
MIME-Version: 1.0
In-Reply-To: <list-413881@2rosenthals.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: it-IT
Content-Transfer-Encoding: 7bit



Il 05/02/2020 20:08, Lewis G Rosenthal ha scritto:
> Hi, Max...
> 
> On 02/05/20 06:17 am, Massimo S. wrote:
>> Hi all,
>>
>> anyone has the same experience?
>>
>> my webserver is being pinged by at least 113 differents IPs/servers
>> all with fqdn like "ecs-......compute.amazonaws.com"
>>
>> i'm writing deny rules, since i've enough that someone ping my webserver
>> i'm at 113 rules at the moment 8-)
>>
>> any comment?
>> any idea?
>> why they ping my server?
>> maybe it's a botnet?
>>
> 
> No idea.
> Here, looking at today's stats, we're being hit by two IPs from Panama (about 300 packets in 
> total - LOL).
> 
> Last month, our biggest offenders came from Ireland and Panama. These appear to have been SQL 
> injection attempts. The Panamanian host appears to be coming from directwebhost.org.

here too i've banned those ip directly on the router ACLs

...

> 
> If you are concerned about malicious activity, you should probably contact Amazon:
> 
> https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/
> 
> Asking us here is not likely to get you any useful results, because as you can see, we 
> typically have different experiences at different times.
> 
> GL

i guess that sharing this kind of info is allways useful ;)

massimo