Just curious about this ip reddit / selfhosted ---------------------------------------------------------------------- 9acca9 · 2023-11-11 22:55 what could be the reason for an amazon ip in my nginx access.log file? 3.88.16.48 - - [11/Nov/2023:19:20:07 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36" ​ ---------------------------------------------------------------------- autisticit · 2023-11-11 22:57 There are thousands of reasons. ---------------------------------------------------------------------- 9acca9 · 2023-11-11 23:00 i though that just the bad ip are playing around in the internet. mmm, so Amazon is bad, i always knew it! ---------------------------------------------------------------------- 9acca9 · 2023-11-11 23:01 Have SSH open. ---------------------------------------------------------------------- mrbmi513 · 2023-11-11 23:04 Just about anyone can spin up resources in AWS and do whatever until they're caught. ---------------------------------------------------------------------- autisticit · 2023-11-11 23:05 You should probably not expose anything online. Use a VPN to get to your network when outside and all your problems will be solved... ---------------------------------------------------------------------- UnfairerThree2 · 2023-11-11 23:10 You know an Amazon IP doesn’t translate to Amazon doing anything, it’s 99% going to be AWS. Gets abused real easy ---------------------------------------------------------------------- tcp-xenos · 2023-11-11 23:16 nah this is definitely Bezos himself, wearing a guy fawkes mask and typing lots of password attempts ---------------------------------------------------------------------- thekrautboy · 2023-11-11 23:22 Tell me. All of them. ---------------------------------------------------------------------- 9acca9 · 2023-11-11 23:31 i was just asking about an ip and also...... making a little dumb kind of a joke. What i want to know if there is a fair use, or fair case for an ip saying "hello" to my server. In this case you are saying that could be someone using AWS for "bad use", but could be a fair use? ---------------------------------------------------------------------- RuffKez · 2023-11-11 23:32 Get yourself crowdsec and the background noise of the web will be reduced in secounds ---------------------------------------------------------------------- ndragon798 · 2023-11-11 23:39 Pro tip set up user agent blocks in nginx and have it respond with a 444 it will have nginx stop responding instead of giving a 403. Block anything under chrome 100. ---------------------------------------------------------------------- sniff122 · 2023-11-12 00:19 It will likely be some sort of crawler ---------------------------------------------------------------------- multidollar · 2023-11-12 01:35 I once had a Senior Infrastructure Engineer looking at the logs of our public VPN host. A VPN host that is open to the world on [0.0.0.0/0](https://0.0.0.0/0) because that's the requirement we had. This Engineer saw thousands of failed login attempts to the VPN; things like admin/admin admin/password1 etc. Regular internet crap, a bot will scrape the web page and try its luck then move on. This person then decided to initiate security breach procedure and immediately shut down the VPN, because "we'd been hacked!". There's a lot of noise on the internet. The challenge is working out the best way to isolate your resources just enough and block anything that doesn't need access. This is why things like Web Application Firewalls exist. ---------------------------------------------------------------------- mrbmi513 · 2023-11-12 02:30 Could be someone using AWS as a proxy or VPN, but it's also just as likely someone using a script to try and scrape or probe. We don't know. ---------------------------------------------------------------------- 9acca9 · 2023-11-12 03:10 oh, thanks for this! ---------------------------------------------------------------------- krisnaw · 2023-11-12 04:24 You can also use the free version of cloudflare to block ddos, block traffic from certain countries, create page rules etc ---------------------------------------------------------------------- djgizmo · 2023-11-12 04:32 And? ---------------------------------------------------------------------- phein4242 · 2023-11-12 14:57 You will be in for a surprise once you learn about tcpdump ;-) Welcome to internet hosting! ---------------------------------------------------------------------- zoredache · 2023-11-12 22:44 > What i want to know if there is a fair use, or fair case for an ip saying "hello" to my server. Could be a researcher scanning the Internet to count the number of web servers online. Could be a search engine looking for servers to include in their index. Could someone scanning for shodan.io. It could just as easily be a malware infected system looking for new targets for infection. ---------------------------------------------------------------------- kmisterk · 2023-11-17 18:39 If you have a public-facing, accessible webserver, there's an eventuality that some bot, search crawler, or some other kind of automated entity will find the IP, ping it to check for open ports, and attempt to probe with varying types of access. Looks like someone, somewhere, using either a VPN hosted on AWS, or some bot / automated process hosted on AWS decided to give your server a good ol' HTTP hello. It's common, and the longer your service is online for the public to access, the more likely it gets hit more and more. It's not that big of an issue, having random HTTP get requests pointed at your webserver.