Stange stream of HTTP GET requests in apache logs, from amazon ec2 instances
- by Alexandre Boeglin
I just had a look at my apache logs, and I see a lot of very similar requests:
GET / HTTP/1.1
User-Agent: curl/7.24.0 (i386-redhat-linux-gnu) libcurl/7.24.0 \
NSS/3.13.5.0 zlib/1.2.5 libidn/1.18 libssh2/1.2.2
Host: [my_domain].org
Accept: */*
there's a steady stream of those, about 2 or 3 per minute;
they all request the same domain and resource (there are slight variations in user agent version numbers);
they come form a lot of different IPv4 and IPv6 addresses, in blocs that belong to amazon ec2 (in Singapore, Japan, Ireland and the USA).
I tried to look for an explanation online, or even just similar stories, but couldn't find any.
Has anyone got a clue as to what this is? It doesn't look malicious per say, but it's just annoying me, and I couldn't find any more information about it.
I first suspected it could be a bot checking if my server is still up, but:
I don't remember subscribing to such a service;
why would it need to check my site twice every minute;
why doesn't it use a clearly identifying fqdn.
Or, should I send this question to amazon, via their abuse contact?
Thanks!
