Notes

Amazon Web Services
Account ID: 352560228990
Account contact email:
[email protected]
Security contact:
-
Security contact email:
-
Hello,

We've received a report(s) that your AWS resource(s)

AWS ID: 352560228990 Region: eu-central-1 EC2 Instance Id: i-077d77687fa53371a


has been implicated in activity that resembles a Denial of Service attack against remote hosts; please review the information provided below about the activity.

Please take action to stop the reported activity and reply directly to this email with details of the corrective actions you have taken. If you do not consider the activity described in these reports to be abusive, please reply to this email with details of your use case.

If you're unaware of this activity, it's possible that your environment has been compromised by an external attacker, or a vulnerability is allowing your machine to be used in a way that it was not intended.

We are unable to assist you with troubleshooting or technical inquiries. However, for guidance on securing your instance, we recommend reviewing the following resources:

* Amazon EC2 Security Groups User Guide:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html (Linux)
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/using-network-security.html (Windows)

* Tips for Securing EC2 Instances:
https://aws.amazon.com/answers/security/aws-securing-ec2-instances (Linux)
https://aws.amazon.com/answers/security/aws-securing-windows-instances (Windows)

* AWS Security Best Practices:
https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf

If you require further assistance with this matter, you can take advantage of our developer forums:

https://forums.aws.amazon.com/index.jspa

Or, if you are subscribed to a Premium Support package, you may reach out for one-on-one assistance here:

https://console.aws.amazon.com/support/home#/case/create?issueType=technical

Please remember that you are responsible for ensuring that your instances and all applications are properly secured. If you require any further information to assist you in identifying or rectifying this issue, please let us know in a direct reply to this message.

Regards,
AWS Trust & Safety
Amazon Web Services, LLC


Case Number: 12829080924-1

---Beginning of forwarded report(s)---

* Log Extract:
<<<
An instance from your network was reported for participating in a DDoS attack.
Please investigate your instance(s) and reply detailing the corrective measures you have taken to address this activity. To assist you, we have taken the following actions:
Region: eu-central-1
Instances:
Instance Id Remote IP Port Protocol Action Taken
i-077d77687fa53371a 88.238.204.162 17246 17 Outgoing Port 17246 blocked
AWS Account: 352560228990
Instance Id: i-077d77687fa53371a
Report begin time: 12-02-2022 11:08:03 UTC
Report end time: 12-02-2022 11:09:00 UTC

Protocol: UDP
Target Ip: 88.238.204.162
Public Ip(s): 3.69.238.130
Remote port(s): 17246

Total Gbits sent: 9.1081
Total packets sent: 1107497
Total Gbits received: 0
Total packets received: 0
Average Gbits/sec sent: 0.1598

It appears there may be an exposed vulnerability that has triggered a DoS attack. It is advisable to update all applications and ensure the most current patches are applied.
It is recommended that no ports be open to the public (0.0.0.0/0 or ::0). Opening ports with vulnerable applications can cause abusive behavior.