IP Details for incoming traffic

To investigate strange incoming network traffic on your AWS Lightsail instance and obtain IP and location details, you can try the following

1. Access Instance Logs:

   • Connect to your Lightsail instance via SSH.
   • Check system logs for any suspicious activity.

2. Use Netstat: Run sudo netstat -tuln to see active network connections and listening ports.

3. Check Web Server Logs: If you're running a web server, check its access logs

4. Use AWS VPC Flow Logs: Enable VPC Flow Logs for your Lightsail instance to capture IP traffic.

5. Consider the use of AWS Web Application Firewall to add protection from common exploits

If you see ip addresses of concern do some research on the domains associated with those ip addresses.

Focus on securing your instance and implementing proper access controls to help reduce the risk.

For persistent issues or if you suspect a security breach, contact AWS Support for assistance.

To identify the IP and location details associated with the unusual incoming network traffic:

1. Enable AWS VPC Flow Logs: This will capture information about IP traffic going to and from network interfaces in your VPC. Make sure to set it up on the network interface associated with your Lightsail instance.

2. Check Web Server Logs: If your instance is running a web server, such as Apache or Nginx, you can inspect its access logs. These logs typically contain IP addresses and timestamps of incoming requests.

3. Use an IP Geolocation Service: Once you have the IPs from the logs, you can use services like ipinfo.io or ipgeolocation.io to get location details of the IP addresses.

This should give you more insight into the source of the traffic shown in your metrics.