Websites hosted on ec2 not reachable

0

we have around 10 websites hosted into EC2 server with ubuntu linux, today those websites are not reachable over internet not able to browse any website hostnames, but when i access the EC2 IP from browser it works and showing the website mapped to the IP address, so i created AMI of the instance and recreated the EC2 with same EC2 type and associated old EIP from existing EC2. This issue occured earlier due to phishing attack complaint from our websites hosted on EC2, bu that time i was notified about the issue on health dashboard, but this time there is no clue about the issue, i can able to browse websited only after recreating the instance from AMI. I have restarted the services, reboot the EC2, nothing helped, only EC2 recreation helped me to bring back my websites live, what could be the reason, anybody have answer for this ?

Ramesh
asked 4 months ago357 views
3 Answers
0

This issue occured earlier due to phishing attack complaint from our websites hosted on EC2, bu that time i was notified about the issue on health dashboard,

Did AWS Trust and Safety issue a warning about this? Did they send you any correspondences explaining the problem, or if they isolated this EC2 Instance? To get to the bottom of why the EC2-Instance is unreachable it would be wise to take the old instance, move it to a private VPC and search it's logs for corruption or malware. We don't know much about this website, what are your security groups, is it WordPress, how do you secure it on an infrastructure and application layer?

profile pictureAWS
EXPERT
David
answered 4 months ago
  • Thanks david for pointing about security, the sites hosted on same server down again second time, upon checking apache logs, i see lot of SQL injection attacks, also i ran a clamAV scan, found and removed a backdoor file, now the sites workinig fine.

0

it sounds like you have taken several steps to troubleshoot the issue already, including restarting services and rebooting the EC2 instance. Since recreating the instance from an AMI resolved the problem, it is possible that there was some issue or corruption within the instance that was resolved by creating a new instance from a clean image.

profile picture
kamal
answered 4 months ago
0

Update : Apache logs showed lot of SQL injection requests, also i done a malware scan by using ClamAV, and removed a backdoor file. Iam able to browse the websites from the affected EC2 instance after the removal of backdoor file.

Ramesh
answered 4 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions