0

I've written a logfile analysis program for my S3 logs and I'm now looking in detail at every line. I've seen some odd behavior lately. I'm trying to figure out

938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [31/Mar/2021:12:15:33 +0000] 192.171.91.135 - 530GTEGJQBJY2KZ8 REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 10 - "https://forum.bdaia.com/forums/users/carolhillyard92/" "PHP/5.3.78" - 2SXnDoKzEpyQTTSYZ7iX8edx8GxkE+wQWBNTy1DaCqhEM/Tfoy13GPBXka4MJV/YM4haKP2jfns= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [31/Mar/2021:16:55:24 +0000] 198.46.199.73 - 6NSWVQYD76FDKCXR REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 39 - "http://www.sdyojoy.com:1108/uchome/space.php?uid=2407&do=blog&id=27798" "PHP/5.3.58" - LiXYpzyuOT7SVQ8zhcesWDCUeB6ztpWolmW+Zl1pUJZa0vDKQ0o/aFc9Sx+9r8Cv4qT1OL74eN8= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [01/Apr/2021:01:57:10 +0000] 75.75.232.172 - V6WWER9Y6J5VAFYB REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 36 - "https://marlou8x.wixsite.com/sellhousesflorida" "PHP/5.3.57" - gxFYg3c3s+d18BBOfaYQxkeDICmhQQjXbgewr2kNxu5AJy6LoLvaRHpDZcWMNbnDcoxgqqNIi4I= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [08/Apr/2021:05:18:52 +0000] 223.24.160.99 - J2T36MABS02RSJQH REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 13 - "http://fogbugz.qarbon.com/default.asp?vb.7.7975.0" "PHP/5.3.48" - sB+DtSFSUkRXq9IoJ4qYxvrRaYH3v1ENQLHQnX3AHNNWAp8y7sITAgYSlboMRjqq6Z9VKgaipf8= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [08/Apr/2021:09:01:33 +0000] 103.113.106.178 - KZG78XKQQGA9J824 REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 31 - "http://www.almelosewandelkring.nl/gastenboek/" "PHP/5.3.55" - ydsWsdsWpeRgY8j8TnD6/pp14AApQTW8jQQXV8an+eGdSl/EooPzv6RApcMEi7KfX0WgQmc6u/E= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
938c42948af97101aa4121273349fb9034d92563dede79b306da5fb954759e8b mys3bucket [09/Apr/2021:05:07:44 +0000] 103.153.68.150 - RH6ZGFHX6SM9EECM REST.POST.OBJECT fluffy-bunny/feature_context.1.0.txt/trackback/ "POST /fluffy-bunny/feature_context.1.0.txt/trackback/ HTTP/1.1" 405 MethodNotAllowed 348 - 44 - "https://mbee.com.vn/dia-chi-ban-vach-ngan-ve-sinh-compact-tai-ho-chi-minh-hcm/" "PHP/5.2.59" - zYsaK9qHYBsF4xEpJ5ttQP6AXtgJF/DWqWqm63tSNcWlI/xf93LZv3gZwgyAxGohzqau31eLX6Y= - ECDHE-RSA-AES128-GCM-SHA256 - mys3bucket.s3.amazonaws.com TLSv1.2
  • I'm not familiar with this /trackback/ post. Is this from Wordpress or something?
  • Is REST.POST.OBJECT somebody trying to do a HTTP POST on my S3 bucket (which is available as a web server), or is it someone going in with the S3-specific APIs?

This is mildly annoying, so I'll program my logfile analysis program to ignore it. Should I be concerned?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.