1

So I just created a new droplet on DigitalOcean and did a http-server in the root directory. 5 minutes later I see this in the logs:

GET http://47.99.121.32:39169/Ip/Up?Ip=[my server ip]&Port=8080&Check=89&Order=58.218.213.44

Researching a bit, I found out that the IP belongs to "Hangzhou Alibaba Advertising Co.,Ltd.".

And it does that every 20 seconds or so. How did they know about it? Is ther a browser extension that's somehow communicating my browser history to them? What the hell is going on?

Ahmed Alharbi
  • 11
  • 1

1 Answers1

1

What you are seeing are considered routine, automated, dragnet (rather than targeted) scans of large parts of the internet. Such requests are probably not targeted at your server specifically but part of the "background noise" of the Internet.

Additionally hosting providers will re-use their ip-addresses and assign new customers ip-addresses that were returned to the pool by customers that had no use for them anymore. You may see traffic to your server when for instance the previous tenant didn't remove a DNS record.

HBruijn
  • 72,524
  • 21
  • 127
  • 192