Dev.to

Phantom DNS Query to GCP VM Metadata Service in My AWS Workload

I Found Suspicious DNS Calls on AWS I was debugging flaky outbound calls from an AWS Fargate task. To gain better visibility into potential network issues, I followed the common best practice of enabling Route 53 Resolver query logging for DNS queries within my VPC on AWS. Shortly after the logs started populating, while examining them for clues related to the original outbound problems, I noticed something odd... I noticed repeated lookups for metadata.google.internal. — an endpoint meant exclusively for Google Cloud VMs, but hey, my workload was on AWS all the time! At first glance, it felt like a hacker reconnaissance probing my AWS Fargate tasks

Apr 27, 2025 - 06:24
 0
Phantom DNS Query to GCP VM Metadata Service in My AWS Workload

I Found Suspicious DNS Calls on AWS

I was debugging flaky outbound calls from an AWS Fargate task. To gain better visibility into potential network issues, I followed the common best practice of enabling Route 53 Resolver query logging for DNS queries within my VPC on AWS. Shortly after the logs started populating, while examining them for clues related to the original outbound problems, I noticed something odd...

I noticed repeated lookups for metadata.google.internal. — an endpoint meant exclusively for Google Cloud VMs, but hey, my workload was on AWS all the time!

At first glance, it felt like a hacker reconnaissance probing my AWS Fargate tasks

Read More

Tags:

Previous Article

How Google’s AI Is Unlocking the Secrets of Dolphin Communication

Next Article

Azure Applied Skills: Create DNS zones and configure DNS settings

Related Posts

From Legacy FTP to Secure SFTP: Building a Reusable Java Library with Factory Pattern

From Legacy FTP to Secure SFTP: Building a Reusable Jav...

Apr 27, 2025  0

Architecture of Academialink: Full Stack Flow (Angular Spring Boot MySQL)

Architecture of Academialink: Full Stack Flow (Angular ...

Apr 20, 2025  0

Apr 26, 2025  0