I developed a small application with a Redis datastore. I encounter no problems on my development machine. The application is built using docker images and defined in a docker-compose yml file.
I have deployed the project to a VPS. The environment is practically the same, it is built from the same docker images/Dockerfiles using the same docker-compose settings etc.
I noticed that once every few hours my Redis datastore is emptied. When digging in the logs I saw that Redis wants to replicate to a (for me) unknown IP address (based in Russia).
I have no clue what is happening. It looks like my server is compromised, which, of course, is possible. But it is a fresh install (ubuntu 18.04) with only my project on it. No unknown packages or other security risks. I have never encountered any kind of behavior like this except in malicious code.
When looking up the IP it wants to replicate to/from an in Russia hosted VPS. When visiting the IP I get a default Nginx page.
I have grepped my machine for the IP address but nothing found. I have exported the Docker image and grepped for that IP (also the ipv6) in the export but also nothing found.
I am clueless, does anyone have any idea what is happening here?
Here follows a snippet from the logfile.
1:M 13 Jul 2020 20:06:18.108 * Background saving terminated with success
1:S 13 Jul 2020 20:06:20.873 * Before turning into a replica, using my own master parameters to synthesize a cached master: I may be able to synchronize with the new master with just a partial transfer.
1:S 13 Jul 2020 20:06:20.873 * REPLICAOF 93.189.43.3:8886 enabled (user request from 'id=7746 addr=95.214.11.231:34714 fd=21 name= age=0 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=45 qbuf-free=32723 obl=0 oll=0 omem=0 events=r cmd=slaveof user=default')
1:S 13 Jul 2020 20:06:21.620 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:21.621 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:21.667 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:21.714 * Master replied to PING, replication can continue...
1:S 13 Jul 2020 20:06:21.807 * Trying a partial resynchronization (request 9bdf2d313dc7387849d8607f14a5133e53b98cdf:1).
1:S 13 Jul 2020 20:06:21.854 * Full resync from master: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ:1
1:S 13 Jul 2020 20:06:21.855 * Discarding previously cached master state.
1:S 13 Jul 2020 20:06:21.855 * MASTER <-> REPLICA sync: receiving 55664 bytes from master to disk
1:S 13 Jul 2020 20:06:21.949 * MASTER <-> REPLICA sync: Flushing old data
1:S 13 Jul 2020 20:06:21.949 * MASTER <-> REPLICA sync: Loading DB in memory
1:S 13 Jul 2020 20:06:21.949 # Wrong signature trying to load DB from file
1:S 13 Jul 2020 20:06:21.950 # Failed trying to load the MASTER synchronization DB from disk
1:S 13 Jul 2020 20:06:22.623 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:22.623 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:22.670 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:22.716 # Error reply to PING from master: '-Reading from master: Invalid argument'
1:S 13 Jul 2020 20:06:23.625 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:23.626 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:23.672 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:23.719 # Error reply to PING from master: '-Reading from master: Invalid argument'
1:S 13 Jul 2020 20:06:24.630 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:24.630 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:24.676 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:24.723 # Error reply to PING from master: '-Reading from master: Invalid argument'
1:S 13 Jul 2020 20:06:25.633 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:25.634 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:25.680 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:25.727 # Error reply to PING from master: '-Reading from master: Invalid argument'
1:S 13 Jul 2020 20:06:26.638 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:26.638 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:26.684 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:26.731 # Error reply to PING from master: '-Reading from master: Connection reset by peer'
1:S 13 Jul 2020 20:06:27.641 * Connecting to MASTER 93.189.43.3:8886
1:S 13 Jul 2020 20:06:27.642 * MASTER <-> REPLICA sync started
1:S 13 Jul 2020 20:06:27.720 * Non blocking connect for SYNC fired the event.
1:S 13 Jul 2020 20:06:27.800 # Error reply to PING from master: '-Reading from master: Connection reset by peer'
1:S 13 Jul 2020 20:06:28.077 # Module ./red2.so failed to load: It does not have execute permissions.
1:M 13 Jul 2020 20:06:28.179 # Setting secondary replication ID to 9bdf2d313dc7387849d8607f14a5133e53b98cdf, valid up to offset: 1. New replication ID is 17f925dc5b42b00af0083a1bb3502e6b68c2fc64
1:M 13 Jul 2020 20:06:28.179 * MASTER MODE enabled (user request from 'id=7746 addr=95.214.11.231:34714 fd=21 name= age=8 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=34 qbuf-free=32734 obl=0 oll=0 omem=0 events=r cmd=slaveof user=default')