<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Archaeology on ferkakta.dev</title><link>https://ferkakta.dev/tags/archaeology/</link><description>Recent content in Archaeology on ferkakta.dev</description><generator>Hugo</generator><language>en-US</language><copyright>Copyright fizz.</copyright><lastBuildDate>Mon, 06 Apr 2026 12:00:00 -0500</lastBuildDate><atom:link href="https://ferkakta.dev/tags/archaeology/index.xml" rel="self" type="application/rss+xml"/><item><title>The zombie Java app serving internet scrapers for five years</title><link>https://ferkakta.dev/zombie-java-app-serving-scrapers/</link><pubDate>Mon, 06 Apr 2026 12:00:00 -0500</pubDate><guid>https://ferkakta.dev/zombie-java-app-serving-scrapers/</guid><description>&lt;p&gt;I found it because of the load balancers.&lt;/p&gt;
&lt;p&gt;Six of them on the dev account, all legacy. Four Classic ELBs from 2015–2016, two ALBs from 2017. I was auditing them as part of a finops sweep — checking whether anything still needed them. The answer was no. Five had zero requests in all of 2026. The sixth, an ALB called &lt;code&gt;staging-passthru-ssl&lt;/code&gt;, had 150.&lt;/p&gt;
&lt;p&gt;150 requests in three months is background noise. But I wanted to know what was making it. The ALB had four target groups: &lt;code&gt;staging-web&lt;/code&gt;, &lt;code&gt;oracle&lt;/code&gt;, &lt;code&gt;oraclev2&lt;/code&gt;, &lt;code&gt;oraclev3&lt;/code&gt;. Three were empty — no registered targets at all. &lt;code&gt;oracle&lt;/code&gt; had one instance: &lt;code&gt;i-0abc123def456ghi7&lt;/code&gt;, a t2.medium named &lt;code&gt;oracle-api&lt;/code&gt;. It was unhealthy. The ALB was health-checking it and the health checks were failing.&lt;/p&gt;</description></item></channel></rss>