Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided.
Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was shocked to see this:
Welcome to Ubuntu 14.04.2 LTS (GNU/Linux 2.6.32-042stab116.2 x86_64)
Last login: Sat Sep 17 04:39:57 2016 from ic.fbi.gov
Immediately, I contacted my hosting company. They said that they didn't know why this might be, and that it's possible the hostname was spoofed.
I did a bit more digging, and resolved ic.fbi.gov to an IP address.
I then ran this on the system:
This returned my IP address, and then two other IP addresses which were unknown to me. I geoIP'd these two IP addresses. One of them was a VPN and the other was a server from a hosting company in the state of Washington.
Again, the IP that I resolved ic.fbi.gov to was not on the list.
Do you think I should be concerned/worried about the "FBI" obtaining access to my VPS? Or is it just a hacker that spoofed the hostname?