A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address):

I'm seeing attack traffic from your Linode. Just a friendly heads up that its likely p0wned. A quick google suggests no one else likes the traffic coming from your Linode either.
<https://www.google.com/search?q=[my Linode's IP]>

However I couldn't find any evidence to support this assertion. I checked the resource utilization graphs provided by Linode, as well as my firewall logs, system's process list, active connections, recently modified files, user accounts, and so on, and found absolutely no anomalies. The results from the Google search didn't seem to back up the claim that nobody else likes the traffic either; nothing I saw in the first few results raised any red flags. So either the server is fine, or I'm dealing with an adversary who knows how to cover their tracks so well that I can't imagine why they would have any interest in my Linode. (There is no sensitive data on it.)

This leads me to wonder whether the message could have been a form of phishing. In this particular case, I doubt it, but could something like this be a legitimate social engineering tactic? Is there something I would be likely to reveal by replying to this message which could be used against me in some way I can't think of?

If and when this happens in the future, my goal is to respond in a way that allows me to collect the information I need to track down the attack in case it is real, while not revealing anything too compromising in case it isn't real.

  • 1
    In the good old days, there would be less of these type of mails. It might also be a way of gauging the social engineering efficacy, i.e. you're not the only person.
    – munchkin
    Commented Jan 30, 2015 at 7:10
  • 1
    Sounds like maybe someone is goin' fishin'.
    – Ramrod
    Commented Jan 30, 2015 at 8:58
  • 3
    Could be a very confused nice person trying to help. Take this as an opportunity to do some "spring cleaning" on your Linode. You didn't fall for anything, so no harm done.
    – Ohnana
    Commented Jan 30, 2015 at 14:15

2 Answers 2


The message itself isn't phishing, but it could be the first stage of a social engineering attack.

The message (that you quoted) isn't asking you to do anything specific, so it is benign. But, if you reply asking for further details, they might ask you to do something specific (run a program, log into their service, etc.), which would be an attack.

Otherwise, the person could be confused. I see no harm in replying and seeing what the next step is.

  • Makes sense. I actually did send a reply requesting details of the traffic in question and offering to block anything outgoing from my Linode to the IPs being attacked (which I guess reveals that I have a firewall), but I got no response.
    – David Z
    Commented Jan 31, 2015 at 1:07

The search results you get from that link are unlikely to mean anything. There are 100s of sites which will allow you to obtain information about an IP address. These sites in their nature will consist mainly of dynamically generated pages, and many of the sites are not blocking these through robots.txt. Which means they can show up in search engines.

The result is that any IP address you search for is likely to produce loads of results of little relevance. The number of results is going to vary depending on the IP address. It is plausible that the number of results will tell you something about how much interest the general public has in that particular IP address. But a high number can't be assumed to indicate a good reputation or a bad reputation.

All of these generated pages make it hard to find out if there are some really interesting pages somewhere among the search results. If all of the search results are dynamically generated pages, which will be present for very IP you search for, then they are of no interest. If however you were to find somebody mentioning your particular IP address in a question on security.stackexchange.com or serverfault.com, then that is definitely interesting.

If what you cited is the entire email, then that is a clear indication that the sender is either incompetent or malicious. A legitimate email should have contained some actual details about the observed traffic.

An incompetent sender might have misinterpreted lots of results when searching for the IP address as indicating a bad reputation. A malicious sender might actually own some of the search results that you are seeing. In theory there could be malware on those pages, though it would seem like a quite odd way to draw visitors to a page with malware.

Clicking on any of the links in the search results or answering the email will give that sender some more information about you. For example they could learn about the IP addresses of other machines you are using. And it will of course also tell them that somebody has read the email.

  • 1
    When you talk about IP addresses of other machines I'm using, I'm guessing you mean e.g. my laptop which I use to click on the search results?
    – David Z
    Commented Jan 31, 2015 at 1:09
  • @DavidZ Yes. And if you reply to the email, they would also see the IP address of each machine the email has gone through. Of course none of that information is absolutely necessary to keep confidential. But the more information a person has, the easier it will be to perform an attack whether that be by exploiting a vulnerability or social engineering.
    – kasperd
    Commented Jan 31, 2015 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .