Could a fake tip that my server is compromised be a social engineering attack?

Question

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address):

I'm seeing attack traffic from your Linode. Just a friendly heads up that its likely p0wned. A quick google suggests no one else likes the traffic coming from your Linode either.
<https://www.google.com/search?q=[my Linode's IP]>

However I couldn't find any evidence to support this assertion. I checked the resource utilization graphs provided by Linode, as well as my firewall logs, system's process list, active connections, recently modified files, user accounts, and so on, and found absolutely no anomalies. The results from the Google search didn't seem to back up the claim that nobody else likes the traffic either; nothing I saw in the first few results raised any red flags. So either the server is fine, or I'm dealing with an adversary who knows how to cover their tracks so well that I can't imagine why they would have any interest in my Linode. (There is no sensitive data on it.)

This leads me to wonder whether the message could have been a form of phishing. In this particular case, I doubt it, but could something like this be a legitimate social engineering tactic? Is there something I would be likely to reveal by replying to this message which could be used against me in some way I can't think of?

If and when this happens in the future, my goal is to respond in a way that allows me to collect the information I need to track down the attack in case it is real, while not revealing anything too compromising in case it isn't real.

Answer 1

The message itself isn't phishing, but it could be the first stage of a social engineering attack.

The message (that you quoted) isn't asking you to do anything specific, so it is benign. But, if you reply asking for further details, they might ask you to do something specific (run a program, log into their service, etc.), which would be an attack.

Otherwise, the person could be confused. I see no harm in replying and seeing what the next step is.

Answer 2

The search results you get from that link are unlikely to mean anything. There are 100s of sites which will allow you to obtain information about an IP address. These sites in their nature will consist mainly of dynamically generated pages, and many of the sites are not blocking these through robots.txt. Which means they can show up in search engines.

The result is that any IP address you search for is likely to produce loads of results of little relevance. The number of results is going to vary depending on the IP address. It is plausible that the number of results will tell you something about how much interest the general public has in that particular IP address. But a high number can't be assumed to indicate a good reputation or a bad reputation.

All of these generated pages make it hard to find out if there are some really interesting pages somewhere among the search results. If all of the search results are dynamically generated pages, which will be present for very IP you search for, then they are of no interest. If however you were to find somebody mentioning your particular IP address in a question on security.stackexchange.com or serverfault.com, then that is definitely interesting.

If what you cited is the entire email, then that is a clear indication that the sender is either incompetent or malicious. A legitimate email should have contained some actual details about the observed traffic.

An incompetent sender might have misinterpreted lots of results when searching for the IP address as indicating a bad reputation. A malicious sender might actually own some of the search results that you are seeing. In theory there could be malware on those pages, though it would seem like a quite odd way to draw visitors to a page with malware.

Clicking on any of the links in the search results or answering the email will give that sender some more information about you. For example they could learn about the IP addresses of other machines you are using. And it will of course also tell them that somebody has read the email.