When I was running tcpdump and watching output on my new created VPS (OS:CentOS 7.1) via SSH, a message appears suddenly:

OPTIONS sip:100@My_VPS_IP SIP/2.0
Via: SIP/2.0/UDP;branch=z9hG4bK-1736040942;rport
Content-Length: 0
From: "sipvicious"<sip:100@>;tag=3264346531356562313363340132313937303630383239
Accept: application/sdp
User-Agent: friendly-scanner
To: "sipvicious"<sip:100@>
Contact: sip:100@
Call-ID: 557316745284479406993575
Max-Forwards: 70

I firstly thought I have received a fake ip email, and confused, for I have never setup an email service.

Here comes the result of ss -tunpl:

[root@localhost ~]# ss -tunpl
Netid State      Recv-Q Send-Q                            Local Address:Port                                           Peer Address:Port              
Cannot open netlink socket: Protocol not supported
udp   UNCONN     0      0                                             *:46413                                                     *:*                   users:(("ss-server",pid=25065,fd=5))
udp   UNCONN     0      0                                            :::443                                                      :::*                   users:(("kcp_server",pid=25027,fd=3))
Cannot open netlink socket: Protocol not supported
tcp   LISTEN     0      0                                             *:22                                                        *:*                   users:(("sshd",pid=128,fd=3))
tcp   LISTEN     0      0                                                                                 *:*                   users:(("ss-server",pid=25065,fd=6))
tcp   LISTEN     0      0                                            :::22                                                       :::*                   users:(("sshd",pid=128,fd=4))
[root@localhost ~]# 

Program ss-server and kcp_server are both something like a socks5 proxy server with authorization forced, which means nothing about email service has been install in my VPS(even mail is Command not found).

At the mean time, the ssh only allow RSA authorization, and I am sure my private key is safe enough. And, the w command shows that there is only one user online.

But, above are not important. The reason why I call this a ghost email is that both /var/mail/ and /var/spool/mail/ have only one empty file called rpc :

[root@localhost ~]# ls /var/mail       
[root@localhost ~]# file /var/mail/rpc 
/var/mail/rpc: empty
[root@localhost ~]# ls /var/spool/mail/    
[root@localhost ~]# file /var/spool/mail/rpc 
/var/spool/mail/rpc: empty

The email I have received disappeared!

I hope this is not a security BUG which can make my VPS unsafe.

But, the most important thing is: I want to know how it could be happened? What is the mechanism behind it?


This is a SIP (VoIP) probe, and nothing to do with SMTP or Email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.