---
title: "Comment by Furqan Ashraf on \"How I Investigate a Suspicious Login on a Linux Server\" | Hashnode"
description: "Solid playbook, the ctime vs mtime timestomping point alone is worth bookmarking. One thing I'd add right at the top, before any of the /proc work: the opening"
url: "https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab3ed7385d6402093317ce1"
---

[Discussion](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d)

Comment [How I Investigate a Suspicious Login on a Linux Server](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Sep 23](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab3ed7385d6402093317ce1)

Solid playbook, the ctime vs mtime timestomping point alone is worth bookmarking.

One thing I'd add right at the top, before any of the /proc work: the opening scenario mentions an SSH session "from an IP address block in a country where your engineering team has zero presence," but that judgment call is doing a lot of work and it's worth making it explicit rather than trusting the alert. A quick geolocation + ASN lookup on the source IP tells you fast whether you're looking at a residential ISP in an unexpected country (bad sign) or just a known corporate VPN exit / cloud NAT range that happens to geolocate oddly (false alarm). ipgeolocation.io's free tier is enough for this, one call gives you country, ASN and organization/network type, so you're not burning time on /proc forensics for what turns out to be a coworker on a company VPN.

Worth wiring straight into the alert itself so the country/ASN shows up before anyone even opens a terminal.

[Asep Sayyad](https://hashnode.com/@asepsayyad007)

[Oct 2](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab3ed7385d6402093317ce1#reply-6abfd6d0ec620802a928efd3)

That's a good point. Country alone shouldn't be treated as proof of a suspicious login. Checking the IP's ASN and organization first can help separate a real anomaly from a VPN or cloud network. I'll definitely consider adding this to the initial triage steps. Thanks!

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 5](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab3ed7385d6402093317ce1#reply-6ac346f803acadaf838233e0)

Thanks Asep. One more cheap triage step to put next to the ASN check: run the source IP against a threat feed before anyone opens a terminal. If it is already listed as an attacker or abuse source, you escalate faster. Disclosure, I work at WhoisFreaks, and our threat intelligence feed covers IP threats along with phishing and malware indicators, scored so you can load them into a SIEM or MISP. There are free samples to test with, and the full feed is a paid license: [whoisfreaks.com/products/threat-intelligence-feed](https://whoisfreaks.com/products/threat-intelligence-feed) Any reputation list works for this step. Just treat a clean result as "no known history", not "safe".