How do I find my hacker 1

[Smarty]

Our website has been hacked. Is there any possibility how I can find who might have hacked my website? I have some logging:

HTTP_ACCEPT_LANGUAGE:nl HTTP_CONNECTION:Keep-Alive HTTP_HOST:

http://www.lucronbioproducts.com

HTTP_REFERER:

http://www.lucronbioproducts.com/_V...p://www.lucronbioproducts.com/Admin/index.asp

HTTP_USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) ASPSESSIONIDQCBCTBRR=OHHLEFCDDLKIKKBGPDKKLBKD HTTP_CONTENT_LENGTH:134 HTTP_CONTENT_TYPE:application/x-

http://www-form-urlencoded

HTTP_ACCEPT_ENCODING:gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
LOCAL_ADDR: 62.212.81.132
LOGON_USER:
REMOTE_ADDR: 80.65.116.60
REMOTE_HOST: 80.65.116.60

Where do I start?

 

[sleipnir214]

Here's what I did:

First I went to

http://www.arin.net

and entered the REMOTE_ADDR into their whois search. That entry told me that the record is maintained by RIPE, not ARIN.

So I went to

http://www.ripe.net

and punched in the REMOTE_ADDR into their whois search. That told me the IP address involved is registered to a ISP in the Netherlands.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[eyec]

following is info on the ip addresses you listed. remember that a hacker may be about to spoof these but at least you have a starting point to let the other domains know about this as well. you may also want to add these ips to you blocke list.

good luck


Target: 62.212.81.132
Date: 1/24/2005 (Monday), 1:26:41 PM
Nodes: 15
52.083N 5.133E

Node Data
Node Net Reg IP Address Location Node Name
15 1 1 62.212.81.132 Utrecht green.peweb.nl


Packet Data
Node High Low Avg Tot Lost
15 0 ---- 0 39 40


Network Data
Network id#: 1
This is the RIPE Whois query server 2.
The objects are in RPSL format.

Rights restricted by copyright.
See

http://www.ripe.net/db/copyright.html

inetnum: 62.212.81.0 - 62.212.81.255
netname: LEASEWEB
descr: LeaseWeb
descr: P.O. Box 616
descr: 3500AP, Utrecht
descr: Netherlands
descr:

http://www.leaseweb.nl

remarks: Please send email to abuse@leaseweb.nl for complaints
remarks: regarding portscans, DoS attacks and spam.
country: NL
admin-c: ZCA1-RIPE
tech-c: LT303-RIPE
status: ASSIGNED PA
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20031209
source: RIPE

route: 62.212.64.0/19
descr: OCOM
origin: AS16265
remarks: Ocom
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20031209
source: RIPE

person: Cornelis Zwinkels
address: P.O. Box 616
address: 3500 AP Utrecht
address: Netherlands
phone: +31 30 2368696
fax-no: +31 30 2368779
e-mail: ripe@ocom.com
nic-hdl: ZCA1-RIPE
remarks: Ocom B.V.
remarks:

http://www.ocom.com

notify: ripe@ocom.com
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20031224
source: RIPE

person: Laurens Rosenthal
address: P.O. Box 616
address: 3500 AP Utrecht
address: Netherlands
phone: +31 30 2368696
fax-no: +31 30 2368779
e-mail: ripe@ocom.com
nic-hdl: LT303-RIPE
remarks: Ocom B.V.
remarks:

http://www.ocom.com

notify: ripe@ocom.com
mnt-by: OCOM-MNT
changed: ripe@ocom.com 20031224


Registrant Data
Registrant id#: 1

Rights restricted by copyright. See

http://www.domain-registry.nl/whois.php

Domain name:
peweb.nl (first domain)

Status: active

Registrant:
PeWeb.NL
Uitloper 66
8256 CD BIDDINGHUIZEN
Netherlands

Domicile:
N/A

Committed to ADR: no

Administrative contact:
L. Peters
+31 (0)321332134
postmaster@peweb.nl

Registrar:
PeWeb.NL - EuSelect (*/d)
Uitloper 66
8256 CD BIDDINGHUIZEN
Netherlands

Technical contact:
Th. Peters
+31 (0)321332134
hostmaster@peweb.nl

Technical contact:
N. Mooney
+31 (0)321333743
hostmaster@euselect.com

Domain nameservers:
ns1.peweb.nl 62.212.81.128
ns2.peweb.nl 62.212.81.129

Date registered: 24-08-1999
Record last updated: 26-05-2003


Target: 80.65.116.60
Date: 1/24/2005 (Monday), 1:29:58 PM
Nodes: 18


Node Data
Node Net Reg IP Address Location Node Name
18 1 1 80.65.116.60 Enschede ip116-60.dsl.introweb.nl


Packet Data
Node High Low Avg Tot Lost
18 165 125 127 12 0


Network Data
Network id#: 1

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 80.0.0.0 - 80.255.255.255
CIDR: 80.0.0.0/8
NetName: 80-RIPE
NetHandle: NET-80-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH62.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at

http://www.ripe.net/whois

RegDate:
Updated: 2004-03-16

ARIN WHOIS database, last updated 2005-01-23 19:10


Registrant Data
Registrant id#: 1

Rights restricted by copyright. See

http://www.domain-registry.nl/whois.php

Domain name:
introweb.nl (first domain)

Status: active

Registrant:
IntroWeb B.V.
Welbergweg 30
7556 PE HENGELO OV
Netherlands

Domicile:
N/A

Committed to ADR: yes

Administrative contact:
R. Esschendal
+31 (0)742430105
postmaster@introweb.nl

Registrar:
IntroWeb B.V. *) /p
Welbergweg 30
7556 PE HENGELO OV
Netherlands

Technical contact:
Pieter de Haer
+31 (0)742430105
domain-admin@introweb.nl

Technical contact:
Duco Waterreus
+31 (0)742430105
domain-admin@introweb.nl

Technical contact:
Edwin Ringersma
+31 (0)742430105
domain-admin@introweb.nl

Domain nameservers:
ns1.introweb.nl 80.65.96.40
ns3.introweb.nl 62.165.127.222

Date registered: 02-02-1996
Record last updated: 23-12-2004

 

[eyec]

80.65.116.60
Location: Enschede
52.267N 6.800E

 

[Smarty]

Thank you, PEWEB is our hosting company... I sended an email to the other company. If I don't get an answer, I will give them a phone call.

If any other steps are possible, please let me know

 

[eyec]

look inward for source of hacking!

 

[eyec]

check your user logins surrounding the time of the incident including remotes.

 

[Hondy]

Unfortunately any hacker that knows what they are doing will have used at least one proxy to hide their address or use an already compromised machine to launch an attack.

At a guess your admin function has been abused in which case someone knows your password or it has no protection against a brute-force attack. Check your webserver log for multiple guesses in alphabetical order this will give you a clue as to whether they knew the password or hacked it. Hopefully your user id isn't "admin" or "administrator" or something obvious, if it is change it to something obscure and change the password too.

If the attacking address is in the same hosting company the chances of this being random are slim, you need to determine if the attacker knew the password or broke in. If they broke in you will have thousands of repeating log entries in your webserver log.