11

So I logged in this morning and someone had DDoSed me. Luckily it only affected one of my five servers. The guy didn't even dare to delete the list of zombie servers he used to DDoS me from my logfile, but changed his IP address.

Is there a way I can trace back to him? Is the nmap analyzer built in a way that I can use it on his zombie servers to find his new IP, or it'll only log people connected as root?

Improve this question
6
  • 1
    @Waterseas It is a question relating to a game about hacking. Perfectly acceptable here.
    – Batophobia
    Commented Dec 16, 2014 at 17:33
  • 2
    @Waterseas You might want to read the tag information.
    – Jeff Noel
    Commented Dec 16, 2014 at 17:33
  • 6
    @Batophobia Originally thought 'hacker-experience' meant the user was asking for someone with hacker experience, didn't realize there was a game with this name. I rescind my previous statement.
    – Waterseas
    Commented Dec 16, 2014 at 17:41
  • 1
    @waterseas Don't worry, it tends to happen a lot on this stack. There's probably at least several FBI, NSA and ATF people that have been driven to drink just keeping up.. :)
    – Shadur-don't-feed-the-AI
    Commented Sep 24, 2015 at 13:41
  • Protecting the question to prevent answers from people who don't realise it's a game.
    – Comic Sans Seraphim
    Commented Sep 24, 2015 at 13:50

3 Answers 3

Reset to default
5

No, you can not find him.

When you get a new IP address from the ISP, there is no link between the old and new IP. There is no way to get the new IP address from the new address. That is what the IP reset is for: giving you a fresh start.

Improve this answer
0
1

Onto Lars's answer, in general no.

But if the guy was stupid enough to upload and install a virus onto your server, then his next DDoS attack would be logged on your server.

Secondly, if you still have the list of IPs from the DDoS result, try going on one of those IPs and check thier logs and see if that same guy DDoS'd someone else.

And I have no bet he is going to come back and DDoS you again.

Improve this answer
-1

Generally, if there is a long list of zombie servers, they will not go to all of them and delete their IP from all of them. It should say, on one of the IP's, "DDoS attack against (your IP) initiated by (their IP)" if I am not mistaken. But if they are on popular servers, such as someone who doesn't understand the importance of log deleting/altering, or on NPC servers, it is possible people just go on and delete all of the logs when they log on instead of just theirs. Please correct me if I'm wrong, but i believe that is how someone tracked me after I DDoS'd them.

Improve this answer
1
  • 2
    The op stated that the DDoSer already changed his IP. This won't work.
    – user114959
    Commented Jun 11, 2016 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .