My site had been hacked today and I was also able to find injection point in my site  . I'm working on how to prevent this in future .I'm kind of noobie in security stuff. So I have to clear my confusion .

First of all this is my server log .

8.37.230.5 - - "POST /admin/images/uploads/pro_01-04rin.php HTTP/1.1" 200 38597 "http://mywebsite.com/admin/images/uploads/pro_01rin.php" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; SM-G313HZ Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30"

What I knew already is.

• I have tracked down this ip 8.37.230.5 , but it leads to nowhere.because every hacker uses some kind of proxies . so definitely this is fake ip.
• Information about User agent is Mozilla/5.0 (Linux; U; Android 4.4.2; AppleWebKit/534.30 UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30)

My Doubts Are .

• If every hacker uses proxy then what is the benefit of getting this ip in server log?
• is there any other way to get the real ip of user by any modification in my website . So that I can identify who did this . I hope you get what my trying to say here
• As you can see in user agent  , there are Android 4.4.2 and UCBrowser/10.10.8.820  . SO what does this mean , they hack my website from UC Browser in android 4.4.2  ? is that So.

I've google about this but no luck . Any help or guidance would be welcome .

My site had been hacked today and I was also able to find the injection point in my site. I'm working on how to prevent this in future.

This is my server log:

8.37.230.5 - -  "POST /admin/images/uploads/pro_01-04rin.php HTTP/1.1" 200 38597
"http://mywebsite.com/admin/images/uploads/pro_01rin.php"
"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; SM-G313HZ Build/KOT49H)
AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0
UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30"

What I know:

• I have tracked down this IP 8.37.230.5 but it leads to nowhere because every hacker uses some kind of proxies, so definitely this is a fake IP.
• Information about User agent is Mozilla/5.0 (Linux; U; Android 4.4.2; AppleWebKit/534.30 UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30)

My questions:

• If every hacker uses proxy then what is the benefit of getting this ip in the server log?
• Is there any other way to get the real ip of the user by any modification in my website so that I can identify who did this?
• As you can see in user agent, there are Android 4.4.2 and UCBrowser/10.10.8.820. What does this mean? Did they hack my website from UC Browser in Android 4.4.2?

I've googled about this but no luck.