My site had been hacked today and I was also able to find the injection point in my site. I'm working on how to prevent this in future.
This is my server log:
220.127.116.11 - - "POST /admin/images/uploads/pro_01-04rin.php HTTP/1.1" 200 38597 "http://mywebsite.com/admin/images/uploads/pro_01rin.php" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; SM-G313HZ Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30"
What I know:
- I have tracked down this IP 18.104.22.168 but it leads to nowhere because every hacker uses some kind of proxies, so definitely this is a fake IP.
- Information about User agent is Mozilla/5.0 (Linux; U; Android 4.4.2; AppleWebKit/534.30 UCBrowser/10.10.8.820 U3/0.8.0 Mobile Safari/534.30)
- If every hacker uses proxy then what is the benefit of getting this ip in the server log?
- Is there any other way to get the real ip of the user by any modification in my website so that I can identify who did this?
- As you can see in user agent, there are Android 4.4.2 and UCBrowser/10.10.8.820. What does this mean? Did they hack my website from UC Browser in Android 4.4.2?
I've googled about this but no luck.