|
Hey, I just thought about something,
if you still have your web servers logs, I bet
your hackers IP is in the web logs.....
He will have been the VERY FIRST person to see the IFRAMES....
They always test their work just after they implemeted the html
modifications...... They normally will be one of the very first hits
in your web logs just after the mods were done so thats a good
way to age the hack and know what time it occurred.....
Keep in mind the last octets of his ip may change because his ISP told me
they only have that one class C for their broadband customers...
:-)
|