2

We were having some issues at work until we found that we are being attacked almost every day. The attacker seems pretty smart - at first he was always using proxy to hide his IP. With scanning I found that they were socks 5 proxy. The last week we had 11 attacks and every time i found the ip i scanned it with nmap. I found that ALL of the 11 different ip addresses were RDP (port 3389 open, and accept rdp connections, checked by myself on ALL of them).

So here follow the questions: 1. Can we trace his real IP back through a socks5 proxy ? 2. Can we trace him if he is using some RDP server to hide his ip ?

Please do not answer like "Call the owner of the proxy server/RDP..." etc. we already tried it and it didn't work, that's why I am writing here.

Thank you very much.

2 Answers 2

1

The only way to get this information is check the proxy's logs, which you have already tried. Even if it does work, often there are no logs to check. (I'm not sure Windows even has the ability to log RDP connections.)

1

Unfortunately, the answer you don't want to hear is the only answer I know of - and I'm pretty sure it's the only answer there is too. Some HTTP proxies pass on a custom HTTP header which gives the IP address of the machine they are proxing for, but I don't believe SOCKS5 has any such mechanism, and with RDP there can't be such a mechamism because the attacker is executing his/her commands directly on the machine they RDPing in to.

So - short answer - NO.

You must log in to answer this question.