Is it possible to track back someone who DDoS me and changed his IP address?

Question

So I logged in this morning and someone had DDoSed me. Luckily it only affected one of my five servers. The guy didn't even dare to delete the list of zombie servers he used to DDoS me from my logfile, but changed his IP address.

Is there a way I can trace back to him? Is the nmap analyzer built in a way that I can use it on his zombie servers to find his new IP, or it'll only log people connected as root?

@Waterseas It is a question relating to a game about hacking. Perfectly acceptable here. — Batophobia, Dec 16 '14 at 17:33
@Batophobia Originally thought 'hacker-experience' meant the user was asking for someone with hacker experience, didn't realize there was a game with this name. I rescind my previous statement. — Waterseas, Dec 16 '14 at 17:41
@waterseas Don't worry, it tends to happen a lot on this stack. There's probably at least several FBI, NSA and ATF people that have been driven to drink just keeping up.. :) — Shadur-don't-feed-the-AI, Sep 24 '15 at 13:41
Protecting the question to prevent answers from people who don't realise it's a game. — Comic Sans Seraphim, Sep 24 '15 at 13:50
@studoku Not sure quite how much that's going to help in this question — Waterseas, Sep 25 '15 at 13:40

score 5 · Accepted Answer · answered Feb 12 '15 at 15:09

5

No, you can not find him.

When you get a new IP address from the ISP, there is no link between the old and new IP. There is no way to get the new IP address from the new address. That is what the IP reset is for: giving you a fresh start.

answered Feb 12 '15 at 15:09

Lars Ebert

351
4
19

score 1 · Answer 2 · answered Jun 13 '15 at 04:41

Onto Lars's answer, in general no.

But if the guy was stupid enough to upload and install a virus onto your server, then his next DDoS attack would be logged on your server.

Secondly, if you still have the list of IPs from the DDoS result, try going on one of those IPs and check thier logs and see if that same guy DDoS'd someone else.

And I have no bet he is going to come back and DDoS you again.

score -1 · Answer 3 · answered Aug 29 '15 at 21:31

Generally, if there is a long list of zombie servers, they will not go to all of them and delete their IP from all of them. It should say, on one of the IP's, "DDoS attack against (your IP) initiated by (their IP)" if I am not mistaken. But if they are on popular servers, such as someone who doesn't understand the importance of log deleting/altering, or on NPC servers, it is possible people just go on and delete all of the logs when they log on instead of just theirs. Please correct me if I'm wrong, but i believe that is how someone tracked me after I DDoS'd them.

The op stated that the DDoSer already changed his IP. This won't work. — , Jun 11 '16 at 17:30

Is it possible to track back someone who DDoS me and changed his IP address?

3 Answers3