Important date / ip security.. need help

[krappleby025]

UserID Session_START Session_END IP ADDRESS
20 1102368248 1102368631 4403d3bf

The above row is a record from my PHPBB forum, based website, that represents a hacker that nearly got away with 50$ in cash..

as you can see it is all coded.. i need someone who can translate or change this into recognisable format

session_start = date
session_end = date
Ip address = ip address (most important)

can someone do this so i can trace this criminal and have them charged with hacking

cheers

 

[sleipnir214]

I don't know for sure, but Session_START and Session_END look like Unix timestamps. IP ADDRESS could be a hexadecimal representation of an IP address -- each two hex digits represent one octet of the address.

If so, this PHP script:

<?php
$a = 1102368248;
$b = 1102368631;
$c = '4403d3bf';

print date('Y-m-d H:i:s', $a);
print "\n";
print date('Y-m-d H:i:s', $b);
print "\n";

for ($counter = 0; $counter < 4; $counter++)
{
	print hexdec(substr($c, $counter * 2, 2));
	if ($counter !=3)
	{
		print ".";
	}
}
print "\n";
?>

Outputs:

2004-12-06 15:24:08
2004-12-06 15:30:31
68.3.211.191


Do these values look reasonable?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[DRJ478]

Timestamps:
Mon, 06 Dec 2004 21:24:08 GMT (start)
Mon, 06 Dec 2004 21:30:31 GMT (end)
IP: 68.3.211.191 suppsedly:
Name: ip68-3-211-191.ph.ph.cox.net
Address: 68.3.211.191

Good luck. The address is probably spoofed anyway.
You ought to protect your money better.

 

[Olavxxx]

you can do a lookup on the ip on

http://www.ripe.net,

then contact the ISP, if it has some information there.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[sleipnir214]

Not RIPE, ARIN. That address is assigned to an entity in the U.S.


Want the best answers? Ask the best questions!

TANSTAAFL!!