My sites are hosted in a shared server at Hostgator.Server details:uname -aLinux xxxx.hostgator.com x.xx.x.x86_64 #1 SMP Fri May 1 18:21:30 CDT 2015 x86_64 x86_64 x86_64 GNU/LinuxI was curious to see who is logged into the system and the output I am getting is:$ whome        pts/1        Nov  2 14:11 (x.x.x.x) <= That's melittlebox pts/0        Nov  2 16:54 (186.59.101.53) <= Who is this?$ w littlebox18:29:25 up 48 days, 11:46,  2 users,  load average: 0.02, 0.00, 0.00USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHATlittlebo pts/0    186.59.101.53     16:54    0.00s  0.00s   ?    -I have checked and am not seeing any such user by that name. Hence, there are no bash history files to see the activities (if any) performed. Hosting company says they aren't logged in.I also checked the user logins in the recent past using last and am seeing this user 'littlebox' logged in twice today and once 2 days back.Following are some entries which seems suspicious. My user/root entries have been trimmed off. $ lastlittlebo pts/0        186.59.101.53    Mon Nov  2 16:54 - 18:29  (01:35)    littlebo pts/5        186.39.184.11    Mon Nov  2 08:58 - 09:02  (00:04)    littlebo pts/4        190.113.162.226  Mon Nov  2 08:38 - 09:15  (00:36)    gvr      pts/0        c-73-24-139-94.h Sun Nov  1 22:31 - 16:07  (17:36)    gvr      pts/0        c-73-24-139-94.h Sun Nov  1 00:44 - 14:05  (14:21)    gvr      pts/0        c-73-24-139-94.h Fri Oct 30 22:25 - 12:16  (13:50)    inov2    pts/0        99-45-228-199.li Fri Oct 30 21:17 - 21:27  (00:10)    littlebo pts/0        186.59.101.53    Fri Oct 30 16:30 - 16:47  (00:17)    littlebo pts/0        186.59.40.135    Fri Oct 30 14:40 - 15:27  (00:46)    ittlebo pts/1        186.59.55.133    Tue Oct 27 17:37 - 23:05  (05:28)    littlebo pts/0        186.59.55.133    Tue Oct 27 17:04 - 18:38  (01:33)    littlebo pts/0        186.59.55.133    Tue Oct 27 15:35 - 16:53  (01:17)    jarmad   pts/0        115.178.250.160  Mon Oct 26 19:31 - 20:09  (00:38)    littlebo pts/0        186.59.108.234   Mon Oct 26 14:45 - 19:00  (04:15)    adzcer   pts/1        124.104.204.134  Sat Oct 24 23:18 - 23:43  (00:24)    gvr      pts/0        c-73-24-139-94.h Sat Oct 24 11:41 - 11:43  (00:01)    littlebo pts/1        186.59.108.234   Fri Oct 23 18:14 - 18:44  (00:30)    littlebo pts/0        186.59.108.234   Fri Oct 23 17:33 - 19:52  (02:18)    littlebo pts/1        186.59.108.234   Fri Oct 23 15:51 - 16:03  (00:11)    littlebo pts/0        186.59.108.234   Fri Oct 23 15:31 - 15:52  (00:20)    littlebo pts/0        186.59.0.201     Fri Oct 23 15:19 - 15:25  (00:05)    gvr      pts/0        c-73-24-139-94.h Fri Oct 23 05:55 - 10:00  (04:04)    littlebo pts/0        186.59.0.201     Thu Oct 22 15:11 - 17:35  (02:24)    gvr      pts/0        c-73-24-139-94.h Thu Oct 22 00:33 - 10:23  (09:50)    littlebo pts/0        186.59.121.19    Wed Oct 21 13:17 - 16:35  (03:18)    ramnath  pts/0        117.194.37.189   Wed Oct 21 07:55 - 09:28  (01:32)    littlebo pts/0        186.59.121.19    Tue Oct 20 23:40 - 23:45  (00:05)    littlebo pts/0        186.59.121.19    Tue Oct 20 23:33 - 23:35  (00:02)    jarmad   pts/0        115.178.236.121  Tue Oct 20 20:20 - 21:17  (00:57)    littlebo pts/0        186.59.121.19    Tue Oct 20 19:10 - 19:16  (00:06)    littlebo pts/0        186.59.121.19    Tue Oct 20 00:26 - 00:28  (00:01)    littlebo pts/0        186.59.121.19    Mon Oct 19 20:34 - 20:40  (00:06)    mcclxvii pts/4        69.80.105.74     Sun Oct 18 13:41 - 13:48  (00:07) What to do? Pls help!
Is this a Hacker? What to do?
security;users;webserver