Today I noticed this entry in my log file:
Connection attempts using mod_proxy: 220.127.116.11 -> 18.104.22.168:80: 1 Time(s)
This is something I do not normally see in my logs. I have a few questions about this:
- What does this actually mean? Does this mean that someone tried to access my server through a proxied connection?
- What is the first IP address? Is this the originating IP?
- What is the second IP address? Is this the server they used as a proxy?
- If what I said for 2 and 3 are correct, how is it that Logwatch (or whatever in Linux is resolving this) can detect the originating IP? I thought that a proxy is supposed to help with anonymity and make it so that the originating IP address is completely masked?
- What does this mean? Are these requests usually from bots that are looking for additional security holes? What's the hole point of going through a proxy to access my server?
EDIT: It looks like 22.214.171.124 belongs to eBay and the other IP belongs to someone in Taiwan. Does this mean someone accessed my server through eBay? Shouldn't eBay's security be good enough to prevent things like that?