I have number of such records in my Apache log:
[Tue Dec 20 01:31:45 2011] [error] [client 220.127.116.11] File does not exist: /var/www/user/data/www/example.com/phpMyAdmin-2.5.4
Where 18.104.22.168 is my server external IP address configured on eth0. Clearly, someone is scanning server on subject of phpmyadmin vulnerabilities. But why all such logs entries show my own server IP address not the attacker? I would like to block such scans. I feel I'm missing something. I use CentOS 5.7 if it matters.
grep proxy /etc/httpd/conf/httpd.conf LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_connect_module modules/mod_proxy_connect.so # enable the proxy server: #<IfModule mod_proxy.c> # CacheRoot "/var/cache/mod_proxy" # End of proxy directives.
I should have mentioned that I have nginx before Apache, but that does not change anything. The same situation had occurred before we deployed nginx as a reverse-proxy.