0

Our website appears to be under attack from URLs with MySQL statements in them.

From my PHP code I access $_SERVER['REMOTE_ADDR'] to see a value of 5.39.44.16

I've tried blocking 5.39.44.16 in our firewall but with no success.

Then I look in the Apache access.log but I cannot find 5.39.44.16

  • How can REMOTE_ADDR show an address that has not been logged in my Apache log?
  • Any suggestions on the right way to handle these attacks?
Mateusz Grzejek
  • 11,698
  • 3
  • 32
  • 49
Ian
  • 679
  • 1
  • 8
  • 17

2 Answers2

0

Well not sure this will answer it, but perhaps give you more information to go on. It seems it can't be faked easily since it's set by the web server which is apache. However, perhaps it's using the x-forwarded-for address if it's going through a proxy? I'm not sure why it would be different in Apache versus PHP though. More info on this question: How to fake $_SERVER['REMOTE_ADDR'] variable?

Community
  • 1
  • 1
5kKate
  • 61
  • 5
0

My mistake. I was looking at the wrong Apache log file.

Ian
  • 679
  • 1
  • 8
  • 17