Home/ Questions/Q 6997195
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T20:15:11+00:00

I run a server for a project of mine. The clients invoke an Update

  • 0

I run a server for a project of mine. The clients invoke an Update check function running as a webservice at start-up. These requests are logged to file.

I use the following function to log to file:

Public Sub Log(ByVal Message As String, ByVal Level As LogEntryLevel, ByVal Additional As Boolean)
   Dim base As String = "C:\SERVER\log\"
   Dim fileName As String = Date.Now.ToString("dd-MM-yyyy") & ".log"
   Dim newString As String = ""
   If Not Additional Then
      If System.IO.File.Exists(base + fileName) Then newString &= vbNewLine
      newString &= Date.Now.ToString("[dd/MM/yyyy HH:mm:ss.fff ") & Level.ToString & "] " & Message
   Else
      newString &= Message
   End If
   My.Computer.FileSystem.WriteAllText(base + fileName, newString, True)
End Sub

I use the following function to get the clients IP-address:

Public Function getIP() As String
   Dim ip As String
   ip = Context.Request.ServerVariables("HTTP_X_FORWARDED_FOR")
   If ip = String.Empty Then
      ip = Context.Request.ServerVariables("REMOTE_ADDR")
   End If
   Return ip
End Function

The log message is constructed as follows:

Log(String.Format("Client {0} invoked CheckForUpdate with [{1}]", getIP, ver), LogEntryLevel.INFO, False)

Some time ago this got logged:

[11-12-2011 22:10:20.730 INFO] Client 10.0.1.4, 127.0.0.1 invoked CheckForUpdate with [0.5]

O_O How can this be returned? Is this normal? Is this possible? How can the request have originated from localhost (127.0.0.1) and at the same time from a remote IP-address? Was the server hacked? Is this a glitch? Can someone please explain this to me?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is very likely the result of a non-anonymous proxy being used to access your server. High-anonymity proxies completely hide the fact that a proxy is being used, and standard anonymous proxies do not show the user’s original IP address, but they do send an X-Forwarded-For header, so they can be detected that way. Non-anonymous proxies, however, simply add the X-Forwarded-For header value to the user’s IP address, and it tends to look exactly like the result you found in your logs. The fact that it was forwarded for 127.0.0.1 implies that they were likely trying some form of nefarious activity, probably submitting a recreated form with modified values.

    • 0