How did this user change his server [REMOTE_ADDR]?
<p>I've been getting hundreds of error messages the last few days, looks like someone is trying to hack into a restricted part of my site. One security mechanism we use is blocking based on hit counts per IP (ie if one IP hits this page more than x times a week).</p>

<p>The error message includes the server dump, and I can see the hacker is trying to get in by changing his IP address.
And I am just wondering... how on earth did he do that?!</p>

<p>Including here the relevant server vars:</p>

<pre><code>_SERVER dump:
Array
(
    [CLIENTIP] =&gt; 10.0.1.92
    [HTTP_X_REQUESTED_WITH] =&gt; XMLHttpRequest
    [HTTP_X_FORWARDED_FOR] =&gt; -1' OR 2+819-819-1=0+0+0+1 --, 104.196.143.54
    [HTTP_X_FORWARDED_PORT] =&gt; 443
    [HTTP_X_FORWARDED_PROTO] =&gt; https
    [REMOTE_ADDR] =&gt; -1' OR 2+819-819-1=0+0+0+1 --
//etc
)
</code></pre>