This question already has an answer here:
- How are attacks and APTs attributed? 5 answers
I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like:
[14/Mar/2019 02:05:36] "GET /php/admin HTTP/1.1" 200 2090 [14/Mar/2019 02:05:36] "GET /wordpress/admin HTTP/1.1" 200 8072 [14/Mar/2019 02:05:36] "GET /myphpadmin/login HTTP/1.1" 200 289535
Thankfully, I wouldn't touch PHP with a ten foot pole, so I don't have to worry about any kind of injection attacks or brute force login attempts.
But whenever I track the IPs of these bots/hackers, they seem to be coming from very random places, one I can recall was a German IP address. This incident happened at around 3AM Eastern Time.
The press has been yammering on about this for over two years now, but I'm very confused. If my hackers could easily just assault my servers through a VPN to fake their attack positions, then how exactly would an investigator conclude that their assailants are coming from the cyber red army???