Ok, then the log should contain IP addresses. Just tested it here on a Debian 10 ispconfig 3.1.15 system that uses nginx, the access.log is like this: Code: root@server1:/var/www/test100.int/log# tail access.log 192.168.0.162 - - [29/Sep/2019:03:34:06 +0200] "GET / HTTP/1.1" 200 923 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.34 Safari/537.36"