okay, iset up custom log format in nginx and restarted nginx and boom, found his ip address
Code:
log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$host" "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" $request_time';
and then
Code:
access_log /var/logs/nginx/access.log main;