I mean it's pretty easy. If you are seeing GET request in your logs for PHPadmin or Drupal URLs and you're not running those on your server, it's pretty clear they are up to no good and you can block that IP address.