I recently noticed a number of foreign IP addresses connected to my web server have remained active for several days (possibly longer).

This server only hosts a small number of static files so it seems odd for them to stay connected this long.

How can you tell what these client connections are actually doing?

| improve this question | | | | |
  • 1
    Look at your server's access and error logs to see what resources they're requesting. Then restart your server to see if they open connections again, and if they do, lookup their IP's and block them in your firewall, server config, or security module if you think they're not legitimate visitors, application support, or search engine bots. – dan Dec 14 '19 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.