Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I checked my apache logs there's nothing! Neither there is in any other log files I've checked (message, secure, I've watched them all).
My system is running the latest CentOS with all the latest (as of yesterday) patches. The netstat -a output looked like follows: (I only noticed TIME_WAITs , never established new or anything else)
tcp 0 0 ::ffff:internalserverip:http externaluserip:61215 TIME_WAIT
I've now blocked the IP and it keeps requesting my server (gets SYN_SENT in netstat now), so I guess it is some kind of bot! Do you guys have any idéa what it could be and where I can find logs on the requests?!