Question From where is calling this IP?

[SalvadorS]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.61

Hi everybody,

First of all, thank you very much for trying to help me.

I have an IP address that is always connected to one of my servers:

root@server:/# netstat -plan|grep :80 |awk {'print $5'}|cut -d: -f 1|sort|uniq -c |sort -n
8 109.236.89.219

I added the IP to fail2ban to block it, but it is still there. I searched the logs to find out where the IP is calling from:

root@server:/# grep 109.236.89.219 /var/www/vhosts/*/logs/access_ssl_log
root@server:/# grep 109.236.89.219 /var/www/vhosts/*/logs/access_log

No luck...

So, how can I find out exactly what that IP is doing and where it is coming from?

Thank you in advance.