We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address of 220.127.116.11 to our webserver.
We can easily block any connection from and to 18.104.22.168 from IPTABLES but we want to know which of our VIRTUAL HOSTS is receiving this connection or which of our VIRTUAL HOST scripts is making this outgoing connection to that specific IP address.
We are assuming that we have two scenarios. One for INBOUND and one for OUTBOUND
Is there any tool or way to find out exactly what website is receiving the connection or what script on our server is making outgoing connection to that IP?
It is noteworthy it is a CentOS6.5 server and we are using LITESPEED as webserver.