This recently appeared in the users support email list for Apache:
On Tue, Aug 31, 2010 at 12:00 AM, [b]personal contact info removed[/b] wrote:
> > I’m using:
> >
> > CustomLog “/var/log/apache2/access_log” “%a %l %u %t \”%r\” %>s %b
> > \”%{Referer}i\””
> >
> > And I occasionally see this right around the time the CPU starts running at
> > 100%:
> >
> > :: – – [27/Aug/2010:12:28:01 -0700] “GET /favicon.ico HTTP/1.1” 200 – “-”
> >
> > %a is supposed to be an IP address, so what IP address is “::”? I’m only
> > somewhat familiar with IPv6 but I’ve never seen “::” before.
http://en.wikipedia.org/wiki/IPv6_address#Notation
One or any number of consecutive groups of zero value may be replaced
with two colons. [ … ]
The localhost (loopback) address, 0:0:0:0:0:0:0:1, and the IPv6
unspecified address, 0:0:0:0:0:0:0:0, are reduced to ::1 and ::,
respectively.
Now, what reason would any client possibly have for using the unspecified ip address when online?
to maintain their privacy is the only legit use I can see myself.