On a legacy server, we have an IIS7 site that has multiple IP addresses listed in the IPv4 Address and Domain Restrictions list. We are migrating this site to a new server. When I opened the web.config for the site expecting to find these IP addresses, I was unable to find any of these IPs listed (or even an ipSecurity section). I confirmed this is a custom list (not inherited from parent) and confirmed no IP restrictions exist for the server level either. I even checked my machine.config files for all .net versions.
Where does IIS store these IP restrictions settings if not in the web.config?