Our server logs show repeated or unusually frequent requests coming from IP addresses that appear to belong to organizations such as the Department of Defense and the Federal Reserve. How can I verify whether those addresses are genuinely associated with those organizations, and should I treat the traffic as malicious, an investigation, or something harmless?
3 Answers
It’s hard to interpret this without seeing the actual log entries. First confirm what you’re measuring: request paths, user agents, timestamps, response codes, and connection patterns. IP ownership databases can also be inaccurate or misleading, so an address appearing government-owned doesn’t necessarily mean an agency employee is intentionally targeting your server.
If the traffic is abusive, focus on its behavior rather than the organization name. Preserve the logs, identify the requested URLs and rate, apply sensible rate limits or blocking, and check whether the requests are exploiting anything. If there is a suspected routing problem or an address appears to be used improperly, use the abuse or network-operations contact listed in the address registration records.
Check the addresses with reliable WHOIS and routing data, and look for ordinary explanations such as automated scanners, misconfigured systems, proxies, spoofed headers, or reused cloud infrastructure. An Nginx log only records the source address that reached the server; it doesn’t prove who was operating the system or why.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures