Why Is My Server Receiving Traffic From Government-Owned IP Addresses?

Check the addresses with reliable WHOIS and routing data, and look for ordinary explanations such as automated scanners, misconfigured systems, proxies, spoofed headers, or reused cloud infrastructure. An Nginx log only records the source address that reached the server; it doesn’t prove who was operating the system or why.

If the traffic is abusive, focus on its behavior rather than the organization name. Preserve the logs, identify the requested URLs and rate, apply sensible rate limits or blocking, and check whether the requests are exploiting anything. If there is a suspected routing problem or an address appears to be used improperly, use the abuse or network-operations contact listed in the address registration records.

It’s hard to interpret this without seeing the actual log entries. First confirm what you’re measuring: request paths, user agents, timestamps, response codes, and connection patterns. IP ownership databases can also be inaccurate or misleading, so an address appearing government-owned doesn’t necessarily mean an agency employee is intentionally targeting your server.