Suspicious traffic from web server

I believe I know the answer but I need to ask. Web serve for org on CentOS 7. We have had geoblocking applied from the public internet for Russia. I recently applied geoblocking for high risk counties from our LAN to public internet and logging the traffic. I saw last week, very early in the mor