It said the requests came from the Dept of Homeland Security servers, the assumption is anybody using that domain/server location would be employed by them.