You'll see the requests in nginx's access logs, but it might be very hard to isolate them. These would not show the response data (only the length and the respo

You'll see the requests in nginx's access logs, but it might be very hard to isolate them. These would not show the response data (only the length and the response code). But you're right, I'd expect that whatever tactic they used, the prosecution should be able to demonstrate in far more depth how the IP leaked.