There should also be an entry in your services log from 04:06:47p (or perhaps 04:06:46p if it was right on the edge) showing activity on your websocket service. You'll likely see the true client IP shown there. It may just show up as 'WS' depending on how it's named in services.ini.