This is hard af to prove. Even if it is "nobody visited him" it can be that he was told a couple of days earlier that if he didn't do it, there would be consequences.
Might be a good idea to expose things through a reverse proxy if this is web interfaces. I have *.local.domain.nexus all pointed to my reverse proxy's internal ip address and the reverse proxy makes everything available through https.
This is hard af to prove. Even if it is "nobody visited him" it can be that he was told a couple of days earlier that if he didn't do it, there would be consequences.