Mr. Nice Try Notes from the edge

Fraud desk, yesterday

539,032 requests got turned away at the door.

814 login attempts from 444 addresses, 0 confirmed wrong passwords, and 6,460 new tags and bans.

Monday, Oct 19, 2026 (UTC) · see the latest

Share on X Download the GIF
Fraud Desk: 539,032 requests got turned away at the door.

539,032

turned away

▲ +47% vs the day before

814

login attempts

▲ +27% vs the day before

1,704

IPs refused

▲ +3.8% vs the day before

6,460

tags & bans

▲ +21% vs the day before

Ban log requests refused
34.53.x.x · Google LLC 16,293
34.52.x.x · Google LLC 14,855
93.123.x.x · TECHOFF SRV LIMITED 13,947
45.148.x.x · TECHOFF SRV LIMITED 13,280
93.123.x.x · TECHOFF SRV LIMITED 12,875
↳ Fraud is a volume business. So is no.

Every edition: turned away

Oct 7 Oct 19

How I measure

Login attempts are POST requests to login, session or password paths. Failed logins are those whose response (captured on routes where a team turned response capture on) says the credentials were wrong. "Turned away" counts requests blocked or sent to the bot gym at the edge, and requests the site itself refused with a 429 because it had already banned the sender. IP addresses are shown with their second half hidden.

Most refused

The addresses turned away most often, second half hidden.

Address Network Requests refused
34.53.x.x Google LLC 16,293
34.52.x.x Google LLC 14,855
93.123.x.x TECHOFF SRV LIMITED 13,947
45.148.x.x TECHOFF SRV LIMITED 13,280
93.123.x.x TECHOFF SRV LIMITED 12,875
45.148.x.x TECHOFF SRV LIMITED 12,654
35.205.x.x Google LLC 12,537
34.156.x.x Google LLC 11,798

Past editions

Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

A new one every morning.

Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.

More from yesterday

Bot Weather: 48% of yesterday's traffic was scanners.

Bot Weather · Oct 27

48% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

 Most Wanted: Bots' most wanted file: /.env

Most Wanted · Oct 27

Bots' most wanted file: /.env

The files bots asked for most yesterday. It's usually your .env.

 The AI Key Heist: Bots went hunting for AI keys 3,362 times.

The AI Key Heist · Oct 27

Bots went hunting for AI keys 3,362 times.

Bots are hunting for AI API keys. Here's whose they want most.

 Cloud Landlords: 88% of scanning came from rented servers.

Cloud Landlords · Oct 27

88% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

 Speedrun: New sites get scanned in under a minute.

Speedrun · Oct 27

New sites get scanned in under a minute.

How many minutes a brand-new website gets before the first scanner shows up.

 Costume Party: 71% of "browsers" were bots in costume.

Costume Party · Oct 27

71% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.