I have seen many scan entries on nginx while sharing links on Teams recently. At first I thought its some type of brute force. Even abuseipdb reports categorize it as web attack.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 10 hours ago

I've built a system for sharing confidential files to customers so that we get to know where they get downloaded to and alerted if something is fetched to more than one location. Had to deal with MS 'preview' accesses in that context. Any wild guesses what triggers my return 444 clause 😁

  • source