Looking back, this started to happen in Aug 2021 from a Digital Ocean IP. After blocking all DO IP's in my router I didn't see this again until late 2023, all except for one coming from Micro$haft IP's. There are likely far more attempts being blocked now in my router that I'm not seeing.

My landing page is being requested, the referrer is simply "binance . com", the user-agent is always this:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36

My web server is now looking for any UA containing Chrome/n where n ranges from 3 to 9. If the Chrome major version ranges from 30 to 99 then I give out the same "I think you're a bot" page regardless what's being requested. No major search engine is being caught by this, so this to me is a safe rule.

But I wonder about the binance thing in the referrer.