[qwertox]

Might as well be a browser extension.

I remember setting up a Confluence server which was only used by me, but had public access (still password protected).

When checking the logs, I noticed an external IP trying to access pages which I had accessed previously, but they got redirected to the log-in page. The paths were very specific, some which I had bookmarked, so it was clear that there was an extension logging my browsing and some server or person then tried to access my pages.