Hi Alex,
That log entry comes from the page Stripe sends the customer back to after paying. Based on the URL parameter passed ochSubscriptions will lookup the temp transaction. If not found you will get this message.
So in this case:
- The temporary transaction doesn't exist anymore: the url is opened again by the visitor, via page refresh, browser history, etc.
- Something other than the customer's browser called the URL, for example a bot, a link checker or a link preview.
- A passed parameter was tampered with or made up. That case is what the "fraud" message is really meant for
Note that this doesn't affect the payment, as this url is only meant to display the payment status to the customer after returning from stripe. payments are processed via the Stripe webhook (which cannot be tampered with)
the IP address belongs to this domain name: nuvemsvr5.albatrozdigital.pt
That is a server, not a user / customer. So likely a bot (the IP address is listed twice on DNS Blacklists > UCEPROTECTL2 and UCEPROTECTL3)
In short: no worries
