Watching the Scanners Scan Us
We build a threat intelligence platform, so it felt honest to point the lens at ourselves for once. Here's a few hours of raw traffic to setecastronomyinc.com — no cherry-picking, just what actually showed up while we were working on something else entirely.
The usual suspects
A steady trickle of requests for paths that don't exist on our site, because we don't run the software they're checking for:
/actuator/beans
/actuator/env
/actuator/loggers
/actuator/heapdump
/actuator/threaddump
/actuator/configprops
/actuator/mappings
/actuator/gateway/routes
/config/application.properties
/bootstrap.properties
That's Spring Boot Actuator — a Java framework feature that, when left exposed without auth, hands over your app's entire internal object graph. Sometimes credentials wired straight into a bean constructor. It's one of the most consistently scanned-for misconfigurations on the internet, and it's been that way for years. We're a Python/FastAPI shop. None of it exists here. Every single one of these 404s.
Right alongside it, the credentials-fishing family:
/.env
/.env.dev
/.env.swp
/.env.php.bak
/wp/.env
/laravel/.env
/storage/.env
/config/.env.php
/config/env/aws_credentials.env
/.vscode/.env
/.vscode/api/.env
/.vscode/api/backend/.env
/.vscode/api/backend/core/.env
/.git/config
Somebody, somewhere, left an .env file world-readable often enough that scanning for a dozen variations of the path is worth automating. And the classics never really go away:
/admin/login/
/wp-admin/
/xmlrpc.php
None of this is aimed at us specifically. It's the same handful of scripts running against every public IP on the internet, all day, forever — what security people sometimes call internet background radiation. We happen to have a platform built to catch exactly this category of traffic, so watching it arrive is a little bit funny instead of alarming.
The actual surprise
Here's the part we didn't expect going in: a meaningful chunk of this traffic isn't shady-hacker-movie stuff at all. It's AI crawlers.
In a single tight burst — the same handful of seconds — our logs recorded YiBot (01.AI), ChatGLM-Spider (Zhipu AI), Kimi-SearchBot and KimiBot (Moonshot AI), PanguBot (Huawei Cloud), MistralAI-User, DuckAssistBot, Amazonbot, cohere-ai, OAI-SearchBot and GPTBot (OpenAI), and — genuinely — Claude-SearchBot, all hitting the exact same actuator and config paths, in the same order, within seconds of each other. That's not a coincidence and it's not each of these companies independently deciding to check us for exposed Spring Boot secrets. It's almost certainly one underlying recon toolkit, run by whoever operates the crawling infrastructure behind several of these bots, doing generic vulnerability sweeps as a side effect of crawling the open web.
We're not publishing source IPs here, for an honest reason rather than a dramatic one: like most sites, we sit behind Cloudflare, and what our access log actually records for these hits is Cloudflare's edge address, not the real origin. Publishing that as "the attacker's IP" would just be wrong, and we'd rather leave it out than get it wrong for the sake of a screenshot.
Why we're not worried, and why that's the point
Every path above returned a clean 404. Nothing here is a vulnerability report — it's a reminder of what "connected to the internet" actually means by default: constant, automated, indiscriminate probing, whether you're a Fortune 500 company or a two-person shop that launched three weeks ago.
Most of what we do at SATIS lives one layer below this — BGP-level blackholing for the IPs actually running attacks, not just scanning for one. But the instinct underneath both is the same: don't assume "nobody's looking," assume someone (or something) already is, and build accordingly. If you're running your own infrastructure and want to see what your own logs actually say instead of assuming you're too small to be a target, Shield is exactly the kind of thing we built for that — no transit relationship or public ASN required, just a router that speaks BGP.
Back to Blog