Likely explanation for this type of discovery would be either internet wide scans of known services or happening across these servers while reverse-engineering

Likely explanation for this type of discovery would be either internet wide scans of known services or happening across these servers while reverse-engineering an app / protocol related to the specific service. The former seems to be the case here, as the authors refer to some of their "web-mapping" efforts in the last paragraph and have previously published similar findings [1, 2] they discovered through the same process. You can get starting points for probing into this as a service from places like [3] if you don't want to perform the scan on your own infrastructure - although the tools for this became insanely accessible over the last few years (at least for IPv4 coverage). [1] https://www.vpnmentor.com/blog/report-millions-homes-exposed/ https://www.vpnmentor.com/blog/report-millions-homes-exposed... [2] https://www.vpnmentor.com/blog/report-theta360-leak/ https://www.vpnmentor.com/blog/report-theta360-leak/ [3] https://www.shodan.io/ https://www.shodan.io/