This reminds me of the vigilante web security scanner sites who scan whatever infrastructure belongs to you, according to whatever sketchy mapping they use, and

This reminds me of the vigilante web security scanner sites who scan whatever infrastructure belongs to you, according to whatever sketchy mapping they use, and then publish a "report" with all their "findings". The findings are (nearly) all meritless, but it creates a lot of annoying work if a higher-up in the company (who doesn't know that it's a shakedown) says that the report needs to be addressed.