Maybe it's a cloudflare controlled scanner? Maybe you published the subdomain in a cert? Snooped traffic is unlikely. This is a good question, if you don't p

Maybe it's a cloudflare controlled scanner? Maybe you published the subdomain in a cert? Snooped traffic is unlikely. This is a good question, if you don't publish a subdomain, scanners should not reach it. If they do, there's a leak in your infra.