Comment by zaptrem

Why do y’all think the attacker was replying all of his requests? Could they be probing for unintentionally exposed endpoints themselves?