This has been going on for FAR longer than LLMs have existed. We call it "internet background radiation", because it's everywhere; it usually shows up within minutes of a host coming online. Or just about immediately after your first LetsEncrypt certificate gets issued.
Pretty much every infosec company of non-trivial size runs one set. The old venerable services are Shodan and Censys. Then there are a various security "researchers" who like to point their crapware vulnerability "scanner" at a subnet or ASN and let it rip.
And then there are of course all the actual botnets and low rent access broker wannabes trying to pop shells where ever they can, so they can resell that access.
This has been going on for FAR longer than LLMs have existed. We call it "internet background radiation", because it's everywhere; it usually shows up within minutes of a host coming online. Or just about immediately after your first LetsEncrypt certificate gets issued.
Pretty much every infosec company of non-trivial size runs one set. The old venerable services are Shodan and Censys. Then there are a various security "researchers" who like to point their crapware vulnerability "scanner" at a subnet or ASN and let it rip.
And then there are of course all the actual botnets and low rent access broker wannabes trying to pop shells where ever they can, so they can resell that access.