It looks like any subdomain I expose of the form '%word%word%d%d' gets clobbered by scanners.
edit: Nope. It's hitting complete nonsense too. Even with nothing on the 'backend' a random 12 char subdomain gets scanned. Yet somehow one resource isn't getting touched......
edit 2: Pangolin logs show I'm getting scanned within minutes of creating a resource. The only subdomain not showing scanning requires specific headers.
edit 3: Looks a lot like normal 'background' scanning is being redirected on my end. Stopping here for now.
Edit 4: Even the resource requiring specific headers is getting hit now. Geoblock dropping everything, but that is an imperfect blunt instrument, unintended traffic shouldn't be able to find the URL.