Our "First Seen URL" page did show attempts to access /actuator/gateway/routes this weekend. So I dug in a bit deeper to see what these scans are all about. The scans originate from %%ip:45.155.204.146%% and have been going on for a few days already, but our first-seen list doesn't display them until they hit a threshold to consider the scans significant. We also see scans from a couple of our IPs, but at a much lower level.