Why has vulnerability scanning traffic suddenly increased across my domains?

I’ve seen a similar tenfold increase on a VPS recently. It’s mostly an annoyance, although the unusual traffic can trigger outbound-usage alerts. These bursts tend to appear periodically and then fade when the scanners or botnets move on to another target set.

You’re definitely not the only one. Scanning activity often arrives in waves when a new vulnerability is disclosed or when a botnet updates its list of targets. As long as sensitive files and endpoints—such as .env files, .git directories, admin panels, and outdated services—aren’t exposed, much of this is just automated noise. Keep everything patched, rate-limit requests, and block the most common probe paths.

The bursty pattern is common on smaller deployments. Grouping logs by requested path, source address, and user agent can make it easier to see whether the spike comes from one scanner or many different networks. A sudden increase often means an automated tool has changed its target list rather than someone specifically focusing on your domains.

It could be a mix of legitimate security scanners and ordinary bots impersonating them. Either way, it’s worth hardening the servers, limiting exposed services, reviewing authentication controls, and making sure your monitoring can distinguish routine probes from attempts that reach sensitive areas.