Dunno if you have access to this, but have you checked your raw access logs (or something similar). I used to own a server that, for some odd reason, 2 or 3 servers on the same network always did a scan of my site/server. We contacted the company and they said it was normal as it was one of their servers doing it (besides DNS, not sure why; there was no remote reboot option on that server). Each of those servers would scan my server at least 15x a day. Just a thought.