Take the fetch order as a program rather than a visit. The agent went first to addresses that are either standards or long-settled conventions: /legal, /support, and /.well-known/security.txt, the machine-readable security contact defined by RFC 9116 [5]. Then it started guessing: /suites, /contact, /p/field-service-suite, and the product's bare slug /jobora without the /p/ prefix [6]. All four returned 404, and it did not try another spelling before reporting what it found and moving on [7].
That last detail is the whole engineering problem. A human who gets a 404 on /contact scrolls to the footer; the agent took the status code as the answer. Whatever your server returns for an address you never wired up becomes the finding, and the finding goes to the person holding the card.
The vendor is careful about the limits of its own evidence. It says it does not know what the agent's owner asked, only that the fetch pattern is consistent with an instruction along the lines of checking whether the vendor is legitimate before paying [9]. The sentence it believes was in the report, that the site has no contact page, is its inference rather than a log line [10]. The link between agent and buyer is a shared network, a distinct User-Agent, and interleaved timestamps [4]. Accept that inference or the story does not transfer.
The ratio in the log is worth keeping: 7,200 seconds of evaluation against an 11-second order, roughly 650 to 1 [1]. Buying is cheap. Being checked is not.
Four of the five surfaces the vendor now lists were already in place: /llms.txt with every product and its price read from the database at request time [11], schema.org Product and Offer blocks carrying live prices on product, suite and comparison pages [12], security.txt, which the agent fetched third [13], and a pricing page. That pricing page was itself a retrofit, added earlier this month after a different agent guessed /plans, /pricing, /pricing-plans and /plans-pricing in sequence and 404'd on all four [14]. Eight 404s across two agent visits, then [2]. The one missing surface was the least standardised of them: the addresses people actually type, which no RFC will ever tell you [15].
The repair is good engineering and worth naming as such. /suites computes each bundle price, the separate-purchase total and the difference from current single-licence prices on every request, carries no typed figure, and a test refuses any build that contains one [16]. /contact is a permanent redirect to the support page, which grew a contact section for everything that is not a support request [17]. Generated numbers cannot drift from the store; a hand-maintained /llms.txt drifts on the first price change.
What would have to hold for this to be your log too: your buyers are strangers spending real money on software they will run on their own hardware [2], the agent is running a trust check rather than a feature comparison, and the paths it guesses are ones your router has never heard of. If that holds, the work is an index page, a permanent redirect, and the two product URLs it missed, checked from outside your own network [18].
