My previous role was at a public facing ecommerce site. One day I started noticing a lot of public traffic to internal administrative endpoints that were failing - likely bots, but also to URLs that bots would have never known existed. Urls that only someone internal to the company would even know existed, due to the complex way they were crafted. It was very concerning.

We spent a LOT of time tracking down, and finally realized that the "bot" traffic was coming about 30 minutes after one of our employees legitimated visited the site. We found that user was using grammarly. Once we deactivated grammarly, all of the bot traffic stopped.

As best as I could tell, every URL that particular person went to in their browsers, grammarly had a service about 30 minutes later that would try and hit the url directly and ascertain what was there.

Haven't been on the crusade against it ever since.