There are many tools available which brute-force filenames. Some of these are more intelligent than others.
For instance, a "dumb" tool may just have a word list, containing probable names for files and directories, such as
A more intelligent tool may look at the files which it already knows about (e.g. by crawling the application) and try to find similarly-named files. In your case, there was a file named
filename.js, so the application likely tried to mangle the name, as TripeHound pointed out in a comment:
Why are these files a problem?
One might be tempted to think that an unreferenced file is "safe", because it's not a part of the application. However, the file is still accessible, and depending on the contents of the file, this may allow an attacker to do various things:
- Unreferenced files may be archives that are left over from deployment and still contain source code, thus allowing an attacker to gain access to that
- Unreferenced files may contain credentials or other relevant configuration data
In general, it's best to avoid having unreferenced files in your webroot. As the name implies, they are not used by the application and thus are only a source of problems.