Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly redacted logfile to illustrate:
5.189.164.217 - - [17/Apr/2020:11:12:30 -0700] "GET [redacted]/wordpress/license.txt HTTP/1.1" 404 562 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
158.181.48.29 - - [17/Apr/2020:14:46:47 -0700] "GET [redacted]/w/license.txt HTTP/1.1" 404 554 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
178.254.50.202 - - [17/Apr/2020:18:45:12 -0700] "GET [redacted]/blog/license.txt HTTP/1.1" 404 557 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
217.11.48.184 - - [17/Apr/2020:22:51:10 -0700] "GET [redacted]/b/license.txt HTTP/1.1" 404 554 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
This specific day the IP addresses all appear to originate from Germany, but this is not the case generally.
Why these repeated GETs for variations license.txt? Is there some known vulnerability being scanned for here? Like if a site responds with a certain license.txt, that is a sign to the client that there's some exploitable vulnerability? Is this something to worry about?