The scanning is being done by CISA’s Attack Surface Evaluation team, according to one of the ​sources