Your pprof is showing: IPv4 scans reveal exposed net/http/pprof endpoints:

Golang’s net/http/pprof package is incredibly powerful: it’s trivial to debug a running production server. In the process it’s equally easy to accidentally expose your debugging information to the world. In this post we use the zmap project to show this is a real problem in the wild, and explain preventative measures you can take. Update: an earlier version suggested an exposed endpoint could leak

[tmatsuu]

golangのnet/http/pprofは超絶便利だけど、うっかり外部から/debug/pprof/*にアクセスできるようになっていないか確認しような。