I have found in my server access logs that someone is trying to access GXHLGSL.txt file. It looks like automated test (it was right after trying wp-login.php).
When I googled that file I found it on several sites. It contains word TEST.
What is a purpose of it? To mark sites that allow file uploads?
There sure are a lot of sites out there with this file. It looks like someone trying to test the ability to upload a file, or upload a file and then modify it maybe.
I can't find any description of this file name being from a specific vulnerability scanner, I'd say you are right that this is a bot and not human, they could be marking sites as Google seems to index them, though I'd expect malicious users to attempt to cover their tracks and not leave evidence behind of their visit.
Things you could do - delete the file, check your permissions on your upload directory, make sure no one can execute anything, check your permitted file types and how you are preventing them, consider banning this IP and consider preventing indexing via robots file if you don't need it.
