Is it victim of the enumeration vulnerability, ie between 403 and 405 you can guess what they were busy with and therefore identify the activity? Or do they randomize the numbers, but then just 3 digits seems little for such a big country?