{"ip":"147.185.132.135","total_events":786,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"71,313 bytes sent","bytes_sent":71313,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-19T01:50:18","last_seen":"2026-09-21T20:23:20","events_24h":4,"events_7d":24,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":97},{"port":3388,"proto":"tcp","label":"","count":27},{"port":20257,"proto":"tcp","label":"","count":26},{"port":3390,"proto":"tcp","label":"","count":22},{"port":9983,"proto":"tcp","label":"","count":11},{"port":10001,"proto":"tcp","label":"","count":10},{"port":20256,"proto":"tcp","label":"","count":8},{"port":8088,"proto":"tcp","label":"Hadoop","count":8},{"port":7001,"proto":"tcp","label":"WebLogic","count":7},{"port":7547,"proto":"tcp","label":"TR-069","count":7},{"port":8081,"proto":"tcp","label":"","count":6},{"port":8015,"proto":"tcp","label":"","count":6},{"port":4567,"proto":"tcp","label":"","count":6},{"port":50067,"proto":"tcp","label":"","count":6},{"port":1911,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c2030378307e0a657ec0c9a08aee43a3718b69a4ca9cd5c477ab883249c510f152fbf92005e2a94c62d3d2034da2a0c7199c37e996bc3780af17f41bff790ebc7c98bccb001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c06997cbed29c738955eabd8cb58c2339aec3ab4bb2308fcccadab96f7b8c746843d0ddb871948a78e363e5fd22b1f0607d487528217ce2ff55ca410324cf95dbf78960011a626e4456f347b751246b721a076d50ef35396eaa4b7c412bbcc585854d3339c96551ef1751ff210731bc70d7b9ea801812ab07479e56280e5245a293fff4036c7526788774ff068a75084c018a17bf4b37f0792a8f7d6874c448652db3b74dacb229659f19a8b4a441d0fa18a3876bb913002661884207ba87ecb4d0470cccb85b7d816bd80ea395a03add0666a16b9a6a40bbde9105fd0b958ec933a45d279ef960753cc88f5b666e6f6a602f60c7247564e6ca19fec9c1946b60376688ef92cfe812dd4a31ee2999f6e3c8da6c27da0953de71a2e0a335aca2466cdb56df3b7b2455496d60a09da9a9f0cc13f0d45876ce67e2734b32a770d1b822ded702dbdc9ba0e3b0910b47ab62cc2ca110cb014c4de7b7404fa483770c131a43e14647a7244699d416a08439913d70ef0e62ecb6b024a38a1c9031cfb0633def59eae2bbe4e77844cb5a10e532a68827653478f3541c05e4915714b8cde13b577d02a1995cba698bc26ea7429c2976a14c3d6b30c31f9c373a4c216d8a005301c2d91a349138c9412cbc061bc2916a04b2bc73be410a1137520e028dd15ad131409cd6246378a094a91cb53291ecad0a96e7b7cb042b994c4b687a32869612986ab7b70e1c6bad14269509860b2a30a6b4fa9bb13fd4c7f09190ee8f45a937b9edae56a77d4c428facb8456abcfa8c0bc3bbac1a1bc1a42c6b065a52b371b61c5346121785de20073ca202cb8773631afc9c106726986c701697895436c29540f486854052896710684e4329ae3196fc107eabc6aed27434b463fafd42279041da4fc6e0b6b7bc4ab8e5d161ac834447aa48418b264efeb3d7f2a3a36b19a4ab944b5f5c6c93a07eea36c37c81d36c0299eb460ed9620c1599c8144649d508209f97d944a0ea43656dc8a89dcf5864a8b9820906dfaf11dad98a68ed6ae319451d83679757129b9c93e5d9ba573ec9061c9553e4a0d8a81725c8980f484b3c3f2cacdda56f24ab96d67579196cd07eb98e726ace9ac176c714f8916bfdb974f76a3c4639a6a1abcab9f40bbb8b92e527884e575bda079522e7b648a4878722248da042e29bc30b959994244bb82cc5825010f0cf95b7abaabbb05a16970cd08d5bba2e3c028397a09e394c4a945547b720a706efe632cf4865f015a6e4c1281dcd5a6d71cc7c5baa074c638f1540eaf4b95965a2081e26d46fc3bd0b3c9109604d5abc33f85488f59a211712c5c93bc7589ce6a67a2de87504a894def16bb81523483e7821675318cf990cd45c8b086b14c0061b4aa46a40b5db1a5761bac659e6b2a2bb7359d685e51781888d440e0b7700775b0da418a6b62822753b722f720791508eb52c014d1b14d5b2ef2e411b971404e7342f0c930dda1c61cd33d573743de406106ecb6710306506ccb75bb2ba985070eb746174208b66460bca5b70890a3545c6349a965646cac1228cccf061a3cccce8272b66d528272cb10cd19ae869663e3352a899aadb9179918036bd0341f183350c5640a11350a5f7ba60a10dbbe9c270f71f2450c87b5ab9062d3ad47321b20390fc8e9c0899111411245f49f2700b3e2d17980a4052f568cfcb265fd721e3c25c594f645984da8b305001d002045f49f2700b3e2d17980a4052f568cfcb265fd721e3c25c594f64598","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2896,"t13i140900_cbb2034c60b8_e7c285222651":724,"t13i311000_e8f1e7e78f70_24695f2957a7":518,"t13i131000_f57a46bbacb6_ab7e3b40a677":5173},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-06-24","count":3},{"date":"2026-06-25","count":3},{"date":"2026-06-26","count":4},{"date":"2026-06-27","count":1},{"date":"2026-06-28","count":7},{"date":"2026-06-29","count":9},{"date":"2026-06-30","count":8},{"date":"2026-07-01","count":4},{"date":"2026-07-02","count":3},{"date":"2026-07-05","count":22},{"date":"2026-07-06","count":2},{"date":"2026-07-07","count":2},{"date":"2026-07-08","count":2},{"date":"2026-07-09","count":2},{"date":"2026-07-10","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-12","count":4},{"date":"2026-07-14","count":16},{"date":"2026-07-15","count":6},{"date":"2026-07-16","count":1},{"date":"2026-07-17","count":2},{"date":"2026-07-19","count":3},{"date":"2026-07-20","count":3},{"date":"2026-07-21","count":2},{"date":"2026-07-22","count":3},{"date":"2026-07-23","count":3},{"date":"2026-07-24","count":1},{"date":"2026-07-25","count":5},{"date":"2026-07-26","count":5},{"date":"2026-07-27","count":5},{"date":"2026-07-28","count":4},{"date":"2026-07-29","count":5},{"date":"2026-07-30","count":4},{"date":"2026-07-31","count":1},{"date":"2026-08-01","count":1},{"date":"2026-08-02","count":5},{"date":"2026-08-03","count":14},{"date":"2026-08-04","count":4},{"date":"2026-08-05","count":4},{"date":"2026-08-06","count":2},{"date":"2026-08-07","count":3},{"date":"2026-08-09","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":3},{"date":"2026-08-13","count":6},{"date":"2026-08-14","count":4},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":14},{"date":"2026-08-17","count":5},{"date":"2026-08-18","count":2},{"date":"2026-08-19","count":3},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-22","count":4},{"date":"2026-08-23","count":6},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":13},{"date":"2026-08-26","count":7},{"date":"2026-08-27","count":2},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":8},{"date":"2026-08-30","count":4},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":6},{"date":"2026-09-02","count":3},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":4},{"date":"2026-09-05","count":4},{"date":"2026-09-06","count":6},{"date":"2026-09-08","count":5},{"date":"2026-09-09","count":7},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":2},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-14","count":3},{"date":"2026-09-15","count":1},{"date":"2026-09-16","count":2},{"date":"2026-09-17","count":10},{"date":"2026-09-18","count":1},{"date":"2026-09-19","count":2},{"date":"2026-09-20","count":4},{"date":"2026-09-21","count":5}],"recent_events":[{"timestamp":"2026-09-21T20:23:20","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:4443\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a343434330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"e4e5dbe5-ebec-4012-a3c7-69e2402ff311","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":80},{"timestamp":"2026-09-21T19:40:54","port":13456,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"host\":\"185.228.81.201:13456\",\"user-agent\":\"curl/7.68.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a31333435360d0a557365722d4167656e743a206375726c2f372e36382e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.68.0","ja3":"004556e859f3c26c5d19746b3a957c74","session":"5c274b0c-fdce-486f-8042-f97cc6646ddc","seq":1,"duration_ms":206,"bytes_in":84,"bytes_out":80},{"timestamp":"2026-09-21T16:13:19","port":41795,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"54b1f96f-b4e0-4678-bdb2-79a14af972fb","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15},{"timestamp":"2026-09-21T16:13:19","port":41795,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"fc92a275-b017-41af-bec1-3fb718cea7c7","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15},{"timestamp":"2026-09-21T00:52:56","port":23656,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:23656\",\"user-agent\":\"curl/7.68.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32333635360d0a557365722d4167656e743a206375726c2f372e36382e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.68.0","ja3":"004556e859f3c26c5d19746b3a957c74","session":"072d33f6-6dc8-4ac5-aa24-28d6380010cb","seq":1,"duration_ms":208,"bytes_in":83,"bytes_out":80},{"timestamp":"2026-09-20T16:09:47","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0004\u0000\u0001\u0002�\u0005\u0001\u0000\u0003\ngoogle.com\u0000PGET / HTTP/1.0\r\n\r\n","payload_hex":"050400010280050100030a676f6f676c652e636f6d0050474554202f20485454502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"341b5e6b-bf31-4941-b9b2-b0b9f2a2baa4","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":15,"enriched":{"digest":"f1c3af0c6976ce07","label":"SOCKS5","strings":["google.com","PGET / HTTP/1.0","google.comPGET / HTTP/1.0"],"iocs":{"domains":["google.com","google.compget"]}}},{"timestamp":"2026-09-20T12:12:26","port":1801,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0010\u0000\u000b\u0000LIOR<\u0002\u0000\u0000����\u0000\u0000\u0002\u0000\u0006U=Q6��@�C\u0017\\<�l�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�)\u001d\u0006\u0010\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"10000b004c494f523c020000ffffffff0000020006553d5136dfc7409643175c3ce76caa00000000000000000000000000000000d2291d06100300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"175a3eae-4e38-4234-96c4-5723bfa0ba71","seq":1,"duration_ms":100,"bytes_in":572,"bytes_out":15,"enriched":{"digest":"b5ce6aaf1d6f40a3","strings":["LIOR<","U=Q6"]}},{"timestamp":"2026-09-20T05:32:46","port":60243,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:60243\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303234330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"88c8ae8b-5637-4888-93a0-128077e40444","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-20T03:57:50","port":31337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33313333370d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"eb796183-0473-4cfd-b02d-d07584685e73","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-19T04:09:20","port":1250,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1250\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313235300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"603a4a7c-abc9-4da2-9c2f-9a429843bec3","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":80}],"http_methods":[{"method":"GET","count":370},{"method":"POST","count":5}],"distinct_ports_total":265,"top_paths":[{"path":"/","count":314,"ports":165},{"path":"/.well-known/security.txt","count":43,"ports":38},{"path":"/api/jolokia/list","count":5,"ports":5},{"path":"/jolokia/version","count":3,"ports":3},{"path":"/wsman","count":2,"ports":2},{"path":"/jolokia/exec","count":2,"ports":2},{"path":"/api/jolokia/version","count":2,"ports":2},{"path":"/actuator/jolokia/version","count":2,"ports":2},{"path":"/_config","count":1,"ports":1},{"path":"/jolokia/list","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":2}],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":6}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"185.228.81.201:4443","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-09-22T05:25:18.620595+00:00"}