{"ip":"147.185.132.148","data_as_of":"2026-10-25T15:59:01+00:00","observed":true,"total_events":3956,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["The address is in a published scanner range (paloaltonetworks).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 168 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"698,932 bytes sent","bytes_sent":698932,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-02-18T00:30:16","last_seen":"2026-10-25T14:58:52","events_24h":19,"events_7d":126,"interactive_sessions":168,"interactive_sessions_24h":8,"interactive_sessions_7d":138,"interactive_protocols":[{"protocol":"http","sessions":161},{"protocol":"ssh","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","kev_date_added":"2026-04-16"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":168,"first_seen":"2026-10-14T17:25:46","last_seen":"2026-10-25T14:58:52","verdicts":[{"verdict":"scan","sessions":162},{"verdict":"unknown","sessions":6}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":60},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":34},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":29},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":23},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":11},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":4},{"persona":"linux-ubuntu@20.04","sessions":2}],"services":[{"protocol":"tcp","port":19080,"sessions":2},{"protocol":"tcp","port":4434,"sessions":2},{"protocol":"http","port":5653,"sessions":2},{"protocol":"http","port":46895,"sessions":2},{"protocol":"http","port":58601,"sessions":2},{"protocol":"http","port":49504,"sessions":2},{"protocol":"http","port":557,"sessions":2},{"protocol":"http","port":50921,"sessions":2},{"protocol":"http","port":25813,"sessions":1},{"protocol":"http","port":48991,"sessions":1},{"protocol":"http","port":44429,"sessions":1},{"protocol":"http","port":56002,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":162}]},"top_ports":[{"port":53983,"proto":"tcp","label":"","count":6,"sessions":0},{"port":9241,"proto":"tcp","label":"","count":5,"sessions":0},{"port":64797,"proto":"tcp","label":"","count":5,"sessions":0},{"port":31953,"proto":"tcp","label":"","count":5,"sessions":0},{"port":65112,"proto":"tcp","label":"","count":5,"sessions":0},{"port":9873,"proto":"tcp","label":"","count":4,"sessions":0},{"port":38438,"proto":"tcp","label":"","count":4,"sessions":0},{"port":7552,"proto":"tcp","label":"","count":4,"sessions":0},{"port":28556,"proto":"tcp","label":"","count":4,"sessions":0},{"port":665,"proto":"tcp","label":"","count":4,"sessions":0},{"port":5876,"proto":"tcp","label":"","count":4,"sessions":0},{"port":32244,"proto":"tcp","label":"","count":4,"sessions":0},{"port":9962,"proto":"tcp","label":"","count":4,"sessions":0},{"port":3341,"proto":"tcp","label":"","count":4,"sessions":0},{"port":7955,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c2030391c1de7e6354a04db5c326dcf2c62d130e0543e789e4e35828874ae59ac66910207605371be26a86b6dcd37aa61ccd50b6b1d9775a88d5034fb2de18eb0440d89a001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c08b5c1f5296b90d06c3a6c87397a4380718bdad95ce6734c1bcb691348baca8833dbcc459f3f72e040c570047717288c0afab67f418ca6634869fe7305ed634e39cb35dc692d8016a4f079d54db9297bc4b06c334f1b79cb7b08e0f7134de6007d8240c47c4bc524c390bf2916e94bd40462f2a08bcaf23688dac407d170aab893806d88670401815a7603078c97a2631b7cb664006872c7126cc3939d7b88851708bd9831dda2608171b71bd07024f4c0d5c255e59870c0e9c48c1d5b377c528f9d87803453035da9fbe9b08aebccd2133807e980c17060f99397f207796e1f1a0e459597e37c12298434b53b153da33402a5013e2821c6246cf820bcbd425f807472db637ec693f4cb32961a6237c628d5399c9d8a185ac0cb72a152b5d457a52005037460d8df07b6c087931b385bf2c08b14aadd7168387090d88364158a83eba9c3e4383415862b8c424b5d6ab35dd100dee5ac9535525923a454736c867c0193833bcd87667e84925ec276943ea71653242931255c9546318258cca9c22654c8e920083e4a209924089bebbc9709a0e03c5b5f5f9b5d0a99eedfbbe48e0307b6279d0fb209b132e0eab1c15e91d4f785f3446235bbac845440d73e5ac185123642378071513127bbd46841bac10086028ab7b3a7aad9180d04a7120493430210930262843b62102166da7d27795645c84941e8ce23238099f0f79538f590a6f59950723a7ef03565dc45155072b564bc64a21b17432cf76161ef136946535537d42c516f3119e7cbbc4d11c595bc2e5f712967a99f0274ab38c138d5c3fa63761229b0724d85b3971a15de0aa6826bee4c9732715c4e7207744792c2d090feb962a61a5b73a8a5ce6a2b2f3785d236403d4898d26ab3fb582099d25c4a2c05c37375f0f06a240f6cdecac4a2a54559c108d5a570d8de82bf470c48d422d314563732c4eb18a1e6e290e40ab8ee3eb0ac14c02f164803f374c3ff131b547b2cc96947f9c1bdf206aead4b4a5409ef31477c4532c27e08ee189a9358707b39563aa336d72e09ae46333835a11567c6ed0f199ccc241edd240ee844f6a83286eebbcd2e00de51a4982509e9252552cc443daf702a0eb80f7f47d0054caadd23b4246a3eaa8b65f04525ca0bb504c82a0734f70003081d34ab34359b3e523978745fba54c9c4547516b417f460212d36603db30b6c206a8c1b9f6392ae1b38ede0096348b68c904292831b46be27f52d2511b048464d11b75e36f5a29504d2a3f0cf9bc5de46208d2ae71f621bd364e8253c76068c3ed195416b050ec00119e438c45d11bca60798502b3dbf45571fb33124a82c0e93f0c280db10c1f48ea7a117992b95a8358f248d400b47400c09ec2ad139962ef6485f31ab317a709dc25c28f0c7fe64516f6627f9c333dac859d00cb5d652bba9a3baa1dfcc01e966e9d81ce730a7113b3b99cb96630f9c1283649e1c9a0e39963e6528c1942c656e4ccfda34bd1e79f426c809c963a769b18de79366ce15ce839bf824a2948bb09c71791ac8c0dbcc5a407dc93df9642e1a05ba6aabb8bf6b4c91cb7bf739c87f95b6da9b90e3ab98c49c4b48b998403c809c014c82a49f6f87f575089c1003eca0305c3643d7183245b8d5eeb6c8f39f7fe244b3c043ae79ea0b28c763c93ca341a48633fc73f1fc3adf8233dc435a72f868a501fb8dd128f3e0b33d6a9d3339ef878001d0020633fc73f1fc3adf8233dc435a72f868a501fb8dd128f3e0b33d6a9d3","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b10cun020_00000014_0a8d7f11","b11cun020_00040010_724c10fb"],"interactive":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":905,"t13i131000_f57a46bbacb6_ab7e3b40a677":3152,"dd9bcf093c355da7000132131cb36fd0":0,"b11cun030_00040012_13ee3d34":5411,"b10cun020_00000014_0a8d7f11":2029,"b11cun020_00040010_724c10fb":1866},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":2,"ips":1867}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"],"timeline":[{"date":"2026-07-27","count":7,"sessions":0},{"date":"2026-07-28","count":18,"sessions":0},{"date":"2026-07-29","count":15,"sessions":0},{"date":"2026-07-30","count":27,"sessions":0},{"date":"2026-07-31","count":11,"sessions":0},{"date":"2026-08-01","count":31,"sessions":0},{"date":"2026-08-02","count":17,"sessions":0},{"date":"2026-08-03","count":18,"sessions":0},{"date":"2026-08-04","count":19,"sessions":0},{"date":"2026-08-05","count":12,"sessions":0},{"date":"2026-08-06","count":16,"sessions":0},{"date":"2026-08-07","count":10,"sessions":0},{"date":"2026-08-08","count":15,"sessions":0},{"date":"2026-08-09","count":18,"sessions":0},{"date":"2026-08-10","count":19,"sessions":0},{"date":"2026-08-11","count":19,"sessions":0},{"date":"2026-08-12","count":13,"sessions":0},{"date":"2026-08-13","count":24,"sessions":0},{"date":"2026-08-14","count":24,"sessions":0},{"date":"2026-08-15","count":26,"sessions":0},{"date":"2026-08-16","count":21,"sessions":0},{"date":"2026-08-17","count":29,"sessions":0},{"date":"2026-08-18","count":18,"sessions":0},{"date":"2026-08-19","count":20,"sessions":0},{"date":"2026-08-20","count":19,"sessions":0},{"date":"2026-08-21","count":18,"sessions":0},{"date":"2026-08-22","count":11,"sessions":0},{"date":"2026-08-23","count":21,"sessions":0},{"date":"2026-08-24","count":20,"sessions":0},{"date":"2026-08-25","count":18,"sessions":0},{"date":"2026-08-26","count":17,"sessions":0},{"date":"2026-08-27","count":14,"sessions":0},{"date":"2026-08-28","count":33,"sessions":0},{"date":"2026-08-29","count":25,"sessions":0},{"date":"2026-08-30","count":24,"sessions":0},{"date":"2026-08-31","count":29,"sessions":0},{"date":"2026-09-01","count":20,"sessions":0},{"date":"2026-09-02","count":21,"sessions":0},{"date":"2026-09-03","count":30,"sessions":0},{"date":"2026-09-04","count":25,"sessions":0},{"date":"2026-09-05","count":31,"sessions":0},{"date":"2026-09-06","count":30,"sessions":0},{"date":"2026-09-07","count":27,"sessions":0},{"date":"2026-09-08","count":18,"sessions":0},{"date":"2026-09-09","count":21,"sessions":0},{"date":"2026-09-10","count":20,"sessions":0},{"date":"2026-09-11","count":24,"sessions":0},{"date":"2026-09-12","count":35,"sessions":0},{"date":"2026-09-13","count":16,"sessions":0},{"date":"2026-09-14","count":19,"sessions":0},{"date":"2026-09-15","count":24,"sessions":0},{"date":"2026-09-16","count":12,"sessions":0},{"date":"2026-09-17","count":23,"sessions":0},{"date":"2026-09-18","count":19,"sessions":0},{"date":"2026-09-19","count":18,"sessions":0},{"date":"2026-09-20","count":21,"sessions":0},{"date":"2026-09-21","count":11,"sessions":0},{"date":"2026-09-22","count":13,"sessions":0},{"date":"2026-09-23","count":17,"sessions":0},{"date":"2026-09-24","count":16,"sessions":0},{"date":"2026-09-25","count":12,"sessions":0},{"date":"2026-09-26","count":17,"sessions":0},{"date":"2026-09-27","count":58,"sessions":0},{"date":"2026-09-28","count":18,"sessions":0},{"date":"2026-09-29","count":18,"sessions":0},{"date":"2026-09-30","count":21,"sessions":0},{"date":"2026-10-01","count":15,"sessions":0},{"date":"2026-10-02","count":15,"sessions":0},{"date":"2026-10-03","count":16,"sessions":0},{"date":"2026-10-04","count":8,"sessions":0},{"date":"2026-10-05","count":13,"sessions":0},{"date":"2026-10-06","count":28,"sessions":0},{"date":"2026-10-07","count":19,"sessions":0},{"date":"2026-10-08","count":17,"sessions":0},{"date":"2026-10-09","count":18,"sessions":0},{"date":"2026-10-10","count":14,"sessions":0},{"date":"2026-10-11","count":34,"sessions":0},{"date":"2026-10-12","count":12,"sessions":0},{"date":"2026-10-13","count":16,"sessions":0},{"date":"2026-10-14","count":11,"sessions":1},{"date":"2026-10-15","count":27,"sessions":6},{"date":"2026-10-16","count":17,"sessions":2},{"date":"2026-10-17","count":19,"sessions":3},{"date":"2026-10-18","count":86,"sessions":18},{"date":"2026-10-19","count":28,"sessions":66},{"date":"2026-10-20","count":20,"sessions":3},{"date":"2026-10-21","count":13,"sessions":1},{"date":"2026-10-22","count":14,"sessions":58},{"date":"2026-10-23","count":20,"sessions":2},{"date":"2026-10-24","count":19,"sessions":3},{"date":"2026-10-25","count":10,"sessions":5}],"recent_events":[{"timestamp":"2026-10-25T14:58:52","port":8424,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8424\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383432340d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"218c65c1-7244-4e73-b8a9-ad5953b84796-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:34:06","port":1088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1088\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313038380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"ff6fb23f-3921-442b-b49c-048455b7fffb","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-10-25T13:14:18","port":9789,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9789\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393738390d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"34a253bc-599a-4042-93e8-3888d2d17e46-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:26:02","port":51002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:51002\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313030320d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"a43a9246-47e4-4609-b15f-8bcd7e91f92d","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":80},{"timestamp":"2026-10-25T09:15:32","port":53997,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"9c3d3576-9e8c-49f9-a872-88a63a82688c","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-25T05:43:27","port":17858,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"5674542d-81dc-4d9e-a334-ce4576d9f627","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-25T05:43:27","port":17858,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"087926ee-36b1-47f2-8105-2de225cd987a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T02:42:05","port":52487,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"c14047e7-8af0-4d12-802d-38b27a36f645","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-25T02:42:05","port":52487,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"9e3336b5-aa50-43f6-bdc9-dbcdaf80ab69","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-25T02:35:41","port":48792,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"b0b041e1-e6ef-4788-b786-1bb92aa6440c","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80}],"http_methods":[{"method":"GET","count":3936}],"distinct_ports_total":3174,"top_paths":[{"path":"/","count":2765,"ports":2111},{"path":"/.well-known/security.txt","count":442,"ports":408},{"path":"/jolokia/write","count":79,"ports":79},{"path":"/api/jolokia/version","count":79,"ports":79},{"path":"/actuator/jolokia/version","count":73,"ports":73},{"path":"/jolokia","count":72,"ports":72},{"path":"/jolokia/exec","count":72,"ports":72},{"path":"/jolokia/list","count":72,"ports":71},{"path":"/jolokia/version","count":71,"ports":71},{"path":"/api/jolokia","count":70,"ports":70},{"path":"/api/jolokia/list","count":63,"ports":63},{"path":"/wp-json/","count":28,"ports":28},{"path":"/wp-login.php","count":20,"ports":20},{"path":"/xmlrpc.php","count":18,"ports":18},{"path":"/wp-json/wp/v2/users","count":12,"ports":12}],"distinct_paths_total":15,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":92}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8424","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[],"kev_date_added":"2026-04-16"}]}