{"ip":"147.185.132.216","total_events":469,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"68,128 bytes sent","bytes_sent":68128,"session_seconds":2,"persistent":false}},"first_seen":"2026-05-19T08:07:42","last_seen":"2026-09-24T07:00:59","events_24h":3,"events_7d":17,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":22},{"port":20257,"proto":"tcp","label":"","count":18},{"port":3388,"proto":"tcp","label":"","count":11},{"port":3390,"proto":"tcp","label":"","count":11},{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":5678,"proto":"tcp","label":"","count":6},{"port":7777,"proto":"tcp","label":"Oracle","count":5},{"port":10001,"proto":"tcp","label":"","count":5},{"port":31337,"proto":"tcp","label":"","count":5},{"port":18080,"proto":"tcp","label":"","count":4},{"port":30083,"proto":"tcp","label":"","count":4},{"port":5060,"proto":"tcp","label":"SIP","count":4},{"port":943,"proto":"tcp","label":"","count":4},{"port":88,"proto":"tcp","label":"","count":4},{"port":1717,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030100ee010000ea030321ee33ea060d62a5c8465c1ab17ed00b4ed97ef06daac9a2117ee8a501ed1fcb20766ebc6b3d01065177fc129e13821e3ece0be15a8389a797dbc8505349b4cf480026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020cac3dc8b322d98fe1d142b3f7c2baab767d9b48bfac4af98b1c7a4d3","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2999,"t13i140900_cbb2034c60b8_e7c285222651":659,"t13i311000_e8f1e7e78f70_24695f2957a7":516,"t13i131000_f57a46bbacb6_ab7e3b40a677":5079,"a11cun030_0000004c_13ee3d34":2230},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2232}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-06-26","count":2},{"date":"2026-06-27","count":5},{"date":"2026-06-28","count":8},{"date":"2026-06-29","count":13},{"date":"2026-06-30","count":3},{"date":"2026-07-01","count":13},{"date":"2026-07-02","count":3},{"date":"2026-07-03","count":3},{"date":"2026-07-04","count":2},{"date":"2026-07-05","count":2},{"date":"2026-07-06","count":7},{"date":"2026-07-07","count":6},{"date":"2026-07-08","count":1},{"date":"2026-07-09","count":2},{"date":"2026-07-10","count":5},{"date":"2026-07-11","count":3},{"date":"2026-07-12","count":3},{"date":"2026-07-13","count":2},{"date":"2026-07-14","count":4},{"date":"2026-07-15","count":4},{"date":"2026-07-16","count":5},{"date":"2026-07-17","count":2},{"date":"2026-07-18","count":3},{"date":"2026-07-19","count":2},{"date":"2026-07-20","count":1},{"date":"2026-07-21","count":2},{"date":"2026-07-22","count":3},{"date":"2026-07-23","count":3},{"date":"2026-07-24","count":1},{"date":"2026-07-25","count":4},{"date":"2026-07-26","count":6},{"date":"2026-07-27","count":4},{"date":"2026-07-28","count":3},{"date":"2026-07-29","count":5},{"date":"2026-07-30","count":2},{"date":"2026-07-31","count":4},{"date":"2026-08-01","count":2},{"date":"2026-08-02","count":2},{"date":"2026-08-03","count":6},{"date":"2026-08-04","count":3},{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":3},{"date":"2026-08-07","count":1},{"date":"2026-08-08","count":3},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":5},{"date":"2026-08-11","count":3},{"date":"2026-08-12","count":6},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":3},{"date":"2026-08-15","count":7},{"date":"2026-08-16","count":6},{"date":"2026-08-17","count":3},{"date":"2026-08-18","count":13},{"date":"2026-08-19","count":5},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-22","count":2},{"date":"2026-08-23","count":4},{"date":"2026-08-25","count":4},{"date":"2026-08-26","count":2},{"date":"2026-08-27","count":2},{"date":"2026-08-28","count":5},{"date":"2026-08-29","count":3},{"date":"2026-08-30","count":4},{"date":"2026-08-31","count":4},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":4},{"date":"2026-09-05","count":3},{"date":"2026-09-06","count":4},{"date":"2026-09-07","count":8},{"date":"2026-09-08","count":5},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":3},{"date":"2026-09-11","count":2},{"date":"2026-09-13","count":15},{"date":"2026-09-14","count":4},{"date":"2026-09-15","count":3},{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":2},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":4},{"date":"2026-09-20","count":5},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":2},{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T07:00:59","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"host\":\":5555\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a353535350d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"b9693f2f-5198-4b3f-a4b1-9a78954cee3a","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-24T02:41:46","port":2380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:2380\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a323338300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"3de903f5-4d2d-43ec-9534-8f8f5afdc614","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":80},{"timestamp":"2026-09-23T13:58:17","port":18080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001!\u0001\u0001\u0001\u0001\u0001\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001�\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0011\u0001\u0001\u0001\u0001\u0002\u0001\u0001\b\tnode_data\f\u0010\nlocal_time\u0005d�\u0016`\u0000\u0000\u0000\u0000\u0007my_port\u0006\u0000\u0000\u0000\u0000\nnetwork_id\n@\u00120�qa\u0004Aa\u00171\u0000�\u0016��\u0010\u0007peer_id\u0005AAAAAAAA\fpayload_data\f\u0010\u0015cumulative_difficulty\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000ecurrent_height\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006top_id\n�A�\u0015��邡�]�גw�pW'�h��\u000f�F���\u001fF2�\u000btop_version\b\u0001","payload_hex":"0121010101010101e20000000000000001e903000000000000010000000100000001110101010102010108096e6f64655f646174610c100a6c6f63616c5f74696d65056493166000000000076d795f706f727406000000000a6e6574776f726b5f69640a401230f171610441611731008216a1a11007706565725f69640541414141414141410c7061796c6f61645f646174610c101563756d756c61746976655f646966666963756c74790501000000000000000e63757272656e745f68656967687405010000000000000006746f705f69640a80418015bb9ae982a1975da7d79277c2705727a56894ba0fb246adaabb1f4632e30b746f705f76657273696f6e0801","method":"","user_agent":"","ja3":"","session":"c76fc718-3e00-4035-bd63-8d44c6837160","seq":1,"duration_ms":100,"bytes_in":259,"bytes_out":15,"enriched":{"digest":"72de1e814315893b","strings":["node_data","local_time","my_port","network_id","peer_id","AAAAAAAA","payload_data","cumulative_difficulty","current_height","top_id"]}},{"timestamp":"2026-09-23T09:09:17","port":6881,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005���Ϲ�p���@nj\u0016\u001f+�$1&-UM1860-A�\u0018\u001aɺ\u0017�qRf>","payload_hex":"13426974546f7272656e742070726f746f636f6c0000000000100005dcfcdccfb9e670ccc3dd40c78c161f2bea2431262d554d313836302d418e181ac9ba17987152663e","method":"","user_agent":"","ja3":"","session":"dce3ca3d-f7d6-4ac2-9f0f-6403c0f77284","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"25caebb2ee60d0f8","strings":["BitTorrent protocol","$1&-UM1860-A","qRf>"]}},{"timestamp":"2026-09-22T03:12:59","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"host\":\":10443\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a31303434330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"f08bf978-7c5a-463a-9453-79a4b0fd212e","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-21T17:56:15","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"2035482f-d61e-4cfa-b24f-f75af020dde2","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":15},{"timestamp":"2026-09-20T20:08:54","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�}\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000b57d00000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","ja3":"","session":"39d9312f-97e6-4e67-a0c0-711a665a1b22","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":15,"enriched":{"digest":"bb23ec222e010171","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-09-20T20:08:54","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456h\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0011\u0003\u0000\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0000\u0000\u0001\u0000,\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0001\u0000 \u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000000acfe534d42400000000000000000000000000000000000000000000000000000000000000000000000000000000000000031323334353637383930313233343536240001000100000000000000313233343536373839303132333435366800000002000000110300000200060000000000020002000100000001002c00000000000200020001000100200001000000000000000000000000000000000001000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"dddf806b-25a9-4841-8895-acf69e8608a1","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":15,"enriched":{"digest":"70ed1072e860440d","strings":["SMB@","1234567890123456$","1234567890123456h","SMB@1234567890123456$"]}},{"timestamp":"2026-09-20T18:16:13","port":32569,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"host\":\":32569\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a33323536390d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"cccda8b0-0850-4a36-bf5f-2d1386d4e1d7","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-20T10:54:18","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+:5555","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-09-24T13:04:53.348292+00:00"}