{"ip":"147.185.133.164","data_as_of":"2026-10-24T06:56:39+00:00","observed":true,"total_events":2829,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["The address is in a published scanner range (paloaltonetworks).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 28 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"474,343 bytes sent","bytes_sent":474343,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-02-17T08:25:09","last_seen":"2026-10-24T05:50:09","events_24h":13,"events_7d":134,"interactive_sessions":28,"interactive_sessions_24h":4,"interactive_sessions_7d":23,"interactive_protocols":[{"protocol":"http","sessions":25},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":3,"protocols":[{"protocol":"udp","events":2},{"protocol":"dns","events":1}],"ports":[{"port":498,"events":1},{"port":6353,"events":1},{"port":24500,"events":1}],"dns_questions":[{"name":"_services._dns-sd._udp.local","type":"PTR","events":1}],"quic_clients":[],"first_seen":"2026-10-18T15:28:48","last_seen":"2026-10-23T13:34:38","recent":[{"timestamp":"2026-10-23T13:34:38","port":24500,"src_port":51661,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0000�\u0013Mw��hQ\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000! \"\b\u0000\u0000\u0000\u0000\u0000\u0000\u0001(\"\u0000\u0000l\u0000\u0000\u0000h\u0001\u0001\u0000\u000b\u0003\u0000\u0000\f\u0001\u0000\u0000\f�\u000e\u0001\u0000\u0003\u0000\u0000\f\u0001\u0000\u0000\f�\u000e\u0000�\u0003\u0000\u0000\b\u0001\u0000\u0000\u0003\u0003\u0000\u0000\b\u0001\u0000\u0000\u0002\u0003\u0000\u0000\b\u0002\u0000\u0000\u0002\u0003\u0000\u0000\b\u0002\u0000\u0000\u0001\u0003\u0000\u0000\b\u0003\u0000\u0000\u0002\u0003\u0000\u0000\b\u0003\u0000\u0000\u0001\u0003\u0000\u0000\b\u0004\u0000\u0000\u0002\u0003\u0000\u0000\b\u0004\u0000\u0000\u0005\u0000\u0000\u0000\b\u0004\u0000\u0000\u000e(\u0000\u0000�\u0000\u0002\u0000\u0000]5-��@]�,Q�\n;�\u0000�e&F��eJe\"��1�K�\u0013��s{��ꮦ�\u001b\u001d\u0006�\u001b�\u000e6��9Ԟa-��Ǜ`�k��\u0011�;��懯l|AT+�`7$*-�c\u000f2\u0004j\u000bO�Ժ���c�E�\u0018���+��\u000eāa\u001f{���݌)�l�TL�\u0000\u0000\u0000\u0018;\\Eq\u0003y��֋�\u0003���>�w}�","payload_hex":"00000000e0134d77f3f7685100000000000000002120220800000000000001282200006c000000680101000b0300000c0100000c800e01000300000c0100000c800e008003000008010000030300000801000002030000080200000203000008020000010300000803000002030000080300000103000008040000020300000804000005000000080400000e28000088000200005d352dad97405dc62c51ef0a3ba5009c6526469ab2654a6522e2b9319a4bdc13f0eb737b85e2eaaea6fc1b1d06b31b990e36a28739d49e612dab91c79b60cb6b9fb611f33bc2e6e687af6c7c41542beb6037242a2da9630f32046a0b4ff4d4baa8b1fb63a045bc1898acaf2bb8de0ec481611f7ba49bf7dd8c29ac6ced544cea000000183b5c4571037982e6d68bf803d2f0bd3e98777d85","sni":"","session":"65bdcc4c-ee48-4968-8756-7543278b394e","bytes_in":300,"source_verified":false,"enriched":{"digest":"f638f96d699ad88b","strings":["eJe\"","l|AT+","`7$*-",";\\Eq","hQ! \"","(\"lh"]}},{"timestamp":"2026-10-23T10:31:58","port":6353,"src_port":51255,"proto":"udp","app_proto":"dns","app_protocol":"dns","summary":"DNS query PTR _services._dns-sd._udp.local","payload_hex":"000000000001000000000000095f7365727669636573075f646e732d7364045f756470056c6f63616c00000c0001","sni":"","session":"88723724-3d6d-4265-a1a4-0a52a6884d2a","bytes_in":46,"source_verified":false,"dns":{"kind":"query","name":"_services._dns-sd._udp.local","type":"PTR","class":"IN"}},{"timestamp":"2026-10-18T15:28:48","port":498,"src_port":51471,"proto":"udp","app_proto":"","app_protocol":"","summary":"�O,�\u0017\u001c��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001P\u0000\u0000\u00014\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0001(\u0001\u0001\u0000\b\u0003\u0000\u0000$\u0001\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0002\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0003\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0004\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0005\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0001�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0006\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0001�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0007\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0001�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0000\u0000\u0000$\b\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0001�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�","payload_hex":"f24f2cdd171cb3d500000000000000000110020000000000000001500000013400000001000000010000012801010008030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080030000240401000080010001800200018003000180040002800b0001000c000400007080030000240501000080010005800200028003000180040001800b0001000c000400007080030000240601000080010005800200018003000180040001800b0001000c000400007080030000240701000080010001800200028003000180040001800b0001000c000400007080000000240801000080010001800200018003000180040001800b0001000c000400007080","sni":"","session":"85e776b1-23bb-48f0-a675-a561e4f1ac64","bytes_in":336,"source_verified":false}]},"interaction":{"window_days":90,"sessions":29,"first_seen":"2026-10-15T00:44:10","last_seen":"2026-10-24T05:50:09","verdicts":[{"verdict":"scan","sessions":27},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":4},{"persona":"dlink-dir645@1.01","sessions":1},{"persona":"linux-ubuntu@20.04","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":36510,"sessions":2},{"protocol":"http","port":20205,"sessions":1},{"protocol":"http","port":63046,"sessions":1},{"protocol":"http","port":57742,"sessions":1},{"protocol":"http","port":14562,"sessions":1},{"protocol":"http","port":40061,"sessions":1},{"protocol":"http","port":10422,"sessions":1},{"protocol":"http","port":8818,"sessions":1},{"protocol":"http","port":8854,"sessions":1},{"protocol":"http","port":9407,"sessions":1},{"protocol":"http","port":9550,"sessions":1},{"protocol":"http","port":22242,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":27}]},"top_ports":[{"port":49343,"proto":"tcp","label":"","count":11,"sessions":0},{"port":29983,"proto":"tcp","label":"","count":11,"sessions":0},{"port":16484,"proto":"tcp","label":"","count":6,"sessions":0},{"port":11712,"proto":"tcp","label":"","count":6,"sessions":0},{"port":32032,"proto":"tcp","label":"","count":5,"sessions":0},{"port":34278,"proto":"tcp","label":"","count":5,"sessions":0},{"port":40567,"proto":"tcp","label":"","count":5,"sessions":0},{"port":48578,"proto":"tcp","label":"","count":5,"sessions":0},{"port":47512,"proto":"tcp","label":"","count":4,"sessions":0},{"port":56379,"proto":"tcp","label":"","count":4,"sessions":0},{"port":49679,"proto":"tcp","label":"","count":4,"sessions":0},{"port":44443,"proto":"tcp","label":"","count":4,"sessions":0},{"port":40160,"proto":"tcp","label":"","count":4,"sessions":0},{"port":25386,"proto":"tcp","label":"","count":4,"sessions":0},{"port":17372,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t12i520600_3874cc0afe49_d74d77c6171b","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303925d7938fb7d610d2983cbb748b7e73a2f913f0597680b9ca626dc241079e47020eb7ffd26546796148bba0eba9170954937c38e291c08f690920f05a5351a3a0c001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c08e861e3911c97d23b8f3bc41d7f54d9dd60e07cc5478ea8dbf35104a1a68a49a32b8c9265cb2961842aeb806c1292409b440a45834c81519a196bb9c03e92d75d739c8eb5e9e95387d4703abb8542db535c46cbdcfb5acace31e0a41b3c6a2ba175462870716e28051472ac0563c7da000926cba1c5d4c0c1cf86ee7400c7ceab5ea570e6afc4375a21d03164cdc051c2151489ac5517387cfda4c05cfd23603491b197510d4b6c041e04f8e4ac25b3947172b4ac8c1215c4923d51468ab1a029766726a5666a86b73373c60919b80d08aa8bf83717c975308e558162626b5aa12b6a1008c0bbde0a429082601e48018a7597dbe3c9322254d6674b14f25c96c4b8a7298732b98a76e44cb230a6466d900425611464a00af2050654657482b69a8e1b7eb124b6567a88b7b3fc14767c81b09af43c804d4a25ea5689c954afd6b24d6223878327814c187a7c93314d70346a95f65b6a218fc557d6327cb3b02fda1befa31403db1810aac91dd409ad0a107b22550cb2a5b3b071424a46babcba01672a31d12165ee53415a10622129063e45c17323dd8cb052b958fa6d463292b79b786c5508a5a84f4707ff94442a69b3a13ad9fb5ac1f89b6e14c776837959dfc76803b67441a7f120a5039fc8337e61517e6c0f760bcf7b198f12a6c10e932b13c4523598d3340874083381a45c90af32cd2825e93674145571f4b021cc0d15bb9f985d8058134f538075481006a01094b410f198d730873323c7f89576117bc71c8168d2216755926222b45c712c520ea1970cd13a3e3e41ea9784a63ac2086c31e4ee59590066acf58a8f4ab14b04840b7f514014287cf9233d44baa731259dc773a91c951fc0151d70a9e92b1bb8046b43b02bd770a300daa65774199adeb8a59e977e2dbc3613c4e943920e39646394210a1c26fd3a62885d9acb2cbbfd2c8bb1cd45d62401182906c00d068d4362f92997ec4f81afa4c06bb106c78a6a79001b0436679ea70a539a4098803a806fb695132b92f53902db3681b45034b8a399160830e0b32c0a2af9de537d9631d2a4795fe158ed8102573e47bc0e39164143db44a8d02c78b3c73a598da50388c82e34859045a95a5f5a96b947fc00cc631d155dea33ad5365dbbd1ba0af747bacc9cdd94094c5a5770d377be659f9de2084a635f55d146aeb6375f9358b0021183ebb443e026e55485bfd1b7575a59fe708e9ad3c67cd2454d69ceed32cab0656775fc5d78370897639f43964e2ef15ac2b2799a15177e905b1cc3313ca15b3a4821eb768d23f7b498e433ad294d6e1c78a9610b97400e10753796ab660145637603559a1c27345956fd1288d78b509ee9c0569aa20b448799b74c0e7745ccc408d3f96d317c463926b5f4097811773e132a583bf8641b399d93b9795d27cced181112683c190988dff1453e316dbef767c4cb53d4c3c813531ab65ba87737401e9a70d92941569c75958b0976483888053ae2914f96168d7a7c326ed1b38c578e7b3c5bf099814b0abe8f148d3f4476f9c929da451466e796f6d7cf760caf007772d52a34c484488a170a22a9b3cb43ca595445a8f5c5641c44d78a357b700b39caa4de11a230043621c98684389df995dd90c2f332d9e02598a4419c78cb769cf3330527658d2b25f4b1a20c759e080f4a49fe62f570002766bdbc5216205a481c9b72b1a9e7532c453d16dc4b19001d0020080f4a49fe62f570002766bdbc5216205a481c9b72b1a9e7532c453d","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b10cun020_00000014_0a8d7f11"],"interactive":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":756,"t12i520600_3874cc0afe49_d74d77c6171b":197,"t13i131000_f57a46bbacb6_ab7e3b40a677":3138,"dd9bcf093c355da7000132131cb36fd0":0,"b11cun030_00040012_13ee3d34":5352,"b10cun020_00000014_0a8d7f11":2036},"akin_families":{},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"],"timeline":[{"date":"2026-07-26","count":30,"sessions":0},{"date":"2026-07-27","count":24,"sessions":0},{"date":"2026-07-28","count":20,"sessions":0},{"date":"2026-07-29","count":20,"sessions":0},{"date":"2026-07-30","count":12,"sessions":0},{"date":"2026-07-31","count":19,"sessions":0},{"date":"2026-08-01","count":12,"sessions":0},{"date":"2026-08-02","count":19,"sessions":0},{"date":"2026-08-03","count":21,"sessions":0},{"date":"2026-08-04","count":22,"sessions":0},{"date":"2026-08-05","count":10,"sessions":0},{"date":"2026-08-06","count":28,"sessions":0},{"date":"2026-08-07","count":19,"sessions":0},{"date":"2026-08-08","count":7,"sessions":0},{"date":"2026-08-09","count":13,"sessions":0},{"date":"2026-08-10","count":19,"sessions":0},{"date":"2026-08-11","count":37,"sessions":0},{"date":"2026-08-12","count":2,"sessions":0},{"date":"2026-08-13","count":27,"sessions":0},{"date":"2026-08-14","count":15,"sessions":0},{"date":"2026-08-15","count":27,"sessions":0},{"date":"2026-08-16","count":13,"sessions":0},{"date":"2026-08-17","count":12,"sessions":0},{"date":"2026-08-18","count":21,"sessions":0},{"date":"2026-08-19","count":15,"sessions":0},{"date":"2026-08-20","count":31,"sessions":0},{"date":"2026-08-21","count":9,"sessions":0},{"date":"2026-08-22","count":13,"sessions":0},{"date":"2026-08-23","count":7,"sessions":0},{"date":"2026-08-24","count":13,"sessions":0},{"date":"2026-08-25","count":22,"sessions":0},{"date":"2026-08-26","count":20,"sessions":0},{"date":"2026-08-27","count":30,"sessions":0},{"date":"2026-08-28","count":27,"sessions":0},{"date":"2026-08-29","count":23,"sessions":0},{"date":"2026-08-30","count":16,"sessions":0},{"date":"2026-08-31","count":25,"sessions":0},{"date":"2026-09-01","count":19,"sessions":0},{"date":"2026-09-02","count":20,"sessions":0},{"date":"2026-09-03","count":16,"sessions":0},{"date":"2026-09-04","count":25,"sessions":0},{"date":"2026-09-05","count":17,"sessions":0},{"date":"2026-09-06","count":23,"sessions":0},{"date":"2026-09-07","count":21,"sessions":0},{"date":"2026-09-08","count":21,"sessions":0},{"date":"2026-09-09","count":24,"sessions":0},{"date":"2026-09-10","count":16,"sessions":0},{"date":"2026-09-11","count":24,"sessions":0},{"date":"2026-09-12","count":22,"sessions":0},{"date":"2026-09-13","count":29,"sessions":0},{"date":"2026-09-14","count":18,"sessions":0},{"date":"2026-09-15","count":19,"sessions":0},{"date":"2026-09-16","count":19,"sessions":0},{"date":"2026-09-17","count":30,"sessions":0},{"date":"2026-09-18","count":14,"sessions":0},{"date":"2026-09-19","count":12,"sessions":0},{"date":"2026-09-20","count":18,"sessions":0},{"date":"2026-09-21","count":20,"sessions":0},{"date":"2026-09-22","count":14,"sessions":0},{"date":"2026-09-23","count":13,"sessions":0},{"date":"2026-09-24","count":11,"sessions":0},{"date":"2026-09-25","count":13,"sessions":0},{"date":"2026-09-26","count":30,"sessions":0},{"date":"2026-09-27","count":11,"sessions":0},{"date":"2026-09-28","count":23,"sessions":0},{"date":"2026-09-29","count":20,"sessions":0},{"date":"2026-09-30","count":16,"sessions":0},{"date":"2026-10-01","count":21,"sessions":0},{"date":"2026-10-02","count":13,"sessions":0},{"date":"2026-10-03","count":12,"sessions":0},{"date":"2026-10-04","count":24,"sessions":0},{"date":"2026-10-05","count":14,"sessions":0},{"date":"2026-10-06","count":25,"sessions":0},{"date":"2026-10-07","count":21,"sessions":0},{"date":"2026-10-08","count":15,"sessions":0},{"date":"2026-10-09","count":12,"sessions":0},{"date":"2026-10-10","count":14,"sessions":0},{"date":"2026-10-11","count":24,"sessions":0},{"date":"2026-10-12","count":12,"sessions":0},{"date":"2026-10-13","count":35,"sessions":0},{"date":"2026-10-14","count":20,"sessions":0},{"date":"2026-10-15","count":25,"sessions":3},{"date":"2026-10-16","count":19,"sessions":2},{"date":"2026-10-17","count":16,"sessions":2},{"date":"2026-10-18","count":19,"sessions":2},{"date":"2026-10-19","count":22,"sessions":3},{"date":"2026-10-20","count":22,"sessions":6},{"date":"2026-10-21","count":20,"sessions":2},{"date":"2026-10-22","count":19,"sessions":4},{"date":"2026-10-23","count":19,"sessions":1},{"date":"2026-10-24","count":1,"sessions":3}],"recent_events":[{"timestamp":"2026-10-24T05:50:09","port":8818,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8818\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383831380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"8e27edad-0225-4bd1-b3bb-4c696351d523-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T05:29:43","port":8832,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8832\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383833320d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"1ab11b1c-eeff-4ea5-a49f-995e784aba18","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-10-24T01:43:52","port":14562,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:14562\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31343536320d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"74f9aebe-b0ce-4311-9a08-cf6b4d1ec44d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T22:55:35","port":9958,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9958\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393935380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"d1c5029f-630f-4b7a-93a3-2185a0442737","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-10-23T22:16:37","port":36510,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:36510\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a33363531300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"e6fcf193-77ac-4067-a428-e9d168c14c56-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T22:01:41","port":373,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"4b1bfd07-79b0-4e53-92c5-5ad7ce33e837","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-23T21:40:45","port":56854,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"946b2504-3e80-4070-bd16-4b25874cb475","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-23T21:40:14","port":22280,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ZGrab ZGrab SSH Survey\r\n","payload_hex":"5353482d322e302d5a47726162205a4772616220535348205375727665790d0a","method":"","user_agent":"","ja3":"","session":"b3e262c9-e825-4212-98b8-3e2dd373cdd6","seq":1,"duration_ms":2100,"bytes_in":32,"bytes_out":15,"enriched":{"digest":"5192d527e0eab129","label":"SSH","strings":["SSH-2.0-ZGrab ZGrab SSH Survey"]}},{"timestamp":"2026-10-23T17:34:26","port":55087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"276c167a-41a1-4e6d-895a-d943783609a1","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-10-23T17:30:50","port":52384,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"faf2b000-a671-4cca-bfa7-d0fa4fddfbfb","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80}],"http_methods":[{"method":"GET","count":2656}],"distinct_ports_total":2235,"top_paths":[{"path":"/","count":2656,"ports":2063}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":87}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8818","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[]}