{"ip":"162.216.149.130","total_events":2530,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"401,487 bytes sent","bytes_sent":401487,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-16T22:40:36","last_seen":"2026-09-23T14:02:25","events_24h":12,"events_7d":117,"geo":{"country_code":"US","country_name":"United States","region":"South Carolina","city":"North Charleston","lat":32.8608,"lon":-79.9746,"asn":396982,"org":"Google LLC"},"source_domain":"130.149.216.162.bc.googleusercontent.com","known_scanners":["paloaltonetworks"],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3390,"proto":"tcp","label":"","count":16},{"port":33890,"proto":"tcp","label":"","count":16},{"port":2139,"proto":"tcp","label":"","count":6},{"port":39732,"proto":"tcp","label":"","count":4},{"port":46851,"proto":"tcp","label":"","count":4},{"port":21168,"proto":"tcp","label":"","count":4},{"port":37286,"proto":"tcp","label":"","count":4},{"port":5621,"proto":"tcp","label":"","count":4},{"port":29598,"proto":"tcp","label":"","count":4},{"port":22345,"proto":"tcp","label":"","count":4},{"port":45463,"proto":"tcp","label":"","count":4},{"port":49201,"proto":"tcp","label":"","count":4},{"port":9676,"proto":"tcp","label":"","count":4},{"port":46494,"proto":"tcp","label":"","count":4},{"port":33280,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c203032a82c81d5469aa7bb0d261d508fcc8ec5a3bb00c12e0cb11bc21300029e62dd02039671342f9a24792ac5fc686c04fedcfc45c446c97899eaa925b60fc3e181a1d001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c05b3588fcc79968f13d0cc180025861ef953e8e5195ebebce5e3629b7e77d123c78c279ad257173ab5878d272620528001eea952a282d34e894e9aa934285c1cd191b2d92b75bd98cbe297105c6b0a2c02e95f49ad7b68fb229351d409b92600d83042b2b0678f6fa99f9fc45af83afcdf8458a357ea82a13b2449322d70cd293083e0125e3958bc2603c674bc4cc7ccbff898f736b5f4fc3534736911fca867ca3ca3691031b2b76ab40b248982658b21bf40775ad6c4b486abd5a626f8ba13e0968bd7f42bedd697ed844833f68b28f75b4d4188f9e33bcd79534c8d3016f8522ff668f4d0a9453876fa4f2260b49338ae9336b5b4637480365e020384b34511aab23406f7424c0e7ac5cd0cb0c526c12c3c38647e41a29d055de44b3c2360bce3823d52c02f9293ff62c00adc9bcd2430db557c6cc06ba9da6878eb9101b3c82488a47a09bb366f00d35f709721906ce4708481a7f9f9abb6ad0003232403f655ab111ae94a1ab147a8cf8f716cb9a25004b6fb18b26efa688b4542417c169c72b7bb6c57862b802f0e691e7197758431acdfb66f1b65c265bb2c2823d1298005f365460c485b9bb313a0203613697f3f7789ee68eac6826879a15a000c83848a0be93011e9822347c5fa034044a873f8c9cbb6523728e70268cb485a1b54733eb3a4fc0bfaacb685d7564c1b0ca6b258ed22b9d814529d73c604b8b8d715239fcc9c29ab93352f35fe05229f9004507d695f822b23e60a12e82049d644775dc84069b9fa4203bd87530c347b0cbbb5704e4095c30409a16b397e98073064a330a98e7584836ca5952a4c2b590ac34fc063554872a39ca72c34dfea939e9fcc994c991a1180659f360f744993385bd6d3b6d7df4332ca6c6ead21de4da8c129a955bb353c2e5bbcd5915a67072402a315046a00a75a998f569973181740b15102ca5c019276656590535c140fa729dd0898227a1fd9b3937a6493a8c7894330315912db8943eae1a52e1d6480b1546a3e221ef8625c80c3ce22377eaf13f182888bf9153841759fd6a1c7a0a74cf931eafa6caaa9599bbfcb2442709a3721a6e9a7c7b4ab9ea815ebdb524ed684b3bc278187a6bc94b4c0618b588cb5998322a8f0aae02b75b4ea26f44036136b76fe6f5738c4ca1a32a15c042987351b3907722f868b339cb99642c12658780aba1a944068e1648a155151b8135522d65133773aa2e6c162551735551b0fde15e4f825626f1456a3cc94de476bc5788c0a5c4b3a5347e221f54e0c2d2c50967aa4614b9a920b01b0ae83cc743857f4c6419067973850a62558b44918e5f54353d337b2b3382095c1cca8a9c15eb995b42628da07d0bf930f04b2ec9c899780706a40b99ca56b474a8094cf52f884b1e6a48316f12aa8f366d08547851d32bcc83ca850340dcf1b550f4083c27b55507a0fab666e682c5cd6856966b08e9dc49550984537b97e317700313b976fa40190625b3c70560ab6a476826ca35a4db39bd1a01ce7d3361a7975f1db3588086168bf45d4eb4012788a9c8cb4520b04ccabc55286a22d3d95cdbd62ee5d99219e57c049c37328594cba47ab87b0e2fb76633c18d8c4955faf57cae887e1f8c25d650c6cb6e8ea751ec0920c1e0682db34ca690de25d96121caa071af90aa3a668ac59b9973515d07ec8378f9dbc6299317f3b83016cf1f742531cb45a7413a7915146e001d00209973515d07ec8378f9dbc6299317f3b83016cf1f742531cb45a7413a","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_0000004c_13ee3d34","a10cun020_00000041_0a8d7f11"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":658,"t13i131000_f57a46bbacb6_ab7e3b40a677":5121,"a11cun030_0000004c_13ee3d34":1781,"a10cun020_00000041_0a8d7f11":1434},"akin_families":{},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"],"timeline":[{"date":"2026-06-25","count":6},{"date":"2026-06-26","count":6},{"date":"2026-06-27","count":12},{"date":"2026-06-28","count":19},{"date":"2026-06-29","count":29},{"date":"2026-06-30","count":22},{"date":"2026-07-01","count":19},{"date":"2026-07-02","count":18},{"date":"2026-07-03","count":10},{"date":"2026-07-04","count":12},{"date":"2026-07-05","count":12},{"date":"2026-07-06","count":15},{"date":"2026-07-07","count":21},{"date":"2026-07-08","count":15},{"date":"2026-07-09","count":26},{"date":"2026-07-10","count":14},{"date":"2026-07-11","count":10},{"date":"2026-07-12","count":12},{"date":"2026-07-13","count":11},{"date":"2026-07-14","count":10},{"date":"2026-07-15","count":8},{"date":"2026-07-16","count":15},{"date":"2026-07-17","count":15},{"date":"2026-07-18","count":22},{"date":"2026-07-19","count":16},{"date":"2026-07-20","count":21},{"date":"2026-07-21","count":6},{"date":"2026-07-22","count":21},{"date":"2026-07-23","count":19},{"date":"2026-07-24","count":9},{"date":"2026-07-25","count":10},{"date":"2026-07-26","count":20},{"date":"2026-07-27","count":17},{"date":"2026-07-28","count":25},{"date":"2026-07-29","count":16},{"date":"2026-07-30","count":26},{"date":"2026-07-31","count":14},{"date":"2026-08-01","count":18},{"date":"2026-08-02","count":23},{"date":"2026-08-03","count":22},{"date":"2026-08-04","count":15},{"date":"2026-08-05","count":15},{"date":"2026-08-06","count":18},{"date":"2026-08-07","count":22},{"date":"2026-08-08","count":20},{"date":"2026-08-09","count":93},{"date":"2026-08-10","count":18},{"date":"2026-08-11","count":31},{"date":"2026-08-12","count":13},{"date":"2026-08-13","count":32},{"date":"2026-08-14","count":14},{"date":"2026-08-15","count":29},{"date":"2026-08-16","count":16},{"date":"2026-08-17","count":14},{"date":"2026-08-18","count":26},{"date":"2026-08-19","count":24},{"date":"2026-08-20","count":20},{"date":"2026-08-21","count":16},{"date":"2026-08-22","count":18},{"date":"2026-08-23","count":12},{"date":"2026-08-24","count":20},{"date":"2026-08-25","count":22},{"date":"2026-08-26","count":26},{"date":"2026-08-27","count":14},{"date":"2026-08-28","count":30},{"date":"2026-08-29","count":25},{"date":"2026-08-30","count":29},{"date":"2026-08-31","count":17},{"date":"2026-09-01","count":24},{"date":"2026-09-02","count":30},{"date":"2026-09-03","count":28},{"date":"2026-09-04","count":41},{"date":"2026-09-05","count":25},{"date":"2026-09-06","count":23},{"date":"2026-09-07","count":28},{"date":"2026-09-08","count":23},{"date":"2026-09-09","count":19},{"date":"2026-09-10","count":26},{"date":"2026-09-11","count":17},{"date":"2026-09-12","count":25},{"date":"2026-09-13","count":43},{"date":"2026-09-14","count":19},{"date":"2026-09-15","count":21},{"date":"2026-09-16","count":16},{"date":"2026-09-17","count":23},{"date":"2026-09-18","count":20},{"date":"2026-09-19","count":22},{"date":"2026-09-20","count":10},{"date":"2026-09-21","count":16},{"date":"2026-09-22","count":10},{"date":"2026-09-23","count":9}],"recent_events":[{"timestamp":"2026-09-23T14:02:25","port":58554,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"663fd465-06a2-4cd7-84f1-0b624de54cfd","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T09:06:30","port":55394,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"c4343d56-a13b-4d3b-9975-5216bdf7ba87","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T06:26:45","port":60286,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"dd3d912b-2ca2-4785-a862-71daf20e2379","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T06:12:31","port":34282,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"52b1110c-bba1-47c2-8734-4bd2f88cbd3f","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T05:52:15","port":20242,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"3d8555a2-7035-4a9f-8390-dc0b39536ee8","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T05:44:36","port":47790,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:47790\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34373739300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"cb8d584e-da5e-42a6-b727-9383ddccae89","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":80},{"timestamp":"2026-09-23T02:43:30","port":17698,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"9bc4c048-8b42-40eb-938b-a44e79d6cdd1","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-23T01:35:18","port":22280,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ZGrab ZGrab SSH Survey\r\n","payload_hex":"5353482d322e302d5a47726162205a4772616220535348205375727665790d0a","method":"","user_agent":"","ja3":"","session":"8aa1d2c6-d414-4ce8-a4aa-7731880fa5c2","seq":1,"duration_ms":2100,"bytes_in":32,"bytes_out":15,"enriched":{"digest":"5192d527e0eab129","label":"SSH","strings":["SSH-2.0-ZGrab ZGrab SSH Survey"]}},{"timestamp":"2026-09-23T00:39:34","port":47234,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"eee3444b-bb2a-490a-a228-f82cb5f49bbc","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":80},{"timestamp":"2026-09-22T21:36:30","port":4009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"e9538db8-3853-4e06-b37b-aec866cbc38a","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":80}],"http_methods":[{"method":"GET","count":2329},{"method":"POST","count":1}],"distinct_ports_total":1944,"top_paths":[{"path":"/","count":2182,"ports":1683},{"path":"/.well-known/security.txt","count":148,"ports":141}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":78}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:47790","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-23T15:10:32.945341+00:00"}