{"ip":"162.216.149.25","data_as_of":"2026-10-24T05:16:20+00:00","observed":true,"total_events":3331,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["The address is in a published scanner range (paloaltonetworks).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 208 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"616,428 bytes sent","bytes_sent":616428,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-02-19T03:41:24","last_seen":"2026-10-23T22:22:37","events_24h":21,"events_7d":132,"interactive_sessions":208,"interactive_sessions_24h":33,"interactive_sessions_7d":204,"interactive_protocols":[{"protocol":"http","sessions":203},{"protocol":"ssh","sessions":3},{"protocol":"t3","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"South Carolina","city":"North Charleston","lat":32.8608,"lon":-79.9746,"asn":396982,"org":"Google LLC"},"source_domain":"25.149.216.162.bc.googleusercontent.com","known_scanners":["paloaltonetworks"],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","kev_date_added":"2026-04-16"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":208,"first_seen":"2026-10-15T02:28:25","last_seen":"2026-10-23T22:21:09","verdicts":[{"verdict":"scan","sessions":204},{"verdict":"unknown","sessions":4}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":97},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":72},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":27},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":3},{"persona":"linux-ubuntu@20.04","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":2}],"services":[{"protocol":"http","port":9036,"sessions":2},{"protocol":"http","port":58209,"sessions":2},{"protocol":"http","port":9851,"sessions":2},{"protocol":"http","port":48330,"sessions":2},{"protocol":"http","port":46620,"sessions":2},{"protocol":"http","port":9325,"sessions":2},{"protocol":"http","port":9893,"sessions":2},{"protocol":"http","port":9030,"sessions":2},{"protocol":"http","port":9567,"sessions":2},{"protocol":"http","port":35798,"sessions":2},{"protocol":"http","port":54986,"sessions":2},{"protocol":"http","port":31014,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":204}]},"top_ports":[{"port":3392,"proto":"tcp","label":"","count":11,"sessions":0},{"port":2443,"proto":"tcp","label":"","count":11,"sessions":0},{"port":13390,"proto":"tcp","label":"","count":11,"sessions":0},{"port":9197,"proto":"tcp","label":"","count":6,"sessions":0},{"port":5122,"proto":"tcp","label":"","count":5,"sessions":0},{"port":56263,"proto":"tcp","label":"","count":5,"sessions":0},{"port":52370,"proto":"tcp","label":"","count":4,"sessions":0},{"port":64328,"proto":"tcp","label":"","count":4,"sessions":0},{"port":8642,"proto":"tcp","label":"","count":4,"sessions":0},{"port":45136,"proto":"tcp","label":"","count":4,"sessions":0},{"port":11501,"proto":"tcp","label":"","count":4,"sessions":0},{"port":49551,"proto":"tcp","label":"","count":4,"sessions":0},{"port":9347,"proto":"tcp","label":"","count":4,"sessions":0},{"port":10715,"proto":"tcp","label":"","count":4,"sessions":0},{"port":39373,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303ea24832e8d7ae4f7238497293ffa6ea36596da0a1d74609806fee49c75df524f2030242b6cf7d6df23d36fe02591831ce7329d79a5c4af038286311e49121bb2e4001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c04fd2751f0a974301a16a243f672b004438b6c7e19434f14b2ee0c12b27bcc9544fac8aca273b072bdb62c5a7a4d38c758ca38224277bea220225dc00a0a89666909b004d46bd06025d389395f0aad17532c7a2842050518ac764e54c75664182ba94c6c09b3efef5bc72f7c3169b48782a5487a488122b5703357053a2b99ed36a4786b3f87b18b6121e7056b97c0502c85880c8bc09f44484262a72b6e10316f72213488042158b4589adfd039476f1b1a88ab943778ca6e720a15b4ec63576439c8479104b3d0727054b961202421b53c9c3363096a56a36833e23f11038729b0a5817e46b640fb603ef67720f0b9f238aa168c0062ed77986094f85987c9d7aa99b4b4b2ce07a6ba96334159e3013400c3b23dbb67ef625028e589883fc76340a58418081c5da31c81cca340a8ec4da18e47a59a0bc872914b962122c7f70ae652999a9a201840b303676a17dc249077a4fda5b730fa527f023776e5b042bda964a46788ac295a5d738f3b987d5a5af5a987a64853874052d9e84cd49d6870b539372f75b5ee96dd87b9f6c147e86540be9200f35d01146a93dabd8803aab2ebc4ab7aae8304d7a1501d5234a164059800b8f9889d24320ee7422e6418fd5e19fd6cca9caf09d5bd6750fb5364350a2ab778db37bb32c613a15a8af63056ad4c8a3738566dd1529572685c67847d526232285aba04782fc2173ac7c7d113769ba6a4f59b4be48f132c9d271c3f62516a7524d45a28a579cda781beba3bed6974a68b19470696a2deb818a3700f9283f9cd44334ec306a22127ea8b2e3329e37f79f4bb965dca0ada95202368a84cf985e78434ef33779d2bccd6f125e0d9a5688033871e4c402172ae1a99411024b26b364e67794366853e6a16cfbe0c957d6265e55262b0560cc41cbee9923cc875422d57c9a8b803a2027bf9a2ab658b168855875aaa92df6a946943e319742929c4d428c3d8742080163be05b5c72d727278f81f8218982a656094624cee8b34467cbd91466e9786376e880b3003a2a7b889bcf0ae41c620305c520053a36b6a0627219ce26bb07c96016ef5315374566fbbaa92500c03b6a6ae57798ac6bc6e124d64895ba73b8042c29b10c8ad2827135d5b5b2b522534091a37ec032e026e013031a2e7619fe69d6e932238d079eb0b8d2c51958fb44682895324e790e433089c945a5c56879c144a734c9b94c75e1da4536aa93ae0c273e7373393845506140bd2bbc549b38c6941c7e63c7fdda26cb7777fc57b592c34b48087574a88beb8536eb6614643aaaaaab08c54fbb3e334bc81e397a6468bbcdb52f3a6af1a00c622eb22c2501ffb25acd0483dc2409c944587d58c6c71a609d5958ff0c2399b92933af95f1c7a07d93ca76226af1fe39894e3952daa0fc75c2e2f91abaee263d9e623d3302b1d91b02ebc0ddaab12c33c60f3037163b0cb525902e8404e346c640050b49c154533b36b24aaad1019af31216d5a6b74b8233f6cf62b32dab2230cca79bcceee88c13fe65eaa810e2446711fc34c6a004a0ebb5480b8263beb0d3afc829bf2ac1f72cf1647c8fb4cbf5c6a824db73dbdfc2d2ad182ceb0b4dc49bbea698fe359cdcbb1bf880231647632705f6552f590a9f72da81cd72d68da293b792c7a9896e03e78ca3de2d21db2e3d2eeb9daff9cc790cfe72fcdbcfcd6cff13d4a171deb4ed1fcee0ba3bb1c4127001d0020d2eeb9daff9cc790cfe72fcdbcfcd6cff13d4a171deb4ed1fcee0ba3","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b10cun020_00000014_0a8d7f11","b11cun020_00040010_724c10fb"],"interactive":{"ssh_hassh":["dd9bcf093c355da7000132131cb36fd0"],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":756,"t13i131000_f57a46bbacb6_ab7e3b40a677":3138,"dd9bcf093c355da7000132131cb36fd0":0,"b11cun030_00040012_13ee3d34":5348,"b10cun020_00000014_0a8d7f11":2036,"b11cun020_00040010_724c10fb":1721},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":2,"ips":1721}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"],"timeline":[{"date":"2026-07-26","count":11,"sessions":0},{"date":"2026-07-27","count":24,"sessions":0},{"date":"2026-07-28","count":5,"sessions":0},{"date":"2026-07-29","count":18,"sessions":0},{"date":"2026-07-30","count":31,"sessions":0},{"date":"2026-07-31","count":34,"sessions":0},{"date":"2026-08-01","count":29,"sessions":0},{"date":"2026-08-02","count":17,"sessions":0},{"date":"2026-08-03","count":15,"sessions":0},{"date":"2026-08-04","count":31,"sessions":0},{"date":"2026-08-05","count":13,"sessions":0},{"date":"2026-08-06","count":25,"sessions":0},{"date":"2026-08-07","count":32,"sessions":0},{"date":"2026-08-08","count":13,"sessions":0},{"date":"2026-08-09","count":17,"sessions":0},{"date":"2026-08-10","count":19,"sessions":0},{"date":"2026-08-11","count":17,"sessions":0},{"date":"2026-08-12","count":20,"sessions":0},{"date":"2026-08-13","count":40,"sessions":0},{"date":"2026-08-14","count":15,"sessions":0},{"date":"2026-08-15","count":26,"sessions":0},{"date":"2026-08-16","count":21,"sessions":0},{"date":"2026-08-17","count":20,"sessions":0},{"date":"2026-08-18","count":20,"sessions":0},{"date":"2026-08-19","count":17,"sessions":0},{"date":"2026-08-20","count":28,"sessions":0},{"date":"2026-08-21","count":17,"sessions":0},{"date":"2026-08-22","count":31,"sessions":0},{"date":"2026-08-23","count":19,"sessions":0},{"date":"2026-08-24","count":17,"sessions":0},{"date":"2026-08-25","count":23,"sessions":0},{"date":"2026-08-26","count":25,"sessions":0},{"date":"2026-08-27","count":16,"sessions":0},{"date":"2026-08-28","count":32,"sessions":0},{"date":"2026-08-29","count":46,"sessions":0},{"date":"2026-08-30","count":14,"sessions":0},{"date":"2026-08-31","count":21,"sessions":0},{"date":"2026-09-01","count":19,"sessions":0},{"date":"2026-09-02","count":22,"sessions":0},{"date":"2026-09-03","count":27,"sessions":0},{"date":"2026-09-04","count":15,"sessions":0},{"date":"2026-09-05","count":24,"sessions":0},{"date":"2026-09-06","count":16,"sessions":0},{"date":"2026-09-07","count":23,"sessions":0},{"date":"2026-09-08","count":29,"sessions":0},{"date":"2026-09-09","count":27,"sessions":0},{"date":"2026-09-10","count":24,"sessions":0},{"date":"2026-09-11","count":20,"sessions":0},{"date":"2026-09-12","count":31,"sessions":0},{"date":"2026-09-13","count":38,"sessions":0},{"date":"2026-09-14","count":15,"sessions":0},{"date":"2026-09-15","count":30,"sessions":0},{"date":"2026-09-16","count":27,"sessions":0},{"date":"2026-09-17","count":21,"sessions":0},{"date":"2026-09-18","count":26,"sessions":0},{"date":"2026-09-19","count":23,"sessions":0},{"date":"2026-09-20","count":27,"sessions":0},{"date":"2026-09-21","count":19,"sessions":0},{"date":"2026-09-22","count":10,"sessions":0},{"date":"2026-09-23","count":7,"sessions":0},{"date":"2026-09-24","count":25,"sessions":0},{"date":"2026-09-25","count":17,"sessions":0},{"date":"2026-09-26","count":18,"sessions":0},{"date":"2026-09-27","count":13,"sessions":0},{"date":"2026-09-28","count":15,"sessions":0},{"date":"2026-09-29","count":13,"sessions":0},{"date":"2026-09-30","count":13,"sessions":0},{"date":"2026-10-01","count":9,"sessions":0},{"date":"2026-10-02","count":17,"sessions":0},{"date":"2026-10-03","count":18,"sessions":0},{"date":"2026-10-04","count":14,"sessions":0},{"date":"2026-10-05","count":17,"sessions":0},{"date":"2026-10-06","count":19,"sessions":0},{"date":"2026-10-07","count":23,"sessions":0},{"date":"2026-10-08","count":14,"sessions":0},{"date":"2026-10-09","count":22,"sessions":0},{"date":"2026-10-10","count":16,"sessions":0},{"date":"2026-10-11","count":40,"sessions":0},{"date":"2026-10-12","count":9,"sessions":0},{"date":"2026-10-13","count":24,"sessions":0},{"date":"2026-10-14","count":17,"sessions":0},{"date":"2026-10-15","count":11,"sessions":3},{"date":"2026-10-16","count":20,"sessions":1},{"date":"2026-10-17","count":15,"sessions":3},{"date":"2026-10-18","count":16,"sessions":3},{"date":"2026-10-19","count":14,"sessions":0},{"date":"2026-10-20","count":23,"sessions":26},{"date":"2026-10-21","count":23,"sessions":3},{"date":"2026-10-22","count":19,"sessions":135},{"date":"2026-10-23","count":24,"sessions":34}],"recent_events":[{"timestamp":"2026-10-23T22:22:37","port":9880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9880\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393838300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"603e0d75-0cc8-47b9-819a-9577ced3a519","seq":1,"duration_ms":101,"bytes_in":220,"bytes_out":79},{"timestamp":"2026-10-23T22:21:09","port":60003,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:60003\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a36303030330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"9323f27b-f494-48a8-ad39-29baefadfe74-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T22:20:20","port":26320,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"f3318ed9-d26a-496a-ac50-8d18adb2fa78","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T21:55:45","port":4635,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"1de411cc-a7ab-41ed-91b0-49ac81bcc6ce","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T21:35:10","port":41142,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"171c3583-9b0d-4702-8212-b5cac7197f3a","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T17:55:45","port":50975,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"573c09fc-4bf1-409c-a12c-6081dd9e4915","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T17:30:35","port":19405,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"ca014366-01ee-4558-a273-85ed7422d329","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T17:17:41","port":37825,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"1d65ffc8-e339-4f4d-a11d-65fa28c2487a","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-10-23T15:26:16","port":28726,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:28726\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f757365727320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a32383732360d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"fc0c9328-d0fd-4033-81da-b92ff8adecea-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T15:26:15","port":48158,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:48158\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f757365727320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a34383135380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"1487bd354c20f20dd642bebc7f706e95","session":"be415901-342b-4f11-9709-cb5a3a137019-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":3309}],"distinct_ports_total":2694,"top_paths":[{"path":"/","count":2825,"ports":2103},{"path":"/.well-known/security.txt","count":250,"ports":245},{"path":"/wp-login.php","count":39,"ports":39},{"path":"/wp-json/","count":35,"ports":35},{"path":"/wp-json/wp/v2/users","count":35,"ports":35},{"path":"/xmlrpc.php","count":29,"ports":29},{"path":"/api/jolokia/list","count":17,"ports":17},{"path":"/api/jolokia","count":16,"ports":16},{"path":"/jolokia/exec","count":12,"ports":12},{"path":"/jolokia","count":11,"ports":11},{"path":"/jolokia/version","count":10,"ports":10},{"path":"/api/jolokia/version","count":9,"ports":9},{"path":"/actuator/jolokia/version","count":9,"ports":9},{"path":"/jolokia/write","count":6,"ports":6},{"path":"/jolokia/list","count":6,"ports":6}],"distinct_paths_total":15,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":81}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9880","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[],"kev_date_added":"2026-04-16"}]}