{"ip":"198.235.24.140","total_events":209,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,318 bytes sent","bytes_sent":15318,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-17T13:40:01","last_seen":"2026-10-05T07:35:52","events_24h":1,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"","lat":34.0544,"lon":-118.244,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":44818,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T19:49:47","last_seen":"2026-10-05T19:49:47","recent":[{"timestamp":"2026-10-05T19:49:47","port":44818,"src_port":49690,"proto":"udp","app_proto":"","app_protocol":"","summary":"c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"630000000000000000000000000000000000000000000000","sni":"","session":"74c5407e-483b-4298-9e18-ffb2a0bdb5a3","bytes_in":24,"source_verified":false}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":38},{"port":4730,"proto":"tcp","label":"","count":3},{"port":20256,"proto":"tcp","label":"","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":541,"proto":"tcp","label":"","count":3},{"port":10011,"proto":"tcp","label":"","count":3},{"port":20257,"proto":"tcp","label":"","count":3},{"port":27015,"proto":"tcp","label":"","count":3},{"port":135,"proto":"tcp","label":"MSRPC","count":3},{"port":10250,"proto":"tcp","label":"","count":2},{"port":50100,"proto":"tcp","label":"Cassandra","count":2},{"port":22,"proto":"tcp","label":"SSH","count":2},{"port":7070,"proto":"tcp","label":"","count":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2},{"port":10000,"proto":"tcp","label":"Webmin","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030100e8010000e403038acd0d67a98410e5ecfb1e78cd9d312749a83f97be68e3546889a92bdd20f73220fef8b0ad1a30e01b34d655736bd2ef27e659420a3f138325eb982be12c109583001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007f000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003300260024001d0020e1ef517691debd7ded52a4aabf7a3b83942f70e104cfa8c9058863d0d7f53357","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00040010_724c10fb","b10cun020_00000014_0a8d7f11","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3123,"t13i140900_cbb2034c60b8_e7c285222651":771,"t13i311000_e8f1e7e78f70_24695f2957a7":517,"t13i131000_f57a46bbacb6_ab7e3b40a677":4075,"b11cun030_00040012_13ee3d34":4801,"b11cun020_00040010_724c10fb":1548,"b10cun020_00000014_0a8d7f11":2006,"b11cun030_00040014_54d07b6d":3696},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1548}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-08","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-13","count":2},{"date":"2026-07-14","count":1},{"date":"2026-07-15","count":1},{"date":"2026-07-18","count":1},{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":1},{"date":"2026-07-21","count":1},{"date":"2026-07-22","count":2},{"date":"2026-07-24","count":2},{"date":"2026-07-26","count":3},{"date":"2026-07-28","count":11},{"date":"2026-07-29","count":1},{"date":"2026-07-31","count":2},{"date":"2026-08-02","count":2},{"date":"2026-08-04","count":3},{"date":"2026-08-05","count":1},{"date":"2026-08-06","count":2},{"date":"2026-08-12","count":1},{"date":"2026-08-13","count":2},{"date":"2026-08-14","count":1},{"date":"2026-08-18","count":1},{"date":"2026-08-20","count":2},{"date":"2026-08-24","count":1},{"date":"2026-08-28","count":1},{"date":"2026-08-31","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":1},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":1},{"date":"2026-09-14","count":2},{"date":"2026-09-15","count":1},{"date":"2026-09-16","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-02","count":3},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":3},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T07:35:52","port":81,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:81\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38310d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"0ff2eb40-5e2f-4a81-a0ee-1bcff8707179","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":79},{"timestamp":"2026-10-04T15:16:44","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"1487bd354c20f20dd642bebc7f706e95","session":"93d8de58-43eb-407e-913b-48d6dce6b663","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":79},{"timestamp":"2026-10-04T12:30:50","port":135,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000�\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000","payload_hex":"000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"b185a6af-b080-4253-8f34-0b4ecc013f41","seq":1,"duration_ms":101,"bytes_in":168,"bytes_out":14,"enriched":{"digest":"517d6cf13ba58442","strings":["SMBr","PC NETWORK PROGRAM 1.0","MICROSOFT NETWORKS 1.03","MICROSOFT NETWORKS 3.0","LANMAN1.0","LM1.2X002","Samba","NT LANMAN 1.0","NT LM 0.12"]}},{"timestamp":"2026-10-04T12:30:40","port":135,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000�\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000","payload_hex":"000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"7a5c17cb-3eb7-49b3-bcd6-49d4daf1a2f9","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":14,"enriched":{"digest":"517d6cf13ba58442","strings":["SMBr","PC NETWORK PROGRAM 1.0","MICROSOFT NETWORKS 1.03","MICROSOFT NETWORKS 3.0","LANMAN1.0","LM1.2X002","Samba","NT LANMAN 1.0","NT LM 0.12"]}},{"timestamp":"2026-10-03T19:18:25","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS * RTSP/1.0\r\nCSEQ: 1\r\n\r\n","payload_hex":"4f5054494f4e53202a20525453502f312e300d0a435345513a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"dc7b07d9-de46-4944-af59-a607a21a4c99","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":79,"enriched":{"digest":"d691fa286f14c7a3","label":"HTTP","strings":["OPTIONS * RTSP/1.0","CSEQ: 1"]}},{"timestamp":"2026-10-02T13:39:52","port":50100,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b2300988-88e2-437a-b81c-2f86316b8d90","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-10-02T09:03:23","port":50001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:50001\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303030310d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"c07a6ff5-282c-4e24-8abe-6a2561debebf","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79},{"timestamp":"2026-10-02T00:25:13","port":49,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001\u0001\u0000�/\u0010�\u0000\u0000\u0000\u0017u�S< @BB��t�\u0001\"a8o�MS���","payload_hex":"c00101008f2f10a00000001775eb533c2040424289ac7497012261386ffd4d53d8e2ad","method":"","user_agent":"","ja3":"","session":"5561f210-665b-48d2-bebd-64e1b5ffb3ff","seq":1,"duration_ms":100,"bytes_in":35,"bytes_out":14,"enriched":{"digest":"4a47dc4cb8300ac2","strings":["S< @BB","\"a8o"]}},{"timestamp":"2026-10-01T07:35:21","port":43676,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:43676\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34333637360d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"429cd878-6c73-487e-8317-bef59be5c1f6","seq":1,"duration_ms":101,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-28T08:30:23","port":465,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:465\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3436350d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"b6257767-b6b9-4bdd-9855-032657fbee08","seq":1,"duration_ms":94,"bytes_in":220,"bytes_out":40}],"http_methods":[{"method":"GET","count":77},{"method":"POST","count":1}],"distinct_ports_total":127,"top_paths":[{"path":"/","count":63,"ports":54},{"path":"/.well-known/security.txt","count":6,"ports":6},{"path":"/jolokia","count":2,"ports":2},{"path":"/jolokia/exec","count":2,"ports":2},{"path":"/wsman","count":1,"ports":1},{"path":"/jolokia/version","count":1,"ports":1},{"path":"/jolokia/list","count":1,"ports":1},{"path":"/api/jolokia/version","count":1,"ports":1},{"path":"/actuator/jolokia/version","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":2}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:81","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-10-05T23:10:58.466440+00:00"}