{"ip":"198.235.24.36","total_events":598,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"66,883 bytes sent","bytes_sent":66883,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-17T13:41:35","last_seen":"2026-09-28T20:38:21","events_24h":7,"events_7d":22,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"","lat":34.0544,"lon":-118.244,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":59},{"port":20256,"proto":"tcp","label":"","count":17},{"port":20257,"proto":"tcp","label":"","count":16},{"port":9983,"proto":"tcp","label":"","count":11},{"port":3388,"proto":"tcp","label":"","count":11},{"port":20000,"proto":"tcp","label":"","count":10},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":8},{"port":10001,"proto":"tcp","label":"","count":7},{"port":4117,"proto":"tcp","label":"","count":6},{"port":10443,"proto":"tcp","label":"","count":6},{"port":88,"proto":"tcp","label":"","count":5},{"port":5000,"proto":"tcp","label":"Web-alt","count":5},{"port":54528,"proto":"tcp","label":"","count":5},{"port":32569,"proto":"tcp","label":"","count":5},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c203036a10866f5431060cfbe5f3f531d4afdcbcd09af0c44be5cde3f4fb0c4bc84263207f608c9de392d1f9ff83b20729bd809131df02867eba7311c64f15c74b7df798001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0db12ae6870ceb337174cda4eb9058e59b60096089b3865cc3fc9b4ef545df1c62934b66b24fba4f93828b4e335c57b9f88e72c5412618e3093370c6761aac55c99b6f052a9a1a800c638bf5b9409ea0a59a7b17015e8be2655ca6d5cb8765c4c7ddc07943bcd35f928e5b18a92e56dd9329f8271b38a547f40c328ff8212d4613a0005be3a172420297da1388bdeb4a06ecbc34d03939229ba6e48724feb2de6c68b38e7771787a4590b148af0bddae9635c93b6f5b0a1db774336109a1ae776ce309732410eb11c73979594d147cca4c53383283f74543b332077a89ba2723b1e1da5be02a495e58868e47cabb6412391d1c3f6c9312d070a45f41376f831aed577a310caf5100ecb89ae7a435c6c7327c8ac4e6919149bc4ad6ee4cbca24be50d68d63bb3f3ba232e3a4642f7a160e2369bd7894bd414698629f536a5279827dab54581dc3b83686660d2b3a4e9671555c04ab804810b68886d83067279b0638937cfa7116f4cbb87393268a192a6c4ea206c155e25bcbf6b74a0b9c2f7a22ba6a7be02c6d0e4c225881575cfb52b6a002bcd58f090b6ad2f9af1131858eec659d1841fc4269e66004efd0b06ddc7600224a2d9a6dec31545879ab4e6446a3c4446ac679b7f7ac5368ca8741bf07a421fac74ab7671b6867a6448c721b31a5f55c1dbbba8982495505b812c8b7661b237fcc064c8a92c08974258d8677e780429507b78ce27d56492276656dfb767c649c39b9e914bccb773f830d36677a78c99a9366242aa60809285449a8a134ea2c50ba511fc26ab8b66370506c4d5a6219351b5b31c9728027521692e70a1fe86cb13d02a27fd44ea6a08f4ea609a484260263a9ec496435b9b8146cc6af455ccd1c1147799f54901511ecc8a0dcaa1d6a7e5b54bb068b8744f0522ef223b4abb84ee09d26f10ed785c872524602d26868446786abb4508b7557bc7375c478199ab5bc305a93c928aaaa81bbf807e003cc4bd18cd23a669187022d9c1a38127256c24e488870d5c43fa5621f6b0677b9596624b9765661b9ecc12089db5f65f258a096cbbc57a85ed352914217093a5d226c86df228ee8043251e8300547665a295015a446c42c69521a455e529eace56305a45315797dfdd083b38b5465c4c654d7ae2e358c8613b8385b94ff7b3001a0965ed14ee6ac2af0754192f75762480eda785b91d49fc589ae1b2a9ee321cc2782aa09585374d78846c76c92d6005a01a8ceb09b861a2dab1047b62212b6f52723570c09187e2b3bbde277172fda219492cfaab80a2c9a2d704440659447e6d6597d1619c33a3570009ff992caef7b071eb355306379aea8c2dc4747af145bc0033b46009812ea05b9952da495b3d940778bb4ceef121e4a39455ec21030b51fdee5cc25cab3005a85881863b87866602448ae93ccb760b088712c80f53d3f28ba99f8c057d233efa263addc715998c99dd011b37ac912bb39c15bc8472b137b84bd5e323d33983d6f8693aefb1d4d32040adb4a116b7f3e60ccde389bbc4419e0b1076ef080e5f9404e795db5d99c797c8f47975936d9ae161c943c407c648ca3805842bdd847c1068f92890c92b0c4f3693a800bc7d0601231d267a5d9791607d3815096fbae27c40e2a543015a83fb86de41f41f395bfa922d2c492b484eda2782f8ca52410008472c3b6e32cba1e27ed3f6ccd341768c2d69fbe94a14b001d0020eda2782f8ca52410008472c3b6e32cba1e27ed3f6ccd341768c2d69f","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_0000004c_13ee3d34","a10cun020_00000041_0a8d7f11"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3137,"t13i140900_cbb2034c60b8_e7c285222651":766,"t13i311000_e8f1e7e78f70_24695f2957a7":512,"t13i131000_f57a46bbacb6_ab7e3b40a677":4975,"a11cun030_0000004c_13ee3d34":2540,"a10cun020_00000041_0a8d7f11":1663},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":2,"ips":2540}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-01","count":1},{"date":"2026-07-02","count":2},{"date":"2026-07-03","count":4},{"date":"2026-07-04","count":1},{"date":"2026-07-05","count":1},{"date":"2026-07-07","count":5},{"date":"2026-07-08","count":3},{"date":"2026-07-10","count":1},{"date":"2026-07-12","count":4},{"date":"2026-07-13","count":3},{"date":"2026-07-14","count":1},{"date":"2026-07-15","count":3},{"date":"2026-07-16","count":1},{"date":"2026-07-17","count":1},{"date":"2026-07-18","count":2},{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":5},{"date":"2026-07-21","count":6},{"date":"2026-07-22","count":12},{"date":"2026-07-23","count":5},{"date":"2026-07-24","count":2},{"date":"2026-07-25","count":3},{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":2},{"date":"2026-07-28","count":4},{"date":"2026-07-29","count":3},{"date":"2026-07-30","count":3},{"date":"2026-07-31","count":3},{"date":"2026-08-01","count":4},{"date":"2026-08-02","count":1},{"date":"2026-08-03","count":3},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":2},{"date":"2026-08-07","count":2},{"date":"2026-08-08","count":2},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":3},{"date":"2026-08-13","count":2},{"date":"2026-08-14","count":1},{"date":"2026-08-15","count":3},{"date":"2026-08-16","count":1},{"date":"2026-08-17","count":3},{"date":"2026-08-18","count":3},{"date":"2026-08-19","count":4},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-22","count":2},{"date":"2026-08-23","count":6},{"date":"2026-08-24","count":1},{"date":"2026-08-25","count":2},{"date":"2026-08-26","count":4},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":4},{"date":"2026-08-30","count":2},{"date":"2026-09-01","count":5},{"date":"2026-09-02","count":12},{"date":"2026-09-03","count":2},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-07","count":4},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":3},{"date":"2026-09-11","count":3},{"date":"2026-09-12","count":2},{"date":"2026-09-13","count":2},{"date":"2026-09-14","count":1},{"date":"2026-09-15","count":2},{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":13},{"date":"2026-09-21","count":2},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":3},{"date":"2026-09-27","count":4},{"date":"2026-09-28","count":5}],"recent_events":[{"timestamp":"2026-09-28T20:38:21","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"081941b2-cd99-47da-9a3b-26c4d4881aea","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-28T09:19:10","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"efa6d3d1-86f6-4e21-af96-6a1182fc0431","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-28T01:49:53","port":8880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8880\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"33ae46ec-dfff-4c0f-9986-b502a66de35f","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-28T01:28:10","port":50002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:50002\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303030320d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"ba6d2e67-1763-4a11-bac8-29a56a8ef51a","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":78},{"timestamp":"2026-09-28T01:11:10","port":9997,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9997\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939370d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"ba2ed16c-3e16-4d8d-98e7-9d034b1c09f3","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-27T23:35:40","port":88,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000sjq0o�\u0003\u0002\u0001\u0005�\u0003\u0002\u0001\n�c0a�\u0007\u0003\u0005\u0000@\u0000\u0000\u0000�\u000b\u001b\tREALM.com�\u001e0\u001c�\u0003\u0002\u0001\u0002�\u00150\u0013\u001b\u0006krbtgt\u001b\tREALM.com�\u0011\u0018\u000f20260928083540Z�\u0006\u0002\u0004\tJv��\u000e0\f\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017","payload_hex":"000000736a71306fa103020105a20302010aa4633061a00703050040000000a20b1b095245414c4d2e636f6da31e301ca003020102a11530131b066b72627467741b095245414c4d2e636f6da511180f32303236303932383038333534305aa7060204094a7681a80e300c020112020111020110020117","method":"","user_agent":"","ja3":"","session":"3e4b8c5e-0014-4944-92fd-a55323ff1628","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":13,"enriched":{"digest":"db7d7e1c293882df","strings":["sjq0o","REALM.com","krbtgt","20260928083540Z"],"iocs":{"domains":["realm.com"]}}},{"timestamp":"2026-09-27T22:34:09","port":50001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:50001\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303030310d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"45ada5b0-16e3-4ec8-8c05-b7829e331b89","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":78},{"timestamp":"2026-09-27T19:32:05","port":6568,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6568\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363536380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"ca246df8-27a5-4aaf-855a-9b86fcf4c886","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-27T07:29:14","port":5557,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5557\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535370d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"397cfc27-15e9-402d-92a0-7050789b8e40","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-26T19:15:08","port":3929,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3929\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333932390d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"c180f014-95a9-4cbc-98a6-990170ceabdf","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":78}],"http_methods":[{"method":"GET","count":292},{"method":"POST","count":2}],"distinct_ports_total":245,"top_paths":[{"path":"/","count":275,"ports":147},{"path":"/.well-known/security.txt","count":11,"ports":10},{"path":"/jolokia/list","count":3,"ports":3},{"path":"/jolokia","count":1,"ports":1},{"path":"/_config","count":1,"ports":1},{"path":"/api/jolokia","count":1,"ports":1},{"path":"/jolokia/version","count":1,"ports":1},{"path":"/jolokia/exec","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[{"value":"panel.heliosnode.nl","count":1}],"top_hosts":[{"value":"panel.heliosnode.nl","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":3}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:4443","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-28T21:35:30.971686+00:00"}