{"ip":"205.210.31.130","total_events":254,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,938 bytes sent","bytes_sent":20938,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-19T18:37:09","last_seen":"2026-10-02T08:14:47","events_24h":4,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":69},{"port":20256,"proto":"tcp","label":"","count":7},{"port":18245,"proto":"tcp","label":"","count":4},{"port":20000,"proto":"tcp","label":"","count":4},{"port":6002,"proto":"tcp","label":"","count":4},{"port":9092,"proto":"tcp","label":"Kafka","count":4},{"port":13911,"proto":"tcp","label":"","count":3},{"port":13,"proto":"tcp","label":"","count":3},{"port":1962,"proto":"tcp","label":"","count":3},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":623,"proto":"tcp","label":"","count":3},{"port":9192,"proto":"tcp","label":"","count":3},{"port":8126,"proto":"tcp","label":"","count":3},{"port":9051,"proto":"tcp","label":"","count":3},{"port":5432,"proto":"tcp","label":"Postgres","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303f50a4ce194da41a4d96368258a994431f6b2a6b39e2889ebd2a828a34cdf638520d10d7f9c5b2d65a19f86d64970b29be630d6e6f692082b47d60ab6de7bc2c336001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c08bc45cff27bcb1cc6955dc644a308ac1dcbf7d54a205e8c39f9507a69ccd1da51d9e2a36b131100aa01b8888a00769695a574cb52c9d423483454574452c7aae627d9bcb2b601c7f9e514c00f789eb0a7465092ca2d3a9d49b509e440961331e1c94772c67a9ce97687a45a853f26dd4cabe6bf32fa764b94812c3f359cfc799a24787330c222d86b9b001a15ddf4c5e396a0fe8e8cf6f405afcb8cc88b3a6d9092016797a64511e9a694c944061aa769632920c3da397a0c7526c1611bb319ea6a6925c178013a5aa7e92915ff4a153c856864a07b850cc687ba0ab25363b55218f5b7696c49450923d57102245c84506684fb781560b6385088bb8ee16169bbb9664442c89d374d8e2bc69447afdc0a50a3bad2bea333e8a6935559fced0929d327a63d439a113bf3f8c7a6d3ab4bf177c6b34cdfc55b1df9721ac0484dcc98d0c6ab570e9ba8914ca7662a6bfc89fccf3c75ab99b15c50eb5dc80cdc26c2ef978de959be1a63394d43f1934b908915e056bb635566466676dae3b0c00080bbe8bb225229ee64590b5377a979418c9c8145ec30b0c6b82aaf354e2788e25c46c83e26efef38555395a0e2b9bdb453fd4ac9899e245a4540b7852a78086ae15a11c4d147395e1b89f9ab2007b1788ba6338e13fc5460acab28f7f35b16dca38df6bb0147600827850f90494c67cbd5b9564b3287409d2514cca09baf10e8d980502d932a5a90c37c833b39466fcd702aa853ff1243ae095204c4a7bc5879b38ac750e552373f4c8bc3b162443cb92ea63ce5061f2256fd249a29c3c621c3064dad5ad7890567b3a1f251280a9995fac048321561a2032764521a7f86671fc28339b99148be9544af8c50bf32e7540befd073102616dec07ae0b0ba49618c53d41958f71a079649dd75885aac52319bc8cae798111f41cc15631764545082b029b50904738834b161954927672383d266ac0ed475fa3315b9636769d696486d768c4246046f3c01b401300187e9f628a03227ee9b9a8e82b308aa4cb7d1b313a37b9e9e05919876a138c14eb6b3602fc40db76aac6a46f1946591f131bc42958be90946437572685cc0cf133a9b78b34543f278349a21688cc3944ac8a143cd21aa0c01c97d12773d6b4fa324d2a148f2c2c254ce3a390709f1d04823cec516bcc991751412e51caeec88b344c82e5b59e2c06a0731bbc360764593898750b5f44c4ac5c353f20ca04f4d91d67e719dbca8a2feba3b49aa5cce099bbc93213949649161f5215b0523230b3f2a553291295d0c147b0ba4868c156bc90d2619edcfb6ce83040f21c1fae60bb8610784e828baee27a7136bf8a426d8eb20f0acc838b8b94362559d9b533fc3c5a97072c7ccb48cf410bf6a5621a94a821d41ff7ba6cc9eab66462a4bebc27c977740843bedcd28b6b59265a562b16bc41f28a864baa0832e99a243b36e342695cc419b70ac9c7d740c616634a2466a346c5cd975edf390bac36baa366b7fff170f5c46fb4e279070107b01c6dc613c50a2a0b7383184026ada5dbc57a6b179801116b710b47684aa9d875a44c33549768c2987b329c29fec786d47c7b1a896540936bdbe0b64a38bac9d924d8996e86e73ee802a03a494f1ce60fc98d08869609ae9b5c10c5398ac2585db8987daca84366ba04bb2b28f4a8219fc5941d9a49a97fd6ed3de33c70f049f0acd6df444673df853357001d00202b28f4a8219fc5941d9a49a97fd6ed3de33c70f049f0acd6df444673","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00040010_724c10fb","b10cun020_00000014_0a8d7f11","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3156,"t13i140900_cbb2034c60b8_e7c285222651":657,"t13i311000_e8f1e7e78f70_24695f2957a7":517,"t13i131000_f57a46bbacb6_ab7e3b40a677":4642,"b11cun030_00040012_13ee3d34":5052,"b11cun020_00040010_724c10fb":1440,"b10cun020_00000014_0a8d7f11":1984,"b11cun030_00040014_54d07b6d":3682},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1440}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-05","count":2},{"date":"2026-07-06","count":1},{"date":"2026-07-09","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-13","count":1},{"date":"2026-07-18","count":1},{"date":"2026-07-23","count":1},{"date":"2026-07-26","count":1},{"date":"2026-07-27","count":1},{"date":"2026-07-28","count":2},{"date":"2026-07-29","count":1},{"date":"2026-07-31","count":3},{"date":"2026-08-02","count":1},{"date":"2026-08-03","count":1},{"date":"2026-08-05","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":11},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":4},{"date":"2026-08-11","count":1},{"date":"2026-08-13","count":1},{"date":"2026-08-16","count":1},{"date":"2026-08-18","count":1},{"date":"2026-08-19","count":1},{"date":"2026-08-21","count":1},{"date":"2026-08-23","count":1},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":1},{"date":"2026-08-26","count":1},{"date":"2026-08-30","count":14},{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":2},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-22","count":4},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-02","count":4}],"recent_events":[{"timestamp":"2026-10-02T08:14:47","port":2181,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats\r\n","payload_hex":"73746174730d0a","method":"","user_agent":"","ja3":"","session":"96a47260-b667-4732-9f72-5515d9fbdc00","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"8ba3dc4bf81a4992","label":"Memcached","strings":["stats"]}},{"timestamp":"2026-10-02T08:01:14","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"dd7fc54d-fc27-4c72-89ad-9751ba65ca64","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":79},{"timestamp":"2026-10-02T00:24:47","port":9051,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"getinfo config-text\r\n","payload_hex":"676574696e666f20636f6e6669672d746578740d0a","method":"","user_agent":"","ja3":"","session":"d0ecb60b-c58d-4dd6-878c-c3853b0c9986","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"46a307345d07b234","strings":["getinfo config-text"]}},{"timestamp":"2026-10-02T00:24:47","port":9051,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"getinfo config-text\r\n","payload_hex":"676574696e666f20636f6e6669672d746578740d0a","method":"","user_agent":"","ja3":"","session":"697babfc-d469-43d2-b66a-8a68c041a178","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"46a307345d07b234","strings":["getinfo config-text"]}},{"timestamp":"2026-09-30T08:47:40","port":1801,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1801\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313830310d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"e2d219cd-6465-43a5-93eb-3cae1f4096c6","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-29T09:49:54","port":23656,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:23656\",\"user-agent\":\"curl/7.68.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32333635360d0a557365722d4167656e743a206375726c2f372e36382e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.68.0","ja3":"004556e859f3c26c5d19746b3a957c74","session":"9d483331-d7a4-48e9-b463-444468881dc1","seq":1,"duration_ms":228,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-27T00:46:09","port":4567,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"b47a400e-b41b-4630-a855-8501797550bc","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-26T00:15:22","port":2602,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"67f107b9-51f3-4a09-94a1-ca0e6d0cda86","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-22T19:36:03","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"2fccd058-57cd-4242-b6cd-b9323eccab13","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-22T04:33:42","port":20256,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SIe\u0000\b\u0000/00IDED\r","payload_hex":"5349650008002f3030494445440d","method":"","user_agent":"","ja3":"","session":"8b178f26-fa24-4d96-ada5-9199eb26de78","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14,"enriched":{"digest":"011b3d9d039817c9","strings":["/00IDED"]}}],"http_methods":[{"method":"GET","count":74}],"distinct_ports_total":122,"top_paths":[{"path":"/","count":48,"ports":44},{"path":"/.well-known/security.txt","count":7,"ports":7},{"path":"/api/jolokia","count":4,"ports":4},{"path":"/jolokia","count":3,"ports":3},{"path":"/api/jolokia/version","count":3,"ports":3},{"path":"/jolokia/write","count":2,"ports":2},{"path":"/jolokia/exec","count":2,"ports":2},{"path":"/actuator/jolokia/version","count":2,"ports":2},{"path":"/jolokia/version","count":1,"ports":1},{"path":"/jolokia/list","count":1,"ports":1},{"path":"/api/jolokia/list","count":1,"ports":1}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[{"value":"chicago.vpnigo.de","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":2}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:6443","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":3,"events_with_headers":5},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-10-02T21:48:40.609951+00:00"}