{"ip":"205.210.31.23","total_events":219,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,936 bytes sent","bytes_sent":15936,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-17T01:39:13","last_seen":"2026-09-27T09:01:38","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":27},{"port":31337,"proto":"tcp","label":"","count":6},{"port":22,"proto":"tcp","label":"SSH","count":4},{"port":4369,"proto":"tcp","label":"","count":4},{"port":10011,"proto":"tcp","label":"","count":4},{"port":20256,"proto":"tcp","label":"","count":4},{"port":5986,"proto":"tcp","label":"","count":3},{"port":2605,"proto":"tcp","label":"","count":3},{"port":10000,"proto":"tcp","label":"Webmin","count":3},{"port":2604,"proto":"tcp","label":"","count":3},{"port":943,"proto":"tcp","label":"","count":2},{"port":541,"proto":"tcp","label":"","count":2},{"port":54498,"proto":"tcp","label":"","count":2},{"port":3000,"proto":"tcp","label":"Web-alt","count":2},{"port":50100,"proto":"tcp","label":"Cassandra","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e7010005e303036723dad8164b9e6d17506c9bd008fbf52e7cad55db28b2a5434c9b50ac8225e5204746390841a5725122bd9c05d48563b8df4ae32138c243ae8c94a3066e5ab034001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010005800000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0277a50e4ba12cc10b47cf532a8558250223355b17e528b2c37a75714393088425583b520ee66382e956ec7331e6be97cd1207d99e5a9cca876c1a0b5e697c6c8b8c9acc4a6715b3aeed38c0d6175da9b1964e7ad0f8747848aac9f6b5a44f25a841330bcbb03b2ec51d7e004f38819d4e48202b996e660b462538ae461137fecc85071ab477093152953a0698c0ef3b09c4a8de6c84f6ecb497d418bd1e17c1cd42c59622a957cbaa93a6c8a5cbfa867c2c31032d6bbcfda31b2afb76f42831ecb40cafa756746c036716b3d03784e930393132a7e3f89211583c1ac708957b49d3cdb87610a2a39e007860ba7ea0893c5740600521b87cb90ea4324f6817302b956270070e6d2b2eafb0189667a6f50a4409ababc34755a3c75a03bb54f73691ae7cab60aa9d93327501780118020e343815a8132e63651fb315e3d6995438b32524b1cd88b8242f461a5c25c89514f1c4c3692ab5ad40c4cba50a317faae0618bed8e3357ed02366c00167262ea326a29735b7032a74f38b4c8ed3c6d71b5ac92899ce04c0966a6d80db01d98079842cc34e817fa84c3898c59db796a8602c277537bc71360e99a183603abb9bf720aa089261b692743a4a0c1167b0128b73abc44d29a553ca5a4fcbbfdf4688f627c3bc097ae2e30e12c4373819c245403a79741dbf983dfe6b033eb1a02a930f80ca2192d644b4435c3adb2a73f960134c28de8286bbc278ab82be30e46ab04a227794896f4a4642c51452e846d7e6bb6e2a133476619df950297b55b50417c1a09768561ce17a5b7f1749a78a0e1d408593767ccca7c8b51b9f741a9ef4f9b87d7b0b8a700376a94ce2166e150c7e43c76f4a7749cda88f5f6216dc833bc48b1e980799dc39398ee4b1d062529dd4804e3419662494f61284d3c66b2a77a6419c9b8d594f1d7ca0d08037fa173c70293b48865004b6391ce98d3cdc87c09acaef311976b8b5435610dc71cd05e939fc52cad4e64211848696aa4ccfea7bf8a03223921ffd876700108296f6872ddb051f154347e39d4aa90178867144b0496b8752198206d16005772737ae603a7683342a01a0451924ec41ce2262424d0acde3c42c05b95264a66248f365b0672b8c2b05fe551973f1834761a1e0e67a8600434f7474dd64983a388fcc85990d2771856756b856c28c99cd5294287a4045210147315391c2308bb3c1be0df58f7c000e8727ad6c9555d037bf950bb862348de5214939898b72556099125f5d115aaa4a91b0e222cc79be275869ffd739c8c3ae3054a6477663de9cb2a01c2672782553109ddbc471458a8228e14d928c2153d84245454217a937abdb86fd3315031b5662d557140b7fd6185155744e4aa48c9b2b1983004ba3dc38c273a2227b00d4679c43212fc113754410c45f65a3f79b2fdf82b48173164dc2ab84584c15442a8222bd8ce78de8d77a5b1092c4f181aa58010f484401c0612e9a7e74ec0b19292f2cb2c7d186b0c142baedf4bd09203a6b73af7921044aba2d31c9a49c28b66ba9ae3cd89f9bf7a908e54f5e0113c0646b5188bdcf7134984c8209e09023b65c96daa0245b0112a998bd6c90aa779098f7b8ad9c5598f30a6a134a028908690564c9223198fcbe6902733acaaddd488036b85771e530fcc4d70f0290ae3ab9d77ca2ff1e64ff36fa8287d577b66adf98f576db385db707ed756977b3b0a4eb511b001d0020a2ff1e64ff36fa8287d577b66adf98f576db385db707ed756977b3","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun020_00000048_724c10fb"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3137,"t13i140900_cbb2034c60b8_e7c285222651":766,"t13i311000_e8f1e7e78f70_24695f2957a7":512,"t13i131000_f57a46bbacb6_ab7e3b40a677":4978,"a11cun020_00000048_724c10fb":645},"akin_families":{"a11cun020_00000048_724c10fb":{"head":"a11cun020_00000048_724c10fb","shapes":3,"ips":645}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-03","count":1},{"date":"2026-07-04","count":1},{"date":"2026-07-10","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-12","count":1},{"date":"2026-07-13","count":2},{"date":"2026-07-14","count":2},{"date":"2026-07-17","count":2},{"date":"2026-07-18","count":1},{"date":"2026-07-19","count":4},{"date":"2026-07-21","count":1},{"date":"2026-07-24","count":1},{"date":"2026-07-28","count":2},{"date":"2026-07-29","count":1},{"date":"2026-07-31","count":1},{"date":"2026-08-01","count":1},{"date":"2026-08-02","count":4},{"date":"2026-08-08","count":1},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-14","count":1},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":4},{"date":"2026-08-20","count":1},{"date":"2026-08-21","count":1},{"date":"2026-08-22","count":1},{"date":"2026-08-23","count":11},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":2},{"date":"2026-08-26","count":1},{"date":"2026-08-27","count":2},{"date":"2026-08-29","count":1},{"date":"2026-08-30","count":2},{"date":"2026-08-31","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-07","count":1},{"date":"2026-09-11","count":1},{"date":"2026-09-14","count":3},{"date":"2026-09-15","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":2},{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":1},{"date":"2026-09-27","count":1}],"recent_events":[{"timestamp":"2026-09-27T09:01:38","port":4018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u00027net.tcp://127.0.0.1:4018/Microsoft/VisualStudio/msvsmon\u0003\b\f","payload_hex":"000100010202376e65742e7463703a2f2f3132372e302e302e313a343031382f4d6963726f736f66742f56697375616c53747564696f2f6d7376736d6f6e03080c","method":"","user_agent":"","ja3":"","session":"42ef61b1-748c-4d0e-8050-04e269307d5d","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":13,"enriched":{"digest":"701705b888a7e080","strings":["7net.tcp://127.0.0.1:4018/Microsoft/VisualStudio/msvsmon"],"iocs":{"ips":["127.0.0.1"],"domains":["7net.tcp"],"paths":["/Microsoft/VisualStudio/msvsmon"]}}},{"timestamp":"2026-09-23T10:54:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"20b279993ae2e137e62b9647c6d768fb","session":"1c5495b6-d065-4701-af24-3d2a46e9d16c","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78},{"timestamp":"2026-09-22T06:03:48","port":1024,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1024\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313032340d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"71d838c9-c88e-4837-adee-6585b75af2d8","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":78},{"timestamp":"2026-09-21T04:48:07","port":2096,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2096\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039360d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"570a2802-c26c-4071-8295-95fd515229b1","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-20T06:24:12","port":22460,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:22460\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a32323436300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"1487bd354c20f20dd642bebc7f706e95","session":"3df13b35-0860-4248-a1e4-b0d36f0df26e","seq":1,"duration_ms":101,"bytes_in":223,"bytes_out":78},{"timestamp":"2026-09-18T20:22:05","port":50580,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:50580\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303538300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"161fad4d-4304-4358-bc1d-06c13375b5ac","seq":1,"duration_ms":101,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-18T08:58:58","port":4786,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"","session":"28f35b3e-3862-4316-a657-8d84d35c2b20","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13},{"timestamp":"2026-09-17T23:50:20","port":11495,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11495\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313439350d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"3ca3130f-f94a-4aa3-803e-3314623d5a11","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":78},{"timestamp":"2026-09-15T03:41:58","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"d0532b6b-58ef-4eba-8665-5babf50b0752","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":78},{"timestamp":"2026-09-14T20:13:01","port":1344,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1344\",\"user-agent\":\"curl/7.68.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313334340d0a557365722d4167656e743a206375726c2f372e36382e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.68.0","ja3":"","session":"d5a39479-b4ec-42ed-8ad2-e1cf6976a5d1","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78}],"http_methods":[{"method":"GET","count":94},{"method":"POST","count":3}],"distinct_ports_total":136,"top_paths":[{"path":"/","count":56,"ports":49},{"path":"/.well-known/security.txt","count":33,"ports":32},{"path":"/wsman","count":3,"ports":1},{"path":"/jolokia","count":1,"ports":1},{"path":"/_config","count":1,"ports":1},{"path":"/jolokia/write","count":1,"ports":1},{"path":"/api/jolokia","count":1,"ports":1},{"path":"/jolokia/version","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":4}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1024","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":3,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-28T20:50:13.554866+00:00"}