{"ip":"205.210.31.80","total_events":754,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"86,833 bytes sent","bytes_sent":86833,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-17T03:08:23","last_seen":"2026-10-13T17:53:37","events_24h":6,"events_7d":34,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":3,"protocols":[{"protocol":"udp","events":3}],"ports":[{"port":5632,"events":1},{"port":12546,"events":1},{"port":17185,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T23:43:50","last_seen":"2026-10-12T23:39:39","recent":[{"timestamp":"2026-10-12T23:39:39","port":12546,"src_port":53499,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"3ea4acd7-807e-4b60-89ba-ccb4f9e3d805","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-08T11:05:44","port":17185,"src_port":55827,"proto":"udp","app_proto":"","app_protocol":"","summary":"r7r7\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002UUUU\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��U\u0010\u0000\u0000\u0000<\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72377237000000000000000255555555000000010000000100000000000000000000000000000000ffff55100000003c00000003000000020000000000000000","sni":"","session":"88108c12-d7ba-485d-98bf-8af6e4505bff","bytes_in":64,"source_verified":false,"enriched":{"digest":"77574595957b3781","strings":["r7r7","UUUU"]}},{"timestamp":"2026-10-06T23:43:50","port":5632,"src_port":52739,"proto":"udp","app_proto":"","app_protocol":"","summary":"ST","payload_hex":"5354","sni":"","session":"e32ff75f-3271-49f2-80b4-b2d98b8cfe9d","bytes_in":2,"source_verified":false}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":43},{"port":20257,"proto":"tcp","label":"","count":21},{"port":3390,"proto":"tcp","label":"","count":12},{"port":20256,"proto":"tcp","label":"","count":10},{"port":22,"proto":"tcp","label":"SSH","count":10},{"port":139,"proto":"tcp","label":"SMB","count":8},{"port":8090,"proto":"tcp","label":"","count":8},{"port":80,"proto":"tcp","label":"HTTP","count":8},{"port":8005,"proto":"tcp","label":"","count":8},{"port":3978,"proto":"tcp","label":"","count":7},{"port":10002,"proto":"tcp","label":"","count":7},{"port":21242,"proto":"tcp","label":"","count":6},{"port":943,"proto":"tcp","label":"","count":6},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":6},{"port":28080,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_ab7e3b40a677","t13i190800_9dc949149365_97f8aa674fd9","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030100ee010000ea03038b8647b3f88b664d36a159c9e3779f45627aeb674c467476c639177ba42bf78120d8c71d4b2332070997a4911e157e8ff38a82cd8e3093e305aba612d4c2581ae10026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020ce6cbd191426741e8f78b295fb54cb101b94e49a49cc477cac7a61f5","tls_ja3":["20b279993ae2e137e62b9647c6d768fb","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00040010_724c10fb","b10cun020_00000014_0a8d7f11","b11cuq040_02050800_f46b29fb"]},"fingerprint_peers":{"t13d131100_f57a46bbacb6_ab7e3b40a677":128,"t13i131000_f57a46bbacb6_ab7e3b40a677":3130,"b11cun030_00040012_13ee3d34":4959,"b11cun020_00040010_724c10fb":1555,"b10cun020_00000014_0a8d7f11":2005,"b11cuq040_02050800_f46b29fb":183,"t13i311000_e8f1e7e78f70_24695f2957a7":507,"t13i190800_9dc949149365_97f8aa674fd9":2998},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1555}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-16","count":1},{"date":"2026-07-18","count":5},{"date":"2026-07-19","count":2},{"date":"2026-07-20","count":3},{"date":"2026-07-21","count":3},{"date":"2026-07-22","count":5},{"date":"2026-07-23","count":5},{"date":"2026-07-24","count":2},{"date":"2026-07-25","count":5},{"date":"2026-07-26","count":3},{"date":"2026-07-27","count":4},{"date":"2026-07-28","count":2},{"date":"2026-07-29","count":2},{"date":"2026-07-30","count":2},{"date":"2026-07-31","count":3},{"date":"2026-08-01","count":7},{"date":"2026-08-02","count":4},{"date":"2026-08-03","count":4},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-08","count":1},{"date":"2026-08-09","count":10},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-13","count":9},{"date":"2026-08-14","count":1},{"date":"2026-08-15","count":3},{"date":"2026-08-16","count":7},{"date":"2026-08-17","count":1},{"date":"2026-08-18","count":1},{"date":"2026-08-19","count":8},{"date":"2026-08-21","count":5},{"date":"2026-08-22","count":3},{"date":"2026-08-23","count":17},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":3},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":5},{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":2},{"date":"2026-08-31","count":6},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":6},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":8},{"date":"2026-09-05","count":2},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":6},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":3},{"date":"2026-09-11","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":5},{"date":"2026-09-14","count":2},{"date":"2026-09-15","count":4},{"date":"2026-09-16","count":3},{"date":"2026-09-17","count":2},{"date":"2026-09-18","count":2},{"date":"2026-09-20","count":4},{"date":"2026-09-21","count":4},{"date":"2026-09-22","count":3},{"date":"2026-09-23","count":2},{"date":"2026-09-24","count":4},{"date":"2026-09-26","count":4},{"date":"2026-09-27","count":3},{"date":"2026-09-28","count":4},{"date":"2026-09-30","count":5},{"date":"2026-10-01","count":2},{"date":"2026-10-02","count":4},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":3},{"date":"2026-10-05","count":4},{"date":"2026-10-06","count":6},{"date":"2026-10-07","count":4},{"date":"2026-10-08","count":1},{"date":"2026-10-09","count":4},{"date":"2026-10-10","count":3},{"date":"2026-10-11","count":4},{"date":"2026-10-12","count":12},{"date":"2026-10-13","count":6}],"recent_events":[{"timestamp":"2026-10-13T17:53:37","port":4786,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"","session":"29f9978c-2087-49fe-b694-20c7d70b65a7","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13},{"timestamp":"2026-10-13T13:03:06","port":43,"proto":"tcp","app_proto":"","app_protocol":"whois-das","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"google.com\r\n","payload_hex":"676f6f676c652e636f6d0d0a","method":"","user_agent":"","ja3":"","session":"39835f14-93df-48e4-9e0a-e17b7b25968f","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":13,"enriched":{"digest":"73e5eb7ad756e626","strings":["google.com"],"iocs":{"domains":["google.com"]}}},{"timestamp":"2026-10-13T07:31:01","port":5672,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"AMQP\u0000\u0000\t\u0001","payload_hex":"414d515000000901","method":"","user_agent":"","ja3":"","session":"66a8ac59-6151-4d18-9b15-7910a72c5572","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":13,"enriched":{"digest":"198c66d273332395","strings":["AMQP"]}},{"timestamp":"2026-10-13T05:07:11","port":5222,"proto":"tcp","app_proto":"","app_protocol":"jabber","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<?xml version='1.0'?><stream:stream xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' xml:lang='en-US' to='.' version='1.0'>","payload_hex":"3c3f786d6c2076657273696f6e3d27312e30273f3e3c73747265616d3a73747265616d20786d6c6e733a73747265616d3d27687474703a2f2f6574686572782e6a61626265722e6f72672f73747265616d732720786d6c6e733d276a61626265723a636c69656e742720786d6c3a6c616e673d27656e2d55532720746f3d272e272076657273696f6e3d27312e30273e","method":"","user_agent":"","ja3":"","session":"19d59eb2-ecff-44c4-9e26-5e53b074d0c4","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":13,"enriched":{"digest":"7bba7c3fe0b4e7e7","label":"SOAP/XML","strings":["<?xml version='1.0'?><stream:stream xmlns:stream='http://etherx.jabber.org/strea…"],"iocs":{"urls":["http://etherx.jabber.org/strea…"],"domains":["etherx.jabber.org"],"paths":["/etherx.jabber.org/strea"]}}},{"timestamp":"2026-10-13T05:02:35","port":25827,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:25827\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32353832370d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"19e29534fd49dd27d09234e639c4057e","session":"5ef2d836-bc1f-494d-b0f8-607af2a77d66","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-10-13T03:31:49","port":943,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"f4c0f80c-374e-4b66-9b52-065a4375d68b","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-10-12T19:27:06","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0010\u0000\u0004MQTT\u0004\u0000\u0000\u001e\u0000\u0004test","payload_hex":"101000044d5154540400001e000474657374","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"e50c1bd4-c67e-4a7e-b16b-d3f48992fb9d","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":13,"enriched":{"digest":"08290ca66d23e717","label":"MQTT","strings":["MQTT","test"]}},{"timestamp":"2026-10-12T15:32:33","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"944ced96eb8f08b37bed45951d12594e","session":"6cd3197d-f12c-434e-9336-c1e52af06cca","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-10-12T14:01:58","port":9091,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9091\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a393039310d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"4b31431b-33a5-4180-aa12-0e4addef0e5c","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-10-12T03:50:54","port":21242,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:21242\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a32313234320d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"d047d0c6-969c-40d3-8a8e-6f8503fa8c48","seq":1,"duration_ms":101,"bytes_in":222,"bytes_out":78}],"http_methods":[{"method":"GET","count":409},{"method":"POST","count":6}],"distinct_ports_total":276,"top_paths":[{"path":"/","count":349,"ports":164},{"path":"/.well-known/security.txt","count":49,"ports":41},{"path":"/wsman","count":4,"ports":1},{"path":"/api/jolokia/version","count":3,"ports":3},{"path":"/actuator/jolokia/version","count":3,"ports":3},{"path":"/jolokia/version","count":2,"ports":2},{"path":"/jolokia/list","count":2,"ports":2},{"path":"/jolokia","count":1,"ports":1},{"path":"/_config","count":1,"ports":1},{"path":"/api/jolokia","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1},{"value":"chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":1},{"value":"chicago.vpnigo.de","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":10}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:25827","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-10-13T23:04:58.050685+00:00"}