{"ip":"35.203.211.53","total_events":2732,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"469,980 bytes sent","bytes_sent":469980,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-19T04:18:47","last_seen":"2026-09-24T09:28:41","events_24h":11,"events_7d":111,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"City of London","lat":51.5164,"lon":-0.093,"asn":396982,"org":"Google LLC"},"source_domain":"53.211.203.35.bc.googleusercontent.com","known_scanners":["paloaltonetworks"],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"top_ports":[{"port":63389,"proto":"tcp","label":"","count":11},{"port":489,"proto":"tcp","label":"","count":5},{"port":59801,"proto":"tcp","label":"","count":5},{"port":65220,"proto":"tcp","label":"","count":5},{"port":48486,"proto":"tcp","label":"","count":4},{"port":51459,"proto":"tcp","label":"","count":4},{"port":33748,"proto":"tcp","label":"","count":4},{"port":15393,"proto":"tcp","label":"","count":4},{"port":48157,"proto":"tcp","label":"","count":4},{"port":9785,"proto":"tcp","label":"","count":4},{"port":8220,"proto":"tcp","label":"","count":4},{"port":21271,"proto":"tcp","label":"","count":4},{"port":63750,"proto":"tcp","label":"","count":4},{"port":46245,"proto":"tcp","label":"","count":4},{"port":936,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c2030372d244576612774c07f861264a0fcbcb80387b75c3c1c1a0bcdc2d92fbdb9ec4209b45cfd00f68f85092d5991366a50957033b98e27346c9a1f559831afab27e43001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0f201722dd9a7fba7b4e0823507f7a48b272a2f855e9a74073a1085a8ab95b56ccf3133418edba5fb0b8a942176445a84e98a32897325e84b7065672636a419b138b1c5ccca18a65554cc98ae8b4ab199c88788c98fbc61c8109d6c0745ce2108ebf81f66809d1b082f270b3f208bbff8c861b3a6cf69579cef640e57a9c3a3843668e0af2ad7331e493948322392d58875d06c7aacaf235a04edeb96eeec4c3e89548ca34380a6643f53329a66bd66911e881492ed884a2728736e799b99573014896ad404cf540c603c37c381697dcb359f78137abd6ab6cb8716b28542e11850f0e28c5b8a542f50adbe531cb96301ae7932d829c48900598db7a1000cbe8dc864cc612f071b5e7be1129bbc4c4d9390f9259896ba44005b4001aca507fa85cb71bf79701af50c81eb757c97ca07f254359dfbc1f3b3a1c915a0bf2ac35580bfd5633fcc2318ae3aa0385b1c52ac9345553a9ee8afb6e403b9d2b40aeb665ed34cc94507951116e2701708779db41445a4ba3eca2a302e99aa849082525113ca1bb93a335f9ab147c95b4710093f0b26c71d8ca44b0b10fa88c7a274461a873a27d53e950b936e1a22a79c9682bb9dbb6a221af654c581b519777e746a45bb1818713ccbd58a9e1950a7d5f6c3988c0a60b6ca084baf2c67be20899d819447c182c9496b916ce6324a0c7d0ada99c38590a948387ac3b4e379b4a187aabcb5873587883e1579a2d6227178cd25e61b36e364c761c449a60436e30664e889aaba614212147694b25cab6ddb52b7bba42683b30482080c16cb1e532bcd51d246e99198246c55fa93391da762ecdc096a4a6a6eec9e83975f97a910fd268c7594a80ca41d3c9607bc7ba1e1d6cece002bb2e3b09d9b0a2475597a59045bfb17dd9336f84b0698e64abda76697b572fe204045266286ec06a226c14af27ad7d6882019787a8c556e991a2669720c9903c8626ab7755fbc77201dc083d9336f6adbac9dac5391f32a4442b29cf75f5227575b9a8ce040ad92ea548da0129e23382f4698c074480f097fcbbb47a621782ac6808d9a077ae00f62b99feb210ed3751bfe39a6d98498fc24a85ce61c4773766d45bf3699a022abc5fbb499b0e2ad8fb25dcd46c644d832331844047827538867d999c663aa71332a0642556bcbd6933e472c960046f9608a1f0b977bc492bc5a69e0db0e52f562d0973cb0f1585895356ee63fab3a1fab6189836cbbb4b17118b135d628696f030e29da622f50648553720e2bcfe64b797c1ac145ebb9b37b2a187033eb8c0b41283ea6da378e0007ba76130f7415e65a159633c4ab28bfdf63b99435c471760935fc92e157a049c01f327556a93cced8876ca5847b5bb629f5420d96900e3d3c0f4c5988e6a94e7b12c1a5f377de3441006104c45b092af1a963cc6ef46a23dd734b0b25b4a3e213c9f5946a32015979a69e7007dd2c15e2303e1c22254441c38a042e8462028889303dd8982376b4df9459406378d3b193bc033041a2abd8e09fde7b59ec890fe9914eeb784faff12d1f4116ef169cc8da2fb4262a6a11b108404dbfbb7e30f0463d082ac4768717434bcc595e147c99dec7b3ff98bd1b40c6934a899fc3b8b07052bd2441079611b564c7d6d121bf987914fff81736e6db49ecc47067084ec27ede63ba07ae0e1b6cf955d4d972ccef3eb1a942b64566307ff809e58ad327f3ce29001d002063ba07ae0e1b6cf955d4d972ccef3eb1a942b64566307ff809e58ad3","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_0000004c_13ee3d34","a10cun020_00000041_0a8d7f11"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":661,"t13i131000_f57a46bbacb6_ab7e3b40a677":5075,"a11cun030_0000004c_13ee3d34":2236,"a10cun020_00000041_0a8d7f11":1489},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2236}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"],"timeline":[{"date":"2026-06-26","count":106},{"date":"2026-06-27","count":5},{"date":"2026-06-28","count":6},{"date":"2026-06-29","count":16},{"date":"2026-06-30","count":24},{"date":"2026-07-01","count":12},{"date":"2026-07-02","count":15},{"date":"2026-07-03","count":12},{"date":"2026-07-04","count":19},{"date":"2026-07-05","count":12},{"date":"2026-07-06","count":16},{"date":"2026-07-07","count":19},{"date":"2026-07-08","count":13},{"date":"2026-07-09","count":22},{"date":"2026-07-10","count":8},{"date":"2026-07-11","count":14},{"date":"2026-07-12","count":17},{"date":"2026-07-13","count":14},{"date":"2026-07-14","count":23},{"date":"2026-07-15","count":5},{"date":"2026-07-16","count":16},{"date":"2026-07-17","count":18},{"date":"2026-07-18","count":12},{"date":"2026-07-19","count":11},{"date":"2026-07-20","count":21},{"date":"2026-07-21","count":9},{"date":"2026-07-22","count":16},{"date":"2026-07-23","count":11},{"date":"2026-07-24","count":16},{"date":"2026-07-25","count":28},{"date":"2026-07-26","count":18},{"date":"2026-07-27","count":11},{"date":"2026-07-28","count":15},{"date":"2026-07-29","count":15},{"date":"2026-07-30","count":13},{"date":"2026-07-31","count":23},{"date":"2026-08-01","count":20},{"date":"2026-08-02","count":11},{"date":"2026-08-03","count":16},{"date":"2026-08-04","count":5},{"date":"2026-08-05","count":14},{"date":"2026-08-06","count":26},{"date":"2026-08-07","count":16},{"date":"2026-08-08","count":19},{"date":"2026-08-09","count":15},{"date":"2026-08-10","count":26},{"date":"2026-08-11","count":17},{"date":"2026-08-12","count":8},{"date":"2026-08-13","count":23},{"date":"2026-08-14","count":17},{"date":"2026-08-15","count":12},{"date":"2026-08-16","count":23},{"date":"2026-08-17","count":12},{"date":"2026-08-18","count":25},{"date":"2026-08-19","count":16},{"date":"2026-08-20","count":17},{"date":"2026-08-21","count":24},{"date":"2026-08-22","count":20},{"date":"2026-08-23","count":448},{"date":"2026-08-24","count":22},{"date":"2026-08-25","count":21},{"date":"2026-08-26","count":13},{"date":"2026-08-27","count":41},{"date":"2026-08-28","count":19},{"date":"2026-08-29","count":32},{"date":"2026-08-30","count":18},{"date":"2026-08-31","count":22},{"date":"2026-09-01","count":14},{"date":"2026-09-02","count":24},{"date":"2026-09-03","count":25},{"date":"2026-09-04","count":23},{"date":"2026-09-05","count":23},{"date":"2026-09-06","count":15},{"date":"2026-09-07","count":33},{"date":"2026-09-08","count":23},{"date":"2026-09-09","count":28},{"date":"2026-09-10","count":31},{"date":"2026-09-11","count":19},{"date":"2026-09-12","count":14},{"date":"2026-09-13","count":22},{"date":"2026-09-14","count":30},{"date":"2026-09-15","count":13},{"date":"2026-09-16","count":20},{"date":"2026-09-17","count":22},{"date":"2026-09-18","count":19},{"date":"2026-09-19","count":18},{"date":"2026-09-20","count":19},{"date":"2026-09-21","count":18},{"date":"2026-09-22","count":10},{"date":"2026-09-23","count":8},{"date":"2026-09-24","count":8}],"recent_events":[{"timestamp":"2026-09-24T09:28:41","port":48088,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:48088\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34383038380d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"61de60e6-25c2-4a13-abc3-66a83b169bd8","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-24T09:24:16","port":19444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:19444\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31393434340d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"6ffd9007-8205-445e-81a6-c5f5d0a35229","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-24T05:29:05","port":34488,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"93a2c506-cc65-488c-9c42-d9e7456ba583","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-24T05:24:43","port":18944,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"aa316ce9-23dc-4f33-978e-99489b0d1fb3","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-24T05:04:22","port":10200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10200\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303230300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"bf105ab3-694f-4f0c-97e0-732fcaf15896","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":78},{"timestamp":"2026-09-24T05:02:41","port":59337,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"e0621802-a062-4c52-a026-6908dd247ebb","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-24T01:33:03","port":9886,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9886\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393838360d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"aabe27eb-b781-46ba-8c11-0faeb98c3a3a","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":78},{"timestamp":"2026-09-24T00:01:41","port":3263,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3263\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333236330d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"2196848d251b217de8b2c037e356c11d","session":"72a547e6-9cff-4cd3-be20-66c7d5725c1a","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":78},{"timestamp":"2026-09-23T17:25:20","port":61990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"2028d904-1813-4062-a9af-2dcac67f255e","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-23T17:22:15","port":23462,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"256e607f-7c8c-4b3b-809a-ecf24813f0a0","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78}],"http_methods":[{"method":"GET","count":2590}],"distinct_ports_total":2119,"top_paths":[{"path":"/","count":2061,"ports":1610},{"path":"/.well-known/security.txt","count":432,"ports":387},{"path":"/api/jolokia/version","count":16,"ports":16},{"path":"/jolokia/write","count":14,"ports":14},{"path":"/api/jolokia","count":14,"ports":14},{"path":"/jolokia","count":12,"ports":12},{"path":"/jolokia/version","count":10,"ports":10},{"path":"/jolokia/list","count":9,"ports":9},{"path":"/jolokia/exec","count":8,"ports":8},{"path":"/api/jolokia/list","count":8,"ports":8},{"path":"/actuator/jolokia/version","count":6,"ports":6}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":67}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:48088","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-09-24T14:27:59.280859+00:00"}