Scanning Activity on Palo Alto Networks Portals Jump 500% in One Day

Threat intelligence firm GreyNoise disclosed that there was a near 500% surge in IP addresses scanning Palo Alto Networks login portals on 3 October 2025, the highest level in the last three months. The company said as many as 1,300 unique IP addresses took part, up from around 200 previously, with 93% of those addresses classified as suspicious and 7% as malicious.

The majority of the scanning IPs were geolocated to the United States, with smaller clusters detected in the United Kingdom, the Netherlands, Canada and Russia. GreyNoise described the traffic as targeted and structured, and said the surge shares characteristics with recent Cisco ASA scanning in the past 48 hours, including regional clustering and TLS fingerprint overlap.

The report notes that in April 2025 there was a similar activity targeting Palo Alto Networks PAN-OS GlobalProtect gateways, and cautions that surges in malicious scanning are sometimes followed by disclosures of new CVEs affecting the same technology within six weeks.