GreyNoise detects 500% surge in scans targeting Palo Alto Networks portals

GreyNoise detected a 500% surge in scans targeting Palo Alto Networks login portals on 3 October 2025, marking the highest activity in three months. The firm reported that over 1,285 IPs scanned the Palo Alto portals that day, up from a typical 200, with 93% of the IPs deemed suspicious and 7% malicious.

Most of the traffic originated in the United States, with smaller clusters in the United Kingdom, the Netherlands, Canada and Russia, and the scans targeted emulated Palo Alto profiles across distinct clustering that suggested coordinated reconnaissance, focused mainly on United States and Pakistan systems. The activity also appeared to mirror Cisco ASA scanning patterns, with a shared TLS fingerprint linked to infrastructure in the Netherlands, implying possible shared operators or infrastructure.

According to GreyNoise, the scans targeted login portals and were split across separate clusters, and the researchers noted that previous spikes in Palo Alto scans sometimes preceded new flaws, prompting ongoing monitoring for signs of a disclosure. GreyNoise said it is developing an enhanced dynamic IP blocklist to help defenders take faster action on emerging threats.