Scanning Activity on Palo Alto Networks Portals Jump 500% in One Day

Oct 04, 2025Ravie LakshmananVulnerability / Network Security

GreyNoise, a threat intelligence firm, revealed a significant increase in scanning activity targeting Palo Alto Networks login portals on October 3, 2025.

The surge in scanning activity saw a 500% rise in IP addresses scanning Palo Alto Networks login portals, marking the highest level recorded in the past three months. The scanning was described as targeted and structured, focusing mainly on Palo Alto login portals.

Approximately 1,300 unique IP addresses took part in the scanning, showing a notable increase from the previous count of around 200 unique IP addresses. Of these, 93% were classified as suspicious, while the remaining 7% were deemed malicious.

The majority of the IP addresses were geolocated in the U.S., with smaller clusters identified in the U.K., the Netherlands, Canada, and Russia.

GreyNoise highlighted that the recent surge in Palo Alto scanning shared similarities with previous Cisco ASA scanning incidents, including regional clustering and tooling overlap.

Both the Cisco ASA and Palo Alto login scanning activities exhibited a dominant TLS fingerprint associated with infrastructure in the Netherlands.

In a similar incident in April 2025, GreyNoise reported suspicious login scanning targeting Palo Alto Networks PAN-OS GlobalProtect gateways, prompting the network security company to advise customers to update to the latest software versions.

GreyNoise’s Early Warning Signals report from July 2025 suggested that spikes in malicious scanning activities often precede the disclosure of new CVEs impacting the same technology within six weeks.

In early September, GreyNoise warned about suspicious scans targeting Cisco Adaptive Security Appliance (ASA) devices, originating from over 25,100 IP addresses primarily located in Brazil, Argentina, and the U.S.

Cisco later disclosed two zero-day vulnerabilities in Cisco ASA (CVE-2025-20333 and CVE-2025-20362) that had been exploited in real-world attacks to distribute malware families such as RayInitiator and LINE VIPER.

Data from the Shadowserver Foundation indicates that over 45,000 Cisco ASA/FTD instances are still vulnerable to these two vulnerabilities, with a significant number located in the U.S. and Europe.