topic Re: Strange IP exiting our network and erasing its logs in Next-Generation Firewall Discussions

Strange IP exiting our network and erasing its logs

UNIRIO — Fri, 30 Jan 2026 15:07:33 GMT

Hi everyone! Good Afternoon,

I'm from Brazil, and my organization have two appliances PA 3220 in HA. This morning we've noticed some suspicious traffic exiting our network with IPv6 ::b638:2a0a:ffff:0 (for example), there was more than one those IPv6. The payload was huge, something about 4.2GB. This can be an exfiltration data attack? Could anyone help us with this doubt?

Sincerely,

André Luiz Guimarães

Re: Strange IP exiting our network and erasing its logs

Raido_Rattameister — Fri, 30 Jan 2026 17:26:47 GMT

Do you have machine in your network with IP 10.42.56.182 ?

This is what ::b638:2a0a:ffff:0 refers to in IPv4 format.

Every now and then Palo has a bug where IPv4 IPs show up as IPv6 in reports.

Re: Strange IP exiting our network and erasing its logs

BPry — Mon, 02 Feb 2026 22:41:53 GMT

@UNIRIO,

Also just to add onto what @Raido_Rattameister mentioned already, I'd double check that you have a file blocking profile associated with all external traffic with at least an alert option so you can potentially look into the files that are being transferred going forward. If you're decrypting traffic you'll obviously get drastically more information, but in conjunction with your EDR (assuming that you have one) it can help speed up the process to identify whether the traffic is legitimate or not.