Traffic from PAN IP adresses

[Netbooster]

We are getting a lot of traffic on our website from certain IP-addresses registered to Palo Alto Networks.

The addresses are

74.217.90.250,

154.59.123.106,

154.59.126.106,

70.42.131.106

and several addresses on the 64.74.215.0/24 subnet.

Why do we get all of this traffic?

We can see by the patterns in the traffic that the tha traffic is from bots, but we would like to get to the bottom of the actual reason for all of this traffic.

[reaper]

Could you provide some more details?

Did you or one of your colleagues perhaps open a support case that could require testing your site ?

[Netbooster]

We run a large scandinavian affiliate network, and it appears that our publisher's sites are crawled by those IP-addresses.

None of the publishers we have been in contact with have asked Palo Alto Networks to do this.

We recieve somewhere around 500.000 hits every month from 5 of Palo Alto Networks IP's

The main bulk of the traffic comes every day between 03:00 and 08:00 UTC time.

[reaper]

Ok that's pretty weird

I've notified our internal departments to verify what's going on

Thanks for notifying us!

Tom

[Netbooster]

Thank you Tom. It is much appreciated.

[jvalentine]

A couple of "legitimate" possibilities:  

Palo Alto Networks firewall users can configure their firewalls to scan e-mail delivered via SMTP.  The main use-case for this is to scan the content, drop known malware, and sandbox unknown malware.  Along the same lines, the firewall can also extract URL/hyperlinks and submit them to the WildFire cloud for pro-active analysis (looking for exploits & malware).  If there is a large amount of SMTP traffic including URLs that resolve to your address space, and those e-mails are being sent to WildFire subscribers, then this is one possibility.  

Palo Alto Networks also has their own URL categorization engine, which will result in websites being crawled and periodically re-visited. 

Of course, there are many other reasons why this could potentially be happening and I'd look to Tom to get you a more official answer.