As @BPry says, PaloAlto scans seen websites for URL categorization. On my own website, I had never seen this in my logs until I went to it from behind a PA and my site has subsequently been surveyed frequently. This is normally a few pulls of base pages, similar to any other web spider (about 20 per week). I have never seen path traversal attempt, variable injection, or other common signs of malicious activity. A typical scan looks like this:
147.185.132.25 - - [11/Dec/2024:03:29:52 -0700] "GET / HTTP/1.1" 200 42 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"
The scans come from:
35.203.210.0/23 - GoogleCloud
147.185.132.0/23 - PaloAltoNetworks
162.216.149.0/24 - GoogleCloud
162.216.150.0/24 - GoogleCloud
198.235.24.0/24 - PaloAltoNetworks
205.210.31.0/24 - PaloAltoNetworks
... View more