Cortex Xpanse

Verifiable

Palo Alto Networks' attack-surface-management scanner. It continuously scans the global internet from a published set of ranges to map its customers' internet-facing assets and discover emerging threats, and its requests carry a plain-English user agent naming the company and an opt-out contact address.

Operated by Palo Alto Networks · Official documentation

User agents

Patterns this directory matches, with real observed strings.

regexExpanse, a Palo Alto Networks company
observedExpanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]

How to verify

Documented static ranges: 35.203.210.0/23, 144.86.173.0/24, 147.185.132.0/23, 162.216.149.0/24, 162.216.150.0/24, 172.105.147.0/24, 198.235.24.0/24, 205.210.31.0/24, 216.25.88.0/21, 2604:a940:300:5b6::/64, 2604:a940:301:225::/64, 2604:a940:302:118::/64

IP ranges (12)

Refreshed daily from the operator's feed. Also available as /data/ips/cortex-xpanse.ips and /data/bots/cortex-xpanse.json.

144.86.173.0/24
147.185.132.0/23
162.216.149.0/24
162.216.150.0/24
172.105.147.0/24
198.235.24.0/24
205.210.31.0/24
216.25.88.0/21
2604:a940:300:5b6::/64
2604:a940:301:225::/64
2604:a940:302:118::/64
35.203.210.0/23

Good Bot Practices scorecard

Identifies honestly
Stable UA token documented (1 pattern)
Verifiable
Verifiable
Respects robots.txt
Does not honor robots.txt
Behaves
Crawl-rate behavior is operator-declared; not machine-verifiable from this dataset
Reachable operator
Operator and documentation published

Measured against the Good Bot Practices.