01 · Operator
Who operates Palo Alto Networks Cortex Xpanse
- Company
- Palo Alto Networks, Inc.
- Type
- Monitoring bot
- Official docs
- docs-cortex.paloaltonetworks.com
02 · Behavior
What Palo Alto Networks Cortex Xpanse does
Cortex Xpanse maps internet-facing assets for its security customers. Its requests use a user agent starting with "Hello from Palo Alto Networks". The user agent links to a scanning-activity page that we could not load.
03 · Impact
Why Palo Alto Networks Cortex Xpanse matters for your site
If you allow it
- Legitimate security vendor
- Light requests that inventory exposed services
If you block it
- Scans serve Palo Alto Networks customers, not you
- Adds noise to logs and security alerts
04 · Allow
How to allow Palo Alto Networks Cortex Xpanse
robots.txt
# Palo Alto Networks Cortex Xpanse has no documented robots.txt token and does not read robots.txt.
# Use a Cloudflare, nginx or Apache rule instead.Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Palo Alto Networks Cortex Xpanse")
Action: Skip › All Super Bot Fight Mode rules
# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.WordPress
# Palo Alto Networks Cortex Xpanse has no documented robots.txt token and does not read robots.txt.
# Use a Cloudflare, nginx or Apache rule instead.nginx
# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "Palo Alto Networks Cortex Xpanse") { return 403; }Apache
# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} Palo Alto Networks Cortex Xpanse [NC]
# RewriteRule .* - [F,L]05 · Block
How to block Palo Alto Networks Cortex Xpanse
Start with robots.txt. If Palo Alto Networks Cortex Xpanse keeps showing up in your logs, block it at your CDN or web server.
robots.txt
# Palo Alto Networks Cortex Xpanse has no documented robots.txt token and does not read robots.txt.
# Use a Cloudflare, nginx or Apache rule instead.Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Palo Alto Networks Cortex Xpanse")
Action: BlockWordPress
# Palo Alto Networks Cortex Xpanse has no documented robots.txt token and does not read robots.txt.
# Use a Cloudflare, nginx or Apache rule instead.nginx
# In your server { } block:
if ($http_user_agent ~* "Palo Alto Networks Cortex Xpanse") {
return 403;
}Apache
# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Palo Alto Networks Cortex Xpanse [NC]
RewriteRule .* - [F,L]
</IfModule>06 · User agents
User agents we see for Palo Alto Networks Cortex Xpanse
| User agent | Share | Last active | Status |
|---|---|---|---|
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks… |
98% | Yesterday | Unverified |
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks… |
2% | 22 days ago | Verified |
07 · Verification
Is it really Palo Alto Networks Cortex Xpanse?
Palo Alto Networks Cortex Xpanse’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.
IP addresses we saw from verified Palo Alto Networks Cortex Xpanse requests
| IP range | Share | Last active |
|---|---|---|
205.210.31.8 |
100% | 22 days ago |
Always check against the operator’s current list; ranges change.
FAQ
Questions about Palo Alto Networks Cortex Xpanse
What is the "Hello from Palo Alto Networks" user agent?
It is the internet scanner of Cortex Xpanse, Palo Alto Networks' attack surface management product.
Is the Cortex Xpanse scanner malicious?
No. It is a scanner from a known security vendor, identified in Matomo's bot database as a security checker.
Last updated Oct 14, 2026