Bot directory

Expanse: what it is, its IP ranges, and how to block it

Expanse is Palo Alto Networks's internet scanner.

Vendor	Palo Alto Networks
What it is for	Internet scanner
In its User-Agent	`Expanse, a Palo Alto Networks company`
Verified by	Published addresses
Its vendor's address list	`https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/scanning-activity.md`
IP ranges	12
By default	Block

It probes every address on the internet for its exposed services, and sends nobody back. Bot Protection blocks it by default; you can let it through.

How to verify it

Any bot can write Expanse in its User-Agent. A request is Expanse only when its address is in Palo Alto Networks's published list below: check the address, not the name.

Check an address

How to block it

Bot Protection verifies Expanse by its address on every request and answers it as you choose on the Set-up page, per kind or for Expanse alone; a bot that only wears the name is judged like any other bot.

Start free trial Every verified bot

Its IP ranges

From Palo Alto Networks's own list, downloaded again every day.

IPv4

35.203.210.0/23
144.86.173.0/24
147.185.132.0/23
162.216.149.0/24
162.216.150.0/24
172.105.147.0/24
198.235.24.0/24
205.210.31.0/24
216.25.88.0/21

IPv6

2604:a940:300:5b6::/64
2604:a940:301:225::/64
2604:a940:302:118::/64

Internet scanners

CensysInspect Censys