Cortex Xpanse — the ASN lies, RDAP ownership identifies
by shop owners for shop owners.
RDAP-Netzblock-Eigentum: 6 dokumentierte Scan-Blöcke (147.185.132.0/22, 144.86.173.0/24, 172.105.147.0/24, 198.235.24.0/24, 205.210.31.0/24, 216.25.88.0/21) sind ARIN-registriert auf Palo Alto Networks (PAN-22) bzw. Expanse (EXPAN-13). ASN zeigt Google Cloud (geleast) — irreführend; PTR existiert praktisch nicht. Identifikation per RDAP-Org, nicht ASN/DNS. Palo Alto führt die Range offiziell als Scan-Infrastruktur.
Cortex Xpanse (Expander) is Palo Alto Networks' internet-wide attack-surface scanner (US). Not an SEO tool. The catch: the scan IPs are announced via Google Cloud (the ASN says “Google”), but the netblocks are RDAP-registered to Palo Alto Networks / Expanse. Neither ASN nor PTR work — only RDAP ownership identifies Xpanse. Part of our PARC Security feed.
xpanse.json — view feed www.paloaltonetworks.com →
Verification — every IP individually
The CINS cross-check surfaced 858 Xpanse IPs (AbuseIPDB score 0 despite hundreds of reports). Verification:
147.185.132.0/22 AS396982 (Google Cloud) RDAP: PAN-22 Palo Alto ✓
144.86.173.0/24 AS396982 (Google Cloud) RDAP: EXPAN-13 Expanse ✓
216.25.88.0/21 AS396982 (Google Cloud) RDAP: PAN-22 Palo Alto ✓
205.210.31.0/24 · 198.235.24.0/24 RDAP: PAN-22 Palo Alto ✓
172.105.147.0/24 AS63949 (Linode, leased) RDAP: EXPANSE-INC ✓
A pure ASN check would have said “Google Cloud” (wrong); a PTR exists for only 1 of 858. Only the ARIN RDAP netblock ownership (org PAN-22 / Expanse) is the solid proof — the same ownership idea as Shadowserver/umich, only the registry says it instead of the ASN. Palo Alto also officially documents this range as a scan source (“add this range to your allow lists”). Lesson: for cloud-hosted scanners the ASN lies — RDAP ownership is what counts.