GreyNoise has reported a significant decline in suspicious scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect portals, dropping by over 99% within 48 hours after a peak in March 2025. The majority of the activity was linked to 3xK Tech GmbH, highlighting the need for dynamic IP blocking as threat actors rotate between infrastructure providers. Organizations are advised to review their security measures and logs in light of this coordinated scanning effort, which may precede new vulnerabilities.