We are seeing some strange browsing activity attached to our Qualys service account that we use for scanning. It's going to places like facebook, twitter, pandora, etc etc. This activity is being picked up by our Palo Alto device on hundreds, if not thousands of systems.. Some of the activity seems to be during scans of the source or destination of the traffic, but some of it is from sources that we haven't scanned for almost 2 years. We're very confused at what could be causing this type of activity from our Qualys service account from these systems. Any ideas would be much appreciated. Thanks.