All you need is a proxy in reverse.
A campaign has been observed targeting Palo Alto GlobalProtect portals with login attempts and launching scanning activity ...