{"ip":"103.206.253.106","data_as_of":"2026-10-22T20:10:47+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"681 bytes sent","bytes_sent":681,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-29T01:46:38","last_seen":"2026-09-29T01:46:38","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"ID","country_name":"Indonesia","region":"","city":"","lat":-6.175,"lon":106.8286,"asn":9422,"org":"PT SOLNET INDONESIA"},"source_domain":"FAST-INTERNET-103-206-253-106.solnet.net.id","known_scanners":[],"scanner_tag":{"key":"peeringdb:as9422","label":"SOLNET INDONESIA AS9422","category":"isp","url":"https://www.peeringdb.com/asn/9422"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c9010005c503038ac6c4e010b7ddf5cb6af7b28e69c38ae470e27bb901a08c445d4470a44cf109208876263788a2a52f5f5c0f2986dc88e1ac05746480971fd6d91a757d0d68193a001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010005620000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c07130806c02754df4810ff716bb295716ab7b634c6248e80f7a0b3b7b55af22169e4cb06d017bc9aaca7272b37c841c51abfc804cd78aeab16d702a70fc0abc1bd7c8b2f12372c2c40a741feb0881ab2c807d63c4be1b63ca132dda1a1565c822772633c1bc11267688032c187dd33a0a8622f700a1fe688760aacdf1cbcae2ba1f0e58872135634632477d56acb58b8ce5e832a40563e7a32685539d93792a54794b17cc533f9340c5d54bd9e3179f9089f0b3c6ee86cf5b14cc4caa425355774d254ffa435e9e4a6bd337a7d0d62d7457b028d227495c9b90e4099626b389d5c58b16128eb77c8899996424cc8a616300931a4752321432186ffc8db8914f0fd46b4b829a1b284e3465634385c935d2a4ce435e403067bf28982d8442bbca30e87c7accb9732ae0388a6b14bf17210653a599a98a3150b26de00383e435f240284daaa2c7d9ca89bbccea3227e540c560e285d0114f235c6059279b054a426f50722ca29b000b8a66c5312685a7b88646ebca76edcc433ac49acb6c251d78196ba5a2e7f00dea82cde7e798637061e1da66c38692e09946cf98247008b697978da8b5aed0416bdfe75dcff4608cb95e1307a050f03b2049aab49973c6a3c2c636a2c3e92aeed90afd35758e459e1cf1ad1c3037591a84a9d8b4e6106349c10157fa231b02ba61c9417e966371825056d8c798509fcbfc42ac352869297eecd21947202b7b015b76a3c8ba5a5aa1c09137942276d04ec1b949f0bbc017046079910474f98e1dc42f9335b734025b6bf3850b484a1976502f0185b528a20e3c3ce6830cc1cb81f4b9506c8842267a68f6f6cc7c728d760864ea28c1df86a863513acb430c50633e2f550c2f558dfc9c7cd8011fb5525a74752643e7726b2909853b56d9b36277a47880013307ba0c71b006175b83cb08a9aaba0ace783801787e5aa40272440ad1d5a8533587c052397ec82d4fa53bf37b9797fb84573900d4b8345cfbc53827687c4a95030ab816a235ccd5990b1732ce319aef414723629629b67c91d1cba96a4c7220333919ada3596a65334b55b3940a263f7f39a247a91e8b4a0a50db5333295513a439382abc3488b67343c25476b4c2a178e6fb220e6a0971288d9a965fda714d41713023bc53fd986d40e58e4dfb32782226771b17ce068813194e5853c108024d3c7526ea824a22a9cf5d2aa1fdd9376613ce8d33c311a3125c1b7378671cdab94e65618d49b9b359fb3c333581a6a9112d26aeb6cc51f824478660558f19962cb5bb16d177f9d782470c8d4a14ac6f11998eda36a0a9c62544cd0aac1b46d17a4e5baa2abba8354b136ce94c6ff56a71f23b21dc35c48ba1d8160c57a9185c3930a1a75bd856c0d876a6c6221801ccb1acd364edf760e64cca02018a610c2f9169689ebc4d739c2e2ed0585265538e6037a02888aad37d76b1c9ef532b6d68447c2593f70847b4103cfde0595d598c10b6212c5c5322c6ccbf44c6df01243ca39f14792d550b2e9e3375c335c153da481932b4000348fc6232d03a01187730f4ea1a6cf0931238a34f0c4f6e9948cb7b4630042fa4830035265f7c93b5ff989ac6d13c5a760f9f42787d4727bac88a81171cbec5ad5af4deff16696b28c3e2f21495e304ab26eefb0ffd2a9c90eb503db15e2efc06a71a5e62ebdd84acdeaa570f3067c4e044805734e3c7a3ea37144e73784ea87f001d0020a71a5e62ebdd84acdeaa570f3067c4e044805734e3c7a3ea37144e73784ea8","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-09-29","count":3}],"recent_events":[{"timestamp":"2026-09-29T01:46:38","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"102.252.145.52\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203130322e3235322e3134352e35320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"d30efeea-c703-4077-9f4b-d5baec174d4a","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":80},{"timestamp":"2026-09-29T01:46:38","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"24.173.85.42\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2032342e3137332e38352e34320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"9cb379a8-45a7-48bf-88ab-864ad7524b32","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":80},{"timestamp":"2026-09-29T01:46:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"168.127.106.49\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203136382e3132372e3130362e34390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"5250edee-4f86-4414-bcea-bdcdc69391c7","seq":1,"duration_ms":101,"bytes_in":226,"bytes_out":80}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"102.252.145.52","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}