{"ip":"20.31.129.34","data_as_of":"2026-10-22T20:15:49+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"670 bytes sent","bytes_sent":670,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-28T07:24:14","last_seen":"2026-09-28T07:24:14","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c6010005c20303c314921d7bd4e56a2f74a559330196414f0868bbe20ec365c0d03810847e30ba2092ae13636d37889e04da3af369a6bff5408be55dcfc876be6fb60cb8a3f52d7a001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f0000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0414b83aa1618d377c23f0c351fdbbf481899198620f088b3f6c63da3896affe7ae7d246c2bbb7d4d38823ecb0fd4447139cbca4ce96ab709375c18a9d4a8bbfe101eca232a8f3ac2433325be23838ca43c16b162497771c80673ba65c68496b51f02b4b857aa5c765a0482a83fd6cf466a36677207e2ac97564cc0e9a5207fa77ceb60b4fdf3aa8dda8768c128bcec270c4b4991687a72c973a8665acd3563a6f0c2721aa22f721a19f270f36bc37da439e1f33efd354bb722780e61333c17c7db589a12c00f2bac94617c99ba2a99f9c2c548c785ccf12e90484f0e8b1072d43d1b7b59bb5423ccc8c413f0c4f1714230d2396a59bbb7e07534096c27c267ed0a2a7a4ac8c7f49e19fc77092904dcdc50ff054dd8194b0e0a4f0b8948f7cb91e1c3a2704256719341777b5738cbb594fbc04b3b4c27ec3956e044b851ba2b30bb9aa3b9d38b827379c1d2547af17b3be01046ff53bea6b9a10c942ca546c700f8933656a4992aa4748a377fb13e1511a9c0381c2ce06778993cac854ba8149906a0be3158a41c258080e012cbc744c46713fd44119c356422e61b977177298411c175399875c6caf24da949597c7a8b3e44a330e67288834972dc52b4f90855b03cd5a80f9423689ff6677c69b665b439139850033bcb35ea99b9e0bed8bc1982b95eb0cac9a56269d60665ea032288f61605e3184be6ac95ac4f99b1cf66289cb5013fb9ea8cd1d27459c8102585c94770a7f8e1b620b3cecd901746277d26e717552559b3a792d6148e670407c65443ace82a5504229a9ba3319c28d910c9ed8671f892c2699b787f31b2006585bc208b13b45c6fd22ae2d8c6aae93dc9bc8f15a196b45512d5f73f124c2137c63571846c12800508981a7ae69958d0389a5728af40b9b417505066bf13fa17f3da8f77ec74ed85c4f68b0580e40d2394852ab3be0e708d9d409203929aa21480554bbe2be52fc6574e56ca736f8c2dbd1c16b1785c58887e6ea2cc5701a14aa58e90e9474517549a406a22a6509b984c891529acf045224acee86c5b2ca3309b9a01c0b869cb5c4b7bd871ee4571e9e52228625d0a0399ccb72100337b6458b9f5fb1b7eb92acc389876d97b949978702764d05aade8d049915c4c2336af547ac0d6c19b05f72f74e7035eec39683463d257a03fb7037948065cd56035986a9a525099e98253b5b6f47bb15331c11f0586ba5378a5f1567c30a84b2818a4783607c67ed9636a17e9bff0c169a5f31f0e97c222539c5f8a0f40f88d0f914ee9d681057a0750c754bf3625679bb6f96c817a635747e43229963342891dbc691b0ca1a593ea752226a51ba0c967370c7b019e71049307fc80c31c1fee0b5df0913e8a326a2f7c3048e71d8c871b8f25c69ab69c4e0a43d8da4d855811ab8672dd930e3ce06371f436ed04755b8b99f813b9b040084fa14d64375d462bbed0d83fb0389ebca591ffe0b11f2182923293e8e547f33214b09988c9114f8e75a8d4050b9ef16ba98110c73b87d5020124954275800bb121b4a8f02aa7d036ac94a02fe9a2654c7871ac4afde66953e57e74c26839a98444147124405dc4036ffbdb86716a45308a398b289c03f7bfa69903898309480490493cf9fb3e4ad826ca0a8e37c793d6a2151ad2eebf3e2fb1a7ff2a14ad39528b15b308071e0cf960e2fde7ce3c73fffe52cb1488426e6761a77de28603001d002039528b15b308071e0cf960e2fde7ce3c73fffe52cb1488426e6761a7","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-09-28","count":3}],"recent_events":[{"timestamp":"2026-09-28T07:24:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"134.14.117.114\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203133342e31342e3131372e3131340d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"d404dc4a-1e26-4dca-aef6-3789c7f19dc2","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":77},{"timestamp":"2026-09-28T07:24:14","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"82.63.86.29\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2038322e36332e38362e32390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"3ac2051b-eb3d-42db-87c0-56a689c4f724","seq":1,"duration_ms":100,"bytes_in":225,"bytes_out":77},{"timestamp":"2026-09-28T07:24:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"60.113.170.84\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2036302e3131332e3137302e38340d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"0cde1f9b-a38d-45f7-92e1-a367e2d1551a","seq":1,"duration_ms":101,"bytes_in":222,"bytes_out":77}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"134.14.117.114","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}