{"ip":"20.87.32.158","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"684 bytes sent","bytes_sent":684,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T17:06:28","last_seen":"2026-09-23T17:06:31","events_24h":3,"events_7d":3,"geo":{"country_code":"ZA","country_name":"South Africa","region":"Gauteng","city":"Johannesburg","lat":-26.2309,"lon":28.0583,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c9010005c50303bf26edc501027e57c380480bfc82557e40c1c7b371c6d29ca5478cd1224bd98620d48e27aac542a52975cd85225d0176328db4ccde07d8413a2c9893e61b3b1f76001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010005620000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c00ef70de0ec15978595b64c9dc248626c69ad88f79599b60c986b710c883b67dc34957a63f984181babae4986ab7dea91da0854df2114c614a247764aba09008961c41e391fd6d468ff9b08e9f45ff8a53474b566a00c9bb6330ba359c25146b57be55d064c46490203d3d3c96ec657392096c4ba6e0bba5a8c99995f34ba2ce86894a28ae9141968737721d71f2d3056275b11db17a745284b2bac56cff865a1803298394b5844c4f307aaf9f01b3100c4a88b426889173650580cbbc486b14aa7c962f468c4b8a63629c99b2bc9722d0c9aaac2a49f920b8faba2ecc54b196394c0ab221fac4e8fba0c6ee40d9c0c7ce5a52884145aa1389ef79531831a33eeb23747ccc200726767a663ecd6b49ef6820bd2044ef4a4122341ea9b8c4a188847d870faeb33e126691ac2c63070137723433549852bcb99a5596444593dbc2b6a88fc89c91238bc0c26cbb9adb3dc6efca0853c719dedb22582e85a6de06c70e528a10b63423c320b004737785eba663f4f7aa90fb4aaea984d467984e53c75892acc5506685a3473bda32f154a03e9cb8ed733c6491c07f170088e66c5e079991ca83655dbc6e9d05c457c7a57793bf764af45084305080c3e91bbd9613f1f01638452690fd56d479430ec803f82e78463929fcd291845e78a59129689a0769cfb392ae09af1123b99698edee01568068e3f12a4fbe38cf975208bb4b14d8949e4e49cfb90079a592871e0321ac016b933375ec93dd70a9542792753db26041a8083257571c911ac7104cf11362f186fbd90843d398e79458bb65183ae763f4cebb3f6c78e3ef557b071781bc60b41a41655f6c7f1530962d079a063043b0632a51b867384c06e1aa4e6817af2d9028502160f8621870341f3194da89b212f803a05c1424571514747320feb25207621bf61523f252abe950ec931af388a7f4c0bb7954b503c3bcc54741a955476be1508256c62c35551c80bcf79855a0d68ce8497b5fdcabf9322201bfb4d3e3819a0f4406288a08b3c9ec968003a631c62d336d2301213fb437b325ceca66e7b50a8ecd03d39c06fd234013b078a07eb42602a29452c2aba42c9b2132de96b2ed690030378b62385478f54c4fff2144d2475d4b8b450913c12751243e85f75e4a7e86023808a073d3cc3cb802676663bd4f5855a92a5b127b58df85648d8c1a477bfb683c178b39d33b75348a363103028eae88780fc4d1c163b0494032fd68af771545e4b7235aa1949cb957d6b03340551f79c5fdca365a3e8090d3ba9d7a00c1352c9d893a78d4a9dac0895e5d4a983e3493f636d4816bcdb659589564ce9fc8d5c39c4809b339e953295a663961a244722602594cbd34a16f8db369608612213abfc540777217268ea71945343fcd3565a1090af38bea8b6906b54550d9631cf9c78ca1b4493336afc92913257472f0aaddb77092635ae024b34ebb75f540a4757c45a779394be5abe35f1c93a4442a3065641976585f48f005da851843eb485a8461673ad10a8f3560632544e55761f2e61c5b88724e1d702fed706b720719de65d48044c308b2d32110ebbf7424efa4dab5091d2a46ddde54268982c2b8aae3bb85953e1613eb6a0c2c33072b6769417368868990bd9823ae6ab8fe8a5ef61f9a9d88992b98eafc3725709588460dc5efd1065c2ea9d8729f75a778940870c766f2d8eda57231dec34a938be920d001d0020dc5efd1065c2ea9d8729f75a778940870c766f2d8eda57231dec34a938be92","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["a11cun051_0000004e_2619b3ac"]},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":1,"a11cun051_0000004e_2619b3ac":1},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-09-23","count":3}],"recent_events":[{"timestamp":"2026-09-23T17:06:31","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"129.216.120.117\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203132392e3231362e3132302e3131370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"75d5b6f7-bc9b-494b-a41f-8aa4547bdd0d","seq":1,"duration_ms":100,"bytes_in":227,"bytes_out":77},{"timestamp":"2026-09-23T17:06:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"183.193.89.141\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203138332e3139332e38392e3134310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"2008570f-a773-4b9e-91aa-ed60df1195b4","seq":1,"duration_ms":105,"bytes_in":226,"bytes_out":77},{"timestamp":"2026-09-23T17:06:28","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"228.225.155.67\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203232382e3232352e3135352e36370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"52d9a564-cd7e-47bb-a6b4-a09a43479172","seq":1,"duration_ms":101,"bytes_in":231,"bytes_out":77}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"129.216.120.117","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]}],"data_as_of":"2026-09-24T13:49:17.777541+00:00"}