{"ip":"42.1.112.36","data_as_of":"2026-10-21T14:03:16+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"683 bytes sent","bytes_sent":683,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-05T19:38:21","last_seen":"2026-10-05T19:38:21","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"VN","country_name":"Vietnam","region":"Hanoi","city":"Hanoi","lat":21.0184,"lon":105.8461,"asn":131429,"org":"MOBIFONE Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as131429","label":"Mobifone","category":"isp","url":"https://www.peeringdb.com/asn/131429"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c9010005c503032a88b6aa4b5bbcb2263456b2ccd9926780c4bbf1ed588c087b59df2fdddf091720542c567e06f4f35e447ead960f8410535dee2478b2002284578fba6cacc672dd001acca9cca8c02bc02fc02cc030c009c013c00ac014130313011302010005620000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c06fac443eb8b0f7192bed954926e0499d13981400501381497bb66ea57cbe0e50803a9918fdb8381efb0bec82b5b6f9c5e05533f5767f28290db6362897d7081d6904c7d29f2ad190cb520633ba7c45f4b9a9450a288b94a7312ae293ad7831152f096642f6b1f3db2e4c177f824cb04ec904c168c89ca6c249a7129338cde3aa228f4a45324ba7ac424e698246b3e38bd9c0824fdb1099c424c6d941370aaf56695118428fa87b43cea8b82730cfbe87a281e0c902575ff6a11895c846a3126407217b73098eeeb21ccf6c257623cb39fb9598b367386aa4432964ca6a0f268c5636361ae4e9075ee57e405360b27b4d65904441506349f965270059663969eaab85dd752292c37a59ea35115c889910c4353548c2327153f54efa077c6519910afa8b6f670835a08d15e706bbf2b1d26b6bab1367f74caeece3397f067d4875ad322596a603ca25b52f1a603c58254a8200b53d1a141ae5c2c1d5b1134bbe44c3bc20a81ad2771d500c9c385ca12cb9778d0562c30835f72964c154180e7700948998f5c6303af0a08827145c9a162380123a0436fda5157d8a4eca61455dc9c1fd8143d01a341c35ca6679344c51aa2c08ca5f096a32eb19365c4ec426b0774a7eed0551d4b03fd31324436c864bf43c43d5459c551fbaf2382eb74bc2b3855b801f70740810556ae8b35b1ebc022af462dd2bc4e47b64bea3157452946e7695c6aa16a3521cb139533b8080d0da22aea56cc1f1cbfa03b64504a304ba1e693152d2c767b1e7b5ea1c4d6f7404cb6463127c30fe6c6f5be61bd311235d4b3fc16831b33884d1f608b079b969db2fce980cd7511f9e9c56455cb61cc83f887ba811a6bff7d3878651bf6c8ab0f26bb747ccc3e43222df2b709a0714abb374ebb746620a4958a64f21761be21955efc099a83ace5bb1ce01d646ea6ac17414716a01295ff20be4fc9bda02670ed58c31e7560ce9b7fa2a0b6e676f8f0b6fdb7b4fcfb515b43ca154b66860f9c9b9879cbe19b802133a91c06502a76f261c689c38264fb3cdd6e66a434819d25599884339fb3361c5fb2a01314433c564a5f764eecc6c177c1495f14a5db9515d780ea5a156155c62e99009105a6c81e98dc5fb1dbfc6be77351ec4335a7ef0a9132a942f439b46ea39c1cb27e183090bb72d8ddc67149b5e292bc4b131ba1b1124bbe0114f6411ddb62c48565a87eab4d944c1db6ca4f4cc21d284b65aa4ca28f161e67b17eb77390b611f46053974a88f3ed76bd4801aed32314f59cca7852b880a79fbf32ff5934dc2307341777a05b93f1da07318ec23e129bd167011c2d26d6fc9304586b1b02523f28ab58e3242b0cc7a47e04f70119701236ece978b9a0b1063fb2187782c00073f125617e72b1c44bc7af9714697c61d7bd6a2bfa9652f9b99d37a576fd14f16aa0ece952fea17900a4a01f7394a25b60ff75c56a0555db5a14ce7ba71b3a92880035096eb3ac61720807235053931b478bc15e880fd7a6fbdf99b32967ffce3bf39742b2ab5afc9c80cf78baa5c5b2c12b6936e763ffbbbbad1974e90a78a740614e303cc1af2b8121ab228518e57450676c463b50a83f1ac5baa74a6ca614686ca3474536a8f700f82f27a311d5f9828f7bf86bf3faf75a563364fa19d1bb2153faa9396596da957147e39ba85816d057263217101aa808ee691c1f38189c96e278af20c8ebdea51001d0020147e39ba85816d057263217101aa808ee691c1f38189c96e278af20c8ebdea","tls_ja3":["830b214050a12f72787c1e61e84a6c04"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-10-05","count":3}],"recent_events":[{"timestamp":"2026-10-05T19:38:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"238.199.82.207\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203233382e3139392e38322e3230370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"c9189a84-30f6-421a-a7cb-6f79669e78d5","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":76},{"timestamp":"2026-10-05T19:38:21","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"105.217.163.100\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203130352e3231372e3136332e3130300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"ec10964e-0847-4d95-91f9-b1a7d03f2e63","seq":1,"duration_ms":101,"bytes_in":232,"bytes_out":76},{"timestamp":"2026-10-05T19:38:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"111.16.110.57\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203131312e31362e3131302e35370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"830b214050a12f72787c1e61e84a6c04","session":"a3513109-3c28-47f9-8953-5f5ba48f4f66","seq":1,"duration_ms":100,"bytes_in":225,"bytes_out":76}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"238.199.82.207","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}