{"ip":"91.92.241.215","total_events":16,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["16 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,950 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,950 bytes sent","bytes_sent":5950,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-10T23:32:17","last_seen":"2026-09-14T22:33:14","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"}],"malware":[],"top_ports":[{"port":8111,"proto":"tcp","label":"","count":10},{"port":3000,"proto":"tcp","label":"Web-alt","count":3},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3111h1_e8f1e7e78f70_d41ae481755e","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["755cbaaa441626ab9e759e8982278df5","c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cuq080_0005081f_7d1d6770","b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i3111h1_e8f1e7e78f70_d41ae481755e":20,"t13i311000_e8f1e7e78f70_d41ae481755e":775,"b11cun030_00040012_13ee3d34":5052,"b11cuq080_0005081f_7d1d6770":1,"b11cun040_00040013_608dab68":4349,"b11cun030_00040014_54d07b6d":3679},"akin_families":{},"user_agents":["curl/8.5.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"],"timeline":[{"date":"2026-09-10","count":1},{"date":"2026-09-11","count":5},{"date":"2026-09-12","count":3},{"date":"2026-09-13","count":6},{"date":"2026-09-14","count":1}],"recent_events":[{"timestamp":"2026-09-14T22:33:14","port":8111,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"68e1d99d-5128-48e0-b2e9-2e7a79d227e6","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-09-13T08:32:51","port":8111,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-fc28f7c01483\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"f749e3ef7578\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d66633238663763303134383322206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22663734396533656637353738222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"","session":"92e78af3-e46e-4cd7-a947-80cad9417406","seq":1,"duration_ms":100,"bytes_in":603,"bytes_out":78},{"timestamp":"2026-09-13T08:32:51","port":8111,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-b01512d700b1\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"e751e05b2f09\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d62303135313264373030623122206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22653735316530356232663039222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"755cbaaa441626ab9e759e8982278df5","session":"3bdd9133-3adb-4042-ae25-1769b5b08aae","seq":1,"duration_ms":100,"bytes_in":603,"bytes_out":78},{"timestamp":"2026-09-13T05:38:59","port":8111,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-37602ad5d326\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"d3f2f8a18755\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d33373630326164356433323622206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22643366326638613138373535222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"755cbaaa441626ab9e759e8982278df5","session":"568c26e4-8923-4e9e-a9e0-fbf7b9a27d1d","seq":1,"duration_ms":100,"bytes_in":635,"bytes_out":78},{"timestamp":"2026-09-13T05:38:58","port":8111,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-612fb4eb6da3\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"ebd4dd5774c2\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d36313266623465623664613322206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22656264346464353737346332222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"","session":"39557600-0148-4e18-95b7-3c9139368b42","seq":1,"duration_ms":100,"bytes_in":604,"bytes_out":78},{"timestamp":"2026-09-13T04:19:24","port":8111,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-d9b47a74774b\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"3c1b0c34bb41\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e35205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d64396234376137343737346222206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22336331623063333462623431222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15","ja3":"755cbaaa441626ab9e759e8982278df5","session":"ddd696b6-df1a-443b-b11f-598fdc74a651","seq":1,"duration_ms":100,"bytes_in":639,"bytes_out":78},{"timestamp":"2026-09-13T04:19:23","port":8111,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-cf884495aeed\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"c9e58653717d\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d63663838343439356165656422206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22633965353836353337313764222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"","session":"e2cd1f73-b0f8-4da1-bf52-0d47211b5654","seq":1,"duration_ms":100,"bytes_in":602,"bytes_out":78},{"timestamp":"2026-09-12T16:13:57","port":8111,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-c44db45c5044\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"2b21e3a63375\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d63343464623435633530343422206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22326232316533613633333735222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"755cbaaa441626ab9e759e8982278df5","session":"860b4ea3-6a19-4ee9-b8fa-854f5a9640cc","seq":1,"duration_ms":100,"bytes_in":633,"bytes_out":78},{"timestamp":"2026-09-12T16:13:56","port":8111,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"content-length\":\"288\",\"content-type\":\"application/xml\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<agentDetails agentName=\"scan-d1c7cf5fdcef\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"051d9145281c\" pingCode=\"\">\n  <alternativeAddresses/>\n  <availableRunners/>\n  <availableVcs/>\n  <buildParameters/>\n  <configParameters/>\n</agentDetails>\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/agents/v1/register","summary":"","payload_hex":"504f5354202f6170702f6167656e74732f76312f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d4c656e6774683a203238380d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c6167656e7444657461696c73206167656e744e616d653d227363616e2d64316337636635666463656622206167656e74416464726573733d223132372e302e302e3122206167656e74506f72743d2239303930222061757468546f6b656e3d22303531643931343532383163222070696e67436f64653d22223e0a20203c616c7465726e61746976654164647265737365732f3e0a20203c617661696c61626c6552756e6e6572732f3e0a20203c617661696c61626c655663732f3e0a20203c6275696c64506172616d65746572732f3e0a20203c636f6e666967506172616d65746572732f3e0a3c2f6167656e7444657461696c733e0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"","session":"4fd53b68-f655-471b-b7fd-b6631abcde09","seq":1,"duration_ms":100,"bytes_in":602,"bytes_out":78},{"timestamp":"2026-09-12T14:45:26","port":8111,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8111\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383131310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"fecef8b9-877d-4185-8d5c-fa154db080ed","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78}],"http_methods":[{"method":"GET","count":8},{"method":"POST","count":8}],"distinct_ports_total":3,"top_paths":[{"path":"/app/agents/v1/register","count":8,"ports":1},{"path":"/api/health","count":3,"ports":2},{"path":"/api/session/properties","count":3,"ports":2},{"path":"/","count":2,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"288","notable":false},{"name":"Content-Type","value":"application/xml","notable":true},{"name":"Host","value":"<HONEYPOT>:8111","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]}],"data_as_of":"2026-10-01T22:34:39.054385+00:00"}