12,251 Metasploit Matches: Mapping the Exploitation-Framework Attack Surface

Avishai Wool's research is not the subject here, but the NCSC assessment is relevant context: it argues that commercial cyber capability has lowered the barrier to entry for state and non-state actors. Open-source exploitation frameworks sit at the cheap end of that spectrum. They cost nothing and they are widely installed.
The NCSC report also lists commercial tool frameworks among the enabling capabilities that circulate commercially. Metasploit belongs to a category the report mentions only in passing: general-purpose frameworks distributed for legitimate penetration testing and equally usable for intrusion.

The headline count

A ZoomEye query for the product fingerprint app="Metasploit" returned 12,251 matching instances on 5 October 2026. That is substantially larger than the Cobalt Strike fingerprint measured the same day, 2,374.

Breaking the surface down by service

Narrowing to HTTP, app="Metasploit" && service="http" returned 9,759. The remaining matches are split across other service types, which is consistent with a framework whose console, module server and payload handlers do not all speak HTTP.
Literal banner matching gives a much smaller figure: banner="Metasploit" returned 667. Title matching sits between the two: title="Metasploit" returned 3,908.
Three counts for one product is not a contradiction. Each field matches a different piece of evidence, and the differences between 12,251, 3,908 and 667 are themselves the finding.

Recency behaviour

Adding a date constraint, app="Metasploit" && after="2024-01-01", returned 10,194. Unlike the equivalent Cobalt Strike query, which returned 0, this field is populated for a large share of Metasploit matches. That means most of the exposure can be placed in time, and that a monitoring programme can track change rather than re-measuring a static total.

What an exposure count is not

A host that answers with a Metasploit fingerprint is a host that ZoomEye attributes to Metasploit. Many such hosts are lab machines, training ranges or deliberately published test targets. Some are operator infrastructure. The data does not distinguish them, and it does not indicate that any host has been used to attack anything.

Using the view

For an asset owner the value is comparative. Run the fingerprint against your own ranges and against your upstream providers. A result is a prompt to identify the owning team and confirm whether the service is intended to be reachable. Where it is not intended, the query has done the job that an internal scan might have missed, because it is anchored on internet-visible evidence rather than on installed packages.

Limitations and a measurement note

app fingerprints are assembled from protocol responses and can be stale or incomplete. title matches arbitrary page titles and is noisier than a fingerprint, which is why its 3,908 should be treated as indicative rather than precise. The counts above are point-in-time observations from 5 October 2026.

References

• NCSC, The threat from commercial cyber proliferation, 19 April 2023: https://www.ncsc.gov.uk/report/commercial-cyber-proliferation-assessment
• ZoomEye: https://www.zoomeye.ai/