{"ip":"169.40.142.131","data_as_of":"2026-10-22T16:03:43+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"672 bytes sent","bytes_sent":672,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-10T21:42:32","last_seen":"2026-10-10T21:42:33","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":215599,"org":"Zkillu SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c6010005c203032de28e099e67bbeeb128182d7b29d117095bedeb1f68fc21b2fb5c830b73629220967b52710149bb72544a4fa19e717b21c10fb4d3e420bc2e1069f2971daaceca001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f0000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0fd89ce0cfa539269213132abf0ca3eda2b486d7c04d0e4c91ebcc34fdbca5f32156703ab440ca173cbb957a5466d8c7a93eb3acab58bee9813523764e9589cf379812997570fa78d33d1b465f112552a2309d01802113396920c677353f48a93e7cb22512c9986862b9936a4c4230c5fb0be928315b5f8bfbd68b953823fd82b0e3c1c3cc4ebbe520708d39a4e6dda8cc7db44f698492b437e560758f5400b78f503516564807074614544d96a5b84da5b39572e46f1203c50b464e21d4b40cb67d03e223695deb7aceb763fc95641b1c9c2fa39588422beaed328484611fb471a650649b4d86005992f5ec62339a42570600e85eab9c1ca77e13568d09a214a1245d94944ff9aa53a22c98bda635559c70581579f0c618a919f850a8615934c6ac8a80fa06f64515a18d20f7db49f3ceb75e540c64a4c978219c6270a8500e30047e864af85b054767473cb4012aa6447dbcc17670c17fb0b01e21a24a9196f51a1c065455688494269552d579648d250194728efb48472c554cd206bb41945c406b44f6056fdb463217564f0582b7ff430c915abf5dc064e0c57d556ac28a258c4f1335a8343d06b6f2baba8cf402e4ee06993400c1fc8c4e0bc57c77b806337023627c0722969a9eb9541ea4bb3271521a91ea2a24f1e547e57a60affeccb25778bf493b017f6751c02ba0ff9714f1b5aa1ea9ae0ab9509f07dd942add497a98a67995a589bfca62d0fcb2facf72ec0ca84020c66de38633e15554a80c3d4a60c2847992ac50eda044828289842f72ef7d9b11363189e87a917030a0554a82b07b2d1985d34c941bc97c42c4baf9a9302ab92347c98ccf3144d36a7c29d06a133e03d3cd62361ea64c81b9e95b62794334dd9902c47498356d85417b67b0a4a420f41b84da27d0e1295c82bc969436d80974b888783d2887a99a9a06dfc233000a5e265ac2377a74700841f91095cb471a01a3b53ca53515036d4893a6ee52a27073e73d2af396b88c67cc24986055ff90ff32235b292c5aefaa15f9cac87a6bc6cc16fa31c2fd75084054963de9a97c8c1b718812a9ffc172558598052a0be47599a765d4dab1ac13115f028694ed63174d61f9734ab2bcc1f3d1655ae76a061493efcf223d6c65e64d04381f2c368e18332e076bedacd7b92cb4f37cfd4d9cf71c2424ee4b4f829bdd8e8ad5a941360479337e96796d454b546321ea791ad469ea2986a6e848917052bc4670fbc0264f906c2cdf06f20209841542825a8cc5f16cdcd9c950bab5fabaa65c3715ce3c67592228fd1f1b0d079248ec9b8ead7058262b283102f7fd3593ef37cd6102d8baa57283b3ac8dcc4fd9bba420729c992c64706bf5d8778a038b93b7a8f4c29a52a24086258990ae4c60848bbab4c075a31b8a8504f6dfca980ea945c769645e1b905639958dc0745a6aa78bc3e275865aa1c6a4b18213dc230c4a283657cb362fb4d4215b894ba39de64a7c0fac16ddc2450bac064d6331704caf418437ac274fdf887dd911f04770863624ee135b8f9f52d2e03648131cb71c3a6db474b56eb427cb7a0feca8c3299bbb5a8bb1d1c5670f62b92f91debe4194c00a8a7242bd546267c883882307ee33bbf43b361644a9a831ed64cd76eda88ae5a60af7d8eec0f46e3381faf952d8ea14650e6b42950db2f1d35d569ba363104029a0df06f3ce3a1951828d7a933e6475db3377b001d00202950db2f1d35d569ba363104029a0df06f3ce3a1951828d7a933e647","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-10-10","count":3}],"recent_events":[{"timestamp":"2026-10-10T21:42:33","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"254.27.237.134\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203235342e32372e3233372e3133340d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"cce532a3-b5f3-4aa2-ae07-0049c1434717","seq":1,"duration_ms":107,"bytes_in":223,"bytes_out":79},{"timestamp":"2026-10-10T21:42:32","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"200.58.74.127\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203230302e35382e37342e3132370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"27ce6df6-be0d-4b88-8a4e-e2d1dc054ac2","seq":1,"duration_ms":100,"bytes_in":227,"bytes_out":79},{"timestamp":"2026-10-10T21:42:32","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"97.84.168.220\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2039372e38342e3136382e3232300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"1d09af68-ee4f-414c-b898-9afc67c4c0ae","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"254.27.237.134","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}