{"ip":"169.40.142.177","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"673 bytes sent","bytes_sent":673,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T19:50:39","last_seen":"2026-09-28T19:50:44","events_24h":0,"events_7d":3,"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":215599,"org":"Zkillu SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c6010005c20303e348488d37f1814c7122da46586075c74cb3595be49d0a9eeae85ae7c30d05bd20eb416f1b9d46374187f04267cd53889a820180bee297be63ace71aae5d7cf52c001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f0000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c05d69bdac60281f8803cf719c86b5c90a1a1fc4429928d56a8ae30513ab904071b1d5ab552e9b5944fb837d85c671c7c436c00ce4297d0a60b052d1c3cf6b3f16478746814dff94bf75e796af8c5bd8f94ef17c565009682a33cc98211ecd2118593445025006ece006ac65a80b1003e79852de38b91cab879f7aca36f035522341b2cc1c669a9ab1855b7c05465c72bbb3e582835aabf26129a855c0d0d8c89b357bf0c528b1421df5098f9fc75660a05629e200ef8743f3e4b71a450d55a8bb545740b6779c32db57df87571af33f6ec86ce969a6aa6934e3b201ff980a25e3ab85a0adbffcce4faac295d40ee580bb2e3b3060e14805c324cad9b56b7c7e3028a459a86965bb5a2a0c56b2da8980c3828a0abaf1e73e077aba2f973cf6c75ffc6419f4e765c50937887291e0374165c129387b6c2687130eda72e6037d0237a14bb87862335687cb4a655a82aa8ac96ee27f212c50d763b0a166aefe17cc6f7a17ae79c902b5a4c6c709e054330f13a9609781a5963f9af930e0e75395769178c437207c3c21113185598f9c157c4e1342a7ab87bb7820d821475892c4a2d35227048fa24ba21c436519c68d46b345c73a1ee98186a983c21af28adf62c236fc79a6352eea57a683c5a932eab337d51ca2c055665986557567d0317c6acb8f0a388785458a5253312ad4762d4573e5d223d950459602708db4c85c071f659778d9cc181c7017bda44622e5c1e7e4c3c199175cd16a55573c8b9b8af807765b8b1f9df4a76a79a1de6c524422bcf4650f03661d2fbb0394585191bc52ee062e0e00d05ad3b4fd0b1712775c5a377b21833497ea56c8c7383b54878cca7120ea07bb8044dd540935139d1aba58c4d7a463b302c1fa9f7c704c7922692715529a898d70b531625b429b01ac8f67abf8f1bc76e3c9a001bbf0695d75db1d0a711733887095a64bff39af6a2c447a73618a52714d73c73d3376b6073b274126ec7130fc20afd68c2fa37403abb22446898abc90a09ec557fa26599a80137be599374323f8ca17c22c9436239d9ec38a728b284401bf94e579fbe35f814599fac2ab75e982a6dbc99859357e5c975a2b599df3bf421bbc21ca793d71c84e2c1948e871a835c5ff846c6d1776cd31b479ca93ca56c22d4027d7494ed6bb8a5d40cd54ba4e5c2b788635cd627a57e1f34d1e921ee1ea73ee752ddaa224d16c82d0102832d455423b4a8cb7041f18153f779802787a64ac8a9db01edd17087f580365806c67e739265b917d1841822a0acb56108ea89d6e47c72f5a611250555e256904e24ec15553f341afb59523db636d73310a90aca10410c9d90bb1b77b7fc2f305af4b6e20714e69bc741c9733df4852943b99f36c4bc075ccf8873420e92899eab70df80e5b30c0e4120c954710248b9c2847bd3429c7c8e2af22b86c06ca391deacfad7253a125c01c683a42777fb56348c4f432963468bc9b1b34c7b4dbea5b5d826fd55655af4869c13b8057bb41373055a40bc667532367286deda269b7b1b54ea521bcda1f0d87c1993927108c5cc67c2cab2211eda36a5c893086f32fae3456405c8daa983e2341ac8b0584f51087c519bc9cb74b1bc327d2e5ce7f7c1df51c18e11117e2efaca5c9db8801ecd0e71a836f06bb8c37d3f3b21c12b498066b3187554e3bcb82543bc7d6247725258d8e343496df85e9810def4e3383bb11001d00206b3187554e3bcb82543bc7d6247725258d8e343496df85e9810def4e","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"]},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":9,"b11cun050_80040013_2619b3ac":6},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-09-28","count":3}],"recent_events":[{"timestamp":"2026-09-28T19:50:44","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"108.231.203.123\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203130382e3233312e3230332e3132330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"72fd2492-b02f-4c8c-92d0-9be9e82330f3","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":79},{"timestamp":"2026-09-28T19:50:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"161.7.228.241\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203136312e372e3232382e3234310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"8a1dfff7-da98-4e97-9f91-3da1a8f7ef81","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79},{"timestamp":"2026-09-28T19:50:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"192.69.72.106\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203139322e36392e37322e3130360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"305174fe-b0b1-4bec-aa77-cefefeea5f93","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de:3000","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"108.231.203.123","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]}],"data_as_of":"2026-10-01T14:37:10.030881+00:00"}