{"ip":"169.40.142.190","data_as_of":"2026-10-22T16:21:55+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"680 bytes sent","bytes_sent":680,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-06T10:23:45","last_seen":"2026-10-06T10:23:45","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":215599,"org":"Zkillu SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c9010005c50303bbce690c51c142c730b0ef11c0e6401cd8e98884d1ed62708cd21b99885cb0b120310a07114820ef7809b9e30df086ca5e3b5ffdd556d3d024365f04a06f1f24cb001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010005620000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c07e786b008c41b64a2f2918326769bcbe875740c7051da57454307d22556f63ec6a3b884869ba0e4a36257bd77b674744d8253185e485f14758a34879df69b0ec2b31b376a6a083771fa3ceff9b9f0d58a33ba1188f0b945173171b70009589b346850e0bb1829f322b95288b0b60a0646b41d6a61e01a211b213ce58212cf4b832a7009ff6d01f672a38bd259ccf4043c41a934bb4568df6c19883bc9b23593784ad0d38b5f616098b14c6e145ba387869e8a2a6a1460b5c4507309672dfa4409239b2ce12730c85a135423fec2c71e6e626ccb55ef0981195689f11ab8b21e7134c5a100a05a3ce67c26242591448909bf96891a39a59e559c1545b5bd1a8ae547581dc6a5013218670c4e760304c330cb0539e636a32e81471bca24c9a5abe52a608d2e63a8739412a5534f6f721ee0791258939cce7ab8f21bc8dccc1bee68f3409655b89b39fe21f148b1630d6967d99bd37c06e6fa11356c56c3f139c3dcb4df20c0005c0a7932c6bea06a82a7785ffdcb1d1198d236bad89232e0958a511947324cab7b3a9be81aa7cb557319204aea03aac4c464928061236848bda2319d7a766d151b024c595e2f64b0dc69e6db27d2c7c25d07cba6468609023879eca823d95c302fbba213266e83867e52b6dd28c278fd20f37803fd07b867e94aeded9990da48185085c86a642439494f8442ec6a5a12a2c59de154709fb273ce3031e516fafaa091eec8448d91b3af06d45233b6a100540f2426e261df5951f6d72443511265a51b544da550c766c90f40bcbc5544fa36d0b7c3d5c63c5bb523decc213f623920013135a1480b33ab58e5b51a31970f5d77f3629888629088f035872226c6c64497e2a4213707791544e7ae80d36b9637af0c8a9ca025609bd64d54da58a88b6880b49912244f06cc5260c462bc686c32e728922dbf4c45238acfdb42ea94571a65b7f4bf166cdd38375019d37d60b9163cb6378076b7b936a354f4f594c77e72b3bb4bda6b48468b8270a80a88a771907d8474bea3270f04bf9a69652bb440b022b4e8699e9432945a8688402bab2db08c6404f8c47631d0c7ae9cbad7a94764c0aab4375b73227bcedf26590b0844156cb10c4b038c51947e634197a2b522424acd753bbf5c355a2b562243769aa7330eb9a87e458e6277e8243c293d8abc43306b9b345a24811b2e1bc70a52194c475be53831a58762a803151564456b237770aae6ea315d3b77f86806efb87bd52a9bbba94229c899a2af33aecda29dd892da2b880395b8f236388a5222ea749aa5a8a6dd36b64ff9b5be7223aa0f346d9e913da28a8d36ac2634c966bf4bf5eac8c03c67ab2832a5644608a70870e93bb276a86e7f48276a877605c94b2b59167bc0349fcb8ad2b40f32822ec549d57931abd929c8cd4758a8a93325b81c2ab449aba89024529f1059da8bbb6b9c9b5adf82da60016a9d00738f95d0717bf58d49b4e700b73bb1c8e301143061447ca8184060cd7ecbfd9244e7c184fc517200af922c6b0ab0da5177a1748f1bbc4ba01be3915b777db4afefc6ba9fb799fb387838707f267ac6c8a4704b606ed3937839cb13f503debc19cd4e39ac17062d6120ca8bc78dfb94ea2da12a9926c029f5e5866c53f500ccbe0c9a34adb819d7519443c96daf0da9a1e235250911484ff0e97854df2f4effec177dc4fed74a53cc2f35b6953b8f42afa6f6f001d002050911484ff0e97854df2f4effec177dc4fed74a53cc2f35b6953b8f42afa6f","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-10-06","count":3}],"recent_events":[{"timestamp":"2026-10-06T10:23:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"230.246.9.129\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203233302e3234362e392e3132390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"600f71bf-ba4c-4e3c-ae04-83eee919cb6e","seq":1,"duration_ms":100,"bytes_in":225,"bytes_out":79},{"timestamp":"2026-10-06T10:23:45","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"161.207.64.80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203136312e3230372e36342e38300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"4213f84b-f51c-4238-bfdc-5377f7a36677","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":79},{"timestamp":"2026-10-06T10:23:45","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"111.9.201.218\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203131312e392e3230312e3231380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"311b7dce-8700-4d7c-8fcf-f77271823162","seq":1,"duration_ms":100,"bytes_in":225,"bytes_out":79}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"230.246.9.129","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}