{"ip":"169.40.142.202","data_as_of":"2026-10-21T15:04:26+00:00","observed":true,"total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"921 bytes sent","bytes_sent":921,"session_seconds":6,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-03T15:21:54","last_seen":"2026-10-21T04:20:24","events_24h":3,"events_7d":3,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":215599,"org":"Zkillu SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c6010005c20303a658ddb7743bae11359220572ddcd5bac1d256d4fc2a2d6b505519721037b54820e1f2966030bb4889dd0f303d9405f05b83cfe7cfd3ee5eaf1f1e7470d00cf319001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f0000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0377a1097287b6db37aab69310eca15e56a61cee0473cb54533a406fa5806836c304aa4977cc27fa73a90adb250bfc5832b28af5a123ce0fa6f84e42faa48320c6a21b4c069fc8324198ac962d1529ad0aaf17749d192405d69a49e222e8e913ef45bb79f861e2cd20ed5c7750bdb71623cbd832a8b7b2986adb044e6920fb27536f49b580f272b45fa884b34b0e8ab9490ea3512215fb42c8e2fc5af7f6976096b41ff5166cfec535b2a708f437f95157b50246eff67b785dc1b66a725d72c06a5624990c45e9f1274be2b246b6122d29a9383da25dfd8cda83959b2997833d191fe91a11b57364f4022190a38f0d9cf5fda50e7a98fd9442d47eb98eb8c2d90447a2f22cd455b3f296aa833542b895b46de0055417c54745cb915cb9f005115b8e18eae0c78fc53c870043914462a3b886a1fc4bcea9322eabb4007eb9f11b138f687883a271dbd1921bb38670ba9692c301db6b0364201369a36bf1ec45b0af2392c896a0c864ff7b7827ec43d0500047711b45a3bb8cfab2731607d188822db412bceeb1689d909a27c170fa54476f32eccac1112072b0f0b2a87e40c9398b9dacc7ea42b677fd1ab6cb6917d75a47361ad8352c1757b63e7172376a57da40622bd2415a701aa93ea215a120f7067caed1911fb7ab3d679a3964827bc3bb52f3028c6757db26933cf4c9b09321528f43d40a9712393ad8ea228c7fb53580196a7d54d83f52cf3dbb3241b954443262a4a3e8acc5b7110c2fdb8931d427390142124002a8d216275292c0740c381924da0214a3c3c43b53370ee4a39f58c91e3635b23d9ccc9c593c48a88d6a698be4a667c227751e91184f334da260e3ee282ccb6ae0045a451023749e376fe320ea420546c91babb5b359c9a216d3236ee19163a48b904a91cb5c36b488093658b50792b5ac07c2e04a48f4e387aa839bbff719d9b821c52b27cda864f87533149085434d5cf75ac8af6644745752fb4961837089bd8d0354fb9c846583d37c2236e915bb3d22d669bbe54e900030160fa4a1138a1a08490aa2afaa5a9217d5c049afb396f5c1904f7808f7b3471ed30c7aa1b06e280afb45bc441f01ca5f01bad670523624e896229c89041deea0b0c46bb5c09c84d057c230cc9cc538d4e240dbc010c3a2b30fab5982eb498c3214a46717cde82a63eb1b943459179057611f328f98771c2f9a9fa4992e901ae4721aff3c4b37381b39d4652da375b20c82995f35a2e904398374c78f87878b9406bc41a6d57726c60b50d14464d519e46a84491c61b45c21075418abba9284a2c83fc08a546871f6c3a63c904aac910380b979f9c466b8fa24416da7dfdf7173f38609ffc97ffe9315cc0442d941ba84811b24812e42756a98b5fe527603c007b1309994ec34c5b35c2d26c93781480b48aa5ec81209e999494021a27e51151991a56b775544678332220747ba5a5d5566ba10ba941a038309aa8c9acf3788ebf35c9e98b4a245b39266acf0aa8024bbb77cee8b2ef44c74e519e613219eff3aba1aa977e9b6f098698c9a834007b934fda6e73bc3e6122c1b05ca7fc8cb7e9e480c43a45bd2073a0c3b6d40604671674da000b15e8388a7c878175a7ed19a06681948f8b31e9b5f2ddfbdcfb76940fd207a1929dcdf191e788c71667542ea34195e47977bddc718014769d43efb6b2e99f1489d1a917c2745c1fa7e192499a8b4954001d00207977bddc718014769d43efb6b2e99f1489d1a917c2745c1fa7e19249","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac","b11cun050_00040017_82352b13"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11,"b11cun050_00040017_82352b13":10},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-10-03","count":1},{"date":"2026-10-21","count":3}],"recent_events":[{"timestamp":"2026-10-21T04:20:24","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"32.121.93.125\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2033322e3132312e39332e3132350d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"7d541759-2bd4-4a8e-8d20-26c9ba534296","seq":1,"duration_ms":101,"bytes_in":222,"bytes_out":79},{"timestamp":"2026-10-21T04:20:24","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"244.189.167.187\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203234342e3138392e3136372e3138370d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"e178bbe9-e4e3-4715-9f5c-af8eb7e13b9a","seq":1,"duration_ms":102,"bytes_in":229,"bytes_out":79},{"timestamp":"2026-10-21T04:20:24","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"180.55.152.33\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203138302e35352e3135322e33330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"57a7d249-8c3f-466e-8a47-94baecbccb6b","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79},{"timestamp":"2026-10-03T15:21:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"application/json, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"a1db5707-99b5-4cbc-bdee-3f66b41727fa","seq":1,"duration_ms":6168,"bytes_in":248,"bytes_out":79}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3},{"path":"/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1},{"value":"vpn.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":3},{"value":"pihole.chicago.vpnigo.de","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"32.121.93.125","notable":true}],"distinct_sets":2,"events_with_headers":4},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}