{"ip":"169.40.142.224","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"917 bytes sent","bytes_sent":917,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T13:30:52","last_seen":"2026-09-29T15:21:57","events_24h":0,"events_7d":4,"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":215599,"org":"Zkillu SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c6010005c203033d130fa34c5cd685520cee87cca3f99a4c16f4e23cb19dd68dad3a386e3435e720cdf22ed97dbc6e4a7e2394461c59f447bd251c6a34ae6aeaca21dd1c6d42ca4b001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f0000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0e5e2090893b71f75136a67830d22b72fd51c2005a3a5eb717e851d5783b92bf87c44b7c38ee9b661144d034585c5aacdf30bb03727ce54101a033a1b7531771ae504ad15a390a5c5fed591c1a9293e81582a434061889e1cc5285358c52a00b509442ecce83172d3110397bbdcd53cd0f4a984732636422cb022a09f21c5ed8745696bb25474cbfa9794d0b7a5b1239a6742aa4e13921e162e84eab5dfa55f30fc421c458945bccd53646c6aa37630f6ac78ab7394c111c9fc881c726e26921ca360c89fe4ab75c39c48a96612c17a44681912f3a673c3b37a31315e01aea67b66f6eb83dca83a9c10a36a00c8d111339611225d199b3ff859f6801a6cb91f266b3ac8b2ad8de490b1f43b8a318f901c90dad2cd01c47baafa6d547961ea5bc15e94264819bd5fe44e036962028c084ec9156fe75bac7b71e5e2188347ac776b7ba4f55ef8f07d3486b77510426727ac0edbc0a7012360442252d695dac32bb293597b2c8cb0871a17d71302f0718bd635921a412ba1b1fde8141a6a040426c7e8940b9d90c6164ace4f35ada001421d8c74c2fb9b1ea09a60eb38edb86637a98ce69c6c4e45557bfc6746ab29bde9059aa4c0b8f67b4bc042bf60bc7d1286e5716d0c2501cd0a644069bddb08b3c3b7946e4a699319bb140465a8780d9597595912b82079578731b15ef06c75a16d6f66a9590b211eea3a7fe3476e60420ab5c36447c4b94046de822c374931b0db8dafe52c0c890cf0d227e5ab87fff36305122dad28c779e7b8d6b0a2d4a35fc435640d279188c0bcf500994d1cbb6350204b6798cc580820ba53612b5b79e44c77a42ff3338379f82c90a5427bd3621663599e3869830a975079808076b3ba7030a82701b72a05e54a14afca6d3201452bba5b8fa089693b5c81bb952cbb161fe27c53b31b11ab815353add6497059e656af2c7472f58fd986c637549f5c75bf6f35a0b9d9b79acb6e09807fdf21cd9cc7a2be0024e215652a56a4476b83733356f6666346d9c769bc03a2381b53c36f5191a7a806673c6a44d59179d9019962f2cb3cb0ccc6dcacf553c562547dcedb98ebc848d24601baa862e39aaeb2eaa8ad122ae0d823581a8b10e911f1c2129d416029d141ed8ba7e346bfffc299066abfb1845b2d277f7a46a711298a3e2b0a0c83bc06ac3d7554ac48c1102f95bb677324a4e1158d2bc1dcbb0a06c159505504fa45c9a2b87f75e269c7ec5d4d55669905268dcc1df8a3c8fdf2a8c1d4af2904003dd9adb14542a8132798eb5791cc69ec21adcfdb278a64554c511a4d307ea59a0bac16941ae5bfdcf2091cbc7c38027a89105c406bc1e829aa6d8897c1122c2498ad37822f91ba33fc3066f6f2a726f245584209bb5c1d3655a388ac80219c122916099b18825fb4744d4a4db0b50c65441d25372709b4ce671979b2b041412abb04081f28839431451270b212b12a589a924988436534cc9f51330082177339d62dcc32b51ae56b1ac52bf0e4b159577d30144fd241c60766130fd40851132baa684e6be3651d4561baab707a9ac2b7c6a4d3651903871c08ccace2b0a4eb7623fa16836fd06829988b1d92288bd36d29b947f85116555c7ad707399c4446450cf0aeb43447bbdc006dac3399b2dd1b288a50a1921248c580d13dab758d830d3c909413d93126410e24bf97ffe87577bf5d8f09d33ff1592e168090a1af54001d00200d3c909413d93126410e24bf97ffe87577bf5d8f09d33ff1592e1680","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac","b11cun050_00040017_82352b13"]},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":9,"b11cun050_80040013_2619b3ac":6,"b11cun050_00040017_82352b13":7},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-09-29","count":4}],"recent_events":[{"timestamp":"2026-09-29T15:21:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"248.160.31.184\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203234382e3136302e33312e3138340d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"964b26c8-364d-4b03-826c-dcac0263ff27","seq":1,"duration_ms":105,"bytes_in":223,"bytes_out":79},{"timestamp":"2026-09-29T15:21:56","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"43.109.253.113\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2034332e3130392e3235332e3131330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"83a14209-df46-44e5-8eda-6041b69c2391","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":79},{"timestamp":"2026-09-29T15:21:56","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"70.87.148.53\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2037302e38372e3134382e35330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"3beb0298-502b-434e-803c-440b977f0dcb","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-29T13:30:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept\":\"application/json, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"4f76c0dc-dc1c-49e6-861a-f90a73aaf589","seq":1,"duration_ms":100,"bytes_in":245,"bytes_out":79}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":3,"ports":3},{"path":"/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":2}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":4}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"248.160.31.184","notable":true}],"distinct_sets":2,"events_with_headers":4},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]}],"data_as_of":"2026-10-01T14:37:09.271431+00:00"}