{"ip":"31.56.58.167","data_as_of":"2026-10-22T16:23:04+00:00","observed":true,"total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,332 bytes sent","bytes_sent":1332,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-03T17:48:14","last_seen":"2026-10-06T08:26:34","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Saint-Denis","lat":48.9335,"lon":2.3661,"asn":215599,"org":"Zkillu SAS"},"source_domain":"167.as215599.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as215599","label":"★ ZKILLU","category":"cdn","url":"https://www.peeringdb.com/asn/215599"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":3000,"proto":"tcp","label":"Web-alt","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105c2010005be03034258526cea2950fac2c8ec9e6a55df6f73b48dd8c09658b4660287262d87a16e208d4b01f4cf445b81cb74280670517a57e1b3cf7e603aaf66bb74c005dbc2e686001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055b0000001600140000116368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0d30b96d412410f12a7a1e48517b59215abb21760182ee76a4111cc963332f0aa1385c19be7994929f92e74125cca859a181619170abefd6a35c22141229c86657b13dc80cbb684466a7276b07b7222d81c500c1da73a8d03186d49986f851367d11b3dc550ce4d4c5e0298c03e17a57c154aa682639ae76054f23f836989bc875aab18306d5625311b22089085852b37a09285f58c9ba7a2828d728bfa75c8032373f89a9b10157204992197b6bfded33a5a47847fa419b6280576c1a0f1806ff466a764846afb96869b20cf5a480f285745c0fc4317bc96120448b9753aebcb09a68a70884b5c13da22278b3768c0803073650941953d90a5d8bb3ff4c7ce85d39a10a18b36da4cc1201c45550afdac21bf80be34a758195111fcb0c6288c4203cb6192b995a6ac5795888ecfca317f7aa27ce794fb68b9e1d9c23ef737b9e40906072bbaaba3f0e82b61a9061c8079dfc57ca4534418e19058f5c95bb5aaf9b86cd942bdddb1aaef26782cf501b59325cbc961df472c1aab0089c8346f7b7c0303209a6599c2616c46fa88964713a8726b8cfc9748dc926d6b85aaaa1468798424421cd62140d6c7a809495dc7ec111ba09964d96561b01d7134bb84e0a5ef887ebda6cffa69058ee7a8f1f5248e459b3dbc3bb7570beb6bb70de80049d4cec1dac57bd4520bb931027a4a5776c15be729b122a029841e57f695a408bbe761297e2c1672c2859be29198570cdcfcbd8110a187876b84a57fd39721103b3dc9f2697c6675d3d89fa5f8bfc8856227439f7d62171df5c578e6057523ca522883daaa998d79b6bad51e7f2c392b427c80377f187642e1b681e5840f68393b77334a81d09da511aab6c12ed5e97dc0d2a67a86ce64065d6bb23e3bfa3c75531d194b159d67a28f573525698bee79289ecc5db1167fa2f83000074a1dbabdc0dc20c635664646121f4bafd0f6528613508deb1588eb9cec490eee417fa7577f41c0b020b1a74acbca4e228c5a2c148b110d7393375a920237077c0df6b53cb29d2b856d8f812f6359c6a18b478687b6eb086c309004ed365b9d2520f8c8c1971993e9585189928da3eca4beb6420adb3142bb1b5ab19af66a4db913797e0cb1f4bcaa4e1c929e8c30bbd050d35131df4649a7eb7bd00228e5b79f60003661f77ad8a2b6b8896bb7384ba4012b2406200543bfa7e682703a4ed1e6187ba322300716cc3444a572324297aefeda717ce0aa40ca5850dab095223c48078e0d18b90802121b60cbe5abcbe29a1c514aaefceca176b6491ca44df18411aa2c75c72695c97c743f250b09bc470e31434aaa4630e78e4107341fd9406e2c6c20e23b6ea591eac0b4779b512c710b9bf3a679233bd7696f4991ce312987f26899eb13b9dd1335865822a9694f3620cffdc348e7c78ac76a816b0a3d8e2086a9350748e284268a8ba9fa006716077418ac3a9284d533700a578742dc785eb3574dd00a950c733d125af8e51c9990c28d908d9693bf94c881672825e4359e5f9a5231da57c0955296e1745951b755b088826cc7b8004d82857075b676bd9c097dd7575f9cbde919ce19c62eb0a730a32a7360d277fc7c43e962c04ca83fda2ab86373a3cc174a4e998f82007334f1d3ba7061126d0ba807f6085b7ac49d442d2f73d794a88a99eac1c48bc1d7b553aedb063448b2c213f8c92fdf2bff3b3419020597c19cae0d001d0020eac1c48bc1d7b553aedb063448b2c213f8c92fdf2bff3b3419020597c19cae0d","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun050_80040013_2619b3ac"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun050_80040013_2619b3ac":11},"akin_families":{},"user_agents":["metabase-cve-2026-72898-detect/1.0 (benign detection probes only)"],"timeline":[{"date":"2026-10-03","count":3},{"date":"2026-10-06","count":3}],"recent_events":[{"timestamp":"2026-10-06T08:26:34","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"219.161.17.251\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203231392e3136312e31372e3235310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"f4403937-a4ae-4ef1-a0e6-c1806e5e3b7c","seq":1,"duration_ms":101,"bytes_in":224,"bytes_out":77},{"timestamp":"2026-10-06T08:26:34","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"215.214.96.180\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203231352e3231342e39362e3138300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"47cd4f97-348e-491c-ba99-6664633cb9f4","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":77},{"timestamp":"2026-10-06T08:26:34","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"112.248.222.25\"}","body":"","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203131322e3234382e3232322e32350d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"42a76f76-d4d5-4b19-a4f7-6cd05d5ad192","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":77},{"timestamp":"2026-10-03T17:48:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"182.188.89.85\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a203138322e3138382e38392e38350d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"d428275d-6b8e-42ae-a457-2fb6f94a82c6","seq":1,"duration_ms":188,"bytes_in":222,"bytes_out":77},{"timestamp":"2026-10-03T17:48:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"40.184.154.39\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2034302e3138342e3135342e33390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"fc006edd-7434-497e-8812-73d3f24f2c51","seq":1,"duration_ms":101,"bytes_in":222,"bytes_out":77},{"timestamp":"2026-10-03T17:48:14","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"vpn.chicago.vpnigo.de:3000\",\"user-agent\":\"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)\",\"x-forwarded-for\":\"85.61.42.142\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64653a333030300d0a557365722d4167656e743a206d657461626173652d6376652d323032362d37323839382d6465746563742f312e30202862656e69676e20646574656374696f6e2070726f626573206f6e6c79290d0a582d466f727761726465642d466f723a2038352e36312e34322e3134320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","ja3":"","session":"1a4aff0f-1b65-4f92-9802-b4a98cfa0bd5","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":77}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":3,"top_paths":[{"path":"/api/session/properties","count":6,"ports":3}],"distinct_paths_total":1,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":1},{"value":"chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":3},{"value":"chicago.vpnigo.de","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"chicago.vpnigo.de:3000","notable":false},{"name":"User-Agent","value":"metabase-cve-2026-72898-detect/1.0 (benign detection probes only)","notable":false},{"name":"X-Forwarded-For","value":"219.161.17.251","notable":true}],"distinct_sets":1,"events_with_headers":6},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null}]}