{"ip":"34.151.221.164","exported_at":"2026-06-18T02:41:07+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":100,"attack_stage":null,"attack_chain_stage":null,"threat_family":[],"recommended_action":null,"confidence":null,"risk_breakdown":[],"mitre_tactics":[],"mitre_technique":null,"top_mitre_technique":null,"top_mitre_count":null,"executive_one_liner_fr":"risque 33\/100","campaign_hint_fr":null,"confidence_breakdown":[],"persona_hostname":null,"correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":null,"confidence_hint_fr":null,"sensor_role_label_fr":null,"tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":null,"protocol_details":[],"protocol_summary_fr":null,"evidence_snippet":null,"target_port_label":null,"emulator_service":null,"confidence_reason":null,"classification_reason":null,"classification_reason_label_fr":null,"confidence_factors_fr":null,"payload_preview":null},"events":[{"id":7553982,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33942,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.staging","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022staging\u0022, \u0022http_ua_hash\u0022: \u0022a5e39a4438f42d52da3dcf84cebeb14e8ba1c42f\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002260ad021131c60c7ef0d3077bb512c229f5e99a01\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 275, \u0022payload_entropy\u0022: 5.3567259605875766, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u00220a6896524b08d24a8b3850b6dfeca1bdb6942684\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Mobile\/15E148 Safari\/604.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":275},{"id":7553983,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33948,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/api\/.env","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u0022d5ddd104539bfa72865607edcd6b14ea1f2b8a4b\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00227cf3bcec31d16ad31dcc82b576038776c12d1f9d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 257, \u0022payload_entropy\u0022: 5.380996030665285, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022de2d6e96cbc37b2ef43f5610ad94fbdffdff43e9\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; Pixel 3a) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":257},{"id":7553984,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33882,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.dev","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022dev\u0022, \u0022http_ua_hash\u0022: \u002244a91673920641d9ae6f85de2afbd1db9e2887c6\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00226d43a22facf5bd0b2b7f81b2645be87ea2a8a4a1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 246, \u0022payload_entropy\u0022: 5.4427520977621064, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022e364ae7d73dbe5deaaef6476e0f2aac23ce706fd\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":246},{"id":7553985,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33958,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.prod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022prod\u0022, \u0022http_ua_hash\u0022: \u002208e4a8b80e9d1a46010f8fc07ad2584ec744a301\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022ece1b00dd116de2d5cd1e616b647fb67b7d3b035\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 252, \u0022payload_entropy\u0022: 5.416783360386663, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022c679ee6c04887b80a92313c1275bf890090fc521\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":252},{"id":7553986,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33926,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.backup","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022backup\u0022, \u0022http_ua_hash\u0022: \u0022475f9ece62a7dcdd67805664bfc891d7a6ee6cc5\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022010b38f2c3ba3880210fba1c683062ead6b6ee06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 235, \u0022payload_entropy\u0022: 5.404106459278652, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022d6602ccb10c6840489bd0e2507f45482f2707baf\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows; U; ; en-NZ) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.8.0","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":235},{"id":7553987,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33894,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.8299079804274925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553988,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33876,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.795374596556236, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553989,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33922,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/backend\/.env.old","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022old\u0022, \u0022http_ua_hash\u0022: \u0022d28f34c9dc3699cbe0b8083d687537447e04b9f1\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00221f4d8d4518e413ad6b5a41c5ce61d38167670e32\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 278, \u0022payload_entropy\u0022: 5.44682812167027, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00221761ce1e3e1a0d0b7fb2f1facf596106d9daed4c\u0022, \u0022event_fingerprint\u0022: \u00222ad8f3995dacf75424044b275ef53aedaa72fa91\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 YaBrowser\/19.7.2.455 Yowser\/2.5 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":278},{"id":7553990,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33910,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.851775579189727, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553991,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33890,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.8751970714466015, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553992,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33986,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/backend\/.env.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00221f42b03b6b62cb2f49e51a8b19ca993e00b9d459\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022634ed927b1f303dd63cc0a7dc5f7e8b5a6847ee7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 255, \u0022payload_entropy\u0022: 5.415757342289438, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00221761ce1e3e1a0d0b7fb2f1facf596106d9daed4c\u0022, \u0022event_fingerprint\u0022: \u0022b9de36351afd62baba6d91dca54a57519e5ad5c3\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.1 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":255},{"id":7553993,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":33970,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u0022c69d6213fe5c8767cc9d5ae04aa11af131247976\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00227a997ecf8c7c3ade11101024aba12e58dee560af\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 235, \u0022payload_entropy\u0022: 5.301148523926451, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022f15c9c73c3b4bc3d797b500f211669c032a22643\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Opera\/9.80 (Android 4.0.4; Linux; Opera Mobi\/ADR-1205181138; U; pl) Presto\/2.10.254 Version\/12.00","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":235},{"id":7553994,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34002,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.790555981050749, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553995,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34008,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/app\/.env.old","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022old\u0022, \u0022http_ua_hash\u0022: \u00222deed173bb925d20f21a83da5f9cf73a649295f0\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022ad318b5cc7cc0c1bf7e3b724fbebccf0a8e6ad42\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 236, \u0022payload_entropy\u0022: 5.424240293716699, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00221761ce1e3e1a0d0b7fb2f1facf596106d9daed4c\u0022, \u0022event_fingerprint\u0022: \u00228d1aee584d830816adca96dac86922155c09877d\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":236},{"id":7553996,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34022,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.907126771606713, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553997,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34038,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":27,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/backend\/.env.production","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022production\u0022, \u0022http_ua_hash\u0022: \u0022e76d4f757a9bd2b7b908349144438dc19b9e5bc4\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022f5bb9f02b8945472030d827baea0ca721346631c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 283, \u0022payload_entropy\u0022: 5.393962733433945, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022c432b5e81de4595e679cf0f36857ea52ac3fd4fe\u0022, \u0022event_fingerprint\u0022: \u0022c43716e2168ef68ede68938333fc7352c269cb69\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/80.0.262003652 Mobile\/16G77 Safari\/604.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":283},{"id":7553998,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34054,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.844058397131683, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553999,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34070,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.908844954207966, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7554000,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34082,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.783821083668167, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7554001,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34090,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.770281292275024, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7554002,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34092,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.889711674939335, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7554003,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34094,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.936762354846602, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7554004,"ip":"34.151.221.164","ts":"2026-05-22 23:00:39.000000","proto":"tcp","src_port":34110,"dst_port":8008,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002219e29534fd49dd27d09234e639c4057e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 239, \u0022payload_entropy\u0022: 5.825827992578912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 33, \u0022campaign_key\u0022: \u0022b895b727a16411909b82ac75bb5382d4b97d4e25\u0022, \u0022event_fingerprint\u0022: \u0022fa2e7ed07ebe84900f653297ebd1098313903632\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":239},{"id":7553911,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33212,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":35,"waf_tags":"[\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.qa","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022qa\u0022, \u0022http_ua_hash\u0022: \u0022155396580b69830baa3af59a01886bdf4a2267e1\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022f6ca81fc6b63d491b34b08edc02f7c1a76039985\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 196, \u0022payload_entropy\u0022: 5.182531136739505, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002257c8fafa65186ea47ffb6c373eb6ee74288db788\u0022, \u0022event_fingerprint\u0022: \u0022614ece1541186d296dfd6d0bb88950d430544edb\u0022, \u0022tags_list\u0022: [\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (compatible; Exabot\/3.0;  http:\/\/www.exabot.com\/go\/robot)","http_referer":null,"tags":"[\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":196},{"id":7553912,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33276,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.development.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u0022fa9f21ae8103016c95c2c13a8775bfb86eb3a181\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002244b27fcf42134edd5dc872c2c6f931dc026ceb76\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 246, \u0022payload_entropy\u0022: 5.4311452325095715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002230782e0c27bfa67a7dbf847dd1fac704f838b6d9\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/46.0.2490.86 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":246},{"id":7553913,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33254,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.uat","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022uat\u0022, \u0022http_ua_hash\u0022: \u002245f25f7f3a95d24530c6e937f57dc8e4f758e10e\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002266d1899261b7971a064fb81964052eae4ab44ccb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 254, \u0022payload_entropy\u0022: 5.442957336597923, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022223595ab65e0cb0f63d82bbf3080ba2ee64fb185\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; ONEPLUS A6010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":254},{"id":7553914,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33240,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.demo","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022demo\u0022, \u0022http_ua_hash\u0022: \u0022f4d59fc22830556607cd05b8ab7f1bf7d75d1a56\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022281117a46ffb6dbe77926884a25652c0da93651c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 243, \u0022payload_entropy\u0022: 5.414483941775891, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022f57aa5e54f175da0180f4850ed4f800001510fbc\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.122 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":243},{"id":7553915,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33266,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.template","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022template\u0022, \u0022http_ua_hash\u0022: \u002293c0a2ef61ad2851b9e4d723f606465e2b5838c6\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022edccaea3bbb1eaacbff6973ad5f703ae60c1ddc1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.237365514865893, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002295892da9e4714b2beecea607d8d0dc66cb2d0937\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; U; Linux; i686; en-US; rv:1.6) Gecko Galeon\/1.3.14","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":201},{"id":7553916,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33226,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.production.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u0022291ac3f979f5066206f30bc7e01c8a64a5801463\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022d3f1365c6401e671ba4f40a870e3ce46645aab05\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 261, \u0022payload_entropy\u0022: 5.390315039497067, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022738e3d0c6f03c313eb18a0209ad65d9033b1d852\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit\/540.0 (KHTML, like Gecko) Ubuntu\/10.10 Chrome\/9.1.0.0 Safari\/540.0","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":261},{"id":7553917,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33250,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":14,"waf_tags":"[\u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.preprod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022preprod\u0022, \u0022http_ua_hash\u0022: \u002262e5955585854c43724ee6953fa255f665a91654\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002267166fa60459969a35e979b1c3340b3415271d3a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 215, \u0022payload_entropy\u0022: 5.238052168417821, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00221079c176b533102da50259f9e7a29c93d389dd51\u0022, \u0022event_fingerprint\u0022: \u00220b9a3d7d070f84811e990ceed39055021a99211f\u0022, \u0022tags_list\u0022: [\u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"SonyEricssonK810i\/R1KG Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1","http_referer":null,"tags":"[\u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":8,"bytes_in":215},{"id":7553918,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33258,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.dist","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022dist\u0022, \u0022http_ua_hash\u0022: \u0022dfe6a3c151291f820cc51544e8be83c05cccd03f\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022a8dbdb551defc236b9cece3e75d9b78bd8bedf29\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 250, \u0022payload_entropy\u0022: 5.4057323468934895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002286e940daab341cd54a5fd5a2bb61152e6cbc59e1\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; SM-A730F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":250},{"id":7553919,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33284,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.live","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022live\u0022, \u0022http_ua_hash\u0022: \u0022a413bcd835c724e212abb93349bbf67f2616539a\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00226ac4c96f7567e632cc17c82931a457152d6117b9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 264, \u0022payload_entropy\u0022: 5.420550744424521, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022daba9b510f295f8757af49045f6ee8f194347146\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.19 Safari\/537.36 Edg\/77.0.235.9","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":264},{"id":7553920,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33272,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.pre-production","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022pre-production\u0022, \u0022http_ua_hash\u0022: \u002230debfe1f999186751af2ebc80d855016141ec0b\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022b0266a8b5f23aa7eb0ba5ad4711f86dc278bff09\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 247, \u0022payload_entropy\u0022: 5.3831513893097895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022061b2bf630f4333196b058633dec5f5ebc44fe37\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.86 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":247},{"id":7553921,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33294,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/.env.backup","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022backup\u0022, \u0022http_ua_hash\u0022: \u00223ef54880dbcaffd02c7a64a29e34df8d06aef1c5\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00229dab8234c39ccb9ea2d77d85642de0c301ab4efb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 251, \u0022payload_entropy\u0022: 5.4234564133923415, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002233ebe613694e174ee5386503a7573365b1f1e53f\u0022, \u0022event_fingerprint\u0022: \u00229373a1d9e70949b56e89e6a0abecf19ddc0f772b\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; CrOS aarch64 12239.67.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.102 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":251},{"id":7553922,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33310,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/env.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u002294a27920fca0c05ac57381b71c400e1f0d5a54e0\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022a267c1a6bb1f8e78acd54116556c5ca3263f5088\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 231, \u0022payload_entropy\u0022: 5.435822372792139, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022baba843154a65f579bf44820a68e19657219d4ed\u0022, \u0022event_fingerprint\u0022: \u0022da5d94738574e1e6b84b7289f62d40a83b5cd928\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.125 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":231},{"id":7553923,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33312,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.sample","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022sample\u0022, \u0022http_ua_hash\u0022: \u00222e1990ca5d4156bcff24a980977ac61f5c99af27\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022095847d45b64fa9778f5b417101046355c7fb8b4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 249, \u0022payload_entropy\u0022: 5.35839648409392, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002227e58bc05bf052519610a9266bf01a186d2822be\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/533.17.8 (KHTML, like Gecko) Version\/5.0.1 Safari\/533.17.8","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":249},{"id":7553924,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33326,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.default","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022default\u0022, \u0022http_ua_hash\u0022: \u0022736dbc96c3f0384fd7bd354348194b7b22bb56f2\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022437476297bcc04ccaf487ff217e9f02a35247fa6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 253, \u0022payload_entropy\u0022: 5.414851153586893, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022ac8de695e676159240858fc98c8c9be3090942c6\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; SM-M305F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":253},{"id":7553925,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33342,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env~","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022env~\u0022, \u0022http_ua_hash\u0022: \u00226590f8b215f2c01a697ddc796db16f86f884f897\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00221226c0debb1b75494a73e965e6d8cdcb9b1ead38\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 247, \u0022payload_entropy\u0022: 5.445939776346161, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002286ee5ddb824826f05166b4817283e756d4ceddd6\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; SM-A505FN) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":247},{"id":7553926,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33354,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.test","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022test\u0022, \u0022http_ua_hash\u0022: \u0022ec0716fb0ead280b50f7d9fc8ee4c4827e630f6f\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00224e40a92f813d5ab41a0033a3846a1a977ff1de23\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 247, \u0022payload_entropy\u0022: 5.397673315741125, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u00220bc05a0e5194dfde23f487771be5ac864fa68d89\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Falkon\/3.0.0 Chrome\/65.0.3325.230 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":247},{"id":7553927,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33366,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/env","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002245f25f7f3a95d24530c6e937f57dc8e4f758e10e\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022ebac263a482818b6e7a922df98cc560bbc808a0a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 249, \u0022payload_entropy\u0022: 5.4462644826909905, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022f0707aa3d7347e054883baca77520a0589934a58\u0022, \u0022event_fingerprint\u0022: \u0022bad063601b9a0120f519f1d256b8cbfd79a18df5\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_env\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; ONEPLUS A6010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_env\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":8,"bytes_in":249},{"id":7553928,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33378,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.txt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022txt\u0022, \u0022http_ua_hash\u0022: \u0022c1dca35abf62750a969c82efb87360bb3a3feaef\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022db658cd9f30d14f4f7b89e2ec27457776d31b406\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 295, \u0022payload_entropy\u0022: 5.338085013069143, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022386954a0d25eaf943f717551f93bc507cb9909a8\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"osee2unifiedRelease\/1466 osee2unifiedReleaseVersion\/6.9.1 Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15E148","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":295},{"id":7553929,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33394,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.docker","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022docker\u0022, \u0022http_ua_hash\u0022: \u0022e4861f8679e5155f9842a79480d4310270e3f871\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022fffaa1342f06e8670d7edda0bc9461e93e4a0f1f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 244, \u0022payload_entropy\u0022: 5.393505767966047, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022597510ce28a3bfd78f84e67ef1a92925b1034ada\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":244},{"id":7553930,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33406,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/.env.local.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00223160c2e9878e0fe397da006c34bfeb6f3f44a29f\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002214d941abaa5531ff4222826e2a078089eafb4502\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 257, \u0022payload_entropy\u0022: 5.420071895778916, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00221091073ef2d06cd4dc96f331da85bf80652ff48c\u0022, \u0022event_fingerprint\u0022: \u0022700e90ecffa48b263d0f3ce385be0e0eee0713b4\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":257},{"id":7553931,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33414,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.dev.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u00228f028ac2227cbb13760c75952dc6881aa74db7b4\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002212559bd98a78482d9ce7a35ea95030c5164cc18e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 255, \u0022payload_entropy\u0022: 5.408474082134454, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u002282a56229235d16edae6dfb4c129f143d90f3ffb1\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":255},{"id":7553932,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33420,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.testing","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022testing\u0022, \u0022http_ua_hash\u0022: \u002278b5ce573f8bf720549aba6289877bc57c1ff5e2\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022d6baaf9bbaea83adf628e2291f2046f316df3dcd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 257, \u0022payload_entropy\u0022: 5.395371647289862, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002267e5f627f5080e0020a9ba2ab884534eef988e93\u0022, \u0022event_fingerprint\u0022: \u0022c028536ba6b8f6b45328259ccbe1aaba686bd11b\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 8.1.0; SM-J530F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":257},{"id":7553933,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33434,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":20,"waf_tags":"[\u0022950086:sqli-21\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/env.txt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022txt\u0022, \u0022http_ua_hash\u0022: \u002210fcaecdc5efaa17e47cab72cdb98dc121ed6f5d\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002243063baf0fda73950dd575fa216e503f70ad04be\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 404, \u0022payload_entropy\u0022: 5.578810948128366, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u0022cd14bba60e8e12ee36330f851e8b55f92805f7c6\u0022, \u0022event_fingerprint\u0022: \u002299b950bea03a12648c511936baf8d800b31b8010\u0022, \u0022tags_list\u0022: [\u0022950086:sqli-21\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 9; CLT-AL00 Build\/HUAWEICLT-AL00; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEBID\/9069 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetType\/WIFI Language\/zh_CN","http_referer":null,"tags":"[\u0022950086:sqli-21\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":404},{"id":7553934,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33446,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/.env.prod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022prod\u0022, \u0022http_ua_hash\u0022: \u00227134c7901b2ea39aee875b758a774dec77987ced\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022a0523bde74b7800a5f62604ba67d5973949853e7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 266, \u0022payload_entropy\u0022: 5.419512914116748, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002233ebe613694e174ee5386503a7573365b1f1e53f\u0022, \u0022event_fingerprint\u0022: \u002233b38ec88b03a671ca4ea0a1ddc4dcbb2b5d7959\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G930A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":266},{"id":7553935,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33458,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":15,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.example","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022example\u0022, \u0022http_ua_hash\u0022: \u0022561f018309fdaf39c9271ab4fc29282616b6a63f\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022080963ef62d711207d0e68706f04d0705ec4d7fa\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 156, \u0022payload_entropy\u0022: 5.212138076321016, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u00220d6f5f4728e4137c9e82f9036ecbaac6f8003172\u0022, \u0022event_fingerprint\u0022: \u0022c97eaeb2aa08de0d897560ec961c6b167c0d8770\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/2.02E (Win95; U)","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950514:leak-1\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":8,"bytes_in":156},{"id":7553936,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33470,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/.env.staging","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022staging\u0022, \u0022http_ua_hash\u0022: \u00222d8bcb907bf81985d29ed9ad09c744bea8258b71\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022558189df00dd1f382a665a69aadcd9f4c6685109\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 220, \u0022payload_entropy\u0022: 5.2281359775321485, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002233ebe613694e174ee5386503a7573365b1f1e53f\u0022, \u0022event_fingerprint\u0022: \u0022435e02ddbff9b88f568517519b03fcf93b778aea\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; U; SunOS i86pc; en-US; rv:1.8.1.12) Gecko\/20080303 SeaMonkey\/1.1.8","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":220},{"id":7553937,"ip":"34.151.221.164","ts":"2026-05-22 23:00:38.000000","proto":"tcp","src_port":33478,"dst_port":8008,"service":"http","classification":"web_attack","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/.env.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u00229e309b985c3d5172bc5099e55b13770629bc2cc6\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u0022edb025f9fa0e5ca4830590504e5c719dffe9f0d2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 253, \u0022payload_entropy\u0022: 5.391714257646367, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BR\u0022, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 100, \u0022campaign_key\u0022: \u002233ebe613694e174ee5386503a7573365b1f1e53f\u0022, \u0022event_fingerprint\u0022: \u002206ab463310b01dc58c0f596361e5bb82148cc8db\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3844.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022http_sensitive_path\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":253}],"total_events":398}