|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����wȵwV� �??~qi]��k�d�ۑ0v � ��~EI�qS���] <U 㤡C�eJ &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.760051048203151,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "dacac160e72cf548bcfc8a5c4a55a84d",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\ufffd\ufffdw\u0235wV\ufffd\u001f\ufffd?\u0019?~\u0011\u0018qi]\ufffd\ufffdk\b\ufffdd\ufffd\u06d10v \ufffd \ufffd\u0018\ufffd~EI\ufffdqS\ufffd\u0001\u0019\ufffd\ufffd\u0003]\u001f<U\u0011 \u3921C\ufffde\u0014\u0010J\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "a3bb5cee2c85d3f5e9f59131908405028e6b74ff",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �RB��R�� hÚ>�p�gu�
��M�LQ_0Q W��怅�NЮ�ĊN<���(&���1*h�
��9 &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.856052959822833,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "33bb5ddf605337373e88c4afba626afd",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u0003\u001aB\ufffd\ufffdR\ufffd\ufffd\u001eh\u00da>\ufffdp\ufffdgu\ufffd\n\ufffd\ufffdM\ufffdLQ_0Q \u001fW\ufffd\ufffd\u6005\ufffdN\u042e\ufffd\u010aN<\ufffd\ufffd\ufffd(&\ufffd\ufffd\ufffd1*h\ufffd\n\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "99237ab1a119861ca12e312402465c45f8dcb17f",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �C�AgO�6+.�~ חn��ķ��^��`�˝� ��)@��o{̎ �Һ�JR�{���0�HM� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.911421850981519,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "52b7e90d92189db1373713831630b832",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdAgO\ufffd6+.\ufffd~\u001c\u05d7n\ufffd\ufffd\u0137\ufffd\ufffd^\ufffd\ufffd`\ufffd\u02dd\ufffd\u0014 \ufffd\u0005\ufffd)@\ufffd\ufffdo{\u030e\u001e\ufffd\u04ba\ufffdJR\ufffd\u0004{\ufffd\ufffd\ufffd0\ufffdHM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "f3f343ad9bc531acb137ad03ccdf2a4248ef8d62",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����Ƽ�=K/,�)��z�c-�pD�_4��hw �Q�d?e����ns~$kձ:�&) [-=+�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.820230538734844,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "5e6aeceda2e7544b6b7b008956b2100e",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002\ufffd\ufffd\u0018\ufffd\u000e\u01bc\ufffd=K\/,\ufffd)\ufffd\ufffdz\ufffdc-\ufffdpD\ufffd_4\ufffd\ufffdhw \ufffdQ\ufffdd\u0005?e\ufffd\ufffd\ufffd\ufffdns~$k\u0013\u0571:\ufffd&)\u0000[\u0011-=+\ufffd\u0011\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "263dc8a6da96aa5cb909ec0e888c576888699fb0",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � DS���Z�J���]z��˶����R� 9�� 0VA j����'(��N�&�X��al���} &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.833221198530083,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "feeb2772a458f412c07711614d41dacb",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001cDS\ufffd\ufffd\ufffdZ\u0010\ufffdJ\ufffd\ufffd\u0011\ufffd]z\ufffd\ufffd\u02f6\ufffd\ufffd\ufffd\ufffdR\ufffd\u0015\u000b9\ufffd\ufffd 0VA\u001fj\ufffd\ufffd\u0014\ufffd\u0014\ufffd'(\ufffd\ufffd\u0016N\u0004\b\ufffd&\ufffdX\ufffd\ufffdal\ufffd\ufffd\ufffd}\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "7268f61d32cc013adeaf916e8912f1a6b28b55e0",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �^���ʕ!�� ${k"ߐ�h����tq^��� ^h �4z�X�;����f�)|��mHi��P &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.808873994481651,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "d94387774189319c75c0bc86e9ecdc31",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^\u0002\ufffd\ufffd\ufffd\u0295!\ufffd\ufffd\t${k\"\u07d0\ufffdh\ufffd\u0007\ufffd\ufffd\ufffdtq\u0017\u0002^\ufffd\ufffd\ufffd ^h\u001d\ufffd4z\ufffdX\ufffd\u037e\ufffd\ufffd\ufffd\ufffd\u0002f\ufffd)\u0016|\u0002\ufffd\ufffdmHi\ufffd\ufffd\u000eP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "997a49c75adc4b40239a89242deb63009924b8d6",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �L�,���&����晙cAu�B�5@ _�V� /��� p��G����U�����K�]h�A �F� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.85572442365727,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "97df5ae558504685bad7ffe4b6d3c1c9",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003L\ufffd,\ufffd\u0011\ufffd\ufffd&\ufffd\u0001\u0015\ufffd\ufffd\ufffd\u6659\u0018cAu\ufffdB\u000f\ufffd5@\u001e_\ufffdV\ufffd \/\ufffd\ufffd\ufffd\u001cp\ufffd\ufffdG\ufffd\ufffd\ufffd\u0002\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffd]h\ufffdA\u001e\ufffdF\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "7143c0e294a8c9d2139d7dd704f681324518ec93",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �K�h��n�6_�3���� �R�!%2��]r�|. ��I�d?W<�pr�'��e��z }�*Z�iLx &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8378936470739,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "f29204541ecc44b7a407399af73b555d",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003K\ufffdh\ufffd\ufffdn\ufffd6_\ufffd3\ufffd\ufffd\ufffd\ufffd\u0012 \ufffd\u0006R\ufffd!%2\u0010\ufffd\ufffd]r\ufffd|. \ufffd\u001a\ufffdI\ufffdd?W\u0012<\ufffdpr\u0004\ufffd'\ufffd\ufffde\ufffd\ufffdz\u001e}\ufffd*Z\ufffdiL\u0004x\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "ce0cbd59bffa8a44720b5e85298e8ae6365231fc",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �(�ݷ�S:��_3�
���-���&.��c�*��� �D4'�So�Q<p��G����� L<j�* c &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8816222034687335,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "3aba426af2bc8fb916d6583e8159c4f6",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001b(\ufffd\u0777\ufffdS:\ufffd\ufffd_3\ufffd\n\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd&.\ufffd\ufffd\u0005c\ufffd*\ufffd\ufffd\ufffd \u0015\ufffdD4'\ufffdS\u000eo\ufffdQ<\u0013p\ufffd\u0014\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u001cL<j\ufffd*\u001dc\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "b0ba205ad643b9e2c5f71000336ea27cb1ae2efd",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���Ŕ�
md�� �~���̀:n| 4�w� �#��h��l�#��V�� ��3c�$(PW��R$ &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.841306420944047,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "38842a989285dd8e63934a433eeaea53",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0154\u000f\ufffd\nmd\ufffd\u000e\ufffd\u0019\f\u0004\ufffd~\ufffd\ufffd\ufffd\u0340:n\u0007|\u0007\u000b4\ufffdw\ufffd \ufffd#\ufffd\ufffdh\ufffd\ufffdl\ufffd#\u001a\ufffd\ufffdV\u0007\ufffd\ufffd\t\ufffd\ufffd3c\ufffd$(PW\ufffd\ufffdR$\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "50a4709215ca4c34e367cc57d8357730105f26fd",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���We�6�=(e�3IH��M)ڴ,B
9 `N JqLn�yXT�N��R� �I2 �芠!0@���x &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.900070204445129,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "8db2759f229a3e6740a2c729b42e91f9",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdWe\ufffd6\u0011\ufffd=(e\ufffd3IH\ufffd\ufffdM)\u06b4,B\u001c\n\r\u001e9\t`N JqLn\ufffdyXT\ufffdN\ufffd\ufffdR\ufffd\u001e\ufffdI2\u0000\ufffd\u82a0!0\u0017@\ufffd\ufffd\ufffdx\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "89ca082e0e17a8ade5b1da55902b7362eaff48b1",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� s�准�)i��������n�,i> , ��6 i3�H�����V���a ���
�6��`g &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.810318345433492,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "2f9a275a34d46b1a5639bf0d2572674c",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001ds\ufffd\u51c6\ufffd)i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\u0001,i>\u001d,\u0000\ufffd\ufffd6 i3\ufffdH\ufffd\ufffd\ufffd\ufffd\u0011\ufffdV\ufffd\ufffd\u001b\ufffda\u0013\u001f\ufffd\ufffd\u0018\ufffd\r\u0015\ufffd6\ufffd\ufffd`g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "9f2045bd90af2c4d01ab2ff47d49eba5ede107ab",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N}����(��[���B&[�Hw��t�T Xd� ���E\=�)I8 #�ԋm��x�>���� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8301011819865245,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "34b4a28c18caa941a51e3516a1f77fac",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N}\ufffd\ufffd\u0015\ufffd\u0005\ufffd(\ufffd\ufffd[\ufffd\ufffd\ufffdB&[\ufffdHw\ufffd\ufffdt\ufffdT\t\u001eXd\ufffd \ufffd\ufffd\ufffdE\\\u0001\u0001=\ufffd)\u0011I8\u000b#\ufffd\u050bm\ufffd\ufffdx\ufffd>\u0003\ufffd\u000e\ufffd\u0019\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "e30ebf6d7c3f181f00d6e498c67c4466d7a9ba0c",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9�Xv]]�R�w-��m8^� �鰺`x�
�!U] _C#�Wd�ޓ�^��������8��0$QlJ�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.823552845033332,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "392a244b7a81022e6eb27e28dd787b16",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdXv]]\u0019\u001b\ufffdR\ufffdw-\ufffd\ufffdm8^\ufffd\u001d\ufffd\u9c3a`x\ufffd\n\ufffd!U] _C#\ufffdW\u0019d\ufffd\u0793\ufffd^\ufffd\ufffd\ufffd\u0018\ufffd\u0013\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd0$QlJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "266f880c57cd4dbc47116de5f881dfc7014172b3",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��mU�!3)�@͆b��;K��vut��/% f1 Sz���v~����%�o��}�9�ȣB�z/[��� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.852322948016372,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "152f64d603a56fb2d9c83f6c2ee8d526",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmU\ufffd!3\u0015)\u0013\ufffd@\u0346b\ufffd\ufffd;K\ufffd\ufffdvut\ufffd\ufffd\/%\tf1 S\u0006z\ufffd\ufffd\ufffdv~\ufffd\ufffd\ufffd\ufffd%\ufffdo\ufffd\ufffd}\ufffd9\ufffd\u0223B\ufffdz\/\u0005[\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "a5a026b0f211f20881b17d750248bb8c72d55fd6",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��@l99��V>^�!��=]��2G�\���<M� {BK$����N7T/�d�|z@�x�& �z�� � &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.7802713155507774,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "cdd8071ecb5744973fb0196cc656d596",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd@l99\u0006\ufffd\ufffdV>\b^\ufffd!\ufffd\ufffd=]\ufffd\ufffd\u00142G\ufffd\\\ufffd\ufffd\ufffd<M\ufffd {BK$\ufffd\ufffd\ufffd\ufffdN7T\/\b\ufffdd\ufffd|z\u0007@\ufffdx\ufffd& \ufffdz\ufffd\ufffd\u001e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "c1f670bae6fc12d20441888c93f3ca22533e0da9",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5+Y� �!�F� �d H61bM�G~ܼZ��� 3�5��f�A��&kQ�)ߨ��@s�Ϭ�(I��o� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.891702003608309,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "c5bf5363d2bebda7224b4a896bda6f2b",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035+\u0016Y\ufffd\u001c\ufffd!\ufffdF\ufffd\u0000\ufffdd\u001fH61bM\u0006\ufffdG~\u073cZ\ufffd\ufffd\ufffd 3\ufffd5\ufffd\ufffdf\ufffdA\ufffd\ufffd&kQ\ufffd)\u07e8\ufffd\ufffd@s\ufffd\u03ec\ufffd\u0017(I\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "ba7530f5e5bf10faa901160df393db054880ec78",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �n��3Եh�"���Y���פ��T\��u�� ���F�tÿL�ݰ�*.��CKB"�P7�f^f &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8430901404165905,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "4f87153a21667c71cafc479ea4f36828",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003n\ufffd\ufffd3\u0535h\ufffd\u0011\"\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\u05e4\b\ufffd\ufffdT\\\u0010\ufffd\u0011\ufffdu\ufffd\ufffd\u001f \ufffd\ufffd\ufffdF\ufffdt\u00ff\u0014L\ufffd\u0770\ufffd*.\ufffd\ufffdCKB\"\ufffd\u001aP7\ufffdf^\u0011f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "418e475d6fdde6ffede1636996af2dfcf85bf614",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �q VA�uϒi���a$�
� ���x
8] �.����ݚW�üȋݯ1����� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.788464619759566,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "69c334ed91615cf80ac6a2cf7616a03b",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003q \u0014VA\b\ufffdu\u03d2i\u0007\u0002\ufffd\ufffd\u0019\ufffda$\ufffd\u001e\r\ufffd\f\ufffd\ufffd\ufffdx\n8\u0014] \ufffd.\ufffd\u0014\ua8c9\ufffd\u0018\ufffd\ufffd\u075aW\ufffd\u00fc\u020b\u076f1\u0013\ufffd\ufffd\ud995\udc89\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "bf78ccfc414677581ccc762c63ab47e5f5827108",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���J�ێ��/����]/���ʞX��j�� �y�:X���S�9#��h��*�u�n�0��?� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.7935958168481605,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "ae78744e00d6c0058fc345ceefad505c",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\u001a\ufffd\u06ce\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\u0007]\/\u001b\ufffd\ufffd\ufffd\u029eX\ufffd\ufffdj\b\ufffd\ufffd \u0005\ufffdy\ufffd\u0001:X\ufffd\ufffd\ufffd\u0010S\u0012\ufffd9#\ufffd\ufffdh\ufffd\ufffd*\ufffdu\ufffdn\ufffd0\ufffd\ufffd?\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "6cecdedbb0a3766c9ae58810bd0196c0de08664b",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��2 ��p��~�u�+�*�������G�p�Z ��w ^�P��M��g�A�֫�?M�[�b\'�H &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8412753570358245,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "653f3b890c6e75c7e73e32a5c6a0c27e",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd2\u0000\ufffd\ufffdp\ufffd\ufffd~\ufffdu\u0011\u0004\ufffd+\ufffd*\ufffd\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffdG\ufffdp\ufffdZ \ufffd\ufffdw\f^\ufffdP\ufffd\ufffdM\ufffd\ufffdg\ufffdA\ufffd\u0002\u05ab\ufffd?M\ufffd[\ufffdb\\'\u0003\ufffd\u0017H\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "28933a6d8897ae849897fc6053081cdd1cec9dca",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��#�T���#h�LQ4}n��P�b�Z[�P� �] �f�{NP5�f�L3
�@�W����O/�S� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8098847682062775,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "c4f4d56754a7a7281ba48aeb7b680f7b",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd#\u0018\ufffdT\u0005\ufffd\ufffd\ufffd#h\ufffdLQ4}n\ufffd\ufffdP\ufffdb\ufffdZ[\ufffdP\ufffd\f\u0017 \ufffd]\u001c\ufffdf\ufffd\u0013{NP5\ufffdf\ufffdL3\r\ufffd@\ufffdW\ufffd\u0004\ufffd\ufffd\ufffdO\/\ufffdS\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "c3186a294d3c86a9a89f0ee533a02538c5cebbcf",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �|
�@Hۯ h��yy�����0�i [� ��Ǡ�P �^�}��0A"��1�tqw
��k�ܚ�Cx���t &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8285261535277595,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "99debbb3dd294e16daa68182cc3a7f62",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003|\r\ufffd@\u0017H\u06ef\u001fh\ufffd\ufffdyy\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffdi\u000b[\ufffd\u000b\ufffd\ufffd\u01e0\ufffdP \ufffd^\ufffd}\ufffd\ufffd0A\"\ufffd\u0014\ufffd1\u0011\ufffdtqw\n\ufffd\ufffdk\ufffd\u071a\ufffdCx\ufffd\ufffd\ufffdt\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "75a0643b7c6f671cbf39f402b4f0c6ad61f3dfee",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
flood
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
77%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �3�
��K� :������|��L7�D�J��. �o�;OVwVD�̪Hj�Jyb�� Sp�p&�*�O� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.813268179533365,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 31,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
"event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "78c92299a6e127d3aee59dd4f665583e",
"path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u00063\ufffd\r\ufffd\u0011\ufffdK\ufffd\u000b:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\u0017L7\ufffdD\ufffdJ\ufffd\ufffd. \ufffdo\ufffd;OVwVD\ufffd\u032aHj\ufffdJyb\ufffd\ufffd\tSp\ufffdp&\ufffd*\ufffdO\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "9598f46faa48094eb5929c1c472ed246f9850255",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/.env.bak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/app/.env.bak
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
950521:leak-8
Payload (extrait)
GET /app/.env.bak HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build/FROYO)
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "bak",
"http_ua_hash": "0d85256004bcb3aa2b5a1bdece2c306f62e3c724",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "675fe9576f3ec7add08a15dd0c540b55e5bbfdec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 267,
"payload_entropy": 5.436756882745605,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "fe9fbcba95829051efb9f92cc9682d356d17858a",
"event_fingerprint": "357e44aa3186426bd1765dcac8faf4c97f00a115",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "22dcfeda21558fbd8862672da82f977b",
"payload_hash": "39ffad1af3eabcda5d54abec75e35242",
"path_pattern_hash": "a68a9dfeaee6097716a18c2b9f43c5f9"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/app\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build\/FROYO)",
"event_signature": "a2590f5c75a07b63caabe34f53ea7fe0f340ab0b",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/.env.staging
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/app/.env.staging
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.0.0; MI 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /app/.env.staging HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; MI 6) AppleWebKit/537.36 (
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "staging",
"http_ua_hash": "8486665fda73568386afefcf10cb6585c65a1f49",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "e84f59fbbec8a04fdfc3078fbdf0ae4fd69640c6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.381765948252125,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "7c78404831465503d11e4b857092fa571752cf82",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0253c09becda317c35b5c26238e8ea36",
"payload_hash": "b4d4d7e54e60da5e97515b633f175d22",
"path_pattern_hash": "5a281530de78ccf813317373171371c8"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/app\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; MI 6) AppleWebKit\/537.36 (",
"event_signature": "37058fe1e6d5af7966b6faad06c986c465dd9300",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/.env.dev
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/app/.env.dev
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /app/.env.dev HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "dev",
"http_ua_hash": "b6a7a69b45a7e7961442aa0a97444cc4275f6e70",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "df5aa2d688155147d78025f13efee7d00a0eafd8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.428911309146431,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "b924ce97f404a57e9374b2d1b18125f9759bcf8c",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4e0585da2d37ca0c9d49fc1ac12b14ea",
"payload_hash": "f04e5234fbf8cc500b28ce8eb2665c5d",
"path_pattern_hash": "80cfd304d2c6517de5f460ebde85ca3d"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/app\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"event_signature": "87224c35acd4c2b117bcd10b7bc39dd48b0fdf76",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.prod
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.prod
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.19 Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /backend/.env.prod HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "prod",
"http_ua_hash": "8343728e09cc5534aa355662af176824290e16ba",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "ece1b00dd116de2d5cd1e616b647fb67b7d3b035",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 251,
"payload_entropy": 5.430609454677779,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "31bda39281738ccc37d8329b94e7484e3ac73130",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d5b435b8abdaa4272f37db8d3f41393b",
"payload_hash": "bcf69a20cf87424905ec5a4852d95ae1",
"path_pattern_hash": "06b37c283e0032a53442bbe10821cfeb"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"event_signature": "ed8472caec87e70a8e030fe2bd10f2e1eb83ebcc",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/backend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/app/backend/.env
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5X Build/MDB08L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Mobile Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /app/backend/.env HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5X Build/MDB08L) Apple
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "30d8bab965e2ae46e6d5e5c397287f4a1f605ccb",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "97ef8b86f35b56a86d5dbe6549b6162a1d5ef49e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 272,
"payload_entropy": 5.4682994356525825,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "4444517b1daf05daea1b705e3bcc0d746a772415",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "18bd3a7e3b302e61dbfd9090dd2b53dd",
"payload_hash": "2755b458ed730deaf3cde5ff46ff4564",
"path_pattern_hash": "288b39c98eb1f440a224c00537d9552f"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/app\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; Nexus 5X Build\/MDB08L) Apple",
"event_signature": "ca9e330f7365dc1f65ac2e77fd251d5bad1ce2c6",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.old
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.old
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
950521:leak-8
Payload (extrait)
GET /backend/.env.old HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "old",
"http_ua_hash": "a66eebec745c873326bfb84c6d21f4ec9fe16522",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "1f4d8d4518e413ad6b5a41c5ce61d38167670e32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.379024304949395,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "fe9fbcba95829051efb9f92cc9682d356d17858a",
"event_fingerprint": "fe727e793aa9ac3a3c0637f001983138ee5a0fda",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6a01aa0f8090c60b7b474dbbcfd3464a",
"payload_hash": "93a8d5c74c99f52a4b37907e0364c49b",
"path_pattern_hash": "253500a6a15b8bd3c8b0f4dfe71121e2"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit\/604",
"event_signature": "d771c0775c575b218dbcee7cd8e8ca8845afdf16",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.dev
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.dev
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; en-US; rv:2.0b2pre) Gecko/20100712 Minefield/4.0b2pre
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /backend/.env.dev HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; en-US; rv:2.0b2pre) Gecko/201
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "dev",
"http_ua_hash": "ec27f3b1f914c0e8e35ffe2042c05e8cd5130f2a",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "6d43a22facf5bd0b2b7f81b2645be87ea2a8a4a1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 221,
"payload_entropy": 5.352934270358111,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "838830d6f250d3255832c2b815aaea32ed9ef33a",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "96c9eb73f4fda8b88fa6bd82667bca01",
"payload_hash": "df01fa51bf8aba0ee6e95aca7ebc33bf",
"path_pattern_hash": "361efd67c8cb82623bb332a9d4f55268"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; en-US; rv:2.0b2pre) Gecko\/201",
"event_signature": "ceeec1f9320f3d6b40009cdd444f83c8834cb1e3",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/frontend/.env.local
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; LM-V405) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /frontend/.env.local HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; Android 9; LM-V405) AppleWebKit/537.36
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "fc9781c975d92c72d7fbdb574659c43840811169",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "7437aaaafc9e223d971228fe59fdee61b9d620d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.415099023283263,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "7be686139f7a0549308b8542915516be05f0e77f",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b1203e067229de427efedba4a41e9c2d",
"payload_hash": "1d909f71b68a39ab531a210f8bfafafe",
"path_pattern_hash": "d7ae154bfa816b480978a2899fe639ce"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-V405) AppleWebKit\/537.36",
"event_signature": "d8cdcaf6304a19d3f401f59a6390d4c27959f7f8",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.production
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.production
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /backend/.env.production HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebK
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "bd0900aa2772f5fa2f57c0b9941249432ac41c80",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "f5bb9f02b8945472030d827baea0ca721346631c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.415302838521561,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "4919ef923b524f88420e133cf00cb10ad33b99cd",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ef9094703e4392745c199301e0442435",
"payload_hash": "ae4781088b230d0edf864da14d30e123",
"path_pattern_hash": "36d1a8d01ff9d9e501d856bd9686d325"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Redmi 4X) AppleWebK",
"event_signature": "f13bb6a7991cc8a56d72f81776b93189cf376e45",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/api/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/app/api/.env
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 630) like Gecko
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /app/api/.env HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/7.0; Touch; rv:11.0;
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "8c32d04d9f70ec5117f801e0a276d06dd05dc6ea",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "a26af0cb127afb7f53aace7ab18a175b4d8a51bd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 241,
"payload_entropy": 5.362450722142697,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "223dcac974d615633de2cc97406d3933b360a0ec",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "58530c49dfeebde0dd3f1821d569b478",
"payload_hash": "fba1eed334afe6f21f2d3fb01fae95f1",
"path_pattern_hash": "9328998b0872bf59d928235746a301f6"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/app\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows Phone 8.1; ARM; Trident\/7.0; Touch; rv:11.0;",
"event_signature": "dd470c55d6b0807235bca81465b5de59b21681e6",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Critique · 88
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Bloquer (recommandé)
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/frontend/.env
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb/3.5
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /frontend/.env HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb/3.5
Acc
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "f3f687c43c84055959ed3c9c679d5919ea097c92",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "77987435bb3ae079ceddf1be0ca83f10bd79e60f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 192,
"payload_entropy": 5.310863610986861,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 88,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "b888e97894d6c0f6f543f5465bc73651cb855152",
"event_fingerprint": "8892417da80a915c906b1e2f12264dc10a38e3b7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8c8a98262897cefb744b7a5b8f9999a2",
"payload_hash": "3dfce3157bc69ae3719381835b11d392",
"path_pattern_hash": "2eb92b74c9200f7bfafce81d1b6d362c"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "block",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb\/3.5\r\nAcc",
"event_signature": "ac2aef0f8a39a3e247da98644c312e8d1dd941b6",
"ban_policy": "advisory_block",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_metasploit_ua",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.backup
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.backup
Confiance classification
98%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.310.0 Safari/532.9
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /backend/.env.backup HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKi
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "df5e6af17ab64ffe149b257d7b2e35d75a020458",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "010b38f2c3ba3880210fba1c683062ead6b6ee06",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.409653948601173,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "91dea59a42a96c479930d84f29b73833b0ffae78",
"event_fingerprint": "c8543ef6596de73952e0b094169e94cb89a2e9c6",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d36b7d6765d67135068c163a5b34f235",
"payload_hash": "bebf9808610cfbb67a3db1e2a7d4745b",
"path_pattern_hash": "d21da08f9b6364ea0d2550ff45214b03"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.98,
"classification_confidence": 0.98,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKi",
"event_signature": "d2253eb540a324aa8cb56c8f10f7f1dd26497f5a",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.bak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/backend/.env.bak
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3947.100 Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
950521:leak-8
Payload (extrait)
GET /backend/.env.bak HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "bak",
"http_ua_hash": "592d941ab35990a767abedd3f5d5a36f7488c908",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "634ed927b1f303dd63cc0a7dc5f7e8b5a6847ee7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.442457696720223,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "fe9fbcba95829051efb9f92cc9682d356d17858a",
"event_fingerprint": "09159719ef52b2473c3c322f2a01482e21b2a83c",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7be7045c484139edb587d31ba0fbdbff",
"payload_hash": "30d34fd4943ad292f09a1ef6134a957c",
"path_pattern_hash": "6679bce94c041ed02cf99c5001176812"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML",
"event_signature": "0bcb34a45e148c06045208e8bc10cfc43b836e9c",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_sensitive_path
Cible HTTP
GET
/.env.orig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/.env.orig
Confiance classification
92%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Règles WAF
950326:rce-0
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /.env.orig HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Fi
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "orig",
"http_ua_hash": "de7ae3d01370a40b6ce3154d68446553e65f8441",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "a5360e8b4c24130ce7b83ff2db501eac1df0996e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.270377621890899,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 92,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 92,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "224aabadd530722b08ffe0d0fc6be31936dfbf64",
"event_fingerprint": "cb05612d6ce0723f4081ced2be115528f72cf666",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7786eb1e38ed3569c8d6f2bc27ee566e",
"payload_hash": "cd5716cfd7e57a53c096a23d04fea066",
"path_pattern_hash": "74a5485724e3b49c70feec62176e92c9"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.92,
"classification_confidence": 0.92,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Fi",
"event_signature": "8fa6b241c4c7ce92c102a126aaec873691ad7210",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N�; kÓj�.6b)����⏗mH�c��Y� � >At!��x�dG�3����'sK�� �.R�B] &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.907458850337603,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "8affc9777caa2ac5610409063da45a0a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffd;\u001ek\u00d3j\ufffd.6b)\ufffd\ufffd\ufffd\ufffd\u23d7mH\ufffdc\ufffd\ufffdY\u0017\ufffd \ufffd >At!\ufffd\ufffdx\ufffddG\ufffd3\ufffd\ufffd\ufffd\ufffd'sK\ufffd\ufffd\u001e\ufffd.\u0012\u0014R\ufffdB]\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "db3da8f197352f3b82abf09eb8fe2668cc192ab5",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �PG�Ō�0��b��v�^�8��I�- 4q��(cZ b�$�|�3��������j�I��"� �<�/)�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.790237041002859,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "3a03967d8ef03dbd153004e6902e44d7",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003PG\ufffd\u014c\ufffd0\ufffd\ufffdb\ufffd\ufffdv\ufffd\u0004^\ufffd8\ufffd\u0007\ufffdI\ufffd- 4q\ufffd\ufffd(cZ b\ufffd$\ufffd|\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdj\ufffdI\ufffd\ufffd\"\ufffd\u001d\ufffd\u000e<\ufffd\/\u0005)\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "8de270811ee12e662aba86843bd8079b0fc60cbc",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����n2!\�O=���%�ѩ'lݍ���E�}��" �as���4� �� L[�� �5Tqf z�y�F &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.91790268239366,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "a68421758d1bdb15757c2456151beda2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdn2!\\\ufffdO=\ufffd\ufffd\ufffd%\ufffd\u0469'l\u074d\ufffd\ufffd\ufffd\u001bE\ufffd}\ufffd\ufffd\" \ufffdas\ufffd\ufffd\ufffd4\ufffd \ufffd\ufffd\u001cL[\ufffd\ufffd\u001c\ufffd5\u0017Tqf\u0007\u001ez\u0018\ufffdy\ufffdF\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "8d68143b7cf96998ae5cbd0785d59975d6eb1e46",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
15
Recommandation
Investiguer
Tags
950326:rce-0
950514:leak-1
http_sensitive_path
Cible HTTP
GET
/.env~
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/.env~
Confiance classification
89%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)
Règles WAF
950326:rce-0
950514:leak-1
Payload (extrait)
GET /.env~ HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)
Accept-Charset: utf-
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env~",
"http_ua_hash": "eb821319645d3730ad2ac9a0bd8bb8c6e7468b3c",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "1226c0debb1b75494a73e965e6d8cdcb9b1ead38",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 175,
"payload_entropy": 5.315310823536481,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 68,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 68,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 51,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ae1ce00f729a0b746ac42f8e29bd3ef33836a331",
"event_fingerprint": "13b0fbbaf26a63a6f59eea94f357fda8b500855a",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fbb99fc5cecdb6fc6a6e8e28468accb0",
"payload_hash": "d6f1e029b6ab294814ae5f828945745c",
"path_pattern_hash": "cf5f67b633918a8bfbe3f2b4d6e8e9e1"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.89,
"classification_confidence": 0.89,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.env~ HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)\r\nAccept-Charset: utf-",
"event_signature": "14803df60719f7e0ffea1940ea3e85250507ef3f",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950514:leak-1",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��܍q!_m���Mk:Ts��#��$���+� _Bʺ���κ� �2� � ���� q�xӋ� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.76920537716836,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "3abc6b42fc575e7b249d5593eb9798c7",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014\u070dq!_m\ufffd\ufffd\u0003\ufffd\u000eMk:Ts\ufffd\ufffd\u0005\u0019#\ufffd\ufffd$\ufffd\u0002\ufffd\ufffd+\ufffd \u0017\b_B\u02ba\ufffd\ufffd\ufffd\u03ba\ufffd \ufffd2\ufffd\u001e\ufffd \ufffd\ufffd\ufffd\ufffd\u001dq\ufffdx\u04cb\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "22482e4c1e3b6b094ff569eb6e33328924f930b8",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_sensitive_path
Cible HTTP
GET
/.env.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/.env.txt
Confiance classification
92%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.1-update1; de-de; HTC Desire 1.19.161.5 Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17
Règles WAF
950326:rce-0
950470:nosqli-3
950514:leak-1
Payload (extrait)
GET /.env.txt HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Linux; U; Android 2.1-update1; de-de; HTC Desire 1.19.16
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "be677b74890f886d91f28fb41c47661ddaded0c9",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "db658cd9f30d14f4f7b89e2ec27457776d31b406",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 285,
"payload_entropy": 5.4047604833533205,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 92,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 92,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "224aabadd530722b08ffe0d0fc6be31936dfbf64",
"event_fingerprint": "e1f03f954a5ebf971a32bd8d7022751e34d83367",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e4d52e8d5e4db608f81216e2284ea627",
"payload_hash": "1bd693e74ca2947a14393847c44e1735",
"path_pattern_hash": "bcf9f4a0a512e549570ca7fb20cc5789"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.92,
"classification_confidence": 0.92,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.1-update1; de-de; HTC Desire 1.19.16",
"event_signature": "69d45aa2dfe3ec970b14622ea98071b8beeaa0b4",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����
�K�@/�rM0VF��iW*� �w��>�� H�IONF�Ԛ��A�$�<@h��^�h^ɰ{ &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.805740104849777,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "025ad2aef4974dfbd12271e2ac38a34e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\ufffdK\ufffd@\/\ufffd\u0001rM0VF\ufffd\ufffdiW*\ufffd\u001d\ufffdw\ufffd\ufffd>\ufffd\u000f\u0003\ufffd H\ufffdIONF\u0007\ufffd\u051a\ufffd\ufffdA\ufffd$\ufffd<@h\ufffd\u0015\u0010\ufffd^\ufffdh^\u001a\u001b\u0270{\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "ac171bee8445f6e4c56d131135f6140dd322347e",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
http
|
web attack
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_probe_env
Cible HTTP
GET
/env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8443
Chemin / cible
/env
Confiance classification
89%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Règles WAF
950326:rce-0
950470:nosqli-3
Payload (extrait)
GET /env HTTP/1.1
Host: 62.3.50.33:8443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML,
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "5e16024cc7aec3aba85419db480e721ae62e7777",
"http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
"http_target_hash": "ebac263a482818b6e7a922df98cc560bbc808a0a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 243,
"payload_entropy": 5.4163916073081015,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "105eaf35a018d21a1c9becd5a0a5c12f97b3041e",
"event_fingerprint": "4b2c6f30f986007d38f1fa99528d3a4e2ffcf0ec",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1cc534a305a9370d1d82190c9318c6c8",
"payload_hash": "e8e14489d8deb38365c442b34c12defc",
"path_pattern_hash": "1a3ee8c5f071bd935c8a12206727587a"
},
"target_context": {
"dst_port": 8443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.89,
"classification_confidence": 0.89,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/env HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit\/537.36 (KHTML, ",
"event_signature": "3ef3789f4b014acd6d59c84743a9fa52e743852e",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_probe_env"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����� JrL-��Gy�V���Y�f 䎡
�c �Emm��A�JW�����<���T��X��k &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.836809051814317,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "a748ad595db427d73e0466b7a3a5dc70",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\f\bJrL-\ufffd\ufffdGy\ufffdV\ufffd\ufffd\ufffdY\ufffdf \u43a1\u0013\r\u001c\ufffdc \ufffd\u0017Emm\ufffd\ufffdA\ufffdJ\u0014W\ufffd\ufffd\ufffd\u0007\ufffd\u0018\u0014\ufffd<\ufffd\ufffd\ufffdT\ufffd\ufffdX\u0017\ufffd\ufffdk\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "323f09a58a8c07d3476889c8ca5b61d6e3e7e644",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �^ٻ��6z`��� �`��^:Q� �a�:
N� (:[��5��1X�tu�)�e�#GN���z�j6 &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.810949780572944,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "a98c109953a55d4dd17c5c018983558e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^\u067b\ufffd\ufffd6z`\ufffd\ufffd\ufffd\f\ufffd`\u0006\u0007\ufffd\ufffd^:Q\ufffd\u0015\u000b\ufffda\u0013\ufffd:\rN\ufffd (:\u0014[\ufffd\ufffd5\ufffd\ufffd1X\ufffdtu\ufffd)\ufffde\ufffd#GN\u0003\ufffd\ufffd\ufffdz\ufffdj6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "566fdc77ac718302a5bf646eb453507f05613b05",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �l$Dz�����5���7 м��{�Ąa�O �ߕ�5�'��5b I1���K��$�&oZn�u &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.824902987278664,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "6534398c4b4e108cec61f9da01620347",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l$Dz\ufffd\ufffd\u0003\ufffd\u0010\ufffd\ufffd\u00195\ufffd\ufffd\u0017\ufffd\u00027\u001f\u043c\ufffd\ufffd{\ufffd\u0104a\ufffdO \ufffd\u07d5\ufffd5\ufffd'\ufffd\ufffd5\u0015b\u001dI1\ufffd\ufffd\ufffd\u0006K\ufffd\ufffd\u0005$\ufffd&oZn\ufffdu\u001b\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "b5d23c79912543240a40f901d6cf2ad08b074c24",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 26
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/�U�������> ���C���$&��z�%�� �kB5w\�cQ6ܞ�z�rA|�<[r�rߜF��� &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.854466450348765,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 26,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c",
"event_fingerprint": "d15ebe485b7a9865ce7ae63ec0cbd707e596ada7",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "996fe27861bf94d09334d9b44c2366b1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 8443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\/\ufffdU\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>\u001d\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd$&\ufffd\u0005\ufffdz\ufffd%\ufffd\ufffd \ufffdkB5w\\\ufffdc\u0010Q6\u071e\ufffdz\ufffdrA|\ufffd<[r\ufffdr\u07dcF\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "728c803eea56f148844b1bb5dfc8f45d21537af9",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|