34.95.220.234

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "git\/config",
    "http_ua_hash": "e576e94dad83cd52177cb9ef926a3d4095dd883d",
    "http_host_hash": "f67360d9d8752052e6957433375dedea23e1b2f8",
    "http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 229,
    "payload_entropy": 5.333538510181697,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "BR",
    "dst_port": 2375,
    "risk_waf": 88,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 88,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 65,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "4749981ef57d8760e11be435cdfe1b97ae392515",
    "event_fingerprint": "0a7d0964a68c42b2dadb9a73abfcdab45439a472",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "BR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28b5a0abf8f5a3dc2974b5b5cc32be49",
        "payload_hash": "903a890d6c0c94d230c6d1716b2abdc8",
        "path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
    },
    "target_context": {
        "dst_port": 2375,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko)",
    "event_signature": "ebb040d7ce63652296e8169d08ea4bbd93f693be",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_git_exposure",
        "http_probe_git",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.82568887478986,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "BR",
    "dst_port": 2375,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 27,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "df385cf4ae8ae3ec6159ab9257dba924c157ee46",
    "event_fingerprint": "61b01f599e4f6b9f893f04df4a9816393c08e21f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "BR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "0dc72e0a059b49cfd21c49382c8fd352",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 2375,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdC\u0004\ufffd\ufffd&\"\u001aB\ufffddm\ufffd\u001a\r\ufffd\u000f\ufffd\u0127\ufffdP\ufffd>\ufffd\ufffdm\ufffd\ufffdF \ufffd\n5q\u0006\ufffd\ufffdd\ufffd\ufffdj\u0010c\ufffd\ufffd\ufffd,\u001e\ufffd1\u068d\ufffdm[KG\ufffd=\ufffd=\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "40b6a101659456cb25bf0e2ce053ecce08c5469f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 2,
    "behavior_priority": 84
}