04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.old
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/backend/.env.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.old HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /backend/.env.old HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537
Requête brute (extrait)
GET /backend/.env.old HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "old",
"http_ua_hash": "d0888983d2fda197b7ae047f711fe508806b5f56",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "1f4d8d4518e413ad6b5a41c5ce61d38167670e32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.4318623444315435,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "11770b663ddcbc64ccd759f182e5625d28c841f4",
"event_fingerprint": "88276a70a032605730ab540dadb6e65de5974313",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "20682c07def9a4654f03af9c2b69850e",
"payload_hash": "ba792102eb570a3a13536f31709c0b23",
"path_pattern_hash": "253500a6a15b8bd3c8b0f4dfe71121e2"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537",
"method": "GET",
"path": "\/backend\/.env.old",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"request_sample": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.old",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"request_sample": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b9c6e04fa75c974ac4ea7a89a30245d7cb4d66e4",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.staging
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/backend/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/74.0.3729.169 Chrome/74.0.3729.169 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env.staging HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /backend/.env.staging HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/74.0.3729.169 Chrome/74.0.3729.169 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Conn
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "staging",
"http_ua_hash": "fe380f58437657749c87a73f76231884ab0bd539",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "60ad021131c60c7ef0d3077bb512c229f5e99a01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 273,
"payload_entropy": 5.481105597502716,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "e1e4c0b2c2d90c5dec67c582c1b607335e7160df",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d70dd77b2a366de2bc9f0b69ff1b13a1",
"payload_hash": "a8b247da64ebf4ddca40f3f61e428943",
"path_pattern_hash": "71e8425052a8e855284ce6c37676ea95"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/backend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/backend\/.env.staging",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/74.0.3729.169 Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/backend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/74.0.3729.169 Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"payload_snippet": "GET \/backend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.staging",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/74.0.3729.169 Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/backend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/74.0.3729.169 Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"payload_snippet": "GET \/backend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cdbb86a75ed4214c0d6a177ade24557fdf18722b",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/backend/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/api/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit/537.36
Requête brute (extrait)
GET /backend/api/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "381721dfd3d1f7c90ceac35baccfb035df5e707e",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "7cf3bcec31d16ad31dcc82b576038776c12d1f9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.3956122807741025,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "c87b102c5fbcf5039f9dfccd16f89d0af73525df",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "36899e254d5caf5ff0af708247000826",
"payload_hash": "aec23b71721497814eec1bebe779c6dd",
"path_pattern_hash": "f336a19e3f1ce7e6163bdad57dfb6c61"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/backend\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36",
"method": "GET",
"path": "\/backend\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/api\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/backend\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/backend\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/api\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/backend\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-J737A) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ef9aa9a5d32be4952979185f29e6a1a4fe441c1",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.dev
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/backend/.env.dev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.dev HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env.dev HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWeb
Requête brute (extrait)
GET /backend/.env.dev HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connectio
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "dev",
"http_ua_hash": "9ef5541214fd1cb5050eaa0aa3c11d33b134d1f6",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "6d43a22facf5bd0b2b7f81b2645be87ea2a8a4a1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.493234964809275,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "3002cc3107aca29f21fc9f98f10b9c93a3ea3063",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "78998aca9d9fe0b2c9a380079e0f2554",
"payload_hash": "0657f4836cf165d4733bea84c9792d80",
"path_pattern_hash": "361efd67c8cb82623bb332a9d4f55268"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWeb",
"method": "GET",
"path": "\/backend\/.env.dev",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.dev",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/backend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LG-H918 Build\/NRD90M) AppleWeb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1cca673fb3d57969f16b70abad7cc22d5c94db1",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.2 Chrome/38.0.2125.102 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build/L
Requête brute (extrait)
GET /frontend/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.2 Chrome/38.0.2125.102 Safari/537.36 Accept-Charset: utf-8 Acce
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "f8985d90f719a409268dbb04a717ddaa35f0fbe3",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "7437aaaafc9e223d971228fe59fdee61b9d620d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 296,
"payload_entropy": 5.472710173043969,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "159bc8f8653f23494c85603a4250d0a6e54ae00c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "afe00c22406b8bb2bbedc2386b0d3fa6",
"payload_hash": "2c9c01421e93f6f877e69c3084984683",
"path_pattern_hash": "d7ae154bfa816b480978a2899fe639ce"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/L",
"method": "GET",
"path": "\/frontend\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/LRX22G) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/3.2 Chrome\/38.0.2125.102 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.local HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/LRX22G) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/3.2 Chrome\/38.0.2125.102 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAcce",
"payload_snippet": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/L",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/LRX22G) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/3.2 Chrome\/38.0.2125.102 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.local HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/LRX22G) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/3.2 Chrome\/38.0.2125.102 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAcce",
"payload_snippet": "GET \/frontend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build\/L",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94b4e16938b79815e235d6af16630de4fe0bb949",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A346 Safari/602.1
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit
Requête brute (extrait)
GET /frontend/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A346 Safari/602.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection:
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "8bdd51946a43293fbf9e2d2927f2bf22d3fe1c14",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "77987435bb3ae079ceddf1be0ca83f10bd79e60f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 266,
"payload_entropy": 5.3441189158001325,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "b7ce915a914aab562e111962a7d83b58264aeae1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a15647e627b64dcad9c8f35ee8e9e677",
"payload_hash": "495a158f04cc29f1687a82b7df578d88",
"path_pattern_hash": "2eb92b74c9200f7bfafce81d1b6d362c"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit",
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) Version\/10.0 Mobile\/14A346 Safari\/602.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) Version\/10.0 Mobile\/14A346 Safari\/602.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) Version\/10.0 Mobile\/14A346 Safari\/602.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) Version\/10.0 Mobile\/14A346 Safari\/602.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7eddf0b343ece384a97e094a67061e4d2bceb74f",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /frontend/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "89ad0029b2143d93cc8b33793d4548b188b94014",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "d9a2c7e4bfc8a23ebeeaa1888ef5fa4be1e92ee6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.396658935552589,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "c344edc93b3b515f649ca6e0c9b206f13bcca190",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3cb77f1b08fff0e3aa55b35e3dcb3934",
"payload_hash": "fe77117d5aecbbf406191a663f16f02f",
"path_pattern_hash": "6f5e9dea5f57f4e72146c7e773e7255d"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/frontend\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cbba41ff009ba9bb979f8b4c67d654e287f14d0b",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950514:leak-1
http_backup_file_scan
http_sensitive_path
Cible HTTP
GET
/frontend/.env.prod
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.prod
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.prod HTTP/1.1
User-Agent
Download Demon/3.5.0.11
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.prod HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Download Demon/3.5.0.11
Accept-Charset: utf-8
Accept-Encodi
Requête brute (extrait)
GET /frontend/.env.prod HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Download Demon/3.5.0.11 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "prod",
"http_ua_hash": "e3a28fc041166e967b49a3aa6c4624824ac07b8a",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "cf3ece5c26ce77d1afb6b3a84469b6cc81aaf4e1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 159,
"payload_entropy": 5.045553313196749,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c4c4f1b7614489cb01f9ab905b7d15c6b597ab24",
"event_fingerprint": "82ad883d2059caf8ca77fee446079f583f8cf534",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "95952e30af0fbbeff8168f399aa4dc61",
"payload_hash": "b31be2ebae6b8589caa21a0d77a627b7",
"path_pattern_hash": "b602f165e7f6eb051e1d5630d1727616"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Download Demon\/3.5.0.11\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
"method": "GET",
"path": "\/frontend\/.env.prod",
"user_agent": "Download Demon\/3.5.0.11",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Download Demon\/3.5.0.11\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Download Demon\/3.5.0.11\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.prod",
"user_agent": "Download Demon\/3.5.0.11",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Download Demon\/3.5.0.11\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Download Demon\/3.5.0.11\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e7d145775cb17e51051ae9fd32c3764f83b3fe9",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.dev
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.dev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.dev HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.1.1; XT1710-02 Build/NDS26.74-36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.dev HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; XT1710-02 Build/NDS26.74-36
Requête brute (extrait)
GET /frontend/.env.dev HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; XT1710-02 Build/NDS26.74-36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "dev",
"http_ua_hash": "88ea84a32643379ae2bc88a7e628dcb95181ef80",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "c038a771c7c9859031021bfbc55da91693d8463c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 279,
"payload_entropy": 5.455181236885776,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "40c27941b13c529f987bbcb1dca2b132a93cd36b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2022f2989985fa737671b43160e17c5f",
"payload_hash": "e9ae8ccc4e9131dbc08959f03f7a6f29",
"path_pattern_hash": "0210417b51ca7f1ff86d34574422463e"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36",
"method": "GET",
"path": "\/frontend\/.env.dev",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
"payload_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.dev",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
"payload_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; XT1710-02 Build\/NDS26.74-36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee6cc8047582183dffe1380bf37f4a56c5593b3b",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.staging
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko/20100101 Firefox/20.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.staging HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Geck
Requête brute (extrait)
GET /frontend/.env.staging HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko/20100101 Firefox/20.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "staging",
"http_ua_hash": "5c2d2ddd2cfdcb25e99901949bea1b0e1f70cd41",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "b9354afd7c7fbb8f226b6c5ad37595989c02511e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 220,
"payload_entropy": 5.218143403455245,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "b8b12b99031d61396e14398d744dbd0719842d20",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cf837d562bb6cda96c3d9a368de4a61d",
"payload_hash": "4d44d4ce1a0df8a551422676d7813378",
"path_pattern_hash": "d743fa13fb1b94912fe1841ecd591349"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Geck",
"method": "GET",
"path": "\/frontend\/.env.staging",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Geck",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.staging",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Geck",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1842a977c3739cdc159faaf56627b391d36cdba",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/frontend/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.backup HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) Ap
Requête brute (extrait)
GET /frontend/.env.backup HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13 Accept-Charset: utf-8 Accept-Encoding: gzip Connection:
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "76cfa9fdc2aaf2fc0072b65ec573ab8a38aa9a80",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "041ec2294a1481dc3081607b44ac63096bc8be9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.426544933823898,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "3d56c883be487ac41757c97337d9eb8cc4b665dd",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8b5f25f3820d11bf7a12b4a40a6051d9",
"payload_hash": "1d09a525996144052713f2b4faa7fa52",
"path_pattern_hash": "63098b77ef1e7ed1f9ff56d3ae7886f5"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) Ap",
"method": "GET",
"path": "\/frontend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit\/534.13 (KHTML, like Gecko) Chrome\/9.0.597.15 Safari\/534.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit\/534.13 (KHTML, like Gecko) Chrome\/9.0.597.15 Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) Ap",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit\/534.13 (KHTML, like Gecko) Chrome\/9.0.597.15 Safari\/534.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit\/534.13 (KHTML, like Gecko) Chrome\/9.0.597.15 Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) Ap",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ef2bc977dd86ae21b512d7cbb92f9fdad2466f8",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/src/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Requête brute (extrait)
GET /src/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "6e1c38356769095ad76267f9edb43ddae2af1491",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "0c533120cce5f9ceabf0223e76a6dc86fc19a74f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 197,
"payload_entropy": 5.2970412750642755,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "a024861e4b84ea741699f298f3483fb9d396d97b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "180050cb76309ecd4e9e895a18ed06b4",
"payload_hash": "f98dda6ac67edd4393d0b24e2fc8bedf",
"path_pattern_hash": "1be4509071ea53617b7e83d68c291bb4"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)",
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)",
"evidence": {
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident\/6.0)",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd37817a46fb5ef78878a3cb91093d2829a46ffa",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/src/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Fi
Requête brute (extrait)
GET /src/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "ea88c02b135d472772ab0b545cce2bda4b435f1c",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "e4304ce88152d59a50dc3020ea792863da65ad77",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.286799496108255,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "d9a3b4535a31aeb6357e6026f926de0ea5452246",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0f05db919617121c5aabfed71e90d70d",
"payload_hash": "4d1edf3e6d3f87484beadb6302013d28",
"path_pattern_hash": "0ca29e8f6e861d700e912e83099b82f9"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Fi",
"method": "GET",
"path": "\/src\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Firefox\/0.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"request_sample": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Firefox\/0.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Fi",
"evidence": {
"method": "GET",
"path": "\/src\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Firefox\/0.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"request_sample": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Firefox\/0.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko\/20040614 Fi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48923879fbcfbf352833b836135c2f5201207122",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/src/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 9; SM-A505F) AppleWebKit/537.36
Requête brute (extrait)
GET /src/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "5389e2d1a31c2c8e99f813da81ad753659927975",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "599f2d9bd6aa582bb5354e432e5e7dbc94c61beb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 258,
"payload_entropy": 5.40446348248608,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "ff27d8ec73a83b7f332c2f1401c42d448deb4b57",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e016ae64e78f7fed83a4aeb46b2d8f00",
"payload_hash": "a51599d8573ec4a37c7504864513263e",
"path_pattern_hash": "e052e9698e07c6e60c0f023221efaf20"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36 ",
"method": "GET",
"path": "\/src\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"request_sample": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/src\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"request_sample": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-A505F) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "006cee96de1e25a43105549a0bbdf86132e03b67",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
34
Recommandation
Investiguer
Tags
950086:sqli-21
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/src/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/src/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « sqli-21 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; MHA-AL00 Build/HUAWEIMHA-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.99 Mobile Safari/537.36 MMWEBID/9772 MicroMessenger/7.0.6.1460(0x…
Règles WAF
sqli-21
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.backup HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 9; MHA-AL00 Build/HUAWEIMHA-AL00; wv
Requête brute (extrait)
GET /src/.env.backup HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 9; MHA-AL00 Build/HUAWEIMHA-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.99 Mobile Safari/537.36 MMWEBID/9772 MicroMessenger/7.0.6.
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "382082862504cc1df3e537e83c0e227b9efa1d31",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "e2c1e948277f8c3df734e217f074ce4258c3cbfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 383,
"payload_entropy": 5.568587933568216,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "b2b95d806958f29ceb71c2509682cfec6ffc319a",
"event_fingerprint": "fa9bb54e47676b08ac6834b37ba50fa5a2f13a62",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9ab8a72c6c440df7560e9bf2f63a0869",
"payload_hash": "d9f184d6b203077305bffab18be96261",
"path_pattern_hash": "c8b12b4b569bce0b37c2e64eafb947f3"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv",
"method": "GET",
"path": "\/src\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/71.0.3578.99 Mobile Safari\/537.36 MMWEBID\/9772 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetType\/WIFI Language\/zh_CN",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/71.0.3578.99 Mobile Safari\/537.36 MMWEBID\/9772 MicroMessenger\/7.0.6.",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv",
"evidence": {
"method": "GET",
"path": "\/src\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/71.0.3578.99 Mobile Safari\/537.36 MMWEBID\/9772 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetType\/WIFI Language\/zh_CN",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/71.0.3578.99 Mobile Safari\/537.36 MMWEBID\/9772 MicroMessenger\/7.0.6.",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MHA-AL00 Build\/HUAWEIMHA-AL00; wv",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8ba55d686b46254101c1737b607aa5a231a26d1",
"ban_policy": "advisory_investigate",
"tags_list": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/src/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.39 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/api/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux x86_64)AppleWebKit/537.36 (KHTML, like Geck
Requête brute (extrait)
GET /src/api/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux x86_64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.39 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "10e0c0cc81f3c466534209b26644ce48c1c18a86",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "b2a18b35c3f8a9a70962b13b254a203c7ed83824",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.445125183529377,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "21c7455d78f9835b4db53f154b2e953a0b42c3de",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "635c1fabb3438f8d43362ba835f961d5",
"payload_hash": "73ff69ec4be54ec88ffe31ab96ec4b50",
"path_pattern_hash": "422818afedd28569d60d1f16deec3108"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/src\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Geck",
"method": "GET",
"path": "\/src\/api\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/api\/.env HTTP\/1.1",
"request_sample": "GET \/src\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Geck",
"evidence": {
"method": "GET",
"path": "\/src\/api\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/api\/.env HTTP\/1.1",
"request_sample": "GET \/src\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.39 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)AppleWebKit\/537.36 (KHTML, like Geck",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e83c9bb441b636f449844ec8767edbe0e016df9",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/server/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KH
Requête brute (extrait)
GET /server/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "b5219f197fa37f9a176e16ea3a66d5e9fb587f43",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "394e130162f84b369da768999af4d972a2c7e141",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.367617066418548,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "c4f9d65bb005aa0502c6e88834324103affb273c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "379e3f73ea0b0c7d993340f8397a3672",
"payload_hash": "331bce4e0557a61e018620ed420abc20",
"path_pattern_hash": "54554b038eab677020ee0c0c2a53bac1"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
"evidence": {
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "232bdcc391f9bd0f2bd1024a595a005f150794f5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/server/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/53
Requête brute (extrait)
GET /server/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "45c636e77901b96c70f360cae011d912a8e2e92e",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "3a4429a6d5f41cf5d304f80d456adb35465617d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.394275969182301,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "0014f7e7e24d1a639cf5fb4b6cb79cfaec927499",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f9bd990875663102878e16cd2ce3aafa",
"payload_hash": "17bb62b3215260e1bb8a53715ffa0e37",
"path_pattern_hash": "9eb6847465270ab8b74f01d8fe541218"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"method": "GET",
"path": "\/server\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"request_sample": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/server\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"request_sample": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb3f554bfa8c855bc24200482f3886ee156a952c",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/server/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /server/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "f694f99cff565034e1e4fddf9aac9f1fdb313045",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "c5a8bf9f86075206f2cab5a2cf1a94aed3e22719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.416397012310893,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "d4d6adc4dd414d86d64b263c0c6744c08e085fff",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6dc82c8a3d57f2110191f3d1c13c7a38",
"payload_hash": "c2ce571051cfe561764811a144355b9b",
"path_pattern_hash": "a00e13282480bcd571abdd94022996e0"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/server\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"request_sample": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/server\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"request_sample": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.131 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b021c32b9672b70a1e6f4f155bd390ded310e6bd",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/server/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/server/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env.backup HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko
Acc
Requête brute (extrait)
GET /server/.env.backup HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "8298049d71e95110bd38472b3986ed5f4c3b1a0c",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "a6afd16dcc7e295164dcac142437708cf1e776d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 192,
"payload_entropy": 5.28814082105226,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e172cb3a8db13dd0d8b5067113621dd672784d2e",
"event_fingerprint": "eb472dc15e38b68b4051b1c5b09b853ddfeb714c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "292b6843ab61ff69093df856496e872d",
"payload_hash": "620fd1d08c38e0aca4485f68bc338007",
"path_pattern_hash": "25c668888eb11fc8c703644010d4b817"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko\r\nAcc",
"method": "GET",
"path": "\/server\/.env.backup",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.backup HTTP\/1.1",
"request_sample": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/server\/.env.backup",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.backup HTTP\/1.1",
"request_sample": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD; i386; en-US; rv:1.7) Gecko\r\nAcc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7128890ef1311138ac4d182ce59e14fe44c8c233",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/services/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091107 Firefox/3.5.5
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /services/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/200911
Requête brute (extrait)
GET /services/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091107 Firefox/3.5.5 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "640981339f0da42dabf9def6c21cb59e45682a0a",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "0438360fe7a9b359faf44a16aed4ce35cf36b045",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.331701311290871,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "bc5c3cf8d0d98506bcd3b6221d2c434f4cf2ab82",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5f33db2f27e5b8d7c229c71038b3ce71",
"payload_hash": "8e1b1922c3c001567cb5d2863a3d3a1e",
"path_pattern_hash": "992024052ce1ab31c9bd1890c9e7f02b"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/200911",
"method": "GET",
"path": "\/services\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/20091107 Firefox\/3.5.5",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env HTTP\/1.1",
"request_sample": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/20091107 Firefox\/3.5.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/200911",
"evidence": {
"method": "GET",
"path": "\/services\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/20091107 Firefox\/3.5.5",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env HTTP\/1.1",
"request_sample": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/20091107 Firefox\/3.5.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko\/200911",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e12415e59a081ceef26aab559221c6b1944b56b1",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/services/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko/2008092814 (Debian-3.0.1-1)
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /services/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko/
Requête brute (extrait)
GET /services/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko/2008092814 (Debian-3.0.1-1) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "af95654136764219f3e1be062b59f67c138da948",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "73e333bd92670fab956ca02375108c7191056a36",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 224,
"payload_entropy": 5.338782923064725,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "c0efc39e7d8f6a2097486be235fa8515d3cfdf4e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6ad009cbfe015d0ea51aa1bd68d4dfd3",
"payload_hash": "239dc114cb8b21f0ea79e7b1f99cd665",
"path_pattern_hash": "8f696125de1c497ec1d3172258a9f00b"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/",
"method": "GET",
"path": "\/services\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/2008092814 (Debian-3.0.1-1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env.local HTTP\/1.1",
"request_sample": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/2008092814 (Debian-3.0.1-1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/",
"evidence": {
"method": "GET",
"path": "\/services\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/2008092814 (Debian-3.0.1-1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env.local HTTP\/1.1",
"request_sample": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/2008092814 (Debian-3.0.1-1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2c38937dff58bf396c7de871fdddf408b039c70",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
20
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/services/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/services/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /services/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML
Requête brute (extrait)
GET /services/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "c03cd37d2081e146d7646ffe1fd3b288c7377f5e",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "7ad14949ad0b183b675db2d36d2d5b72ec09f204",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.373483550372204,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 88,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7213535e327b3b084d2ccf693979f8a77807d8f7",
"event_fingerprint": "6b79ad8666894056b34aae191be0d4a654c7206c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a84cf2cbdd36ed3842484f0a6bc7e340",
"payload_hash": "cbc468b539540c062b2055dcf9b1759a",
"path_pattern_hash": "211e3ccc5c91dea183ab66efa73c6a45"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML",
"method": "GET",
"path": "\/services\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env.production HTTP\/1.1",
"request_sample": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML",
"evidence": {
"method": "GET",
"path": "\/services\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/.env.production HTTP\/1.1",
"request_sample": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "032333fff52175cae08f59347aadcdbfc041c5bb",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/service/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/service/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /service/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko/20070619 Minimo/0.020
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /service/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko/20070619 Mi
Requête brute (extrait)
GET /service/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko/20070619 Minimo/0.020 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "20093063f32b356f2caff0533edcfb2c6efe838b",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "9afb54f0e738d3d8aa1fcfb80bab77080f7f6fdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.271072799324838,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "3093d77650676b9b0e05c7c22cc8ed51878bd141",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "adad4b53c8af85901ff89de3fdd02286",
"payload_hash": "7b0231bfc5a3bc3448d91f2fcbe12a76",
"path_pattern_hash": "d9b00f587478dec270837253c672f652"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Mi",
"method": "GET",
"path": "\/service\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Minimo\/0.020",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/service\/.env HTTP\/1.1",
"request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Minimo\/0.020\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Mi",
"evidence": {
"method": "GET",
"path": "\/service\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Minimo\/0.020",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/service\/.env HTTP\/1.1",
"request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Minimo\/0.020\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv6l; rv 1.8.1.5pre) Gecko\/20070619 Mi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0898e181806ef73a38d8336483df28fa601c4892",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/admin/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/admin/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/76.0.3809.87 Chrome/76.0.3809.87 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /admin/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko
Requête brute (extrait)
GET /admin/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/76.0.3809.87 Chrome/76.0.3809.87 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "d61171168b95dbb6f5fda454ff9a5fe3927ed0b5",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "9bae73d08848be44521e9c4d49360c6e081f0fff",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.445503919093802,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "6ed3c8c4e2992f0e13f79f2f56b0b5fb1b86ebb3",
"event_fingerprint": "477116f75c20a222ef0b2a294a9e4122ba8df58f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0341",
"pat-0606"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9ddb9802525f1d2316c3a2056b73a9a7",
"payload_hash": "d3e516b3541cb502cd2a072a4ffc6234",
"path_pattern_hash": "36de7f489df887c3e31f5a951469f711"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"method": "GET",
"path": "\/admin\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env HTTP\/1.1",
"request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"evidence": {
"method": "GET",
"path": "\/admin\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env HTTP\/1.1",
"request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9fbfd444905b7163415bd66c9e56ba670fa7150b",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_backup_file_scan",
"http_probe_admin",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/admin/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/admin/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 OPR/60.0.3255.170
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /admin/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /admin/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 OPR/60.0.3255.170 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "f9ad7da69ee498ed83f40fc3998b54d2f538a739",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "6afcf6a74c4f4ca0deffd4538e4bee0be1658fdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.438250212515827,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "6ed3c8c4e2992f0e13f79f2f56b0b5fb1b86ebb3",
"event_fingerprint": "70e8ecd1f161aca1f74c4355c4c8040ac3102c68",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0341",
"pat-0606"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2c335876e4bd94f766c4a78c33e1d8b2",
"payload_hash": "feca81b231dd98604cca99153a4124a9",
"path_pattern_hash": "2436e3a9cfeb9e9b135c78544dba7eee"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"method": "GET",
"path": "\/admin\/.env.production",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36 OPR\/60.0.3255.170",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.production HTTP\/1.1",
"request_sample": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36 OPR\/60.0.3255.170\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/admin\/.env.production",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36 OPR\/60.0.3255.170",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.production HTTP\/1.1",
"request_sample": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36 OPR\/60.0.3255.170\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "195ca49308837b85b1cdd76d9f219d89cbebebac",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_backup_file_scan",
"http_probe_admin",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/admin/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/admin/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /admin/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO
Requête brute (extrait)
GET /admin/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connectio
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "ef7ee2a2c7d300eda4e96e0f837c5648d5702c64",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "5104f09772fa402efdc8eb0bc2114ecf6407730d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.442228210777518,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "6ed3c8c4e2992f0e13f79f2f56b0b5fb1b86ebb3",
"event_fingerprint": "aa43264a00eff97024bd25182460b23e9997ce39",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0341",
"pat-0606"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "df02e92450948a890d4905ca174df839",
"payload_hash": "0c770adbc6179501c213d5628c94f701",
"path_pattern_hash": "8b44c48d7af23ff178b0954ed1a8265f"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO",
"method": "GET",
"path": "\/admin\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.local HTTP\/1.1",
"request_sample": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO",
"evidence": {
"method": "GET",
"path": "\/admin\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.local HTTP\/1.1",
"request_sample": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed72e3b358f2dc8468ce18c233f2cacadc0975ef",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_backup_file_scan",
"http_probe_admin",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/admin/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/admin/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; CPH1859) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /admin/.env.backup HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 9; CPH1859) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /admin/.env.backup HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 9; CPH1859) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "4c1f2d7740fc58fbf86743b914e88958dd8f4617",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "32e03e003a51f542f710beeac8e15f008c3f65ad",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.43141778589635,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "6ed3c8c4e2992f0e13f79f2f56b0b5fb1b86ebb3",
"event_fingerprint": "fd2fdffc9451b05fad633e59f414691ea81adad5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0341",
"pat-0606"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "df8cf954ce56f5ae5222ab1bb74dd330",
"payload_hash": "a823724d4cad42a8dfaa4c72b5d7e34f",
"path_pattern_hash": "9967aebe85bc5150552d43732fce77c0"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/admin\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.backup HTTP\/1.1",
"request_sample": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/admin\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/.env.backup HTTP\/1.1",
"request_sample": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CPH1859) AppleWebKit\/537.36 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a1005c823216001612ec7f0b393a2e6f750adbe",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_backup_file_scan",
"http_probe_admin",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/admin/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/admin/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /admin/api/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWe
Requête brute (extrait)
GET /admin/api/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connecti
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "2757074521bfa128d92b302ba501e17f4d5210e0",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "457eece9ef431f7c5ef47fc5eabd74481382950d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.44049178554889,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "6ed3c8c4e2992f0e13f79f2f56b0b5fb1b86ebb3",
"event_fingerprint": "ed211619c040b5ac6ba76fffca3a8685ebb3ad8c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0341",
"pat-0606"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8c2b26f1d3eeae7269314dbfc381422d",
"payload_hash": "bb9052ef7f28b41ff63d18d1c48bf4a8",
"path_pattern_hash": "eb0b318a7b8e99b7782318c2869ecac1"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/admin\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWe",
"method": "GET",
"path": "\/admin\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.98 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/api\/.env HTTP\/1.1",
"request_sample": "GET \/admin\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.98 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnecti",
"payload_snippet": "GET \/admin\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWe",
"evidence": {
"method": "GET",
"path": "\/admin\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.98 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/admin\/api\/.env HTTP\/1.1",
"request_sample": "GET \/admin\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.98 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnecti",
"payload_snippet": "GET \/admin\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; HTC One M9 Build\/MRA58K) AppleWe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f326fdedaa726e550705cc1ad758c6bff4b3e223",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_backup_file_scan",
"http_probe_admin",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/internal/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/internal/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /internal/.env HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /internal/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; I
Requête brute (extrait)
GET /internal/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0 Accept-Charset: utf-8
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "a11e527840fa2c8b63f7b4b4628cbdbd6433e67b",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "bbff311646149e77bbf27c4899ac7dbcb7bb94dc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 301,
"payload_entropy": 5.369374852682285,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "245361518eb01da511430d533905ffbf8fea0134",
"event_fingerprint": "592fe15a0085e60ae6d716db029358bc1685b221",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a16a92420f4cac2cad3851a7b8066d91",
"payload_hash": "4d1dfe81494cf289a398217ac9bbf517",
"path_pattern_hash": "929e3be7d81c0f83bf54b6e32e9b030d"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/internal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; I",
"method": "GET",
"path": "\/internal\/.env",
"user_agent": "Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED\/1.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/internal\/.env HTTP\/1.1",
"request_sample": "GET \/internal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED\/1.0\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/internal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; I",
"evidence": {
"method": "GET",
"path": "\/internal\/.env",
"user_agent": "Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED\/1.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/internal\/.env HTTP\/1.1",
"request_sample": "GET \/internal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED\/1.0\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/internal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident\/5.0; I",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ac9e095815618206dccb7d2cbca7264619b52b9",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_internal",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/internal/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/internal/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /internal/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 YaBrowser/19.7.0.1990 Yowser/2.5 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /internal/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWe
Requête brute (extrait)
GET /internal/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 YaBrowser/19.7.0.1990 Yowser/2.5 Safari/537.36 Accept-Charset: utf-8 Acce
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "2b1cea1eadd4b9aea2b54b35c91b288f821ee91e",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "d290e289983be8731f71ebf018001c11bad4ee88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 296,
"payload_entropy": 5.427165522291504,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "245361518eb01da511430d533905ffbf8fea0134",
"event_fingerprint": "63d9ec389658f270b93fa589a29a145d5ec796df",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bc0cc854688eb17e30fe3bf6081789d8",
"payload_hash": "181b4f5d53e18d0aad2c1a5a94e7e527",
"path_pattern_hash": "82c27c01e593b4c327a9fce0421e0d53"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/internal\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWe",
"method": "GET",
"path": "\/internal\/.env.production",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 YaBrowser\/19.7.0.1990 Yowser\/2.5 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/internal\/.env.production HTTP\/1.1",
"request_sample": "GET \/internal\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 YaBrowser\/19.7.0.1990 Yowser\/2.5 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAcce",
"payload_snippet": "GET \/internal\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWe",
"evidence": {
"method": "GET",
"path": "\/internal\/.env.production",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 YaBrowser\/19.7.0.1990 Yowser\/2.5 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/internal\/.env.production HTTP\/1.1",
"request_sample": "GET \/internal\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 YaBrowser\/19.7.0.1990 Yowser\/2.5 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAcce",
"payload_snippet": "GET \/internal\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10eb461705bba3fa416c076a4db19af7c1b7df4d",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_internal",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/private/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/private/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private/.env HTTP/1.1
User-Agent
Mozilla/4.0 (compatible; Dillo 3.0)
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /private/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/4.0 (compatible; Dillo 3.0)
Accept-Charset: utf-8
Accept-
Requête brute (extrait)
GET /private/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/4.0 (compatible; Dillo 3.0) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "b0c5734e3267fae307a43bdf236b1c6b09949444",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "42ecb4d5f4be7b556e157ee15a288da92dfb0e45",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.162510473781255,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "eba3a7e7146a63085b1e76ed6630347bc49577be",
"event_fingerprint": "42eaeeb51df8b33078d9dc68cdf8724a234d7180",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4617f7493afe33a1fc0e16514d66b372",
"payload_hash": "c59fe728c36adaa0abfcad7caff57231",
"path_pattern_hash": "467844c5e65593cac952660a5e740364"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf-8\r\nAccept-",
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/4.0 (compatible; Dillo 3.0)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf-8\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/4.0 (compatible; Dillo 3.0)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf-8\r\nAccept-",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a11dbfdf9e38bea9aaac3c7d4ed5dfda5cc4572",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_private",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/private/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/private/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1/UCBrowser/8.6.1.262/145/355
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /private/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Buil
Requête brute (extrait)
GET /private/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1/UCBrowser/8.6.1.262/145/355 Accept-Charset: utf-
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "b206f54df7518d0d9989d507d00c471c2aa25c95",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "733a894b07d9b79b5b4ab7169336337873d659bc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 303,
"payload_entropy": 5.417653694342042,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "a7b2842535a398670455bafa01a27cbb4ee1a38a",
"event_fingerprint": "a8ad45ac29e039e0df8878869ab8582175a3c885",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c3056adb2656f1a981d9b647821a6fa7",
"payload_hash": "251525941677050496d2d868e8a3d518",
"path_pattern_hash": "d172a4f1c2b0f77cc0bf21a5051067d5"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Buil",
"method": "GET",
"path": "\/private\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build\/GRI40) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\/UCBrowser\/8.6.1.262\/145\/355",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build\/GRI40) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\/UCBrowser\/8.6.1.262\/145\/355\r\nAccept-Charset: utf-",
"payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Buil",
"evidence": {
"method": "GET",
"path": "\/private\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build\/GRI40) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\/UCBrowser\/8.6.1.262\/145\/355",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Build\/GRI40) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\/UCBrowser\/8.6.1.262\/145\/355\r\nAccept-Charset: utf-",
"payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.3.3; en-us ; LS670 Buil",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e671fb29806f379035d846dd7366d29f8e197e4",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_private",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/config/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /config/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /config/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "2be45be822a0113cf3e9179d7148a66947b7d527",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "867074af7203ec5cf6b039823237b28edf1066aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 243,
"payload_entropy": 5.411644616936826,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "a44e5f642e522f2e295bd2aec2dbcd4f49abbb8e",
"event_fingerprint": "f2742a75e7268466a95c87ca0b3fac420eff9299",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8a11a34e9c12e87c61c23a0d679ff58e",
"payload_hash": "7dcb7c63fcf47e72238ac70592237bd9",
"path_pattern_hash": "2aaa158af561315bc9004215c1f06852"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/config\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/config\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.140 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env HTTP\/1.1",
"request_sample": "GET \/config\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.140 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/config\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.140 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env HTTP\/1.1",
"request_sample": "GET \/config\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.140 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91dd05aae01f42bff73ced34b38760c2f45b7a28",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_config",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/config/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux i686; rv:25.0) Gecko/20100101 Firefox/25.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /config/.env.local HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:25.0) Gecko/20100101 Firefox/
Requête brute (extrait)
GET /config/.env.local HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:25.0) Gecko/20100101 Firefox/25.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "adb32c6126b5078a114672be2e5c5e2652446272",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "8315d690f50358ceea64bc0cb23314dd9bf855ed",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 201,
"payload_entropy": 5.233898519781215,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "a44e5f642e522f2e295bd2aec2dbcd4f49abbb8e",
"event_fingerprint": "4b612d7f3aa82167e859893f6fe410b389644f93",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "415c4a21627b598e1f6da42e34138f6f",
"payload_hash": "8eb61969348d8213c77983314b833602",
"path_pattern_hash": "826e0f7bf5d8c36c7953b7184edfe839"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/",
"method": "GET",
"path": "\/config\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/25.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.local HTTP\/1.1",
"request_sample": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/25.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/",
"evidence": {
"method": "GET",
"path": "\/config\/.env.local",
"user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/25.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.local HTTP\/1.1",
"request_sample": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/25.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:25.0) Gecko\/20100101 Firefox\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "308d58b0f01bf195b63af7c7154dfa9cb5133465",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_config",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/config/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /config/.env.production HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /config/.env.production HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "fb35aa6d075efbf6c20bdfab4a318bb13334b704",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "b18d8885bb1938ef9b65748771cc7ca2b2b01916",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.401178426740004,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "a44e5f642e522f2e295bd2aec2dbcd4f49abbb8e",
"event_fingerprint": "e16df3b8282663d152406d680102261cda2dd0ad",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b80f036707f051ea52220d84e31704a2",
"payload_hash": "ae8a8b695aa372f13e261afbf9ae1ee6",
"path_pattern_hash": "13dc0331670030f34544b2533e91efac"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/config\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/config\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.78 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.production HTTP\/1.1",
"request_sample": "GET \/config\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.78 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.78 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.production HTTP\/1.1",
"request_sample": "GET \/config\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.78 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d0006482b2aeebbb63e52578c773d0101b1c3ed",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_config",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/conf/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/conf/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /conf/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 4.4.4; Nexus 7 Build/KTU84P) AppleWebKit/537.36 (KHTML like Gecko) Chrome/36.0.1985.135 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /conf/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; Nexus 7 Build/KTU84P) AppleWebKit/5
Requête brute (extrait)
GET /conf/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; Nexus 7 Build/KTU84P) AppleWebKit/537.36 (KHTML like Gecko) Chrome/36.0.1985.135 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "eaffd19466b40201afc74c1895732f48a659310f",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "70dc78a46c5fc5ec9a60262c10608bb7fd4c1db2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.437498009055599,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "bd191c0f0f44999df6f9c377866a4fa07af337d6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f8a8bea4d7391eb9891620a4be35b125",
"payload_hash": "033d1b079fc1e69c269fd4799b60c131",
"path_pattern_hash": "f6629ed9025fbf6cf9edb98b9f1072f5"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/5",
"method": "GET",
"path": "\/conf\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.135 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/conf\/.env HTTP\/1.1",
"request_sample": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.135 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/conf\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.135 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/conf\/.env HTTP\/1.1",
"request_sample": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/36.0.1985.135 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.4; Nexus 7 Build\/KTU84P) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "820df0fe8bb0ac3305c93a9f8659b11c1bf94b17",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/docker/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/docker/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3187.0 Safari/537.366
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /docker/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
GET /docker/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3187.0 Safari/537.366 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "9f4b6da23c4fe9e243a2de2cd6ada9c3f7bce97a",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "9af4b895c55b82b27b0181f549c7f29671f851e7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.425588863008423,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "a0e062831b7001a5aade32ac5364c06a5006b0d9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4e70c483c975fa91f3ad42e83cd46bd2",
"payload_hash": "f631cb03d63fa9b51ae14ae5af4d1967",
"path_pattern_hash": "d8c5fc01c634b7a145b1071dcf26d56b"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/docker\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, li",
"method": "GET",
"path": "\/docker\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3187.0 Safari\/537.366",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/docker\/.env HTTP\/1.1",
"request_sample": "GET \/docker\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3187.0 Safari\/537.366\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/docker\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"method": "GET",
"path": "\/docker\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3187.0 Safari\/537.366",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/docker\/.env HTTP\/1.1",
"request_sample": "GET \/docker\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3187.0 Safari\/537.366\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/docker\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 (x86_64)) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "799ca5b030a33853071cef42806b6f8f06b31733",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/laravel/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/laravel/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /laravel/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /laravel/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.1
Requête brute (extrait)
GET /laravel/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "12e61ede4f75e40b24f2a993128b866dcbbd1476",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "8a8ae205bd806a11f7ace50730b7c0a8ef76120d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.347867898348183,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "07f8391bd1a4608bf7a163503dcd3e94e3ab113c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c4309eabdc0307906b00671cce766eeb",
"payload_hash": "1f3917bce97a432e9b32813213926438",
"path_pattern_hash": "792fa580b048927b1e082634fc8cda9c"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/laravel\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.1",
"method": "GET",
"path": "\/laravel\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/laravel\/.env HTTP\/1.1",
"request_sample": "GET \/laravel\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/laravel\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.1",
"evidence": {
"method": "GET",
"path": "\/laravel\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/laravel\/.env HTTP\/1.1",
"request_sample": "GET \/laravel\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/laravel\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/605.1.1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2e402cba5b16beb4dea3a9cb6146becdbf12a73",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/symfony/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/symfony/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /symfony/.env HTTP/1.1
User-Agent
Mozilla/5.0 (MeeGo; NokiaN9) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /symfony/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (MeeGo; NokiaN9) AppleWebKit/534.13 (KHTML, like Gecko)
Requête brute (extrait)
GET /symfony/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (MeeGo; NokiaN9) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "778636b0bf3f5e2a33bd110df1323712560e7d4f",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "581b418411856b2c342ec9927095e7782e5723ff",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.393796202455405,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "d6bf03aa187d38575c8a388c431752d390bf5c4d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d0699fe8b6fd28afc7919004320e6175",
"payload_hash": "538ada4c0e2c721ce6d71322c54b3cb0",
"path_pattern_hash": "76c104a7314c285b1e250aee04e5396e"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/symfony\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko)",
"method": "GET",
"path": "\/symfony\/.env",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/symfony\/.env HTTP\/1.1",
"request_sample": "GET \/symfony\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/symfony\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko)",
"evidence": {
"method": "GET",
"path": "\/symfony\/.env",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/symfony\/.env HTTP\/1.1",
"request_sample": "GET \/symfony\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/symfony\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN9) AppleWebKit\/534.13 (KHTML, like Gecko)",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9b58d55c8fbe40625575c35654794441983b4f0",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/wordpress/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/wordpress/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /wordpress/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /wordpress/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.3
Requête brute (extrait)
GET /wordpress/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "0102061f1ee3579e7a276e7c1b0c33df2da9f83a",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "b10966d4f4636bfb328d13cc5ad3eaa190ac10f4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 252,
"payload_entropy": 5.442742508209812,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "e741517fe927771b9a6fa2d6840a8f2833e91281",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b03063e9427d04942eb42dbc8a9e6fd1",
"payload_hash": "50b3c9f1c2bbf7289dd0e4826e8fddd3",
"path_pattern_hash": "887cb9244069f23f855e833cc59330df"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/wordpress\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.3",
"method": "GET",
"path": "\/wordpress\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/wordpress\/.env HTTP\/1.1",
"request_sample": "GET \/wordpress\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/wordpress\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/wordpress\/.env HTTP\/1.1",
"request_sample": "GET \/wordpress\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af94790ef87e84bba2fa4c9470d9e337906afeb8",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/public/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/public/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.122 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /public/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /public/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.122 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "f4d59fc22830556607cd05b8ab7f1bf7d75d1a56",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "bc9ca66c038b10c68f8dffc886361c52fc1ac680",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 243,
"payload_entropy": 5.415621838171057,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "c245c7d3cb115b01d6860c8275af5a8e05af97e3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "dd4acdb7441eaa1bbd053f2f90cd11fd",
"payload_hash": "e65b801e4452b25f1ad5daea485bf415",
"path_pattern_hash": "6cf746da949d58c839550a31197db646"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/public\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.122 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/public\/.env HTTP\/1.1",
"request_sample": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.122 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/public\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.122 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/public\/.env HTTP\/1.1",
"request_sample": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.122 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be028ae744e22e1c6320e0314eea759189249b67",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/wp/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/wp/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /wp/.env HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Konqueror/3.5; SunOS) KHTML/3.5.1 (like Gecko)
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /wp/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; SunOS) KHTML/3.5.1 (like Gecko)
Requête brute (extrait)
GET /wp/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; SunOS) KHTML/3.5.1 (like Gecko) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "076cd404655c77a72ab549fc271210fbf04b931e",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "ac9f3e6c6c68e068721388888a9710fa61a49772",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 196,
"payload_entropy": 5.313061565082645,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "30231b55991fbc1620229d38fadd8de2a56cf465",
"event_fingerprint": "4a214f5a80bac64c4476bdc4e6da328fa6c492e7",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4aa6de138ae8c5c2aa4cd5222c0dccdb",
"payload_hash": "c12042d89d63495613efd7f856401799",
"path_pattern_hash": "0151780c15d45702ae9dc50e582e8700"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/wp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)\r",
"method": "GET",
"path": "\/wp\/.env",
"user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/wp\/.env HTTP\/1.1",
"request_sample": "GET \/wp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)",
"evidence": {
"method": "GET",
"path": "\/wp\/.env",
"user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/wp\/.env HTTP\/1.1",
"request_sample": "GET \/wp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; SunOS) KHTML\/3.5.1 (like Gecko)",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "570fbfecc68b83c9f57b991994aafaddf11bd1fb",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_wordpress",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950514:leak-1
http_backup_file_scan
http_sensitive_path
Cible HTTP
GET
/web/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/web/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /web/.env HTTP/1.1
User-Agent
SuperBot/4.4.0.60 (Windows XP)
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /web/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: SuperBot/4.4.0.60 (Windows XP)
Accept-Charset: utf-8
Accept-Encoding:
Requête brute (extrait)
GET /web/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: SuperBot/4.4.0.60 (Windows XP) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "03445952c518f6755b1bc6de6b84e5c811b4f8a5",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "47bcdedb3b954688023f733564a003e944c34a32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 156,
"payload_entropy": 5.208458088918584,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c4c4f1b7614489cb01f9ab905b7d15c6b597ab24",
"event_fingerprint": "1eebd9f72e6e50f69cc5a17c8cb203a622bbee7c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "82a0cea2412ff8dfa5f8ad72409a36a9",
"payload_hash": "cc5fa648bf5c27203ccf2efa23e59949",
"path_pattern_hash": "d80a28198e7c3b2ce080248f274b9024"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/web\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
"method": "GET",
"path": "\/web\/.env",
"user_agent": "SuperBot\/4.4.0.60 (Windows XP)",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/web\/.env HTTP\/1.1",
"request_sample": "GET \/web\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/web\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
"evidence": {
"method": "GET",
"path": "\/web\/.env",
"user_agent": "SuperBot\/4.4.0.60 (Windows XP)",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/web\/.env HTTP\/1.1",
"request_sample": "GET \/web\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/web\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6c4caf1f503eb2935b8fa834547da9d0c6495c6",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/htdocs/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/htdocs/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /htdocs/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36 Vivaldi/2.6.1566.49
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /htdocs/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (
Requête brute (extrait)
GET /htdocs/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36 Vivaldi/2.6.1566.49 Accept-Charset: utf-8 Accept-Encoding: gzip Connect
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "45da61517a0c59230b18cc2e7e3fa1bf75fcdcf0",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "8f48488caec0125a8a05acdcda0c91818dd79982",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 270,
"payload_entropy": 5.440088336266388,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "48ae40452e4b56825ff9370de1fef92409c3c28b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "26153561427cb0ae35fb4f15e24a7268",
"payload_hash": "ec85d4376d7c35e49650977e8d52b1c2",
"path_pattern_hash": "43bb577a72550f9d83432629be23ae6a"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/htdocs\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.145 Safari\/537.36 Vivaldi\/2.6.1566.49",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/htdocs\/.env HTTP\/1.1",
"request_sample": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.145 Safari\/537.36 Vivaldi\/2.6.1566.49\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect",
"payload_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/htdocs\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.145 Safari\/537.36 Vivaldi\/2.6.1566.49",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/htdocs\/.env HTTP\/1.1",
"request_sample": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.145 Safari\/537.36 Vivaldi\/2.6.1566.49\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnect",
"payload_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26a943bd883542d9604b149347b5a5a66bf08b62",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/www/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/www/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /www/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; Pixel) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /www/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Linux; Android 9; Pixel) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /www/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Linux; Android 9; Pixel) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "5b7b2e4e70985e0107fe5bb257375bc0686bfd58",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "f9a5f885118a1e31832caf4bc6622a0bd9e5d124",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 244,
"payload_entropy": 5.422083709411414,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "24cde015f8cee7685bdbba97a70c2003e60fa3ef",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0661b118496333fb1ed77a64f08bf520",
"payload_hash": "697b5c526f1985db48b7423d9c8acf0e",
"path_pattern_hash": "9f8be2cd3d14d4c05416633fe809702c"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/www\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like G",
"method": "GET",
"path": "\/www\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/www\/.env HTTP\/1.1",
"request_sample": "GET \/www\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/www\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/www\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/www\/.env HTTP\/1.1",
"request_sample": "GET \/www\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/www\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b0d93d9e3a06bd1642d67646b07dad1bf7e4e3f",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/html/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/html/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /html/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /html/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (
Requête brute (extrait)
GET /html/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "18d0c4c66bfeb47f5713a590ffcf98a2b0de5ca4",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "d88de32bc9acf1646f12af79ae4f4e612885da98",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 244,
"payload_entropy": 5.349911727155976,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "bc12146e7a10501d417f76f6ce817e5a2604da7d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ea9a3dec4dce8747ef8c835f03590297",
"payload_hash": "9e7fe4ba7f1d5bd277b47ed9a0ce46fb",
"path_pattern_hash": "b731774ad9ccb17484242cab8412851e"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/html\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (",
"method": "GET",
"path": "\/html\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/html\/.env HTTP\/1.1",
"request_sample": "GET \/html\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/html\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (",
"evidence": {
"method": "GET",
"path": "\/html\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/html\/.env HTTP\/1.1",
"request_sample": "GET \/html\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/html\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de1e1147fc69b7411117646547aa6ef8ea076e6d",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/storage/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/storage/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /storage/.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /storage/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/201009
Requête brute (extrait)
GET /storage/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "987f63cbb9c3436380f0c5ba7c4c8f73d9cb4a61",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "b8ca2ea5c794124cded93c100b20da74277adc4e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.302574827592715,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "89fac2ab28969fbfe88f0e07d157d71a65b00c20",
"event_fingerprint": "726c4c66e6662c1b5b36f9faf37c90f97c320a62",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3a804c3ecc17f3b2520fd1567c5a1897",
"payload_hash": "5a4bcb40235bc50888c5bbeb1810086c",
"path_pattern_hash": "450e48008d46f59e9e14143fd8de05b2"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/201009",
"method": "GET",
"path": "\/storage\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/20100916 Iceape\/2.0.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/storage\/.env HTTP\/1.1",
"request_sample": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/20100916 Iceape\/2.0.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/201009",
"evidence": {
"method": "GET",
"path": "\/storage\/.env",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/20100916 Iceape\/2.0.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/storage\/.env HTTP\/1.1",
"request_sample": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/20100916 Iceape\/2.0.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko\/201009",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d504a3e5aaa90544c1ae7591f9ca2e170e88360",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Moyen · 57
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950514:leak-1
http_backup_file_scan
http_probe_uploads
Cible HTTP
GET
/uploads/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/uploads/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /uploads/.env HTTP/1.1
User-Agent
SuperBot/4.4.0.60 (Windows XP)
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /uploads/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: SuperBot/4.4.0.60 (Windows XP)
Accept-Charset: utf-8
Accept-Encod
Requête brute (extrait)
GET /uploads/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: SuperBot/4.4.0.60 (Windows XP) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "03445952c518f6755b1bc6de6b84e5c811b4f8a5",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "ce47452b1fa5a36e3e2ab6ad357d27ce11d38e66",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 160,
"payload_entropy": 5.205169383077552,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 57,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "137fe09ad28f861945bca397d2bef7cddcfc4425",
"event_fingerprint": "65d1376783324a317b92b65dad2b12b182d4cf4f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "82a0cea2412ff8dfa5f8ad72409a36a9",
"payload_hash": "0e571b68952e62e2fcf3db37f7435050",
"path_pattern_hash": "12e1063037a0428b03f9617844274d0a"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encod",
"method": "GET",
"path": "\/uploads\/.env",
"user_agent": "SuperBot\/4.4.0.60 (Windows XP)",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/uploads\/.env HTTP\/1.1",
"request_sample": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encod",
"evidence": {
"method": "GET",
"path": "\/uploads\/.env",
"user_agent": "SuperBot\/4.4.0.60 (Windows XP)",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/uploads\/.env HTTP\/1.1",
"request_sample": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: SuperBot\/4.4.0.60 (Windows XP)\r\nAccept-Charset: utf-8\r\nAccept-Encod",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "736aa13c26ff989493bc3d3de436fd9882a575f1",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_uploads",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
04/06/2026 23:22:47 UTC
TCP
82
Sonde fichier configuration
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950514:leak-1
http_backup_file_scan
http_sensitive_path
Cible HTTP
GET
/data/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/data/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /data/.env HTTP/1.1
User-Agent
ELinks/0.12~pre5-4
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /data/.env HTTP/1.1
Host: 62.3.50.33:82
User-Agent: ELinks/0.12~pre5-4
Accept-Charset: utf-8
Accept-Encoding: gzip
Conn
Requête brute (extrait)
GET /data/.env HTTP/1.1 Host: 62.3.50.33:82 User-Agent: ELinks/0.12~pre5-4 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "c7b726cf128fa57c094989ccafc8e302cc3d8faa",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "e54cfac955f5c42596d11eab4b07481d7b35d55b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 5.1124765260009415,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 82,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c4c4f1b7614489cb01f9ab905b7d15c6b597ab24",
"event_fingerprint": "2f87a599116766677dc271e6ace7df7f955ff057",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2e73c0f0435031f38d7f1c43b2182a01",
"payload_hash": "c982f8c91f63450f0df1dd077d009561",
"path_pattern_hash": "24a4726ce7edb9d3428cf8684d193cc9"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"payload_preview": "GET \/data\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: ELinks\/0.12~pre5-4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"method": "GET",
"path": "\/data\/.env",
"user_agent": "ELinks\/0.12~pre5-4",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/data\/.env HTTP\/1.1",
"request_sample": "GET \/data\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: ELinks\/0.12~pre5-4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/data\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: ELinks\/0.12~pre5-4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"evidence": {
"method": "GET",
"path": "\/data\/.env",
"user_agent": "ELinks\/0.12~pre5-4",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/data\/.env HTTP\/1.1",
"request_sample": "GET \/data\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: ELinks\/0.12~pre5-4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/data\/.env HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: ELinks\/0.12~pre5-4\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f82a43c3ba75bd779f865e9ad2c6c219d3e15c6",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}