Investigation Workspace

Entity: 3%7ebb4be091c5dc4153 (Tls)

Entity Details
Type
Tls
Linked Entities
IPs Linked to TLS Fingerprint (11)
Hostnames Targeted
Hostname Request Count
akamai.darcherif.fr 324
www.darcherif.fr 46
Paths Targeted (with Hostname Counts)
Path Distinct Hostnames
api/gql 2
ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 2
_all_dbs 2
.env 2
info.php 2
server 2
about 2
api 2
server-status 2
.git/config 2
actuator/env 2
graphql 2
swagger.json 2
api/graphql 2
login.action 2
.DS_Store 2
v2/api-docs 2
v3/api-docs 2
v2/_catalog 2
swagger-ui.html 2
config.json 2
@vite/env 2
api/swagger.json 2
telescope/requests 2
debug/default/view 2
swagger/swagger-ui.html 2
swagger/v1/swagger.json 2
.vscode/sftp.json 2
api-docs/swagger.json 2
swagger/index.html 2
webjars/swagger-ui/index.html 2
graphql/api 2
s/63e2031313e2030313e25393/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/2393e2430323e26313e223/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/934313e2430323e26313e223/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/4373e2430323e26313e223/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/035313e2133313e20353e23323/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/3323e2031313e2030313e25393/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/534313e2430323e26313e223/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/7313e2031313e2030313e25393/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/833313e2133313e20353e23323/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/6383e2430323e26313e223/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
s/433313e2133313e20353e23323/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 1
🚫

Block

All requests associated with this TLS fingerprint were flagged by WAF, targeting sensitive files (.DS_Store, .env, .git/config) and common admin/info paths, and triggered a critical 'LFI-ANOMALY' deny rule. This fingerprint is indicative of a highly malicious client.

2025-12-12 00:08:31