Home / Blog / Forensic Analysis
Forensics & LEAP

Automating Forensic Log Analysis: How LEAP detects Aadhaar & UPI exposure

TL
Kryptasys Threat Lab
June 12, 2026 • 8 min read
Forensic Intelligence

Tracing Unauthorized Data Exfiltration and Log Exposure Trails Local-First

When a security breach occurs at an enterprise level, the first responders are rarely staring at active dashboards. They are digging through raw server logs. In India's digital ecosystem, where the Unified Payments Interface (UPI) processes billions of transactions and Aadhaar acts as the primary identity anchor, a log leak can be catastrophic. Developers often accidentally log authorization headers, complete API payload structures, or URL parameters containing sensitive user credentials.

Analyzing raw logs at scale is challenging. A typical web cluster generates gigabytes of text logs daily. Historically, investigators had to upload these files to cloud-based security information event management (SIEM) systems. However, during active cybercrime investigations, government and financial guidelines dictate that raw evidence must not traverse public clouds. This technical breakdown explores how our LEAP (Log Evaluation & Analysis Platform) tool leverages client-side WebAssembly to parse large logs locally, searching for traces of Aadhaar numbers and UPI exposure patterns.

The Problem: PII Leaking into Plaintext Logs

Modern applications depend on third-party payment gateways and identity verification microservices. During a debug cycle, an engineer might set log levels to verbose. This can cause standard server logs (Nginx, IIS, Apache) to capture HTTP requests in full:

# Example Nginx log leak containing PII
192.168.1.45 - - [12/Jun/2026:10:14:22 +0530] "POST /api/v2/verify-identity HTTP/1.1" 200 452 "https://example.in/checkout" "Mozilla/5.0" "request_body: {\"aadhaar\":\"450988123490\", \"vpa\":\"user@upi\"}"

If these logs are subsequently exposed via an open index or backup bucket, attackers gain a clean database of verified Aadhaar numbers and active UPI addresses (VPAs). For law enforcement and security teams, finding where these exposures occurred across hundreds of server nodes is like looking for a needle in a haystack.

How LEAP Automates Detection Local-First

LEAP compiles advanced regular expression engines and search heuristics to WebAssembly (WASM). When a forensic analyst drags and drops a 2GB Nginx log archive into the LEAP browser interface:

  1. Slicing & Tokenization: The browser-based WASM thread slices the large file into manageable chunks using stream reading API buffers.
  2. Luhn Algorithm Verification: Rather than relying solely on simple regular expressions (which trigger thousands of false positives for any 12-digit number), LEAP applies Aadhaar-specific validation check calculations (Verhoeff algorithm) inside the client environment to ensure the matched string is a valid Aadhaar layout.
  3. UPI pattern matching: It tests string structures against standardized UPI patterns (e.g. `[a-zA-Z0-9.\-_]{2,256}@[a-zA-Z]{2,64}`) representing banks and payment providers.

Processing Performance

Because the engine is compiled using Rust and executes natively in the browser via WebAssembly, it can parse logs at speeds exceeding 150MB per second per CPU core, directly in the user's browser, using zero server resources.

Common Regular Expression Rules

For custom security scripting, forensic teams can configure LEAP rules. Here are the core patterns used to detect UPI VPAs and Aadhaar structures:

Aadhaar Number Detection Pattern:

const aadhaarRegex = /\b[2-9]{1}[0-9]{3}\s*[0-9]{4}\s*[0-9]{4}\b/g;

UPI Virtual Payment Address (VPA) Pattern:

const upiRegex = /\b[a-zA-Z0-9.\-_]{3,256}@[a-zA-Z]{3,64}\b/g;

Visualizing the Incident Timeline

Once LEAP parses the logs, it aggregates matching events to build an interactive timeline. This helps security investigators determine if the data exposure was an isolated developer debugging incident or a sustained web scraping campaign. If IP address distributions show a cluster of requests from a single ASN executing POST operations resulting in PII logging, it points to active exfiltration.

Conclusion

Forensic log analysis doesn't have to compromise user privacy. By leveraging modern client-side architectures, LEAP empowers Indian enterprises, security analysts, and law enforcement agencies to analyze massive log datasets instantly, locally, and with absolute confidentiality. Protecting digital boundaries begins by ensuring that the forensic investigation itself doesn't become a source of leakage.

Back to Blog