While unfortunately in french, the detailed write-up of the hack [0] is worth a read.
The first step was finding out the pre-prod sever through the hash of the site's favicon in Shodan [1]
[0] https://yggleak.top/fr/home/ygg-dossier#le-hack
[1] https://blog.shodan.io/deep-dive-http-favicon/
