26/07/2026 17:03:21 UTC
TCP
6443 · K8S API
Scan de ports
port scan syn · via K8S API:6443 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
k gJ��Zs ��+�W�`i�-�"��ˉ�t��� Z ��hT�� >Q� ���X���7C�㪰O�ܡ �,�+̩�0�/̨ � 3 G E AP ���/fß����q
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +19
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
k gJ��Zs ��+�W�`i�-�"��ˉ�t��� Z ��hT�� >Q�
���X���7C�㪰O�ܡ �,�+̩�0�/̨ �
3 G E AP ���/f����q
Requête brute (extrait)
k gJ��Zs ��+�W�`i�-�"��ˉ�t��� Z ��hT�� >Q� ���X���7C�㪰O�ܡ �,�+̩�0�/̨ � 3 G E AP ���/fß����q��à г�E3�uʜG�!�MN ����� �K�z��yw5�zs S + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 368,
"payload_entropy": 6.677217544500935,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 37963,
"country": "CN",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 19
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b98c65b34036fadf42ac80258636a7df",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0001k\u0001\u0000\u0001g\u0003\u0003J\ufffd\u0013\ufffdZs\u001e\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\u0003\u0002\ufffd\ufffd\u02c9\ufffd\u0018t\u000e\ufffd\ufffd\ufffd Z\u0001\u001d\ufffd\ufffdhT\ufffd\ufffd\u001e>Q\ufffd\n\ufffd\ufffd\ufffd\u0011X\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0001\n\u00003\u0000G\u0000E\u0000\u0017\u0000A\u0004P\u000b\ufffd\ufffd\ufffd\/f\u00df\ufffd\u000e\ufffd\ufffd\ufffdq",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001k\u0001\u0000\u0001g\u0003\u0003J\ufffd\u0013\ufffdZs\u001e\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\u0003\u0002\ufffd\ufffd\u02c9\ufffd\u0018t\u000e\ufffd\ufffd\ufffd Z\u0001\u001d\ufffd\ufffdhT\ufffd\ufffd\u001e>Q\ufffd\n\ufffd\ufffd\ufffd\u0011X\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0001\n\u00003\u0000G\u0000E\u0000\u0017\u0000A\u0004P\u000b\ufffd\ufffd\ufffd\/f\u00df\ufffd\u000e\ufffd\ufffd\ufffdq\ufffd\ufffd\u00c3\u0000\u0433\u0a3b\ufffdE3\ufffdu\u029cG\ufffd!\ufffdM\u0015N \ufffd\ufffd\ufffd\ufffd\u0013\u0012\ufffd\u001d\ufffdK\ufffdz\ufffd\ufffdyw5\ufffdzs\u001eS\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001k\u0001\u0000\u0001g\u0003\u0003J\ufffd\u0013\ufffdZs\u001e\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\u0003\u0002\ufffd\ufffd\u02c9\ufffd\u0018t\u000e\ufffd\ufffd\ufffd Z\u0001\u001d\ufffd\ufffdhT\ufffd\ufffd\u001e>Q\ufffd\n\ufffd\ufffd\ufffd\u0011X\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0001\n\u00003\u0000G\u0000E\u0000\u0017\u0000A\u0004P\u000b\ufffd\ufffd\ufffd\/f\u00df\ufffd\u000e\ufffd\ufffd\ufffdq",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7efd8083d4540708cc38e9ffb99054d31ab8d85",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001k\u0001\u0000\u0001g\u0003\u0003J\ufffd\u0013\ufffdZs\u001e\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\u0003\u0002\ufffd\ufffd\u02c9\ufffd\u0018t\u000e\ufffd\ufffd\ufffd Z\u0001\u001d\ufffd\ufffdhT\ufffd\ufffd\u001e>Q\ufffd\n\ufffd\ufffd\ufffd\u0011X\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0001\n\u00003\u0000G\u0000E\u0000\u0017\u0000A\u0004P\u000b\ufffd\ufffd\ufffd\/f\u00df\ufffd\u000e\ufffd\ufffd\ufffdq",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "kgJ\ufffd\ufffdZs\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\ufffd\ufffd\u02c9\ufffdt\ufffd\ufffd\ufffd Z\ufffd\ufffdhT\ufffd\ufffd>Q\ufffd\n\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n3GEAP\ufffd\ufffd\ufffd\/f\u00df\ufffd\ufffd\ufffd\ufffdq",
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via K8S API \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 19
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +19",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001k\u0001\u0000\u0001g\u0003\u0003J\ufffd\u0013\ufffdZs\u001e\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\u0003\u0002\ufffd\ufffd\u02c9\ufffd\u0018t\u000e\ufffd\ufffd\ufffd Z\u0001\u001d\ufffd\ufffdhT\ufffd\ufffd\u001e>Q\ufffd\n\ufffd\ufffd\ufffd\u0011X\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0001\n\u00003\u0000G\u0000E\u0000\u0017\u0000A\u0004P\u000b\ufffd\ufffd\ufffd\/f\u00df\ufffd\u000e\ufffd\ufffd\ufffdq",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "port scan syn \u00b7 via K8S API:6443 \u00b7 (reconnaissance)",
"evidence_snippet": "kgJ\ufffd\ufffdZs\ufffd\ufffd+\ufffdW\ufffd`i\ufffd-\ufffd\"\ufffd\ufffd\u02c9\ufffdt\ufffd\ufffd\ufffd Z\ufffd\ufffdhT\ufffd\ufffd>Q\ufffd\n\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd7C\ufffd\u3ab0O\ufffd\u0721\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n3GEAP\ufffd\ufffd\ufffd\/f\u00df\ufffd\ufffd\ufffd\ufffdq",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
6443,
8080,
8265,
8545,
9222
],
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"eth-rpc",
"http",
"k8s-api"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 19,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}
26/07/2026 17:03:14 UTC
TCP
8545 · ETH RPC
Scan de ports
port scan syn · via ETH RPC:8545 · (reconnaissance)
Élevée
Moyen · 49
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ETH-RPC
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8545
Chemin / cible
—
Service
ETH RPC
Payload
GET / HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +23
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127.0.0.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206574685f72706320726561647920706f72743d383534350d0a",
"emulator_response_len": 38,
"bytes_in": 349,
"payload_entropy": 5.394119228423205,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "eth-rpc",
"app_proto": "eth-rpc",
"asn": 37963,
"country": "CN",
"dst_port": 8545,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a779b0f08170f257c28e2d1c0c9a6ce26b7a45f2",
"event_fingerprint": "74a2af80332fdc25f221a32628b85c5ad99a9fb3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 23
},
"named_classification_skipped": false,
"service_name": "eth-rpc",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0cb095e69e9e57ecc3fdcf4ec41add67",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8545,
"service": "eth-rpc",
"service_name": "eth-rpc",
"risk_score": 49
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7d24c11e9e9292ab190a1f004d18037a90bb35b",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"port": 8545,
"service": "eth-rpc",
"service_label_fr": "ETH RPC"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"attack_vector": "port scan syn \u00b7 via ETH RPC:8545 \u00b7 (reconnaissance)",
"target_port_label": "8545 \u00b7 ETH RPC",
"emulator_service": "eth-rpc",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ETH RPC \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 23
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "eth-rpc",
"service_label_fr": "ETH RPC",
"dst_port": 8545,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-eth-rpc",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +23",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"port": 8545,
"service": "eth-rpc",
"service_label_fr": "ETH RPC"
},
"attack_vector": "port scan syn \u00b7 via ETH RPC:8545 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"target_port_label": "8545 \u00b7 ETH RPC",
"emulator_service": "eth-rpc",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "eth_rpc",
"service_banner": "honeypot-eth-rpc",
"service_os": "linux",
"dst_port": "8545"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
8080,
8265,
8545,
9222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"web"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"eth-rpc",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 23,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
26/07/2026 17:03:13 UTC
TCP
8265 · HTTP
Scan de ports
port scan syn · via HTTP:8265 · (reconnaissance) · → /docker-compose.yaml
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
GET /docker-compose.yaml UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/docker-compose.yaml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/docker-compose.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /docker-compose.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /docker-compose.yaml HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac
Requête brute (extrait)
GET /docker-compose.yaml HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forward
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "3bbb8fd589a1c6561445293d25ec31c27a2956aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 342,
"payload_entropy": 5.4070621959673,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "f5da898f0544df0cb5a3d2db5f1ffd5c05b2c643",
"event_fingerprint": "496789b659c3e1ebb59b01a48f747d566c4e036b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "9763983892f6cebd8a51ab523640e20a",
"path_pattern_hash": "d91024f4d52a5546d3cddb98775be9d6"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac",
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forward",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac",
"evidence": {
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forward",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "492781dd4c58257454fcbbe8ca6348244850d34a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8265 \u00b7 (reconnaissance) \u00b7 \u2192 \/docker-compose.yaml",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8265 \u00b7 (reconnaissance) \u00b7 \u2192 \/docker-compose.yaml",
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:12 UTC
TCP
9222 · HTTP
Scan de ports
port scan syn · via HTTP:9222 · (reconnaissance)
Élevée
Élevé · 72
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
GET / UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 72
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
sap-sapcontrol-path
dns-rebind
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127.0.0.1
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 349,
"payload_entropy": 5.394119228423205,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "6dc242ecd1c85cf8670a5bba0f0c8e820416f179",
"event_fingerprint": "1b8cca1d928664aeb4aaf8d8923cb7be43d114e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0cb095e69e9e57ecc3fdcf4ec41add67",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"sap-sapcontrol-path",
"dns-rebind"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"sap-sapcontrol-path",
"dns-rebind"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82188ce1a7deb69757c11887449cb369fa4b9136",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"attack_vector": "port scan syn \u00b7 via HTTP:9222 \u00b7 (reconnaissance)",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9222 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:12 UTC
TCP
8265 · HTTP
Scan de ports
port scan syn · via HTTP:8265 · (reconnaissance) · → /service-account.json
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
GET /service-account.json UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/service-account.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/service-account.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Cred GCP service account
SSRF Localhost SSRF
Ligne de requête
GET /service-account.json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /service-account.json HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma
Requête brute (extrait)
GET /service-account.json HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwar
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "0617185592e48b3f8b0d3ea1e7c4d21bbf61837c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 369,
"payload_entropy": 5.406112228745549,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "f5da898f0544df0cb5a3d2db5f1ffd5c05b2c643",
"event_fingerprint": "d3e5ed8f858a44384e57fa0b0544d95ca1f7b832",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0476",
"pat-0340"
],
"matched_pattern_names": [
"Cred GCP service account",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0476",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0e5419740eed35cc10eafdb520e69f75",
"path_pattern_hash": "a7a779246988beb1556d3e33d2b29c53"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma",
"method": "GET",
"path": "\/service-account.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/service-account.json HTTP\/1.1",
"request_sample": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwar",
"payload_snippet": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma",
"evidence": {
"method": "GET",
"path": "\/service-account.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/service-account.json HTTP\/1.1",
"request_sample": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwar",
"payload_snippet": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be66fe5c210781e08722974423b9ec036a1e7aac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/service-account.json",
"request_line": "GET \/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma",
"attack_vector": "port scan syn \u00b7 via HTTP:8265 \u00b7 (reconnaissance) \u00b7 \u2192 \/service-account.json",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/service-account.json",
"request_line": "GET \/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8265 \u00b7 (reconnaissance) \u00b7 \u2192 \/service-account.json",
"evidence_snippet": "GET \/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Ma",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:11 UTC
TCP
8265 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8265 · (tentative d'exploit) · → /.env.old
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.old UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
50
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/.env.old
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/.env.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 75
Confiance : Confiance 100 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /.env
Ligne de requête
GET /.env.old HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
leak-8
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /.env.old HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl
Requête brute (extrait)
GET /.env.old HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 12
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "old",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "5c6d2af3e13d17105c8f5fb6187fb5c332303b42",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 331,
"payload_entropy": 5.3897586435117315,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 21,
"anomaly_count": 0,
"campaign_key": "4db3ba4a03db6ce4ec11c3fe52a5f4e10213103f",
"event_fingerprint": "931e93d7989fac1c25eb5a527ec6d41c435f56f0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0191"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/.env"
],
"pattern_ids": [
"pat-0340",
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "8627c53e6638ddc23519807e4e13badd",
"path_pattern_hash": "3807eb1255fb0315f3ffbb94c31e25e0"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"leak-8",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"evidence": {
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"leak-8",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"request_sample": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "533f19163a1b23b4fe8cf7b1bff173a06d7e6592",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_probe_env",
"http_sensitive_path",
"http_xff_loopback"
]
}
26/07/2026 17:03:11 UTC
TCP
8265 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8265 · (tentative d'exploit) · → /.env.swo
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.swo UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
42
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/.env.swo
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/.env.swo
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 75
Confiance : Confiance 100 % — Motif catalogue confirmé · 7 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /.env
Ligne de requête
GET /.env.swo HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /.env.swo HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl
Requête brute (extrait)
GET /.env.swo HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 12
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "swo",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "0aa5ed39664ac00a25bcccf95c24dae5c8c62898",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 331,
"payload_entropy": 5.392537146649326,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 18,
"anomaly_count": 0,
"campaign_key": "8afb45cbbbe18c120305238acb3414265c6ab8a1",
"event_fingerprint": "28f6f7f3dc78f49c3abf131c9a23a10f37af2d6d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0191"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/.env"
],
"pattern_ids": [
"pat-0340",
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "896f730c9826255aa6997ca5b4d5f4ff",
"path_pattern_hash": "97a4045a5cd9f696371a0bd955ef8ae9"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"method": "GET",
"path": "\/.env.swo",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.swo HTTP\/1.1",
"request_sample": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"evidence": {
"method": "GET",
"path": "\/.env.swo",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.swo HTTP\/1.1",
"request_sample": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68735eaf4be982257f1a2a5d828170951749a2bb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.swo",
"request_line": "GET \/.env.swo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.swo",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.swo",
"request_line": "GET \/.env.swo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.swo",
"evidence_snippet": "GET \/.env.swo HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_sensitive_path",
"http_xff_loopback"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
26/07/2026 17:03:10 UTC
TCP
8265 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8265 · (tentative d'exploit) · → /api/.env
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.env UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 75
Confiance : Confiance 100 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
cache-poison-xfh
cache-poison-forwarded
k8s-api
dns-rebind
Payload (extrait)
GET /api/.env HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl
Requête brute (extrait)
GET /api/.env HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 12
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "f5b7d21cf92d5caca6cd906725e72730e31bc18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 331,
"payload_entropy": 5.396504250041036,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 21,
"anomaly_count": 0,
"campaign_key": "9f2050acec688ef4c9a95395f2d94bfd621b3983",
"event_fingerprint": "64e6ae6e49fedfdfe67399dcc3250fe882a8e646",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "9e5f27344b2b81fb754c7cd328d6ce5a",
"path_pattern_hash": "3c658e3b68f996f41891a76e1d05a9a5"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950600:k8s-api",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"k8s-api",
"dns-rebind"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"evidence": {
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950600:k8s-api",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"k8s-api",
"dns-rebind"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a0388c52d0b90c0bbe9a3267878c465ab93bf39",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950600:k8s-api",
"951041:dns-rebind",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_probe_api",
"http_sensitive_path",
"http_xff_loopback"
]
}
26/07/2026 17:03:10 UTC
TCP
8265 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8265 · (tentative d'exploit) · → /.env
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
42
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 75
Confiance : Confiance 100 % — Motif catalogue confirmé · 7 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /.env HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb
Requête brute (extrait)
GET /.env HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127.0.
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 327,
"payload_entropy": 5.397292668073993,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 19,
"anomaly_count": 0,
"campaign_key": "7e9521eec0a7ee9f919c58d197353ed551a0f476",
"event_fingerprint": "a5d2e24cbcee7c769dc84e82a1d2bb0e545f7b33",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0191"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/.env"
],
"pattern_ids": [
"pat-0340",
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "fe13ee37d45f482e29df6ca2d0f0554d",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb",
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f3625e650393fbf820b99116caafaaa4a8539f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb",
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWeb",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_probe_env",
"http_sensitive_path",
"http_xff_loopback"
]
}
26/07/2026 17:03:09 UTC
TCP
8265 · HTTP
SSRF interne
ssrf internal · via HTTP:8265 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 72
Confiance : Confiance 54 % — Motif catalogue confirmé · 7 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
sap-sapcontrol-path
dns-rebind
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127.0.0.1
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 349,
"payload_entropy": 5.394119228423205,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "bd197227fe6cd3511bb95b79266f8c1ac5433e89",
"event_fingerprint": "196e34e5c3dd1607232b419d7e38c10d8a1a1dc0",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0cb095e69e9e57ecc3fdcf4ec41add67",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"sap-sapcontrol-path",
"dns-rebind"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"sap-sapcontrol-path",
"dns-rebind"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127.0.0.1\r",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee5714f4d2d7e2ec5f8dfce197166a5b715c573e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"attack_vector": "ssrf internal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit)",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:09 UTC
TCP
8265 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8265 · (tentative d'exploit) · → /actuator/logfile
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /actuator/logfile UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/actuator/logfile
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/actuator/logfile
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 75
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /actuator
Ligne de requête
GET /actuator/logfile HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /actuator/logfile HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS
Requête brute (extrait)
GET /actuator/logfile HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "ca81dadbf99a3c62e140bf99ad6d41a1dcd8a3c8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 339,
"payload_entropy": 5.3982135392442405,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 18,
"anomaly_count": 0,
"campaign_key": "d7bf2c0b9270eed7e57e06bf0caa062e0eb47367",
"event_fingerprint": "99068161a96b5fff8a968daf97e1e829d4622f92",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0232"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/actuator"
],
"pattern_ids": [
"pat-0340",
"pat-0232"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "8ca06f85ac08186f2750427908f10db9",
"path_pattern_hash": "a5db5df5e4c3194fc1ea58968235ef2d"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"method": "GET",
"path": "\/actuator\/logfile",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/actuator\/logfile HTTP\/1.1",
"request_sample": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-",
"payload_snippet": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"evidence": {
"method": "GET",
"path": "\/actuator\/logfile",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/actuator\/logfile HTTP\/1.1",
"request_sample": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-",
"payload_snippet": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ab6ec2af12d7213681fc317d77db608c5981bdb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/logfile",
"request_line": "GET \/actuator\/logfile HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/logfile",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/logfile",
"request_line": "GET \/actuator\/logfile HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/logfile",
"evidence_snippet": "GET \/actuator\/logfile HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_probe_actuator",
"http_sensitive_path",
"http_xff_loopback"
]
}
26/07/2026 17:03:09 UTC
TCP
8265 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8265 · (tentative d'exploit) · → /settings.py
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /settings.py UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/settings.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/settings.py
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 56%
Confiance classification
56%
Risque capteur
Élevé
· 71
Confiance : Confiance 56 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
pat-0112
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
LFI Django settings
Ligne de requête
GET /settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /settings.py HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A
Requête brute (extrait)
GET /settings.py HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host:
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "3d04c639f33f174cecedd8e2b5ee24fd5f889511",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 334,
"payload_entropy": 5.401853488910749,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "f5da898f0544df0cb5a3d2db5f1ffd5c05b2c643",
"event_fingerprint": "e0398effd66ce26afc96e7fbfec00d361c86c543",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 66,
"precision_signals": [
"pat-0112"
],
"kb_rule_ids": [
"pat-0112"
],
"matched_patterns": [
"pat-0340",
"pat-0112"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"LFI Django settings"
],
"pattern_ids": [
"pat-0340",
"pat-0112"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0f26202b73a013096ad22161331e977c",
"path_pattern_hash": "11cbdc1d0934c26ecc216cf25354d01f"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A",
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host:",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A",
"evidence": {
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host:",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ec41a3d8fed42afc05505242aa664918a4e9b38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 56 % \u2014 via HTTP",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"pat-0112"
],
"tags_summary_labels_fr": [
"pat-0112"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) A",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:08 UTC
TCP
8265 · HTTP
SSRF interne
ssrf internal · via HTTP:8265 · (tentative d'exploit) · → /containers/json
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /containers/json UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/containers/json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8265
Chemin / cible
/containers/json
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 72
Confiance : Confiance 54 % — Motif catalogue confirmé · 7 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /containers/json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /containers/json HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS
Requête brute (extrait)
GET /containers/json HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-H
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "7eef70fb7c77625376d0fb38152f32dff2913f1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 364,
"payload_entropy": 5.3867639385179436,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8265,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "1e9e8e99b7ad9b2f6ac4697e5b671a1869f7cd8d",
"event_fingerprint": "d3d0c263111c1277f76e2e0558905daa0163bf0b",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0acd55bdf28352497e9f6d4a76c0b9ec",
"path_pattern_hash": "94fcb0053fa2a8a4f8fb00e4943ca7ae"
},
"target_context": {
"dst_port": 8265,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS ",
"method": "GET",
"path": "\/containers\/json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/containers\/json HTTP\/1.1",
"request_sample": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-H",
"payload_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"evidence": {
"method": "GET",
"path": "\/containers\/json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/containers\/json HTTP\/1.1",
"request_sample": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-H",
"payload_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56eb450113efd89ff5b96e11ed92862d5f2ecae9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/containers\/json",
"request_line": "GET \/containers\/json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"attack_vector": "ssrf internal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/containers\/json",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8265,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/containers\/json",
"request_line": "GET \/containers\/json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8265,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8265 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/containers\/json",
"evidence_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"target_port_label": "8265 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8265"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback"
]
}
26/07/2026 17:03:07 UTC
TCP
8080 · HTTP
SSRF interne
ssrf internal · via HTTP:8080 · (tentative d'exploit) · → /version
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /version UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/version
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/version
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 72
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Docker API version
etcd version
Ligne de requête
GET /version HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /version HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple
Requête brute (extrait)
GET /version HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "76c5a6fe5f8bec907b8dcab1abdf135058b50bc3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 356,
"payload_entropy": 5.397899191646256,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "5b18596ed17c6f9455393ead837cf9ff71ff8d41",
"event_fingerprint": "5ca3239ddccc92386170b40cf46ed5f374ee20d5",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340",
"pat-0522",
"pat-0525"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Docker API version",
"etcd version"
],
"pattern_ids": [
"pat-0340",
"pat-0522",
"pat-0525"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "b1b9532ddf82b405622fdfd55404b3d7",
"path_pattern_hash": "c77d9d7f66686362a33d6f2622fa5690"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple",
"method": "GET",
"path": "\/version",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/version HTTP\/1.1",
"request_sample": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127",
"payload_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple",
"evidence": {
"method": "GET",
"path": "\/version",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/version HTTP\/1.1",
"request_sample": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 127",
"payload_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6cb21d95fe3b7206b3aed9a797d4d88964287eb8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/version",
"request_line": "GET \/version HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple",
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/version",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/version",
"request_line": "GET \/version HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/version",
"evidence_snippet": "GET \/version HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Apple",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback",
"net_web_probe"
]
}
26/07/2026 17:03:06 UTC
TCP
8080 · HTTP
SSRF interne
ssrf internal · via HTTP:8080 · (tentative d'exploit) · → /config.js
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config.js UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/config.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/config.js
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 72
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config.js HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /config.js HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App
Requête brute (extrait)
GET /config.js HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "67b3179b286c960b4be84ff433764afe1a997eeb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 332,
"payload_entropy": 5.411408084152777,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "5b18596ed17c6f9455393ead837cf9ff71ff8d41",
"event_fingerprint": "798957605520e6f5906f9f374566e056892329c1",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "0f5095751b58e6572010784a8e4a3fe8",
"path_pattern_hash": "0ad09149f0572f6cdaf5a224970ea0d2"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App",
"method": "GET",
"path": "\/config.js",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/config.js HTTP\/1.1",
"request_sample": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 1",
"payload_snippet": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App",
"evidence": {
"method": "GET",
"path": "\/config.js",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/config.js HTTP\/1.1",
"request_sample": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 1",
"payload_snippet": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea840819c8a863b8794b66a754d6abfa2bb27499",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.js",
"request_line": "GET \/config.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App",
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.js",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.js",
"request_line": "GET \/config.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.js",
"evidence_snippet": "GET \/config.js HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) App",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
26/07/2026 17:03:06 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env.production
Élevée
Élevé · 76
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.production UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
42
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 76
Confiance : Confiance 100 % — Motif catalogue confirmé · 7 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0194
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /.env
Probe /.env.production
Ligne de requête
GET /.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /.env.production HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS
Requête brute (extrait)
GET /.env.production HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-H
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "production",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "9b39fa6529cda07275007291b337879405a04c62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 338,
"payload_entropy": 5.3979873238476825,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 76,
"tag_count": 19,
"anomaly_count": 0,
"campaign_key": "0a2226f16e811b3db9a21af17d8edf438bd8f979",
"event_fingerprint": "e3c4252da545ab7f8af13f66a303b2abc7c91d0c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0191",
"pat-0194"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/.env",
"Probe \/.env.production"
],
"pattern_ids": [
"pat-0340",
"pat-0191",
"pat-0194"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "5d8970ff8b36e3b48a4b71e535e09796",
"path_pattern_hash": "a397c8c79032c8a19624fdccf1ae5680"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"method": "GET",
"path": "\/.env.production",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.production HTTP\/1.1",
"payload_snippet": "GET \/.env.production HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"evidence": {
"method": "GET",
"path": "\/.env.production",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/.env.production HTTP\/1.1",
"request_sample": "GET \/.env.production HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-H",
"payload_snippet": "GET \/.env.production HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc571a6aa787f2c435c4821ab4f065a634688806",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production",
"request_line": "GET \/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.production HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0194"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production",
"request_line": "GET \/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production",
"evidence_snippet": "GET \/.env.production HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950514:leak-1",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_sensitive_path",
"http_xff_loopback",
"net_web_probe"
]
}
26/07/2026 17:03:06 UTC
TCP
8080 · HTTP
SSRF interne
ssrf internal · via HTTP:8080 · (tentative d'exploit) · → /gcp.json
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /gcp.json UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950470:nosqli-3
950585:cache-poison-xfh
Cible HTTP
GET
/gcp.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/gcp.json
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 72
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /gcp.json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cache-poison-xfh
cache-poison-forwarded
dns-rebind
Payload (extrait)
GET /gcp.json HTTP/1.1
Host: 62.3.50.33
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl
Requête brute (extrait)
GET /gcp.json HTTP/1.1 Host: 62.3.50.33 Accept: */* User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 12
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "154d15e4123093178945f3086c67635c1429ea76",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "c5215effdcf0be37c8abe146b890ba1adee2e0c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 357,
"payload_entropy": 5.402634116052748,
"port_category": "registered",
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"service": "http",
"app_proto": "http",
"asn": 37963,
"country": "CN",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 12,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "5b18596ed17c6f9455393ead837cf9ff71ff8d41",
"event_fingerprint": "e9a0591c41d750cf92eaea0fe2487577444d87e4",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 37963,
"org": "Hangzhou Alibaba Advertising Co.,Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e938d9b4e587f6b1bd8f62c4da95ccb8",
"payload_hash": "d60973c25b13f6daecd929eb0593b2c3",
"path_pattern_hash": "7dc9411197d934e59d7255877400cc80"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"method": "GET",
"path": "\/gcp.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/gcp.json HTTP\/1.1",
"request_sample": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"evidence": {
"method": "GET",
"path": "\/gcp.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cache-poison-xfh",
"cache-poison-forwarded",
"dns-rebind"
],
"request_line": "GET \/gcp.json HTTP\/1.1",
"request_sample": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\/15E148 Safari\/604.1\r\nX-Forwarded-For: 127.0.0.1\r\nX-Forwarded-Host: 12",
"payload_snippet": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec38ada8c25243ca7410922bb8d63523a926eec0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/gcp.json",
"request_line": "GET \/gcp.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/gcp.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/gcp.json",
"request_line": "GET \/gcp.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3.1 Mobile\u2026",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/gcp.json",
"evidence_snippet": "GET \/gcp.json HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) Appl",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950470:nosqli-3",
"950585:cache-poison-xfh",
"950586:cache-poison-forwarded",
"951041:dns-rebind",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-forwarded-for",
"http_header_x-forwarded-host",
"http_header_x-forwarded-proto",
"http_host_header_injection",
"http_host_mismatch",
"http_xff_loopback",
"net_web_probe"
]
}